[0:01] Good afternoon, everyone. We welcome

[0:02] you to the regular

[0:05] meeting

[0:07] of the audit committee for the utah

[0:08] transit authority. Today is monday,

[0:09] september 22 .

[0:11] our colleague beth holbrook will

[0:14] join us in a little bit and we welcome

[0:15] commissioner

[0:17] bob stevenson with us

[0:20] as well. Just a note that this meeting

[0:23] is being recorded. Live remote viewing

[0:24] for the public is

[0:26] available

[0:30] through our

[0:33] uta board

[0:36] meetings website.

[0:39] also, hold the microphone

[0:41] closely so it is picked up. Excuse

[0:42] mayor

[0:45] natalie hall who is

[0:48] unable to join us today.

[0:49] with that, we will begin with our

[0:51] safety first minute and I will turn to

[0:54] my colleague jeff acerson.

[0:57] jeff?

[0:58] >> thank you, chair.

[0:59] I appreciate the opportunity to share.

[1:00] we are at a

[1:03] season, fall. We are there. It

[1:06] is happening. We get a lot

[1:11] of moisture . The temperature has

[1:12] changed and in utah

[1:15] at least, historically, it comes

[1:18] hunting season.

[1:21] utah is

[1:24] well known for their right to

[1:25] bear arms and go after a game and have a

[1:27] good time

[1:30] and

[1:31] hunt. A lot of time it is a family

[1:33] event. I think it is appropriate to

[1:34] share some guidelines for those that

[1:36] do make that choice

[1:39] to go hunting and have guns.

[1:42] some safety items to be

[1:45] mindful of, how to

[1:46] safely store your firearms. Storage

[1:47] methods include key locks, combination

[1:51] locks, lock boxes and

[1:54] firearm safes as well. If

[1:57] you don't have access to

[2:00] a lock like that, you can go

[2:05] to your local police department. Typically

[2:06] they have those in supply

[2:09] and you can get those free

[2:11] of charge. Keep the keys out of reach

[2:12] of children and

[2:13] where others cannot find them. Store

[2:14] ammunition in a separate security

[2:18] locked container and use

[2:19] a firearm safety device such as a

[2:21] trigger lock or a

[2:22] cable lock, as I mentioned. Some basic

[2:26] firearm safety rules. Treat all firearms as

[2:27] if they

[2:33] are loaded.

[2:38] ofttimes we don't pay attention to that and

[2:39] sometimes accidents

[2:41] happen. Always keep your finger off the trigger

[2:42] until you have made the decision

[2:43] to fire. Never pointed a firearm at anything

[2:45] you are not willing

[2:48] to shoot. And, know your target,

[2:50] your target's environment and any

[2:51] other safety hazard before you

[2:54] fire and always keep the

[2:55] gun unloaded until you are ready to

[3:00] use it.

[3:02] I can just share a couple of personal experiences

[3:03] having been

[3:05] a hunter. I haven't hunted in quite a

[3:06] few years

[3:09] but it was a family event and

[3:10] you get out in the mountains and you

[3:12] get a

[3:13] lot of people out there shooting.

[3:15] you just have to make sure you

[3:17] are safe at all times because bullets

[3:21] are not --

[3:24] they go. Once they

[3:25] are fired, they go whatever direction they

[3:26] fire and they can always ricochet

[3:27] so you

[3:30] have the mindful of your target and

[3:31] beyond so you don't harm something

[3:33] you are not intending to shoot.

[3:36] okay. Chair?

[3:37] >> thank you, jeff.

[3:39] with that, we will entertain

[3:42] a motion on our consent, which

[3:43] is the approval of our minutes from

[3:45] the

[3:48] prior meeting.

[3:50] >> I will move. >> second. >> I have a

[3:51] motion from bob and

[3:52] seconded by jeff. All in favor say

[3:54] aye.

[3:55] >> aye. >>

[3:57] any opposed?

[3:58] that motion passes. Let's then go

[4:00] to item 4 on our agenda. It is

[4:03] the internal audit update. We welcome

[4:06] mike hurst, our internal audit director

[4:07] to give

[4:09] us an update.

[4:12] mike, welcome.

[4:21] >> is it working now? There

[4:24] we go. New microphones. Good

[4:29] afternoon, committee members. For the

[4:30] record, my name

[4:31] is mike hurst, director of internal audit

[4:33] for utah transit authority.

[4:34] in this first presentation I will

[4:36] give an update for

[4:39] the status of the

[4:41] 2025 internal audit plan and an update

[4:42] on the bus

[4:45] safety audit.

[4:46] >> these last

[4:48] few slides are

[4:49] lists of the individual audit engagements

[4:51] that are on the

[4:54] audit plan. On this

[4:57] slide I will highlight the

[5:00] environmental

[5:01] governments it is being performed

[5:03] by our

[5:06] internal auditors and we expect

[5:09] to

[5:12] have it by the next audit

[5:18] committee meeting.

[5:19] >> I am going to

[5:20] go

[5:21] through the slides based on my talking

[5:22] points. If there is anything I don't

[5:23] cover that you want to know about,

[5:24] please stop me.

[5:25] >>

[5:27] on this slide, you are going to get a

[5:29] report today on special services operations. We

[5:30] have

[5:33] also finished video security but not in time for

[5:34] the submission

[5:36] deadline of this

[5:39] committee meeting. We will report

[5:41] on that also in the next audit committee

[5:42] meeting in december.

[5:43] >>

[5:45] let's see. Buy american compliance,

[5:48] I am currently working

[5:51] on that. Forgive my typo here. I

[5:53] will have a report to you sooner than

[5:57] december 2026.

[5:58] >> just hedging

[6:00] your bet.

[6:01] >> I am really

[6:03] pouring a lot into

[6:06] this. No

[6:09] .

[6:10] >> you are at least ready when january

[6:11] comes around. That is what I'm always forgetting,

[6:12] the wrong

[6:14] year.

[6:15] >> yeah. It is a good thing I'm an

[6:16] auditor and not an

[6:18] editor.

[6:21] let's see. Commuter

[6:22] rail safety, the current status says not

[6:24] started but

[6:26] since submitting these files for this agenda,

[6:27] we have started

[6:30] that and we expect to have that to this

[6:33] committee for

[6:36] december 2025.

[6:37] >> mount ogden bus

[6:39] maintenance. This project, we broke

[6:40] up

[6:45] into two sections. We did

[6:46] the governance and risk management

[6:48] sections and reported on that in the june

[6:49] audit

[6:51] committee meeting and then we have

[6:52] subsequently have done the

[6:54] second part of that audit which

[7:00] is testing the rate of completions

[7:01] on preventative

[7:03] maintenance and I completed that

[7:06] last week. The results are in the

[7:07] hands

[7:09] of

[7:11] management to review and work through those

[7:12] things. We will have that second phase

[7:15] report

[7:18] in december. Then, finally, these

[7:19] are

[7:21] our

[7:24] outsource projects. We have the bus

[7:25] safety

[7:26] audit which I will give a more complete audit

[7:27] in an update and then we

[7:28] have our construction audit. Currently,

[7:33] the committee --a committee is reviewing

[7:36] the proposals. We got eight or

[7:39] nine bids on this. We will

[7:45] report back on what auditor was

[7:48] selected in the december audit

[7:50] committee meeting.

[7:51] >> the bus safety

[7:52] audit, this

[7:54] was outsourced to auditors, provided

[7:55] by

[7:56] the american public transportation

[7:57] association. They are going to be

[8:00] on site the week of

[8:02] october 6 and they will have a report

[8:03] ready for the december

[8:06] audit

[8:09] committee meeting.

[8:10] >>

[8:11] this takes us to the end of the presentation.

[8:12] are there any questions or concerns

[8:14] I can address?

[8:15] >> at this point, mike,

[8:16] it doesn't look like

[8:18] you have any concerns about things

[8:19] not being done in

[8:20] a relatively good timeframe. Does

[8:21] that

[8:24] sound right?

[8:25] >> yeah. That is definitely

[8:26] accurate. We

[8:31] keep internal tracking of the

[8:32] status of our projects relative to how

[8:33] much of the year has lapsed and we

[8:34] are in

[8:35] a really good place right now and

[8:39] we expect to fully complete the 2025

[8:43] audit plan

[8:46] within the --not

[8:49] calendar but

[8:50] --week of march to february. We will

[8:52] have it all finished

[8:53] before february.

[8:54] >> any other questions

[8:55] for mike on

[8:58] this part? It doesn't look

[8:59] like it. Thank you.

[9:00] >> thank you.

[9:01] >> then,

[9:04] let's see. Going to the

[9:05] open audit recommendations report.

[9:07] mike?

[9:12] >> great. So, this presentation is a

[9:13] report on

[9:16] the status of

[9:18] open audit issues and recommendations. This

[9:19] is a report

[9:22] that we give every

[9:27] committee meeting . We have closed

[9:29] one issue since the june audit committee

[9:31] meeting. That

[9:34] was

[9:37] issue r-22-06-4

[9:38] which is a recommendation that controls

[9:39] around support vehicle custody and

[9:40] key security be

[9:44] improved. Historically, keys for our support fleet

[9:46] vehicles were kept hanging on

[9:49] a pegboard type thing in

[9:52] an unlocked lockbox

[9:53] just out in the hallway. Since that

[9:55] time,

[10:00] management has purchased and installed

[10:01] an electronic check out and check

[10:04] in and key management system. I

[10:07] tested that system

[10:10] out to make sure that

[10:12] it assigns proper custody, that only approved

[10:13] users can check

[10:16] out a vehicle and that

[10:17] keys are secured unless it is authorized

[10:22] for use. I

[10:23] threw a lot at this, trying to break

[10:25] it, so to speak and it

[10:28] held up, at least to me. I think it

[10:31] is in

[10:33] good shape and they have taken some

[10:36] strong steps to secure this valuable

[10:37] asset.

[10:42] >> mike, is that type of control at

[10:43] all of our

[10:46] facilities that have support

[10:49] vehicle thing? I

[10:50] just don't know how many --I assume

[10:52] that everyone

[10:54] of our maintenance facilities have

[10:55] something similar but not to

[10:57] the same extent, right?

[10:58] >> I focused

[10:59] on the controls here

[11:01] at the

[11:04] headquarters building. As I

[11:05] understand it, and if anyone in management

[11:07] knows

[11:10] differently, fl

[11:13] hq has most of the support fleet

[11:15] vehicles that are floating that can

[11:16] be

[11:21] checked out. I think some of the locations have

[11:22] some but

[11:25] those are primarily signed out to

[11:26] individuals.

[11:27] >> those vehicles are typically assigned

[11:28] already. They have a

[11:31] responsible party for

[11:33] them.

[11:34] >> we better have use your microphone.

[11:35] >> is

[11:37] there any problem with over demand

[11:40] for

[11:42] these vehicles? Is there always a

[11:43] vehicle available for those

[11:45] who want it? Does anyone know the

[11:46] answer

[11:49] to that?

[11:50] >> we have not had a problem where

[11:52] we have not been able to meet

[11:53] the demand of the vehicles.

[11:54] >> my

[11:55] next question is, do we have too

[11:57] many vehicles?

[11:58] >> that is something

[11:59] that our vehicles team

[12:00] was always looking out. We have retired

[12:01] a number

[12:05] of vehicles. That is something we

[12:07] always look at.

[12:08] >> I think it was

[12:10] an issue two

[12:13] years ago .

[12:14] we have made some changes.

[12:15] >> that

[12:16] was part of the analysis process

[12:17] we went through to right size it and

[12:19] make sure we get efficient use out

[12:20] of it.

[12:21] >> one of the issues from this audit

[12:22] that is still open is

[12:25] about right sizing

[12:28] the fleet

[12:30] . And, about having processes in place

[12:31] to ensure that we have the right

[12:32] number in the right time of vehicles

[12:34] in place and

[12:35] management has taken some strong steps

[12:37] toward that

[12:40] and are developing policies

[12:45] and procedures to make sure that we

[12:46] have a good

[12:52] balance of the rain

[12:55] number of vehicles but also

[12:57] good availability.

[12:58] >> does that answer

[13:04] your question?

[13:05] >> let's

[13:06] see. The current status of open issues.

[13:07] there are currently 37 open issues.

[13:08] here is

[13:10] just

[13:13] a breakdown

[13:15] by cheap office, 10 are in capital service,

[13:16] 10 in

[13:22] operation, 10 in the people office, six

[13:23] in

[13:24] finance and then one is shared by

[13:25] enterprise strategy

[13:31] and operations

[13:34] . Another way to break that down is

[13:35] by year.

[13:36] three in 2020, seven in 2021, six

[13:37] in 2022, 16 in 2023, three 2024 and

[13:40] two from 2025.

[13:42] another --this is on the slide but

[13:43] it may also be instructive

[13:46] to know

[13:48] that the risk rating on those. For

[13:52] each of the

[13:54] audit issue, we ranked them as high, medium,

[13:55] or low

[13:57] based on the severity of the issue

[13:58] and the relative importance of

[14:01] it. Out of

[14:03] those 37, 12 were rated as high, 20

[14:04] as medium and five

[14:07] as low.

[14:08] >> or any of

[14:10] the ones from

[14:13] 2020 or even 2021,

[14:16] are those high at all? Do

[14:19] you know?

[14:22] mostly when I am going for

[14:24] there, high risk issues that have been

[14:25] around

[14:28] for a

[14:29] long time. If you don't have that

[14:31] answer right now, you can come

[14:33] back to this later.

[14:34] >> christi, do

[14:35] you have that information?

[14:37] I don't know if you want to

[14:40] come up.

[14:41] >> we would need

[14:42] you to come up and use the microphone,

[14:43] christie. We would love to hear your

[14:44] response.

[14:45] >> while she comes up, I can read them off

[14:46] real quick.

[14:49] >> sure. >> the three in 2020 are medium,

[14:54] high, medium and in 2020 when we have

[14:55] medium, high, medium, medium, medium, medium,

[14:56] high.

[15:00] >> okay. >> I don't know that you need

[15:01] me to add to

[15:04] that.

[15:05] >> it

[15:07] is not -- are we

[15:08] actively working on these issues?

[15:09] are some of the issues open because

[15:10] we

[15:13] don't have moved forward with the

[15:14] correct information

[15:15] to audit? Can you give us -- we are

[15:16] working on this

[15:19] with mike, give the committee a better

[15:20] understanding of where

[15:22] we

[15:24] are at?

[15:25] >> for the record, I am christie giles,

[15:26] the 10 risk management administrator

[15:27] and we do work closely with mike and we

[15:34] do check in on the open issues with

[15:36] the issues owners every month. They

[15:37] are getting constant attention. In

[15:38] some cases,

[15:40] in fact, in most cases, with these issues that are

[15:41] older, they have been

[15:44] escalated to chief

[15:47] level recently because in some places we

[15:49] need a little bit higher authority

[15:50] to

[15:53] make decisions and to

[15:56] take actions

[15:59] around these issues

[16:00] that are assigned to a lower leadership

[16:01] level so we are finding that we need

[16:02] to

[16:03] do a little more escalation to the

[16:04] right level to address the issues

[16:05] but they are getting

[16:08] constant attention.

[16:09] >> I

[16:10] guess, and I apologize because I have

[16:11] been gone a lot, within the last few

[16:12] weeks, I did not get a chance to look

[16:14] through

[16:16] the details. Getting escalated is

[16:18] one thing, taking action or figuring

[16:20] out a

[16:26] claim plan -- game

[16:27] plan to resolve it is a different thing. This

[16:29] would be helpful to know what

[16:30] the game plan is, at least on those

[16:32] 20 and 21

[16:37] issues.

[16:38] >> the status updates are

[16:39] accurate.

[16:40] the status updates are provided by management

[16:41] in every report in detail the action

[16:42] plan that is underway.

[16:47] >> absolutely. >> I will

[16:49] commit, chief carlton, that the december meeting,

[16:50] we will have

[16:53] a report. I would like a report

[16:55] on 2021 and 2022 to see where we are

[16:56] on each

[16:58] of those.

[16:59] >> okay. That is helpful.

[17:00] thank you.

[17:02] anything else on that, mike?

[17:05] >> no. Any other questions for

[17:08] him? Okay.

[17:09] >>

[17:11] with that, why don't we go on to

[17:14] internal

[17:17] audit report. The first item

[17:20] up is our light rail

[17:23] safety audit. I think travis king

[17:24] is going to join you. Does that sound

[17:26] right?

[17:27] >> yeah,

[17:31] he is.

[17:32] >> travis, we should have you introduce

[17:35] yourself too.

[17:36] >> good afternoon,

[17:37] travis king, director of safety and

[17:41] security.

[17:42] >> to quickly set

[17:45] the stage for what this audit is,

[17:47] this is an auditor

[17:48] that we internal audit perform on

[17:50] behalf of state safety

[17:53] oversight. They

[17:56] provide checklists that

[17:59] originally published

[18:02] by the fta to give us subjects

[18:04] and procedures that they want applied. They

[18:10] set the period of review. Also, unique to this

[18:14] audit is internal audit is

[18:17] strictly fact finders in

[18:20] this. We report the

[18:23] results

[18:24] and then the state safety oversight

[18:26] works with our

[18:27] safety management to determine what

[18:29] observations from the audit require

[18:32] corrective action

[18:33] and what that corrective action will

[18:35] be. This presentation

[18:38] will be more limited in

[18:41] the scope because of that

[18:44] reason. Internal audit

[18:45] does not issue recommendations for

[18:47] this audit the

[18:50] way that we do in a typical audit.

[18:53] this covers calendar year 2024 and

[18:55] then I won't read them all but those

[18:56] are the

[19:00] audit topics. A couple I will point

[19:02] out are the second bullet, transit

[19:05] agency safety plan updates. We

[19:08] did quite an extensive review of

[19:10] the task. That is the acronym. We

[19:17] reviewed the

[19:22] tasp. Halfway down, maintenance audits

[19:23] and inspections. We look

[19:24] at the way they handle preventative

[19:26] maintenance for our light rail vehicles

[19:27] and

[19:29] tested their compliance with those

[19:32] preventative

[19:33] maintenance schedules. We also looked

[19:35] at our

[19:38] security system. We looked

[19:41] at the security system plan. We

[19:44] reviewed that document and some other aspects

[19:47] of the

[19:50] security program.

[19:51] >> we completed this audit on june

[19:53] 30, 2025 and then

[19:56] a report was issued to state

[20:01] safety oversight. I will turn it over to

[20:02] travis king to report

[20:05] on what next steps are.

[20:08] >> yeah. Thank you, mike.

[20:10] I would also like to express my gratitude

[20:11] to the

[20:14] internal audit team. They have been

[20:15] a great job in helping us establish

[20:17] best practices in helping us do

[20:20] this review. Essentially, as

[20:22] mike explained, this is a breakdown of

[20:23] the same

[20:29] review that the fta does

[20:31] of us when they come in and do their triannual. We split

[20:32] it up into three

[20:34] different bases and cover a three-year period. Next steps,

[20:35] now that we have the

[20:38] results

[20:41] from mike's team, we are working closely with

[20:42] the sso to

[20:43] make a determination. If there was

[20:50] a finding

[20:53] , those will follow our hazard

[20:54] management process plan and will be

[20:56] issued a corrective action plan that

[20:57] will be

[20:58] approved by the state safety oversight

[20:59] and will be worked through and then

[21:00] closed out with

[21:01] the approval and help from the state

[21:02] safety oversight. Any recommendations,

[21:03] which are essentially

[21:04] best practices, will be reviewed and

[21:05] analyzed to determine if

[21:08] a corrective action plan is needed

[21:09] or if

[21:11] a lower mitigation

[21:14] is appropriate in that case all with

[21:15] the

[21:17] assistance and approval through

[21:20] the sso.

[21:23] >> just making sure it is clear for

[21:26] the record, the sso means what?

[21:28] >> I apologize pick the sso stands

[21:29] for the state

[21:32] safety oversight which

[21:34] is overseen by udot, the current assigned

[21:35] state oversight is peter jaeger.

[21:38] >>

[21:41] okay. Questions?

[21:42] >>

[21:44] thank you.

[21:45] >> I do

[21:47] have one.

[21:48] >> you

[21:50] said you completed the audit --

[21:53] bob is your --sorry.

[21:54] >>

[21:59] you said that you completed the audit on

[22:01] june 30. Okay? That was a few months

[22:02] ago. Are some of

[22:05] these

[22:08] audits too large with not enough staff to

[22:09] be able to

[22:10] complete in a timely manner or do

[22:11] you feel that that is a timely manner?

[22:14] how would you weigh

[22:17] that out? I know that is an

[22:20] open question. But be honest.

[22:21] >> they

[22:22] are

[22:23] very manageable. Very manageable audits.

[22:29] a typical --audits are

[22:30] not a homogenous product. They are

[22:32] not one-size-fits-all but these

[22:35] probably take -- I would

[22:38] guess two months to

[22:40] complete. State safety oversight,

[22:41] correct me if

[22:47] I misspeak ,

[22:48] travis. State safety oversight once

[22:50] the results early enough in the year

[22:51] that they

[22:53] can have

[22:54] corrective action plans in place by

[22:56] january. At least that is

[22:58] my understanding. So, I did this audit

[22:59] myself. I

[23:02] started it in late

[23:05] march,

[23:08] early april, we completed it

[23:11] june 30. And, as I

[23:14] understand it, that is plenty of time for

[23:15] state

[23:21] safety oversight

[23:23] to develop the corrective action plans and

[23:24] then as far

[23:25] as resources on my side, that was

[23:26] another part of your question. No,

[23:27] it

[23:29] wasn't a burden. We had planned for

[23:33] this and I was able to complete

[23:36] the audit as well as all of

[23:37] my other responsibilities during that time

[23:38] without any other issue.

[23:39] >> okay.

[23:42] >> good question. Thank you.

[23:45] >> with that, we

[23:47] will move to our special services

[23:51] operations

[23:54] audit. Mike, it looks like

[23:55] he will be joined by ryan taylor. Does

[23:57] that sound right?

[23:58] >> yeah. Ryan taylor and then also

[24:02] joanna gossen. I will let both of

[24:03] them introduce themselves

[24:05] for the record.

[24:06] >> hello, committee.

[24:07] I am

[24:12] joanna goss, one of the senior

[24:13] internal auditors for the uta.

[24:14] >>

[24:15] I am ryan

[24:16] taylor, general manager of special services

[24:18] at

[24:24] uta.

[24:25] >> first, special services

[24:27] operations audit. Our scope

[24:33] was dedicated to

[24:34] the four different areas. First is the

[24:36] governance of special

[24:38] service operations. The second would be

[24:39] staff training

[24:40] and oversight. Third would be the

[24:42] scheduling process that is utilized

[24:45] by special service

[24:48] operations in creating

[24:51] daily schedules for the

[24:54] routes

[24:55] and to fulfill our paratransit needs

[24:57] and then

[24:58] fourth would be the participation

[25:00] and

[25:03] risk management. Excuse me.

[25:04] I got the order wrong. It is on the

[25:05] slide there. Regardless, that was

[25:06] the

[25:09] scope of this

[25:12] audit. Hour period of review was

[25:15] january 2022 to february of this

[25:18] year, 2025. Any questions

[25:24] so far?

[25:27] >>

[25:30] all right. For our recommendations,

[25:33] the first and that we

[25:36] ended up doing was reviewing our

[25:38] safety-related standard operating

[25:39] procedures for special

[25:42] services and found that

[25:45] many had not been

[25:48] completed within

[25:50] a five-year timeframe so we had made the

[25:54] recommendation that two

[25:55] special service operations, to work

[25:56] with our safety team to a date these

[25:59] standards of procedures so that we

[26:00] could have effective

[26:03] and relevant standards of

[26:06] siege are.

[26:09] any questions regarding

[26:12] the

[26:15] sop?

[26:16] >> may be looking to

[26:18] ryan for a response and how that

[26:20] gets accomplished?

[26:21] >> we have set

[26:22] up

[26:24] a working group to review all of

[26:26] our sop's, concentrating first and

[26:27] foremost on the

[26:28] safety sop's which have been identified.

[26:30] they are doing

[26:33] that work currently and we

[26:39] are on

[26:41] schedule to have draft revisions submitted

[26:42] by november 1 which

[26:43] will review and we should have those

[26:45] completed by december 1 of this year.

[26:46] >>

[26:47] maybe

[26:48] it is too early to tell but are you

[26:49] looking at significant changes

[26:51] or refinements

[26:54] based on

[26:55] more current guidance?

[26:56] >> many of

[26:57] the processes are current. They may

[26:58] be

[26:59] old. We haven't deviated from that

[27:00] work over

[27:03] the

[27:04] past decade. The regulations for paratransit

[27:06] service has not really

[27:08] changed significantly. We are finding

[27:09] areas where

[27:12] we can tidy

[27:13] some of those sop's up and make some

[27:15] of those current but we

[27:18] don't see any major revisions of

[27:21] those.

[27:22] >> any

[27:24] further questions? Our

[27:30] second recommendation

[27:31] that we came up with after reviewing

[27:33] off the job descriptions held within

[27:36] special

[27:38] service operations was that some of

[27:39] these job descriptions had not

[27:42] been up dated in at least

[27:47] five years. We recommended that special

[27:48] service operations review these with

[27:51] human resources or our

[27:53] people office in order to update these

[27:54] the way that

[27:57] made them relevant

[28:00] to 2025 and

[28:06] moving forward. Then, the list,

[28:07] obviously the list of the job descriptions

[28:09] are there on the slide.

[28:10] >> we

[28:12] also agree with

[28:18] this finding

[28:20] and have tasked our managers for those respective

[28:21] job descriptions, to go through

[28:22] those. We have been doing that on

[28:24] a case-by-case basis so when a job

[28:25] opening happens, typically the hiring

[28:26] manager will at least review that

[28:27] to see if there

[28:28] is anything that has had any major

[28:30] changes but we are going through and

[28:31] redlining

[28:32] any of those to update those and our

[28:33] target date for completion

[28:36] is to have

[28:39] all the description reviewed

[28:40] by january 1 and complete those updates

[28:42] by

[28:45] february 15.

[28:46] >> any

[28:47] questions? Jeff?

[28:48] >> it sounds like it

[28:49] was more

[28:53] as needed and this way you are getting

[28:54] a full look and

[28:56] trying to make sure these are up to date.

[28:57] >>

[28:58] rate.

[28:59] >> sounds great.

[29:00] >> it probably only helps you later

[29:01] on when

[29:02] you go to host if you are not having to

[29:03] do it.

[29:06] >> absolutely.

[29:08] >> moving onto the next slide, we

[29:09] reviewed some data that special

[29:11] services collects in order to create

[29:12] goals and

[29:15] to maintain compliance

[29:18] with fta regulations. Within

[29:21] this data,

[29:23] it is noteworthy that even with an

[29:24] increase in ridership

[29:27] throughout the reporting

[29:28] period, special services has supported

[29:30] a higher rate of

[29:32] on-time performance for operators

[29:36] and maintain low rates for missed trips

[29:37] and trips

[29:39] taken over 90 minutes, which

[29:42] is commendable. Some of the data that we reviewed

[29:45] suggested that average

[29:48] hold times for customers calling in

[29:49] to create a

[29:51] trip had increased

[29:57] and that --there is

[30:00] an increase in calls that were over

[30:01] two

[30:03] minutes. We have made the

[30:05] recommendation that management reevaluate staffing

[30:06] needs

[30:09] to assess if

[30:12] increased staff would ensure average

[30:13] call times and then

[30:18] also review

[30:21] the call time in general over two minutes

[30:23] to see if there were needs of re-addressing

[30:24] those goals or looking into that

[30:27] as well.

[30:28] >> do all scheduling have

[30:29] to be

[30:30] done through

[30:33] an operator?

[30:36] is there an option

[30:38] or something where they can schedule

[30:39] something --

[30:40] >> really, all calls and

[30:41] reservations go through our call center.

[30:42] that is correct. We are looking at

[30:43] a technology solution for

[30:44] a self-service portal that we would

[30:45] hope could come

[30:48] online next year.

[30:51] >> okay.'s tee we do have

[30:54] a small call center of nine reservation

[30:57] agents. It is our obligation

[31:00] to that fta and

[31:03] all of the regulations

[31:05] regarding ada and paratransit that

[31:06] we can take

[31:08] any trip reservations up to the day before

[31:15] the service

[31:21] . So, that operates 24/7. For example,

[31:22] when we are closed on christmas day,

[31:24] we need to be able to take reservations

[31:25] for

[31:26] the day after so we have staff available

[31:27] for that. During this time, we

[31:29] did have some turnover in that department and

[31:30] we were short a

[31:32] few individuals and we have hired

[31:35] staff there who are in training. Because of the

[31:36] complexity of looking

[31:39] those

[31:41] trips, we do have conditions of eligibility

[31:42] for a lot of our individuals. It

[31:45] does take a good amount

[31:48] of time for someone to

[31:51] become proficient in that job and

[31:52] we are

[31:53] in the process of training those individuals

[31:54] and also working with the

[31:57] business analysts, ensuring that

[32:02] our data on those calls is correct

[32:03] on the hold times to make

[32:06] sure that we are in compliance

[32:10] with

[32:11] that.

[32:12] >> is there -- maybe you answered the question

[32:13] -- is there a way for customer service

[32:15] to take rollover calls for you or

[32:17] not really?

[32:18] >> no. With the complexity

[32:19] of the trips, it is

[32:22] very specific for those ada

[32:28] paratransit trips.

[32:31] it is specific

[32:32] to each individual booking that.

[32:33] >>

[32:34] when you are fully staffed, do you meet the

[32:35] thresholds?

[32:36] >> whatever our commitment is.

[32:37] >> it ebbs

[32:40] and flows. When you have a staff

[32:42] of only nine reservationists and four

[32:44] leader reservationists and you are

[32:45] open basically business hours seven

[32:46] days

[32:49] a

[32:50] week, you are trying to manage those calls

[32:52] when you have people who

[32:55] call out sick or

[32:56] are on vacation and you have limited

[32:58] staff, that also limits

[32:59] our availability. Our lead schedulers who

[33:01] take escalated calls

[33:04] and do a lot of

[33:06] the training, they jump in on the

[33:07] call too. They are actively

[33:10] monitoring

[33:11] that to see how many calls we have on

[33:13] the q and can

[33:14] jump in and mitigate that when they see that

[33:16] going too

[33:19] long.

[33:20] >> I am sure you are

[33:22] mindful of this. When I

[33:25] hear automation, there tends to be a

[33:26] little less of the human characteristics

[33:31] of that and I would think the

[33:33] clientele that take advantage of this,

[33:34] there is

[33:37] probably an enhanced need to make

[33:40] sure they feel like they

[33:41] are connecting. I don't know if any

[33:43] of you had been on the

[33:44] other end of an automated call but

[33:46] sometimes it can become a

[33:47] little frustrating. I am sure you

[33:49] are being mindful

[33:51] of that and whatever system you move

[33:54] forward with, it will take into account that

[33:58] need to make sure

[33:59] that there is still the ability to

[34:01] communicate

[34:03] directly if needed.

[34:04] >> absolutely.

[34:05] we will always make

[34:07] sure that that is available

[34:10] for individuals. A little bit of background

[34:11] on the system we are looking at. It

[34:13] is a web based portal where

[34:14] an individual can log on to an internet

[34:16] site. They will have to have

[34:18] their credentials and they can only

[34:19] book trips for

[34:20] themselves or a caregiver can book it

[34:26] for them. Then, that still has to

[34:27] be evaluated. That will actually shorten

[34:28] the process

[34:29] for many people and they can do it

[34:31] on their

[34:34] own time. We are excited

[34:37] about that, to have it as a

[34:38] elementary product.

[34:39] >> some of the

[34:40] groundwork can be pre-done so when

[34:41] they get to the queue or that , it

[34:43] helps everybody.

[34:44] >>

[34:46] correct.

[34:49] >> thanks. >> okay. For our

[34:53] next recommendation, actually moves

[34:55] right into

[34:58] the

[34:59] scheduling. From my perspective as

[35:03] an auditor, the scheduling process

[35:04] for special

[35:06] service operations, to ensure that

[35:07] we are

[35:08] fulfilling our ridership needs is incredibly

[35:10] dynamic. We are

[35:13] dealing with a diverse group

[35:19] of individuals , calling in, requiring

[35:20] operation supervisors and scheduling

[35:22] staff to quickly review

[35:23] incoming information. That is being

[35:25] bombarded at them throughout the

[35:28] day. And, the need to plan

[35:30] these routes every single day 48 hours

[35:36] in advance in a way that best serves our customers and also

[35:38] balances the workload of available operators

[35:40] and available routes within

[35:43] the system. In looking at

[35:49] how dynamic this process is and

[35:52] how well the team is working on

[35:54] managing that with all of the different

[35:55] needs,

[36:00] we suggest --we recommend that management

[36:01] should formalize the procedure as

[36:02] a standard operating procedure rather

[36:03] than rely on the wonderful communication

[36:04] on the

[36:10] teams there. A way that patient

[36:13] won't

[36:16] be lost

[36:18] in the case that everyone wins the lottery

[36:19] and decides to

[36:20] walk away. A recommendation here would

[36:21] be for management to formalize the

[36:22] scheduling process and

[36:25] the standard of

[36:27] procedure document.

[36:28] >> we also concur with

[36:30] that finding. I think that one of

[36:34] our opportunities is in our

[36:37] formal documentation and

[36:40] I think that is probably an area that needs the

[36:41] most amount

[36:43] of work. We have all

[36:46] you

[36:47] formulated --also related a working

[36:48] group and they are currently meeting

[36:49] and working

[36:52] on this process and

[36:53] the target date for completion is

[37:01] april 1.

[37:02] >> then, for

[37:07] our last --I'm

[37:08] sorry. Were there any further questions?

[37:09] >>

[37:10] I don't think so.

[37:11] >> for our last recommendation,

[37:12] we

[37:13] reviewed our cdl licensure of employees

[37:14] and

[37:16] the system in which we are keeping those

[37:21] records here and employee license

[37:22] records that are entered

[37:24] into udot's system, which is the system

[37:25] we

[37:28] rely on with our

[37:30] acquisition team, with our people

[37:33] office team, the records are inaccessible

[37:34] or not as accessible to

[37:39] operations services --service units,

[37:40] excuse me.

[37:43] that

[37:44] prohibits records and monitoring and

[37:46] a proactive notification to

[37:49] employees when their licensing

[37:52] is expiring. We make the

[37:57] recommendation here that in order for us

[37:58] to be

[38:01] more secure in

[38:02] these records that we come up with

[38:07] a way so that our talent

[38:08] acquisition and our people office

[38:10] can share

[38:11] these records with the operations

[38:16] business units.

[38:17] >> I can't imagine this

[38:19] is limited to special services,

[38:21] though, right? How do we check the

[38:22] rest of our cdl?

[38:23] >> I would

[38:24] have to bring up andrea's pullman

[38:25] to see how we are

[38:28] doing that.

[38:31] >> are you getting

[38:34] expired cdl? You would probably have

[38:35] to

[38:37] pull that down toward

[38:40] you too.

[38:41] >>

[38:42] the light isn't on. We received routine

[38:43] reports from

[38:46] the people

[38:49] office and

[38:50] our senior office specialists review

[38:51] those. They schedule appointments

[38:52] ahead of time for

[38:53] cdl holders. I think the challenge

[38:55] comes when

[38:58] things happen in between those reporting

[38:59] periods

[39:01] but

[39:04] we do monitor. We schedule these

[39:05] appointments for our employees and we

[39:07] do a good job at it but

[39:09] there are sometimes gaps because we

[39:10] don't have access in real-time

[39:13] to

[39:16] the information.

[39:19] >> so, it sounds like it is not just

[39:20] a special services challenge.

[39:21] >> that

[39:22] is across all services.

[39:23] >> I wonder if

[39:24] udot

[39:25] or somebody would

[39:28] help share real-time access.

[39:29] >> we will

[39:31] work with a team.

[39:34] >> anyway. >> on this

[39:39] particular one, the lead, they have

[39:40] an action plan put in place

[39:41] for that where each of the service

[39:42] units will provide subject matter

[39:43] experts

[39:45] to assist on our sides to help them

[39:46] craft

[39:48] a solution.

[39:49] >> okay. Anything else?

[39:52] >> absolutely. This concludes --unless

[39:54] there are other questions from the

[39:55] committee.

[39:56] >> I don't see

[39:58] any.

[39:59] >>

[40:00] thank you.

[40:01] >> ryan, thanks for those

[40:02] goals and I look forward to

[40:04] the follow-up is.

[40:05] >> purchase card

[40:07] program

[40:10] audit.

[40:13] welcome. Welcome our

[40:16] colleague, beth. Welcome. Mike, I

[40:17] guess viola

[40:19] miller ,

[40:22] you will be joined by

[40:25] anybody else?

[40:27] >> yeah, yeah. We also have luke barber,

[40:28] one of our senior internal

[40:30] auditors.

[40:31] >> okay. Great. We will

[40:32] turn the

[40:34] time to you.

[40:35] >> we will go ahead and

[40:37] take it.

[40:38] >> luke barber, senior

[40:40] internal auditor. We have the purchase

[40:41] card

[40:44] program audit. It

[40:47] took place mid part of the year

[40:50] and ended

[40:53] back in -- well, right in

[40:54] august. We got the report locked out.

[40:56] it is a pretty

[40:59] big program. The

[41:01] audit scope was from that period of

[41:02] september

[41:05] 1, 2021 through february

[41:08] 28,

[41:11] 2025. Just to address the

[41:14] dates there, that is when we switched the

[41:16] uta to using u.s. Bank as our card management

[41:19] bank. We recorded the duration of

[41:20] that and

[41:23] the audit topics were

[41:25] the governance over the program with

[41:28] a compliance with any laws and within

[41:32] our own sop's. Various

[41:34] transaction testing, we looked at

[41:35] the

[41:38] different

[41:41] transactions and some analytics as

[41:43] far as how certain transactions were

[41:44] handled. The scope also included a

[41:47] risk

[41:48] management portion. We don't have

[41:52] a slide.

[41:53] >> sorry, that should say

[41:54] the

[41:56] scope did not include

[41:58] risk management.

[41:59] >> we don't have

[42:02] a slide addressing this

[42:05] but our program is quite large,

[42:06] something to bear in mind. We have

[42:11] approximately

[42:12] 500 p cards within our system. They

[42:13] are used for smaller purchases that

[42:14] don't require direct

[42:17] oversight from

[42:19] accounts payable. There is about 1

[42:20] million to 1.2

[42:21] million in spending per month that

[42:23] goes through that and if we did

[42:24] away with the program that would all

[42:26] fall on ap

[42:29] and I am sure that would be a

[42:31] big burden. With that being said,

[42:32] we will

[42:35] jump in --

[42:36] >> do you have a total number

[42:39] of annual p card transactions? Do you

[42:41] have

[42:44] that report?

[42:45] >> I

[42:46] had an estimate in the introduction

[42:47] of

[42:53] the report.

[42:57] the most recent annual spend was about

[43:02] 13.5 million.

[43:03] >> that was about

[43:05] a year of 2024 calendar

[43:11] year.

[43:12] >>

[43:13] can I ask a quick question? Sorry, I

[43:14] was late

[43:15] to the party. Thank you for everybody. On

[43:17] the good news, the city

[43:18] did obtain their. I had a question

[43:20] on your transaction testing.

[43:23] structurally, do you

[43:26] --is there a percentage that

[43:28] you attempt to understand? Do you

[43:29] do specific dollar

[43:30] figures or specific months? Maybe

[43:32] you could just talk about how

[43:35] you navigate the specifics

[43:38] on that?

[43:39] >> within transaction testing,

[43:41] we looked at it from a few different

[43:42] angles. One of them is running analytics

[43:44] to provide to management in determining what our

[43:47] biggest spend

[43:50] areas were

[43:51] . We provided a table with information

[43:53] as far as what the spend is per

[43:54] area. We can provide that or it is

[43:56] in the report

[43:59] as well. We also looked

[44:02] at, based on risk, what areas

[44:05] would be a

[44:10] higher risk type item. One of the policies

[44:11] that we

[44:13] looked at is having things shipped,

[44:14] directly to a uta address rather than

[44:17] a

[44:18] non-uta address. We looked at transactions

[44:20] that were sent outside of the

[44:26] uta address

[44:29] . In addressing your question, kind of

[44:30] yes. We looked at

[44:31] all of those things from different

[44:32] angles.

[44:33] >> there is not a percentage,

[44:38] per se?

[44:40] just a strategy to know where you're

[44:41] more potential risk

[44:42] factors are. With that be accurate?

[44:44] >> yeah.

[44:46] >> thanks. >> if you have a p card

[44:47] --

[44:48] >>

[44:49] do I have one?

[44:50] >> no. Just hypothetical.

[44:51] if you have a

[44:55] p card, and your supervisor, will he

[44:56] go through your charges at

[44:57] the end of your billing period?

[44:58] >>

[44:59] by policy, they should

[45:02] be reviewed.

[45:03] >> due to

[45:05] the large scale

[45:08] of the program,

[45:13] you have two options. One would be to

[45:14] hire staff that

[45:17] could directly monitor all of

[45:18] the transactions. I don't know if that

[45:20] would be super effective the other

[45:21] one

[45:23] is relying on supervisors and middle

[45:24] management

[45:25] to actually review the transactions

[45:29] and

[45:30] approve other people's transactions.

[45:32] >> are there receipts and other things

[45:33] attached

[45:35] to them?

[45:36] >> there

[45:37] should be.

[45:38] >> we will address that.

[45:39] there are a few findings

[45:44] on that.

[45:45] >> I think we will also note

[45:50] that the

[45:53] numbering on

[45:54] this doesn't flow exactly and that is because

[45:56] there are a few items that were more

[45:57] sensitive in

[45:58] nature and so those will be addressed

[45:59] in a closed session after this.

[46:00] so, the first one we are reporting

[46:05] on is audit finding 25-03-02

[46:07] and the issue was that there was one

[46:08] open purchase card that belonged to

[46:09] a

[46:11] terminated employee.

[46:14] we did not find any

[46:17] evidence that

[46:18] a fraudulent or any spending was done

[46:20] after they had left uta employment

[46:21] but that

[46:22] is obviously a risk because it was

[46:23] open. You can use it

[46:28] for possible online purchases, et cetera.

[46:29] >> could you

[46:31] clarify if they had returned the card

[46:32] to their supervisor or

[46:34] if they literally took the card with

[46:35] them accidentally? I am just going to

[46:38] presume accidentally. Can you not

[46:40] specify?

[46:41] >> we were not able to determine

[46:46] that. The office takes care of that and

[46:47] gets the card so management, I

[46:49] think, addressed that and said they

[46:50] were able to determine.

[46:51] >>

[46:56] go ahead.

[46:57] >> so, yes,

[46:58] we were able to determine that no

[46:59] charges were made after the fact but

[47:00] we

[47:01] are working with the people office

[47:02] to make sure that

[47:05] we get notified when people are terminated

[47:06] if they

[47:08] have

[47:11] a card.

[47:14] >> okay.

[47:15] so, the recommendation there were that

[47:16] management should coordinate with

[47:17] people office, which they

[47:20] are working on and then consider

[47:22] creating an automated system that might

[47:23] notify if that

[47:29] is needed when an

[47:30] employee leaves. And then, having the

[47:31] p card administrator periodically

[47:32] reconcile or create

[47:33] some kind of a tracking mechanism to

[47:35] ensure that only active cardholders

[47:36] are

[47:40] current employees. Any additional

[47:47] questions there?

[47:48] >> okay. Then we

[47:49] are

[47:50] going to go to

[47:53] finding 03-05. The issue here was

[47:56] at 137

[47:59] cardholders or --speaking to the question

[48:01] that bob had earlier. There are cardholders

[48:05] and then there can be within the system

[48:06] just transaction approvers.

[48:07] they may not have an actual card but

[48:08] they log into the

[48:11] u.s. Inc. System

[48:13] and they are able to view those and

[48:14] approve them. So, a

[48:16] total of 137 card elders were approval

[48:17] had not completed the training that

[48:18] is available called

[48:20] basic purchase

[48:24] card training.

[48:28] >> I did not think there was an option. I

[48:30] thought it was part of

[48:33] the

[48:35] training module requirements.

[48:36] >> part

[48:37] of the issue

[48:38] here is that the training module requirement

[48:39] is only for

[48:40] the cardholder. We are working on

[48:42] updating that now.

[48:48] >> okay. >> so, just

[48:51] for clarity. You can be

[48:55] an approver and not be a cardholder.

[48:57] >> not actually have

[48:58] a card.

[48:59] >> exactly. >> it is really

[49:00] be

[49:01] approver that is missing the training?

[49:03] >>

[49:06] yes.

[49:07] and, where we have annual training requirements, some

[49:09] people are not meeting those.

[49:14] >> okay. >> there should be some clarification. The

[49:15] issue that

[49:17] we looked at was more in the calendar

[49:18] year

[49:19] or from starting january 1 of 2024

[49:21] and rolling through the end of

[49:23] the audit dates. We did not look at

[49:29] the historical.

[49:30] >> if somebody did not

[49:31] complete

[49:33] their training of the card, you

[49:34] can suspend the card?

[49:35] >> they will

[49:36] get notification if they

[49:37] do not pay it within the 30 days.

[49:39] the card will

[49:44] be suspended.

[49:45] >> with that, our recommendations

[49:46] were that

[49:47] policies and sop's be updated to clearly mandate

[49:50] the annual training for the cardholders

[49:51] and

[49:53] the approvers. Then, also identify

[49:54] cardholders

[49:57] and approvers who have not

[50:00] completed it in

[50:01] the past year and require that completion. Or,

[50:03] as they said, they can

[50:06] suspend the card. Any additional

[50:09] questions there?

[50:12] >> our next one, the

[50:13] issue was training for specifically

[50:15] transaction approvers does

[50:21] not exist

[50:26] . Currently there is just that p card

[50:27] basic training and

[50:28] it seemed that there might be an opportunity

[50:29] to provide some additional training

[50:30] for those who don't

[50:31] necessarily have an p card but are

[50:32] required to review those and those

[50:33] transactions

[50:36] and then approve

[50:39] them.

[50:40] >> what is

[50:45] your response?

[50:46] >> yes,

[50:47] we absolutely are working on this as well.

[50:48] first, I just want to go back in general

[50:50] and to say thank you for this audit

[50:51] because we do not have a

[50:52] full-time p card administrator and

[50:54] the work

[50:57] that a p-card

[51:02] administrator does do is obviously

[51:03] missing

[51:04] some things because of the resource

[51:05] factor. I was happy to have this audit

[51:06] done

[51:09] so we could identify the gaps or,

[51:10] rather, have someone else identify them for

[51:12] us so we could start figuring out

[51:14] what to do about these. In this case, we

[51:15] did not have a

[51:19] transaction approver trainee. I saw

[51:21] that when I came in because someone

[51:24] told me what to do but there was no

[51:25] training on specifically what to look

[51:27] for and I think this lack

[51:30] of training

[51:33] is also an indirect cause

[51:36] of some of the other issues

[51:39] that luke brought up especially, for

[51:40] instance, the fact

[51:42] that receipts are not

[51:44] uniformly attached. If we don't train

[51:45] the approvers that

[51:48] they are supposed to

[51:51] make sure

[51:52] that the receipts are attached, then

[51:53] that is an issue. We are definitely

[51:54] working

[51:56] on that. I am working with todd and

[51:57] tina to come up with what

[51:58] should be our training and we are

[52:00] working with people office

[52:06] as well.

[52:14] >> one other question I would have

[52:15] on it. Are these tax-exempt?

[52:17] are we tax exempt on this?

[52:18] >> yes.

[52:19] >> is that something that is being

[52:20] asked? The reason I ask that is because

[52:21] at the county, it is something we

[52:22] look very closely at, to make sure

[52:24] everybody is doing that. If not, there

[52:26] is a red flag that goes up on each

[52:27] one.

[52:28] >> we get a report from

[52:29] mike every month that he works with

[52:30] the comptroller's office to recover

[52:31] anything that

[52:33] has not been properly

[52:36] not taxed.

[52:37] >> how many

[52:39] millions did you

[52:41] say is annually on each cards? See

[52:42] the most recent one was

[52:48] 13.5 million.

[52:49] >>

[52:50] so if that is the total amount. I

[52:51] was asking for the number of transactions on

[52:53] an annual basis. Do you know that?

[52:54] >> I don't know about annual but

[53:00] hour period covered --I could give

[53:01] you an exact

[53:03] number. It

[53:06] was 136,599.

[53:07] >> total transactions?

[53:08] >> total transactions. >> we will rounded

[53:09] up to 600.

[53:12] >> mike, to bob's question, if

[53:15] the sales

[53:18] tax is paid and it is

[53:21] paid in utah, anyway, then that

[53:24] is recoverable through

[53:26] filing with the tax commission, correct?

[53:27] >> it is. We

[53:30] work with --like I said, we work with

[53:31] the comptroller

[53:33] to

[53:36] do that and they have a regular cadence for

[53:38] going back to the tax commission and

[53:39] getting those

[53:45] funds back.

[53:46] >> it should

[53:47] be noted that that is contained within

[53:48] the p-card basic training, you have

[53:49] information about being tax-exempt.

[53:50] >> I would just think that with that

[53:51] total many dollars and

[53:54] that

[53:57] many transactions,

[54:02] that is not an easy task to watch that but

[54:03] I would say that

[54:06] has got

[54:09] to be open and not

[54:10] accusing anybody but it definitely

[54:12] opens it up for there to be some

[54:13] type of fraud going on someplace as

[54:15] far as that goes. That is a lot of

[54:17] things that could be being charged. They

[54:18] are not all being looked at

[54:21] very,

[54:24] very closely.

[54:25] >> certainly

[54:27] fraud is --fraud and also

[54:30] accidental personal purchases are always

[54:36] a possibility

[54:39] and I've got to choose my

[54:42] words carefully. We didn't find any

[54:45] evidence of widespread or

[54:48] egregious fraud in

[54:51] our procedures. Separate from

[54:54] this audit, my

[54:57] team also --we also do a

[55:00] number of other things that gets our

[55:03] eyes on p-card

[55:06] transactions.

[55:08] for one, the sales tax thing. Because

[55:09] of that, we reviewed

[55:12] just about every transaction. We,

[55:13] on

[55:15] a quarterly basis,

[55:18] we review

[55:21] p-cards, specifically looking for duplicate

[55:22] transaction. That gets us

[55:23] pulling reports, seeing what is being

[55:24] spent . I also have

[55:28] a

[55:31] monitoring report

[55:34] --

[55:35] credit cards have what is called an

[55:36] mcc code, merchant category code.

[55:37] every company has an

[55:39] associated code. For instance, walmart

[55:40] or

[55:43] a department or

[55:44] store, mcdonald's would be fast food, et

[55:45] cetera. I have flagged some of the

[55:49] high risk

[55:50] type mcc codes and I have a report

[55:55] sent right to my

[55:56] email box. I get it just about every morning

[55:58] of any transactions that hit up

[56:00] against that and then I can review

[56:01] it and see

[56:04] if any follow-up

[56:07] is

[56:10] needed. So,

[56:12] nobody can guarantee that an environment is

[56:13] 100% free

[56:16] from fraud. As long

[56:18] as people are involved in any process,

[56:19] that promise can't be

[56:22] made but,

[56:28] our internal audit, both in

[56:29] this audit and through all of those

[56:31] other activities I

[56:36] have described, we have seen enough that

[56:37] I am confident

[56:38] that we don't have systemic or widespread

[56:39] fraud going on within our purchase

[56:46] card program.

[56:53] >> also, if I could touch base on

[56:54] this. Since I have joined us in 2023, we have

[56:55] also reduced significantly the number

[56:57] of p-cards being held. I don't know

[56:58] if you want

[56:59] to touch on that quickly or not.

[57:00] >>

[57:01] on

[57:04] the training, I have

[57:05] noticed this a little bit, and thank

[57:07] you, bob for being here. I am

[57:10] hoping that

[57:13] it includes

[57:16] --if you have a business meal,

[57:17] the purpose of the business meal,

[57:18] those types of things. It seems intrinsic

[57:19] if you

[57:20] have lived at your whole life but if

[57:22] you haven't, somebody may not realize

[57:25] those are

[57:26] the things they actually need to be

[57:28] submitting on the

[57:29] documentation and I am wondering if

[57:31] those things should also

[57:34] be included.

[57:35] >> those things

[57:36] are absolutely being considered. We

[57:37] recognize from this audit that we

[57:38] need not just to

[57:39] establish some training portals for

[57:40] specific things but

[57:46] also retraining.

[57:49] the receipts for when there are

[57:50] meals, one, they are not supposed

[57:52] to be single person

[57:53] meals and two, they are supposed to put

[57:54] on the receipt who was in attendance at

[57:55] the

[57:58] meal. Right? So, also making

[58:01] sure

[58:03] that the senior person who was in

[58:04] attendance at the meal

[58:07] is the person who uses

[58:09] the card. We definitely need to do

[58:10] some retraining

[58:13] and we are working

[58:16] on that.

[58:17] >> with that, are there any

[58:18] questions

[58:19] on

[58:22] this slide? You can skip to the next

[58:23] one which is totally fine because

[58:25] we did find a

[58:27] number of potential purchases where

[58:28] it was an

[58:29] individual meal or when that would

[58:31] not fall

[58:33] within policy. As noted, they recognize

[58:37] the ability

[58:38] to improve that process and create

[58:40] some better documentation for

[58:43] that and training.

[58:46] any additional

[58:49] questions there?

[58:50] >>

[58:52] the last one

[58:55] is issue 25-03-08

[59:01] where the issue is purchase transactions lacked

[59:04] detailed information required

[59:07] by policy.

[59:10] so, a few different things there.

[59:11] as mike noted, there were 137,600

[59:12] transactions, I think. So, 85,068

[59:13] of them

[59:15] were 62% did not really have a description

[59:16] as required, written

[59:19] in the u.s.

[59:22] bank

[59:24] system. 4412 were missing receipts

[59:25] and

[59:28] then 3039 did not have any recorded approvals from

[59:31] a supervisor or

[59:34] transaction

[59:40] approver.

[59:41] >> I was going

[59:43] to ask, how does it go

[59:46] on

[59:49] that long?

[59:52] the system, having used it, if somebody doesn't approve

[59:53] it,

[59:55] it doesn't always come to the

[59:56] approver but at some point, somebody

[59:58] should flagged that as

[1:00:01] lack of

[1:00:02] action by the cardholder. I am just

[1:00:04] wondering how does that

[1:00:06] get resolved?

[1:00:07] >> again, retraining, absolutely

[1:00:10] require it

[1:00:12] but in some cases, there are a couple

[1:00:13] of things going on here

[1:00:16] where the auto populated

[1:00:19] piece in u.s.

[1:00:22] bank allows people to think

[1:00:25] that the

[1:00:27] field has been completed so they just

[1:00:28] approve it or they just let

[1:00:31] it go. The other is, in

[1:00:33] some cases where the information has

[1:00:37] become an issue where

[1:00:40] the manager has not approved

[1:00:42] it and the two cycles that they are provided and then

[1:00:43] the

[1:00:46] card

[1:00:48] is shut off and then they go in and

[1:00:49] they fix and the card is turned back

[1:00:52] on, it doesn't automatically

[1:00:54] wipe up --out the stuff that wasn't approved

[1:00:55] the

[1:01:00] prior times. Sometimes it is just

[1:01:01] a communication issue. Sometimes it

[1:01:02] is a

[1:01:04] system issue. Sometimes it is a people

[1:01:05] issue.

[1:01:06] we are working on that. One of the

[1:01:07] things that I wanted to

[1:01:10] bring up is that we are working with

[1:01:11] a vendor

[1:01:13] that is coming in next week to give

[1:01:14] --

[1:01:15] I believe the meeting is next week,

[1:01:16] just to give us

[1:01:19] a discussion, right?

[1:01:22] of what kinds of things we

[1:01:25] could be looking for in a p-card

[1:01:28] management vendor because

[1:01:31] there are ways that we could

[1:01:36] structure this so that we could send

[1:01:37] a list of our active

[1:01:40] employees and they

[1:01:43] automatically roll

[1:01:45] it through the system and so the ones who

[1:01:46] are no longer active,

[1:01:47] they automatically turn those cards

[1:01:49] off so even if somebody doesn't turn

[1:01:50] in their card,

[1:01:52] they won't have access to spend against

[1:01:53] it.

[1:01:54] there are options where they could

[1:01:55] set up, instead of a card, they have

[1:01:56] a

[1:01:58] replenished account where

[1:02:01] you don't --for those cardholders

[1:02:02] who have cards

[1:02:03] because they travel once a year to

[1:02:09] a conference , they are not going

[1:02:10] to have any option

[1:02:12] but to turn the card on for that conference,

[1:02:13] right? Otherwise, you would have to

[1:02:14] go through your management to say,

[1:02:16] I am going to two conferences this

[1:02:17] year. Can you

[1:02:19] turn the card

[1:02:22] on for this other

[1:02:23] conference? There are options we have

[1:02:25] looked into because we know we don't

[1:02:26] have internal resources to

[1:02:27] do this full program the way it should

[1:02:28] be

[1:02:31] done and we are looking

[1:02:32] into those options at the same time

[1:02:34] as improving our

[1:02:37] training protocols.

[1:02:38] >>

[1:02:43] anything else?

[1:02:44] >> I mean, there is

[1:02:45] a second slide of recommendations

[1:02:46] but I think most were addressed in

[1:02:47] the comments

[1:02:49] just now. It should also be

[1:02:51] noted that management and everybody was

[1:02:53] very helpful in

[1:02:58] this audit. It went very well, very

[1:02:59] smoothly as

[1:03:00] meetings were requested or information

[1:03:05] was requested

[1:03:07] . The team is aware that there are some areas

[1:03:08] that probably needed some improvement

[1:03:09] and they were very helpful throughout

[1:03:11] the

[1:03:12] whole process. It has been a good

[1:03:13] process that way.

[1:03:14] >> viola, what you

[1:03:15] see is

[1:03:16] the timeframe for getting into some

[1:03:20] kind

[1:03:23] of overall --

[1:03:24] >>

[1:03:25] the end of this year is the plan. There

[1:03:26] are couple of things we were able

[1:03:27] to do immediately like restricting

[1:03:29] who

[1:03:31] has approvals. Now, that is set by

[1:03:32] the p-card

[1:03:35] administrator and not by the

[1:03:41] individual cardholder.

[1:03:43] there are some compliance audits and we

[1:03:44] are checking

[1:03:45] those right now to see who is outside of

[1:03:46] the compliance as far as not taking

[1:03:47] the training. Those immediate things

[1:03:49] are being done and then the training

[1:03:50] and finding some

[1:03:51] vendor support is going to be at the

[1:03:53] end of the year.

[1:03:56] >> okay. Questions for vi

[1:03:59] or staff?

[1:04:02] okay.

[1:04:03] >> I have one thing to add

[1:04:04] that you brought up in the beginning

[1:04:05] which was about the packages

[1:04:08] being sent

[1:04:11] to non-uta addresses. Again, that is

[1:04:12] another training issue but I wanted to

[1:04:14] bring up that of

[1:04:17] the

[1:04:18] numbers, two people were responsible

[1:04:23] for 60% of those

[1:04:24] transactions so those two people have been

[1:04:26] identified and those

[1:04:28] specific retraining's but it wasn't

[1:04:29] everyone

[1:04:33] running amok.

[1:04:34] >> I actually did not

[1:04:35] think you could go to

[1:04:37] a non-uta address. I know you can

[1:04:41] but from the policy

[1:04:43] standpoint. Mini from a policy standpoint

[1:04:44] it is

[1:04:47] not supposed to

[1:04:48] happen but the thing is, when you

[1:04:49] order on amazon, sometimes you just

[1:04:50] forget

[1:04:53] to change it from your personal. They

[1:04:55] are supposed to be using our business

[1:05:01] amazon account.

[1:05:02] >> okay. >> that is helpful.

[1:05:03] it

[1:05:04] takes out the sales tax, anyway.

[1:05:05] >> exactly.

[1:05:06] >> okay.

[1:05:08] with that, mike, anything

[1:05:10] else from your end?

[1:05:11] >> nothing else.

[1:05:12] >> our next meeting

[1:05:14] will be on monday, december 15

[1:05:17] at 3:00.

[1:05:20] we do --

[1:05:22] let's see. We do have a closed session

[1:05:29] to discuss a strategy session to

[1:05:31] discuss topics as defined in the utah

[1:05:32] code in regards to

[1:05:34] deployment of security personnel,

[1:05:35] services or

[1:05:37] systems and that particular meeting

[1:05:43] will be in our map room. With that,

[1:05:44] I entertain

[1:05:47] a motion to go into

[1:05:51] closed session.

[1:05:52] >> so moved to go into

[1:05:53] closed session.

[1:05:54] >> second. >> I have a

[1:05:55] motion from jeff, seconded by beth

[1:05:56] to go

[1:05:59] into

[1:06:01] closed session. All in favor say aye.

[1:06:02] >> aye. >>

[1:06:03] any opposed?

[1:06:04] >> that motion

[1:06:05] passes. We will plan to see everybody

[1:06:06] there in five minutes at a

[1:06:08] quarter after.

[1:06:10] >>> we have returned our closed

[1:06:13] session and with

[1:06:15] that, we will take a final motion of adjournment.

[1:06:22] >> motion. >>

[1:06:24] second.

[1:06:25] >> motion and a second. All

[1:06:26] in favor say aye.

[1:06:27] >> aye.

[1:06:28] >> any opposed? >> we stand adjourned.

Audit Committee on 2025-09-22 3:00 PM

Agenda

Transcript