CITY COUNCIL AGENDA ITEM

Date: November 19, 2020

To: Mark F. Miller, City Manager Lori Grigg Bluhm, City Attorney

From: Robert J. Bruner, Assistant City Manager

Subject: Forensic Accounting Investigation Corrective Action Plan (CAP) Update

History Plante & Moran, PLLC (Plante Moran) presented the findings of their forensic accounting investigation to City Council in a public meeting on July 17, 2019. The City Council authorized release of the report and directed City staff to post it on the City’s website and include it in the July 22, 2019 regular City Council meeting agenda packet. These steps ensured the final report became a public record.

Plante Moran’s report included an Internal Control Recommendation Log (“Control Log”) with seventeen recommendations to strengthen the City’s internal controls. A team of senior City staff was assigned to evaluate each recommendation. Teams began meeting during the week of July 29, 2019.

A report dated September 18, 2019 was included in the September 23, 2019 City Council agenda packet (P-02b) and a report dated September 30, 2019 was included in the October 7, 2019 City Council agenda packet (P-02a). These reports summarized the corrective actions taken related to expenses (recommendations #1, 2, 8, 11, 13, 14, 15, and 16) and City Council agenda memos (recommendation #3).

Plante Moran’s Control Log included three recommendations (#5, 6, and 7) regarding ethics and compliance. City Council members discussed the forensic accounting investigation report and the City Council’s power to conduct investigations in July 2019. The City Council subsequently adopted a series of resolutions (#2019-08-094, #2019-10-116, and #2019-12-153) culminating in the approval of a new Professional Services Agreement with Plante Moran on December 2, 2019.

The new investigation was delayed by the COVID-19 pandemic but Plante Moran informed the City it was in the process of finalizing the report in October 2020. On November 9, 2020, the City Council adopted resolution #2020-11-163 waiving the attorney client/work product privilege, to allow a public release of the investigative report, and directing City staff to include it in the November 23, 2020 City Council agenda packet.

The purpose of this report is to provide an update regarding the corrective actions taken by City staff as the City prepares to release the new investigative report.

1

CITY COUNCIL AGENDA ITEM

Recommendation 1: Reimbursement Methods (High Priority) City staff recommended discontinuing the petty cash reimbursement process through the City Treasurer's office. See attached report dated September 30, 2019 for details. Petty cash reimbursement has stopped and City staff is preparing an Administrative Memorandum to document the acceptable reimbursement procedures.

Recommendation 2: Reimbursement Approval (High Priority) City staff recommended copies of the City Attorney and City Manager’s monthly check requests and purchasing card reconciliations be provided to the City Council. See attached report dated September 30, 2019 for details.

Recommendation 3: City Council Agenda Memos (High Priority) City staff implemented a new electronic agenda preparation procedure in November 2019. See attached report dated September 18, 2019 for details. The new electronic process documents the approval of each agenda memo and creates an electronic record that may be reviewed if unapproved modifications are suspected.

Recommendation 4: New Hire Documentation (Low Priority) Plante Moran observed that sufficient documentation of exceptions to the standard hiring procedures was not always maintained. This exposes those involved in the hiring process to risk, should an issue surface subsequent to hire and the City lacks the adequate documentation regarding the decision- making process at the time of hire.

Accordingly, Human Resources updated the new hire checklist to include specific hiring procedures such as background checks. The City had been using the Internet Criminal History Access Tool (ICHAT), the only public resource for name-based Michigan criminal history background checks, and the Michigan Public Sex Offender Registry and National Sex Offender Public Website. In addition, Human Resources is now using background check services provide by Troy-based Credential Check for all full-time employees; Credential Check’s background includes a nationwide criminal history search. Background checks vary by position based on job responsibilities.

Human Resources has also implemented a regular procedure to document exceptions to the standard hiring process. Details of the exception will be recorded on the form by Human Resources; the exception will be approved by the Human Resources Director and reviewed (if appropriate) by the department director of the hiring department and/or the City Manager. The form will remain with the recruitment file but will be transferred to the personnel file if the candidate is hired. This will allow for the information to be retained appropriately by our standard record retention schedule. In the past any notes to support an exception remained with the recruitment file and would have been purged when the recruitment file was eligible for disposal. Retaining the information with the employee’s personnel file will ensure that the information will be maintained through the career of the employee and it will not be destroyed until the personnel file retention period has been exhausted.

2

CITY COUNCIL AGENDA ITEM

Recommendations 5, 6, and 7: Ethics & Compliance (High Priority) City Council strengthened its Code of Ethics and the Board & Committee Code of Ethics in November 2019. City Council has also scheduled a special meeting to further discuss its Code of Ethics on February 1, 2021. The new investigative report is intended to help address these recommendations. City staff will reevaluate these recommendations after the new report is released.

Recommendation 8: Meal Reimbursement Policy (Medium Priority) City staff recommended enforcement of the existing policies. See attached report dated September 30, 2019 for details.

Recommendation 9: Employee Use of City Amenities (Low Priority) This recommendation involves more than a dozen amenities and at least two chapters of the City Code (26 - Parks - General Regulations and 30 - Municipal Golf Courses). Plante Moran identified this recommendation as a low priority and implementation is highly complex. The low risk may not be worth the effort required to implement.

Recommendation 10: Emergency Purchases (High Priority) City staff recommended enforcement of the existing policies. More details will be provided in a future report.

Recommendation 11: Receipt Review (High Priority) City staff recommended discontinuing the petty cash reimbursement process through the City Treasurer's office. See attached report dated September 30, 2019 for details.

Recommendation 12: Vendor Due Diligence (Medium Priority) City staff found each of the suspicious transactions had verifiable explanations, and did not find any additional causes for concern.

Recommendation 13: Receipt Itemization (Medium Priority) City staff recommended enforcement of the existing policies. See attached report dated September 30, 2019 for details.

Recommendation 14: Expense Documentation (Medium Priority) City staff recommended enforcement of the existing policies. See attached report dated September 30, 2019 for details.

Recommendation 15: Enforcement & Consequences (Medium Priority) City staff recommended adopting the meals and incidental expense (M&IE) per diem rate established by the General Services Administration (GSA) rather than reimbursing City employees for the actual cost of meals within limits set by the City. See attached report dated September 30, 2019 for details. City staff is preparing an Administrative Memorandum to document the new travel policy but most City travel has been suspected since March 2020 so the new Memorandum has yet to be finalized.

3

CITY COUNCIL AGENDA ITEM

Recommendation 16: Excessive Tipping (Medium Priority) City staff recommended adopting the meals and incidental expense (M&IE) per diem rate established by the General Services Administration (GSA) rather than reimbursing City employees for the actual cost of meals within limits set by the City. See attached report dated September 30, 2019 for details. City staff is preparing an Administrative Memorandum to document the new travel policy but most City travel has been suspected since March 2020 so the new Memorandum has yet to be finalized.

Recommendation 17: Bid-splitting (Low Priority) All purchases in excess of ten thousand dollars ($10,000) must be approved by the City Council and competitive bids must be obtained, except where the Council determines an emergency exists or the public interest will be best served without obtaining sealed bids (City Charter Section 12.1). Plante Moran identified multiple transactions with characteristics indicative of purchase splitting to avoid the need for City Council approval. Split purchases occur when one larger purchase is split into two or more smaller purchases to reduce the purchase amount below a threshold value. At best, this may increase costs by reducing competition. At worst, it can be an act of corruption.

Plante Moran’s analysis did not verify any purchase splitting occurred but they recognized the potential for it and recommended the City consider implementing a periodic process to review for intentional threshold avoidance activity. The City will do so. In addition, the City already has several controls in place to mitigate this risk.

The Check Register page (https://o.troymi.gov/OpenTroy/CheckRegister) includes accounts payable checks from the current and previous fiscal years. Users can view and/or download a summary of checks by date, including vendor name and the amount paid. In addition, users can download check details including vendor name, the amount paid, invoice number, invoice date, and a description of the goods or service provided.

The Purchasing Contracts page (https://o.troymi.gov/OpenTroy/PurchasingContracts) provides a list of all purchases approved by the City Council including the Bid Number, Bid Name, Department, Vendor, Resolution Number, and Commencement Date. The Bid Name and Vendor fields are searchable so users can find purchases related to specific goods or service provided and/or the vendors that provide them.

When used together, these tools allow anyone to identify transactions with characteristics indicative of purchase splitting. Supporting documentation for suspicious payments may be requested by City Council members or anyone else (pursuant to the Freedom of Information Act) to ensure all payments are made in compliance with the City Code.

4

City of Troy  July 17, 2019 Forensic Investigation

TABLE OF CONTENTS

Executive Summary ...... 2

Background ...... 2

Interviews ...... 4

Information Received ...... 4

Definitions and General Principles of Internal Controls ...... 4

Analysis ...... 6

A. Data Collection Challenges ...... 6

B. Data Analytics ...... 7

C. Petty Cash and Purchasing Card Detail Testing ...... 11

D. Adverse Influence ...... 19

E. Additional Testing ...... 28

Signature ...... 2 8

ATTACHMENTS

 Schedule 1 - Summary of Potentially Problematic Petty Cash Transactions  Schedule 2 - Summary of Potentially Problematic Purchase Card Transactions  Internal Control Recommendation Log  ACFE Tone at the Top Article

July 17, 2019

Lori Grigg Bluhm, Esq. City Attorney, City of Troy 500 W. Big Beaver Rd. Troy, MI 48084

Re: City of Troy – Forensic Investigation

Dear Ms. Bluhm:

As requested, we provided forensic investigative services to assist you in your representation of the City of Troy (the “City” or “Troy”). Our work included an analysis of select policies, procedures, and transactions occurring at the City between November 2012 and March 2018 (our “scope period”). More specifically, we:

 Obtained an understanding of Troy’s purchasing policies and guidelines in place during our scope period.  Performed data analytics on select accounting information to identify anomalies potentially indicative of problematic activity.  Analyzed select petty cash activity to identify if funds were diverted.  Analyzed select purchasing card transactions performed by the former City Manager, Brian Kischnick (“BK”), other City employees on BK’s behalf, and/or other City employees at BK’s direction.  Interviewed multiple City employees to accomplish the aforementioned procedures, in addition to identifying if BK made questionable purchases and/or intentionally circumvented the City’s purchasing polices.  Identified recommendations to strengthen the City’s internal control environment, where applicable.

Our report is to provide you with the results of our analysis. It is not intended to express an opinion on the City’s internal controls or financial statements in accordance with standards issued by the American Institute of Certified Public Accountants.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 2 of 28

EXECUTIVE SUMMARY

DiLisio Contracting, Inc.: We did not identify new findings regarding DiLisio beyond the activities previously communicated to Council in connection with the FBI investigation.

Data Analytics: Our data analytics did not identify transactions that were conclusive of problematic activity. However, we identified several transactions of which we recommend the City researches to determine appropriateness.

Petty Cash and Purchasing Card: We identified an overall pattern of problematic behavior with the use of petty cash and purchasing cards, including the apparent purchase of personal items. Due to the lack of records, it is difficult to quantify the totality of questionable expenditures.

Adverse Influence: We identified an overall pattern of behavior exuded by BK whereby he used his positon as City Manager to use City funds and/or influence others for special favors and personal gain.

Tone at the Top: A culture of complicity plagued the City that allowed behaviors not in the best interest of the City to continue.

Recommendations: We provide suggestions to strengthen the City’s control environment in the Internal Control Recommendations Log.

BACKGROUND

Background: BK served as Troy’s City Manager from 2012 until March 12, 2018, when he was discharged for cause. It is our understanding law enforcement conducted an investigation related to BK soliciting and receiving bribes from a City vendor while working as the City Manager. BK executed a Guilty Plea for accepting a bribe from DiLisio Contracting, Inc. (“DiLisio”).

As a result, the City issued a Request for Proposal with the following objectives:

1. Demonstrate to City Council and City of Troy residents whether or not money was taken from petty cash or any other accounts or City of Troy resources. 2. Review the internal controls as they relate to the City’s disbursements and also review business areas that had the possibility of being adversely influenced by the former City Manager during his term of employment.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 3 of 28

3. Review City of Troy existing internal processes and provide an opinion as to the ability to get and/or take money in accordance with the City’s existing policies and procedures.

After discussions with you and City Management, it was concluded that, given the depth of the FBI investigation, the City’s funds would be best spent with us investigating transactions involving other vendors (i.e., not DiLisio) to identify if the problematic activity was more pervasive than disclosed and/or uncovered by the FBI. However, while we did not focus our interviews on transactions involving DiLisio, we still inquired with City personnel whether or not they were aware of additional transactions involving this vendor that were not addressed by the FBI. In addition, by the design of our data analytics, transactions involving DiLisio were within the scope of our testing. No transactions involving DiLisio were flagged by our analytics and no new information involving this vendor was identified through our interview process. Therefore, DiLisio is not referenced further in this report.

It is our understanding that, in June 2016, the City received multiple whistleblower complaints from purchasing and finance personnel regarding improper activities and/or transactions directed by BK. In response, the City hired the law firm, Kirk, Huth, Lange & Badalmenti, PLC to perform an investigation of the allegations. The law firm issued a report on July 14, 2016 (the “Lange Report”) and presented their findings to Council. This report detailed a pattern of problematic activities performed by BK. It is our understanding that, upon learning of these activities, Council held a closed session and determined their response actions. It is possible these actions may not have been fully implemented by City Management and/or lacked the level of severity necessary to dissuade BK, since BK continued to perform problematic activities. During interviews, multiple City personnel stated they deemed, (in summary) Council’s actions and/or lack of action against BK in response to the problematic findings provided BK a sense of security, in that, he could do whatever he wanted without getting into trouble.

Given the overlap in dates between the Lange Report scope period and our scope period, our testing surfaced many of the problematic transactions that may have already been known to Council. However, Lange’s report was focused on investigating the appropriateness of the transactions, whereby, our analysis was focused on how the transactions occurred and what process and/or control(s) could be implemented to mitigate future risks of those transactions recurring.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 4 of 28

INTERVIEWS

In order to complete our objectives, we conducted at least one interview each with 16 key City employees. (In some instances, multiple interviews were conducted.)

INFORMATION RECEIVED

We obtained and analyzed the following information for the scope period of November 2012 through March 2018, unless otherwise stated:

 Accounts payable (“AP”) disbursement data  Vendor master file (“VMF”)  Invoice registers for the General Account and Trust Account  Check registers for the General Account and Trust Account  Purchase order detail reports  Payroll registers  Employee direct deposit report  Employee master file (“EMF”)  Payroll check register  Petty cash activity reports  General ledger(s) (“GL”)  BK’s personnel file  City of Troy organizational chart  City of Troy employee handbook  Purchasing card activity, monthly statements, and select supporting documentation  The Lange Report (the redacted version only)  Select supporting information provided to us during interviews  Select Administrative Memorandums (“Admin Memos”)

DEFINITIONS AND GENERAL PRINCIPLES OF INTERNAL CONTROLS

Internal controls are systematic measures instituted by an organization for many purposes. Some of those purposes include: to detect and deter errors, fraud and theft, to safeguard its assets and resources, and to ensure adherence to its policies and plans.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 5 of 28

Key general principles of successful internal controls programs include:

 Tone at the Top – When the tone set by management upholds honesty, integrity and ethics, employees are more likely to uphold those same values;  Separation of Duties – Duties divided so that no one person has complete control over a key function or activity;  Authorization and Approval – Proposed transactions are authorized when they are consistent with policy and funds are available;  Custodial and Security Arrangements – Responsibility for custody of assets is separated from the related record keeping;  Review and Reconciliation – Records are examined and reconciled to determine that transactions were properly processed and approved;  Physical Controls – Equipment, inventories, cash and other assets are secured physically, counted periodically, and compared with amounts shown on control records;  Training and Supervision – Well-trained and supervised employees help ensure that control processes functioned properly;  Documentation – Well-documented policies and procedures promotes employee understanding of job duties and help ensure continuity during employee absences or turnover; and  Cost/Benefit – Costs associated with control processes should not exceed expected benefits.

One of the best defenses against business failure and an important driver of business performance is a strong internal control environment. In addition, establishing proper processes is only part of the equation, in that, it is necessary that the employees responsible for overseeing, implementing and enforcing the controls are performing their duties with diligence and thoroughness, or the established processes are rendered ineffective. We provide recommendations in response to findings outlined throughout this report in the Internal Control Recommendation Log (“Control Log”), included with this report. We have subjectively prioritized these recommendations. In addition, we provide a research article written by the Association of Certified Fraud Examiners (ACFE) regarding the impact and importance of the Tone at the Top.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 6 of 28

ANALYSIS

We outline our analysis and findings using the following five (5) categories to accomplish the objectives the City requested of us.

A. Data collection challenges

B. Data analytics

C. Petty cash and purchasing card detail testing

D. Adverse influence

E. Other potential findings

A. Data Collection Challenges

During our engagement, we received incomplete data in response to our requests. Receiving incomplete information required multiple follow-up conversations to obtain the necessary data. Additionally, these challenges caused us to deviate from our work plan and dedicate unforeseen time to investigate why the data was not provided and obtain answers to questions, such as:

 Was the incomplete production intentional to conceal problematic transactions and/or problematic employees?  Was the incomplete production due to a computer system/reporting issue?  Were filters applied to the data prior to providing it to us?

Select examples of the data challenges we incurred include:

 Employees missing from the EMF;  Check numbers missing from the check register;  Purchase orders missing from the purchase order register; and  The GL did not balance.

In summary, our research into these issues found that there was no intentional production of incomplete and/or manipulated data. Examples include, but are not limited to the following:

 Select City personnel applying filters to the data prior to providing it to us in an attempt to reduce the size of the files.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 7 of 28

 Incomplete productions due to timing differences between EFT’s actually occurring and EFT’s being recorded in the general ledger.  Extracting from the system a custom General Ledger, which included one-sided, system- generated soft-close entries.

B. Data Analytics

Data analytics is the process of examining sets of data to identify patterns and trends. Data analytics can be utilized to identify anomalies within data sets which are indicative of problematic transactions. We worked with City personnel to obtain select accounting information. In addition, we performed background research using Thomson Reuters CLEAR1 (our subscription based research software) to identify associations between select individuals and businesses.

We performed the following data tests:

1. Comparing results from our background research on BK to the EMF; 2. Comparing results from our background research on BK to the VMF; 3. Comparing employee addresses in the EMF to vendor addresses in the VMF; 4. Preliminary analytics to identify indicators of bid splitting; and 5. Comparing results from our background research on the Finance Director to the VMF.

We have provided the results of our analytics in the following format:

Potential risk: The potential scheme that may occur based on current City procedures.

Data test performed to address risk: The test performed to address the aforementioned risk.

Results from data test: A summary and/or visual representation of our test results.

Research needed to identify if results are problematic: The follow-up action(s) we recommend you perform based upon the Results from data test.

1https://www.thomsonreuters.com/en/products-services/legal/corporate-and-government- practice/clear.html

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 8 of 28

B1. Comparing results from our background research on BK to the EMF Potential risk: BK could influence someone in the City’s HR Department to add a fictitious employee. Alternatively, BK could influence someone to add a BK relative as an employee and divert funds to them, regardless of whether they performed work for the City or not.

Data test performed to address risk: We extracted CLEAR’s results of BK’s addresses during the time period of 2015 through 2019. In addition, we extracted CLEAR’s results for the available names and addresses of BK’s relatives.

We also analyzed BK’s social media connections to identify related parties. However, we noted (and subsequently confirmed via interviews) that BK commonly added City personnel to his social media network. Therefore, comparing BK’s social media connections to the EMF would not provide meaningful results.

We utilized a fuzzy match function2 to compare the data collected from our background research to the EMF, searching for matching names and/or addresses.

Results from data test: We identified one (1) address match (i.e., an address listed in our CLEAR results and the EMF). This address, 3555 Salem Road, was listed for Valerie Gale in the EMF. Ms. Gale was listed as an inactive employee since September 27, 2016. We reviewed the payroll registers and identified she was paid $6,539 in gross during our scope period. In compliance with Section 5.16(b) of the City’s Charter, Ms. Gale was disclosed in a City Council Agenda Item dated January 13, 2016 to be BK’s mother-in-law. Council approved her to be hired as a part-time Library Aide.

While not the focus of our work, we discovered two (2) employees and one (1) presumed system user ID included in the EMF which had the City of Troy address (500 W Big Beaver) as their listed address. Donald Lockard (EE ID number 1431), Linda Bockstanz (EE ID number 3), and Fixed Asset Employee (EE ID number 1). We reviewed the payroll register and identified no payments to these individuals; however, Linda Bockstanz received 65 individual $0.00 checks during our scope period. Because of the unusual nature of these checks (zero-value), we learned Ms.

2 Fuzzy matching is a technique used in computer-assisted translation as a special case of record linkage. It works with matches that may be less than 100% perfect when finding correspondences between segments of a text and entries in a database of previous translations.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 9 of 28

Bockstanz is a retiree, receiving retirement health insurance coverage through the City. The City’s system generates a zero-value check when processing the insurance coverage.

Research needed to identify if results are problematic: We recommend someone outside of payroll confirm the address information of Donald Lockard and Linda Bockstanz.

B2. Comparing results from our background research on BK to the VMF. Potential risk: BK could influence someone in the City’s Finance Department or Purchasing Department to create a fictitious vendor in the system. Alternatively, BK could procure goods or services from a related party vendor and collude to divert funds.

Data test performed to address risk: We extracted CLEAR’s results of BK’s addresses during the time period of 2015 through 2019. In addition, we extracted CLEAR’s results for the available names and addresses of BK’s relatives. We also reviewed BK’s social media connections to identify additional related parties.

We utilized a fuzzy match function to compare the data collected from our background research to the VMF, searching for matching names and/or addresses. We excluded addresses affiliated with the City from our results to reduce the population of false positives (at times, employer addresses may show up in our CLEAR research).

Results from data test: We identified 12 matches of vendor names between the VMF and the background research performed on BK. We identified eight (8) of the matches were either current or former employees of the City, established as vendors for expense reimbursement purposes. The remaining four (4) matches were not employees (i.e., not listed in the EMF).

We did not identify any address matches using this same methodology.

Research needed to identify if results are problematic: We provided the 12 matches to you and you conveyed that all were determined as valid.

B3. Employee addresses in the EMF matching vendor addresses in the VMF

Potential risk: A scheming employee could add an unauthorized (i.e., fictitious) vendor to the VMF to divert funds.

Data test performed to address risk: We performed a match to identify employee addresses in the EMF that are within .01 miles (53 feet) of the vendor address in the VMF.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 10 of 28

Results from data test: This match generated over 400 results. We analyzed this listing and identified nearly half of the matched items appeared to be employees set up as vendors for the purposes of receiving expense reimbursements.

Therefore, we manually reviewed the results to isolate vendors listed with apparent “business names" (i.e., names that did not appear to be an employee’s name). This isolation identified 15 vendors, seven (7) of which were paid over $2,500. These seven (7) vendors and the associated employee matches have been provided to you for further research.

Research needed to identify if results are problematic: We recommend someone outside the AP process review the vendors for reasonableness and ensure no problematic conflicts of interest exist.

B4. Preliminary analytics to identify potential indicators of bid splitting Potential risk: City policy requires Council approval for purchases over $10,000. A scheming employee could split purchases into smaller amounts that collectively sum to an amount over the $10,000 threshold to circumvent this policy and, therefore, divert funds.

Data test performed to address risk: We performed preliminary analytics to identify vendors who were collectively paid over $10,000 by individual payments less than $10,000.

Results from data test: Our analysis identified nearly 600 vendors that received a total of over $10,000 by individual payments less than $10,000. In addition, we identified checks paid just below the $10,000 threshold. We have provided a sample of flagged transactions for reference, below:

Invoice Invoice Bank Account Number Date GL Date Description Amount Name 18217 10/13/16 11/03/16 I-75 Mobile Environmental Testing 5,865.50 GENERAL 18232 11/14/16 11/14/16 FAR Delineation I-75 Mobil 9,478.00 GENERAL

162086 07/28/16 08/05/16 TUITION-K9 ACADEMY 2,500.00 GENERAL 162085 07/22/16 08/16/16 K-9 Patrol Dog 9,500.00 GENERAL

091914 12/19/14 12/22/14 LTL Somerset Pines - South Blvd 9,999.00 GENERAL 1513 10/25/13 12/12/13 Demolition 9,900.00 GENERAL

However, based on representations during our interviews, BK would direct staff to approve purchases exceeding the threshold without obtaining the appropriate Council approval. Therefore, splitting large purchases into smaller amounts would not be necessary to avoid Council

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 11 of 28 approval. Based on this information, we did not perform further research on our preliminary analytics results, but can do so upon request.

Research needed to identify if results are problematic: N/A

C. Petty Cash and Purchasing Card Detail Testing

Policies

The City maintains a petty cash reimbursement process for employees to be repaid for business expenses they personally incur. The following excerpt from Administrative Memorandum 1-PU- 3 details the petty cash process.

Select City personnel and/or departments utilize purchasing cards to make City related purchases. Administrative Memorandum 1-PU-25 details the purpose, policies and procedures for the purchasing cards. The following is an excerpt from the memorandum explaining the intended purpose of the purchasing cards.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 12 of 28

During interviews, City personnel represented that BK had a purchasing card assigned to him from August 2017 through March 2018 in addition to access to the City Manager’s Office card. We obtained the activity for the following purchase cards.

 City Manager’s Office (x3581) – for our scope period. It is our understanding that BK was responsible for a significant majority of this card’s activity.

 Brian Kischnick (x5515) – for the period August 2017 through February 2018

The following tables summarize the transactions on each account.

City Manager's Office (x3581) 2012 2013 2014 2015 2016 2017 2018 Total Meals $ 168.00 4,739.10$ 12,231.04$ 28,937.81$ 16,960.90$ 9,859.13$ 2,454.11$ $ 75,350.09 Training 959.00 9,205.90 5,905.20 19,742.75 6,955.00 6,748.49 2,476.00 51,992.34 Supplies 168.26 923.23 8,510.23 5,011.94 6,823.92 5,015.14 2,863.89 29,316.61 Hotels 97.18 6,831.82 2,138.26 3,196.73 6,035.44 2,755.74 110.25 21,165.42 Member Dues - 2,154.00 2,689.92 2,240.40 3,315.00 1,891.98 50.00 12,341.30 Transportation - 242.80 480.00 2,803.32 5,136.03 124.00 - 8,786.15 Subscription - 893.50 868.95 984.95 785.52 679.00 348.00 4,559.92 Technology - 148.74 89.29 2,231.16 119.93 359.88 249.95 3,198.95 Miscellaneous - - 40.95 - 525.03 1,215.88 50.00 1,831.86

Total 1,392.44$ 25,139.09$ 32,953.84$ 65,149.06$ 46,656.77$ 28,649.24$ 8,602.20$ $ 208,542.64

Brian Kischnick (x5515) 2017 2018 Aug Nov Dec Jan Feb Total Gordon Food Store $ - 153.44$ -$ -$ -$ 153.44$ Mon Jin Lau - - - 150.19 - 150.19 Ocean Prime - - - 94.20 - 94.20 Lansing Brewing Company - - - 85.45 - 85.45 McCormic & Schmick 66.94 - - - - 66.94 Lebanese Grill - - - 36.90 26.15 63.05 Home Depot - - - - 59.96 59.96 Capital Grille - - - 58.64 - 58.64 Luxe Bar - - - 43.39 - 43.39 Thai Taste 30.00 - - - - 30.00 CVS - - 10.37 - - 10.37

Total $ 96.94 153.44$ 10.37$ 468.77$ 86.11$ 815.63$

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 13 of 28

We performed a detailed analysis of select petty cash and purchasing card transactions.

Detailed Analysis

We selected the following transactions and analyzed the supporting documentation:

 30 petty cash transactions.  All 12 transactions from BK’s purchasing card.  25 transactions from the City Manager’s Office card.

We utilized BK’s personal calendar to select transactions on days with meetings, travel, his son’s hockey tournaments, and/or time periods when personal purchases were more likely to occur.

Our analysis identified several potential issues, which we summarize below.

C1. Phone accessories The Lange Report identified phone accessories as a potentially problematic purchase. We identified multiple cell phone accessory purchases that may be personal purchases, as shown by the Petty Cash Voucher below.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 14 of 28

C2. Meetings on the weekend It was represented to us that City business meetings are not regularly scheduled on the weekend. We identified multiple restaurant receipts for weekend meals represented as business meetings, as shown by the purchase card receipt below (which also contains a “math” error as the check amount plus the tip amount does not equal the total listed).

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 15 of 28

C3. Potentially altered receipts We identified several receipts that appear to have been altered using white-out. We also identified receipt amounts that do not agree to the corresponding charge on the card, which is an indication that the supporting documentation may be altered. An example of this is shown in the petty cash receipt below.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 16 of 28

C4. Tips over 25% It was represented to us that BK may have paid excessive tips in exchange for alcohol and/or other unallowable purchases not appearing on receipts. To address this potential issue, we identified meal receipts with tips exceeding of 25% of the bill amount, an example of which is shown below.

C5. Missing receipts The City allows personnel to sign an affidavit as supporting documentation if receipts are lost, damaged, or otherwise unavailable. Even with this option available, we identified multiple purchases lacking any supporting documentation.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 17 of 28

C6. Non-itemized receipts It was represented to us that, at times, BK may have submitted non-itemized receipts to hinder the City from identifying unallowable purchases. For example, the receipt he submitted for the Luxe Bar on January 24, 2018 at 22:54 (10:54PM) totaled $43.39, but did not include the list of items purchased. We identified numerous receipts in our sample population that did not contain the details of items/services purchased (i.e., non-itemized), an example of which is shown below.

C7. Meals exceeding the travel policy Administrative Memorandum 1-P-1 details the maximum price range for meals an employee can purchase when out-of-town on City related travel, as shown below:

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 18 of 28

We identified multiple out-of-town meals within our sample population that exceeded this policy, an example of which is shown below.

In addition, we identified multiple local meals within our sample population exceeding the policy limit; however, the policy appears to only reference out-of-town meals. We could not identify/locate a policy relating to local meals and, therefore, although the meals appear excessive in both amount and quantity, we are unable to determine if those meals also violated City policies.

Conclusion

We identified 28 transactions of the 67 transactions analyzed, or 42%, contained at least one (1) potentially problematic finding. Our findings are summarized in the table below.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 19 of 28

Purchase Card Petty Cash Total Count Percent Count Percent Count Percent Phone Accessories 0 0% 3 10% 34% Meeting on the Weekend 4 11% 0 0% 46% Potentially Altered Receipts 2 5% 1 3% 34% Tips over 25% 4 11% 1 3% 57% Missing Receipt 4 11% 1 3% 57% Non-Itemized Receipts 7 19% 10 33% 17 25% Travel Meals over Travel Policy 2 5% 0 0% 23%

At least one potentially problematic finding* 15 41% 13 43% 28 42%

* note the total of transactions is not the sum of the column. Some transactions may have multiple potential findings

Due to the lack of records, it is difficult to quantify the totality of questionable expenditures. We provide the details of our testing in Schedule 1 and Schedule 2. Upon request, we can provide the supporting documentation for our findings. In addition, we have provided recommendations to strengthen the internal control environment in the Control Log.

The Finance Director frequently made reference during our interview to the success of his “key controls” and that the process he created was not flawed, as many potentially problematic charges/receipts were flagged by his department during their review. The Finance Director stated that his methodology to analyze the flagged transactions performed by BK was to ask BK (i.e., the person incurring the expense) if the charge was reasonable or to inform him the charge was not proper (but then to allow it).

It appears the City/Finance Director implemented some controls/processes that identify problematic activity; however, if the “flagged” activity was ignored and/or not thoroughly researched, the controls were rendered ineffective/useless. The result is that this control environment was flawed when the individual (not the process) making the final determination of approval/denial (i.e., the Finance Director) did not enforce the City’s policies and procedures.

D. Adverse Influence

We performed interviews with multiple employees across various Departments. The ensuing subsections of this report describe representations made to us by City employees and, if applicable, the additional research we performed in response to those representations. We have not researched every representation made to us, as some representations were discussed in the Lange Report and others would cause us to incur fees significantly over the City’s budget. A

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 20 of 28 common theme was represented to us in our interviews, in that, employees experienced and/or heard of multiple instances of BK (primarily on his own, but at times with the Finance Director) either adversely influencing or, at a minimum, attempting to adversely influence others through intimidation, position, or power.

Our interviews and corresponding research has identified multiple recommendations for which we believe will strengthen the City’s internal control environment. We have provided those recommendations in the Control Log.

D1. Tone at the Top – A Culture of Complicity As previously stated, when the tone set by management upholds honesty, integrity and ethics, employees are more likely to uphold those same values. The tone at the top has a significant impact on the choices employees make regarding ethics, compliance and integrity. It is critical that the tone at the top values ethics, compliance and integrity and, as just as important, that consequences are enforced when employees do not uphold/display those values.

Overall, it appears there was a culture of complicity, in that, many people knew BK was violating policy (and potentially the law), but they were complicit in their actions due to the tone established by BK and Council.

It is our understanding multiple whistleblowers raised concerns about BK’s activity during our scope period. Further, the Lange Report (issued in 2016) identified and described multiple instances of unethical and/or non-compliant behavior displayed by BK. This information was communicated to Council for them to take corrective actions.

It was represented to us in our interviews that Council enforced minimal, if any, consequences against BK in response to his documented wrongdoing. Employees interpreted this inaction as Council’s approval of BK’s behavior. This tone established by the top conveyed to employees that BK was, quote, “protected.” The apparent poor tone at the top, combined with BK’s and, at times, other Officials’ aggressive behavior (to include screaming so loud it could be heard through the walls in other rooms) left many personnel to feel their employment was at risk if they questioned and/or “went against” BK. Some behavior was so aggressive employees even kept notes detailing these encounters.

A prime example of this poor tone trickling down (i.e., other employees making poor decisions) is the inaction of the Finance Director to prohibit/restrict BK from performing problematic

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 21 of 28 transactions. The Finance Director was aware of, at least some, problematic credit card charges BK incurred. This included the excessive phone accessories (including four Beats headphones that BK purchased outside of the allowable purchasing method). When informed of these transactions, the Finance Director choose to ignore and/or allow them, quoted in the Lange Report as follows:

”Because certainly somebody said you know what, how many Beats do you need, you know what I mean, within a year, and guess what, I think that’s misappropriation. But that’s a judgement call.”

When we inquired about these transactions in our interview with the Finance Director, he continually stated there was not a pattern and it was not material or did not reach his dollar threshold to report it, so he made a judgement call that the transactions were fine. It’s possible the Finance Director may have also ignored the problematic activity because he was afraid to lose his job (or get in trouble for questioning BK), as he was quoted in the Lange Report as stating:

“Between that and his contract, on, on, on quite honestly the small stuff, again, I’m not going to, I’m not dying on the sword over a thousand dollar cell phone bill and that’s why I said material, you know what I mean?”…

We question what would rise to his definition/determination of a “pattern,” when many issues were described in the 40+ page Lange Report. In addition, he even went as far as to cough “bull shit” during our interview when referencing some of the explanations provided by BK. However, he demonstrated these poor decisions were a reflection of his perception of the tone Council established, as he stated to us:

“In my mind, I’m pretty assured that certain Council members knew of this stuff going on…I knew the Council pretty well and you know what, they didn’t have a problem with it…the tone from the top…it’s part of doing business…I feel my observations were correct, as they did nothing after the (Lange) report…at the end of the day, if he didn’t hang himself, he’d still be here.”

One employee utilized the term “toxic” when referring to the culture in the City. It will be critical that the City establishes a tone at the top valuing integrity/ethics and enforcing consequences when integrity/ethics are not displayed, or the City could be destined for a repeat situation.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 22 of 28

D2. Jeep Grand Cherokee It was represented to us that, in January 2016, the PD was contacted by the City’s Motor Pool Superintendent about purchasing a Jeep Grand Cherokee for BK (per BK’s request). This purchase was in addition to the auto stipend of $425 a month that BK already received. It is our understanding this vehicle was not part of the City’s originally approved budget. The PD drafted a memorandum for Council’s approval, which described the vehicle, its cost and its use (i.e., that it was for use by BK). The PD provided a copy to BK for his review, with other employees copied. An image of that document is shown below.

It was represented to us that the document was subsequently altered by BK to include three (3) additional vehicles (which also were not budgeted). Additionally, BK removed all references to his use of the new vehicle. The revised memorandum presented to Council is provided below.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 23 of 28

Despite his significant revisions, BK left the document as “From: the PD, the Public Works Director, and the Superintendent of Fleet Operations.”

We cannot confirm the reason that BK altered the document, without the PD’s approval/consent, to add an additional three vehicles and remove any reference of his use of the Jeep; however, it

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 24 of 28 is likely it was done to conceal from Council that the Jeep was for him, given he was already receiving and continued to receive an auto stipend each month.

This process, whereby BK could modify any memo prepared by a Department Head prior to providing it to Council, is flawed and should be corrected, as discussed in the Control Log. In addition, employees represented to us that BK did utilize City vehicles for work while also receiving an auto stipend. Last, it is our understanding that, for tax purposes, BK claimed he used his personal car for work and claimed he drove more than the “maximum” amount of mileage needed to fully deduct the stipend from his taxable pay. We have not analyzed these representations as BK’s potential tax liabilities were outside our scope.

D3. “Forced” Compensation Increases It was represented to us that BK used his positon as City Manager to improperly influence compensation increases for select individuals. Multiple personnel represented that BK had a personal relationship with another employee, Kelly Molinar. We obtained a memorandum prepared by the Recreation Director, dated March 31, 2015, which recommended a $7,500 (15.3%) pay increase and additional cell phone reimbursement to Ms. Molinar. It was represented to us the Recreation Director was forced by BK to prepare this recommendation memorandum. Ms. Molinar resigned on June 15, 2018.

D4. Natural Gas Contract The Lange Report discussed a natural gas contract that was terminated by BK without Council’s approval. In addition, BK entered into a new contract, for a price exceeding $10,000, without Council’s approval. This situation was referenced by many employees during our interviews.

The City had, for many years, purchased their natural gas through the State of Michigan MIDeal Cooperative Purchasing Program (“MIDeal”). Council approval was not needed for these purchases, as Council had previously approved a blanket resolution to utilize this program.

Without Council’s knowledge, BK terminated this agreement. This termination caused the City to incur a $7,897 termination fee. Subsequently, BK directed the PD to enter into an agreement with AmeriFirst Energy. BK justified this action by stating it saved the City $10,140 (per Lange’s Report) and, therefore, this activity resulted in a net savings to the City. However, this activity was problematic as BK violated the City’s purchasing policies/processes in performing this transaction without Council’s knowledge and/or approval. However, despite the violation, Council

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 25 of 28 justified this activity in their press response to the Lange Report, highlighting that it saved the City money. However, it is our understanding nobody researched and/or analyzed what the MIDeal price was at the time of the cancellation. It is possible, due to declining gas prices at that time, the City could have saved more money by renegotiating with MIDeal and/or canceling and rebuying from them (vs. AmeriFirst).

It was represented to us in our interviews the “broker” from whom BK bought the gas was a friend/contact of his and possibly the Mayor’s.

The Lange Report documents email communication between the PD and the Finance Director in which the PD warns that leaving the MIDeals Contract would require Council Approval. The Lange Report states the warning to BK “was diluted by the Finance Director, rewritten by him, and then forwarded to the City Manager.” In addition to diluting the PD’s warning, the Lange Report further states the Finance Director assisted BK in his attempts to not seek Council’s approval by “weakly assert(ing) that this contract did not have to go to Council because it was an “emergency.”” The Lange Report provides an opinion that BK’s actions violated both the City Charter and the City Code.

Our investigation did not include the transactional details of this issue as they were previously addressed. However, the process used to terminate the MIDeals contract and enter the new agreement, which was in excess of $10,000 and, therefore, required Council approval, did not follow City policies and procedures and, per the Lange report, was a direct result of BK’s and the Finance Director’s actions. It appeared the “internal control process” initially worked, in that the PD identified an issue and informed management to prevent an error/improper transaction; however, the control appeared to be intentionally overridden to ensure this transaction took place. Having strong internal controls will not typically prevent the intentional overriding by management, but for having a strong tone at the top that ensures consequences will occur if this type of activity is performed.

D5. Customer Service Desk The City solicited bids for a custom desk at the East entrance to City Hall. PO#2016-00001435 was issued to Interior Environments in the amount of $4,260.00 for construction of the desk. It was represented to us the desk was determined unfit for the City’s purposes and, at the instruction of BK, the Public Works Director was directed to construct a second desk for the City with the understanding that he would be compensated. The Public Works Director utilized the City’s

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 26 of 28 purchasing cards to obtain the materials used for construction and tracked the hours he spent working on the desk.

It was represented to us that BK and the Finance Director instructed the Public Works Director to create an invoice for his time in order to be compensated.

 It is our understanding the PD questioned the invoice, as well as the process utilized for its approval. It was represented the Finance Director subsequently issued a purchase requisition for the desk and requested quotes (i.e., after the invoice was questioned). This supporting documentation was, therefore, to be created after the invoice was received and work already performed (i.e., not in the proper order/intent of the purchase requisition process). Last, it was represented to us that after it was determined the invoice would not be paid, the Finance Director asked that the purchase requisition he created be deleted from the system (versus merely cancelled).

 While the invoice was ultimately not paid, BK and the Finance Director attempted to approve/process this transaction outside of the normal purchasing process. While their intent is not known, one can reasonably assume it was to avoid the normal review process given the direct conflict of interest (with the vendor being an employee).

While it is understood that you are aware of this specific situation, it is important to outline the attempts to bypass/circumvent the established payment procedures.

D6. Slide Care, LLC Contract Section 12.1 of the City Code defines the circumstances the City Manager can act without Council approval. Paragraph 5 states the following:

The City Manager may make necessary purchases without sealed bid, prior Council approval, and in excess of the limits provided in this Chapter when in emergency, because of a natural disaster, civil disturbance or similar calamity is officially declared. Any such purchases shall be affirmed at the next regularly scheduled Council meeting.

On May 16, 2016, BK approved a $22,350.00 “emergency repair” for the City Aquatic Center water slides. As an emergency purchase, this contract did not go to bid and no additional quotes were obtained. It was represented to us the repair did not necessitate an emergency, as the

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 27 of 28

Center did not open for over a month subsequent to the purchase (i.e., there was plenty of time to follow the appropriate procedures).

The Lange Report provides an opinion that BK violated the City Charter by not bringing this matter to the Council for review and approval, as it did not meet the definition of an emergency.

D7. Free golf Personnel represented BK and his family received (through BK’s demands and intimidation) approximately 60+ free rounds of golf at the City’s course. This activity further demonstrates the aforementioned Culture of Complicity, as employees appeared too afraid to question BK’s improper behavior for fear of losing their jobs. This activity was identified by the City’s third-party golf course management company, Billy Casper, as shown:

D8. Community center/ aquatic passes Personnel represented BK used his position as City Manager to intimidate and demand free Aquatic center passes for his family and friends. You conveyed that the City incurred no loss from this matter because the passes were ultimately not delivered. However, BK improper demands demonstrates the aforementioned Tone at the Top.

Lori Grigg Bluhm, Esq. July 17, 2019 City of Troy – Forensic Investigation Page 28 of 28

E. Additional Testing

Financial Services Director (Finance Director) The Finance Director made representations to us acknowledging there may be some questionable expenses included in the purchase card and petty cash activity, but did not believe them to be significant. He represented to us that his role as the Financial Services Director is to identify if there is a pattern of questionable activity and the purpose of the purchases from a broader business perspective. As mentioned in previous sections, we identified 42% of the transactions tested contained at least one potentially problematic issue which one could reasonably conclude to be indicative of a pattern. Given the Finance Director’s knowledge of problematic activities and apparent complicity with BK, we concluded to perform background research on him and compare the results to the VMF.

Data test performed: We utilized CLEAR to obtain a listing of businesses associated to the Financial Services Director and manually searched the accounting system for these businesses.

Results from data test: The CLEAR research for the Financial Services Director identified one related vendor, Darling & Associates CPA’s PLC. We inquired with personnel regarding this connection and it was represented to us that the Financial Services Director was formerly affiliated with this entity as an outside contractor for the City before becoming an employee of the City. We analyzed the vendor disbursement detail for this vendor in the New World accounting system and noted they were not paid during our scope period.

Research needed to identify if results are problematic: We recommend the City continue to monitor future vendor payments for potential conflicts of interests.

SIGNATURE

Very truly yours,

PLANTE & MORAN, PLLC

Schedule 1 Page 1 of 1

Summary of Potentially Problematic Petty Cash Transactions

City of Troy - Forensic Investigative Services

Potentially Travel Meals Phone Meeting on the Altered Tips over Missing Non-Itemized over Travel At least one Potentially Sample Number Date Amount Accessories weekend Receipts 25% Receipt Receipts Policy Problematic Finding*

Sample 08 02/26/14 $ 61.32 XX X

Sample 10 11/01/17 65.58 XX X

Sample 12 08/27/15 66.73 XX

Sample 15 10/27/17 72.95 XX

Sample 17 05/23/13 79.49 X X

Sample 18 01/24/18 80.00 XX

Sample 20 04/25/13 84.76 X X

Sample 23 07/29/13 90.08 X X

Sample 24 07/02/13 91.16 XX

Sample 25 06/06/17 95.00 XX

Sample 26 04/22/14 96.65 XX

Sample 27 11/13/12 111.49 XX

Sample 29 03/18/14 119.29 XXX

Total 3 0 1 1 1 10 0 13

Percentage of sample with Potentially Problematic Finding 10% 0% 3% 3% 3% 33% 0% 43%

* note the total of transactions is not the sum of the column. Some transactions may have multiple potential findings Schedule 2 Page 1 of 1

Summary of Potentially Problematic Purchase Card transactions City of Troy - Forensic Investigative Services

Potentially Travel Meals At least one Transaction Meeting on the Altered Tips over Missing Non-Itemized over Travel Potentially Sample number Account Name Date Merchant Name Amount Weekend Receipts 25% Receipt Receipts Policy Problematic Finding*

Sample 01 BRIAN KISCHNICK 01/14/18 CAPITAL GRILLE 0138005 $ 58.64 X X X X

Sample 02 BRIAN KISCHNICK 01/15/18 #37 OCEAN PRIME TROY 94.20 X X

Sample 03 BRIAN KISCHNICK 01/24/18 LUXE BAR GRILLE 43.39 X X X

Sample 08 BRIAN KISCHNICK 08/03/17 THAI TASTE 30.00 X X

Sample 09 BRIAN KISCHNICK 08/02/17 1036 M&S TROY 66.94 X X X

Sample 11 BRIAN KISCHNICK 12/14/17 CVS/PHARMACY #08026 10.37 X X X

Sample 12 BRIAN KISCHNICK 01/26/18 LANSING BREWING COMPAN 85.45 X X X

Sample 17 CITY MANAGER'S OFFICE 06/26/16 NINO SALVAGGIO - TROY 195.95 X X

Sample 20 CITY MANAGER'S OFFICE 07/18/16 HAMPTON INN HOTELS 412.70 X X

Sample 24 CITY MANAGER'S OFFICE 10/02/15 SOMERSET INN CRUMPETS 10.37 X X

Sample 33 CITY MANAGER'S OFFICE 12/03/16 CECI ITALIAN RESTAURAN 28.90 X XX

Sample 34 CITY MANAGER'S OFFICE 12/03/16 CONNOLLY'S 121 W 45TH 20.33 X X

Sample 35 CITY MANAGER'S OFFICE 12/06/16 VIA BRASIL 35.40 XX

Sample 36 CITY MANAGER'S OFFICE 12/06/16 VIA BRASIL 66.72 XX X

Sample 37 CITY MANAGER'S OFFICE 12/30/15 ORCHID CAFE 48.48 XX Total 424472 15

Percentage of sample with Potentially Problematic Finding 11% 5% 11% 11% 19% 5% 41%

* note the total of transactions is not the sum of the column. Some transactions may have multiple potential findings Internal Control Recommendation Log Page 1 of 3

High Priority Medium Priority Low Priority

# Process Priority Observations Possible Risk Recommendations 1 Expense The City currently has multiple methods to *A scheming employee could submit copies of the same receipt The City should consider the cost/benefit of continuing to utilize the Reimbursement reimburse employee expenses. Employees can multiple times, through the different processes and receive petty cash reimbursement process through the Treasurer's office. If seek reimbursement through the accounts multiple reimbursements without detection. For example, an retained, at a minimum, the City should reconcile petty cash activity payable ("AP") process (Finance Department), employee could spend their own funds on behalf of the City and to the expense reimbursement process to ensure purchases are through the petty cash process (Treasurers' submit copies of the same receipt for reimbursement from the not being submitted multiple times. Additionally, Treasury staff office) and payroll. Finance office and the Treasurer's office. should compare purchases made by purchase cards to the petty *Alternatively, an employee could make a purchase using a City cash reimbursements to ensure the City has not already incurred purchasing card (i.e., without spending any of their personal the expense. funds). They could provide the receipt to AP to support their charge (per policy) and provide a copy of the receipt to the Alternatively, all expenses could be reimbursed using only one Treasurer's office for reimbursement through the petty cash method. This will reduce the opportunity for duplication and process. possibly provide the City with electronic data to periodically perform analytics, which can identify anomalies such as duplicate It is unlikely either scheme would be detected, as different purchases and abnormal spending activity. individuals are responsible for approving transactions occurring through the different processes and no reconciliations are performed.

2 Expense Treasury requires an approval signature for all An inherent subordinate relationship exists between the Office Someone separate from the City Manager's office, such as the Reimbursement petty cash reimbursements; however, the Office Coordinator and the City Manager positions. The City Manager Council, should review purchases made by the City Manager for Coordinator frequently approved the petty cash could, therefore, exercise influence and pressure the Office appropriateness. It may not be feasible for someone not in a requests made by the City Manager (the Coordinator to approve purchases. subordinate position to approve petty cash reimbursements, given "supervisor"). the timing of such reimbursements; however, the frequent review by Council will help ensure any inappropriate reimbursements are identified in a timely matter and will create a level of oversight.

Alternatively, remove the petty cash reimbursement process, having all expense reimbursements go through payroll.

3 General The former City Manager modified at least one As happened, these edits by the former City Manager misled the When memorandum communications are sent by Department memorandum prepared by a Department Head City's leadership. Heads, a copy should be routed by the Department Head to a prior to providing to Council. Council designee, such as the City attorney. This process provides for a secondary set of eyes to review. 4 Payroll Sufficient documentation for the new hire process The City may inadvertently hire employees that have a history that As discussed with the Director of Human Resources, the City now is not always maintained, specifically when would normally disqualify them from consideration. Those uses a checklist for new hire candidates; however, it does not exceptions are allowed to the standard hiring involved in the hiring process are also at risk, should an issue contain all details pertinent to the decision making process. This procedures. surface subsequent to hire and the City lack the adequate checklist should be updated to include specific hiring procedures documentation regarding the decision making process at the time such as background/conflict of interest checks. It should also of hire. include approvals and narratives to document exceptions (i.e., when items that traditionally preclude a candidate from being hired are overwritten/ignored). This checklist should be maintained as supporting documentation. Internal Control Recommendation Log Page 2 of 3

High Priority Medium Priority Low Priority

# Process Priority Observations Possible Risk Recommendations 5 Policies and The City lacked a process where employees City employees were discouraged from reporting potential The City amended the Whistleblower policy in August of 2017 Procedures could report policy and legal breaches without violations and inappropriate behavior of individuals in positions of thereby allowing complaints to be made to the City Manager, City fear of retaliation. authority. This can/did create a "toxic" environment that is highly Attorney, or directly to City Council as appropriate. susceptible to abuse at all levels. We highly encourage the City to review the tone at the top to ensure all members of management and oversight uphold values of honesty, integrity, and ethics, which will encourage employees to uphold the same values. 6 Policies and The overall tone at the top encouraged Management could/did use their position to adversely influence Training, combined with appropriate mechanisms to report issues, Procedures individuals in positions of authority to influence behavior that was not in the best interest of the City. is ideal to promote awareness. We highly encourage the City to subordinates. review the tone at the top to ensure all members of management and oversight uphold the same values of honesty, integrity, and ethics, which will encourage employees to uphold the same values.

7 Policies and The City's response to poor behavior/choices Given the response, behaviors continued that were not in the best We highly encourage the City to review the tone at the top to Procedures when they were made known often reinforced the interest of the City. ensure all members of management and oversight uphold values of wrongdoer's actions, from the employee honesty, integrity, and ethics which will encourage employees to perspective, since sufficient corrective action was uphold the same values. Further, a zero tolerance policy should seldom taken. be established, involving (enforced) consequences for non- compliance. 8 Policies and We identified numerous meal purchases to Occasional meal purchases may be an acceptable use of City The City should update polices to clearly define the acceptable use, Procedures upscale restaurants within petty cash receipts funds; however, without proper policies in place, meal threshold limitations, and supporting documentation requirements and purchase card activity. No policies currently reimbursements are susceptible to abuse by employees, for purchase cards and petty cash. exist documenting the appropriate use of City potentially leading to the personal use of City funds and an funds for meal reimbursements, outside of the inappropriate use of tax dollars. travel policy (i.e., there is no policy regarding "local" meals). 9 Policies and Free access to golf and the community center A sense of entitlement by leadership can be pervasive in an A policy should be implemented that outlines permissions for Procedures were provided to the City Manager. organization. personnel to use City assets. 10 Purchasing We identified a purchase that circumvented the Employees could continue to inappropriately label purchases as We encourage the City to enforce City policies, requiring all Council approval process by being emergency purchases as a method to circumvent the Council emergency purchases to go before Council in the subsequent inappropriately classified as an emergency approval process. meeting of the purchase for affirmation. purchase. *Additionally, Council should consider reviewing the check registers for payments exceeding $10,000. Supporting documentation should be requested for unfamiliar payments to ensure they weren't improperly excluded from Council's oversight/approval.

11 Purchasing We identified multiple instances of approved Conceivably, an employee could alter, forge, manipulate, etc. The City should ensure that questions are asked of unusual receipts which were either altered (e.g., white out, receipts to receive reimbursements for fictitious purchases or for receipts. Answers should be obtained and consequences should etc.) or contained mathematical errors (e.g., the amounts in excess of what they actually paid. Approving receipts be established for non-responsive answers. check amount plus the tip amount did not equal with these characteristics could indicate the current review the total). process is not thorough enough. 12 Purchasing A new vendor “vetting” process/checklist does not The Department Heads' vendor selections could be influenced by A vendor “vetting” policy should be established, including a conflict exist. The Department Heads can select vendors vendors who provide gifts and/or kickbacks. This influence could of interest review by someone other than the Department Head. to be utilized without additional authorization. cause the City to overpay for items/services. New vendors should be periodically reviewed.

Our analytics identified multiple instances of companies sharing an address with an employee being utilized as a vendor. Internal Control Recommendation Log Page 3 of 3

High Priority Medium Priority Low Priority

# Process Priority Observations Possible Risk Recommendations 13 Purchasing We identified numerous purchases on purchase Without itemized receipts, the reviewer of the purchases cannot The City has a policy in place requiring itemized receipts. cards and petty cash that lacked itemized distinguish between inappropriate and appropriate charges. Consequences for not providing itemized receipts should be supporting documentation. Summary receipts communicated and enforced. Consequences could include, loss of were provided, but these did not show the detail purchasing card authorization/use, personal liability for the charges, of the purchase. etc. However, we encourage the City to discuss options with their legal counsel. 14 Purchasing We identified numerous purchases using Without receipts, the reviewer of the purchases cannot distinguish The City has a policy in place requiring itemized receipts. purchase cards and petty cash that lacked any between inappropriate and appropriate charges. Consequences for not providing itemized receipts should be supporting documentation. Further, Affidavits did communicated and enforced. Consequences could include, loss of not exist to support the transactions with missing purchasing card authorization/use, personal liability for the charges, receipts. etc. However, we encourage the City to discuss options with their legal counsel. 15 Purchasing We identified instances whereby the former City A lack of accountability is established if consequences are not Consequences for not following policy should be established, Manager's receipts for meals during travel enforced when policies are violated, thus facilitating the communicated and enforced. Consequences could include, loss of exceeded the policy thresholds. It is our employee's willingness to commit additional violations. purchasing card authorization/use, personal liability for the charges, understanding there were no consequences for etc. However, we encourage the City to discuss options with their this policy violation. legal counsel. 16 Purchasing We identified numerous purchases using The lack of guidelines, policies and procedures can lead to The City should consider updating the policy to include the purchase cards and petty cash with excessive behaviors that are not in the best interest of the City. allowable tip percentages. Variances should be investigated for tips (over 25%+). reasonableness. 17 Purchasing Our analysis identified multiple transactions with Our analysis did not "verify" this occurred; however, conceivably While these characteristics can commonly occur in the normal characteristics indicative of bid-splitting (threshold some of these purchases could have been intentionally split to course of business, the City should consider implementing a avoidance) to keep transactions under the avoid Council approval. periodic process (including analytics) to review for intentional $10,000 threshold. threshold avoidance activity. ACFE Tone at the Top Article Page 1 of 12

TONE AT THE TOP:

HOW MANAGEMENT CAN PREVENT FRAUD IN THE WORKPLACE

PRESENTED BY THE ASSOCIATION OF CERTIFIED FRAUD EXAMINERS

WHAT IS THE “TONE AT THE TOP”? The connection between fraud and the “tone at the top” of an organization has received international attention over the last few years. Tone at the top refers to the ethical atmosphere that is created in the workplace by the organization's leadership. Whatever tone management sets will have a trickle-down effect on employees of the company. If the tone set by managers upholds ethics and integrity, employees will be more inclined to uphold those same values. However, if upper management appears unconcerned with ethics and focuses solely on the bottom line, employees will be more prone to commit fraud because they feel that ethical conduct is not a focus or priority within the organization. Employees pay close attention to the behavior and actions of their bosses, and they follow their lead. In short, employees will do what they witness their bosses doing.

Corporate greed at the executive level has destroyed hundreds of companies, drained stockholders of their investments, and left innocent employees without work. Ken Lay, Jeffrey Skilling, and Andrew Fastow from Enron; Bernie Ebbers from MCI/WorldCom; and Dennis Kozlowski at Tyco have become household names, and to many are synonymous with what is wrong with our corporate system. Furthermore, these individuals represent only a small percentage of the executives who have abused their posts of power to commit corporate fraud. Over 100 public company CEOs have been sued over the last five years for committing white collar crimes. These CEO criminals were sending a clear (though perhaps unintentional) message to their employees that committing fraud is acceptable as long as it makes the company seem profitable. They were obviously not setting an ethical tone at the top for their employees.

It is crucial to a company’s success for executives and management to set an ethical example (or tone) of how their employees should behave in the workplace. When those in top positions set the wrong, unethical example by committing fraud, their employees will take heed and follow in their bosses’ fraudulent footsteps, creating an entire culture of workplace fraud. When executives put pressure on their employees to meet unrealistic goals to yield profits for the company, they are essentially forcing employees to do whatever it takes to achieve those goals, whether they achieve those goals improperly or not. In their minds, the end justifies the means.

The National Commission on Fraudulent Reporting (called the Treadway Commission) released a groundbreaking study in 1987 that reported the casual factors that lead to fraudulent behavior and financial statement fraud. According to the Commission, the tone at ACFE Tone at the Top Article Page 2 of 12

the top plays a crucial and influential role in creating an environment in which fraudulent financial reporting is ripe to take place.

To set the right tone, those in top positions of management have to follow four very important steps: communicate to employees what is expected of them; lead by example; provide a safe mechanism for reporting violations; and reward integrity. These steps will be discussed in greater detail throughout this presentation.

STORY OF A CONVICTED CRIMINAL: WALT PAVLO Walt Pavlo is a convicted white-collar criminal who claims that he was pressured by his bosses to commit financial statement fraud at MCI/WorldCom. In January of 2001, Pavlo received a 41-month federal prison sentence for money laundering, wire fraud, and obstruction of justice. He was a Senior Manager in Billing Collections at MCI/WorldCom and dealt with customer payments, credits, and reconciliations of accounts. He felt pressure from upper level management at MCI/WorldCom to constantly achieve revenue growth in the company. Revenue projections for the company were laid out beforehand for each period, and employees were pressured to meet or exceed these projections. As Pavlo watched his bosses manipulate the company’s financial records, he soon began to manipulate them himself. Soon after, Pavlo’s own employees would learn to conduct fraudulent activity under their boss. Pavlo and his supervisors met to devise ideas on how to cook the company’s books. Financial records were manipulated by Pavlo, his superiors, and his colleagues in a widespread effort to fraudulently make the company look like it was meeting revenue growth projections, even though it wasn’t. Pavlo learned how to conceal uncollectible debt, which boosted the company’s assets and profits. Auditors eventually found unusual journal entries made by Pavlo and confronted him about it. It was then that he confessed to his fraudulent behavior.

Similar to many other people who commit white collar crime, Pavlo didn’t feel as though he was doing anything wrong in the beginning. He felt that he was doing his job and making his employers happy by altering the company’s financial data. In the long run, he incorrectly thought, the problem would remedy itself.

Even a highly-educated and well-experienced employee can become a white collar criminal. Pavlo received an Industrial Engineering degree from West Virginia University and his MBA from the Stetson School of Business at Mercer University in Atlanta, Georgia. He left behind his wife and two young sons when he served a two-year prison sentence for his financial crimes.

MAJOR FRAUD FACTORS There were three major factors that played a role in Walt Pavlo’s downfall. These factors are also common in many other fraud cases, particularly in larger companies. The fraud factors present in Walt’s case were:

• Meeting analysts’ expectations – Upper management and employees can become preoccupied with meeting analysts’ expectations. This preoccupation can lead to the pressure to commit fraud. In the case of Walt Pavlo, he felt extreme pressure from his

Tone at the Top Page 2 ACFE Tone at the Top Article Page 3 of 12

superiors to meet revenue projections. Employees and executives alike knew where the numbers needed to be in order to meet those projections, and they would meet to discuss different ways to manipulate the records so that it looked like MCI/WorldCom was living up to analysts’ expectations.

• Compensation and incentives -- Compensation and incentive plans may encourage unacceptable, unethical, and illegal conduct. In Pavlo’s case, in addition to his annual salary, he was eligible for thousands of dollars in stock options each year if he was able to meet his financial targets. He knew there was a financial incentive for cooking the books, so he manipulated the numbers. This created a financial gain for him and kept his bosses happy at the same time.

• Pressure to reach goals – The degree of fear and pressure associated with meeting numerical goals and targets also play a major role in fraud. It goes without saying that the more pressure and fear that an employee feels to meet revenue goals, the more likely they are to do whatever it takes to meet those goals. Pavlo stated that he learned how to conceal uncollectible debt and artificially boost the company’s assets and profits from his supervisors . With their help, he delayed write-offs and made the revenue numbers seem more attractive by making them look like they were collectible. Not only was this unethical, it was also illegal.

COMMON ETHICAL VIOLATIONS According to the 2005 National Business Ethics Study, the falsification and misrepresentation of financial records constituted 5 percent of the ethical violations reported in its survey. The other common types of ethical violations observed by employees (as well as their corresponding percentages) in the workplace were:

• Abusive or intimidating behavior of superiors toward employees (21 percent) • Lying to employees, customers, vendors, or the public (19 percent) • A situation that places employee interests over organizational interests (18 percent) • Violations of safety regulations (16 percent) • Misreporting actual time or hours worked (16 percent) • E-mail and Internet abuse (13 percent) • Discrimination on the basis of race, color, gender, age, or similar categories (12 percent) • Stealing, theft, or related fraud (11 percent) • Sexual harassment (9 percent) • Provision of goods or services that fail to meet specifications (8 percent) • Misuse of confidential information (7 percent) • Price fixing (3 percent) • Giving or accepting bribes, kickbacks, or inappropriate gifts (3 percent)

The NBES points out that every organization needs to be able to answer this question: How much misconduct is considered acceptable/inevitable within the company? This question will help prepare upper management to focus on how it deals with the problem of employee behavior.

Tone at the Top Page 3 ACFE Tone at the Top Article Page 4 of 12

WHY EMPLOYEES DON’T REPORT UNETHICAL CONDUCT Obviously, there are many different forms of misconduct that go on in the workplace and are observed by employees every year. Yet, many employees do not report this unethical conduct. According to the National Business Ethics Survey, only 55 percent of employees in 2005 said that they reported misconduct that they observed in the workplace. This was a 10 percent decrease from the previous survey in 2003.

In the past, employees under age 30 with little tenure (less than three years) were the least likely of any group to report ethical misconduct. This was due to their fear of retaliation from management and coworkers. They also felt that managers would consider them “trouble makers” if they reported unethical conduct. Middle managers and senior managers were most likely to report misconduct. However, in 2005, there was no significant statistical relationship between age/tenure and reporting. The top reasons for not reporting unethical conduct, according to the 45 percent of employees who did not report misconduct, are:

• No corrective action – Employees who were cynical of their organizations felt that nothing would be done if they came forward and reported the misconduct that they observed. In 2005, 59 percent of those who did not report misconduct felt as though no corrective action would be taken if they had reported unethical conduct. However, the NBES states that these employees may have had an unrealistic expectation for how organizations should handle misconduct reports. Privacy restrictions may prevent the company from telling the whistleblower how the report was handled and what punishments were assessed to the suspicious perpetrator. The company should stress the privacy factor in order to boost confidence in these employees that their reporting will be handled appropriately, even if the whistleblower may not find out about it.

• No confidentiality of reports – Another concern for those who do not report misconduct is the fear that if they were to come forward with a report, their identities, as well as their suspicions, would be revealed.

• Retaliation by superiors – Not surprisingly, this same group of employees also felt that if their identities were exposed, they would have to suffer retaliation from the superiors. The fear of retaliation caused them not to report misconduct.

• Retaliation by coworkers – Similar to retaliation by superiors, employees who withheld reporting unethical behavior in the workplace feared that their coworkers would find out who blew the whistle and retaliate against them.

• Unsure whom to contact – A small number of the employees who did not report misconduct (18 percent in 2005) said they were unclear whom to contact in order to raise their suspicious of unethical conduct.

Employees who witnessed their company actively following its code of ethics were the most likely to report misconduct in the workplace, according to the 2005 NBES. They were also more likely to be satisfied with their company’s response to reported misconduct. Those who work for organizations that implement formal ethics programs were considerably more prone to reporting the misconduct that they observed. It is important to note that those who

Tone at the Top Page 4 ACFE Tone at the Top Article Page 5 of 12

do not report misconduct may have had a poor experience in the past with trying to do so. Executives must reach out to those disenfranchised employees to make sure that they know their identities will be kept confidential if they report unethical behavior in the workplace.

DETERMINANTS OF ETHICAL BEHAVIOR There are certain factors that will determine the likelihood of ethical behavior within an organization. Walt Pavlo took cues from his bosses and his peers to commit fraud, since he was working in an environment that was inundated with fraudulent behavior. The determinants of ethical behavior in an organization are:

• Behavior of superiors – According to the 2005 NBES, employees who feel that top management acts ethically in four important ways (talks about importance of ethics, informs employees, keeps promises, and models ethical behavior) are much less likely to commit fraud, versus those who feel that top management only talks about ethics without exhibiting any action to support their words.

• Behavior of peers – The 2005 NBES research showed that the way in which employees perceive the behavior of their peers can impact their own ethical conduct. Those who observe their peers acting ethically will also be more likely to act ethically; those who observe their peers engaging in misconduct in the workplace will be more prone to engage in misconduct themselves.

• Industry ethical practices – Employees view the ethical practices that they see day-in- and-day-out as normal. If employees work in an industry where particular unethical actions are viewed as standard practice, then those unethical actions begin to seem normal to them. For example, if it is a standard practice in an industry to “pad” hourly billings, then employees may inflate their hourly billings and begin to view such practice as normal and expected. Conversely, employees who work in an environment that strives to maintain ethical conduct will likely view moral practices as normal.

• Society’s moral climate – Most people do not want to suffer the humiliation of being scorned by their friends, family, and community due to moral transgressions. However, if society views a particular unethical behavior as tolerable or acceptable, then people are more likely to engage in moral misconduct. For example, in the 1950s, manufacturing companies routinely dumped large amounts of chemical waste into lakes and rivers. There was little societal outrage against the practice. Today, however, such actions are viewed by the public as morally reprehensible.

• Formal organizational policy – It is important for organizations to state that unethical conduct will not be tolerated. It is equally important that the organization follows through in enforcing that policy. If a company consistently “looks the other way” with regard to certain violations, then the employees begin to realize that those violations are not serious ones.

NEGATIVE WORK ENVIRONMENT In a negative work environment, there will be low or nonexistent levels of employee morale or feelings of loyalty to the company. In this setting, employees will be more prone to

Tone at the Top Page 5 ACFE Tone at the Top Article Page 6 of 12

committing fraud that will hurt the company, since they feel no obligation to protect it. The following are some of the components that make up a negative work environment, according to the AICPA report “Management Antifraud Programs and Controls: Guidance to Help Prevent, Detect Fraud”:

• Top management does not seem to care about or reward appropriate behavior • Lack of recognition for proper job performance • Negative feedback • Perceived organizational inequities • Autocratic management, rather than participative management • Unreasonable budget expectations or other financial targets • Low organizational loyalty • Fear of delivering “bad news” to supervisors and/or management • Less-than-competitive compensation • Poor training and promotional opportunities • Unfair, unequal or unclear organizational responsibilities • Poor communication practices or methods within the organization

POSITIVE WORK ENVIRONMENT Conversely, a positive work environment will help deter fraud while improving the morale and loyalty of employees. According to the AICPA’s “Management Antifraud Programs and Controls: Guidance to Help Prevent, Detect Fraud” report, when employees are in a positive work environment, they will be more reluctant to commit fraud that will hurt the organization. When employees have positive feelings about an organization they work for, the occurrence of misconduct is reduced. To create and maintain a positive work environment, management should ensure that:

• Recognition and reward systems are in tandem with goals and results • Equal employment opportunities exist • Team-oriented, collaborative decision-making policies are encouraged • Compensation and training programs are professionally administered

TYPES OF WORKPLACE LOYALTY In addition to creating a positive work environment, an organization should strive to create an environment that nurtures the highest possible level of loyalty between employees and their company. Employees that demonstrate and feel greater levels of loyalty to their company will be less likely to commit fraud. There are three types of workplace loyalty:

• Personal loyalty is the lowest level of workplace loyalty. It consists of employees’ basic acceptance and compliance with the orders of their superiors.

• Institutional loyalty is the next level and is organizational in nature, consisting of accepting and complying with the mission of the organization.

• Integrated loyalty is the highest and most virtuous level of organizational loyalty. It is idealistic in nature for the organization. It transcends the previous loyalties by honoring the ideas of accountability, fairness, honesty, and good will. Organizations should strive

Tone at the Top Page 6 ACFE Tone at the Top Article Page 7 of 12

for this level of workplace loyalty in order to protect against fraud and ethical misconduct.

IMPORTANT CONSIDERATIONS OF INVESTORS When critically examining an organization’s successes and failures, it is necessary to keep the shareholders’ goals in mind. Today, investors, analysts, and advisors are taking a close look at the reputation and perceived ethical culture of an organization as part of their evaluation. According to the Corporate Reputation Watch 2004 survey, investors consider the following factors, listed in the order of importance:

• Management team – The caliber of the CEO and the management team is very important to investors.

• Products and services – The quality of products and services is also a crucial consideration to investors.

• Corporate Reputation – Investors pay close attention to the reputation of the corporation. According to the Corporate Reputation Watch 2004 survey, the majority of senior executives surveyed believed that investors and lenders view corporate reputation as important to extremely important, and it is one of the top three factors considered before making investments.

• Governance – Strong corporate governance in an organization is an important factor to investors. More than two-thirds of the senior executives believe that effective governance, transparent disclosures, and reliable financials are essential elements to their company’s reputation to the investment community.

IMPORTANT STEPS TO TAKE There are several steps that business leaders can take to convey the message of individual and corporate responsibility and accountability to its employees and investors:

• Set an ethical tone at the top – Upper management has to lead by example and actions. These actions should include rewarding ethical behavior while punishing unethical actions. There should be sanctions for engaging in, tolerating, or condoning improper conduct.

• Establish a code of ethics – Organizations should produce a clear statement of management philosophy. It should include concise compliance standards that are consistent with management’s ethics policy relevant to business operations. This code of ethics should be given to every employee who will be required to read and sign it. It should also be given to contractors who work on behalf of the organization for their review and signature.

• Carefully screen job applicants – According to the ACFE’s Fraud Examiners Manual, one of the easiest ways to establish a strong moral tone for an organization is to hire morally-sound employees. Too often, the hiring process is hastily conducted. Organizations should conduct thorough background checks on all new employees,

Tone at the Top Page 7 ACFE Tone at the Top Article Page 8 of 12

especially managers and those who will be handling cash. These background checks should include a thorough examination of the candidate’s educational credentials, criminal record, history of employment, and references. Speaking with former employers or supervisors can provide valuable information about a person’s reputation for trustworthiness, moral conduct, and loyalty.

• Assign proper authority and responsibility – In addition to hiring qualified, ethical employees, it is important to place these individuals in situations where they are able to thrive without resorting to unethical conduct. Organizations should provide employees with well-defined job descriptions and performance goals. Performance goals should be routinely reviewed to ensure that they do not set unrealistic standards. Training should be provided on a consistent basis to ensure that employees maintain the skills to perform effectively. Regular training on ethics will also help employees identify potential trouble spots and avoid getting caught in compromising situations. Finally, management should quickly determine where deficiencies in an employee’s conduct exist and work with the employee to fix the problem.

• Mandate fraud and ethics training for staff – It must be mandatory for all employees (including upper-level personnel) to receive fraud prevention and detection training. This training should cover the company’s stance on corporate compliance: its code of ethical conduct, the company’s procedures and standards, as well as employees’ roles and responsibilities to report misconduct in the organization. It should also inform employees about what kinds of acts and omissions are prohibited by law and by the organization to help them avoid situations that could lead to criminal conduct. New employees must be required to attend this training. The company should provide on- going and continuing training for all employees. These training sessions should be used as a tool to communicate and reinforce the organization’s values, code of conduct, and expectations. Common training techniques include lectures, training films, and interactive workshops. Compliance standards should be regularly emphasized.

• Implement effective disciplinary measures – No control environment will be effective unless there is consistent discipline for ethical violations. Consistent discipline requires a well-defined set of sanctions for violations and strict adherence to the prescribed disciplinary measures. If one employee is punished for an act and another employee is not punished for a similar act, the moral force of the company’s ethics policy will be diminished. The levels of discipline must be sufficient to deter violations. It may also be advisable to reward ethical conduct. This will reinforce the importance of organizational ethics in the eyes of employees.

• Implement a confidential hotline – Hotlines have proved to be a very effective reporting mechanism. According to the ACFE’s 2006 Report to the Nation on Occupational Fraud and Abuse, occupational frauds were more likely to be detected by a tip than by any other means such as internal audits, external audits, or internal controls. Additionally, organizations with hotlines had a median loss of $100,000 per scheme and detected their frauds within 15 months of inception. By contrast, organizations without hotlines suffered twice the median loss ($200,000) and took 24 months to detect their frauds.

Tone at the Top Page 8 ACFE Tone at the Top Article Page 9 of 12

The mere mention of an anti-fraud, confidential hotline can deter fraud. When employees are aware of workplace ethics, their likelihood of engaging in misconduct decreases, according to the NBES survey. An organization can place an advertisement in the staff break room with a hotline number that employees can call to confidentially report suspicious fraudulent activity in the workplace. Promoting anti-fraud hotline numbers will send the message that the company is encouraging an ethical environment by allowing employees to fearlessly report misconduct.

• Establish a whistleblower policy – Companies should establish and communicate a whistleblower protection policy to allow employees to come forward and report misconduct in the workplace. This policy should allow employees to report or seek guidance regarding actual or potential criminal conduct by others within the organization while retaining anonymity or confidentiality, without fear of retaliation. Additionally, in many organizations, whistleblowers may be protected by state and federal law. Therefore, you should consult with your legal counsel to train and educate employees about whistleblower protections.

Here are the ways to create a robust and successful whistleblower program:

9 Implement a 24/7 hotline staffed with trained interviewers; 9 Nurture ongoing dialogue by assigning a unique identification number to an anonymous caller, so he or she can call back to respond to questions; and 9 Protect confidentiality by not using caller ID, e-mail tracking, or other means of tracking communication

Remember that the anti-fraud hotline should protect an employee’s identity. Any posters or company communications that promote the anti-fraud hotline should emphasize clearly that reports and employee identities will remain confidential. Employees should be well aware of the fact that they will remain anonymous if they call an anti-fraud hotline. Those who are on the other end of the line, taking these anti- fraud reports, should fully understand the significance of keeping the whistleblower’s identity completely confidential, as well as the details of the investigation.

• Follow through with reports of misconduct and promote effective internal controls – Organizations must have a standard procedure for dealing with fraud allegations. The management team must conduct a full-fledged investigation when misconduct is reported. After an offense has been detected, the organization must have taken all reasonable steps to respond appropriately and to prevent further similar offenses – including any necessary modifications to its program to prevent and detect violations of the law. Those at the top of the organization are responsible for clearly stating and upholding the message that all employees will be required to act within the company’s ethical code of conduct. This message must be enforced in order to prevent and deter fraud in the organization.

• Prevent reprisals – The organization should make every effort to protect the identity of and prevent reprisals against whistleblowers.

Tone at the Top Page 9 ACFE Tone at the Top Article Page 10 of 12

• Create a culture of doing the right thing – By implementing all of the above steps, and making sure that everyone in the organization (especially those at the top) are actively maintaining corporate standards, a culture of “doing the right thing” will be created. This is the ultimate goal that should always be the striving point.

ANTI-FRAUD PROCESSES AND CONTROLS It is recommended that management obtain a copy of the AICPA’s report, “Management Antifraud Programs and Controls: Guidance to Help Prevent and Deter Fraud,” which is a report commissioned by the Fraud Task Force of the AICPA’s Auditing Standards Board. It is an extremely valuable reference and can be obtained from the AICPA’s website: www.aicpa.org. The report provides a number of recommendations for strengthening an organization’s anti-fraud programs, including the following:

Evaluating Antifraud Processes and Controls

• Identifying and Measuring Fraud Risks: Management has primary responsibility for establishing and monitoring all aspects of the agency’s fraud risk-assessment and prevention activities. Fraud risks are often considered as part of an enterprise-wide risk management program, though they may be addressed separately as well. The fraud risk-assessment process should consider agency vulnerabilities and its exposure to material losses, taking into account the agency’s size and the complexity of its operations.

• Mitigating Fraud Risks: Management should conduct an internal risk assessment to identify and prioritize the different types of fraud risks and apply appropriate fraud mitigation strategies. This process is an essential component of a healthy control environment and can reduce certain fraud risks.

• Implementing and Monitoring Appropriate Internal Controls: Most risks can be mitigated with an appropriate system of internal control. Once a fraud risk assessment has been performed, the agency must identify the ongoing processes, controls, and other monitoring procedures that are needed to identify and/or mitigate those risks.

Developing an Appropriate Oversight Process

• Independent Audit Committee or Board of Directors: The audit committee (or the board of directors where no audit committee exists) must systematically and periodically evaluate management’s identification of fraud risks, the implementation of antifraud prevention and detection measures, and the creation of the appropriate “tone at the top.” Active oversight by the audit committee serves as a deterrent to management and employees engaging in fraudulent activity and helps management fulfill its responsibility. Active oversight by the audit committee helps to reinforce management’s commitment to creating a culture with “zero tolerance” for fraud.

• Management: Fraud prevention and detection requires commitment from both management and the decision makers of the organization. Ideally, managers must be

Tone at the Top Page 10 ACFE Tone at the Top Article Page 11 of 12

assigned direct responsibility to develop, implement, and maintain effective fraud prevention measures within their area of expertise.

• Other Oversight Resources: Internal and external auditors and certified fraud examiners can provide expertise, knowledge, experience, and objective, independent input into the agency‘s fraud risk assessment process. They can assist in developing prevention and mitigation measures and in the resolution of allegations or suspicions of fraud.

JUST RELYING ON A FORMALIZED CODES OF ETHICS CAN BE COUNTERPRODUCTIVE IN PREVENTING FRAUD While it is important to implement a formalized code of ethics in an organization, just relying upon these strict codes to detect fraud can be counterproductive. When executives simply hand out a written code of ethics for the employees to comply with, without setting an example as to how to live by and interpret the code, the employees will no longer engage in any kind of moral analysis. Moral analysis is crucial because ethical situations are complex and deserve individual attention that may go beyond the scope of what is written in the code of ethics. If a company becomes too dependent upon a checklist of prohibited actions, employees will begin to lose the ability to analyze each complex ethical situation as it comes up in the workplace. While a formalized code of ethics is a good starting point, employers and employees should not solely rely upon a written code. It is impossible to list every ethical situation an employee may face, and an attempt to do so may lead the employee to conclude, “If it’s not specifically prohibited by the code of ethics, it must be o.k.” There should be room for analysis beyond what is written in the formal document.

CONCLUSION: SUGGESTIONS ON HOW CORPORATE LEADERS CAN CREATE AND MAINTAIN A TRUE ETHICAL CLIMATE IN THEIR ORGANIZATIONS

In summary, there are four steps that an organization’s leadership can take to create and maintain a good ethical climate within an organization:

Communicate what is expected of employees: The first step executives need to take is to state clearly and convincingly what the organization’s values and ethics are and the behavior that is expected from each employee. This should be done through the implementation of a written code of ethics and a formal training program. The policy should be continually reinforced through communications from the organization’s leaders.

Lead by example: The second step is to lead with integrity. Employees take their work ethic cues from those at the top of the organization. Executives cannot just talk about acting ethically, executives also have to “walk the walk” and show employees how to act by setting the example. Management must demonstrate their commitment to ethics through both their words and their actions.

Provide a safe mechanism for reporting violations:

Tone at the Top Page 11 ACFE Tone at the Top Article Page 12 of 12

The third step is to create an environment of safety for employees to report misconduct. Those who know about, or are suspicious of, fraudulent behavior or other ethical violations should be able to come forward and report misdeeds without the fear of retaliation from upper level management or their colleagues. Executives need to strongly convey the message that reporting misdeeds is highly-valued by the company and those who do the reporting will be protected to the highest degree.

Reward integrity: The fourth step is to reward integrity. Companies should not reward employees only for meeting financial goals. If executives see ethical behavior, they should be rewarded for it. Employees should know that meeting the bottom line is not the only measure of success. Acting with integrity and ethics should also be rewarded by the company and should be integrated into existing employee incentive programs to encourage ethical behavior.

Remember, employees look to management for direction. Management must be conscious of the signals it is sends to its employees. Creating an ethical tone at the top will cut losses due to fraud and improve loyalty and morale. Preventing fraud is good business, and it starts at the top.

Tone at the Top Page 12 FROM THE OFFICE OF THE CITY MANAGER

Date: August 5, 2019

To: Troy City Council Members

From: Mark F. Miller, City Manager

Subject: Forensic Accounting Investigation Corrective Action Plan

Background Plante & Moran, PLLC (Plante Moran) presented the findings of their forensic accounting investigation to City Council in a public meeting on July 17, 2019. The City Council authorized release of the report and directed City staff to post it on the City’s website and include it in the July 22, 2019 regular City Council meeting agenda packet. These steps ensured the final report became a public record.

This investigation was initiated in August 2018 after federal bribery charges were filed against former City Manager Brian Kischnick in July 2018. Request for Quotes were sent to accounting firms in August 2018 but only three responded. The City issued a Request for Proposals in October 2018. Nine proposals were received and evaluated by a Selection Committee including City Manager Mark Miller, City Attorney Lori Grigg Bluhm, and Grosse Pointe Shores City Manager Mark Wollenweber. The Selection Committee interviewed Plante & Moran and Baker Tilly in November 2018. Based on the selection and scoring criteria, the Committee unanimously recommended Plante Moran and the City Council authorized City Administration to enter into an agreement with Plante Moran in December 2018.

The City also separated employment with former Financial Services Director Tom Darling in July. Former Assistant City Manager for Finance and Administrative Services John Lamerato is serving as Interim Financial Services Director until a new Director is hired. John worked for the City between 1994 and 2011. In 2011 he became the City Controller of Grosse Pointe Farms and retired in 2017. John recently served as Interim Finance Director of Mount Clemens and we are grateful he has agreed to assist Troy in this transition period.

Next Steps Plante Moran’s report included an Internal Control Recommendation Log (“Control Log”) with seventeen recommendations to strengthen the City’s internal controls. A copy is attached. Internal controls are systematic measures instituted by an organization for many purposes. Some of those purposes include: to detect and deter errors, fraud and theft, to safeguard its assets and resources, and to ensure adherence to its policies and plans.

Corrective Action Plan The recommendations are listed below in the same order as the Control Log and have been grouped by process as they are in the Control Log. Each recommendation has been given a brief title. Please see the attached Control Log for details about each recommendation.

A team of senior City staff was assigned to evaluate each recommendation. These teams are included below. The Interim Financial Services Director was intentionally omitted from these teams because the

1

FROM THE OFFICE OF THE CITY MANAGER

position is currently filled on a temporary and part-time basis. However, the Interim Director will participate as necessary. Senior staff will also include subordinates as necessary.

Expense Reimbursement 1. Reimbursement Methods 2. Reimbursement Approval Senior Staff: Accounting Manager; City Manager; and City Treasurer

General 3. City Council Agenda Memos Senior Staff: Assistant City Manager; City Attorney; City Clerk; IT Director and Purchasing Manager

Payroll 4. New Hire Documentation Senior Staff: Accounting Manager; City Manager; and Human Resources Director

Policies and Procedures 5. Whistleblower Procedure 6. Whistleblower Training 7. Policy & Procedure Enforcement & Consequences 8. Meal Reimbursement Policy 9. Employee Use of City Amenities Senior Staff: Accounting Manager; Assistant City Manager; Purchasing Manager; and Recreation Director

Purchasing 10. Emergency Purchases 11. Receipt Review 12. Vendor Due Diligence 13. Receipt Itemization 14. Expense Documentation 15. Policy & Procedure Enforcement & Consequences 16. Excessive Tipping 17. Bid-splitting Senior Staff: Accounting Manager; Assistant City Manager; City Attorney; City Treasurer; and Purchasing Manager

All teams met during the week of July 29 to begin reviewing the recommendations. City Management will provide progress reports on a regular basis.

2

Internal Control Recommendation Log Page 1 of 3

High Priority Medium Priority Low Priority

# Process Priority Observations Possible Risk Recommendations 1 Expense The City currently has multiple methods to *A scheming employee could submit copies of the same receipt The City should consider the cost/benefit of continuing to utilize the Reimbursement reimburse employee expenses. Employees can multiple times, through the different processes and receive petty cash reimbursement process through the Treasurer's office. If seek reimbursement through the accounts multiple reimbursements without detection. For example, an retained, at a minimum, the City should reconcile petty cash activity payable ("AP") process (Finance Department), employee could spend their own funds on behalf of the City and to the expense reimbursement process to ensure purchases are through the petty cash process (Treasurers' submit copies of the same receipt for reimbursement from the not being submitted multiple times. Additionally, Treasury staff office) and payroll. Finance office and the Treasurer's office. should compare purchases made by purchase cards to the petty *Alternatively, an employee could make a purchase using a City cash reimbursements to ensure the City has not already incurred purchasing card (i.e., without spending any of their personal the expense. funds). They could provide the receipt to AP to support their charge (per policy) and provide a copy of the receipt to the Alternatively, all expenses could be reimbursed using only one Treasurer's office for reimbursement through the petty cash method. This will reduce the opportunity for duplication and process. possibly provide the City with electronic data to periodically perform analytics, which can identify anomalies such as duplicate It is unlikely either scheme would be detected, as different purchases and abnormal spending activity. individuals are responsible for approving transactions occurring through the different processes and no reconciliations are performed.

2 Expense Treasury requires an approval signature for all An inherent subordinate relationship exists between the Office Someone separate from the City Manager's office, such as the Reimbursement petty cash reimbursements; however, the Office Coordinator and the City Manager positions. The City Manager Council, should review purchases made by the City Manager for Coordinator frequently approved the petty cash could, therefore, exercise influence and pressure the Office appropriateness. It may not be feasible for someone not in a requests made by the City Manager (the Coordinator to approve purchases. subordinate position to approve petty cash reimbursements, given "supervisor"). the timing of such reimbursements; however, the frequent review by Council will help ensure any inappropriate reimbursements are identified in a timely matter and will create a level of oversight.

Alternatively, remove the petty cash reimbursement process, having all expense reimbursements go through payroll.

3 General The former City Manager modified at least one As happened, these edits by the former City Manager misled the When memorandum communications are sent by Department memorandum prepared by a Department Head City's leadership. Heads, a copy should be routed by the Department Head to a prior to providing to Council. Council designee, such as the City attorney. This process provides for a secondary set of eyes to review. 4 Payroll Sufficient documentation for the new hire process The City may inadvertently hire employees that have a history that As discussed with the Director of Human Resources, the City now is not always maintained, specifically when would normally disqualify them from consideration. Those uses a checklist for new hire candidates; however, it does not exceptions are allowed to the standard hiring involved in the hiring process are also at risk, should an issue contain all details pertinent to the decision making process. This procedures. surface subsequent to hire and the City lack the adequate checklist should be updated to include specific hiring procedures documentation regarding the decision making process at the time such as background/conflict of interest checks. It should also of hire. include approvals and narratives to document exceptions (i.e., when items that traditionally preclude a candidate from being hired are overwritten/ignored). This checklist should be maintained as supporting documentation. Internal Control Recommendation Log Page 2 of 3

High Priority Medium Priority Low Priority

# Process Priority Observations Possible Risk Recommendations 5 Policies and The City lacked a process where employees City employees were discouraged from reporting potential The City amended the Whistleblower policy in August of 2017 Procedures could report policy and legal breaches without violations and inappropriate behavior of individuals in positions of thereby allowing complaints to be made to the City Manager, City fear of retaliation. authority. This can/did create a "toxic" environment that is highly Attorney, or directly to City Council as appropriate. susceptible to abuse at all levels. We highly encourage the City to review the tone at the top to ensure all members of management and oversight uphold values of honesty, integrity, and ethics, which will encourage employees to uphold the same values. 6 Policies and The overall tone at the top encouraged Management could/did use their position to adversely influence Training, combined with appropriate mechanisms to report issues, Procedures individuals in positions of authority to influence behavior that was not in the best interest of the City. is ideal to promote awareness. We highly encourage the City to subordinates. review the tone at the top to ensure all members of management and oversight uphold the same values of honesty, integrity, and ethics, which will encourage employees to uphold the same values.

7 Policies and The City's response to poor behavior/choices Given the response, behaviors continued that were not in the best We highly encourage the City to review the tone at the top to Procedures when they were made known often reinforced the interest of the City. ensure all members of management and oversight uphold values of wrongdoer's actions, from the employee honesty, integrity, and ethics which will encourage employees to perspective, since sufficient corrective action was uphold the same values. Further, a zero tolerance policy should seldom taken. be established, involving (enforced) consequences for non- compliance. 8 Policies and We identified numerous meal purchases to Occasional meal purchases may be an acceptable use of City The City should update polices to clearly define the acceptable use, Procedures upscale restaurants within petty cash receipts funds; however, without proper policies in place, meal threshold limitations, and supporting documentation requirements and purchase card activity. No policies currently reimbursements are susceptible to abuse by employees, for purchase cards and petty cash. exist documenting the appropriate use of City potentially leading to the personal use of City funds and an funds for meal reimbursements, outside of the inappropriate use of tax dollars. travel policy (i.e., there is no policy regarding "local" meals). 9 Policies and Free access to golf and the community center A sense of entitlement by leadership can be pervasive in an A policy should be implemented that outlines permissions for Procedures were provided to the City Manager. organization. personnel to use City assets. 10 Purchasing We identified a purchase that circumvented the Employees could continue to inappropriately label purchases as We encourage the City to enforce City policies, requiring all Council approval process by being emergency purchases as a method to circumvent the Council emergency purchases to go before Council in the subsequent inappropriately classified as an emergency approval process. meeting of the purchase for affirmation. purchase. *Additionally, Council should consider reviewing the check registers for payments exceeding $10,000. Supporting documentation should be requested for unfamiliar payments to ensure they weren't improperly excluded from Council's oversight/approval.

11 Purchasing We identified multiple instances of approved Conceivably, an employee could alter, forge, manipulate, etc. The City should ensure that questions are asked of unusual receipts which were either altered (e.g., white out, receipts to receive reimbursements for fictitious purchases or for receipts. Answers should be obtained and consequences should etc.) or contained mathematical errors (e.g., the amounts in excess of what they actually paid. Approving receipts be established for non-responsive answers. check amount plus the tip amount did not equal with these characteristics could indicate the current review the total). process is not thorough enough. 12 Purchasing A new vendor “vetting” process/checklist does not The Department Heads' vendor selections could be influenced by A vendor “vetting” policy should be established, including a conflict exist. The Department Heads can select vendors vendors who provide gifts and/or kickbacks. This influence could of interest review by someone other than the Department Head. to be utilized without additional authorization. cause the City to overpay for items/services. New vendors should be periodically reviewed.

Our analytics identified multiple instances of companies sharing an address with an employee being utilized as a vendor. Internal Control Recommendation Log Page 3 of 3

High Priority Medium Priority Low Priority

# Process Priority Observations Possible Risk Recommendations 13 Purchasing We identified numerous purchases on purchase Without itemized receipts, the reviewer of the purchases cannot The City has a policy in place requiring itemized receipts. cards and petty cash that lacked itemized distinguish between inappropriate and appropriate charges. Consequences for not providing itemized receipts should be supporting documentation. Summary receipts communicated and enforced. Consequences could include, loss of were provided, but these did not show the detail purchasing card authorization/use, personal liability for the charges, of the purchase. etc. However, we encourage the City to discuss options with their legal counsel. 14 Purchasing We identified numerous purchases using Without receipts, the reviewer of the purchases cannot distinguish The City has a policy in place requiring itemized receipts. purchase cards and petty cash that lacked any between inappropriate and appropriate charges. Consequences for not providing itemized receipts should be supporting documentation. Further, Affidavits did communicated and enforced. Consequences could include, loss of not exist to support the transactions with missing purchasing card authorization/use, personal liability for the charges, receipts. etc. However, we encourage the City to discuss options with their legal counsel. 15 Purchasing We identified instances whereby the former City A lack of accountability is established if consequences are not Consequences for not following policy should be established, Manager's receipts for meals during travel enforced when policies are violated, thus facilitating the communicated and enforced. Consequences could include, loss of exceeded the policy thresholds. It is our employee's willingness to commit additional violations. purchasing card authorization/use, personal liability for the charges, understanding there were no consequences for etc. However, we encourage the City to discuss options with their this policy violation. legal counsel. 16 Purchasing We identified numerous purchases using The lack of guidelines, policies and procedures can lead to The City should consider updating the policy to include the purchase cards and petty cash with excessive behaviors that are not in the best interest of the City. allowable tip percentages. Variances should be investigated for tips (over 25%+). reasonableness. 17 Purchasing Our analysis identified multiple transactions with Our analysis did not "verify" this occurred; however, conceivably While these characteristics can commonly occur in the normal characteristics indicative of bid-splitting (threshold some of these purchases could have been intentionally split to course of business, the City should consider implementing a avoidance) to keep transactions under the avoid Council approval. periodic process (including analytics) to review for intentional $10,000 threshold. threshold avoidance activity. FROM THE OFFICE OF THE CITY MANAGER

Date: September 18, 2019

To: Mark F. Miller, City Manager

From: Aileen Dickson, City Clerk MaryBeth Murz, Purchasing Manager Gert Paraskevin, Information Technology Director Beth Tashnick, City Manager's Office Manager Robert J. Bruner, Assistant City Manager

Subject: Forensic Accounting Investigation Corrective Action Plan

The Administrative Memo (1-G-2) outlining the “Policy and Procedure Regarding Preparation of City Council Agendas” was originally issued on June 30, 1969 and most recently updated on September 1, 2006. It specifically states, “Hard copies of cover memos, back-up materials and resolutions must be approved by the City Manager for inclusion in City Council agendas.” After these hard copies are approved by the City Manager, electronic copies are submitted to the City Clerk’s Office where the electronic agenda packet is prepared in Portable Document Format (PDF).

City staff began meeting in June to reevaluate the policy and establish an electronic agenda preparation procedure. Coincidentally, Plante Moran’s Internal Control Recommendation Log (“Control Log”) included a recommendation regarding City Council agenda memos. Specifically, Plante Moran observed the former City Manager modified at least one memo prepared by a Department Head prior to providing the memo to City Council in its agenda packet.

That memo dated January 7, 2016 was for the purchase of a "vehicle to be used by the City Manager." In that case, four City employees approved the memo before it reached the City Manager: Financial Services Director, Public Works Director, Purchasing Manager, and Superintendent of Fleet Operations. The former City Manager subsequently altered the memo to include three (3) additional vehicles and removed all references to his use of the new vehicle. Despite his significant revisions, the former City Manager left the document as from the Public Works Director, Purchasing Manager, and Superintendent of Fleet Operations.

The new electronic agenda preparation procedure will prevent a memo from being modified after the author submits it for approval. If a memo is disapproved and/or revisions are requested, the memo must be resubmitted by the author and reapproved by City staff up to and including the City Manager. It will also create a record of each City staff approval from the original author to the City Manager.

Information Technology has used the City’s existing business process management software to implement the new electronic agenda preparation procedure. Training will be conducted during the week of November 11, 2019 and the process will be piloted for the November 25, 2019 City Council agenda packet. We will provide another update following the November 25, 2019 City Council meeting.

1

Control Log

# Category Priority Observations Possible Risk Recommendations 3 Agenda High The former City Manager modified at least As happened, these edits by the former City Manager When memorandum communications are sent by one memorandum prepared by a misled the City's leadership. Department Heads, a copy should be routed by the Department Head prior to providing to Department Head to a Council designee, such as the City Council. attorney. This process provides for a secondary set of eyes to review.

Page 1 of 1 ADMINISTRATIVE MEMORANDUM

SUBJECT: Policy and Procedure Regarding Preparation of City Council Agendas DATE OF ORIGINAL ISSUE: I EFFECTIVE DATE: NUMBER: June 30, 1969 September 1, 2006 1-G-2 RE-EVALUATION DATE: RESCINDS: LAST REVISION DATE: 1-G-2a, 1-G-2b, 1-G-11 , 1-G-41 DISTRIBUTION: Department Directors, Support- Staff Responsible for Preparing Agenda Items PURPOSE

This ad memo is designed to set policy and procedure with regard to the preparation and submittal of items for City Council agendas.

PROCEDURES

Submittal of Agenda Items

Hard copies of cover memos, back-up materials and resolutions must be approved by the City Manager for inclusion in City Council agendas. The City Manager's Office will forward approved agenda items to the City Clerk's Office during agenda preparation.

The City Clerk's Office will notify departments via email when an item is received, prompting the submittal of agenda items electronically. Cover memos and back-up materials will be submitted to the agenda email inbox in Adobe format. Resolutions shall be submitted to the agenda email inbox in Word format so that the City Clerk's Office can cut and paste them into the agenda instead of having to retype them.

Layout of Agenda Items

Described below is the format to be used for cover memos. If the item is an action item, the heading will read "City Council Action Report". If the item is informational only, the heading will read "City Council Report".

Cover memos shall be broken down into the following sections:

Background Financial Considerations Legal Considerations Policy Considerations Options

Use bullet points to list the considerations under each heading.

1-G-2 1 If an item will not impact all considerations listed, use the following format:

Legal Considerations

There are no legal considerations associated with this item.

Be sure to add the signature of the City Attorney at the end of memos that require legal review.

A sample of this format is attached to the ad memo.

Format of Agenda Items

All cover memos shall be typed in Arial 12-point font. A smaller point size may be used if doing so will keep the memo to one page. It is preferred that the font size used be no smaller than 11-point.

Margins shall be set at .5" and left-justified only, as using right justification causes irregular spacing of words. As with the font size, the margins may be adjusted if doing so will keep the memo to one page.

There shall be a footer used in each cover memo displaying preparer's initials and electronic file location. Recommended font for the footer is 9 point. Example:

mr\2006 AGENDA ITEMS\09.11.06 - Standard Purchasing Resolution 10 - NLC FAIR Fall Steering Committee Meeting

Format of Resolutions

Department directors shall submit resolutions (motions) with City Council action reports, i.e., items that appear on either the "Consent" or "Regular Business" portion of the agenda. Resolutions will be sent in Word format to the Agenda [email] lnbox, along with the corresponding action report in Adobe format.

Instructions for creating a resolution:

1. Wording

Resolutions (motions) should be worded in a concise, unambiguous and complete form.

2. Use of "RESOLVED"

a) In a resolution the name of the adopting organization should be made part of the enacting words:

RESOLVED, That the Troy City Council hereby APPROVES ...

Please note the preferred formatting of the word "RESOLVED" (in all caps) and the action word "APPROVES" (in all caps and bolded).

b) A resolution can consist of more than one resolving clauses:

RESOLVED, That the Troy City Council hereby APPROVES ... ; and

BE IT FURTHER RESOLVED, That the Troy City Council hereby DIRECTS City Management to ...

1-G-2 2 3. Use of a Preamble

It is usually inadvisable to include reasons for a motion's adoption within the motion itself. To do so may encumber the motion or weigh against its adoption, since some Council members who approve of the action the motion proposes may dislike voting for it if the preamble states reasons with which they disagree.

When special circumstances make it desirable to include a brief statement of background, the motion should be cast in the form of a resolution, with the background or reasons incorporated in a preamble that is placed before the resolving clauses.

A preamble consists of one or more clauses beginning with "WHEREAS". It should be emphasized that neither rule nor custom requires a resolution to have a preamble, and one should not be used merely for the sake of form.

In general, the use of a preamble should be limited to cases where it provides little-known information without which the point or the merits of a resolution are likely to be poorly understood, or where unusual importance is attached to making certain reasons for an action a matter of record.

a) An example of a resolution with an appropriate preamble is as follows:

WHERE.AS, The city of Troy has deemed that the current location of Precincts #12 and #13 at the Fire-Police Training Facility at 4850 John R has insufficient parking and cannot adequately serve the City of Troy electors assigned to that polling location; and

WHEREAS, The City of Troy has found an alternative polling location at Bethesda Romanian Pentecostal Church at 2075 E. Long Lake that will sufficiently serve the electors of the City of Troy;

THEREFORE, BE IT RESOLVED, That the City of Troy Precincts #12 and #13 located at the Fire-Police Training Facility at 4850 John R be RELOCATED to Bethesda Romanian Pentecostal Church located at 2075 E. Long Lake effective with the primary election scheduled for Tuesday, August 8, 2006.

b) The preamble, regardless of how many paragraphs it has, should never contain a period.

Each of its paragraphs should close with a semicolon, followed, in the case of the next to the last paragraph, by the word "and" (which is optional for the preceding paragraphs also). The last paragraph of the preamble should close with a semicolon, after which a connecting expression such as "THEREFORE, BE IT RESOLVED" OR "NOW, THEREFORE, BE IT RESOLVED".

c) To avoid detracting from the force of the resolution, a preamble generally should contain no more clauses than are strictly necessary. In cases where an elaborate resolution (consisting of several preamble clauses and several resolving clauses) cannot be avoided, the following example will serve as a guide:

WHEREAS, The ... [text of the first preamble clause];

WHEREAS, The .. . [text of the next to the last preamble clause]; and

1-G-2 3 WHEREAS, The ... [text of the last preamble clause);

THEREFORE, BE IT RESOLVED, That ... [stating action to be taken]; and

THEREFORE, BE IT FINALLY RESOLVED, That .. . [stating final action to be taken].

Distribution of City Council Agendas

The City Clerk's Office performs final assembly and distributes agendas to City Council on Thursdays before Council meetings.

The City Clerk's Office emails all employees a link to the electronic agenda on the City's intranet, in the "Information Store".

Deadline for Submitting Agenda Items to the City Manager's Office for Approval

The deadline for submitting original hard copies of agenda items to the City Manager's Office for review and approval is noon on Tuesday of the agenda preparation week.

Approved:

~ %' / Qd;.,.__ PhillipL~ elson, Cityf anager

Prepared by Mary Redden

1-G-2 4

CCITY CCOUNCIL AACTION RREPORT

September 20, 2006

TO: Phillip L. Nelson, City Manager

FROM:

SUBJECT:

Background:

Financial Considerations:

Legal Considerations:

Policy Considerations:

Options:

Where legal review is necessary:

Approved as to Form and Legality: Lori Grigg Bluhm, City Attorney CITY COUNCIL AGENDA ITEM

Date: September 30, 2019

To: Mark F. Miller, City Manager Lori Grigg Bluhm, City Attorney

From: Lisa Burnham, Accounting Manager Sandra L Kasperek, City Treasurer Beth L. Tashnick, City Manager's Office Manager Robert J. Bruner, Assistant City Manager

Subject: Forensic Accounting Investigation Corrective Action Plan

Background Plante & Moran, PLLC (Plante Moran) presented the findings of their forensic accounting investigation to City Council in a public meeting on July 17, 2019. Plante Moran’s report included an Internal Control Recommendation Log (“Control Log”) with seventeen recommendations to strengthen the City’s internal controls. A copy is attached. A team of senior City staff was assigned to evaluate each recommendation. Teams began meeting during the week of July 29. This team was tasked with evaluating the following recommendations:

1. Reimbursement Methods 2. Reimbursement Approval 8. Meal Reimbursement Policy 11. Receipt Review 13. Receipt Itemization 14. Expense Documentation 15. Enforcement & Consequences 16. Excessive Tipping

Recommendation #1

The City should consider the cost/benefit of continuing to utilize the petty cash reimbursement process through the Treasurer's office. If retained, at a minimum, the City should reconcile petty cash activity to the expense reimbursement process to ensure purchases are not being submitted multiple times. Additionally, Treasury staff should compare purchases made by purchase cards to the petty cash reimbursements to ensure the City has not already incurred the expense.

Alternatively, all expenses could be reimbursed using only one method. This will reduce the opportunity for duplication and possibly provide the City with electronic data to periodically perform analytics, which can identify anomalies such as duplicate purchases and abnormal spending activity.

1

CITY COUNCIL AGENDA ITEM

Administrative Memorandum 1-PU-3 provides that petty cash may be used for purchases of less than $100 and are not subject to the mechanics of the purchase order system or check request procedures. This includes reimbursements for out-of-pocket expenses. Administrative Memorandum 1-PU-19 provides a policy for making purchases via check and a procedure for requesting checks. Reimbursements for out-of-pocket expenses is an acceptable reason for requesting a check. Administrative Memorandum 1-PU-25 stablished a procedure to implement a purchasing card (also abbreviated as P-Card) program.

We believe it is in the City’s best interest to discontinue the petty cash reimbursement process through the City Treasurer's office and direct employees to make purchases with a City purchasing card whenever possible. When the use of a purchasing card is not possible, reimbursements for out-of- pocket expenses will be made via check request on a monthly basis. This will eliminate the need to reconcile petty cash activity. Only purchases made by purchase cards and check requests will need to be compared to ensure the City does not pay for the same expense twice.

Recommendation #2

Someone separate from the City Manager's office, such as the Council, should review purchases made by the City Manager for appropriateness. It may not be feasible for someone not in a subordinate position to approve petty cash reimbursements, given the timing of such reimbursements; however, the frequent review by Council will help ensure any inappropriate reimbursements are identified in a timely matter and will create a level of oversight.

Alternatively, remove the petty cash reimbursement process, having all expense reimbursements go through payroll.

We recommend copies of the City Attorney and City Manager’s monthly check requests and purchasing card reconciliations be provided to the City Council. This information will be sent directly from Finance to the Mayor and each City Council member via email beginning in November.

Recommendation #8

The City should update polices to clearly define the acceptable use, threshold limitations, and supporting documentation requirements for purchase cards and petty cash.

No policies currently exist regarding the use of City funds for “local” meals because such meals are not generally an appropriate use of City funds. On January 23, 2017 the City Council adopted Resolution #2017-01-012 which authorized City Administration to use municipal funds to provide food and related expenses for specific annual events, meetings, and other limited occasions where citizens, elected officials and/or City employees participate in City business outside of regular working hours (including lunch time). We believe this resolution clearly defines the acceptable use of City funds for “local” meals.

The threshold limitations for food are the same as for any other City expense. Purchases of less than $1,000 may be made with a purchasing card (Administrative Memorandum 1-PU-25). Purchases of

2

CITY COUNCIL AGENDA ITEM

$1,000 or more must be made with a purchase order (City Code Chapter 7). Purchases in excess of ten thousand dollars must be approved by the City Council (City Charter Section 12.1). The supporting documentation requirements for each type of purchase are included in the City Code and Administrative Manual. We do not believe any policy changes are required, only enforcement of the existing policies.

Recommendation #11

The City should ensure that questions are asked of unusual receipts. Answers should be obtained and consequences should be established for non-responsive answers.

Plante Moran identified receipts submitted for reimbursement which were either altered or contained mathematical errors. They warned an employee could alter receipts to receive reimbursements for fictitious purchases or for amounts in excess of what they actually paid. Discontinuing the petty cash reimbursement process in the Treasurer’s Office and directing employees to make purchases with a City purchasing card and/or monthly check request instead will eliminate this risk.

Recommendations #13 and #14

The City has a policy in place requiring itemized receipts. Consequences for not providing itemized receipts should be communicated and enforced. Consequences could include, loss of purchasing card authorization/use, personal liability for the charges, etc. However, we encourage the City to discuss options with their legal counsel.

Plante Moran identified purchases on purchase cards and petty cash that lacked itemized supporting documentation and others that lacked any supporting documentation. Without receipts, the reviewer of the purchases cannot distinguish between inappropriate and appropriate charges. Administrative Memorandum 1-PU-25 makes department directors responsible for ensuring each employee with a purchasing card reconciles their receipts with their monthly statements. Memorandum 1-PU-25 also provides consequences for inappropriate and unauthorized use of a purchasing card. Consequences include disciplinary measures, up to and including termination. A City employee found to have inappropriately used a purchasing card is responsible for reimbursing the City for all costs associated with such improper use and may be subject to civil and/or criminal prosecution. Accordingly, we do not believe any policy changes are required, only enforcement of the existing policies.

Recommendation #15

The City has a policy in place requiring itemized receipts. Consequences for not providing itemized receipts should be communicated and enforced. Consequences could include, loss of purchasing card authorization/use, personal liability for the charges, etc. However, we encourage the City to discuss options with their legal counsel.

Plante Moran identified instances whereby the former City Manager's receipts for meals during travel exceeded the policy thresholds and there were no consequences for this policy violation. Administrative Memorandum 1-P-1 provides as follows:

3

CITY COUNCIL AGENDA ITEM

MEALS: The maximum price range for meals, including tips, is as follows:

Breakfast $10.00 Lunch 15.00 Dinner 25.00 Total Daily $50.00

The allowances specified above are intended to be a per meal, per day allowance and include tips. Exceptions are made for scheduled conference meals which exceed the above schedule.

Rather than reimbursing City employees for the actual cost of meals within these limits, we recommend adopting the meals and incidental expense (M&IE) per diem rate established by the General Services Administration (GSA). The per diem allowance (also referred to as subsistence allowance) is a daily payment instead of reimbursement for actual expenses. This eliminates the need for itemized receipts and will save time and money when processing travel expenses. It will also make the City’s travel policy clearer and easier to enforce. The current standard M&IE Breakdown is as follows:

Continental Breakfast/ Breakfast $13 Lunch $14 Dinner $23 Incidental Expenses $5 M&IE Total $55

GSA establishes the per diem rates for the lower 48 Continental United States (CONUS). Rates are set by federal fiscal year, effective October 1 each year. Most of the CONUS (approximately 2,600 counties) are covered by the standard rate.

Recommendation #16

The City should consider updating the policy to include the allowable tip percentages. Variances should be investigated for reasonableness.

The meals and incidental expense (M&IE) rate includes taxes and tips in the rate, so travelers will not be reimbursed separately for those items.

Next Steps

No City Code amendments are required to implement these recommendations. Instead, City staff will work with the City Manager to update the relevant Administrative Memorandums and forms. The City is currently in the process of changing purchasing card program providers. That change should be completed by the end of the year. In the meantime, the City Council will begin receiving the City Attorney and City Manager’s monthly check requests and purchasing card reconciliations in November.

4

Internal Control Recommendation Log Page 1 of 3

High Priority Medium Priority Low Priority

# Process Priority Observations Possible Risk Recommendations 1 Expense The City currently has multiple methods to *A scheming employee could submit copies of the same receipt The City should consider the cost/benefit of continuing to utilize the Reimbursement reimburse employee expenses. Employees can multiple times, through the different processes and receive petty cash reimbursement process through the Treasurer's office. If seek reimbursement through the accounts multiple reimbursements without detection. For example, an retained, at a minimum, the City should reconcile petty cash activity payable ("AP") process (Finance Department), employee could spend their own funds on behalf of the City and to the expense reimbursement process to ensure purchases are through the petty cash process (Treasurers' submit copies of the same receipt for reimbursement from the not being submitted multiple times. Additionally, Treasury staff office) and payroll. Finance office and the Treasurer's office. should compare purchases made by purchase cards to the petty *Alternatively, an employee could make a purchase using a City cash reimbursements to ensure the City has not already incurred purchasing card (i.e., without spending any of their personal the expense. funds). They could provide the receipt to AP to support their charge (per policy) and provide a copy of the receipt to the Alternatively, all expenses could be reimbursed using only one Treasurer's office for reimbursement through the petty cash method. This will reduce the opportunity for duplication and process. possibly provide the City with electronic data to periodically perform analytics, which can identify anomalies such as duplicate It is unlikely either scheme would be detected, as different purchases and abnormal spending activity. individuals are responsible for approving transactions occurring through the different processes and no reconciliations are performed.

2 Expense Treasury requires an approval signature for all An inherent subordinate relationship exists between the Office Someone separate from the City Manager's office, such as the Reimbursement petty cash reimbursements; however, the Office Coordinator and the City Manager positions. The City Manager Council, should review purchases made by the City Manager for Coordinator frequently approved the petty cash could, therefore, exercise influence and pressure the Office appropriateness. It may not be feasible for someone not in a requests made by the City Manager (the Coordinator to approve purchases. subordinate position to approve petty cash reimbursements, given "supervisor"). the timing of such reimbursements; however, the frequent review by Council will help ensure any inappropriate reimbursements are identified in a timely matter and will create a level of oversight.

Alternatively, remove the petty cash reimbursement process, having all expense reimbursements go through payroll.

3 General The former City Manager modified at least one As happened, these edits by the former City Manager misled the When memorandum communications are sent by Department memorandum prepared by a Department Head City's leadership. Heads, a copy should be routed by the Department Head to a prior to providing to Council. Council designee, such as the City attorney. This process provides for a secondary set of eyes to review. 4 Payroll Sufficient documentation for the new hire process The City may inadvertently hire employees that have a history that As discussed with the Director of Human Resources, the City now is not always maintained, specifically when would normally disqualify them from consideration. Those uses a checklist for new hire candidates; however, it does not exceptions are allowed to the standard hiring involved in the hiring process are also at risk, should an issue contain all details pertinent to the decision making process. This procedures. surface subsequent to hire and the City lack the adequate checklist should be updated to include specific hiring procedures documentation regarding the decision making process at the time such as background/conflict of interest checks. It should also of hire. include approvals and narratives to document exceptions (i.e., when items that traditionally preclude a candidate from being hired are overwritten/ignored). This checklist should be maintained as supporting documentation. Internal Control Recommendation Log Page 2 of 3

High Priority Medium Priority Low Priority

# Process Priority Observations Possible Risk Recommendations 5 Policies and The City lacked a process where employees City employees were discouraged from reporting potential The City amended the Whistleblower policy in August of 2017 Procedures could report policy and legal breaches without violations and inappropriate behavior of individuals in positions of thereby allowing complaints to be made to the City Manager, City fear of retaliation. authority. This can/did create a "toxic" environment that is highly Attorney, or directly to City Council as appropriate. susceptible to abuse at all levels. We highly encourage the City to review the tone at the top to ensure all members of management and oversight uphold values of honesty, integrity, and ethics, which will encourage employees to uphold the same values. 6 Policies and The overall tone at the top encouraged Management could/did use their position to adversely influence Training, combined with appropriate mechanisms to report issues, Procedures individuals in positions of authority to influence behavior that was not in the best interest of the City. is ideal to promote awareness. We highly encourage the City to subordinates. review the tone at the top to ensure all members of management and oversight uphold the same values of honesty, integrity, and ethics, which will encourage employees to uphold the same values.

7 Policies and The City's response to poor behavior/choices Given the response, behaviors continued that were not in the best We highly encourage the City to review the tone at the top to Procedures when they were made known often reinforced the interest of the City. ensure all members of management and oversight uphold values of wrongdoer's actions, from the employee honesty, integrity, and ethics which will encourage employees to perspective, since sufficient corrective action was uphold the same values. Further, a zero tolerance policy should seldom taken. be established, involving (enforced) consequences for non- compliance. 8 Policies and We identified numerous meal purchases to Occasional meal purchases may be an acceptable use of City The City should update polices to clearly define the acceptable use, Procedures upscale restaurants within petty cash receipts funds; however, without proper policies in place, meal threshold limitations, and supporting documentation requirements and purchase card activity. No policies currently reimbursements are susceptible to abuse by employees, for purchase cards and petty cash. exist documenting the appropriate use of City potentially leading to the personal use of City funds and an funds for meal reimbursements, outside of the inappropriate use of tax dollars. travel policy (i.e., there is no policy regarding "local" meals). 9 Policies and Free access to golf and the community center A sense of entitlement by leadership can be pervasive in an A policy should be implemented that outlines permissions for Procedures were provided to the City Manager. organization. personnel to use City assets. 10 Purchasing We identified a purchase that circumvented the Employees could continue to inappropriately label purchases as We encourage the City to enforce City policies, requiring all Council approval process by being emergency purchases as a method to circumvent the Council emergency purchases to go before Council in the subsequent inappropriately classified as an emergency approval process. meeting of the purchase for affirmation. purchase. *Additionally, Council should consider reviewing the check registers for payments exceeding $10,000. Supporting documentation should be requested for unfamiliar payments to ensure they weren't improperly excluded from Council's oversight/approval.

11 Purchasing We identified multiple instances of approved Conceivably, an employee could alter, forge, manipulate, etc. The City should ensure that questions are asked of unusual receipts which were either altered (e.g., white out, receipts to receive reimbursements for fictitious purchases or for receipts. Answers should be obtained and consequences should etc.) or contained mathematical errors (e.g., the amounts in excess of what they actually paid. Approving receipts be established for non-responsive answers. check amount plus the tip amount did not equal with these characteristics could indicate the current review the total). process is not thorough enough. 12 Purchasing A new vendor “vetting” process/checklist does not The Department Heads' vendor selections could be influenced by A vendor “vetting” policy should be established, including a conflict exist. The Department Heads can select vendors vendors who provide gifts and/or kickbacks. This influence could of interest review by someone other than the Department Head. to be utilized without additional authorization. cause the City to overpay for items/services. New vendors should be periodically reviewed.

Our analytics identified multiple instances of companies sharing an address with an employee being utilized as a vendor. Internal Control Recommendation Log Page 3 of 3

High Priority Medium Priority Low Priority

# Process Priority Observations Possible Risk Recommendations 13 Purchasing We identified numerous purchases on purchase Without itemized receipts, the reviewer of the purchases cannot The City has a policy in place requiring itemized receipts. cards and petty cash that lacked itemized distinguish between inappropriate and appropriate charges. Consequences for not providing itemized receipts should be supporting documentation. Summary receipts communicated and enforced. Consequences could include, loss of were provided, but these did not show the detail purchasing card authorization/use, personal liability for the charges, of the purchase. etc. However, we encourage the City to discuss options with their legal counsel. 14 Purchasing We identified numerous purchases using Without receipts, the reviewer of the purchases cannot distinguish The City has a policy in place requiring itemized receipts. purchase cards and petty cash that lacked any between inappropriate and appropriate charges. Consequences for not providing itemized receipts should be supporting documentation. Further, Affidavits did communicated and enforced. Consequences could include, loss of not exist to support the transactions with missing purchasing card authorization/use, personal liability for the charges, receipts. etc. However, we encourage the City to discuss options with their legal counsel. 15 Purchasing We identified instances whereby the former City A lack of accountability is established if consequences are not Consequences for not following policy should be established, Manager's receipts for meals during travel enforced when policies are violated, thus facilitating the communicated and enforced. Consequences could include, loss of exceeded the policy thresholds. It is our employee's willingness to commit additional violations. purchasing card authorization/use, personal liability for the charges, understanding there were no consequences for etc. However, we encourage the City to discuss options with their this policy violation. legal counsel. 16 Purchasing We identified numerous purchases using The lack of guidelines, policies and procedures can lead to The City should consider updating the policy to include the purchase cards and petty cash with excessive behaviors that are not in the best interest of the City. allowable tip percentages. Variances should be investigated for tips (over 25%+). reasonableness. 17 Purchasing Our analysis identified multiple transactions with Our analysis did not "verify" this occurred; however, conceivably While these characteristics can commonly occur in the normal characteristics indicative of bid-splitting (threshold some of these purchases could have been intentionally split to course of business, the City should consider implementing a avoidance) to keep transactions under the avoid Council approval. periodic process (including analytics) to review for intentional $10,000 threshold. threshold avoidance activity.