The URL can be used to link to this page

Home My WebLink About09-04-2024 Audit Ad Hoc Committee Meeting Complete Agenda Packet SPECIAL NOTICE PUBLIC ATTENDANCE & PARTICIPATION AT PUBLIC MEETINGS Audit Ad Hoc Committee Meeting Wednesday, September 4, 2024 4:00 p.m. Your participation is always welcome. OC San offers several ways in which to interact during meetings. You will find information as to these opportunities below. IN-PERSON MEETING ATTENDANCE You may attend the meeting in-person at the following location: Orange County Sanitation District Headquarters Building 18480 Bandilier Circle Fountain Valley, CA 92708 ONLINE MEETING PARTICIPATION You may join the meeting live via Teams on your computer or similar device or web browser by using the link below: Click here to join the meeting We suggest testing joining a Teams meeting on your device prior to the commencement of the meeting. For recommendations, general guidance on using Teams, and instructions on joining a Teams meeting, please click here. Please mute yourself upon entry to the meeting. Please raise your hand if you wish to speak during the public comment section of the meeting. The Clerk of the Board will call upon you by using the name you joined with. Meeting attendees are not provided the ability to make a presentation during the meeting. Please contact the Clerk of the Board at least 48 hours prior to the meeting if you wish to present any items. Additionally, camera feeds may be controlled by the meeting moderator to avoid inappropriate content. HOW TO PARTICIPATE IN THE MEETING BY TELEPHONE To join the meeting from your phone: Dial (213) 279-1455 When prompted, enter the Phone Conference ID: 478 823 548# All meeting participants may be muted during the meeting to alleviate background noise. If you are muted, please use *6 to unmute. You may also mute yourself on your device. Please raise your hand to speak by use *5, during the public comment section of the meeting. The Clerk of the Board will call upon you by using the last 4 digits of your phone number as identification. NOTE: All attendees will be disconnected from the meeting at the beginning of Closed Session. If you would like to return to the Open Session portion of the meeting, please login or dial-in to the Teams meeting again and wait in the Lobby for admittance. WATCH THE MEETING ONLINE The meeting will be available for online viewing at: https://ocsd.legistar.com/Calendar.aspx SUBMIT A COMMENT You may submit your comments and questions in writing for consideration in advance of the meeting by using the eComment feature available online at: https://ocsd.legistar.com/Calendar.aspx or sending them to OCSanClerk@ocsan.gov with the subject line “PUBLIC COMMENT ITEM # (insert the item number relevant to your comment)” or “PUBLIC COMMENT NON-AGENDA ITEM”. You may also submit comments and questions for consideration during the meeting by using the eComment feature available online at: https://ocsd.legistar.com/Calendar.aspx. The eComment feature will be available for the duration of the meeting. All written public comments will be provided to the legislative body and may be read into the record or compiled as part of the record. For any questions and/or concerns, please contact the Clerk of the Board’s office at 714-593-7433. Thank you for your interest in OC San! August 27, 2024 NOTICE OF REGULAR MEETING AUDIT AD HOC COMMITTEE ORANGE COUNTY SANITATION DISTRICT Wednesday, September 4, 2024 – 4:00 P.M. Headquarters Building 18480 Bandilier Circle Fountain Valley, CA 92708 ACCESSIBILITY FOR THE GENERAL PUBLIC Your participation is always welcome. Specific information as to how to participate in this meeting is detailed on the Special Notice attached to this agenda. In general, OC San offers several ways in which to interact during this meeting: you may participate in person, join the meeting live via Teams on your computer or similar device or web browser, join the meeting live via telephone, view the meeting online, and/or submit comments for consideration before or during the meeting. The Regular Meeting of the Audit Ad Hoc Committee of the Orange County Sanitation District will be held at the above location and in the manner indicated on Wednesday, September 4, 2024 at 4:00 p.m. ROLL CALL AUDIT AD HOC COMMITTEE Meeting Date: September 4, 2024 Time: 4:00 p.m. COMMITTEE MEMBERS (4) Jon Dumitru (Orange) Phil Hawkins (YLWD) Bob Ooten (CMSD) Bruce Whitaker (Fullerton) OTHERS Scott Smith, General Counsel STAFF Rob Thompson, General Manager Lorenzo Tyner, Assistant General Manager Wally Ritchie, Director of Finance Kelly Lore, Clerk of the Board ORANGE COUNTY SANITATION DISTRICT Effective 01/23/2024 BOARD OF DIRECTORS Complete Roster AGENCY/CITIES ACTIVE DIRECTOR ALTERNATE DIRECTOR Anaheim Stephen Faessel Carlos A. Leon Brea Christine Marick Cecilia Hupp Buena Park Joyce Ahn Art Brown Cypress Scott Minikus Bonnie Peat Fountain Valley Glenn Grandis Ted Bui Fullerton Bruce Whitaker Nick Dunlap Garden Grove Stephanie Klopfenstein John O’Neill Huntington Beach Pat Burns Gracey Van Der Mark Irvine Farrah N. Khan Kathleen Treseder La Habra Rose Espinoza Jose Medrano La Palma Debbie Baker Mark I. Waldman Los Alamitos Jordan Nefulda Shelley Hasselbrink Newport Beach Brad Avery Erik Weigand Orange Jon Dumitru John Gyllenhammer Placentia Chad Wanke Ward Smith Santa Ana Johnathan Ryan Hernandez Benjamin Vazquez Seal Beach Schelly Sustarsic Lisa Landau Stanton David Shawver Carol Warren Tustin Ryan Gallagher Austin Lumbard Villa Park Robbie Pitts Jordan Wu Sanitary/Water Districts Costa Mesa Sanitary District Bob Ooten Art Perry Midway City Sanitary District Andrew Nguyen Tyler Diep Irvine Ranch Water District John Withers Douglas Reinhart Yorba Linda Water District Phil Hawkins Tom Lindsey County Areas Board of Supervisors Doug Chaffee Donald P. Wagner AUDIT AD HOC COMMITTEE Regular Meeting Agenda Wednesday, September 4, 2024 - 4:00 PM Huntington Beach Room Headquarters Building 18480 Bandilier Circle Fountain Valley, CA 92708 (714) 593-7433 ACCOMMODATIONS FOR THE DISABLED: If you require any special disability related accommodations, please contact the Orange County Sanitation District (OC San) Clerk of the Board’s office at (714) 593-7433 at least 72 hours prior to the scheduled meeting. Requests must specify the nature of the disability and the type of accommodation requested. AGENDA POSTING: In accordance with the requirements of California Government Code Section 54954.2, this agenda has been posted outside OC San's Headquarters Building located at 18480 Bandilier Circle, Fountain Valley, California, and on the OC San’s website at www.ocsan.gov not less than 72 hours prior to the meeting date and time above. All public records relating to each agenda item, including those distributed less than 72 hours prior to the meeting to a majority of the Board of Directors, are available for public inspection with the Clerk of the Board. AGENDA DESCRIPTION: The agenda provides a brief general description of each item of business to be considered or discussed. The recommended action does not indicate what action will be taken. The Board of Directors may take any action which is deemed appropriate. MEETING RECORDING: A recording of this meeting is available within 24 hours after adjournment of the meeting at https://ocsd.legistar.com/Calendar.aspx or by contacting the Clerk of the Board. NOTICE TO DIRECTORS: To place items on the agenda for a Committee or Board Meeting, the item must be submitted to the Clerk of the Board: Kelly A. Lore, MMC, (714) 593-7433 / klore@ocsan.gov at least 14 days before the meeting. For any questions on the agenda, Board members may contact staff at: General Manager: Rob Thompson, rthompson@ocsan.gov / (714) 593-7110 Asst. General Manager: Lorenzo Tyner, ltyner@ocsan.gov / (714) 593-7550 Director of Communications: Jennifer Cabral, jcabral@ocsan.gov / (714) 593-7581 Director of Engineering: Mike Dorman, mdorman@ocsan.gov / (714) 593-7014 Director of Environmental Services: Lan Wiborg, lwiborg@ocsan.gov / (714) 593-7450 Director of Finance: Wally Ritchie, writchie@ocsan.gov / (714) 593-7570 Director of Human Resources: Laura Maravilla, lmaravilla@ocsan.gov / (714) 593-7007 Director of Operations & Maintenance: Riaz Moinuddin, rmoinuddin@ocsan.gov / (714) 593-7269 AUDIT AD HOC COMMITTEE Regular Meeting Agenda Wednesday, September 4, 2024 CALL TO ORDER ROLL CALL: Clerk of the Board PUBLIC COMMENTS: Your participation is always welcome. Specific information as to how to participate in a meeting is detailed in the Special Notice attached to this agenda. In general, OC San offers several ways in which to interact during meetings: you may participate in person, join the meeting live via Teams on your computer or similar device or web browser, join the meeting live via telephone, view the meeting online, and/or submit comments for consideration before or during the meeting. INFORMATION ITEMS: 1.2024-3773INTERNAL AUDIT UPDATE RECOMMENDATION: Information Item. Originator:Wally Ritchie Agenda Report Accounts Payable Vendor Review Internal Audit Report Construction Change Orders Review Internal Audit Report Attachments: OTHER BUSINESS AND COMMUNICATIONS OR SUPPLEMENTAL AGENDA ITEMS, IF ANY: ADJOURNMENT: Adjourn the Audit Ad Hoc Committee Meeting. Page 1 of 1 AUDIT AD HOC COMMITTEE Agenda Report Administration Building 10844 Ellis Avenue Fountain Valley, CA 92708 (714) 593-7433 File #:2024-3773 Agenda Date:9/4/2024 Agenda Item No:1. FROM:Robert Thompson, General Manager Originator: Wally Ritchie, Director of Finance SUBJECT: INTERNAL AUDIT UPDATE GENERAL MANAGER'S RECOMMENDATION RECOMMENDATION: Information Item. BACKGROUND The Orange County Sanitation District (OC San)selected the audit firm of Eide Bailly LLP to provide audits of various OC San programs and processes as selected by the Audit Ad Hoc Committee. Most recently,the Audit Ad Hoc Committee selected the Accounts Payable (AP)Vendor Review and Construction Change Orders Review for audit. The auditors were directed to focus their efforts on ensuring internal controls and processes.The auditors will provide an update of those efforts. RELEVANT STANDARDS ·Conduct audits to determine if OC San operations are being conducted in an economical and efficient manner ·Conduct audits to establish whether specific government programs are effective in meeting their stated goals and objectives ·Conduct audits to determine if OC San is following policies and procedures in conducting operations ADDITIONAL INFORMATION Eide Bailly LLP performed an independent assessment of OC San’s AP Vendor Review and Construction Change Orders Review to ensure appropriate internal controls and processes.The audit work done in these areas is summarized below. Orange County Sanitation District Printed on 8/27/2024Page 1 of 2 powered by Legistar™ File #:2024-3773 Agenda Date:9/4/2024 Agenda Item No:1. 1)Accounts Payable Vendor Review Review OC San’s procedures and controls to ensure they are adequately designed and implemented to identify,prevent,and detect the inclusion of fictitious vendors within the AP system. Select and audit records to ensure processes are effective in verifying the authenticity and legitimacy of new and existing vendors,including ongoing monitoring mechanisms to detect unusual transactions or relationships. Ensure appropriate measures are in place to prevent and detect conflicts of interest involving employees who may influence vendor selection and payment processes. 2)Construction Change Orders Review Review OC San’s internal controls as they relate to Construction Change Orders to determine whether they are designed and operating efficiently to mitigate risks and ensure compliance with relevant guidelines and standards. Select construction change orders and test for key internal controls related to the authorization of construction change orders, including approval timeliness and justification. ATTACHMENT The following attachment(s)may be viewed on-line at the OC San website (www.ocsan.gov)with the complete agenda package: ·Accounts Payable Vendor Review Internal Audit Report ·Construction Change Orders Review Internal Audit Report Orange County Sanitation District Printed on 8/27/2024Page 2 of 2 powered by Legistar™ Accounts Payable Vendor Review August 2024 ORANGE COUNTY SANITATION DISTRICT Submitted By: Eide Bailly LLP 2| eidebailly.com ORANGE COUNTY SANITATION DISTRICT: ACCOUNTS PAYABLE VENDOR REVIEW TABLE OF CONTENTS Executive Summary ......................................................................................... 3 Background Information .................................................................................. 3 Objective & Scope ........................................................................................... 5 Methodology ................................................................................................... 5 Results and Conclusion .................................................................................... 6 FINDING #1 – Review of Vendor Master File .................................................... 6 FINDING #2 – Duplicate Vendors ..................................................................... 6 FINDING #3 – Policies and Procedures ............................................................. 8 FINDING #4 – Vendor Master File User Access ................................................. 8 FINDING #5 – Vendor Documentation ............................................................. 9 ORANGE COUNTY SANITATION DISTRICT: ACCOUNTS PAYABLE VENDOR REVIEW 3| eidebailly.com Executive Summary Eide Bailly LLP (referred to as "we," "our," or "us") was engaged by the Orange County Sanitation District (“OC San,” “OCSD,” or “District”) to perform a comprehensive review of the Accounts Payable Vendor Review process. This engagement was identified in the initial risk assessment, highlighting the importance of this area in OC San’s operations. Additionally, this engagement is to be conducted every three to five years to ensure continuous monitoring and ongoing improvement of OC San’s vendor management processes. The risk assessment and multi‐year audit plan helps mitigate risks, enhance internal controls, and maintain data integrity, ultimately contributing to the District’s overall efficiency and reputation. This engagement focused on evaluating the internal controls and processes over the Accounts Payable (AP) Vendor Review. The review involved gathering and evaluating documentation outlining the District’s processes, procedures, and internal controls related to AP Vendor Review. This included analyzing policies, desktop procedures, guidelines, and relevant forms. We conducted interviews with individuals involved in the process to gain a better understanding of their roles and to identify relevant controls and monitoring activities. Our review primarily concentrated on the vendor setup and maintenance processes, and we are pleased to report that the District maintains efficient internal controls and appropriate segregation of duties over these operations. This engagement identified five (5) findings that present opportunities for improving the existing AP Vendor Review process. Addressing these findings can further enhance operational efficiency and effectiveness. We extend our sincere gratitude to the Contracts & Purchasing Manager, Principal Staff Analyst, Accounting Supervisor, and the Contracts & Purchasing Technicians for their valuable contributions. Their insights were instrumental in enhancing our understanding of the AP Vendor Review process, and they enabled us to provide meaningful recommendations for process improvements and control enhancements. Background Information OC San’s wastewater system is dedicated to safeguarding public health and the environment from the potential hazards of wastewater. To ensure the proper operation of its extensive water system, the District undertakes regular construction, reconstruction, repair, and rehabilitation of system facilities through capital improvement projects. This requires contracting with numerous outside vendors and local businesses. As of June 2024, the District had approximately 3,700 active vendors during the period of July 1, 2023, through June 3, 2024. The vendor master file is an important component of the District’s purchasing and accounts payable (AP) processes. It contains key information such as the vendor’s name, address(es), tax identification number1 (TIN), and contact information. This information is used to send payments to vendors and to process 1099s, as required by the Internal Revenue Service (IRS). Vendor management is essential for efficient, cost effective, and compliant procurement and financial operations. OC San’s vendor setup and maintenance processes are managed by the Contracts and Purchasing Division within the District’s ERP system, JD Edwards or JDE. Requests to setup new vendors or update existing vendor information in the system can be submitted by Contract Administrators, Buyers, or AP personnel. However, only Purchasing Technicians within the Contracts and Purchasing Division have the authority and system access to create or update vendor information. The AP team, which manages vendor payments, does not have access to create or update vendor records in the system. See Figure 1 for OC San’s vendor creation process. 1 A TIN, or Tax Identification Number, is a unique identifier used by Internal Revenue Service (IRS) for tax purposes. A TIN is assigned either by the Social Security Administration (social security number) or by the Internal Revenue Service (Federal Employer Identification Number). ORANGE COUNTY SANITATION DISTRICT: ACCOUNTS PAYABLE VENDOR REVIEW 4| eidebailly.com This review evaluated the internal controls over the vendor management process, ensuring that vendors are legitimate, transactions are transparent, and conflicts of interest are avoided. During the scope of this review, Accounts Payable processed close to 18,000 invoices for payment, totaling approximately $321,739,000. Figure 1 Steps to Add a New Vendor to the Vendor Master File Source: EB created process flowchart of vendor creation process ORANGE COUNTY SANITATION DISTRICT: ACCOUNTS PAYABLE VENDOR REVIEW 5| eidebailly.com Objective & Scope The Objective of this review was to evaluate the internal controls over the AP Vendor Review process to ensure that:  Procedures and controls are adequately designed and implemented to identify, prevent, and detect the inclusion of fictitious vendors within the AP system;  Controls are effective in verifying the authenticity and legitimacy of new and existing vendors, including ongoing monitoring mechanisms to detect unusual transactions or relationships;  Appropriate measures are in place to prevent and detect conflicts of interest involving employees who may influence vendor selection and payment processes. The Scope of this engagement covered all active vendors in the period from July 1, 2023, to June 30, 2024 (Fiscal Year 2024). The engagement was performed under the Statements on Standards for Consulting Services issued by the American Institute of Certified Public Accountants (AICPA). We did not provide audit, review, compilation or financial statement preparation services to any historical or prospective financial information or provide attestation services under the AICPA Statements on Standards for Attestation Engagements and assume no responsibility for any such information. Methodology In alignment with the stated objectives, our procedures included, but were not limited to, the following activities: 1. Obtained and reviewed relevant policies and procedures related to the AP Vendor Review Process. 2. Obtained and reviewed the organization chart and gained an understanding of the organization's structure along with roles and responsibilities of personnel involved in vendor selection and payment process. 3. Performed interviews and process walkthroughs of key personnel and gained an understanding of the AP Vendor Review process. Key Personnel Interviewed included:  Contracts and Purchasing Manager  Principal Staff Analyst  Accounting Supervisor  Contracts and Purchasing Technicians 4. Evaluated processes, procedures and internal controls designed to prevent and detect fictitious vendors within the AP system. 5. Obtained and reviewed the vendor master file to identify potential duplicate and/or fictitious vendors. 6. Tested a sample of vendors to verify controls in place are effective to maintain the completeness and accuracy of vendor information. 7. Evaluated controls in place to prevent and detect conflicts of interest. 8. Reviewed User Access Roles to verify proper segregation of duties. ORANGE COUNTY SANITATION DISTRICT: ACCOUNTS PAYABLE VENDOR REVIEW 6| eidebailly.com Results and Conclusion Orange County Sanitation District established efficient processes, procedures, and internal controls over the AP Vendor Review process. Based on the procedures performed during this assessment, we identified areas of strength within the process including proper segregation of duties, effective oversight over vendor setup and maintenance, and robust controls over vendor payment processes. The District has well‐defined purchasing thresholds and signing authority which provide clear guidelines to ensure all vendor transactions are subject to appropriate levels of review and approval. While some key controls over the AP Vendor Review process are operating effectively, we identified certain areas where these controls are not functioning as intended. This assessment identified five (5) findings, for which we have provided recommendations to strengthen the overall control environment. By implementing these recommendations, OC San can improve the integrity of its vendor management process, reduce the risk of fraudulent activities, and enhance overall operational efficiency. FINDING #1 – Review of Vendor Master File OC San currently has two issues related to the vendor master file review. First, there is no formally documented process for the periodic review and maintenance of the vendor master file. The AP team only sends the list of vendors recommended for deactivation to the Purchasing Technicians on an annual basis, which is not formally documented. Second, while Information Technology (IT) generated a system report to assist in identifying potential duplicate vendors, this process is also not formally documented and is not performed on a routine basis. The lack of a structured, regular review process increases the risk of having outdated, duplicate, or fictitious vendor records in the system. Recommendation To address the identified issues with the vendor master file review process, OC San should implement a formalized, documented, and comprehensive review process and conduct reviews of the vendor master file on an annual basis. This review should include a thorough evaluation of all vendor records and data entry practices, as well as an analysis of processes to ensure ongoing compliance with documentation standards. In addition to a formal periodic review process, OC San should also consider implementing ad hoc reviews whenever significant changes occur, such as significant increases in vendor activity or following any major incident involving vendor management. By implementing these corrective actions, the District can significantly improve the integrity and accuracy of the vendor master file, reducing the risk of maintaining outdated, duplicate, or fictitious vendor records. Management Response OC San’s Purchasing and Contracts Manager will ensure all procedures are updated to incorporate periodic reviews of the vendor master file, as well as ad hoc reviews, as needed. The procedures will include review of duplicate vendors, vendor set up, and documentation. These procedures will be updated by December 31, 2024. FINDING #2 – Duplicate Vendors During our examination of the vendor master file, we identified several instances of potential duplicate records where vendors contained identical or similar information. Our analysis indicated that certain vendors appeared multiple times in the vendor master file, often with slight variations in their names or addresses. Inconsistent vendor naming conventions has contributed to these duplicate vendors. ORANGE COUNTY SANITATION DISTRICT: ACCOUNTS PAYABLE VENDOR REVIEW 7| eidebailly.com See Duplicate Vendor Examples below. Additionally, we noted that some vendors were assigned multiple vendor numbers. Currently, OC San maintains a total of 3,778 active vendors, and our assessment identified that 69 of these entries are actual duplicate vendors based on matching criteria, including vendor name and vendor address. Duplicate Vendor Example #1: Vendor Name: System Integrators LLC Duplicate: Systems Integrators LLC (s at end of Systems) Duplicate Vendor Example #2: Vendor Name: Arcadis U.S. Inc. Duplicate: Arcadis U.S., Inc. (coma at end of U.S.) Duplicate Vendor Example #3: Vendor Name: City of Fullerton Duplicate: Fullerton City of Duplicate Vendor Example #4: Vendor Name: SCCWRP Duplicate: Southern California Coastal Water Duplicate Vendor Example #5: Vendor Address: 2055 E Centennial Cir Duplicate: 2055 East Centennial Circle It is important to note that certain circumstances can lead to unavoidable duplicate vendors, such as vendors with different remittance addresses, shared office spaces, or vendors resulting from mergers with the same address. The presence of duplicate vendors has several risks, including an increased likelihood of duplicate payments, inaccurate financial reporting, and operational inefficiencies. Addressing these issues through data cleanup, standardizing vendor naming conventions, and implementing stricter data entry protocols will help mitigate these issues, ensuring that each vendor is accurately represented in the master file. Recommendation We recommend that OC San establish ongoing monitoring processes and conduct periodic reviews of the vendor master file, to identify and merge duplicate vendor records. This process should involve regular reviews, as detailed in Finding #1, to ensure the integrity of the vendor data is maintained. Additionally, we recommend the implementation of standardized naming conventions and data entry guidelines. By establishing clear protocols for how vendor names and other relevant information should recorded, OC San can significantly reduce the likelihood of future duplicate entries. This could involve creating a reference guide for staff to ensure consistency in spelling, formatting, and abbreviations used when entering vendor information. Lastly, we recommend strengthening the verification procedures for new vendor setups and updates. This includes implementing thorough checks against existing records before creating new entries, which will help prevent duplicates from being introduced into the vendor master file. Such checks could involve searching for potential matches based on multiple criteria—including name, address, and tax identification number—prior to approving new vendor registrations. Management Response OC San’s Purchasing and Contracts Manager will ensure all procedures are updated to incorporate ORANGE COUNTY SANITATION DISTRICT: ACCOUNTS PAYABLE VENDOR REVIEW 8| eidebailly.com periodic reviews of the vendor master file, as well as ad hoc reviews, as needed. The procedures will include review of duplicate vendors, vendor set up, and documentation. The procedure will also be updated to include verification of existing vendor information before adding a new vendor. These procedures will be updated by December 31, 2024. FINDING #3 – Policies and Procedures OC San does not have an established schedule or process for the periodic review of existing policies and procedures (P&P) related to the AP Vendor Review process, resulting in outdated documentation. The document “JDE – Address Book Procedures” was last updated in March of 2022 and has not been revised to reflect the current process, specifically the requirement for vendors to submit a Payee Data Record Form along with the vendor’s W‐92 form, attaching the VIN creation/update request email in JDE, and ensuring there is an audit trail for all changes made to vendor records. Additionally, the other two documents reviewed, “Activity Level Controls AP Purchases” and “Vendor ACH Payments” lack version control information, preventing us from determining the last time they were reviewed and updated. Outdated and incomplete P&Ps can result in inconsistent application of processes, confusion among staff, and potential non‐compliance with new procedures. This increases the risk of errors, inefficiencies, and potential legal or regulatory issues, ultimately compromising the integrity and effectiveness of the AP Vendor Review process. Recommendation To address these issues, we recommend the following corrective actions:  OC San should implement a formal process for the periodic review and update of all P&Ps, at least annually or on a rolling basis. This process should include a schedule for reviews, a designated responsible party, and documentation of the review and update process.  OC San should update the existing P&Ps to include the current processes and procedures, including the steps mentioned in the finding, and incorporate best practices for vendor management to align with industry standards. Ensure that all relevant updates are clearly documented and communicated to the staff.  Lastly, OC San should ensure that all P&Ps have proper version control information, including the date of the last review and approval. This will help maintain the relevance and accuracy of the documentation. By implementing these corrective actions, the District can ensure that its vendor setup and management processes are governed by current, accurate, and comprehensive policies and procedures, thereby improving the consistency and reliability of the vendor setup and management processes. Management Response OC San’s Purchasing and Contracts Manager will ensure all procedures are updated to incorporate current practices, as well as a periodic review of all procedures. The format of the procedure will also be updated to reflect current OC San formatting for Policies and Procedures, including version control, and date of last review and approval. These procedures will be updated by December 31, 2024. FINDING #4 – Vendor Master File User Access During our review, we identified one individual, who transitioned to a different position within the organization and retained read and write permissions to the Vendor Master File. We acknowledge that 2 A W‐9 Form is an IRS form that independent contractors and certain individuals fill out to provide their correct Tax Identification Number (TIN) to the person who is required to file an information return with the IRS to report. ORANGE COUNTY SANITATION DISTRICT: ACCOUNTS PAYABLE VENDOR REVIEW 9| eidebailly.com Information Technology’s upcoming annual review of individual user access roles would likely have identified this instance. However, unauthorized access to the Vendor Master file increases the risk of fraudulent activities, such as the creation of fictitious vendors, unauthorized changes to vendor information, and compromise of data integrity. Recommendation We recommend that OC San implement a formalized process to promptly update user access rights when employees change roles. While this process is being formalized, AP should work with IT to increase the frequency of user access reviews to a more frequent basis to ensure only authorized personnel have access to the Vendor Master File. These corrective actions will help ensure that access to the Vendor Master File is appropriately restricted, reducing the risk of unauthorized access and enhancing the overall integrity of the District's vendor management processes. Management Response OC San’s IT Manager will ensure procedures are updated to incorporate the review of user access as employees change roles and responsibilities at OC San. These procedures will be updated by December 31, 2024. FINDING #5 – Vendor Documentation During our analysis, we identified 11 records out of a sample of 60 that were either missing required documentation or contact information or had discrepancies between the vendor information in the system and the details provided in the submitted documentation.  Four (4) out of the 60 samples were missing a W‐9 form in the system, which is a critical document for verifying vendor tax identification and classification.  Four (4) out of the 60 samples lacked essential contact information, hindering effective communication and prompt resolution of any inquiries related to vendor accounts.  Three (3) out of the 60 samples had vendor information that did not align with the details provided in the W‐9 or the Payee Data Vendor Form, leading to concerns about the accuracy and validity of the available data. Lack of proper documentation can lead to delays and inefficiencies in processing payments and reconciling vendor accounts. Additionally, the absence of or the inaccurate and incomplete vendor documentation increases the risk of fictitious vendors being added to the system, which compromises the integrity and reliability of the Vendor Master File. Recommendation We recommend that OC San conduct a review of all vendor records to identify and correct any instances of missing, inaccurate or incomplete documentation. Additionally, as noted in Finding #3, we recommend updating the vendor management P&Ps, particularly the “JDE – Address Book Procedures”, to ensure clear and detailed guidelines on the required documentation and the verification processes for vendor records. This should include specifications on essential forms, such as W‐9s, contact information, and any other relevant documentation that should be retained to ensure compliance and proper vendor management. Implementing these corrective actions will enable OC San to enhance the accuracy and completeness of its vendor records, resulting in strengthening of the Districts overall vendor management process and improve compliance and operational efficiency. ORANGE COUNTY SANITATION DISTRICT: ACCOUNTS PAYABLE VENDOR REVIEW 10| eidebailly.com Management Response OC San’s Purchasing and Contracts Manager will ensure procedures are updated to include review of vendor files for complete documentation. These procedures will be updated by December 31, 2024. Construction Change Orders Review August 2024 ORANGE COUNTY SANITATION DISTRICT Submitted By: Eide Bailly LLP 2| eidebailly.com ORANGE COUNTY SANITATION DISTRICT: CONSTRUCTION CHANGE ORDERS REVIEW TABLE OF CONTENTS Executive Summary ....................................................................................... 3 Background Information ................................................................................ 3 Objective & Scope ......................................................................................... 4 Methodology ................................................................................................. 4 Results of Construction Change Orders Review ............................................... 4 FINDING – PMWeb System Audit ................................................................... 5 ORANGE COUNTY SANITATION DISTRICT: CONSTRUCTION CHANGE ORDERS REVIEW 3| eidebailly.com Executive Summary Eide Bailly LLP (referred to as "we," "our," or "us") was engaged by the Orange County Sanitation District (OC San, or “District”) to conduct a review of construction change orders. This engagement was initiated at the request of the District's leadership to determine whether the internal controls surrounding construction change orders are designed and operating efficiently to mitigate risks and ensure compliance with relevant guidelines and standards. Our assessment confirmed the District maintains an efficient internal control framework relating to the management of construction change orders, ensuring the adequacy, accuracy, and timeliness of change order requests. This framework includes having qualified personnel responsible for activities including the submission of change orders, the reviewing of change order documentation, and approving the change order through the change order management system, PMWeb. While overall operations were deemed effective, we have identified one (1) key area that warrants attention for enhancing operations. This observation presents an opportunity for the District to refine practices, while enhancing operational efficiency and effectiveness. We express our gratitude to management and staff for their valuable contributions in providing insights and enhancing our understanding of change order management processes and control points. Background Information The Orange County Sanitation District (OC San) relies on construction change orders to manage the dynamic aspects of its capital improvement projects, which are essential for upgrading and maintaining its wastewater collection and treatment systems. Construction projects are used to build, reconstruct, improve, or maintain OC San infrastructure assets. Unanticipated issues that develop during projects may result in the need for change orders that authorize an addition, deletion, or revision of the contract price and/or contract time (days to complete). These change orders are crucial for addressing unforeseen conditions, such as unexpected soil or groundwater issues, design modifications to resolve issues or incorporate improvements, compliance with new regulatory requirements, client requests for operational enhancements, and corrections of design errors or omissions. The process begins with the identification and documentation of the need for a change order by field personnel or project managers. Detailed descriptions, justifications, and supporting evidence are created and placed into PMWeb, the system used to manage capital projects. A formal change order request is then submitted through PMWeb, where it undergoes review by project managers, engineers, and others according to the system workflow. Potential impacts on the project’s budget and schedule are analyzed, with cost estimates and revised timelines being carefully considered. PMWeb facilitates a structured approach, ensuring that all necessary approvals are obtained, changes are tracked efficiently, and that roles are restricted, and access is limited. This system enables OC San to maintain transparency, accountability, and control over its construction projects, ensuring they are completed within budget and on schedule while meeting all required standards. ORANGE COUNTY SANITATION DISTRICT: CONSTRUCTION CHANGE ORDERS REVIEW 4| eidebailly.com Objective & Scope The Objective of the Construction Change Order review was to determine whether the internal controls surrounding construction change orders are designed and operating efficiently to mitigate risks and ensure compliance with relevant guidelines and standards. The Scope of the engagement encompassed the primary functions of managing construction change orders, covering the period from July 1, 2023 – June 30, 2024 (Fiscal Year 2024). The engagement was performed under the Statements on Standards for Consulting Services issued by the American Institute of Certified Public Accountants (AICPA). We did not provide audit, review, compilation or financial statement preparation services to any historical or prospective financial information or provide attestation services under the AICPA Statements on Standards for Attestation Engagements and assume no responsibility for any such information. Methodology In alignment with the stated objectives, our procedures included, but were not limited to, the following activities: • Obtained and reviewed the organization chart to identify positions related to change order management, such as project managers, contract administrators, and procurement officers. • Received copies of relevant policies and procedures related to change orders including the change order policy, contract administration policy, approval authority matrix, and any communication protocols. • Conducted interviews and process walkthrough with key personnel to gain an understanding of the process under review and identify internal controls that are designed to prevent errors, ensure accurate documentation, and mitigate risks of fraud or unauthorized changes. • Gained a thorough understanding of the change order management process, including how change orders are initiated, approved, documented, and communicated throughout the organization. • Obtained the population listing for construction contracts and compared with list of change orders issued and followed up on the identified change orders without a contract listed. • Tested a sample of construction change orders within the review period and performed the following: o Compared each change order to approval sign offs from authorized personnel. o Inspected approvals for timeliness by comparing the dates of change order initiation and approval. o Examined detailed cost estimate documentation for the proposed changes for completeness and accuracy. o Reviewed the comprehensive justifications for the changes and potential impact on timeliness for reasonableness. o Assessed the extent to which monitoring and reporting mechanisms are utilized and documented. o Reviewed copies of the selected contracts and amendments; reviewed the contracts clauses, sections, or provisions pertaining to change orders, variations, or modifications to the original scope of work. Results of Construction Change Orders Review The Orange County Sanitation District has established efficient processes, procedures, and internal controls over the management of construction change orders. The controls are designed and are operating efficiently in order to mitigate risks and ensure compliance with relevant guidelines and standards. This review identified one (1) ORANGE COUNTY SANITATION DISTRICT: CONSTRUCTION CHANGE ORDERS REVIEW 5| eidebailly.com finding that presents an opportunity for improvement. Addressing this observation will positively enhance the District's change order management processes. FINDING – PMWeb System Audit The PMWeb system, which is integral to managing capital improvement projects, has not undergone an independent assessment since 20211 to ensure the integrity, reliability, and security to adequately support operational and financial reporting objectives. The previous audit did not cover change management procedures, or data backup and recovery activities. The lack of a routine audit increases the risk of the system's data integrity, compliance with regulatory requirements, security measures, and overall effectiveness in managing project workflows and financial controls. Without regular audits, there is an increased risk of undetected discrepancies, data breaches, and non-compliance with internal and external standards. Recommendation To address the finding, it is recommended to implement an Information Technology General Controls (ITGC) framework and conduct ITGC audits on an annual basis, which is a standard best practice. These ITGC assessments would evaluate access controls, change management procedures, data backup and recovery, system development and maintenance, evaluate incident management, and evaluate the effectiveness of Information Technology operations management. Benefits of ITGC assessments include improved security, increased efficiency, risk mitigation, and informed decision making. Management Response OC San will conduct periodic ITGC audits on the PMWeb system, OC San’s IT Manager will ensure the first audit is complete before June 30, 2025. OC San also currently has the following systems in place: • Change Advisory Board to review all IT system changes and plan the smooth implementation. • ServiceNow system for incident management and response. • PMWeb has a detailed backup and disaster recovery plan that is tested quarterly. 1 An Information Technology Cyber Security Assessment was performed in June 2021 that included the PMWeb. Although there is overlap between cybersecurity assessment and ITGC evaluations, only focusing on cybersecurity can leave out essential controls and processes that ensure the overall integrity, accountability, and effectiveness of IT operations. ORANGE COUNTY SANITATION DISTRICT COMMON ACRONYMS ACWA Association of California Water Agencies LOS Level Of Service RFP Request For Proposal APWA American Public Works Association MGD Million Gallons Per Day RWQCB Regional Water Quality Control Board AQMD Air Quality Management District MOU Memorandum of Understanding SARFPA Santa Ana River Flood Protection Agency ASCE American Society of Civil Engineers NACWA National Association of Clean Water Agencies SARI Santa Ana River Interceptor BOD Biochemical Oxygen Demand NEPA National Environmental Policy Act SARWQCB Santa Ana Regional Water Quality Control Board CARB California Air Resources Board NGOs Non-Governmental Organizations SAWPA Santa Ana Watershed Project Authority CASA California Association of Sanitation Agencies NPDES National Pollutant Discharge Elimination System SCADA Supervisory Control And Data Acquisition CCTV Closed Circuit Television NWRI National Water Research Institute SCAP Southern California Alliance of Publicly Owned Treatment Works CEQA California Environmental Quality Act O & M Operations & Maintenance SCAQMD South Coast Air Quality Management District CIP Capital Improvement Program OCCOG Orange County Council of Governments SOCWA South Orange County Wastewater Authority CRWQCB California Regional Water Quality Control Board OCHCA Orange County Health Care Agency SRF Clean Water State Revolving Fund CWA Clean Water Act OCSD Orange County Sanitation District SSMP Sewer System Management Plan CWEA California Water Environment Association OCWD Orange County Water District SSO Sanitary Sewer Overflow EIR Environmental Impact Report OOBS Ocean Outfall Booster Station SWRCB State Water Resources Control Board EMT Executive Management Team OSHA Occupational Safety and Health Administration TDS Total Dissolved Solids EPA US Environmental Protection Agency PCSA Professional Consultant/Construction Services Agreement TMDL Total Maximum Daily Load FOG Fats, Oils, and Grease PDSA Professional Design Services Agreement TSS Total Suspended Solids gpd gallons per day PFAS Per- and Polyfluoroalkyl Substances WDR Waste Discharge Requirements GWRS Groundwater Replenishment System PFOA Perfluorooctanoic Acid WEF Water Environment Federation ICS Incident Command System PFOS Perfluorooctanesulfonic Acid WERF Water Environment & Reuse Foundation IERP Integrated Emergency Response Plan POTW Publicly Owned Treatment Works WIFIA Water Infrastructure Finance and Innovation Act JPA Joint Powers Authority ppm parts per million WIIN Water Infrastructure Improvements for the Nation Act LAFCO Local Agency Formation Commission PSA Professional Services Agreement WRDA Water Resources Development Act ORANGE COUNTY SANITATION DISTRICT GLOSSARY OF TERMS ACTIVATED SLUDGE PROCESS – A secondary biological wastewater treatment process where bacteria reproduce at a high rate with the introduction of excess air or oxygen and consume dissolved nutrients in the wastewater. BENTHOS – The community of organisms, such as sea stars, worms, and shrimp, which live on, in, or near the seabed, also known as the benthic zone. BIOCHEMICAL OXYGEN DEMAND (BOD) – The amount of oxygen used when organic matter undergoes decomposition by microorganisms. Testing for BOD is done to assess the amount of organic matter in water. BIOGAS – A gas that is produced by the action of anaerobic bacteria on organic waste matter in a digester tank that can be used as a fuel. BIOSOLIDS – Biosolids are nutrient rich organic and highly treated solid materials produced by the wastewater treatment process. This high-quality product can be recycled as a soil amendment on farmland or further processed as an earth-like product for commercial and home gardens to improve and maintain fertile soil and stimulate plant growth. CAPITAL IMPROVEMENT PROGRAM (CIP) – Projects for repair, rehabilitation, and replacement of assets. Also includes treatment improvements, additional capacity, and projects for the support facilities. COLIFORM BACTERIA – A group of bacteria found in the intestines of humans and other animals, but also occasionally found elsewhere, used as indicators of sewage pollution. E. coli are the most common bacteria in wastewater. COLLECTIONS SYSTEM – In wastewater, it is the system of typically underground pipes that receive and convey sanitary wastewater or storm water. CERTIFICATE OF PARTICIPATION (COP) – A type of financing where an investor purchases a share of the lease revenues of a program rather than the bond being secured by those revenues. CONTAMINANTS OF POTENTIAL CONCERN (CPC) – Pharmaceuticals, hormones, and other organic wastewater contaminants. DILUTION TO THRESHOLD (D/T) – The dilution at which the majority of people detect the odor becomes the D/T for that air sample. GREENHOUSE GASES (GHG) – In the order of relative abundance water vapor, carbon dioxide, methane, nitrous oxide, and ozone gases that are considered the cause of global warming (“greenhouse effect”). GROUNDWATER REPLENISHMENT SYSTEM (GWRS) – A joint water reclamation project that proactively responds to Southern California’s current and future water needs. This joint project between the Orange County Water District and OCSD provides 70 million gallons per day of drinking quality water to replenish the local groundwater supply. LEVEL OF SERVICE (LOS) – Goals to support environmental and public expectations for performance. N-NITROSODIMETHYLAMINE (NDMA) – A N-nitrosamine suspected cancer-causing agent. It has been found in the GWRS process and is eliminated using hydrogen peroxide with extra ultra-violet treatment. NATIONAL BIOSOLIDS PARTNERSHIP (NBP) – An alliance of the NACWA and WEF, with advisory support from the EPA. NBP is committed to developing and advancing environmentally sound and sustainable biosolids management practices that go beyond regulatory compliance and promote public participation to enhance the credibility of local agency biosolids programs and improved communications that lead to public acceptance. PER- AND POLYFLUOROALKYL SUBSTANCES (PFAS) – A large group (over 6,000) of human-made compounds that are resistant to heat, water, and oil and used for a variety of applications including firefighting foam, stain and water-resistant clothing, cosmetics, and food packaging. Two PFAS compounds, perfluorooctanesulfonic acid (PFOS) and perfluorooctanoic acid (PFOA) have been the focus of increasing regulatory scrutiny in drinking water and may result in adverse health effects including developmental effects to fetuses during pregnancy, cancer, liver damage, immunosuppression, thyroid effects, and other effects. PERFLUOROOCTANOIC ACID (PFOA) – An ingredient for several industrial applications including carpeting, upholstery, apparel, floor wax, textiles, sealants, food packaging, and cookware (Teflon). PERFLUOROOCTANESULFONIC ACID (PFOS) – A key ingredient in Scotchgard, a fabric protector made by 3M, and used in numerous stain repellents. PLUME – A visible or measurable concentration of discharge from a stationary source or fixed facility. PUBLICLY OWNED TREATMENT WORKS (POTW) – A municipal wastewater treatment plant. SANTA ANA RIVER INTERCEPTOR (SARI) LINE – A regional brine line designed to convey 30 million gallons per day of non-reclaimable wastewater from the upper Santa Ana River basin to the ocean for disposal, after treatment. SANITARY SEWER – Separate sewer systems specifically for the carrying of domestic and industrial wastewater. SOUTH COAST AIR QUALITY MANAGEMENT DISTRICT (SCAQMD) – Regional regulatory agency that develops plans and regulations designed to achieve public health standards by reducing emissions from business and industry. SECONDARY TREATMENT – Biological wastewater treatment, particularly the activated sludge process, where bacteria and other microorganisms consume dissolved nutrients in wastewater. SLUDGE – Untreated solid material created by the treatment of wastewater. TOTAL SUSPENDED SOLIDS (TSS) – The amount of solids floating and in suspension in wastewater. ORANGE COUNTY SANITATION DISTRICT GLOSSARY OF TERMS TRICKLING FILTER – A biological secondary treatment process in which bacteria and other microorganisms, growing as slime on the surface of rocks or plastic media, consume nutrients in wastewater as it trickles over them. URBAN RUNOFF – Water from city streets and domestic properties that carry pollutants into the storm drains, rivers, lakes, and oceans. WASTEWATER – Any water that enters the sanitary sewer. WATERSHED – A land area from which water drains to a particular water body. OCSD’s service area is in the Santa Ana River Watershed.