VI, ..I-- I--.EUR . -Z.-.L I I .5I-.-- . . . - . . . .-.. -- .. .. . - TVR-.-- - L, Q-..-. - -. .- .. .1 --.- .. - - zz 1 - I . ..-- - . ., .-IZI.V.V,354 . ..Ii I.. . J, I-..-. [-.-- In conducting the examination, the Auditor reviewed the OCFO's: (1) Human Resources directives and draft personnel policies and procedures;' and (2) District--Wide Policies and Procedures Manual.' Further, the Auditor interviewed officials within the OCFO's: (1) (2) Office of Integrity and Oversight and (3) Human Resources Division. Impediments to the Review The Auditor encountered obstacles in conducting a thorough examination of the OCFO's background checks on employees who worked with cash and/or cash equivalents in the OFT including the OCFO's failure to provide full and unrestricted access to the OCFO's background check report files. The Auditor requested, but was denied, access to background investigation reports for OFT employees who worked with cash and/or cash equivalents. According to OIO's representatives, the requested files could "not be disclosed to a third party." Instead, OIO's Executive Director, Director of Internal Security, and other OIO representatives, held discussions with the audit team where they: (1) provided some background information on the investigative process; (2) indicated that background checks had been conducted on each employee; and (3) stated that "no adverse administrative actions were taken against any ofthe nine employees" identified by the Auditor. While the Auditor does not question the confidentiality of the employee information, we do take strong exception to the OCFO not providing full and unrestricted access to the files requested in connection with an official examination lawfully conducted by the Auditor. [Auditor' Emphasis] We further take issue with the CFO mislabeling the Office ofthe District of Columbia Auditor as a "third party." The information requested directly related to the District's accounts and operations as well as the safety and security of District financial assets. Finally, the information requested was collected on behalf of and paid for by the District of Columbia government. As a result of the OCFO's actions, the Auditor could not be assured that full and factually accurate disclosure was made regarding all matters related to background checks of affected employees or that background investigations were in fact completed for the employees under examination. In other words, the OCFO's actions could have been an effort to cover--up its failure to conduct criminal and financial background checks of OCFO personnel who worked with cash and/or cash equivalents. 4See Office of the Chief Financial Officer, Office of Management and Administration I-luman Resources Operations, Compilation of Personnel Policies and Procedures, January 2008. SSee District of Columbia Office of the Chief Financial Officer, Office of Financial Operations and Systems, Policies and Procedures Manual, Volume 1 District-Wide, Effective Date 8/3 l/1998, Last Updated: Fiscal Year 2004. -2- BACKGROUND IN BRIEF OIO's Executive Director indicated that OIO began doing background investigations, which included credit, employment references and education verifications, on newly hired employees in 1999. These background investigations were intended primarily to determine the suitability of employees for various positions within the OCFO. Until approximately 2002, OIO conducted the investigations using in-house resources. In 2002, however, OIO contracted with US Investigations Services (USIS) to conduct background investigations. The results of USIS investigations are furnished to OIO. OIO reviews the investigations and highlights any issues raised by the results. OIO may interview an employee regarding issues raised in the USIS report and fumishes the background information to management in the OCFO's Human Resources Division. According to an OCFO Human Resources representative, appropriate officials in the Human Resources Division review and evaluate the findings to determine what actions to take. The decision is based, in part, on the position held by the employee. Human Resources management may decide to counsel, discipline or, in some instances, to terminate the employee. Employees who are terminated have an opportunity to appeal their termination. -3- FINDINGS OCFO DID NOT CONDUCT PRE-EMPLOYMENT BACKGROUND CHECKS According to Government Internal Control Standards, issued by the Comptroller General of the United States, the Control Environment is one of the five standards for internal control:" A positive control environment is the foundation for all other standards. . . Several ke factors ajfect the control environment. One factor is the integrity and ethical values maintained and demonstrated by management and stajf Agency management plays a key role in providing leadership in this area, especially in setting and maintaining the organization 's ethical tone, providing guidance for proper behavior, removing temptations for unethical behavior. . . and establishing appropriate practices for hiring. The Auditor found that OIO management did not conduct criminal or financial background checks on OCFO employees assigned to handle the District's cash and/or cash equivalents.? According to the OIO Executive Director, background investigations are conducted after an employee has been hired by the OCFO. Further, according to the Executive Director, "The investigations can take months to complete. Therefore, it would not be practical to conduct this type of investigation on applicants, and to expect most applicants to be willing to wait for the results of a background investigation before being hired." Due to the lack of pre-employment background checks, OCFO management could not be assured that employees with financial problems, bankruptcies, or a criminal record were not placed in a position of handling cash, cash equivalents, or other sensitive financial documents. An effective timely pre-employment criminal and financial background check could alert OCFO officials (prior to actual employment) to a prospective employee who has a criminal record or significant financial problems thus allowing OCFO management to determine the employee's suitability for the intended position. However, without pre-employment background checks, an employee with significant financial problems may be placed in a position of trust where the internal control environment is weak, and internal controls are non-existent, inadequate, or function poorly. 6See United States General Accounting Office, Standards for Internal Control in the Federal Government, November 1998, p. 8. 7Aeeording, to OlO's Executive Director, limited circumstances in the past, OIO has conducted background investigations on certain senior executives before they were hired." -4- In such situations, temptation is rigorously tested and employees may be tempted to steal or engage . in other criminal or unethical behavior to address their personal financial issues. The Auditor found that allowing employees, especially those whose duties and responsibilities require the handling of cash and/or cash equivalents, to begin work before a background check is completed may give an employee with a negative criminal or financial history access to cash thus exposing the District to an unreasonable risk of financial harm from misappropriation and fraudulent activities. OCFO DID NOT CONDUCT PERIODIC BACKGROUND CHECKS OCFO's Personnel Policies and Procedures state:8 All new employees will be subject to a satisfactory background investigation as a condition of employment. Where applicable, current OCFO employees may be subject to a satisfactory background investigation as a condition of employment. For example, when an employee seeks promotion to a position that requires a satisfactory background investigation. Additionally, Chapter Section 4000.000 ofthe OCFO 's Policies and Procedures Manual states that in recruiting and retaining competent people, agencies are to consider the extent to which:? Employee candidate background checks, particularly with regard to prior actions or activities considered to be unacceptable by the entity, are adequate. The Auditor found that the OCFO personnel policies and procedures did not require periodic background checks for all employees once an initial background investigation had been completed. According to OIO, one instance in which an existing employee may receive an additional background check is when the employee is seeking a promotion to a new position. The OIO also indicated that background checks of limited scope were conducted for some OFT employees when 8See District of Columbia Office of the Chief Financial Officer, Off`ice of Financial Operations and Systems, Policies and Procedures Manual, Volume District-Wide, Effective Date 8/31/1998, Last Updated: Fiscal Year 2004. 9See District of Columbia Office ofthe Chief Financial Officer, Office of Financial Operations and Systems, Policies and Procedures Manual, Volume Effective Date 8/31/1998, Last Updated: Fiscal Year 2004. -5- the District sought to obtain employee bonding. The failure to conduct periodic background checks prevents OCFO management from obtaining timely notice of an adverse or critical change in the criminal ?or financial status of an employee subsequent to their initial background investigation. The completion of periodic background checks would serve as a control mechanism to protect District financial resources and would ensure timely notice of adverse changes in an employee's circumstances. As a consequence, the OCFO could take appropriate proactive measures to protect the District's financial interests and assets. RECOMMENDATIONS 1. The CFO establish an official written policy: A. mandating pre-employment criminal and financial background investigations of all employees who handle cash, cash equivalents, or financial transactions for the District and/or supervise and manage District cash operations; and B. requiring periodic background investigations of any District employee responsible for handling District cash and/or cash equivalents or supervising and managing District cash collections. 2. The CFO establish and implement this policy within 45-days ofthe date of this report. 3. The Council of the District of Columbia consider establishing a statutory requirement that all District employees assigned the responsibility of handling cash and/or cash equivalents on behalf of the District of Columbia government undergo a criminal and financial background investigation and thereafter undergo periodic background investigations as long as the employee occupies a position involving the handling of cash and/or cash equivalents on behalf of the District government. CONCLUSION The Auditor found that the OCFO did not conduct pre-employment criminal or financial background checks on OCFO employees assigned to handle District cash and/or cash equivalents. According to the Executive Director ofthe OIO, any background investigations are conducted only -6- 1*i, . .-.FC. 7;o1oF'F7 ,3 . .. MTH. I .*r__V -..-. .-.-.. .4Vu . P-.. -.-- .yf(IgAli: . XV VV: II f*.IIE.- *7 II *4 . lj I1. E-.- -- .-.lI'.V-.. - . .. - - - - -- - - . - - .-.. . AGENCY COMMENTS AGENCY COMMENTS On September 25, 2008, the Office ofthe District of Columbia Auditor submitted this report, in draft, to the Chief Financial Officer of the District of Columbia, the Executive Director of the Office of Integrity and Oversight, and the Deputy Chief Financial Officer of the Office of Finance and Treasury for review and comment. Written comments were received from the Executive Director of the Office of Integrity and Oversight on October 2, 2008. Based on the comments received no changes were made to the final report. The comments received from the Office of Integrity and Oversight are appended, in their entirety, to this final report. GOVERNMENT OF THE DISTRICT OF COLUMBIA Office of the Chief Financial Ofhoer Omce of Integrity and Oversight October 2, 2008 in it 1 OCT r. Deborah K. Nichols . District of Columbia Auditor Office of the DC Auditor 717 l4"' Street, NW, Suite 900 Washington, DC 20005 Dear Ms. Nichols: These comments are in response to the recommendations in your draft report entitled "Letter Report: Review of Background Checks on Specific OCFO Employees Who Handled Cash and/or Cash Equivalents? Your recommendations were that the Chief Financial Officer (CFO) mandate pre-employment as well as periodic criminal and financial background investigations of employees who handle cash, cash equivalents, or financial transactions for the District and/or supervise and manage District cash operations. The OCFO recognizes the benefits of pre-employment and periodic backgrotmd checks for employees in certain positions, and the Office of Integrity and Oversight (OIO) has in the past recommended periodic background investigations for the most sensitive OCFO positions. OIO recommended that OCFO Human Resources perform a position sensitivity study for all OCFO positions so that we could apply position sensitivity to determine those positions that warrant periodic updated investigations. The study would also be used to determine whether to perform background investigations when employees transfer from one sensitivity level to another. In keeping with the requirement in OMB's Circular Number A-123 "Management's Responsibility for Internal Controls," we must evaluate the need for an internal control in the context of the programs and operations of the agency. OIO records reflect that of all OCFO background investigations conducted in fiscal years 2003 through 2007, 2% have resulted in termination. This indicates the need to determine whether additional controls, such as pre- employment background checks, will improve oru? control environment to the extent that they outweigh any adverse effect on our operations. It is essential that the control environment recognize the risk of hiring employees before the background investigation is completed and take effective risk mitigation measures. One such meastue is management's responsibility to provide closer supervision and training for new hires. Another is OIO's procedure to suspend a background investigation and notify management as 1275 Street, Nm Suite 500, Washington, n.c. 20005 (202) 442-6435 I ff! Review of Background Checks on Specyic OCF0 Employees Who Handled Cash and/or Cash Equivalents October 2, 2008 Page 2 soon as any information is developed which is of such seriousness that it may warrant removal action, so that prompt action can be taken. The OCFO hiring process is already a process; if we are to add pre-employment background investigations to that process, we must consider the benefits of this control in relation to its costs. The CFO already conducts extensive background investigations of every new employee. OIO procedures require that we suspend a background investigation when derogatory information arises which is of such seriousness as to warrant immediate referral to OCFO management officials for consideration of removal action. Moreover, under a policy adopted on April 22, 2008, we have begtm to conduct background investigations of current employees who were hired before we began the background investigation policy. We have already undertaken a comprehensive review of all of our internal controls. This review is being conducted by the consulting firm of Deloitte Touche under the direction of the OCFO Audit Committee. We will ask them to review our background investigation policy in light of your recommendations, and I will communicate the results of this review to your office. If you require any additional information, please feel free to contact me at (202) 442-6445. . Sincerely, Robert G. Andary 3 I. Executive Director cc: Natwar M. Gandhi, Chief Financial Officer, District of Columbia Government Lucille Dickinson, Chief of Staff] Office of the Chief Financial Officer Angell Jacobs, Director of Operations, Office of the Chief Financial Officer Charles Fultz, Director of Internal Security, Office of Integrity and Oversight