720-913-5000 auditor@denvergov.org

Audit Report

Denver Public Trustee

The objective of the audit was to review the Denver Public Trustee—including its accounting practices, compliance with laws and regulations, and governance structure—and to evaluate the efficiency and effectiveness of its internal controls over the foreclosure process.

Watch the Audit Committee presentation here.

Colorado state law establishes the foreclosure process and delegates authority to a public trustee within each county to oversee that process in an objective and fair manner. In some counties, the public trustee function is performed by the county treasurer, while in the City and County of Denver, the elected Clerk and Recorder serves as the public trustee.

The Denver Public Trustee’s Fund Activity Is Not Clearly Stated in the City’s Comprehensive Annual Financial Report

Agency fund activity in the City’s 2017 comprehensive annual financial report was presented based on the net change in assets and liabilities, rather than based on the gross activity passing through the fund.

The Denver Public Trustee Has a Significant Weakness in Internal Controls

During the course of our audit, we found numerous control deficiencies in the Denver Public Trustee’s accounting function. These deficiencies result in a significant weakness in internal control for the Denver Public Trustee. These deficiencies relate to:

  • Insufficient written policies and procedures;
  • An inadequate accounting system;
  • Inaccurate recording of fee revenue;
  • Errors in the list of fees that can be charged;
  • Checks that are improperly printed and held;
  • Improper accounting for held checks;
  • A lack of controls over service organizations;
  • Insufficient segregation of duties; and
  • Poor user permissions and access management policies.

Payroll Approvals Are Accurate and Timely

We found that the Denver Public Trustee does approve employee time sheets accurately and in a timely manner.

1.1 Report All Denver Public Trustee Activity – The Controller’s Office should work with the Denver Public Trustee to develop a process to ensure the full amount of additions and deductions are reported to the Controller’s Office and that those amounts are fully accounted for in the City’s comprehensive annual financial report, beginning with the December 31, 2018 report.

Agency Response: Agree, Implementation Date – May 31, 2019

1.2 Disaggregate Agency Fund Reporting – In the interest of promoting greater transparency, the Controller’s Office should consider disaggregating its reporting of the City’s agency funds in the comprehensive annual financial report going forward. This will allow the public to see the balances of assets and liabilities that relate to each fund at the beginning of the year, all additions and deductions relating to each fund, and the ending balances by fund at year-end.

Agency Response: Agree, Implementation Date – May 31, 2020

2.1 Update Key Policies and Procedures – The Denver Public Trustee should establish and document formal policies and procedures for key processes, such as the foreclosure review process, by the end of 2019. Policies and procedures should be designed to incorporate the five components and 17 principles of the internal control framework issued by the U.S. Government Accountability Office.

Agency Response: Agree, Implementation Date – June 30, 2020

2.2 Integrate Benchmark with Workday – The Denver Public Trustee, in conjunction with the Controller’s Office and the Technology Services agency, should determine if an integration can be built to transfer financial information from Benchmark into Workday by the end of 2019.

Agency Response: Agree, Implementation Date – December 31, 2019

2.3 Record All Transactions in Workday – In addition to developing and implementing integrations between Benchmark and Workday, the Denver Public Trustee should immediately record the summary of daily transaction activity into Workday on a timely basis and use Workday as its primary system of accounting.

Agency Response: Agree , Implementation Date – December 31, 2019

2.4 Improve Policies and Procedures for Revenue Transactions – The Denver Public Trustee should, by the end of 2019, develop and implement formal written policies and procedures requiring revenue transactions be reconciled and reviewed after they are recorded in the City’s Enterprise Cashiering System and in Workday, and that this be done by someone other than the person who recorded the transactions.

Agency Response: Agree, Implementation Date – December 31, 2019

2.5 Create Policies and Procedures for Fees – The Denver Public Trustee should, by the end of 2019, create and implement formal written procedures for regularly reviewing active fees that can be charged to an account. This procedure should ensure fees align with current state law and ensure there are no outdated or incorrect fees available to employees.

Agency Response: Agree, Implementation Date – June 30, 2019

2.6 Move Check-Writing to Controller’s Office – The Denver Public Trustee, in conjunction with the Controller’s Office, should develop a plan to move the function of check-writing to the Controller’s Office by the end of 2019.

Agency Response: Agree, Implementation Date – December 31, 2019

2.7 Prohibit Preprinting of Checks – Until Recommendation 2.6 is implemented, the Denver Public Trustee should immediately update its written policies and procedures to prohibit the practice of printing checks in advance.

Agency Response: Agree, Implementation Date – June 30, 2020

2.8 Move Bank Reconciliation Process to Controller’s Office – The Denver Public Trustee, in conjunction with the Controller’s Office, should develop a plan to move the function of performing bank reconciliations to the Controller’s Office by the end of 2019.

Agency Response: Agree, Implementation Date – June 30, 2020

2.9 Update Bank Reconciliation Form – Until Recommendation 2.8 can be implemented, the Denver Public Trustee should immediately update its bank reconciliation form to distinguish between outstanding checks and held checks and account for both held checks and outstanding checks in accordance with Governmental Accounting Standards Board guidance.

Agency Response: Agree, Implementation Date – December 31, 2018

2.10 Obtain and Review Service Organization Controls Reports – The Denver Public Trustee should work with third-party vendors that provide critical services to obtain Service Organization Controls reports from them by the end of 2019. These reports should be carefully reviewed to determine if there are any weaknesses or gaps in the controls provided by the vendor and to identify critical “user controls” the Denver Public Trustee needs to have in place to rely on the vendor’s controls.

Agency Response: Agree, Implementation Date – December 31, 2019

2.11 Develop and Implement Policies and Procedures for Service Organizations – The Denver Public Trustee should develop and implement formal written policies and procedures for monitoring its third-party vendors that provide critical services but that do not have Service Organization Controls reports available by the end of 2019. These policies and procedures should address all critical requirements that would otherwise be addressed in a standard Service Organization Controls report.

Agency Response: Agree, Implementation Date – December 31, 2019

2.12 Strengthen Segregation of Duties – The Denver Public Trustee should improve segregation of duties by conducting and documenting a thorough review of the current duties assigned to its staff, including identifying incompatible job responsibilities by the end of 2019. The Denver Public Trustee should then remove some incompatible duties from personnel with excessive responsibilities and move those responsibilities to other personnel. For example, a single employee should not have the authority to create and submit the positive pay file as well as have the responsibility to approve or reject positive pay exceptions.

Agency Response: Agree, Implementation Date – December 31, 2019

2.13 Delegate Authority for User Permissions – To better segregate duties, the Denver Public Trustee should, by the end of 2019, assign the ability for modifying user permissions to someone who does not have other responsibilities in Benchmark.

Agency Response: Agree, Implementation Date – June 30, 2019

2.14 Implement Timely Removal of Access – The Denver Public Trustee should immediately create and implement formal written policies and procedures for the timely removal of access for terminated or transferred employees.

Agency Response: Agree, Implementation Date – December 31, 2019

2.15 Develop Review Process for User Permissions – The Denver Public Trustee should create and implement formal written policies and procedures to periodically review user permissions to ensure all users have appropriate access to Denver Public Trustee information systems and that there are no unauthorized users with access to the information systems by the end of 2019.

Agency Response: Agree, Implementation Date – June 30, 2020

 

Follow-up report

A follow-up report is forthcoming. 

Audit Team: Kevin Sear, Jeremy Creamean, Ivy Anderson, Robert Persichitte