Suspense Process Review

June 11, 2012 To: CC: From: Jim Bucholz, Director Audit Committee and Agency Management Team Jason Robinson, Chief Audit Executive Classification Level: 3 Purpose: Assessing the governance of the Suspense Unit

BACKGROUND A fraudulent return with a high dollar refund was able to get past the scrutiny of the Suspense Unit. This process included: a first look and clearing of the return from a first level Suspense Unit employee, a first level review from a higher level Suspense Unit employee, 2nd level review from Suspense Unit Manager, and a supposed 3rd level review that should only be allowed by an administrator or delegate. OBJECTIVE and SCOPE The objective of this review was to provide a reasonable level of assurance to Agency Management that the policy and procedures governing the Suspense Unit are appropriate and working. The scope of the review was focused on the Suspense Unit within the PTAC Division at Revenue Main building located at 955 Center Street, NE, Salem Oregon. The review was conducted in accordance with the International Standards for the Professional Practice of Internal Auditing. AUDIT RESULTS We can conclude with a reasonable level of assurance that the Department of Revenue (DOR) Management has put into place policies and procedures that, when adhered to, would have thwarted this fraud from occurring. The result of this occurrence is due to employees not following policy and procedure during the initial processing of the return as well as the review process. Management has assured us that adherence to the review process will be emphasized in the future. During the review we noted items that could improve the efficiency of the Suspense Unit and possibly reduce the amount of human error that is possible with such manual processes. 1. Issue: When interviewing the manger and staff of the Suspense Unit we discovered incomplete, and in some cases, non-existent documentation on desk procedures. Manager and staff all admitted to being self-taught on the numerous ways to scrutinize the nearly two hundred computer edits that lead to a tax return suspending from processing for further review. Recommendation: Management should provide the resources that will allow Suspense Unit to create and document thoughtful processes for all levels of Suspense and management review. Response: Management agrees with this recommendation and has begun the process of creating unit desk procedures. Desk procedures are expected to be completed by December 31st, 2012.

Suspense Process Review

June 11, 2012 2. Issue: During the interview of four Suspense staff and the Fraud Team lead, we found that each person working in Suspense will pull their own queue. We also noted that some edits were very easy to resolve while others took a fair amount of research and judgment. Work from the suspense unit is not assigned by either a lead worker or manager. More-complex edits could be pulled by lessqualified staff causing unwanted errors or missed opportunities to catch fraudulent returns. We noted that certain edits within the fraud team are assigned to those individuals within the group that have an expertise at processing those types of edits. Recommendation: We recommend that management consider the difficulty of each Edit and assign them as appropriate to the respective skill levels of the Suspense workers. Response: Management will explore the option of assigning easier and harder edits to appropriate staff by November 1, 2012. This may require adding different classifications into the unit. The majority of staff in the unit are AS1s, and the work they perform is within this classification, therefore, all AS1s should be able to perform the same type of work. 3. Issue: It is as accurate as possible within the current scope of Suspense. Suspense workers are on a time line and have production numbers that they must meet or exceed. The production theory is that if one or two edits look good enough, then the other edits will probably be good as well. Although some specific edits within ITX/ITA will usually be associated with other edits (if it suspends for this edit then it will more than likely suspend for that edit), Business has created each edit for a specific reason. Therefore, each edit should be individually verified to make sure that the tax return is correct in its entirety. Otherwise there is a redundancy in the edits that suspend returns, causing Suspense workers to disregard some. Recommendation: Management should instill the necessity to prove (or disprove) each edit before clearing a return (this could be documented in policy and procedure or training). Response: Management agrees that each edit should be proved or disproved before clearing a return and is in the process of creating desk procedures to ensure employees are doing appropriate review of each edit. Desk procedures are expected to be completed by December 31, 2012. 4. Issue: It was suggested that the Over-limit edit be changed this year from suspending any refund or liability that is over to suspending any that is over . When asked why make the change to that specific amount, the two-fold answer was to lessen the workload and to pick a number everyone could accept. The edit recommendation was never brought forward because the group felt that the Agency was too conservative and would not loosen the constraint. Although the edit has been in place for a number of years and the system could be used to gather some statistics on it, it appears that statistics were not used during the evaluation process. The edit review process appears to be a best guess effort without using relevant data to support the changes. It also appears that the Agency may not support the decisions of the evaluation team. Recommendation: Management should fully support (to include IT support) the edit review team or reconfigure it into a team capable of making solid recommendations. Additionally, edit modification recommendations should be based on facts, not best guesses. Response: Management agrees with the recommendation and has implemented the majority of recommendations made by the edit review team. All of the edits that were brought forward to management for approval had relevant data to support the recommendations. Relevant data is currently being gathered to determine if an increase in the second level Over-limit tolerance should be raised, and to what dollar amount. A recommendation is expected to be ready by August 31, 2012.

Suspense Process Review

June 11, 2012

5. Issue: The management position for the Suspense unit is required to review the work of every unit employee that has reviewed and cleared a return with a refund or liability of more than . This nd management review is called a 2 Level Review. The purpose of this review has never been defined (Is it a cursory review to find any glaring errors? Is it a review performed because of the risk of refunding large amounts of money in error?). With Internal Audit (IA), the review process for an auditors working papers is done to make sure there have been no mistakes made. The review is done by a higher level of auditor to verify that work was done appropriately. It seems to IA that the current manager has not been trained to do a proper review. She has very little experience in the current Suspense process and she has not been trained in any way to verify what her staff has submitted for review. IA does not feel that a cursory review of a significant amount of money meets the Agencys needs. A higher level review of tax returns would require years of knowledge that would be unavailable to any manager that would transfer into this position. IA noted that AS2s generally have a higher level of knowledge and understanding of the process of reviewing tax returns. Recommendation: Management should consider the possibility of having 2nd Level Reviews be conducted by a higher level of Suspense worker, thus freeing the Suspense Manager to manage the personnel aspects of the Suspense unit. Response: Management agrees with this recommendation and is looking into available options, such as having current AS2s in the Suspense unit or TA1s currently located outside of the unit review this work. Management will review and consider options by September of 2012. 6. Issue: DOR occasionally allows employees to take management positions over units in which they have little or no experience. For the majority of these opportunities there is not a critical step that the manager must perform that could damage the Agency. In cases where a manager must perform such a critical function as a second review over a function that can take years to learn such as the Suspense Unit, it would seem prudent to hire someone with those critical skills or backfill the position to learn from the exiting manager before they retire. Recommendation: Acknowledging that the Agency will likely wish to continue providing valuable staff and managers with new challenges, IA recommends that the Agency consider taking on the responsibility of properly training those staff and managers for the new leadership positions theyll face, specifically those positions with oversight authority to release cash. This includes not just staff management training, but also training in the systems and processes the managers will face in their new duties. Response: Management agrees with this recommendation and will pursue setting up training for new managers within the Program Services Section that have authority to release cash. The Program Services Section will review and consider options for training for new Managers by November 1st, 2012. 7. Issue: The Fraud Team and Suspense Unit work closely with each other passing work back and forth to get items processed faster. There currently is no formal policy that requires the two groups to work with each other besides the fact that both of the current managers of the separate units see the overall benefit to the Agency. Without formal agreements between work units, this type of cohesiveness may not be possible in the long-term. This can be seen in the breakdown of the relationship that once existed between Audit and Suspense to provide quality reviews on more complex items.

Suspense Process Review

June 11, 2012 Recommendation: Management should consider formalizing the process currently used between the two units to expedite the processing of accurate returns. Management may want to consider the governance of each unit to see if the combined duties could be better managed with one supervisor. Response: Management agrees with this recommendation and is in the process of formalizing the current process used between the units. A formalized agreement between the two units will be created by October 1st, 2012. 8. Issue: The computer system currently suspends over 10% of the returns processed. These returns must then be handled manually and cleared of the edit before completing processing. Many companies that process records (such as insurance claims) have a much lower percentage requiring human intervention. Consequently, very few (if any) are processed manually. Recommendation: Management should consider modifying the current system or create a new one that will lower the suspense rate and automate a multitude of edits that must now be completed manually. Response: Management agrees with this recommendation. However, we must evaluate the cost versus the short-term benefit of making such changes as we are currently in the process of core systems replacement that would accomplish much of the recommendation by September 2014. A contract has been signed with FAST enterprises (contingent upon legislative funding approval in 2013) for a comprehensive tax system replacement to begin in September of 2013. 9. Issue: We noted while conducting multiple walkthroughs in Suspense that the current system is not programmed to display other information which is not contained on the tax return. All supplemental information (such as .) must be viewed manually outside of our computer systems. Due to the inconsistency of each of those other systems, it is often necessary for a Suspense worker to check multiple systems to find the data needed to clear a return. This manual process can lead to multiple errors, from delaying a proper tax return to processing a return with incorrect information. Recommendation: If possible, management should try to integrate the additional systems into the data that ITX/ITA uses to process tax returns. This could allow a number of correct tax returns to process quickly and avoid the current manual processes to verify validity that is being done by Suspense workers. This would then free Suspense workers to focus on those returns that actually need attention. Response: Management agrees with this recommendation. However, we must evaluate the cost versus the short-term benefit of making such changes as we are currently in the process of core systems replacement that would accomplish much of the recommendation by September 2014. A contract has been signed with FAST enterprises (contingent upon legislative funding approval in 2013) for a comprehensive tax system replacement to begin in September of 2013. 10. Issue: Gray-Bar reports, the purpose of which is to prompt review of specific tax returns, are printed by the Production unit. Production passes these reports to Central Support, which then sorts them by program and mails them to the different areas. Mail Handling then takes them and delivers them throughout the Agency. Managers in different units find the Gray-Bar reports in their in-box and make the necessary reviews on the computer systems as indicated by the report. The Gray-Bar report is then signed and sent back to Central Support which keeps them for one year prior to shredding them. IA noted that in the past these reports have had several types of failures including having not

Suspense Process Review

June 11, 2012 been signed, getting lost &/or shredded prematurely, and having been delayed in someones in-box. IA also noted that management was not sure what should be reviewed via the Gray-Bar report process. This led to reports often being signed off (authorized) without having complete confidence in the tax return but trusting that staff had performed a thorough job during the 1st Level Review. It appears that this internal control is not operating as intended. Recommendation: Management should consider not printing the Gray-Bar reports and finding a more trusted and efficient way to transport them to the intended receiver, preferably within the computer system. IA also recommends that management review this internal control to ascertain whether or not it is operating as intended and providing any risk mitigation. Response: Management agrees with this recommendation. This process affects more than just the Suspense Unit and the Program Services Section. We will need to evaluate the needs of other areas of the Agency to ensure all benefits and consequences are considered. Management is in the process of performing a complete review of the Gray-Bar reports process to identify alternatives to the current paper process. A first draft of this review report is expected to be received by November 1st\, 2012. 11. Issue: Management appeared to be unaware of the existence of some of the processes that control the releasing of cash (i.e. the Gray-Bar reports that passed through the Suspense unit). Recommendation: Management should consider remapping all of its cash flow processes to verify it is aware of, and therefore managing, all of the work and risk over which it has authority. Response: Management agrees and has already made significant changes that will prevent the releasing of cash without approval from someone with the appropriate authority. Management would like assistance from Internal Audit in remapping all of the sections cash flow processes by January 1st, 2013. Management has made a change to the 3rd Level Review and approval process for the Gray-Bar reports. The Gray-Bar reports are still printed out, but they are now being directed to the appropriate reviewer for approval. The 3rd Level Reviewer approves the Gray-Bar refund in the system, and therefore creates a permanent audit trail. 12. Issue: There were over returns suspended via the Over-limit edit (i.e. the refund was too large for the system to automatically accept it). Of the returns suspended for this edit only .2% (2 out of every 1,000) had adjustments made to them. This appears to be an inefficient edit that causes an additional work load on the Suspense unit and could be creating a false sense of security when seeing this edit by itself. We also noted that only one person reviews this edit and the increased redundancy at looking at a near perfect edit can create a lack of due diligence during the review process. Recommendation: Management should consider turning this edit off or document the validity of keeping this edit on. IA also recommends that other AS2s should be assigned the duty of reviewing this edit. Response: Management agrees with the recommendation. An evaluation of this edit will be performed prior to January 1, 2013. 13. Issue: DOR does not have full access to the information that would allow the Agency to operate more efficiently. We do not require the submission of information from the tax payer or employer that would easily single out returns that are truly fraudulent. DOR is allowed to view, but not fully access

Suspense Process Review

June 11, 2012 other systems from DOE, DMV, and DHS that would allow us to perform our comparisons electronically instead of manually. Recommendation: DOR should consider asking for the authority to require taxpayers and employers to submit the requisite information that would allow for more informed decision making within our systems. DOR should also look into the authorization that would need to be put into place to allow access to the information gathered by other agencies that would allow us to automate many of our manual processes. Response: Management partially agrees with the recommendation. Currently, DOR has the authority and has recently implemented a process that requires employers to submit W-2 information. However, we must evaluate the cost versus the short-term benefit of making such automated changes as we are currently in the process of core systems replacement that could accomplish much of the recommendation by September 2014. ACKNOWLEDGEMENT Internal Audit noted that as soon as DOR management became aware of the incident they immediately consulted with IT to modify the system to never allow someone with lesser authority to sign off on a refund within the over-limit part of the system. At the same time Management has created an audit trail within the system to verify who has released (conducted the final review) for this type of refund. We would like to thank the many employees throughout the Agency that participated in this review. METHODOLOGY As part of the review process, we gathered information from other sources outside of the Suspense Unit. We consulted with IT Services Production Control Unit, IT Services Program group, Central Services, and Business Divisions Corp Audit Section. These other areas are all directly or indirectly involved with the Suspense Unit.