~ NOTICE OF MEETING ~ CAPITAL METROPOLITAN TRANSPORTATION AUTHORITY BOARD OF DIRECTORS FINANCE, AUDIT AND ADMINISTRATION COMMITTEE MEETING www.capmetrotx.iqm2.com ~ AGENDA ~ Monday, June 15, 2020 10:00 AM Video Conference Meeting Board of Directors Page 1 Printed 6/11/2020 I. Public Comment: II. Action Items: 1. Approval of Minutes from the May 15, 2020 Finance, Audit and Administration Committee meeting. 2. Approval of a resolution authorizing the President & CEO, or his designee, to finalize and execute a Memorandum of Understanding with the City of Round Rock authorizing Round Rock to be a Direct Recipient of a portion of Capital Metro’s FY2021 and FY2022 Federal Section 5307 Program funds. III. Presentations: 1. Internal Audit FY2020 Audit Plan Status 2. Audit Report - OrbCAD, Analysis of Service Delays 3. Audit Report - Semi-annual Follow-up on Prior Recommendations IV. Items for Future Discussion: V. Adjournment ADA Compliance Reasonable modifications and equal access to communications are provided upon request. Please call (512) 369-6040 or email [email protected]if you need more information. Committee Members: Terry Mitchell, Chair; Wade Cooper, Troy Hill and Pio Renteria.
Transcript
~ NOTICE OF MEETING ~
CAPITAL METROPOLITAN TRANSPORTATION AUTHORITY
BOARD OF DIRECTORS FINANCE, AUDIT AND ADMINISTRATION COMMITTEE MEETING
www.capmetrotx.iqm2.com
~ AGENDA ~
Monday, June 15, 2020 10:00 AM Video Conference Meeting
Board of Directors Page 1 Printed 6/11/2020
I. Public Comment:
II. Action Items:
1. Approval of Minutes from the May 15, 2020 Finance, Audit and
Administration Committee meeting.
2. Approval of a resolution authorizing the President & CEO, or his designee,
to finalize and execute a Memorandum of Understanding with the City of
Round Rock authorizing Round Rock to be a Direct Recipient of a portion of
Capital Metro’s FY2021 and FY2022 Federal Section 5307 Program funds.
III. Presentations:
1. Internal Audit FY2020 Audit Plan Status
2. Audit Report - OrbCAD, Analysis of Service Delays
3. Audit Report - Semi-annual Follow-up on Prior Recommendations
IV. Items for Future Discussion:
V. Adjournment
ADA Compliance
Reasonable modifications and equal access to communications are provided upon
request. Please call (512) 369-6040 or email [email protected] if you need
more information.
Committee Members: Terry Mitchell, Chair; Wade Cooper, Troy Hill and Pio Renteria.
Finance, Audit and Administration CommitteeAgenda June 15, 2020
Board of Directors Page 2 Printed 6/11/2020
The Board of Directors may go into closed session under the Texas Open Meetings Act.
In accordance with Texas Government Code, Section 551.071, consultation with
attorney for any legal issues, under Section 551.072 for real property issues; under
Section 551.074 for personnel matters, or under Section 551.076, for deliberation
regarding the deployment or implementation of security personnel or devices; arising
regarding any item listed on this agenda.
Capital Metropolitan Transportation Authority MEETING DATE: 06/15/2020
Board of Directors (ID # 4614)
Approval of Minutes from the May 15, 2020 FAA Meeting
Page 1
Approval of Minutes from the May 15, 2020 Finance, Audit and Administration Committee meeting..
2.1
Packet Pg. 3
CAPITAL METROPOLITAN TRANSPORTATION AUTHORITY
BOARD OF DIRECTORS
FINANCE, AUDIT AND ADMINISTRATION COMMITTEE
2910 East Fifth Street Austin, TX 78702
~ MINUTES ~
Friday, May 15, 2020 10:00 AM Video Conference Meeting
Board of Directors Page 1 Printed 6/11/2020
Call to Order: 10:07 a.m.
I. Public Comment:
There were no public comments.
II. Action Items:
1. Approval of Minutes from the February 12. 2020 Finance, Audit and Administration Committee Meeting.
Motion to approve by Board Member Cooper. Hill second. Approved 3-0.
2. Approval of a resolution authorizing the President & CEO, or his designee, to
approve an Interlocal Agreement with the City of Austin for the New Mover Program in an amount not to exceed $22,464.
Community Involvement Specialist Lonny Stern presented this item.
This program - New Movers - is an extension of the existing partnership with the City of Austin called Smart Trips. The goal of the program is to encourage people to find new ways to get around Austin, reducing single-occupant vehicle trips. Customized toolkits are provided to participants to alert them to all the transportation options available to them. Over several years the program has shown consistent results in increasing active and shared commuting in several areas of the city. The 2021 program will target individuals and families who have recently relocated and have new mailing addresses, and CAMPO has provided a matching grant to help expand the program.
Board member Hill asked about the logistics of the program and whether there was an app involved. Lonny explained that we promote the program via the mail and targeted Facebook ads. Interested parties are invited to events featuring transportation options that include a fun or social component.
Motion to place on the consent agenda at the full board by Board Member Hill. Cooper second. Passes 4-0.
III. Presentations:
1. FY2019 Financial Audit
CFO Reinet Marneweck introduced Tino Robledo, Senior Manager from RSM, who presented the FY2019 Financial Audit.
2.1.a
Packet Pg. 4
Att
ach
men
t: 2
0051
5 F
AA
Co
mm
itte
e M
inu
tes
(46
14 :
Ap
pro
val o
f M
inu
tes
fro
m t
he
May
15,
202
0 F
AA
Mee
tin
g)
Finance, Audit and Administration Committee Agenda May 15, 2020
Board of Directors Page 2 Printed 6/11/2020
Mr. Robledo ran through his firm's scope of services and presented the results of the audit. Overall the results of the financial statements audit were "clean/unmodified", as they were for both the defined benefit and defined contribution retirement plans. There were no significant deficiencies with internal controls. There were also no findings with the Federal and State Compliance audit results.
2. Internal Audit FY 2020 Audit Plan Status
Vice President of Internal Audit Terry Follmer presented this item.
Terry shared the status of his department's current projects. He also shared some of the research and best practices that the agency has been doing related to the COVID-19 situation. The agency has put together a task force that is focused on Capital Metro's response, and will be developing a plan to assist with future pandemics.
3. Internal Audit IT Endpoint Management Report
Vice President of Internal Audit Terry Follmer presented this item.
This is the first time this audit has been done at the agency. The majority of network breaches - approximately 70% -- come from endpoints attached to the network. UT interns assisted with building a data analytics tool to help spot computers and devices attached to the network that may be at risk because they are missing current patches and virus protection software. Internal Audit also made recommendations on updating agency-wide guidelines and policies related to IT management.
4. Internal Audit OrbCAD Incident/Accident Review Process Report
Vice President of Internal Audit Terry Follmer introduced Auditor Jeannette Lepe, who presented this item.
This was another project that benefited from an assist from UT interns. Incidents and accidents are recorded in the OrbCAD database, and COO Dottie Watkins suggested that a deeper dive into the data to ensure accuracy and proper internal controls. All data from an incident is manually keyed into three separate systems - approximately 5000 were recorded last year. Recommendations from the audit include finding a way for the systems to be combined or work more efficiently together, ensuring the accuracy of the data input, and finding ways to automate more of the data entry.
IV. Items for Future Discussion:
V. Adjournment
Adjourn: 11:05 a.m.
2.1.a
Packet Pg. 5
Att
ach
men
t: 2
0051
5 F
AA
Co
mm
itte
e M
inu
tes
(46
14 :
Ap
pro
val o
f M
inu
tes
fro
m t
he
May
15,
202
0 F
AA
Mee
tin
g)
Finance, Audit and Administration Committee Agenda May 15, 2020
Board of Directors Page 3 Printed 6/11/2020
ADA Compliance
Reasonable modifications and equal access to communications are provided upon request. Please call (512) 369-6040 or email [email protected] if you need more information.
Committee Members: Terry Mitchell, Chair; Wade Cooper, Troy Hill and Pio Renteria.
The Board of Directors may go into closed session under the Texas Open Meetings Act. In accordance with Texas Government Code, Section 551.071, consultation with attorney for any legal issues, under Section 551.072 for real property issues; under Section 551.074 for personnel matters, or under Section 551.076, for deliberation regarding the deployment or implementation of security personnel or devices; arising regarding any item listed on this agenda.
2.1.a
Packet Pg. 6
Att
ach
men
t: 2
0051
5 F
AA
Co
mm
itte
e M
inu
tes
(46
14 :
Ap
pro
val o
f M
inu
tes
fro
m t
he
May
15,
202
0 F
AA
Mee
tin
g)
Capital Metropolitan Transportation Authority MEETING DATE: 06/15/2020
Board of Directors (ID # 4615)
City of Round Rock MOU for 5307 Funding
Page 1
Approval of a resolution authorizing the President & CEO, or his designee, to finalize and execute a Memorandum of Understanding with the City of Round Rock authorizing Round Rock to be a Direct Recipient of a portion of Capital Metro’s FY2021 and FY2022 Federal Section 5307 Program funds. .
2.2
Packet Pg. 7
Capital Metropolitan Transportation Authority MEETING DATE: 6/15/2020
Board of Directors (ID # AI-2020-1225) City of Round Rock MOU-5307 Funds
Page 1
SUBJECT: Approval of a resolution authorizing the President & CEO, or his designee, to finalize and execute a Memorandum of Understanding with the City of Round Rock authorizing Round Rock to be a Direct Recipient of a portion of Capital Metro’s FY2021 and FY2022 Federal Section 5307 Program funds. FISCAL IMPACT This action has no fiscal impact.
STRATEGIC PLAN: Strategic Goal Alignment: 2. Ridership Strategic Objectives: 2.3 Pursue service expansion opportunities EXPLANATION OF STRATEGIC ALIGNMENT: Capital Metro is coordinating with non-members in the Austin urbanized area to meet transit needs in their communities and build a regional system. These efforts will result in a more robust transit network that can eventually be brought together through regional planning efforts. BUSINESS CASE: As the Designated Recipient of the grant, Capital Metro must concur with the use of federal funds allocated for the Austin urbanized area, which extends beyond the service area. Capital Metro’s goal is to work with these local communities to meet their transit needs now and in the future. By receiving a formulated portion of 5307 funding, the City of Round Rock will be able to continue their on-demand and fixed route service and plan for future transit needs. COMMITTEE RECOMMENDATION: This agenda item was presented and is recommended for approval by the Finance, Audit and Administration Committee on June 15, 2020. EXECUTIVE SUMMARY: As the public transit provider of the Austin urbanized area, Capital Metro is the Designated Recipient of Federal Section 5307 Program funds for the urbanized area. Per Federal Transit Administration (FTA) guidelines, Section 5307 funds can be used for transit capital and operating assistance in urbanized areas and for transportation planning. In the past, Capital Metro provided Round Rock a portion of 5307 funds that were apportioned to the agency by the FTA as part of a pass-through arrangement
2.2.a
Packet Pg. 8
Att
ach
men
t: R
eso
luti
on
-AI-
2020
-122
5 (
4615
: C
ity
of
Ro
un
d R
ock
MO
U f
or
5307
Fu
nd
ing
)
Page 2
outlined in an interlocal agreement (ILA). In FY2011, the ILA that authorized this arrangement was not renewed and Round Rock elected to become a Direct Recipient of FTA funds, coordinating directly with the FTA to submit independent grant applications. In FY2013, an agreement was signed for FY2013 and FY2014 Section 5307 funds to be directly distributed to Round Rock. This agreement has been renewed on a biennial basis since that time. Capital Metro is not required to provide technical support or assistance beyond any that may be required by the FTA when a Designated Recipient authorizes another public entity to be a Direct Recipient. Round Rock is permitted to apply for a share of Capital Metro’s FY2021 and FY2022 Section 5307 funds based upon the distribution formula that will be published in the federal register for the FTA FY2021 and FY2022 Section 5307 apportionments. The distribution of any 5307 funds to Round Rock will be contingent upon the apportionment and distribution of 5307 funds to Capital Metro. If the FTA does not apportion or distribute 5307 funds to Capital Metro, Round Rock would not be eligible to receive 5307 funds as a Direct Recipient. If the FTA reduces the amount of 5307 funds available to Capital Metro, Round Rock’s share of 5307 funding would be based upon the reduced amount. These terms are included in the attached MOU between Capital Metro and Round Rock. The MOU expires on September 30, 2022 and applies only to Section 5307 funds appropriated in FY2021 and FY2022.
DBE/SBE PARTICIPATION: Does not apply. PROCUREMENT: Does not apply. RESPONSIBLE DEPARTMENT: Finance
2.2.a
Packet Pg. 9
Att
ach
men
t: R
eso
luti
on
-AI-
2020
-122
5 (
4615
: C
ity
of
Ro
un
d R
ock
MO
U f
or
5307
Fu
nd
ing
)
Page 3
RESOLUTION
OF THE
CAPITAL METROPOLITAN TRANSPORTATION AUTHORITY
BOARD OF DIRECTORS
STATE OF TEXAS
COUNTY OF TRAVIS RESOLUTION (ID # AI-2020-1225)
City of Round Rock MOU-5307 Funds
WHEREAS, Capital Metro is the Designated Recipient of Section 5307 Program funds apportioned by the Federal Transit Administration for the Austin urbanized area; and WHEREAS, the City of Round Rock has requested a portion of Capital Metro’s Section 5307 funds in order to support the planning, capital development and operation of transit services for the Round Rock community, including demand response bus service, express bus service and reverse commute bus service. NOW, THEREFORE, BE IT RESOLVED by the Capital Metropolitan Transportation Authority Board of Directors that the President & CEO, or his designee, is authorized to finalize and execute a Memorandum of Understanding with the City of Round Rock that authorizes Round Rock to continue to be a Direct Recipient of a portion of Capital Metro’s FY2021 and FY2022 Federal Section 5307 Program funds. ________________________ Date: ____________________ Secretary of the Board Eric Stratton
2.2.a
Packet Pg. 10
Att
ach
men
t: R
eso
luti
on
-AI-
2020
-122
5 (
4615
: C
ity
of
Ro
un
d R
ock
MO
U f
or
5307
Fu
nd
ing
)
Page 1 of 5 CMTA/Round Rock MOU
5307 Funds – FY 2021-2022
Memorandum of Understanding between the
Capital Metropolitan Transportation Authority and the City of Round Rock
Regarding the Provision of Federal Transit Administration
Section 5307 Program Funds
This Memorandum of Understanding (“MOU”) regarding the provision of Federal Transit
Administration Section 5307 Program Funds is executed by and between the City of Round
Rock (“City”) a local government public entity and the Capital Metropolitan
Transportation Authority (“Capital Metro”) a transportation authority and political
subdivision organized under Chapter 451 of the Texas Transportation Code, collectively
referred to as “the Parties.” Accordingly, the Parties set forth their intent and
understandings as follows:
I. PURPOSE
Capital Metro is the designated recipient (“Designated Recipient”) of Section 5307
Program funding apportioned by the Federal Transit Administration (“FTA”) for the Austin
urbanized area. This MOU outlines the Parties’ mutual intent and understanding with
respect to Capital Metro’s authorization of City as a direct recipient of FTA Section 5307
Program funds. City and Capital Metro agree to work cooperatively and in good faith in
the manner set forth herein.
II. KEY TERMS
A. The Parties will comply with the requirements of the Urbanized Area Formula Funding
Program (49 U.S.C. 5307).
B. Since City is not a member city of the Capital Metro transit system, City would like to
become a direct recipient (“Direct Recipient”) of a share of the Section 5307 Program
funding apportioned to Austin urbanized area (“FTA Section 5307 Program Funds”).
C. During the term of this MOU, City is authorized to apply for a share of Section 5307
Program Funds apportioned and distributed to Capital Metro, as Designated Recipient
for the Austin urbanized area, based upon the distribution formula established by the
FTA for Section 5307 Apportionment Formula Distribution of Available Funds during
FTA fiscal years 2021 (October 1, 2020 – September 30, 2021) and 2022 (October 1,
2021 – September 20, 2022) (each a “FTA Fiscal Year”).
D. The distribution of any amounts payable to City as a Direct Recipient is contingent
upon the successful apportionment and distribution of Section 5307 funds to Capital
Metro as the Designated Recipient for the Austin urbanized area for FTA Fiscal Years
2021 and 2022. If the FTA does not apportion or distribute Section 5307 Program
Funds to Capital Metro as the Designated Recipient, City will not be eligible to receive
Section 5307 Program Funds as a Direct Recipient. If the FTA reduces the amount of
Section 5307 Program Funds available to Capital Metro as the Designated Recipient,
City’s share of funding will be based upon the reduced amount. Capital Metro will not
be liable to City for any damages, which are caused or associated with any FTA changes
2.2.b
Packet Pg. 11
Att
ach
men
t: R
ou
nd
Ro
ck M
OU
FY
202
1-22
Des
ign
ated
Rec
ipie
nt
(46
15 :
Cit
y o
f R
ou
nd
Ro
ck M
OU
fo
r 53
07 F
un
din
g)
Page 2 of 5 CMTA/Round Rock MOU
5307 Funds – FY 2021-2022
to the amounts apportioned or distributed to the Austin urbanized area under the Section
5307.
E. Capital Metro is not obligated to provide any technical assistance or technical support
to City beyond the requirements of FTA Circular 9030.1E.
F. City’s designation as a Direct Recipient requires the approval by the Capital Metro
Board of Directors and the Round Rock City Council.
G. Capital Metro will not provide technical support or assistance beyond any that may be
required by the FTA when a Designated Recipient authorizes another public entity to
be a Direct Recipient.
B. Capital Metro’s Responsibility:
A. Capital Metro will remain the Designated Recipient of Section 5307 Program
Funds apportioned by the FTA for the Austin urbanized area;
B. Capital Metro authorizes City to be a Direct Recipient of a share of the Section
5307 Program Funds apportioned to the Austin urbanized area based on the
distribution formula established by the FTA for Section 5307 Apportionment
Formula Distribution of Available Funds during FTA Fiscal Years 2021 and 2022;
and
C. Capital Metro’s authorizes this designation once to include all grant applications
for FTA Section 5307 Program Funds submitted by City to FTA during the term of
this MOU.
C. Round Rock Responsibility:
A. City will remain an eligible FTA grantee for the provision of transit services and
construction of transit facilities;
B. As a Direct Recipient, City will use FTA Section 5307 Program Funds to support
the planning, capital development and operation of transit services for the Round
Rock community;
C. City shall comply with all provisions of FTA Circular 9030.1E, Urbanized Area
Formula Program: Program Guidance and Application Instructions, Chapter II,
Section 8, Applicants Other than Designated Recipients, including but not limited
to providing its local share of matching; and
D. City shall comply with all applicable requirements set forth in state or federal law,
regulations, policies, and administrative practices.
III. TERM OF MOU
This MOU will be executed and effective as of the date of the last Party to sign (the
“Execution Date”) and expire on the last day of the FTA Fiscal Year 2022. The Parties may
mutually agree, in writing, to extend the term of this MOU. This MOU may be terminated
or modified by thirty (30) day advanced written notice by either Party. In the event that
either Party shall be in default of its material obligations under this Agreement and shall
2.2.b
Packet Pg. 12
Att
ach
men
t: R
ou
nd
Ro
ck M
OU
FY
202
1-22
Des
ign
ated
Rec
ipie
nt
(46
15 :
Cit
y o
f R
ou
nd
Ro
ck M
OU
fo
r 53
07 F
un
din
g)
Page 3 of 5 CMTA/Round Rock MOU
5307 Funds – FY 2021-2022
fail to remedy such default within thirty (30) days after receipt of written notice thereof,
this MOU may be terminated at the option of the Party not in default upon expiration of
the thirty (30) day period.
IV. INCORPORATION OF DOCUMENTS
This MOU incorporates by reference the following attachments:
A. Attachment A, resolution of the Capital Metro Board of Directors approving this
MOU.
B. Attachment B, Resolution of the Round Rock City Council approving this MOU.
V. MISCELLANEOUS
A. This MOU constitutes the entire MOA between Capital Metro and City. No other terms
and conditions are applicable, unless amended and agreed to by both Parties.
B. By execution of this MOU, neither Party waives or relinquishes any sovereign immunity
rights available to it by law except as otherwise stipulated by applicable laws.
VI. SIGNATORY
This MOU is hereby accepted and agreed to by the following individuals or officers who
are duly authorized to bind the Parties as set forth above:
Capital Metropolitan
Transportation Authority
City of Round Rock
By: By:
Randy Clarke Name: ____________________________________
2 Semi-annual Implementation Status Report - November 2019 Completed 2/123 Semi-annual Implementation Status Report - May 2020 Completed 6/154 FY2020 Risk Assessment & development of FY21 Audit Plan In-Process
FY20 Audit Assurance & Advisory Projects
1Quadrennial Review (Requisition #306188) - Evaluation Team currently looking at proposals received 4/30
In-Process
RFP released 4/1; Final
Proposals due 6/3
7/15
2QAR (Quality Assurance Review) of Internal Audit practices - GAO/ALGA have postponed all QAR's by 9 months
Postponed due to COVID-19
3 Payroll Process - SOX Like Key Financial Control Testing Planning4 Project Connect - System Controls & Processes (e-Builder) Planning
2 OrbCAD - Analysis of Service Delays Completed UT Interns 6/153 Develop a Contagious Virus Response Plan based on APTA Standard Completed Draft Plan 5/154 Develop COVID-19 Situation Reports for 3/11 to 4/9 In-Process5 COVID-19 Sharepoint Directory - Organize Key Documents by Area/Dept In-Process
6 RFP 305938 – External Auditing Services - Member of Selection CommitteeIn-Process
3.1.a
Packet Pg. 17
Att
ach
men
t: F
Y20
20 In
tern
al A
ud
it P
lan
Sta
tus
6-15
-202
0 (
4617
: In
tern
al A
ud
it F
Y20
20 A
ud
it P
lan
Sta
tus)
Capital Metropolitan Transportation Authority MEETING DATE: 06/15/2020
Board of Directors (ID # 4618)
Audit Report - OrbCAD, Analysis of Service Delays
Page 1
TITLE: Audit Report - OrbCAD, Analysis of Service Delays
3.2
Packet Pg. 18
OrbCAD Service Delays Process Review (20-06)
Internal Audit Report #20-06| June 8, 2020
ORBCAD SERVICE DELAYS PROCESS REVIEW
(20-06)
Terry Follmer, VP of Internal Audit
Distribution List: Capital Metro Board of Directors Randy Clarke, President and CEO Kerri Butcher, EVP, Chief Counsel & Chief of Staff Donna Simmons, EVP, Administration & EEO Officer Reinet Marneweck, EVP, Chief Financial Officer Dottie Watkins, Chief Customer Officer & COO Sharmila Mukherjee, EVP – Planning & Development David Dech, VP, Rail Operations Ken Cartwright, VP, Capital Projects Jane Schroter, VP, Chief Information Officer Shanea Davis, VP, Real Estate, Property & Asset Management Chad Ballentine, VP, Demand Response & Innovative Mobility Brian Carter, VP, Marketing & Communications Gardner Tabon, VP, Safety, Risk Management, & Accessible Services Tangee Mobley, VP, Bus Operations and Maintenance Muhammad Abdullah, Senior Director, Chief Procurement & Compliance Officer Susan Renshaw, Controller Rafael Villareal, Director of Contract Oversight Charlie Jackson, IT Director of Transit Technology Systems Jennifer Govea, Manager of Service Analysis
A. Swiftly vs OrbCAD Comparison………… ……………………………..………..…..……….…………………………....5 B. OTP Reporting Process Flowchart……………………………………………………………………………………………6 C. Top 10 Problem Codes Used……….…………………………………………………………………………………………..7 D. OTP Swiftly Vs OrbCAD High Frequency Routes……………………………………………………………………….8
3.2.a
Packet Pg. 20
Att
ach
men
t: 2
0-06
Orb
CA
D S
ervi
ce D
elay
s P
roce
ss R
evie
w 6
-8-2
020
(46
18 :
Au
dit
Rep
ort
- O
rbC
AD
, An
alys
is o
f S
ervi
ce D
elay
s)
1
EXECUTIVE SUMMARY This OrbCAD Service Delays Process Review project was added to the Fiscal Year 2020 Internal Audit Plan at the request of management. We performed an audit of the OrbCAD Service Delay reporting process to evaluate the efficiency and effectiveness of internal controls to ensure the completeness and accuracy of the records, and compliance with contract and applicable policies/procedures. The audit results, including the objective, scope, and conclusion, are as follows.
Background As of January 5th, 2020, MV Transportation (MV) is the sole service provider responsible for all bus operations and related maintenance. Before this date, MV was responsible for the north garage located at 9315 McNeil Road, and RATP Dev was responsible for the south garage located at 2910 East 5th Street. The MV contract for service delays requires the service provider to comply with the following: 1. Service Provider is expected to log all service delays in the CAD/AVL system OrbCAD within a
maximum of fifteen (15) minutes following the start of the delay. 2. Failure to properly and accurately document an incident, including but not limited to failure to
accurately reflect change out buses, lost time, or service delays, will result in a PDC of $100 per occurrence. The PDC will not apply until after the seventh day of the incident, which represents the time allowed to accurately reconcile and finalize incident entries.
3. On-Time Performance goal is 83%, and it is measured by 0 minutes early and no more than 5 minutes late.
MV is responsible for the personnel that records all service delays into the OrbCAD system. OrbCAD is a computer-aided dispatch application used for vehicle dispatching, automatic vehicle location and monitoring, real-time performance and incident management, two-way messaging, route schedule adherence, remote vehicle health monitoring, and analytics. At the Operations Control Center, the OrbCAD system automatically color codes all service delays. As part of this process, the performance queue will color code the event to allow the Dispatcher to select a problem code (see Appendix C) and subcategory code in OrbCAD describing the reason for the service delay, but completion of this field is not required by the system. Note, once a problem code is chosen, the incident cannot be deleted in OrbCAD. On-time performance (OTP) is captured in two different systems, OrbCAD and Swiftly, but OrbCAD is the official system of record for external reporting. Swiftly is a transit data platform that captures real-time transit information to allow management to manage the transit fleet proactively. One of the key differences between the two systems is that OrbCAD captures (i.e., Polls) the bus GPS location every 30 seconds while Swiftly records the GPS location every 10 seconds (See Appendix A for more details). However, OrbCAD reports OTP in real-time for some of the stops that are classified as "time points," as the bus enters or departs the preset radius of the stop. As part of this project, Internal Audit performed a comparison of OTP performance on high-frequency routes using both OrbCAD and Swiftly, which can be found in Appendix D. The on-time reporting process flowchart in Appendix B illustrates how data is captured in OrbCAD and finally reported to the public. Upon an Operator login into the bus, OrbCAD starts capturing the on-time performance data, and the Dispatchers simultaneously view notifications of the delays at the Operations Controls Center. Per the MV contract, the Dispatcher is supposed to create events in OrbCAD and identify a problem code and subcategories to describe the event. (See Appendix C for most common used codes) Once a month, the Strategic Planning Development Department produces the OTP reports using Infoview.
3.2.a
Packet Pg. 21
Att
ach
men
t: 2
0-06
Orb
CA
D S
ervi
ce D
elay
s P
roce
ss R
evie
w 6
-8-2
020
(46
18 :
Au
dit
Rep
ort
- O
rbC
AD
, An
alys
is o
f S
ervi
ce D
elay
s)
2
The CMTA Data Analyst uses the reports to review the on-time performance for each route and completes the Schedule Adherence Exceptions Report, which includes all exceptions for the month. The service provider must respond by the 12th of the month, and the results of the on-time performance goal are provided to Capital Metro Management. The IT Department obtains the result of the on-time performance and updates the route performance dashboard to allow customer access to this information. The Program Manager from Operations and Maintenance Oversight Department reviews several reports to calculate the service monthly performance deficiency credits (PDC). The monthly reports reviewed include lost time hours, block PDC, lost Q bus, OrbCAD logs, missed pullouts, and others. All documentation is submitted to Finance and included in the service provider's monthly invoice for potential incentives/disincentives to be included in the payment.
Audit Objective & Scope The primary objective of this audit was to determine whether internal controls over the service delays reporting processes are sufficient to ensure the completeness and accuracy of the records and compliance with contract and applicable policies/procedures. The scope included completing a flowchart of the process, a review of OrbCAD vs. Swiftly data capture, analysis of high-frequency routes between OrbCAD and Swiftly, review of Capital Metro's policies, review of ITS System OrbCAD Operations Manual, review of contracts, invoices with monthly oversight reports reviewed, interviews and review of desk procedures. Testing included reviewing OrbCAD incidents data for December 2019 to January 2020, and on-time performance for January 2020.
Opinion Our sample testing of service delay coding showed that Dispatchers are accurately coding service delays as the code selected agreed with the written narrative for almost all of the transactions tested. In our opinion, internal controls can be improved by making OrbCAD system and monitoring changes in the following two areas:
1. OTP Target Measurements Differ from MV Contract
2. Service Delay Records and Monitoring
More details regarding the issues/risks and recommendations can be found below in the detailed audit report. This audit was conducted in accordance with the U.S. Government Accountability Office's Generally Accepted Government Auditing Standards (GAGAS) and the Institute of Internal Auditor's International Professional Practices Framework (IPPF). These standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. The audit was conducted by the following staff members in the Capital Metro Internal Audit Department:
• Jeannette Lepe, Senior Auditor (Project Lead)
• Terry Follmer, VP of Internal Audit Recommendations to strengthen internal controls and improve accountability were provided to management in the audit report. Management agrees with the internal audit recommendations and has provided target completion dates, which are included in the detailed audit report below. A follow-up audit is performed semi-annually (i.e., May and November) to ensure management action plans for all issued audit reports are completed timely. We appreciate the cooperation and assistance provided to us throughout this audit.
3.2.a
Packet Pg. 22
Att
ach
men
t: 2
0-06
Orb
CA
D S
ervi
ce D
elay
s P
roce
ss R
evie
w 6
-8-2
020
(46
18 :
Au
dit
Rep
ort
- O
rbC
AD
, An
alys
is o
f S
ervi
ce D
elay
s)
OrbCAD Service Delays Process Review (20-06)
3
Issues & Risk Recommendation Management Action Plan
1. OTP TARGET MEASUREMENTS DIFFER FROM MV CONTRACT
We reviewed the controls related to the calculation of OTP and noted the following discrepancies:
• MV contract states 0 minutes early to no more than 5 minutes late, but OrbCAD is configured to calculate based on 0 minutes early to 6 minutes late.
• Swiftly is more accurate in calculating GPS location because it captures the bus GPS locations every 10 seconds instead of every 30 seconds for OrbCAD (See Appendixes A & D).
OTP metrics impact monthly payment amount to service providers, so differences noted above require further review and action.
The Director of Contract Oversight, Manager of Service Analysis, and IT Director of Transit Technology Systems will consider the following improvements:
a) Ensure the OTP calculation programmed into the OrbCAD system agrees to the contract (i.e., 0 minutes early to no more than 5 minutes late). Alternatively, management may want to consider modifying the contract to agree with OrbCAD by changing the contract language to state late is after 5 minutes and 59 seconds.
b) Evaluate and consider whether Swiftly should be used as the OTP contract monitoring tool to measure OTP performance.
Management agrees with the recommendations. Target Completion Date:
a) 9/30/20 and
b) 12/31/20
3.2.a
Packet Pg. 23
Att
ach
men
t: 2
0-06
Orb
CA
D S
ervi
ce D
elay
s P
roce
ss R
evie
w 6
-8-2
020
(46
18 :
Au
dit
Rep
ort
- O
rbC
AD
,
OrbCAD Service Delays Process Review (20-06)
4
Issues & Risk Recommendation Management Action Plan
2. SERVICE DELAY RECORDS & MONITORING
The MV contract requires them to record/code the reason for each service delay in OrbCAD within a maximum of 15 minutes from the occurrence. We reviewed the controls related to this process and noted the following weaknesses:
• OrbCAD has not been set up to automatically capture the 15-minute requirement.
• OrbCAD has not been set up to capture service delays that are missing a reason code.
• The OCC Dispatcher had a guide that did not agree to the CMTA OrbCAD Operations Manual. Additionally, the CMTA OrbCAD Operations Manual contains 20 codes that should not be used.
• We noted one situation whereby a new problem code was created, but the Dispatchers were not informed and trained.
The purpose of the requirement to report 15-minute service delays is to ensure that key stakeholders (for example, Customer Care) have quick visibility into incidents which are impacting service. This intent suggests that contract language may need to be clarified and reporting adjusted accordingly.
The Director of Contract Oversight, Manager of Service Analysis, and the IT Director of Transit Technology Systems will consider the following improvements:
a) Clarify contract language to meet the intent of reporting service delays impacting service.
b) An OrbCAD report should be created to capture all incidents that are not coded by Dispatchers within 15 minutes of the occurrence, in accordance with the modified contract language per item a above.
c) An OrbCAD report should be created to capture all incidents that are never recorded by Dispatchers with an explanation of the incident, in accordance with the modified contract language per item a above.
d) The OrbCAD guide and manual should be reviewed and approved by CMTA. Training and communication protocols for OrbCAD manual updates should be developed.
e) Using the new OrbCAD reports in recommendations b & c above, analyze results to help minimize service delays, and understand Dispatcher training and staffing needs.
Management agrees with the recommendations. Target Completion Date: 10/31/20
3.2.a
Packet Pg. 24
Att
ach
men
t: 2
0-06
Orb
CA
D S
ervi
ce D
elay
s P
roce
ss R
evie
w 6
-8-2
020
(46
18 :
Au
dit
Rep
ort
- O
rbC
AD
,
OrbCAD Service Delays Process Review (20-06)
5
Appendix A: Swiftly vs. OrbCAD Comparison
Swiftly vs. OrbCAD # Factor Swiftly OrbCAD
1 Arrival Vs. Departure Departures Only Departures Only ***
2 Selecting an official departure time Extrapolates from multiple GPS pings for a more precise estimate of exact departure
Chooses the first GPS ping outside of stop radius of 100,250,500 feet diameter
4 Processing No post-processing Post-processed to remove false exceptions due to GPS location every 30 seconds and departure radius meters' applied.
5 End of Line Arrival before scheduled time
Counts as an early trip in OTP calculations Uses departures only, so early arrivals ignored
For routes 801 and 803, OTP is captured on arrival time by OrbCAD, instead of departures times for all other routes.
3.2.a
Packet Pg. 25
Att
ach
men
t: 2
0-06
Orb
CA
D S
ervi
ce D
elay
s P
roce
ss R
evie
w 6
-8-2
020
(46
18 :
Au
dit
Rep
ort
- O
rbC
AD
,
OrbCAD Service Delays Process Review (20-06)
6
Appendix B – OTP Reporting Process Flowchart
3.2.a
Packet Pg. 26
Att
ach
men
t: 2
0-06
Orb
CA
D S
ervi
ce D
elay
s P
roce
ss R
evie
w 6
-8-2
020
(46
18 :
Au
dit
Rep
ort
- O
rbC
AD
,
OrbCAD Service Delays Process Review (20-06)
7
Appendix C: Top 10 Codes Used from December 2019 to January 2020
3.2.a
Packet Pg. 27
Att
ach
men
t: 2
0-06
Orb
CA
D S
ervi
ce D
elay
s P
roce
ss R
evie
w 6
-8-2
020
(46
18 :
Au
dit
Rep
ort
- O
rbC
AD
,
OrbCAD Service Delays Process Review (20-06)
8
Appendix D: OTP – Swiftly vs. OrbCAD on High-Frequency Routes
Note: Differences between Swiftly and OrbCAD are expected since Swiftly captures GPS location every 10 seconds versus OrbCAD's every 30 seconds. Additional reasons for differences can be found in Appendix A. *** Route 801 and 803, OTP is captured on arrival time by OrbCAD, instead of departure times for all other routes.
3.2.a
Packet Pg. 28
Att
ach
men
t: 2
0-06
Orb
CA
D S
ervi
ce D
elay
s P
roce
ss R
evie
w 6
-8-2
020
(46
18 :
Au
dit
Rep
ort
- O
rbC
AD
,
Capital Metropolitan Transportation Authority MEETING DATE: 06/15/2020
Board of Directors (ID # 4619)
Audit Report - Semi-annual Follow-up on Prior Recommendations
Page 1
TITLE: Audit Report - Semi-annual Follow-up on Prior Recommendations
3.3
Packet Pg. 29
SEMI-ANNUAL FOLLOW-UP ON AUDIT RECOMMENDATIONS – May 2020 (20-07) Terry Follmer, VP of Internal Audit
Distribution List: Capital Metro Board of Directors Randy Clarke, President and CEO Kerri Butcher, EVP, Chief Counsel & Chief of Staff Donna Simmons, EVP, Administration & EEO Officer Reinet Marneweck, EVP, Chief Financial Officer Dottie Watkins, Chief Customer Officer/Chief Operating Officer Sharmila Mukherjee, EVP, Planning & Developments David Dech, VP, Rail Operations Ken Cartwright, VP, Capital Projects Jane Schroter, VP, Chief Information Officer Shanea Davis, VP, Real Estate, Property & Asset Management Chad Ballentine, VP, Demand Response & Innovative Mobility Brian Carter, VP, Marketing & Communications Gardner Tabon, VP, Safety, Risk Management, & Accessible Services Tangee Mobley, VP, Bus Operations & Maintenance Muhammad Abdullah, Senior Director/Chief of Procurement & Compliance Officer Susan Renshaw, Controller Muriel Friday, Director of Rail Operations Rafael Villarreal Jr., Director of Contract Oversight-Bus Andrew Murphy, Director, Vehicle Maintenance Darryl Jamail, Director of Security & Emergency Management
INTERNAL AUDIT REPORT 20-07 | June 8, 2020
3.3.a
Packet Pg. 30
Att
ach
men
t: 2
0-07
Sem
i-A
nn
ual
-Im
ple
men
tati
on
-Sta
tus-
Rep
ort
6-8
-202
0 (
4619
: A
ud
it R
epo
rt -
Sem
i-an
nu
al F
ollo
w-u
p o
n P
rio
r
Semi-Annual Follow-up on Audit Recommendations – May 2020
1
Executive Summary As part of our annual Audit Plan approved by the Capital Metro Board, we conducted the semi-annual status review of all open audit recommendations as of May 31, 2020. The follow up included eight audit reports with a total of 35 outstanding recommendations. The audit objective and conclusion on the implementation of the corrective action plans follows.
Audit Objective & Scope The objective of the audit was to determine whether Management has successfully implemented action plans in response to the recommendations provided in internal audit reports. In order to monitor the disposition of audit recommendations, the Internal Audit Department conducts two follow-up audits (semi-annual) per fiscal year (May and November). This Report reflects the status as of May 31, 2020, for the outstanding Corrective Action Plans (CAP's) resulting from internal audits projects.
Conclusion on Corrective Action Plans We followed up on 35 recommendations from eight different audit reports and have concluded that only 18 recommendations remain open and Management has action plans to implement the items listed as "In Process of Being Implemented". Table 1 listed below provides a summary breakdown of audit reports with open recommendations as of May 31, 2020.
19-07 8/14/2019 Capital Project Expenditure Controls
4 2 2 0 50%
19-08 9/30/2019
Commuter Rail Operations- Contract Management & Oversight of Herzog
2 0 2 0 0%
19-09 10/31/2019 Sox Controls Audit 6 2 4 0 33%
20-02 4/24/2020 IT End Point Management 4 0 4 0 0%
20-03 3/9/2020 OrbCAD Incident/Accident Process Review
3 0 3 0 0%
TOTAL: 35 17 18 0 49%
3.3.a
Packet Pg. 31
Att
ach
men
t: 2
0-07
Sem
i-A
nn
ual
-Im
ple
men
tati
on
-Sta
tus-
Rep
ort
6-8
-202
0 (
4619
: A
ud
it R
epo
rt -
Sem
i-an
nu
al F
ollo
w-u
p o
n P
rio
r
Semi-Annual Follow-up on Audit Recommendations – May 2020
2
In our opinion, Management has made reasonable progress in implementing the recommendations and open Corrective Action Plans. Additional details related to all open recommendations can be found in Appendix A.
This audit was conducted by the following staff members in the Capital Metro Internal Audit Department:
Jeannette Lepe, Internal Auditor II (Project Lead) Sarah Daigle, Internal Auditor II Terry Follmer, VP of Internal Audit
We want to thank Management for their support and good progress in implementing the open corrective action plans.
3.3.a
Packet Pg. 32
Att
ach
men
t: 2
0-07
Sem
i-A
nn
ual
-Im
ple
men
tati
on
-Sta
tus-
Rep
ort
6-8
-202
0 (
4619
: A
ud
it R
epo
rt -
Sem
i-an
nu
al F
ollo
w-u
p o
n P
rio
r
Semi-Annual Follow-up on Audit Recommendations – May 2020
3
APPENDIX A – DETAILS OF OPEN AUDIT RECOMMENDATIONS Prior Recommendations and Audit Results
As required by the Institute of Internal Auditors' International Professional Practices Framework, we have reviewed all open audit recommendations. Based on our review of eight audits, we identified 18 open recommendations. Listed below are the open recommendations, along with the name of the audit report, report date, original recommendation, and Management's updated target completion date and comments. 19-01 COMMUTER RAIL – DMU MAINTENANCE PROGRAM, OVERSIGHT OF HERZOG (12/11/2018 Report Issued with 7 Recommendations)
RECOMMENDATION 3 – (Compliance with Contract Monitoring Plan): The Director of Rail Operations will implement the following CMP improvements:
c) Develop Rail Operation Policies and Procedures that are specific to the Herzog contract covering: quality performance review and sampling requirements; preventive maintenance and DMU overhauls; asset management and recordkeeping including part costs in accordance with the contract; safety; invoice certification; and how to use the Audit Inspection Report.
OPEN ACTION PLANS: (David Dech – VP Rail Operations) Management agreed with the recommendations above.
• Management's Updated Target Completion Date & Comments: 10/31/2020 Management is in the process of updating department policies.
RECOMMENDATION 5 – (Contractor Staffing Changes & Reporting): The VP of Rail will work with Herzog to achieve the following staff reporting changes:
b) Herzog will submit staffing changes in real time directly to the IT Service Desk, Security, and Rail Operations. An IT Access Request form will be submitted for any new hires, terminations, or requested access changes to systems.
OPEN ACTION PLANS: (David Dech – VP Rail Operations) Management agreed with the
recommendation above.
• Management’s Updated Target Completion Date & Comments: 10/31/2020 Management is in the process of ensuring IT Requests are made timely from receiving the termination notice from Herzog.
19-05 GENFARE CASH AND TICKET CONTROLS AUDIT (4/5/2019 Report Issued with 5 Recommendations)
Semi-Annual Follow-up on Audit Recommendations – May 2020
4
RECOMMENDATION 2 – (Compare Genfare Ticket Sales to Cash): The Controller and Manager of Revenue should consider the following:
a) Developing written standard operating procedures (SOP) covering the reconciliation and variance analysis related to farebox tickets and cash.
b) The SOP should state the cadence as to how often the review is performed as well as establish tolerance levels to identify outliers.
c) Ticket to cash variances outsides tolerance levels are researched with action plans to remediate as applicable.
OPEN ACTION PLANS: (Susan Renshaw – Controller) Management agreed with the recommendations above.
• Management's Updated Target Completion Date & Comments: 12/31/2020 Management has hired a consultant who is working on the procedures.
19-07 CAPITAL PROJECT EXPENDITURE CONTROLS AUDIT (8/14/2019 Report Issued with 4 Recommendations)
RECOMMENDATION 1 – (Lack of Criteria and Required Approvals for Project Changes): The VP of Capital Projects should develop the following internal control enhancements:
a) The Capital Projects Department and the Authority as such should adopt the formalized policy on when PM's need to obtain Steering Committee approval that is being developed as part of the EPPM tool. This should include the implementation of a formal EPPM Steering Committee charter.
OPEN ACTION PLANS: (Ken Cartwright – VP of Capital Projects) Management agreed
with the recommendation above.
• Management's Updated Target Completion Date & Comments: 6/30/20
Management has drafted a formal charter for the agency and is scheduled for
review and approval.
RECOMMENDATION 4 – (Lack of Current Formalized Policies & Procedures): The VP of Capital Projects should develop the following internal control enhancements:
a) Develop formalized policies and checklists for the department's key controls, add these to the Capital Metro Capital Projects Group Policies and Procedures guide, and provide the guide to department staff.
OPEN ACTION PLANS: (Ken Cartwright – VP of Capital Projects) Management agreed
with the recommendation above.
• Management's Updated Target Completion Date & Comments: 08/31/20 Management is in the process of updating policies, checklists, and procedure guides.
Semi-Annual Follow-up on Audit Recommendations – May 2020
5
19-08 Commuter Rail Operations - Contract Management & Oversight of Herzog (09/30/2019 Report Issued with 2 Recommendations)
RECOMMENDATION 1 – (Herzog Did Not Submit All CDRL's and PDC's Were Not Enforced): The VP of Rail should develop the following internal control enhancements:
a) Ensure contractually required CDRL's are properly reviewed and appropriate incentives/disincentives are taken from Herzog's monthly fixed price invoice.
b) Ensure the content of each CDRL is clearly defined in future contract modifications and as part of the contract update evaluate the list of CDRL's to determine the need and required frequency.
OPEN ACTION PLANS: (David Deck – VP of Rail) Management agreed with the recommendations above.
• Management's Updated Target Completion Date and Comments: 10/31/2020 Management has completed the modification and is waiting on Procurement to complete.
RECOMMENDATION 2 – (Improve Monitoring and Oversight of CDRL Documents): The VP of Rail should develop the following internal control enhancements:
a) Document the CDRL status in the CMP tracking spreadsheet to evidence that staff opened and reviewed CDRL reports. Staff should document red flags (e.g. incorrect reports, late submissions, and deadline extensions they give Herzog to submit late reports, etc.) in this column so that Management can monitor performance over time.
b) Review all CDRL's that are listed as NTP submitted once at the beginning of the contract and require updates for any changes and periodic review and updates as required by regulations.
Open Action Plans: (David Deck- VP Of Rail) Management agreed with the recommendations above:
• Management's Updated Target Completion Date and Comments: 10/31/2020 Management is waiting for the modification to get fully implemented to ensure CDRLS and PDC's are applied according to contract.
19-09 SOX Controls Audit (10/31/2019 Report Issued with 6 Recommendations)
RECOMMENDATION 1 – (Add Late Fees & Interest to Contract Terms & Invoices)
a) The CFO and Chief Counsel should consider modifying the standard terms
Semi-Annual Follow-up on Audit Recommendations – May 2020
6
and conditions listed in contracts and on invoices to include a statement that allows late fees and interest to be charged by Capital Metro on delinquent accounts.
OPEN ACTION PLANS: (Susan Renshaw, Controller) Management agreed with the recommendation above.
• Management's Updated Target Completion Date and Comments: 6/30/20 Management is working with legal to update invoice and contract language to allow late fees and interest.
RECOMMENDATION 3 – (Cross Check Monthly Billing Totals to Source Records) The Controller and Accounting Manager should review the monthly revenue reporting and reconciliation process to source systems/records, and opportunities to improved communication as follows:
a) Right of Way & RWIC – The Finance Department should provide a monthly report of all Right of Way billings to the Real Estate and Rail Departments. Additionally, Real Estate department should provide CLS access to the Finance Department so that the system totals can be reconciled by both departments.
b) Marketing & Advertising – The Finance Department should provide a monthly report of all billings to the Marketing Department.
c) Bulk Ticket Sales - ODR invoices created by the A/R Specialist should be reconciled to the ODR Excel Spreadsheet maintained by the Revenue Accountant.
OPEN ACTION PLANS: (Susan Renshaw, Controller) Management agreed with the recommendation above.
• Management's Updated Target Completion Date and Comments: 6/30/20 Management is working on obtaining access to the CLS System to complete the monthly reconciliations.
RECOMMENDATION 5 – (Update Advertising Policy for Discounts)
a) The VP of Marketing should update the advertising policy to include discounts for-profit organizations, and identify the necessary executive approvals (e.g. CFO, President, Chief Counsel) from outside the Marketing Department for these advertising discount exceptions.
OPEN ACTION PLANS: (Brian Carter, VP of Marketing) Management agreed with the recommendation above.
• Management's Updated Target Completion Date and Comments: 10/31/20 Management is working on updating the advertising policy for discounts.
RECOMMENDATION 6 – (Extra RWIC Hours Should be Billed in CLS Systems)
3.3.a
Packet Pg. 36
Att
ach
men
t: 2
0-07
Sem
i-A
nn
ual
-Im
ple
men
tati
on
-Sta
tus-
Rep
ort
6-8
-202
0 (
4619
: A
ud
it R
epo
rt -
Sem
i-an
nu
al F
ollo
w-u
p o
n P
rio
r
Semi-Annual Follow-up on Audit Recommendations – May 2020
7
a) The VP of Real Estate, Property and Asset Management should work with Rail Operations to establish monthly reconciliation procedures to ensure all RWIC charges are billed in 8 and 10 hour increments and entered into the CLS System by Real Estate rather than the current manual billings performed by Finance in the AX System.
OPEN ACTION PLANS: (Shanae Davis, VP of Real Estate, Property, and Asset Management) Management agreed with the recommendation above.
• Management's Updated Target Completion Date and Comments: 10/31/20 Management is working on establishing monthly reconciliation procedures.
20-02 IT End Point Management (04/24/2020 Report Issued with 4 Recommendations)
RECOMMENDATION 1 – (Explore Enhanced System Management Software Solutions) a) The Director of Network Services should explore on a cost-benefit basis other
system management software solutions (e.g. IBM BigFix, etc.) that will enable the identification and deployment of patches based upon severity rating as well as improved capabilities on non-Microsoft operating systems (e.g. UNIX, Mac iOS, etc.).
OPEN ACTION PLANS: (Steven Salinas, Director of Network) Management agreed with the recommendation above.
• Management's Updated Target Completion Date and Comments: N/A – This action plan is not due until 7/31/2020
RECOMMENDATION 2 – (Update IT Policies & Procedures)
a) The Director of Network Services to complete the updates to IT policies and
procedures.
OPEN ACTION PLANS: (Steven Salinas, Director of Network) Management agreed with the recommendation above.
• Management's Updated Target Completion Date and Comments: N/A-This action plan is not due until 8/31/2020
RECOMMENDATION 3 – (Leverage Data Analytics Across EndPoint Management Tools)
a) The Director of Network Services should carry forward the Microsoft Power
Query data analytics tool and run the analysis on at least a quarterly basis to identify the highest risk machines. The highest risk machines should be identified, located and remediated on at least a quarterly basis.
Semi-Annual Follow-up on Audit Recommendations – May 2020
8
OPEN ACTION PLANS: (Steven Salinas, Director of Network) Management agreed with the recommendation above.
• Management's Updated Target Completion Date and Comments: N/A – This action plan is not due until 7/31/2020
RECOMMENDATION 4 – (Define Patching Timeliness by Patch Severity Rating) a) The Director of Network Services will further define patch management
standards based upon the manufacturer's severity rating standards (e.g. Critical; High; Medium; and Low) and clearly state the maximum number of elapsed days from the patch release date for installation. The IT Department will measure compliance with the patch management standards at least quarterly, and machines out of tolerance will be identified and remediated.
OPEN ACTION PLANS: (Steven Salinas, Director of Network) Management agreed with the recommendation above.
• Management's Updated Target Completion Date and Comments: N/A – This action plan is not due until 5/31/2020.
20-03 OrbCAD Incident/Accident Process Review (03/09/2020 Report Issued with 3 Recommendations)
RECOMMENDATION 1 – (Disconnected Systems & No Comprehensive Database) The Director of Contract Oversight, IT Director of Transit Technology Systems and the Director of Risk Management will consider the following improvements:
a) Establishing a single comprehensive database for all incident/accident data.
b) Require MV to enter all data into the chosen single comprehensive database.
c) Automate the flow of data from OrbCAD into the required Excel templates (e.g., Operator Report, Supervisor Report, etc.) that are saved to Sharepoint, thus requiring the Supervisor to only record new data and not have to rekey all data that is already captured in OrbCAD.
OPEN ACTION PLANS: (Rafael Villareal, Director of Contract Oversight) Management agreed with the recommendation above.
• Management's Updated Target Completion Date and Comments: N/A – This action plan is not due until 9/30/21.
RECOMMENDATION 2 – (Improve QA Oversight, Analysis and Monitoring) The Director of Contract Oversight, IT Director of Transit Technology Systems, and the Director of Risk Management should consider and evaluate the following process improvements:
Semi-Annual Follow-up on Audit Recommendations – May 2020
9
a) Establishing a single comprehensive database for all incident/accident data.
b) Require MV to enter all data into the chosen single comprehensive database.
c) Automate the flow of data from OrbCAD into the required Excel templates (e.g., Operator Report, Supervisor Report, etc.) that are saved to Sharepoint, thus requiring the Supervisor to only record new data and not have to rekey all data that is already captured in OrbCAD.
OPEN ACTION PLANS: (Rafael Villareal, Director of Contract Oversight) Management agreed with the recommendation above.
• Management's Updated Target Completion Date and Comments: N/A – This action plan is not due until 7/31/20.
RECOMMENDATION 3 – (Automate Reporting Out of Systems) The Director of Contract Oversight, IT Director Transit Technology Systems and the Director of Risk Management, should consider and evaluate the following improvements:
a) Request the IT Departments Report Writing Team to develop required pre-printed reports (e.g., monthly reports as well as daily Operator/Supervisor Reports, etc.) out of OrbCAD and/or RiskMaster based upon which system is designated the system of record with all comprehensive data.
b) Review for additional monitoring needs (i.e., Capital Metro and MV) and develop additional reports as necessary to improve MV oversight and improve efficiencies.
c) Ensure that the original Incident # automatically assigned by the OrbCAD system is properly captured in other reports and systems for appropriate tracking purposes
OPEN ACTION PLANS: (Rafael Villareal, Director of Contract Oversight) Management agreed with the recommendation above.
• Management's Updated Target Completion Date and Comments: N/A – This action plan is not due until 9/30/21.
