AUDIT OF PATCO REVENUE COLLECTION, ACCOUNTING, and CONTROL August 30, 2019 PERFORMED BY: DONNA MCCOY, AUDIT CONSULTANT & RON MCREYNOLDS, IT AUDITOR & DAVID J. AUBREY, INSPECTOR GENERAL Contents A. Objective / Scope / Methodology ............................................................................. 1 B. Background .............................................................................................................. 2 C. Audit Summary ........................................................................................................ 3 D. Documentation of Fare Revenue Process .................................................................. 5 1. Fare Collections / Operations ................................................................................... 5 2. PATCO Finance ....................................................................................................... 14 3. Systems Management / Information Services ......................................................... 19 E. Key Processes, Available Operating Procedures, Associated Risks ........................... 20 F. Walk-Throughs and Testing .................................................................................... 20 G. SEPTA Interoperability Agreement ......................................................................... 22 H. Contracted Services ................................................................................................ 23 I. IT Systems / Resources ........................................................................................... 24 J. PCI DSS (Payment Card Industry Data Security Standard) Compliance ..................... 25 K. Audit Findings and Recommendations .................................................................... 26 August 30, 2019 DELAWARE RIVER PORT AUTHORITY OFFICE OF THE INSPECTOR GENERAL AUDIT OF PATCO REVENUE COLLECTION, ACCOUNTING, and CONTROL A. Objective / Scope / Methodology The Office of the Inspector General (OIG) conducted an audit of the Port Authority Transit Corporation’s (PATCO’s) Revenue. The objective of this audit was to obtain a documented understanding of PATCO’s revenue process and assure that effective and current procedural guidance and governance is in place addressing key processes, activities, and controls. The scope of this audit focused on PATCO High Speedline-related revenue (processing and reporting of PATCO train fares), and included the following: obtaining a documented understanding of the PATCO revenue process (from methods of fare collection / ticketing to financial revenue reporting); identifying and documenting all key processes and process activities (i.e. daily, weekly, monthly, quarterly, annually, and “as needed” activities); reviewing and confirming available procedures, and recommending procedures where they currently do not exist; assessing associated risks and evaluating / recommending controls; performing a documented “walk-through” of the key processes / procedures with PATCO Fare Collection Operations management / staff and PATCO Finance area; performing compliance testing of processes (as determined upon completion of preliminary planning and previously mentioned “walk-through” procedures). obtaining a documented understanding and assessing the control environment of the newly implemented PATCO / SEPTA interoperability processes and PATCO Refund process; identifying associated contracted services and assessing compliance and contract management practices; confirming the source and evaluating the accuracy of monthly reported PATCO revenue and ridership figures for the Chief Financial Officer’s (CFO’s) report to the Authority’s Finance Committee / Board of Commissioners; identifying and documenting interface(s) with various IT systems / resources and assessing associated IT general controls (PATCO, DRPA, and external); and ensuring PCI (Payment Card Industry) compliance is regularly tested and documented. A formal audit entrance meeting was conducted on Thursday, February 14, 2019 at PATCO headquarters to discuss OIG’s audit intentions and present initial information / document requests. Fieldwork began on February 25, 2019 and continued through June 28, 2019. 1 B. Background The PATCO High Speedline, is a rapid transit system which runs between Philadelphia, Pennsylvania, and Camden County, New Jersey. It is operated by the Port Authority Transit Corporation, which is a subsidiary of the Delaware River Port Authority (DRPA). The PATCO Speedline began operations on February 15, 1969, with the first trip from Lindenwold, New Jersey, to Center City Philadelphia. At that time, the 14.2-mile line carried 21,200 riders per day. Currently, PATCO provides as many as 38,000 rides per day. PATCO operates 24 hours per day; 7 days per week out of 13 stations. Fares range from $1.40 to $3.00, depending on the distance traveled and time of day. Senior citizens and persons with disabilities are charged half of the applicable fare during non-peak service times once they are qualified through PATCO’s Reduced-Fare Program (RFP). Each revenue day starts at 2am and runs until 01:59:59am the following day. Revenue and ridership data for the years ended December 31, 2018 and 2017 were as follows: Ridership: • 2018: 10,789,374 • 2017: 10,839,059 Fare Revenue: • 2018: $26,215,246 • 2017: $26,562,482 PATCO uses Cubic Transportation System’s proprietary Automated Fare Collection (AFC) software. The NextFare Central System (referred to as NCS) is the suite of software products designed to work as a system and together function as an end-to-end mass public transport and fare collection system. In addition, PATCO contracts with Cubic to provide staffing for the Freedom Center and to provide administrative and maintenance services related to the software. PATCO also contracts with Brinks Incorporated (Brinks), formerly Dunbar Armored, Inc., to service Ticket Vending Machines and to transport deposits from the PATCO Money Room to the bank daily. 2 Customers may travel using any one of the following fare media types: Freedom Card: a stored-value card that riders can load and reload to add value to be used to ride PATCO. Customers can purchase the cards at Ticket Vending Machines (TVMs) in any PATCO station. For regular adult cards, the lowest amount that can be loaded on the first purchase is $25 (of that, $20 is added to the Freedom Card and $5 is charged for the cost of the card). There is no card charge for seniors, persons with disabilities or students. After the initial load, adult fare customers may replenish Freedom Cards at minimum values of $20. Seniors and persons with disabilities may add smaller values at the Ticket Office Terminals (TOTs) located in the Freedom Customer Service Centers (Freedom Centers). All information regarding each Freedom Card account is stored on a chip in the card. As a result, the card must be physically tapped at a TVM, entrance gate or exit gate in order to update the account. Freedom Cards may be used to pay for transit or to pay for parking in the lots at PATCO stations. T-Card (Transit Benefit Card): a Freedom Card that is used for transit only. This card is generally used by federal government employees and other riders, whose cards are loaded from an employer-sponsored, prepaid transit benefit account and who are precluded from using their prepaid benefit for anything other than transit. These cards can only be used at fare gates, not at parking gates. Share Card: Account-based cards issued to PATCO customers in accordance with an interoperability agreement with the Southeastern Pennsylvania Transportation Authority (SEPTA; refer to section G of this report). All customers with a positive balance (greater than $1.40 on the card) may use their card on PATCO, as well as SEPTA subways, trolleys and buses (excludes travel on Regional Rail lines). Share Cards may also be used for parking at PATCO lots. Single Tickets: Magnetic stripe paper tickets that can be purchased at the TVMs. Customers can purchase a one-way or round-trip fare that can be used for up to 3 days after purchase. Riders may use Freedom Cards and Share Cards to: Ride PATCO transit: they tap in at the entry station and tap out at the exit station, at which point the fare is determined in accordance with fare schedule for the time of day and distance travelled and the customer’s card value is reduced. Pay for parking. Parking Parking is available for over 12,000 cars daily at 7 PATCO stations: Lindenwold, Ashland, Woodcrest, Haddonfield, Westmont, Collingswood, and Ferry Ave. Parking at PATCO stations costs $1 per day for riders. Customers tap their Freedom or Share Cards at the entrance and payment for parking is charged against their balance. There are also meters at Woodcrest, Ashland, Collingwood and Haddonfield. Cash must be used at the parking meters. C. Audit Summary During the course of the audit, OIG conducted numerous interviews, requested documents and conducted walk-throughs and testing. All departments involved with this audit, including PATCO Fare Collections, PATCO Finance, Legal and Information Services were cooperative and responsive to all requests. As a result, OIG was able to accumulate a wealth of information about PATCO Revenue, its internal functions, and its interactions with external parties. 3 In general, PATCO’s revenue operations appear to be designed in a manner which promotes accurate recording and reporting of revenue and limits the risk of waste, loss or misuse of organization assets. Both the Fare Collections