DENVER – The City of Denver streamlined and formalized how it manages debt after a 2018 audit, but still could do a better job of handling changes to software used to track debt, according to a new follow-up report out this month from Denver Auditor Timothy M. O’Brien, CPA.
“By keeping a tight control on how we manage our debt, we can better serve the voters who approved the city’s bonds,” Auditor O’Brien said.
Our audit in 2018 revealed that the Departments of Finance and Public Works — now called the Department of Transportation and Infrastructure — needed to strengthen and enforce policies related to debt management and bond proceed expenditures and to the maintenance, oversight, and security of certain critical information systems. By making the recommended changes, auditors concluded, the city could oversee its debt better, ensuring compliance with bond covenants and other regulatory requirements.
We found the Department of Finance implemented six of our recommendations, partially implemented two, and did not implement one. The Department of Transportation and Infrastructure implemented one recommendation, partially implemented two, and did not implement four.
One key unimplemented recommendation was related to how the city checks its work. We recommended a process for reconciling changes within the software application called the Capital Integration System, used to aggregate financial data and track project and program management progress.
We recommended the city track changes made to the application to make sure outputs match. Transportation and Infrastructure said it does not perform any kind of formalized reconciliation or review process. That means the department is not periodically comparing the output to the source code to ensure only authorized changes were made.
“We need to make sure we’re getting what we expect when we use software applications in our work,” Auditor O’Brien said. “Although the city has a close working relationship with the software developer and communicates well when changes are made, we still need safeguards to keep bad actors from causing errors we might not catch.”
Two of the other unimplemented recommendations were also related to the Capital Integration System. The department says it plans to phase out the application entirely over the next year, so the recommended changes were not implemented.
“I understand the rationale for not implementing these two recommendations if they will not be relevant in a matter of months,” Auditor O’Brien said. “I expect the auditee to then apply our recommendations for best practices to their future financial and project tracking application use.”
Other unimplemented recommendations involved collection of Service Organization Control reports, independent analyses used to determine whether third-party vendors are accurately processing city financial transactions.
The city did make improvements to how it documents exceptions to debt policy; created, documented and implemented policies and procedures; and created stronger controls over event disclosure.