<p>SEMI-ANNUAL IMPLEMENTATION STATUS INTERNAL AUDIT REPORT #11-08 JANUARY 11, 2012</p><p>Scope This report reflects the status, as of November 2011, of outstanding audit corrective action plans (CAP’s) and monitoring projects.</p><p>Status highlights Internal Audit tracked 14 audits during the Fall 2011 status cycle which included a total of 150 individual CAPs of which 122 (81.3%) are now either fully implemented or substantially complete. The timeliness of implementation for open audits has risen from 27.6% in the Spring 2011 update to 36.9% in the current cycle. The CAP’s for 3 of the 14 audits are now fully implemented and will be closed. CAP implementation updates are listed in chronological order by date of audit report issuance. The status highlights were selected based upon the auditor’s professional judgment and do not represent every change within the last six months. Appendix A provides a detailed summary of the implementation status of all CAP’s. To facilitate a review of this report, status coding is as follows:</p><p> Significant delays or conditions which impede implementation of planned corrective actions.  Moderate delays or conditions exist which slow implementation of corrective actions.  Implementation of corrective actions is complete or progressing on schedule. </p><p>Security Audit & FTA Implementation Status Review REPORT #07-11, OCTOBER 22, 2007 Department of Homeland Security (DHS) continues to track progress in addressing security recommendations. The TSA returned in August 2011 to perform a follow-up on the implementation status of their July 2010 Baseline Assessment & Security Enhancement (BASE) recommendations. According to the DHS, while Capital Metro has improved, they will continue to closely monitor the  Authority’s progress in resolving identified security vulnerabilities. A follow-up review has been tentatively scheduled for June 2012. If Capital Metro receives a satisfactory score in this review, BASE assessments will be conducted every five years thereafter.</p><p>Fuel Controls Audit REPORT #08-12, OCTOBER 27, 2008 Service island cameras have been installed: Security cameras have been implemented in the 2910 Headquarters service island fueling areas to monitor for potential unauthorized access to or theft of fuel  and fuel system override activity. The recordings will be retained for an adequate period until fuel usage has been reconciled each month. PAGE 2 OF 7</p><p>Veolia Contract Audit REPORT #09-03, APRIL 27, 2009</p><p> This audit is now closed. </p><p>Facilities & Property Management Audit REPORT #09-04, JUNE 29, 2009 All corrective actions completed: The final corrective action plan item tracking management  oversight of public facilities has been implemented. The audit is now closed.</p><p>Non-revenue Vehicles Audit REPORT #09-05, AUGUST 24, 2009 All corrective actions completed: The final corrective action plan items regarding logging vehicle use  have been implemented. The audit is now closed.</p><p>Capital Planning & Management Performance Audit REPORT #09-06, March 22, 2010 Capital Project Status Key Performance Indicators: The Capital Improvement Program (CIP) Policy, approved in March 2011, requires periodic project status reports of “work completed compared to  budget spent, status of project budget, [and] project completion. …” Project Managers now submit monthly budget and schedule status updates via “Project Profiles.” Summary status information is then periodically reported to management and the Board. Measuring attainment of Capital Project goals/benefits: The CIP Policy requires that “each project will be evaluated against the original investment criteria at least annually. When determining whether the project accomplished its intended goals, the performance measurement methodology outlined in the original project analysis should be used.” To date, these analyses have not been performed because the capital projects which were completed in FY2011 were not supported by a Cost Benefit Analysis. As a result, policy compliance has not been assessed.  The quality of the “business case” project metrics included in the FY2012 Capital Project Profile tracking spreadsheet varies greatly in terms of specificity and detail. To meet the intent of the CIP Policy, before new capital projects are approved, the supporting project benefits/ KPIs should be closely reviewed to validate the feasibility and value of future measurement.</p><p>MetroAccess Performance Audit REPORT #10-06, AUGUST 20, 2010 Improved MetroAccess productivity: The quantity of overflow taxi trips (i.e. those outsourced at full  cost to taxi operators) has dropped from a daily average of 252 in December 2010 to 63 in November 2011. Travel training program expanding: A second travel trainer position has been added to the organizational chart and posted for job applicants and additional funding may be sought to further  expand the program. Travel training programs help to improve the ability of paratransit-eligible persons to navigate the fixed route system and increase their independence and decrease reliance on paratransit services. Independent eligibility appeals panel in place: A five-member eligibility appeals panel has been appointed with ties to the stakeholder community to provide a wholly independent review of applicants  who are denied eligibility to paratransit services. Appeals hearings are now fully separate from the MetroAccess program.</p><p>INTERNAL AUDIT | JANUARY 11, 2012 PAGE 3 OF 7</p><p>Rail Inventory Audit REPORT #10-02, NOVEMBER 18, 2010 Rail materials contracts brought to Board for approval: In a change from past practice, a contract for $281,000 of “consumable” rail materials was brought forward for Board approval in November 2011.  However, Procurement policies have not been updated to reflect this procedural change. Materials in unsecured right-of-way areas reduced by 57 percent: Since the audit, the value of materials in unsecured right-of-way areas has been reduced from $565,000 to $243,000 and now  represents only 8.8% of total inventory value. There is now improved storage, access, and security of rail materials.</p><p>Revenue Collections & Controls Audit REPORT #10-08, JANUARY 12, 2011 Oversight of Transit Store operations improved: The Treasury Supervisor is performing cash reconciliations for the Transit Store and ensures cash deposits are made daily. Installation of new  Transit Store cash registers has been delayed. Once installed, the new cash registers will facilitate reporting and auditing of both cash and ticket inventories. In the interim, a manual audit procedure has been developed.</p><p>Rail Fare Enforcement Inspector hired: This position was filled in September 2011. To help offset the cost of rail enforcement, a proposed fare evasion administrative penalty was originally to have been  submitted for Board approval by March 31, 2011. The timeline has been delayed until May 2012.</p><p>IT Governance Audit REPORT #11-07, APRIL 13, 2011 Information Technology SWOT (Strengths, Weaknesses, Opportunities, and Threats) Assessment: A SWOT assessment, which considered the results of the IT Governance Audit, was completed in October 2011. The assessment  prioritizes corrective actions to address identified threats and opportunities. The CIO has initially focused on filling key positions and strengthening the IT organizational structures. A Technology Strategic Plan will be completed by March 31, 2012 and will be used to guide future actions. Payment Card Industry Data Security Standards (PCI DSS) Compliance verified: Capital Metro’s PCI DSS compliance certificate for rail ticket vending machines was renewed timely on  November 28, 2011. The Accounting Manager has ongoing responsibility for maintaining a current PCI DSS compliance certificate.</p><p>Property Management & Space Planning Audit REPORT #11-06, MAY 11, 2011 Inventory of non-rail properties complete: The Real Estate  Manager completed an inventory of non-rail real properties. Rail Right-of-Way agreements standardized: The Legal Department has developed a set of templates and boilerplate  language to be used for future right-of-way agreements. This will facilitate timely approval of legal instruments and ensuing revenue recognition.</p><p>INTERNAL AUDIT | JANUARY 11, 2012 PAGE 4 OF 7</p><p>MetroRapid Project Implementation Monitoring MONITORING PROJECT #11-01 Project Construction Grant Agreement (PCGA) Delay: As of the last status update, the FTA anticipated that it would forward the agreement for approval in July 2011. The latest is now “early 2012.” The current MetroRapid project schedule assumed PCGA approval would occur no later than November 2011. The project schedule is now at risk of achieving current forecast start dates of Aug. 2013 and Jan. 2014 for Routes 1 and 2, respectively.  Furthermore, grant reimbursement requests are not allowed until after PCGA approval. To limit financial risk, Capital Metro will continue with design work only and delay construction costs until after the PCGA is approved. Similarly, the notice to proceed for acquiring MetroRapid vehicles will be issued only after the PCGA approval is secured. (Current vehicle pricing has been extended until April 30, 2012.) MetroRapid Ridership Projections: The Planning and Finance Departments coordinate to ensure alignment between estimated ridership projections, the MetroRapid Business Case, long-range  financial plan, and the annual operating budget. As of November 2011, Planning estimates that anticipated combined ridership in the Route 1 and Route 2 corridors remains materially “on target” with original projections. Quality Assurance Plan: According to the Project Management Plan, once the Project Construction Grant Agreement (PCGA) has been fully executed, the MetroRapid quality assurance program will be developed under the guidelines and supervision of a Quality Assurance Manager (to be named). The MetroRapid  Quality Assurance Plan will be based on elements provided in FTA Quality Assurance and Quality Control Guidelines. Once completed, it will be incorporated into the Project Management Plan. Project Risk Management: The MetroRapid Risk Register was created in November 2010. It identifies project risks and analyzes the likelihood and impact if the risk(s) materialize. Originally, the Risk Register was to be formally updated and forwarded to the FTA upon PCGA approval. To  avoid further delays, Risk Register updates will commence in January 2012 prior to the PCGA approval.</p><p>First Transit Contract Audit REPORT #11-12, SEPTEMBER 14, 2011 Invoice review template updated: The invoice review template has been updated to include a review  of all penalties listed in the First Transit contract. </p><p>INTERNAL AUDIT | JANUARY 11, 2012 PAGE 5 OF 7</p><p>Why status updates are important United States General Accountability Office (GAO) standards specify that management is responsible for “addressing the findings and recommendations of auditors, and for establishing and maintaining a process to track the status of such findings and recommendations.”1 Internal auditors are required to follow-up to determine whether appropriate corrective actions have been taken.2</p><p>Closing Internal Audit is grateful to Capital Metro management and staff who have worked to implement improvements in controls and processes. Their cooperation and assistance is instrumental to the success of the Authority.</p><p>______Caroline M. Beyer, CPA, CISA VP, Internal Audit cc: Capital Metro Board of Directors Linda Watson, President / CEO Elaine Timbes, EVP / Chief Operating Officer Doug Allen, EVP / Chief Development Officer Billy Hamilton, Interim EVP Finance & Administration Kerri Butcher, Interim Chief Counsel Capital Metro Leadership Team</p><p>1 GAO-12-331G Government Auditing Standards, 2011 Revision, Section A1.08.f. http://www.gao.gov/assets/590/587281.pdf 2 GAO-12-331G Government Auditing Standards, 2011 Revision, Section 7.05.</p><p>INTERNAL AUDIT | JANUARY 11, 2012 PAGE 6 OF 7</p><p>Appendix A: Implementation Status Detail</p><p>Implementation Status Report Exec Project Name Substantially In Not Disagre Timely Date Sponsor Complete Complete Process Implem. e 10/22/07 Timbes Security Program Audit 6 0 0 2 0 - 3/31/08 Hamilton Accounts Receivable Audit 7 0 0 2 0 - 10/27/08 Timbes Fuel Controls Audit 22 1 0 1 0 16.7% Timbes / Veolia Contract Audit 4/27/09 2 0 0 0 0 0% Hamilton – Audit Closed Facilities & Property Management 6/29/09 Timbes 9 0 0 0 0 33.3% Audit – Audit Closed Non-Revenue Vehicles Audit 8/24/09 Timbes 11 0 0 0 0 9.1% – Audit Closed Capital Planning & Management 3/22/10 Hamilton 9 1 0 0 0 90.0% Performance Audit 8/20/10 Timbes MetroAccess Performance Audit 18 4 3 1 0 29.2% 11/18/10 Clark Rail Inventory Audit 6 0 4 1 0 45.5% Revenue Collections & Controls 1/12/11 Hamilton 13 3 5 3 0 50.0% Audit 4/13/11 Iannello IT Governance 5 0 1 3 0 55.6% Property Management & Space 7/13/11 Hodges 3 0 1 0 0 75.0% Planning Audit 9/14/11 Timbes First Transit Contract Audit 2 0 0 1 0 66.7%</p><p>Current Quantity 113 9 14 14 0 36.9% 11/2011 Percentage 75.3% 6.0% 9.3% 9.3% 0% TOTALS Previous Quantity 113 7 25 23 0 27.6% 5/2011 Percentage 67.3% 4.2% 14.9% 13.7% 0%</p><p>Action item status categories:</p><p>Complete Intent of the corrective action plan item has been met and no further corrective action is required. In some instances, Internal Audit monitors to ensure continuity.</p><p>Substantially Complete Greater degree of progress towards completion than “In Process” and may not require further steps beyond continued performance, monitoring, and/or experience with the implemented action plan. </p><p>In Process Some progress towards implementation of corrective action plan has been made but additional actions are required before intent is met.</p><p>Not Implemented No measurable progress towards implementation of corrective action plan (excludes action plan items for which the target date has not yet been reached).</p><p>Disagree Management disagrees with finding and/or accepts the risk of occurrence and effects.</p><p>INTERNAL AUDIT | JANUARY 11, 2012 PAGE 7 OF 7</p><p>Timely This represents the relative percentage of all corrective action plans for which intent was met by the stated target date. The total figure represents a weighted average for all applicable updates.</p><p>INTERNAL AUDIT | JANUARY 11, 2012</p>