OSAE - REPORT
May 13, 2005
Honorable John Garamendi
California Department of Insurance
Office of the Commissioner
300 Capitol Mall, Suite 1500
Sacramento, CA 95814
Dear Commissioner Garamendi:
Final Report—Conservation and Liquidation Office 2004 Internal Control
Enclosed is our report on the Conservation and Liquidation Office’s (CLO) internal control as of July 21, 2004, and as of March 31, 2003 for information technology controls. The Department of Finance, Office of State Audits and Evaluations performed this examination in order to provide the CLO with information as to whether controls are established and functioning as intended, as well as provide CLO management with opportunities to correct identified weaknesses and improve its operations.
The enclosed report is for your information and use. Your responses along with our evaluations are incorporated into the body of the report.
We appreciate the assistance and cooperation of CLO staff and management during our review. If you have any questions regarding this report, please contact Susan Botkin, Manager, or Cheryl Lyon or Becky McAllister, Supervisors, at (916) 322-2985.
Sincerely,
Samuel E. Hull, Chief
Office of State Audits and Evaluations
Enclosure
cc: Mr. Richard D. Baum, Chief Deputy Director, California Department of Insurance
Mr. Hulen McMinn, Chief, Ethics and Operational Compliance Office, California Department of Insurance
Mr. David E. Wilson, Chief Executive Officer, Conservation and Liquidation Office
Mr. Fred Buck, Special Deputy Insurance Commissioner
Mr. Steve Backe, Chief Information Officer, Conservation and Liquidation Office
Ms. Regina Alava, Vice President of Finance, Conservation and Liquidation Office
Ms. Lilianna Watt, Accounting Manager, Conservation and Liquidation Office
ICC: BOTKIN, C/F, LYON, MCALLISTER, STACY, DIMACHKIE, LEE, JENKINSON,
WILLIAMS, XIONG, LE
I:\OSAE\Reference\Final Reports\Internal Control\Final CLO IC July 2004.doc
Addresses for cc's:
Mr. Richard D. Baum, Chief Deputy Director
California Department of Insurance
45 Fremont Street, 23rd Floor
San Francisco, CA 94105
Mr. Hulen McMinn, Chief
California Department of Insurance
Ethics and Operational Compliance
300 Capitol Mall, Suite 1300
Sacramento, CA 95814
Mr. David Wilson, Chief Executive Officer
Conservation and Liquidation Office
425 Market Street, 23rd Floor
San Francisco, CA 94105
Mr. Fred Buck, Special Deputy Insurance Commissioner
Conservation and Liquidation Office
425 Market Street, 23rd Floor
San Francisco, CA 94105
Mr. Steve Backe, Acting Chief Executive Officer
Conservation and Liquidation Office
425 Market Street, 23rd Floor
San Francisco, CA 94105
Ms. Regina Alava, Vice President of Finance
Conservation and Liquidation Office
425 Market Street, 23rd Floor
San Francisco, CA 94105
Ms. Lilianna Watt, Accounting Manager
Conservation and Liquidation Office
425 Market Street, 23rd Floor
San Francisco, CA 94105
AN INTERNAL CONTROL REVIEW
Conservation and Liquidation Office
Prepared By:
Office of State Audits and Evaluations
Department of Finance
040845125 July 2004
TABLE OF CONTENTS
Preface iii
Executive Summary v
Independent Auditor's Report 1
Findings, Recommendations, CLO Responses, and Our Evaluation of Responses 3
Conclusion 51
Appendix A: Summary of Prior Audit Findings 52
Appendix B: Report Linking Table 83
CLO Response 85
Evaluation of Response 89
PREFACE
The California Department of Insurance (Department) takes a leading role to conserve, rehabilitate, or liquidate licensed California financially distressed and insolvent insurance companies under appointment by the Superior Courts, thereby helping to secure consumer interests and provide for a stable, consistent insurance market.
The Conservation and Liquidation Office (CLO), created in 1994 to be the successor of the Conservation and Liquidation Division of the Department, is appointed by the Commissioner to oversee the affairs of financially impaired insurance companies that are domiciled in California. Financially impaired insurance companies are usually subject to a period of court supervised conservation under CLO administration. During this time, the CLO, along with the regulators, explore opportunities for rehabilitation. Financially distressed life insurance companies are frequently conserved, with policyholder liabilities and related invested assets transferred to a third party acquirer. However, for the vast majority of financially distressed property and casualty insurance companies, the companies will not be conserved, but liquidated.
For companies liquidated, the Commissioner, acting through the CLO, assumes title of the company’s assets. The insurance company offices are closed, all outstanding policies are cancelled, and the process of obtaining and liquidating the company's remaining assets begins. The books and records of the company are acquired by the CLO for use during this process. The goal of liquidation is to apply the money acquired from liquidating the company's assets toward the company's debts and outstanding insurance claims. Upon issuance of a liquidation order, the CLO issues a notice to all interested parties, including the company's policyholders, creditors, and shareholders. The notice requests proofs of claim to be filed with the CLO in order to participate in a distribution of the assets. The costs of the CLO administration are borne by the estate of the insolvent entity. For estates with no assets, the California Insurance Fund supplements the costs. The process of conservation and subsequent liquidation can take several years.
The Commissioner, under California Insurance Code Section 1060 is required to transmit an annual report of information on the companies under his purview to the Governor. As of July 2004, approximately 192 estates of conserved or liquidated insurers are subject to the oversight of the CLO. These estates include those for which the Commissioner is fully responsible; those for which the Commissioner is partially responsible; those for which the Commissioner has custodial responsibilities; and those for which the Commissioner is fully responsible, but are operated separately, such as Golden Eagle Insurance Company. Additionally, since March 2003, the CLO has closed approximately 30 estates which included the distribution of approximately $1 billion.
Management is responsible for the establishment and maintenance of internal and administrative controls. These controls are defined as a process to provide reasonable assurance regarding the achievement of objectives in the following categories: (a) reliability of financial reporting; (b) effectiveness and efficiency of operations; and (c) compliance with applicable laws and regulations. This definition includes five interrelated components:
Control Environment sets the tone of an organization, influencing the control consciousness of its staff. It is the foundation for all other components of internal control, providing discipline and structure.
Risk Assessment is the entity’s identification and analysis of relevant risks to achievement of its objectives, forming a basis for determining how the risks should be managed.
Control Activities are the policies and procedures that help ensure management directives are carried out.
Information and Communication are the identification, capture, and exchange of information in a form and time frame that enable staff to carry out their responsibilities.
Monitoring is the process that assesses the quality of internal control performance over time.
The objectives of our internal control examination were to: (1) determine whether the CLO’s internal control provides accurate financial reporting and effective control over receipts, expenditures, assets, and liabilities; (2) assess programmatic controls over the CLO’s financing, lending, and insurance activities; and (3) report observations and develop recommendations for improving the CLO’s internal control. This report presents the results of our review.
At the time of our audit, the Department of Insurance’s internal audit unit was conducting a review of the CLO’s estate seizure process. Therefore, we omitted this cycle from our review.
This report is intended for the information and use of the Department and CLO management and should not be used for any other purpose. However, the report is a matter of public record and its distribution is not limited.
STAFF:
Susan M. Botkin, CGFM
Manager
Cheryl L. Lyon, CPA
Rebecca Grace McAllister, CPA
Supervisors
Zachary Stacy Kylie Le
Maher Dimachkie Becky Swol
Rebecca Lee Dennis Solheim
Dan Jenkinson Ben Gim Chin, CPA
Dennis Williams Steven McRoberts
Mai Xiong
EXECUTIVE SUMMARY
We performed an internal control examination of the Conservation and Liquidation Office (CLO) as of July 21, 2004 and as of March 31, 2003 for information technology controls. Our objectives were to determine whether the CLO’s internal control provides accurate financial reporting and effective control over receipts, expenditures, assets, and liabilities; assess programmatic controls over the CLO’s financing, lending, and insurance activities; and report observations and develop recommendations for improving the CLO’s internal control.
During our examination, we identified areas where controls were in place and working as intended, and also identified areas where controls could be improved. We noted control weaknesses related to the CLO’s administration, budgeting, purchasing, fixed assets, information technology, and receivables that we consider material weaknesses. When corrected, these controls will reduce the CLO’s exposure to risk of errors, irregularities, and material misstatements in the financial statements. Our observations are summarized below.
Administration: The CLO’s administration controls are not sufficient to ensure the reliability or integrity of data. We observed undocumented and outdated written policies and procedures and instances of uncorrected prior audit findings. See the Findings and Recommendations section for further analysis.
Budget: The CLO’s controls over its budget functions are not sufficient to ensure the reliability and integrity of data. The CLO has adequate separation of duties, whereas, budgets are developed by management, approved by department heads, and finally reviewed and approved by the Special Deputy Insurance Commissioner. However, we observed noncompliance with documented but outdated policies and procedures, lack of budget monitoring, inadequate evidence of the review and approval process, and noncompliance with budgetary deadlines. See the Findings and Recommendations section for further analysis.
Receivables: The CLO’s receivables controls are not adequate to ensure the reliability and integrity of data. The CLO has adequate separation of duties and timely billings. However, for specific sub-cycles, we observed a lack of methodology for determining allowance for uncollectible receivables, improper posting of receivables to the general ledger, inadequate salvage and subrogation recoverables policies and procedures, inadequate monitoring and collection efforts of outstanding receivables, lack of receivables reconciliations, and inadequate monitoring of other receivables. See the Findings and Recommendations section for further analysis.
Cash Receipts: The CLO’s cash receipts controls appear adequate to ensure the reliability and integrity of data. We observed adequate separation of duties, adequate safeguards and control of cash receipts, and timely deposits. However, policies and procedures are not sufficiently documented. See the Findings and Recommendations section for further analysis.
Investments: The CLO’s investments controls appear adequate to ensure the reliability and integrity of data. The CLO has adequate separation of duties, clearly defined investment guidelines, use of Investment Managers, and sufficient oversight of investment activity. However, we observed inconsistent documentation and performance of investment reconciliations. See the Findings and Recommendations section for further analysis.
Reinsurance: The CLO’s reinsurance controls appear adequate to ensure the reliability and integrity of data. The CLO has adequate separation of duties, timely billings and account reconciliations. However, we identified improper policy over assumed billings processing, incorrect payment of reinsurance premium, and no evaluation of reinsurance reserves after conservation.
Claims: The CLO’s claims controls appear adequate to ensure the reliability and integrity of data. The CLO has adequate separation of duties; however, policies and procedures are not documented.
Purchasing: The CLO’s purchasing controls are not adequate to ensure assets are properly safeguarded. We observed that purchases appeared justified, reasonable, and included appropriate authorizations. However, we identified inadequate separation of duties, lack of documented policies and procedures, insufficient receiving and payment controls, and no periodic review of open purchase orders. See the Findings and Recommendations section for further analysis.
Contracts: The CLO’s contracting controls are adequate to ensure that contracts are appropriately approved, include sufficient documentation, or ensure that goods/services are received and/or completed within the contract terms. We observed that policies and procedures are documented, and that adequate separation of duties exist. However, we observed a weakness in controls over the CLO’s legal contracts functions. See the Findings and Recommendations section for further analysis.
Cash Disbursements: The CLO’s cash disbursements controls appear adequate to ensure assets are appropriately safeguarded. The CLO has adequate separation of duties; cash disbursement policies and procedures are documented; and blank check stock and the check-signing machine are safeguarded from unauthorized use. However, we observed several weaknesses including insufficient accounts payable procedures, inconsistent research and review of outstanding checks, and improper bank reconciliation procedures. See the Findings and Recommendations section for further analysis.
Personnel/Payroll: The CLO’s controls over the personnel and payroll functions are sufficient to ensure the reliability and integrity of data. However, we observed outdated/undocumented policies and procedures, inadequate separation of duties, and a failure to establish a plan of correction for excessive sick leave balances. See the Findings and Recommendations section for further analysis.
Fixed Assets: The CLO’s fixed asset controls are not sufficient to ensure the appropriate safeguarding of the CLO’s assets or the reliability and integrity of data. We observed a lack of documented policies and procedures, inconsistent tagging procedures, inadequate property disposal controls, incomplete and inaccurate property records, inadequate separation of duties, failure to complete a physical inventory, and failure to reconcile the general ledger with the property ledger. See the Findings and Recommendations section for further analysis.
Seizures: The scope of our review did not include a review of the CLO’s controls over seizures. Please reference the Department of Insurance’s internal audit report for information regarding the CLO’s controls over the estate seizure process.
Distributions (Early Access): The CLO’s distribution (early access) controls appear adequate to ensure the reliability and integrity of data. We observed adequate separation of duties, appropriate authorizations, contractual agreement for reimbursement of overpayments, and accurate disbursement of funds.
Final Close: The CLO’s final close controls appear adequate. The CLO has adequate separation of duties and is in accordance with court ordered distributions. However, we observed noncompliance with documented, outdated policies and procedures, and untimely transfer of estate account balances during the final close process. See the Findings and Recommendations section for further analysis.
Information Technology: As of March 31, 2003, the CLO’s information technology controls were not sufficient to ensure the overall reliability and integrity of data. We observed that policies and procedures are not documented; weaknesses in controls over information technology access controls and service continuity, including the lack of a disaster recovery plan; inadequate separation of duties; failure to review transaction history logs; and undefined profiles for specific user groups. However, we recognize the CLO’s efforts in implementing corrective actions since March 2003 through the end of our fieldwork in July 2004. See the Findings and Recommendations section for further analysis as well as the CLO’s response for discussion of corrective actions implemented to date.
Financial Reporting: The CLO’s financial reporting controls are not sufficient to ensure the reliability and integrity of data. We observed the financial statements and the general ledger do not reconcile, inappropriate exclusion from the financial statements, incomplete financial statements, inconsistent and untimely uploading of new estates’ balances, multiple versions of the financial statements, and lack of documented policies and procedures. See the Findings and Recommendations section for further analysis.
This report is intended to assist CLO management in focusing attention on areas of deficiency, and in strengthening internal control and improving operations.
INDEPENDENT AUDITOR'S REPORT
Honorable John Garamendi
California Department of Insurance
Office of the Commissioner
300 Capitol Mall, Suite 1500
Sacramento, CA 95814
We have examined the effectiveness of the Conservation and Liquidation Office’s (CLO) internal control over financial reporting and safeguarding estates assets as of July 21, 2004 and as of March 31, 2003 for information technology, based on the Committee of Sponsoring Organizations of the Treadway Commission's Internal Control—Integrated Framework guidelines. CLO management is responsible for establishing and maintaining adequate internal control. Our responsibility is to express an opinion on the effectiveness of internal control based on our examination.
Our examination was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants and, accordingly, included obtaining an understanding of the internal control over financial reporting, testing and evaluating the design and operating effectiveness of the internal control, and performing such other procedures as we considered necessary. We believe that our examination provides a reasonable basis for our opinion.
Because of inherent limitations in any internal control, misstatements due to error or fraud may occur and not be detected. Also, projections of any evaluation of the internal control over financial reporting to future periods are subject to the risk that the internal control may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.
In reviewing the CLO’s internal control as of July 21, 2004, and as of March 31, 2003 for information technology, we noted certain matters involving the internal control and its operation that we consider to be material weaknesses. A material weakness is a condition that precludes the entity’s internal control from providing reasonable assurance that material misstatements in the financial statements will be prevented or detected on a timely basis. Specifically, the CLO does not maintain sufficient controls over its administration, budget, purchasing, fixed assets, information technology, and receivables functions. Failure to maintain sufficient controls could adversely affect the CLO’s ability to record, process, summarize, and report financial data and safeguard estate’s assets against loss from theft, unauthorized use, or disposition.
Subsequent to the completion of our fieldwork in July 2004, but prior to the issuance of our draft report, we became aware of events occurring at the CLO that we feel require disclosure. Specifically, during August 1, 2004 through February 1, 2005, key figures within the CLO organization have resigned or have been terminated. These positions, including the Chief Executive Officer and the Chief Financial Officer, represent 34 percent of the CLO organization’s management team. The changes within the CLO have resulted in the reorganization of certain units, elimination of positions, and hiring of new staff. As such, these changes may impact the results of our examination as described within this report.
In our opinion, because of the effect of the material weaknesses described above on the achievement of the objectives of the control criteria, CLO has not maintained effective internal control over financial reporting and safeguarding estates assets as of July 21, 2004, and as of March 31, 2003 for information technology, based on the Committee of Sponsoring Organizations of the Treadway Commission's Internal Control—Integrated Framework guidelines.
This report is intended solely for the information and use of the Department of Insurance and the CLO management and is not intended to be and should not be used by anyone other than the specified parties. However, this report is a matter of public record and its distribution is not limited.
Samuel E. Hull, Chief
Office of State Audits and Evaluations
(916) 322-2985
July 21, 2004
FINDINGS, RECOMMENDATIONS, AND RESPONSES
During our examination of the Conservation and Liquidation Office’s (CLO) internal control over financial reporting and safeguarding estates assets as of July 21, 2004, and as of March 31, 2003 for information technology, we noted that some controls were functioning as intended. However, we also identified areas where controls are either not in place or functioning as intended, and where corrective action is necessary. The following pages detail the weaknesses observed. Those weaknesses are grouped into the following sections:
Section I Insufficient Documentation of Policies and Procedures
Section II Insufficient and Inconsistent Practices
Section III Ineffective Controls
Section IV Information Technology Controls
Appendix A Summary of Prior Audit Findings
Appendix B Report Linking Table
Section I
FINDING I Insufficient Documentation of Policies and Procedures
During our examination, we observed instances where the CLO’s policies and procedures were either undocumented or outdated. Specifically, although the CLO had policies and procedures in place, we identified instances where these policies and procedures were not documented or the documented procedures were inconsistent with current practices. Failure to adequately document and maintain current practices, policies, and procedures increases the risk of inconsistencies and errors within operational processes as well as diminishes the CLO’s training effectiveness should a turnover in staff occur. We identified the following instances of undocumented and/or outdated policies and procedures:
Budgetary Procedures
Documented budgetary procedures were last updated in February 2001 and fail to conform to current practices.
Receivables Policies and Procedures
1. The CLO does not maintain current written policies and procedures governing receivables, premium receivables, salvage and subrogation receivables, or other receivables.
2. The CLO does not maintain a documented methodology or procedures governing the calculation of the allowance for uncollectible receivables. Although there exists a complex diversity between estates and receivable types, the CLO should establish mathematical formulas or baseline parameters for determining what receivables should be deemed uncollectible. We observed instances where staff were using different methodologies to determine uncollectible receivables for the same type of receivables. Additionally, CLO does not have a process in place for management to review or authorize allowances established. Because there are several types of receivable sub-accounts and various analysts overseeing estates, a lack of consistency exists in amounts reported as uncollectible.
3. The CLO does not maintain documented procedures governing the length of time a negative receivable balance remains in the general ledger.
Cash Receipts Procedures
Current procedures for handling cash receipts and bank reconciliations vary from the documented procedures detailed in the CLO Administrative Manual, last updated in February 2001.
Reinsurance Procedures
Documented reinsurance procedures were last updated in 1996, and thus current practices regarding reinsurance and reinsurance billings are not consistent with the written procedures.
Claims Procedures
The CLO does not maintain current written policies and procedures governing the claims process.
Purchasing Procedures
1. Purchases are processed in two separate areas: administration and information technology. Although the administration area has documented procedures, these procedures are not consistently followed. The information technology area does not maintain documented policies and procedures governing purchases. Additionally, no policies are established governing the receipt of goods for either area. Further, current practices are not consistent among the administration and information technology areas.
2. The CLO does not maintain policies and procedures governing employee use of the CLO credit card.
Personnel and Payroll Policies and Procedures
The CLO does not maintain current written policies and procedures governing the personnel or payroll functions. The CLO last updated the payroll procedures in February 2001, and current practices are not consistent with the documented procedures.
Fixed Assets Procedures
The CLO does not maintain adequate policies and procedures governing the fixed assets functions. The fixed asset functions are split between the information technology unit and the administration unit. Neither unit maintains written procedures. Further, policies and procedures are not consistent between the units. Additionally, the CLO does not maintain policies regarding fixed assets tagging, physical inventory, acquisitions and disposals, or the reconciliation of the property ledgers with the general ledger.
Estate Final Close Procedures
The CLO Accounting Department Desktop Procedures Manual for the final close process was last updated in February 2001, and current practices differ from the documented procedures. Further, the CLO does not maintain policies and procedures regarding the final close processing of rehabilitated estates or those that are ancillary in nature.
Financial Reporting Procedures
1. The CLO does not maintain written procedures governing the compilation of information for the Department of Insurance’s Annual Report to the Governor. Specifically, the CLO is responsible for providing information to the Department of Insurance detailing the names of the persons proceeded against; whether such persons have resumed business, have been liquidated, or have been mutualized; and such other facts that will acquaint the Governor, the policyholders, creditors, shareholders, and the public with the proceedings. The CLO transmits this information to the Department of Insurance in July of the subsequent calendar year. The Insurance Commissioner is then responsible for preparing and submitting the report to the Governor.
2. While the CLO maintains current policies and procedures governing the preparation of the CLO financial statements, including the preparation and processing of top level adjustments and reclassifications, the written policies and procedures do not explain the rationale for several of the reclassifications (for example, reclass of subrogation recoveries, and ELIC reclass of secured liabilities and unclaimed funds, etc.). Further, the CLO has elected to report based on the modified-cash basis of accounting which is another comprehensive basis of accounting; however, the CLO’s definition/interpretation of this method is not documented.
This is a recurring condition from a prior audit. See Appendix A.
Recommendations: 1. Ensure all operational processes and procedures are appropriately documented, revised periodically, and maintained in a centralized manual.
CLO Response: A Process Analyst was employed in November 2003 by the CLO to coordinate the enforcement of standards, provide version control, gain approvals and publish policies and procedures for the entire organization. All CLO policies and procedures filter though the Process Analyst for adherence to the CLO’s document control standards and are filed in a central location. Every policy and procedure kept in this file will be properly reviewed, approved and identified for version control.
As of January 2005, global Document Control Policies were developed to control the format, content and approval levels of managing the policy and procedures at the CLO. These were approved by the Executive team on February 28, 2005 in preparation for an organization-wide effort to update existing procedures.
Any revisions to policies and procedures will be tracked by the Process Analyst and revised or obsolete procedures will be maintained in archival files. For example, on August 18, 2004, the Policies and Procedures governing distributions were published. The first revision to these policies was suggested in February 2005. When approved, the August 18th version will be stored in the archival file and the new distribution policy and procedure will be published and kept in the current file.
The Claims department is in the process of updating the Claims Department Policies and Procedures Manual and a final draft is scheduled for publication by the end of June 2005.
The Estate Trust department began writing the department-level policy and procedures and updating seizure policies and procedures in November 2004. Final versions of these policies and procedures are scheduled by the end of December 2005.
The Accounting department began writing The Accounting/Finance policies and procedures to replace the February 2001 Desktop Procedures Manual in February 2005. Procedures relating to the budget, receivables, cash receipts, financial reporting and estate closings will be updated in this process. These will be completed by the end of December 2005.
The Human Resource department began writing a Supervisor’s Handbook in November 2004 and will begin updating the existing department-level policies and procedures in March 2005. Procedures governing payroll and personnel functions will be updated to reflect current law and practices. A final draft of the department-level policies and procedures coordinated with the Supervisor’s Handbook will be completed by the end of December 2005.
The Administration, IT and Reinsurance departments will begin updating department-level policies and procedures in March 2005 and complete by the end of December 2005. In addition to the overall updates, specific functions to be addressed include: Administration will write the purchasing and fixed asset procedures, IT will address the items noted in Finding IVa and Reinsurance will update the1996 procedures.
All policies and procedures noted above will be formally approved and published within a reasonable time after the dates noted for final draft. Published policies and procedures will be posted to the Intranet and source documents will be secured on a network drive. Department managers and supervisors are responsible to ensure policies and procedures are followed and updated on a timely basis.
Evaluation of Response: The CLO states that a Process Analyst was employed in November 2003 to coordinate the enforcement of standards, provide version control, gain approvals and publish policies and procedures for the entire organization. During our internal control fieldwork conducted between June 7, 2004 and July 21, 2004, we were never informed that such a position existed nor were we provided any information regarding the status of the compilation.
We commend the CLO on its efforts to establish timeframes for the development and update of its policies and procedures.
2. Define and document the CLO’s interpretation of the modified-cash basis of accounting. Ensure that accounts selected for accrual are identified and policies consistently followed.
CLO Response: By August 2005, CLO’s interpretation of modified-cash/liquidation accounting will be defined in detail in a document which will be included in the Accounting Department’s Policies and procedures. This document will be in the form of a spreadsheet matrix with Income and Expense categories and Payable and Receivable accounts identified and mapped to the CLO’s chart of accounts template. The proper treatment for the accounts will be described to relay the interpretation of the CLO’s modified cash basis within the context of accounting requirements for entities in liquidation/receivership.
In general, the CLO records expenses in the period which they are paid for direct and indirect estate expenses. Certain Accounts Payable accruals are made at month-end for activity that has transpired and/or been billed but which has not completed the payment approval process. Income is generally recorded in the period it is received. However, cash received for pre-conservation/liquidation date receivables is applied against receivables instead of revenue. Post-conservation/liquidation Accounts Receivables are recorded as they are billed. Federal income taxes are estimated and accrued for certain entities as required in a tax sharing agreement or for inclusion in a non-CLO entity return.
Evaluation of Response: We encourage the CLO to determine the basis of accounting and financial presentation to apply to its operations. We also encourage the CLO to define and consistently apply this basis throughout its operations of seizing and rehabilitating and/or liquidating entities.
Section II
Insufficient and Inconsistent Practices
During our review, we observed instances where the CLO does not have controls developed or in place, thus, limiting the CLO’s ability to timely detect and correct errors or misstatements and increasing the risk of inaccurate and inconsistent financial reporting. Specifically, we observed the following:
FINDING IIa Weak Accounting Practices
We identified the following instances of weak accounting practices over CLO operations:
Weaknesses in Accounting for Salvage and Subrogation Recoverable
We identified the following issues during our review of the salvage and subrogation recoverable account:
1. A salvage and subrogation recoverable account (13004) is not established within every estate receiving monies for subrogation recoverable nor is every estate with salvage and subrogation recoverable receivables actively pursued. The CLO claims unit is currently billing for seven estates (Alistar, Fremont, HIH, National Automobile and Casualty Insurance Company, Pacific National Insurance Company, Paula, and Superior National Insurance Companies in Liquidation). Only one of the seven (14 percent) has a receivable account (13004) established. Further, we identified three other estates (Mission National, Enterprise, and Mission Insurance Company) that maintained receivable account (13004) balances within the general ledger but collections were not being actively pursued. Additionally, no reconciliation of claims unit detail with the general ledger is performed, thus increasing the risk of inconsistencies and inaccuracies within the general ledger.
2. Subrogation recoverable deemed uncollectible by the CLO’s senior claims analyst and recorded in the subsidiary ledger are not classified as uncollectible in the general ledger. Inconsistencies with subsidiary ledgers and the general ledger increases the risk of misrepresentation and inaccurate reporting of financial data.
Recommendation: Establish salvage and subrogation accounts receivables for the subrogation recoverable currently being pursued. Additionally, ensure the active collection of receivables outstanding.
CLO Response: Since the first quarter of 2003 the Subrogation Senior Claims Analyst has produced a monthly summary report of all traditional subrogation results on an estate basis. This monthly report clearly shows the additions to the recoverable balance as well as reductions to the account, both as a result of receiving payments and reductions due to negotiated settlements. As of January 2005, Accounting receives a copy of this report on a monthly basis. Accounting will review the report and reconcile it to the balances on the general ledger monthly.
As of March 2005, any items on the general ledger not listed and reconciled with the Claims Department report will be identified and researched by the Financial Analyst responsible for the estate. By July 2005, these balances will either be recommended for write-off by the Chief Claims Officer or assigned to collection by the Claims Department. This true-up process will render the subrogation report the sole source of reconciliation to the general ledger subrogation accounts.
Accounting will continue to track the annuity payments received for Mission estate balances and will be advised by Claims on an individual file basis as commutation settlements are achieved and when to expect funds to be received. Any collections against the original annuity balance will be booked by Accounting as these are received. Final resolution of these accounts will occur in October 2005 to coincide with closure of the Mission entities targeted for the end of 2005.
Evaluation of Response: We concur with the CLO’s response.
Improper Accounting for Receivables
1. The CLO improperly classifies salvage and subrogation recoverable receivables within the general ledger. We tested four estates and found that all four (100 percent) had cash receipts that were posted to the salvage and subrogation recovery revenue account (52003) instead of the receivable account (13004). Although the CLO reported performing a year-end reconciliation of the accounts, the reconciliation performed consisted of netting the revenue account with the receivable account rather than determining if monies received had a receivable previously established. Netting of these accounts results in inappropriately reporting collection of receivables, as well as diminishes the CLO’ s ability to appropriately assess whether outstanding receivables were in fact collected and which require further collection efforts.
2. The CLO improperly classifies collections of premium receivables as a credit to the direct premium account (13006) regardless of where the receivable was initially established. Specifically, premium receivables for HIH America estate are held in the direct premium (13006) and premiums due and deferred accounts (13008). Upon receipt, all moneys are credited to the direct premium account (13006), regardless of where the receivable has been established. As a result, netting of these accounts results in inappropriately reporting collection of receivables, as well as diminishes the CLO’ s ability to appropriately assess whether outstanding receivables were in fact collected and which require further collection efforts.
Recommendation: Ensure collections are appropriately reviewed and posted to the proper account upon receipt. Only monies received for established receivables should be posted to the receivables accounts.
CLO Response: Since the second quarter of 2003, the Senior Claims Analyst and the Premium Collector have regularly reviewed cash receipts on-line by inquiring into the daily check log spreadsheet on the CLO’s shared directory. This shared spreadsheet allows each person at the CLO to review cash received and deposited in order to identify items of interest/urgency and to communicate to the Accounting Department how received cash should be applied.
However, without a reconciliation process to the subsidiary ledger detail, since the beginning of 2003, the Accounting Clerk has followed the procedure of posting all salvage, subrogation and premium receipts to specific revenue accounts when cash is first received ensuring the estate is credited with the cash received in a timely manner. These accounts are treated as suspense accounts and re-classifications occur when the collections are reviewed by the Financial Analyst. These reclassifications from the suspense account to a receivable or revenue account will occur more frequently, on a monthly basis, starting September 2005, when Accounting receives both the Subrogation and Premium collection reports from Claims.
The policy-level detail is handled at the subsidiary level, or in the case of subrogation and premium by the Claims Department. Accounting will record only the summary-level information provided by Claims and will do so by reconciling to the Claims Department reports discussed in the finding above. This will ensure a single and consistent basis for recording these receivables.
Evaluation of Response: We concur with the CLO’s response.
Inconsistent Establishment of Allowance for Uncollectible Receivables Accounts
The CLO does not have an established allowance for uncollectible salvage and subrogation recoverable account. Thus, we identified an allowance of $2.5 million attributed to subrogation recoverable that was booked to the allowance for uncollectible account—accounts receivable account (13017), resulting in a larger account balance when compared to the associated accounts receivable account (13016). Although the CLO indicated that the policy was to combine subrogation recoverable allowances with the accounts receivable allowance account, this practice is not documented and appears inconsistent with the accounting for different types of receivables. For example, the CLO maintains approximately ten receivable accounts. Of those accounts, only four allowance accounts have been established. It is unclear as to the CLO policy as to which receivables are deemed to have allowance accounts established and the treatment of uncollectibles for those receivables without allowance accounts. Inconsistencies within accounting for receivables increase the risk of misrepresentation of financial data.
Recommendation: Establish corresponding allowance for uncollectible receivables accounts for all types of receivables established. Ensure amounts deemed uncollectible are posted to the appropriate account.
CLO Response: The CLO receivables can be categorized in two ways: current and legacy. The current receivables are known, supported and are being actively pursued. These are recorded at net realizable value. The legacy receivables are inherited balances from the books of the estates for which supporting documentation is lacking and collectibility has not yet been determined. An allowance is set for these legacy receivables. Any items determined to be uncollectible items are recommended to management for write-off. These procedures will be incorporated into the Accounting Department policies and procedures by the end of December 2005.
The CLO will continue to treat receivables as noted above because there is no added-value in treating post-conservation receivables in the same manner as a going-concern. Adding allowance accounts in the general ledger for each type of receivable would not further improve controls.
Evaluation of Response: Within the CLO’s accounting records receivables are not readily identified as current or legacy. All receivables are combined into a single account and reported by receivable type; i.e., salvage and subrogation. For a select few receivables, allowance accounts are established. In inquiring as to the CLO’s methodology of establishing allowance accounts, we were not informed that the allowances were based solely on legacy receivables. Additionally, it is not apparent from reviewing the financial reports as to the accounting of specific receivables and which receivables are combined with which allowance accounts. The CLO’s current presentation is confusing and difficult to monitor. While we concur with the CLO that such policies and procedures for the treatment of receivables should be documented and consistently followed, we disagree with the CLO’s presumption that we recommend the receivables should be treated in the same manner as a going concern.
Receivables should be consistently accounted for regardless of whether they are current or legacy. This provides value to the efficiency of monitoring an estate’s receivables as well as presenting a clearer financial picture. If the CLO elects to not account for receivables and allowances consistently, then the treatment of specific receivables should be disclosed in the financial reports.
Weaknesses in Monitoring and Collecting Outstanding Receivables
The CLO does not adequately monitor or actively pursue outstanding receivables in order to ensure their collectability. Specifically, we observed the following:
1. The CLO does not periodically review and analyze outstanding receivables. Therefore, the CLO cannot adequately assess which receivables require additional collection efforts or when collection efforts have been exhausted. Additionally, the CLO does not maintain aging reports nor are alternate methods used to fully report the status of outstanding other receivables (account 13018) or accounts receivables (accounts 13010, 13012, 13016, and 13021). Inadequate review, analysis, and pursuit of outstanding receivables result in the loss of estate assets as well as increase the risk of improperly reporting receivables within the financial records.
2. The CLO does not adequately pursue unclaimed property collections after initial contact. We observed several instances where a collection effort was initiated, but not completed.
a. The Ticor Mortgage Insurance Company estate, closed December 31, 2001, had unclaimed property totaling $10,877 reported by the California State Controller’s Office (SCO) as due to the estate. The CLO completed and returned the claim form to the SCO on September 18, 2002, and was required to send additional information within 90 days for the claim to be processed. The additional information was not submitted, therefore, the CLO did not receive the funds.
b. The ELIC estate other receivables account includes a journal entry dated November 29, 2000, establishing a receivable for $47,466. The receivable is for unclaimed property held by the SCO. The CLO has not followed-up on the claim after the initial filing and therefore, the funds have yet to be collected. Furthermore, we identified an additional $21,749 for unclaimed property that the ELIC estate is also entitled to collect.
Failure by the CLO to pursue the collection of receivables due to the estates results in the loss of estate assets.
Recommendation: 1. Periodically review and analyze outstanding receivables to determine collectability.
CLO Response: The monitoring and collection of outstanding receivables at the CLO occurs in the Reinsurance, Claims and Accounting Departments. Each department has specific procedures for monitoring and collecting receivables particular to their expertise and each department periodically reviews and analyzes the collectability of their receivables according to the procedures for their functions. Accounting is responsible for recording all summary information to the general ledger.
It is important to recognize that the methods used to determine collectabilty of receivables in a liquidation environment differ from methods used in going-concern companies. The aim of the liquidator is to collect the most from these receivables by using the least amount of resources. This cost-benefit analysis over-rides continued collection efforts if it is determined that the resources used to establish a receivable would exceed the amount received in cash. Aging reports are used to write-off certain receivables based on how long they have been outstanding. This methodology would not be conducive related to liquidation because very large and complex receivables often take years to resolve.
Evaluation of Response: Consistent review and analysis of outstanding receivables, in any environment, whether it be going concern or liquidation, requires the monitoring of receivables. The CLO is responsible for safeguarding the estates assets, and ensuring that assets are appropriately disbursed. In this sense, the CLO has a responsibility to collect all eligible receivables in the most cost efficient manner. Establishing processes and procedures to consistently document and monitor the efforts expended on the collection of receivables is a cost efficient practice. The CLO would be able to document its efforts and value when the cost benefit of collection has been exceeded. Additionally, aging reports also could be useful to monitor collection efforts since the receivable age is a factor considered when determining the potential collectability.
Recommendation: 2. Ensure prompt and consistent application of collection actions on delinquent receivables and unclaimed property due to the estates.
CLO Response: The CLO Accounting Department will strengthen the procedure over tracking any unclaimed property listed with the State Controllers Office (SCO) and determine the cost-benefit of pursuing these based on amount. This evaluation will be completed for all open estates by the end of May 2005 and incorporated into the other receivable listing maintained in the Accounting Department.
As noted in the response above, some receivables take years to establish, support and collect. The examples sited in the finding were not pursued further because the SCO requires that the Liquidator provide documentation that the Liquidator does not have access to and couldn’t effectively research without considerable cost to the estate.
By October 2005, the Process Analyst is responsible to ensure that the policies and procedures relating to Reinsurance, Claims and Accounting receivables set out collection guidelines and are consistent with the procedures outlined in the CLO’s responses to the 2004 Internal Control Report and the 2002 Agreed-Upon Procedures Report.
Evaluation of Response: We concur with the CLO that the cost-benefit of pursuing receivables should be considered during the collection process. However, when the CLO determines that it is no longer cost beneficial to pursue a receivable, the efforts should be documented within the receivable file and the associated receivable correspondingly written-off. The issues referenced in our findings pertain to receivables where the collection efforts were begun by the CLO and never concluded. No documentation was included in the files indicating that the cost-benefit of collection had been exceeded nor that the associated receivable was written-off.
Improper Policy over Processing of Assumed Billings
The CLO does not record assumed reinsurance billings within the general ledger upon receipt. Because assumed reinsurance billings are Class 7 claims, the CLO considers these billings unlikely to be paid upon final distribution of the estates' assets. Upon receipt, if the billing amounts are small, the billings are recorded on a manually maintained spreadsheet. For large amounts, the billings are maintained within the CLO’s liquidator claims system, or within an estate’s own database, such as the case for the Mission estate. Although the CLO does not review or evaluate billings received until the CLO determines if monies are available to pay Class 7 claims, the billings received should be properly recorded in the general ledger until determination occurs. The CLO’s policy of not recording assumed billings within the general ledger system results in a misrepresentation of estate's liabilities.
Recommendation: Ensure assumed reinsurance is recorded within the CLO’s general ledger system upon receipt of the billings.
CLO Response: The CLO acknowledges that we do not routinely process the accounts received from ceding companies in connection with contracts of assumed reinsurance. But the CLO does inventory and control all such claims. Assumed reinsurance claims are classified as Class 7 in the statutory distribution scheme and in the majority of liquidations there are insufficient assets to justify a distribution to the Class 7 claimants. Accordingly, the adjudication of Class 7 proofs of claim and the maintenance of the underlying accounting records merely for purposes of presenting a more reliable balance sheet would not be a prudent use of the estates assets which would otherwise be available for distribution to claimants. Therefore, the CLO continues to hold to the position that the recording of ceding company liabilities and the adjudication of the related proofs of claim will only be undertaken in situations where it is apparent that a distribution to Class 7 claimants is probable.
Evaluation of Response: We disagree with the CLO’s response. The CLO has a responsibility to safeguard the estates assets, ensure proper oversight of these assets, and ensure assets are distributed properly. To do so, the CLO has a responsibility to maintain accounting records documenting all the assets and related liabilities of an estate, regardless of the probability of distribution. Additionally, if the CLO does not record assumed billings, the CLO potentially may not adequately track and bill for amounts due under retrocession contracts. Further, transparency in regulatory organizations is not about value but rather providing the public with available information.
No Evaluation of Reinsurance Reserves after Conservation
This is a recurring condition from the Department of Finance’s 2002 Agreed-Upon Procedures Report. Details of the finding and the CLO’s response are documented within that report, which was issued under separate cover.
CLO Response: The statement that “This is a recurring condition” may confuse uninformed readers of this report. Since Department of Finance will issue reports on both this internal control audit and the 2002 Agreed-Upon procedures audit at the same time, they will include this same finding in both audit reports. CLO began evaluation and remediation of all findings upon notification, but CLO does not consider the same finding included in two simultaneously issued reports to be a “recurring condition.” CLO will provide similar responses to this same finding in both reports.
The Reinsurance Department acknowledges that for a number of estates with reinsurance recoveries, the CLO does not maintain reserves for ceded case reserves, ceded LAE, and ceded IBNR, post liquidation. This occurs in certain situations where the legacy reinsurance system is not utilized or is a manual system. The calculation on a manual basis of ceded case reserves and ceded LAE for purposes of balance sheet completeness would be time consuming and costly and for this reason has not been undertaken. Moreover, the development of a ceded IBNR reserve is not feasible in circumstances where a reserve for ceded case reserves and ceded LAE is not being maintained.
The CLO has developed and is in the process of implementing a new reinsurance processing system (GOLD) that is modeled after the Mission reinsurance processing system. This system, which will be implemented on a selective basis will have the capacity to create reinsurance cessions for both case reserves and LAE and will facilitate the development of a ceded reserve for IBNR should this be deemed appropriate.
Evaluation of Response: Per the CLO’s request, we identified the findings that were noted in both the internal control review report and the 2002 Agreed-Upon Procedures Report as a recurring condition.
We commend the CLO’s efforts in implementing the GOLD system in an effort to monitor reinsurance recoverable reserves.
Inadequate Purchase Receiving and Payment Controls
We observed inadequate receiving and payment controls over purchases at the CLO. Specifically, the CLO does not document when goods and/or services are received. No receiving report is maintained, nor are partial deliveries documented. We identified partial shipments for 6 of 20 (30 percent) of purchase orders tested, and found no documentation indicating that payment on the invoice should be for a partial shipment.
Furthermore, purchase orders are not forwarded to the accounts payable unit by either the information technology unit or the administration unit. Additionally, a copy of the purchase order or receiving document is not included with the invoice upon submittal for payment. The accounts payable unit relies solely upon the approval of the invoice by the respective information technology and administration unit managers and does not require and/or maintain supporting documentation such as purchase orders or receiving reports to support invoice payments. Moreover, we identified that the information technology unit manager does not review or compare purchase orders with invoices prior to approval for payment, but bases his authorization upon memory.
Failure to maintain adequate receiving and payment controls for purchases increases the risk of inappropriate payments, unauthorized receipt of purchases, and increases the risk of theft, loss, or misappropriation of assets.
Recommendation: 1. Ensure receiving reports are maintained for all purchases.
CLO Response: By the end of June 2005, the Information Technology Department will implement a new process for receiving items to include the redesign of the online Purchase Order (PO) form. The new form will include an ordered column and a received column. The information from the two columns will be used to generate a report reflecting received, partial received, open or closed PO’s.
Evaluation of Response: We concur with the CLO’s response.
Recommendation: 2. Ensure partial deliveries are documented on the receiving reports and purchase orders.
CLO Response: With the modified PO system, the receiving person will be able to update any partial receipts or variations to the order in the P.O. System by July 2005.
Evaluation of Response: We concur with the CLO’s response.
Recommendation: 3. Ensure copies of the purchase order and receiving reports are forwarded to the accounts payable unit with the invoice for payment.
CLO Response: The receiving person in the Administration Department will print the PO and forward the copy along with the attached packing slip(s) to the Accounts Payable area starting in July 2005.
Evaluation of Response: We concur with the CLO’s response.
Recommendation: 4. Develop procedures to ensure that the billing invoice is compared with the PO and receiving report prior to payment.
CLO Response: The policies and procedures for the purchasing cycle are currently being designed with internal controls in mind and will incorporate the recommendations identified by the auditors in a written document by June 2005. In the Accounts Payable area, POs will be compared to billed invoices and receiving reports prior to forwarding to the approver for signature by the Accounts Payable Technician. Copies of these three documents will be attached to the payment documents.
Evaluation of Response: We concur with the CLO’s response.
Recommendation: 5. Develop procedures to ensure that all supporting documentation, such as the billing invoice, PO, and receiving report is retained together.
CLO Response: In the Accounts Payable files, copies of the PO, receiving report and approved invoice will be attached to the payment documents. These procedures will be documented in the Accounting Policies and Procedures discussed in Finding I.
Evaluation of Response: We concur with the CLO’s response.
No Periodic Review of Open Purchase Orders
The CLO does not perform a periodic review of open purchase orders to determine if any items are long outstanding. Specifically, the administration purchase orders are maintained in a file in the CLO receptionist work area and the information technology purchase orders are maintained in the information technology unit. Neither the administration nor information technology purchase order files are reviewed periodically to determine if purchase orders are long outstanding and should be investigated. Failure to periodically review and investigate the open purchase orders increases the risk of non-receipt of items ordered, payment on invoices when purchases have not been received, receipt of duplicate shipments, and/or funds used for purposes other than that which was intended.
Recommendation: Ensure the open purchase order files are periodically reviewed and long outstanding purchase orders are researched and investigated.
CLO Response: The CLO uses purchase orders to purchase approximately $600,000 in office supplies, software, postage and other items per year. The current invoice payment and purchasing procedure has some compensating controls built-in to counter issues identified in the finding.
o In an organization the size of the CLO, items ordered and not received would be quickly questioned by the individual or unit who ordered the item when not received by the expected date.
o Similarly, items received in duplicate would be identified when received by the user and returned to the vendor to avoid budget variances.
o Payment can not be completed on invoices unless approved and coded to the proper budget accounts by a department manager or supervisor.
The open purchase orders will be reviewed by the receiving person on a monthly basis starting July 2005.
The IT Department is planning several enhancements to enable reporting on purchase orders, such as archiving and emailing. The expected completion date is early June 2005. Beginning, July 2005, the Administrative Supervisor will review open purchase orders monthly and research and investigate outstanding purchase orders.
Evaluation of Response: We concur with the CLO’s response.
Inconsistent Research and Review of Outstanding Checks
The CLO does not consistently research and review checks that are outstanding beyond their period of negotiability. We identified $47,902 of outstanding checks in the CLO’s accounts payable account as of March 2004, and $1,266,524 in the West Coast Opt account as of January 2004, that have been outstanding for at least one year, the longest dating to 1998. Failure to research and review checks that are beyond their period of negotiability results in a complex reconciliation, complicated audit trail, and increases the risk of checks not being identified or remitted as unclaimed property.
This is a recurring condition from the Department of Finance’s 2002 Agreed-Upon Procedures Report. However, because the test samples between the 2002 Agreed-Upon Procedures and the Internal Control Examination were different, this finding is described in detail within each report.
Recommendation: 1. Develop policies and procedures governing the identification and research of long outstanding checks.
CLO Response: The CLO’s cash accounts are on a positive-pay system. This system places a compensating control over the possibility of a check being paid if it has been outstanding beyond the negotiable date or if it is a fraudulent facsimile of a CLO check. However, the CLO acknowledges that a procedure is necessary to research stale checks, in the Accounts Payable account, and has taken steps to accomplish this.
By December 2004 each outstanding check in the Accounts Payable bank account had been researched and either reissued or voided in the Accounts Payable subsidiary module. As of January 2005, a monthly review process has been implemented to identify stale-dated accounts payable checks. In January 2005, procedures were written for this and will be incorporated into the departmental policies and procedures.
The checks in the West Coast Opt out account relate to a specific distribution with continued reissue activity. Typically, un-cashed distribution checks are available for reissue until the estate is closed and the Commissioner is discharged. Escheatment is one of the final steps in the closure of an estate. The controls in place for this account include:
The Claims Department regularly corresponds with inquiring payees regarding their outstanding checks and has a documented policy, with built-in controls, to verify payee information and provide supporting documents for the reissue of distribution checks through the Accounting Department.
o The outstanding check lit for this account is kept current and updated each time a check is reissued to limit the possibility of duplicate reissues.
o The proper journal entries are entered with each batch of transactions to record the void and reissue activity in the general ledger and to reconcile to the outstanding check list on a monthly basis.
o After a final reconciliation, outstanding distribution checks which are not reissued, when the cut-off date for reissues is determined, will be remitted to the State Controller's Office Unclaimed Property division.
Evaluation of Response: We concur with the CLO’s response.
2. Ensure checks outstanding beyond their period of negotiability are promptly cancelled in accordance with CLO’s policies, and/or identified and remitted as unclaimed property, in accordance with the California unclaimed property regulations.
CLO Response: The statement that “This is a recurring condition” may confuse uninformed readers of this report. Since Department of Finance will issue reports on both this internal control audit and the 2002 Agreed-Upon procedures audit at the same time, they will include this same finding in both audit reports. CLO began evaluation and remediation of all findings upon notification, but CLO does not consider the same finding included in two simultaneously issued reports to be a “recurring condition.” CLO will provide similar responses to this same finding in both reports.
The CLO’s cash accounts are on a positive-pay system implemented in 2004. This system requires the CLO to communicate with the bank specifically which check may be paid and adds a higher level of internal control.
As discussed directly above, outstanding checks in the Accounts Payable bank account are now researched on a monthly basis. Any un-cashed checks 6 months or older will be researched. If research determines the check should be voided, the check will be voided through the A/P system. If the check is determined to be outstanding the CLO will reissue or escheat it. Any un-cashed distribution checks will be escheated upon closure of the estate. These policies and procedures will be updated in the Accounting policies and procedures discussed in Finding I.
Evaluation of Response: Per the CLO’s request, we identified the findings that were noted in both the internal control review report and the 2002 Agreed-Upon Procedures report as a recurring condition.
We concur with the CLO’s response.
Failure to Establish a Plan of Correction for Excessive Sick Leave Balances
The CLO did not establish a plan of correction for excessive sick leave balances incurred. Specifically, we observed that four employees have negative sick leave balances totaling 13.36 hours amounting to $303. The sick leave accrual reconciliation will always show a negative balance for those four employees. The CLO does not have plans to require the employees to reimburse the CLO for the improper leave and/or remove the balances from the leave accrual reconciliation.
Recommendation: Implement a plan of correction to have the employee reimburse CLO for the excessive sick leave taken.
CLO Response: Prior to February 2002, the CLO offered sick leave to its employees. Accrued sick balances were normally added to an employee’s personnel records in January of each year and unused sick leave was not compensable at the time of separation.
In early February 2002, CLO management discontinued the sick leave program. Four employees utilized sick time in January 2002 believing they had accrued the benefit. The 13.36 hours used by the four employees amounted to $303.00. These immaterial balances have remained on the employee record since 2002.
On March 15, 2005, the CLO purged the sick time negative balances totaling $303 from the report which tracks the defunct sick leave balances. For year-end reconciliation purposes, the report will continue to be used until the end of 2005. By the end of January of 2006, the sick leave report and tracking will be fully discontinued.
Evaluation of Response: We concur with the CLO’s response.
Inadequate Monitoring of Fixed Assets
We observed the following inadequate controls over the CLO’s fixed assets.
1. The CLO maintains two separate property subsidiary ledgers in addition to the general ledger fixed assets account maintained by the accounting unit. One property ledger is maintained in the information technology unit for information technology equipment, and the other ledger, entitled the Fixed Asset System (FAS) ledger, is maintained by the administration unit for all other CLO property. One centralized ledger is not maintained and the information within each is not shared nor reconciled periodically. Further, we found that the information technology unit and the administration unit do not follow the same policies and procedures regarding property and as a result, property is handled inconsistently. Failure to apply consistent procedures to the handling of property and the failure to reconcile the property subsidiary ledgers with the general ledger increase the risk of incomplete and materially incorrect accounting records.
2. The FAS contained information on 1,169 items. However, the information maintained in the FAS was incomplete and inaccurate. Specifically, we observed that the FAS does not include fields to identify the acquisition cost, invoice number, or model number of the fixed assets. Thus, this prohibits the effective reconciliation of the subsidiary ledger with the general ledger.
3. We obtained the capitalized fixed assets listing and determined 65 items were purchased since January 1, 2003. We selected 12 items (18 percent) for testing. Our testing identified the following (Note: some items contained more than one exception):
a. The identification tags for eight items (66 percent) were either not listed, were incorrect or the items were not tagged.
b. The serial number on seven items (58 percent) was either not listed or was incorrect.
c. The location in the FAS for seven items (58 percent) was either incorrect or incomplete.
d. Five items (42 percent) were not capitalized in accordance with CLO guidelines.
e. Four items (33 percent) were not listed in the FAS.
4. We performed a test to determine the completeness of the FAS. We selected 20 items located at the CLO to trace to the FAS. We identified the following (Note: some items contained more than one exception):
a. The FAS did not list the correct location for eighteen items (90 percent).
b. The FAS did not include the serial numbers for six items (30 percent).
c. Four items (20 percent) did not trace to the FAS.
d. Three items (15 percent) did not have identification tags.
5. We tested the information technology listing and found that of 39 items tested (Note: some items contained more than one exception):
a. Ten items (26 percent) did not have identification tags attached.
b. Thirty-six items (92 percent) did not trace to the FAS listing.
6. The CLO has not completed a physical inventory of its fixed assets since January 2001. Although the CLO reported being in the process of performing a physical inventory, this inventory had not been completed as of June 2004. Failure to conduct a periodic physical inventory at least once every two years increases the risk of loss, theft, or misappropriation of assets, and diminishes the CLO’s ability to appropriately safeguard assets.
Because the CLO operations are funded by allocating costs to the estates, the failure of the CLO to maintain proper fixed asset records could negatively impact the assets of the estates.
Recommendation: 1. Maintain a centralized subsidiary property ledger for all CLO property. Ensure the subsidiary ledger contains all necessary information regarding date purchased, cost, location, model, and serial numbers, etc.
CLO Response: Between July 2004 and October 2004, a reconciliation was initiated to tie physical inventory to the subsidiary property ledger FAS. The CLO encountered reconciling differences which are in the process of being identified and researched. All tagged items discovered in the physical inventory which were not on FAS were added to FAS. Any untagged items listed in FAS were subsequently tagged.
We will continue the reconciliation of the physical inventory, general ledgers and FAS will continue through October 2005 or until the records are complete and accurate. Any open items will be listed for future research or disposal. This effort will be overseen by a Fixed Asset working group consisting of the Administration Supervisor, an IT Manager and the Accounting Manager.
Evaluation of Response: We commend the CLO’s efforts on conducting and reconciling its fixed assets inventory.
Recommendation: 2. Develop policies and procedures to ensure the property subsidiary ledger is periodically reconciled with the general ledger.
CLO Response: Currently the general ledger tracks fixed assets by the invoices paid through the Accounts Payable system to calculate depreciation expense on a monthly basis. It is unlikely a material error could occur. With the full utilization of a centralized subsidiary property ledger anticipated by the end of December 2005, the Accounting Department will receive asset reports monthly and reconcile them to the general ledger prior to calculating the depreciation.
Evaluation of Response: We concur with the CLO’s response.
Recommendation: 3. Develop policies and procedures as indicated in Finding 1 above, to ensure consistent treatment of property at the CLO. For example, ensure all property is tagged upon receipt.
CLO Response: Several steps have been taken to ensure consistent treatment of property at the CLO. A Fixed Asset working group is responsible for identifying procedures from the purchase, receipt, recording, depreciation and monitoring of CLO assets. The Purchase and Receiving cycle has been improved as discussed in the response to Finding IIa. In January of 2005, the Administration Department became responsible for “tagging” all asset purchases, including IT purchases.
Evaluation of Response: We concur with the CLO’s response.
Recommendation: 4. Ensure a physical inventory of fixed assets is conducted at least once every two years.
CLO Response: Between March 2004 and July 2004, a physical inventory of the assets at the CLO was conducted by the Administration Department. A physical inventory will take place annually, during the span of a specific week, and the Administration Policies and procedures will be updated to document the process. An inventory report will be designed in June 2005 by the Administration Department to be used after each inventory takes place. This report will be used to reconcile to the FAS and general ledger records.
Evaluation of Response: We concur with the CLO’s response.
Multiple Version Financial Statements
This is a recurring condition from the Department of Finance’s 2002 Agreed-Upon Procedures Report. Details of the finding and the CLO’s response are documented within that report, which was issued under separate cover.
CLO Response: The statement that “This is a recurring condition” may confuse uninformed readers of this report. Since Department of Finance will issue reports on both this internal control audit and the 2002 Agreed-Upon procedures audit at the same time, they will include this same finding in both audit reports. CLO began evaluation and remediation of all findings upon notification, but CLO does not consider the same finding included in two simultaneously issued reports to be a “recurring condition.” CLO will provide similar responses to this same finding in both reports.
The Department of Finance’s 2002 Agreed-Upon Procedures Report recommends: Develop policies and procedures to completely close the general ledger at year-end. Ensure the general ledger and account reclassifications support the financial statements issued.
The general ledger year-end close is a multi-step process complicated by on going tax and/or legal matters and the proof-of-claims process. On a going-concern basis, a definitive close date is necessary to match revenue with expenses. However, in liquidations, the focus is less on the “matching principle” and more focused on identifying what assets will be available for distribution, which in most cases takes years to determine. The accounting year-end closing procedures will be documented by December of 2005 to reflect how these year-end entries will be treated.
The finding of multiple versions of the financial statements was due to the practice of presenting auditors with a preliminary version of the financial statements, at their request, before all necessary adjustments had been identified. Upon further review by CLO Accounting and by the auditors, adjustments were made. This practice is not uncommon in any environment. Oftentimes, the interim versions of financial statements were issued at the request of the auditors themselves, who wished to review the adjustments that had already been made without waiting for a final version of the financial statements.
Starting with the 2004 financials, two factors will remedy this situation. First of all, we will not present the auditors with financial statements prepared on a basis distinct from our regular monthly accounting as we have in the past. This will eliminate most of the subsequent adjustments that are typically made to update the preliminary version of the financial statements. Secondly, we will not provide the auditors with a preliminary draft of the financial statements until we have completed our post-year-end review.
Evaluation of Response: Per the CLO’s request, we identified the findings that were noted in both the internal control review report and the 2002 Agreed-Upon Procedures Report as a recurring condition.
Under liquidation or modified cash basis of accounting, the accounting records still should be closed within a reasonable time after year end. Per CLO request, we began interim testing in June 2003, for the 2002 Agreed-Upon Procedures. Because the CLO did not complete the close of its books until October 2003, multiple version financial statements were produced. We do not consider October 2003 a reasonable time after year end for closure. Nor do we concur with the CLO’s practice of holding its accounting records open in order to post adjustments, corrections, and changes in estimates to the prior year (2002) as opposed to closing its books and posting the changes to the beginning net deficiency in assets for the current year (2003) as is the prevailing practice.
With the 2004 Agreed-Upon Procedures, we will await conducting fieldwork until the CLO’s post year end review is completed and a final version of the financial reports is produced.
Incomplete Financial Statements
This is a recurring condition from the Department of Finance’s 2002 Agreed-Upon Procedures Report. Details of the finding and the CLO’s response are documented within that report, which was issued under separate cover.
CLO Response: The statement that “This is a recurring condition” may confuse uninformed readers of this report. Since Department of Finance will issue reports on both this internal control audit and the 2002 Agreed-Upon procedures audit at the same time, they will include this same finding in both audit reports. CLO began evaluation and remediation of all findings upon notification, but CLO does not consider the same finding included in two simultaneously issued reports to be a “recurring condition.” CLO will provide similar responses to this same finding in both reports.
The Department of Finance’s 2002 Agreed-Upon Procedures Report recommends: Report all estates with year-end general ledger balances by either including the estates in the financial statements, or disclosing them within the financial statement notes, quantifying balances and reasons for exclusion.
In a liquidation proceeding, the purpose of a financial statement is to report to the court financial activity of an estate. In cases where the CLO is not required to report to the court or where another entity has reporting responsibility, the CLO doesn’t expend unnecessary resources to prepare reports.
The financial statements provided to the auditors were deemed to be incomplete because there were some entities in the CLO general ledger that are not included in the combined financial statement report. This practice of preparing “combined” financial statements was initiated by the previous auditors, whereby including in the combined report, only the open estates for which the Commissioner, as Liquidator, was responsible. As such, it excluded estates which the Commissioner had been legally discharged by the Court of his responsibility, even though the CLO continued to hold funds (the closing budget) and to account in its books for the closing administrative expenses. In addition, the CLO, excludes certain entities, which do not constitute a liquidated entity under the supervision of the Insurance Commissioner in the role of Conservator or Liquidator.
For the 2004 year-end financials, the Accounting Department will present the auditors with financial statements for all the estates that were open during the year under review. These estates are also reported in the Annual Report to the Commissioner. As in years past, the CLO will make available all entities with balances on the CLO general ledger, regardless of their legal status. These entities will be listed in a spreadsheet similar to one provided to the auditors for 2002 and 2003 identifying the reasons for exclusion from the financial statement preparation. Financial statements for “excluded” entities will only be prepared if necessitated by a court or regulatory action and if the cost of the audit can be justified for allocation to that entity and not another estate.
Evaluation of Response: Per the CLO’s request, we identified the findings that were noted in both the internal control review report and the 2002 Agreed-Upon Procedures Report as a recurring condition.
We disagree with the CLO’s response. Under the California Insurance Code Section 1060, the Commissioner is required to report to the Governor the names of the persons proceeded against, whether such persons have resumed business, been liquidated, or mutualized, and such other facts as will acquaint the Governor, the policyholders, creditors, shareholders and the public with his proceedings.
As a result, the CLO has a responsibility to include all estates under the Commissioner’s control within its reporting practices. This includes estates considered closed by the courts, but for which the CLO is still performing the final close process. While a formal financial statement may not be necessary, the CLO still has a responsibility to report this information to the Commissioner. Additionally, the CLO’s books and records serve as a basis for supporting the information transmitted. Further, transparency in regulatory organizations is not about value but rather providing the public with available information.
Inconsistent and Untimely Uploading of New Estates’ Balances
This is a recurring condition from the Department of Finance’s 2002 Agreed-Upon Procedures Report. Details of the finding and the CLO’s response are documented within that report, which was issued under separate cover.
CLO Response: The statement that “This is a recurring condition” may confuse uninformed readers of this report. Since Department of Finance will issue reports on both this internal control audit and the 2002 Agreed-Upon Procedures audit at the same time, they will include this same finding in both audit reports. CLO began evaluation and remediation of all findings upon notification, but CLO does not consider the same finding included in two simultaneously issued reports to be a “recurring condition.” CLO will provide similar responses to this same finding in both reports.
The Department of Finance’s 2002 Agreed-Upon Procedures Report recommends: Develop policies and procedures to ensure newly acquired estates are consistently processed and information contained within the general ledger system reflects the conservation date of the estate. Any exceptions should be noted and disclosed within the notes to the financial statements
.
With insolvencies, the CLO inherits a set of books or accounts that often prove to be unreliable or difficult to substantiate. Depending on the complexity of the estate, access to resources, nature of the account and information available, this process could take considerable time. On certain estates, the attempt was made to verify the existence of assets and liabilities before loading them into the CLO general ledger. However, the CLO kept records of the opening balance sheet and maintained control of the books of the estates by keeping a legacy or subsidiary system intact until the estate was successfully loaded.
With the next seizure, the CLO will continue the practice of loading conservation date balances to the ledger to maintain a snapshot of the conservation-date balances, as inherited at seizure. The balances provided will be loaded within a reasonable time period. This time period will be identified by management on an estate-by-estate basis and determined by the complexities encountered during the seizure process. On large or complex estates, the CLO commissions a separate examination of the conservation date balances by external auditors. The results of those examinations are incorporated as adjustments to the conservation date balances.
The balances that are not reconciled within this reasonable time period will be identified before the first court reporting date, one year from the order of liquidation. If, after the one-year discovery phase, research indicates adjustments to be necessary to the opening balances, these will be adjusted on both the opening and general ledgers.
Evaluation of Response: Per the CLO’s request, we identified the findings that were noted in both the internal control review report and the 2002 Agreed-Upon Procedures Report as a recurring condition.
We acknowledge the CLO’s difficulty with inherited books and records. However, we disagree with the CLO’s response. The CLO is charged with the responsibility of acting on the behalf of the Commissioner to liquidate insolvent entities. In this capacity, the CLO has a responsibility to safeguard the assets of the seized entity and properly account and record the liquidation operations. As such, the CLO assumes responsibility for the estates books and records upon conservation and therefore, should timely record these amounts obtained within its accounting system. Upon review of the inherited books and during conversion to liquidation, the CLO should record all adjustments made, whether it be the write down on assets to net realizable value, or the write off of assets or liabilities due to insufficient supporting documentation or cost-benefit analysis.
FINDING IIb Inadequate Reconciliation Practices
We identified the following instances of inadequate reconciliation practices:
Inconsistent Documentation and Performance of Investments Reconciliations
The CLO does not consistently document its pooled investment account reconciliations nor does the CLO perform adequate reconciliations of the accounts. Specifically, the CLO receives statements from both the investment custodian and the investment managers. The CLO uses the investment custodian’s statement to record information in the general ledger. However, the CLO reported only performing reconciliations of CUSIP numbers from the custodian statement to the investment manager statement to verify all securities were accounted for, and does not have procedures in place to identify and investigate large market value variances. We observed a $1,261,264 variance in reported market values between the custodian and investment manager reports for April 2004. The CLO could not provide a documented reconciliation between both sources; therefore, we could not conclude whether variances identified are from typical differences deriving from the different systems used in determining pricing; timing differences for transactions and the end of the period; methods used to accrue interest; or whether differences derive from missing and/or duplicated securities. Failure to adequately complete and document reconciliations increases the risk of the reconciliations not being performed and inconsistencies and errors within the financial records.
This is a recurring condition from the Department of Finance’s 2002 Agreed-Upon Procedures Report. However, because the test samples between the 2002 Agreed-Upon Procedures and the Internal Control Examination were different, this finding is described in detail within each report.
This is a recurring condition from a prior audit. See Appendix A.
Recommendation: Develop policies and procedures to annually reconcile investment managers’ and investment custodian statements, or obtain equivalent work from the investment manager or custodian. At a minimum, documentation should compare CUSIP numbers, units, maturity dates, interest rates, market prices, market values, and interest earned; placing particular attention on large variances in market price, or the inability of one or both outside statements to state a market price other than the original cost. Ensure the reconciliations are documented and all material variances are investigated.
CLO Response: The statement that “This is a recurring condition” may confuse uninformed readers of this report. Since Department of Finance will issue reports on both this internal control audit and the 2002 Agreed-Upon Procedures audit at the same time, they will include this same finding in both audit reports. CLO began evaluation and remediation of all findings upon notification, but CLO does not consider the same finding included in two simultaneously issued reports to be a “recurring condition.” CLO will provide similar responses to this same finding in both reports.
The CLO disagrees with the comment in the finding that the “CLO does not consistently document its pooled investment account reconciliations nor does it perform adequate reconciliations of the accounts.” The CLO reconciles and documents the reconciliation of the pooled investment account with the investment custodian each and every month and has followed this practice since the investment pool was first utilized. In addition, on a monthly basis, the two investment manager reports are tied to the investment custodian report for the number of shares and specific securities held. This process is performed to ensure that all securities are accounted for regardless of the varying market valuation methods used by the parties. The process is documented electronically and evidenced by the capture of the custodian and manager information on a spreadsheet and must be accomplished to complete monthly internal management reports.
The market values attained by the managers and custodian typically differ due to record date, interest accruals and differing valuation entities.
To provide full documentation of the three-way reconciliation, the CLO will add a step to the month-end close process to formally sign-off on a reconciliation summary. This documentation will be included with the hard-copy custodian statements monthly. In addition, any material differences in month-end valuation will be identified and email requests for additional research by the custodian and managers will be included in the file. These policies and procedures will be updated by December 2005.
Additionally, as of August 2004, one of the investment managers has sent electronic reconciliations to the CLO on a monthly basis. The other has been asked to send them electronically as of February 2005. These reconciliations are to tie the manager’s portfolios to those reported by the custodian. The procedure will be continued and in the 2006 contract, it will be incorporated into the contractual obligations of the investment managers.
Evaluation of Response: Per the CLO’s request, we identified the findings that were noted in both the internal control review report and the 2002 Agreed-Upon Procedures Report as a recurring condition.
We do not dispute that the CLO performs monthly investment reconciliations; however, we disagree that the CLO performs adequate reconciliations and maintains documentation of the reconciliations as evidenced by our finding. We concur with the CLO’s plan of corrective action to include documentation of the comprehensive reconciliation. Further, we concur with the CLO’s plan of incorporating the reconciliation into the contractual obligations of the investment managers.
Improper Bank Reconciliation Procedures
We were unable to trace outstanding checks to subsequent bank statements for the January 2004 West Coast Opt account. We found that the CLO did not maintain a single listing of outstanding checks but rather calculated outstanding items by taking the outstanding balance from the prior month and adjusting for current month checks issued and paid. The CLO was not able to provide a detailed listing of outstanding checks until the August 2004 bank reconciliation. As a result, the CLO was unable to identify specific items outstanding per estate or provide assurance that a duplicate payment had not been made during that time period.
This is a recurring condition from the Department of Finance’s 2002 Agreed-Upon Procedures Report. However, because the test samples between the 2002 Agreed-Upon Procedures and the Internal Control Examination were different, this finding is described in detail within each report.
Recommendation: Develop policies and procedures to ensure outstanding bank reconciling items are detailed and adequately supported. This includes maintaining a single listing of outstanding checks and removing cancelled and reissued checks from the outstanding check listing.
CLO Response: The statement that “This is a recurring condition” may confuse uninformed readers of this report. Since Department of Finance will issue reports on both this internal control audit and the 2002 Agreed-Upon Procedures audit at the same time, they will include this same finding in both audit reports. CLO began evaluation and remediation of all findings upon notification, but CLO does not consider the same finding included in two simultaneously issued reports to be a “recurring condition.” CLO will provide similar responses to this same finding in both reports.
The policies and procedures of the CLO require all bank accounts to be reconciled on a monthly basis. Some accounts have no activity except for interest income or bank fees. These are not formally documented through a reconciliation form but the accounts are reconciled to the general ledger by recording income/expense activity each month. Formal reconciliations of large or active accounts are reviewed and approved by the area supervisor. Any reconciling items are noted on the bank reconciliation with a description of the item and resolved either immediately or, if further research is required, as soon as possible.
The example noted in the finding is not a common practice. This deviation from procedures occurred to allow the CLO enhanced tracking and reconciliation of estate information on a particularly large and complex distribution.
From the distribution date in October 2002, the CLO maintained an internal outstanding check listing for the West Coast Opt out account to track numerous voids and reissues to the entire distribution and to reconcile to the policyholder information in the Claims Department. The bank also produced a secondary list of un-cashed checks which was comprised of all stale-dated checks including those voided and reissued by the CLO. The CLO did not use the banks outstanding list because it was not up-to-date or correct. For cost effectiveness, the CLO did not individually void each reissued check in this positive-pay account which caused a reconciling difference between the banks outstanding list and the CLO’s. It was anticipated that maintaining the internal listing to track the voids and reissues would allow a single transaction to be made to void the stale checks and close the account when it was determined that further reissues would not be taking place.
As of December 2004, reconciliation of the two lists has been completed and incorporated into subsequent monthly reconciliations. This is accomplished by including a line item for reconciling the two lists until the account is closed and true stale dated checks are escheated. In addition, this particular bank reconciliation is reviewed by the Accounting Manager on a monthly basis.
Evaluation of Response: Per the CLO’s request, we identified the findings that were noted in both the internal control review report and the 2002 Agreed-Upon Procedures Report as a recurring condition.
Although the CLO states that this is not a common practice, we remind the CLO of the importance of properly reconciling cash accounts in an effort to appropriately safeguard the estates assets.
Insufficient Receivables Reconciliations
The CLO does not perform reconciliations of receivables subsidiary ledgers to ensure consistency in the accounting records. Specifically, subsidiary ledgers for other receivables, receivables, and subrogation are not regularly reconciled to determine the status of the outstanding receivables. For example, we observed that the CLO does not sufficiently monitor its other receivables account. Specifically, the other receivables account represents receivables associated with unclaimed property, other vendor credits, and outstanding loans inherited from seized estates. As of June 2004, the last schedule of other receivables was dated January 2004 and detailed the monies booked and the disposition of their collections. As of June 2004, the CLO is processing billings for only three of approximately 34 estates. Also, because the CLO did not consistently maintain this account, different receivables may be misclassified within other receivable accounts. However, due to the current workload, the CLO has not completed a review and reconciliation of the receivables accounts to determine and/or verify appropriate recording. Inadequate maintenance and monitoring of the receivables accounts increases the risk of errors or mispostings occurring and not being detected timely, as well as the inadequate collection of outstanding receivables.
Recommendation: 1. Perform reviews and reconciliations of the receivables accounts to determine/verify appropriate recording. For those incorrectly classified, repost to the correct account.
CLO Response: The CLO receivables accounts will be reviewed and reconciled monthly as noted in the response to Finding IIa. This regular review of general ledger balances will concentrate on reconciling summary totals from the subsidiary premium, reinsurance and subrogation reports. As of December 2004, the detailed activity in the Other Receivables account is reconciled on a monthly basis and reviewed by the Accounting Manager. Monthly reviews will highlight journal entries which may be coded in error or classified improperly and allow for correction immediately.
Any exceptions for inherited balances in existing open CLO estates will be disclosed with financial reports as well as in an addendum to the Accounting Policies and procedures manual.
Evaluation of Response: We concur with the CLO’s response.
2. Consistently monitor and research outstanding receivables. Ensure collections are actively pursued and processed timely.
CLO Response: Monthly reconciliations to the various receivable accounts will allow for regular monitoring and research of outstanding items deemed cost-effective to pursue. The collection efforts for these items will be monitored as discussed in the response to Finding IIa.
Evaluation of Response: We concur with the CLO’s response.
FINDING IIc Inadequate Separation of Duties
We observed the following instances of inappropriate separation of duties at the CLO:
Inadequate Separation of Duties over Information Technology Purchases and Fixed Assets
We observed an inadequate separation of duties over the information technology unit purchases and fixed assets. Specifically, one employee has the ability to initiate purchases, obtain bids, approve purchases, receive purchases, and approve invoices for payment. Additionally, this same person has the responsibility to maintain the information technology property ledger, tag items received, and approve asset disposals. Inadequate separation of duties increases the CLO’s risk of loss, theft, or misappropriation of assets.
Recommendation: Establish monitoring and approval systems to ensure adequate separation of duties and controls over the information technology purchasing and payment procedures as well as a separation of the fixed assets functions of authorization, recordkeeping, and custody.
CLO Response: In July of 2003, the IT Department implemented a web-based automated Purchase Order (PO) system. The department has used this system exclusively for the generation of POs since that time.
It includes the following controls:
o Only individuals appearing in a control table can approve a PO.
o Approval limits are set by the authority matrix and are programmatically controlled.
o PO numbers are issued sequentially.
o The system prevents duplication of the number. If a PO is voided, the number is not reused.
o The same authority is required to void, as to approve.
o The system controls access to data by the network log on.
An online maintenance and inquiry screen is available permitting the authorized user to view open and closed POs, number, requester, approver, total amount, date created, and time created. The electronic image of the PO displays when selected. All data is in a database and is available for ad hoc reporting.
In late 2003, the system was enhanced to permit a user, when granted the authority, to view and print any PO. This was provided to assist in the receiving process, as well as to permit accounting to see any PO.
A procedure was put into place March 2005 whereby at the time the PO is approved, a copy is printed and routed to the Administration Supervisor to be matched to the merchandise when it is received.
In January of 2005, the IT and Administration Departments established a procedure for applying tags to any computer-related equipment. The custody of the asset tags remains in Administration Department. However, the IT Department is responsible for applying the tags to computer-related items. Procedures outlining the details of tagging assets will be documented within the Purchase and Receiving cycle procedures by the end of June 2005.
Evaluation of Response: We concur with the CLO’s response.
Inadequate Separation of Duties over the Payroll Functions
We identified an inadequate separation of duties over the payroll functions at CLO. Specifically, the same employee receives the timesheets, records the timesheets into the payroll spreadsheet and forwards the information to the Pay Tech company for processing, receives the payroll checks, and distributes the payroll checks to employees. Failure to appropriately separate the payroll functions increases the risk of loss, theft, or misappropriation of assets.
Recommendation: Separate incompatible payroll duties. Ensure that the same person is not responsible for the authorization, recordkeeping, and custody of payroll.
CLO Response: The CLO has approximately 94 employees. For an organization of this size, the CLO has certain controls over the payroll function. These include a review and approval, by the department chief and a second senior officer, of the payroll summary sheets and any changes made to current personnel data prior to the issuance of data to the payroll vendor. After the transactions occur the journal entries and source data are reviewed for posting in the general ledger.
Since February 2005, the various payroll functions of timesheet processing, payroll preparation and submittal, and distribution of checks and vouchers are now segregated and performed by the Payroll Coordinator, HR Coordinator, and HR Generalist.
Additional controls are in place to prevent duplication and unauthorized changes with the use of an external vendor to process payroll changes and controlling information exchanges between the CLO and the vendor.
These steps will be documented in the Human Resource policies and procedures will as discussed in the response to Finding I.
Evaluation of Response: We concur with the CLO’s response.
Section III
Ineffective Controls
During our review, we identified instances where the CLO’s controls did not function as intended resulting in incorrect postings and improper classifications of funds within the general ledger. Specifically, we identified the following:
FINDING IIIa Uncorrected Prior Audit Findings
Condition: A Bureau of State Audits Report, “CLO: Stronger Oversight is Needed to Properly Safeguard Insurance Companies Assets”, Report #2001-102; a California Department of Insurance (DOI) Internal Audit Report, “CLO Disbursements for Legal Services”, Report #2002-001; and a PriceWaterhouseCoopers Management Report, dated December 31, 2001, identified 34 findings requiring corrective action. Of the 34 findings, we identified 70 issues for review. We tested 61 of these issues during our current examination, eliminating 4 issues that pertained to seizures on which the DOI is performing a review, and 5 issues which we will review in the 2003 or 2004 AUPs. We found that CLO management has taken corrective action to resolve 38 (62 percent), however, 23 (38 percent) of the prior audit issues require further attention from CLO management. Of the 23 issues, 13 (21 percent) issues’ resolutions were found to be in progress or partially resolved, 9 (15 percent) were unresolved and 1 (2 percent) issue has not been resolved because the CLO does not agree with the finding; however, we determined that corrective action is required. These findings are detailed within Appendix A.
The CLO’s lack of corrective action taken on prior audit findings raises concern as to the organization’s development and implementation of effective control procedures for preventing and detecting errors in the account balances and potential misappropriation of estates’ assets.
Recommendation: Develop and implement an action plan to promptly resolve the control weaknesses identified in this report, and any unresolved control weaknesses identified in the referenced prior three reports. The action plan should be specific as to responsibilities and time frames.
CLO Response: The CLO’s activities fluctuate dramatically due to industry and economic conditions. The CLO had 57 open estates in 2003, but that number has been reduced to only 27 open estates currently. There have been similar changes to CLO’s organization, operations, staffing, policies and procedures over the intervening years.
In addition, previous audit reports have not been timely. For example, the PricewaterhouseCoopers audit report for 2001 was not completed until the end of 2004, and their management letter for the audit was not delivered to CLO until 2005. The CLO contracted with Department of Finance with the intent of receiving timely audit reports and using them as a basis to strengthen controls.
The CLO has already made progress toward correcting some of the findings in this Internal Control report as described in various responses in this report. This is a first step in addressing prior uncorrected audit findings which are duplicated in the internal control report.
The next step the CLO will take, by the end of June 2005, is to create a project plan to address other uncorrected findings which are still pertinent to the current CLO organization. Some findings may have been resolved by new processes or procedures not previously examined by the DOF. The CLO will study the feasibility of performing oversight procedures over IGA adjusted claims as identified in Appendix A: Finding A.5-13. This project plan will include specific tasks, milestones and responsibilities and will be reviewed on a bi-weekly basis, starting the first week of May 2005, by CLO senior management.
As the 2003 AUP report is received, any new findings will be added to the project plan. Any duplicated findings will be referenced. This project plan will be reviewed with DOI’s Internal Auditor and the DOF auditors during subsequent examinations.
Evaluation of Response: We encourage the CLO to implement processes to review, monitor, and implement timely corrective actions for outstanding prior audit findings that are pertinent to the CLO’s current operating structure.
FINDING IIIb Ineffective Controls over Processes
We identified the following instances of ineffective controls over CLO operational processes:
Ineffective Controls over the Budgetary Process
We observed the following weaknesses with the CLO’s budgetary controls:
1. Budgetary deadlines for submitting draft budgets to the Accounting Manager for consolidation purposes are not consistently met. Failure to meet established deadlines may hinder the ability to produce a timely budget.
2. The review and approval of the budget at different levels of management is not documented, thus the risk of implementing a budget without management knowledge and/or authorization increases.
3. Although formal procedures exist that require budget monitoring and the reporting of budget variances of $25,000 and 10 percent, the CLO does not monitor or report budget variances. As a result, the CLO is at increased risk of exceeding budget limitations without notice and increases the lack of CLO unit accountability.
Recommendation: 1. Ensure budgetary deadlines are established and information is submitted by all CLO units by the predetermined due date.
CLO Response: In September 2004, the CLO initiated a budget process with a specific schedule of deadlines for submittal of departmental and estate budget information for inclusion in the 2005 budget draft. The schedule and support planning documents were distributed at a budget kick-off meeting on September 22, 2004. The first submission date for budget amounts and hours was October 8, 2004. Adjustments and refinements were made and the final budget draft was approved at the end of December 2004.
Evaluation of Response: We concur with the CLO’s response.
Recommendation: 2. Ensure the budget review and approval process is documented and maintained in a file for use when developing the budget and future monitoring.
CLO Response: The budget review and approval process will be updated to reflect the improved process the CLO followed to develop the 2005 budget. This will be documented in the Accounting policies and procedures manual produced in 2005 as noted in the response to Finding I. Additionally, the CLO archives the electronic budget-related schedules, deliverables and drafts for each year on the CLO’s public file directory.
Evaluation of Response: We concur with the CLO’s response.
Recommendation: 3. Follow policies and procedures requiring unit managers to periodically compare budget and actual expenditures, and research and report significant variances to CLO management.
CLO Response: Effective January 2005, the senior management group reviews the budget variances on a monthly basis. The first review occurred in early March 2005 for the month ended January 31, 2005. The first quarterly variance report is scheduled to be submitted after the close for the month of March 2005.
Evaluation of Response: We concur with the CLO’s response.
Ineffective Controls over the Legal Contracts Process
We observed weaknesses in controls over the CLO’s legal contracts. Specifically, we tested five legal contract files initiated during 2004 and identified the following weaknesses. (Note: some items contained more than one exception):
1. Two of five (40 percent) contract files did not include a legal contract request.
2. Two of five (40 percent) contract files did not include CLO management approval of the contract request.
3. One of five (20 percent) included a contract request that was completed after the contract was initiated.
4. One of five (20 percent) contracts did not have a contract number assigned.
Inadequate controls over legal contracts can result in duplication of efforts, inadequate budgeting and spending of funds, and binding the CLO into possible unwanted and/or unnecessary service agreements.
This is a recurring condition from a prior audit. See Appendix A.
Recommendation: 1. Ensure all contracts are appropriately reviewed and authorized prior to inception.
CLO Response: All contracts are appropriately reviewed and authorized according to the CLO’s contracting policies and procedures. In addition, a Department of Insurance, Conservation Liquidation Bureau (CLB) attorney has been permanently assigned to the CLO and is on-site three days a week and is available for consultation concerning our contracting matters. The example cited in Item 1 above is reflective of an abandoned procedure that has not been in place since late 2003. The legal contract request is no longer in effect. Procedures are presently in place to ensure the review and authorization of contracts.
Evaluation of Response: We concur with the CLO’s response.
Recommendation: 2. Ensure contract files are complete and include all necessary supporting documentation.
CLO Response: The CLO maintains comprehensive contract files which include correspondence, status and version controls for all contracts, as required by the CLO’s contracting policies and procedures. The example in Item 2 pertains to contracts initiated at the CLB, (outside the control of the CLO). The files at the CLO did not include the requests by the CLO Contract Manager nor the CEO/SDIC’s approval. Under the CLO’s current policies, these contracts are now created at the CLO and all files for contracts initiated under the new policy have the required documentation.
Evaluation of Response: We concur with the CLO’s response.
Recommendation: 3. Ensure a system is in place to number all contracts, whether initiated or inherited by the CLO.
CLO Response: The CLO follows the contracting policies and procedures and numbers each contract as required. The discussion in Item 4 above pertains to one specific legal contract. This deviation from the procedures at the time the contract was created, was done on an exception-basis due to the unique circumstance employed to protect the identity of a secret witness in a sensitive estate-related legal proceeding.
Evaluation of Response: We concur that the CLO maintains a policy requiring all contracts to be numbered. For contracts that pertain to secret witnesses, a separate numbering system should be established and implemented so that all contracts may be properly tracked, regardless of their sensitivity.
Ineffective Controls over the Review and Posting of Receivables to the General Ledger
We observed several instances of incorrect or incomplete postings or reclassifications in the general ledger receivables account. Specifically, we identified the following:
1. Receipt of funds received from a judgment for the Executive Life Insurance Company (ELIC) estate was incorrectly posted to the settlement/judgments receivables sub-account. On May 25, 2004, the CLO posted a $110 million credit to the receivables account although no receivable had ever been established, thus bypassing the reporting of estate income.
2. The CLO inappropriately recorded a receivable from an estate’s subsidiary in the accounts receivable sub-account (13016) rather than in the receivables from affiliates sub-account (13012). Specifically, the National Services Insurance estate held an $8.7 million receivable from its affiliate, Costal Insurance Company, which was improperly recorded in the accounts receivable account.
3. The CLO improperly classified funds held by Insurance Guarantee Associations (IGAs) as receivables. Specifically, we identified $260 million recorded as other receivables. Of the $260 million, we selected $239 million for testing. We found that the entire $239 million tested was incorrectly posted as receivables rather than as funds held or advances to IGAs. This included monies held or advanced to the IGAs for Mission National Insurance Company ($94.3 million), Mission Insurance Company ($98.6 million), and Holland American Insurance ($46.3 million). Although initially CLO regarded these funds as a receivable because the transfer to the IGA occurred prior to CLO’s control of the estate(s), these funds are currently being used for the payment of claims, and repayment to the estate will not occur. Therefore, the $239 million should be reclassified as either funds held or advances to IGAs.
Failure to appropriately record receivables in the CLO’s accounting records results in inaccurate financial reporting.
Recommendation: 1. Ensure all amounts posted within the financial records are reviewed and properly classified.
CLO Response: All journal entries posted to the general ledger are reviewed by a Supervisor or Manager prior to posting. If an item is miscoded it will be discovered when monthly management reports are produced or when the Financial Analyst completes the trial balance review.
At times, in an effort to keep the month-end closing process on schedule, items may be assigned to certain accounts with the knowledge that the item will be re-classified when the research is completed.
The example cited in Item 1 occurred because the CLO needed to research the proper treatment of the funds received and had to consult with legal and tax professionals. This treatment of a transaction occasionally occurs when dealing with complex and sensitive estate matters. In the liquidation environment, the practice of assigning temporary coding is an issue/problem only if the transaction is not re-classified prior to reporting for tax or court purposes.
Evaluation of Response: We disagree with the CLO’s response. Should the CLO not know the specific treatment of an item at the time of posting, the item should be recorded in a readily identifiable suspense account. Regardless of what environment an entity operates, accuracy and reliability of the accounting records is imperative.
Recommendation: 2. Ensure policies for exceptions to the rules are appropriately documented within the CLO administrative manual.
CLO Response: Any exceptions to the consistent method of coding in the general ledger will be disclosed in notes to the 2004 financial statements produced for estates by Financial Analysts.
The example cited in Item 2 was an immaterial error and one that did not impact the claimants or the eventual distribution and closure of both these estates in any way.
The example cited in Item 3 was a reclassification question and has no impact on the distribution of assets. The coding was purposefully used to segregate funds CIGA held and for which treatment and application toward claims payments and affiliate pooling agreements were in question for years. The balances were not re-classed because the users of the estate financial statements were accustomed to the accounts as they have been presented since 1998. With these specific estates closing in 2004 and 2005, the added effort to re-class the accounts would not result in added value rather it would confuse those who regularly use the information.
Evaluation of Response: We disagree with the CLO’s response. Regardless of whether an item deemed immaterial is posted incorrectly, or whether the CLO is attempting to segregate funds, accuracy and reliability of the accounting records is imperative. Additionally, items recorded in the accounting records should be readily identifiable by account, and posting items to accounts to which they do not pertain does not support this assertion. Mispostings and improper classification of items, whether material or not, affects the reliability and integrity of the CLO staff and the supporting financial data. With numerous mispostings and misclassifications, the users of the financial information cannot rely on the data, nor do they have any assurance that the entity’s assets are being appropriately safeguarded.
Estate Account Balances not Timely Transferred during the Final Close Process
The CLO does not timely transfer estate accounts within its general ledger system once an estate is closed. The CLO’s estate closing process includes transferring amounts attributable to the estates closing budget from the estate’s account to the CLO’s business unit (999). We identified that two of three (67 percent) closed estates tested maintained balances totaling $121,263 in the investment pool after final close. Specifically, World Title and Pacific States estates maintained balances totaling $43,014 and $78,249, respectively. Estate assets remaining in the investment pool after final close may represent undistributed assets or unresolved liabilities. The untimely transfer in estates’ accounts within the general ledger hinders the ability of the CLO to ensure the estate was closed correctly.
Recommendation: Transfer all assets out of the investment pool accounts on closed estates. Remaining amounts attributed to the estates closing budget should be maintained with the CLO’s business unit 999.
CLO Response: The transfer of estate balances within the CLO’s general ledger is for purposes of tracking the closing budget. However, deciding not to transfer the balances does not pose a threat to this tracking process since closing expenses continue to be applied by estate number in both the original and closing ledger.
Additionally, the CLO follows the estate closures activities as specified in the closing court order. These activities include distribution, forgiveness of debt and escheatment. These would occur prior to the estate ledger transfer and would not hinder the ability of the CLO to ensure that the estate was closed properly and that all court-ordered activities were accomplished as required.
The CLO has recently improved the closed estate transfer process so that it occurs on a timely basis and is reviewed periodically.
o As of July 2004, a master list of closed estates is updated monthly and communicated to the Accounting Department, with newly-closed estates specifically identified.
o As of October 2004, the Financial Analysts are charged with the responsibility to ensure the closed estate balances are transferred and blocked from future use.
o For the 2004 year-end close, every balance sheet account balance in the JD Edwards general ledger that did not pertain to an existing open estate was identified and transferred. This same review process will take place in all subsequent years.
Evaluation of Response: We commend the CLO on its efforts to transfer all closed estates and enhancing its procedures to ensure closed estates’ funds are timely transferred to the CLO’s business unit 999.
Incorrect Reinsurance Premium Processing
A failure in the CLO’s reinsurance controls resulted in the CLO incorrectly paying $148,541 in reinsurance premiums from the HIH estate to General Cologne Reinsurance Company. Specifically, the reinsurance invoice received incorrectly reported the premium rate paid by HIH as 10.4 percent while the agreed-upon rate documented in the reinsurance contract was only 10.2 percent; thus resulting in a $148,541 overpayment from the HIH estate. Insufficient review of billings and verification of rates increase the risk of inappropriate payments and a loss of estate assets.
Recommendation: Review the policies and procedures over the reinsurance billings processes to ensure that controls are in place and functioning including the review and verification of contract stipulations prior to payment of billings.
CLO Response: The analysis and subsequent approval of premium reports submitted to the CLO by the reinsurance community is by necessity a manual endeavor. As with all manual processes, premium calculation errors can take place and sometimes these go undetected.
The Reinsurance Department will implement a procedure whereby certain manual calculations are independently reviewed. A compensating control exists since these calculations are also reviewed by the brokers and errors are identified and corrected before final billings are further processed.
Evaluation of Response: We concur with the CLO’s response.
Ineffective Controls over the Financial Reporting Process
We observed the following weaknesses with the CLO’s financial reporting controls:
The CLO 2002 financial statements and general ledger do not reconcile. This is a recurring condition from the Department of Finance’s 2002 Agreed-Upon Procedures Report. Details of the finding and the CLO’s response are documented within that report, which was issued under separate cover.
The CLO inappropriately excluded information from the 2002 financial statements. This is a recurring condition from the Department of Finance’s 2002 Agreed-Upon Procedures Report. Details of the finding and the CLO’s response are documented within that report, which was issued under separate cover.
CLO Response: The CLO discusses corrections to these two control weaknesses in responses to the DOF Findings IIa, Multiple Version Financial Statements and Incomplete Financial Statements above.
Evaluation of Response: See referenced finding, response, and evaluation of response above.
Section IV
Information Technology Controls
We conducted fieldwork over the CLO’s information technology controls during March 2003. As of March 31, 2003, the CLO’s information technology controls were not sufficient to ensure the overall reliability and integrity of data. However, we recognize the CLO’s efforts in implementing corrective actions since March 2003 through the end of our fieldwork in July 2004. The findings denoted below represent issues identified during our fieldwork, March 2003. For the CLO’s corrective actions implemented, see the CLO’s response included within this report.
FINDING IVa Insufficient Information Technology Policies and Procedures
The CLO’s information technology policies and procedures were last updated in September 2001, and do not reflect current practices. Additionally, the documented procedures do not include the governing of users and their authorized access; remote access into the CLO Network; emergency and temporary access authorization; adding or terminating users from the CLO Network or the AS/400 servers; operation of the CLO Help Desk; providing guidance to employees and contractors for USER ID, passwords, and computer security; Database Management Systems; controls over telecommunications access; nor resource classifications and related criteria.
Recommendation: Ensure all operational processes and procedures are appropriately documented, revised periodically, and maintained in a centralized manual.
CLO Response: The statement that “This is a recurring condition” may confuse uninformed readers of this report. Since Department of Finance will issue reports on both this internal control audit and the 2002 Agreed-Upon Procedures audit at the same time, they will include this same finding in both audit reports. CLO began evaluation and remediation of all findings upon notification, but CLO does not consider the same finding included in two simultaneously issued reports to be a “recurring condition.” CLO will provide similar responses to this same finding in both reports.
Bringing the IT Department’s documentation up to date is well underway. The IT Department policies and procedures manual is currently being updated and will be completed by June 30, 2005.
In addition, the following procedures have been completed since the completion of audit field work: Password policy, User Account Management for Windows, User Account Management for AS/400, Remote Access Policy, and Use of Company Owned Laptops.
Numerous other desktop procedures have also been created since the completion of audit field work. These include: How to Connect to Citrix, How to Add Printers, How to Setup and Configure Client Access/400, How to Use a Modem with Terminal Services, Permissions in Outlook for Specific Folders, Desktop Cloning Procedure, How to Renew a DHCP Lease, How to Remove Additional Permissions in Terminal Services, and How to Configure Static IP Addresses.
In May of 2004, the Information Technology Audit Manual was published to govern the review of transaction history logs as described in finding IVe below.
Extensive GOLD System documentation has been completed since March of 2003 to document the development of the system. This includes design documents, test plans, architectural illustrations, and user guides. Documentation will continue to be produced as enhancements are developed and as application maintenance is performed.
Evaluation of Response: We commend the CLO on its efforts of implementing corrective actions to date.
FINDING IVb Weaknesses in Controls over Information Technology Access Controls
We observed the following weaknesses with the information technology access controls:
1. No access path diagrams are maintained and thus no analysis of the logical access path occurs when the system changes. Users obtain access to data files and software programs through one or more access paths through the networks and computer hardware and software. Accordingly, to implement an appropriate level of security, it is important that the entity, to the extent possible, identifies and controls all access paths to ensure protection of the CLO’s resources.
2. Access to sensitive areas is not adequately controlled. We were able to obtain access to the CLO computer room and computer storage room. Unauthorized access by users could compromise the CLO’s computer network.
Recommendation: 1. Prepare access path diagrams and analyze logical access paths whenever system changes occur.
CLO Response: Logical diagrams of servers, services and key applications will be updated to illustrate and better define the user access paths by April 1, 2005.
Evaluation of Response: We concur with the CLO’s response.
Recommendation: 2. Ensure access to sensitive areas such as the computer room and the computer storage room is adequately controlled and limited to only those with a specific purpose.
CLO Response: The security system database was reviewed in January, 2003. Access was restricted to only those individuals in the IT Department that required access. Access to the computer storage room is more restrictive, however, and the current version of the security system does not permit separate zones to be created for the computer room and supply room, therefore access remains identical. We have ordered a software and hardware upgrade that will permit separate zones. This is scheduled for installation by May 1, 2005. At that time, access to the computer supply room will be further restricted to just the Network Operations group.
Evaluation of Response: We commend the CLO on its efforts of implementing corrective actions to date.
FINDING IVc Weaknesses in Controls over Information Technology Service Continuity
We observed the following inadequate controls over the service continuity area:
1. Lack of an approved Disaster Recovery Plan to restore critical applications after an emergency. The CLO does not maintain a written plan detailing the procedures to be followed in the event of an emergency. Additionally, the CLO lacks policies and procedures detailing emergency processing priorities; training and periodic testing of emergency responses; and reviewing, approving, and issuing of plans that may affect other units. Failure to maintain a plan negatively impacts the CLO’s ability to recover from a disaster and maintain regular operations should an emergency occur, thus affecting the capability to process, retrieve, and protect information.
2. Resources required to support critical operations are not identified. Specifically, we requested information regarding the CLO’s list of servers and applications, computer supplies, system documentation, telecommunications, office facilities and supplies, and human resources to support critical operations. We received a network diagram and hardware diagram from the information technology manager, but never received a listing of the other resources. The lack of identifying and documenting resources required to support critical operations affects the CLO’s ability to effectively and efficiently maintain service continuity.
This is a recurring condition from a prior audit. See Appendix A.
Recommendation: 1. Develop a written Disaster Recovery Plan for all CLO operations. Review and update this plan periodically as well as conduct periodic training and testing.
CLO Response: A Disaster Recovery Plan has been written and will be approved and published by end of May 2005.
Evaluation of Response: We concur with the CLO’s response.
Recommendation: 2. Identify and document resources required to support critical operation. Review and update this listing periodically.
CLO Response: The following diagrams have been created to illustrate critical operations: A diagram illustrating the location of all CLO and estate application databases, a network diagram with IP addresses, and an infrastructure diagram for the network switches. Due to the upcoming telephone cutover, the latter two diagrams are being updated to reflect topology and configuration changes to support IP voice telecommunications. This will be completed by end of April 2005.
Evaluation of Response: We concur with the CLO’s response.
FINDING IVd Inadequate Separation of Duties
CLO job descriptions do not sufficiently segregate duties between programming, testing, and implementation functions within the information technology unit. Additionally, alternative compensating controls, such as management review of work performed and assigning project phases to multiple staff, are not in use, documented, or enforced. As a result, one employee can independently write, test, approve, and implement program changes.
Failure to adequately segregate job functions increases the risk of inconsistencies and errors within operational processes, as well as increases the risk of inappropriate use of CLO resources or theft, loss, or misappropriation of estates assets.
This is a recurring condition from a prior audit. See Appendix A.
Recommendation: Segregate incompatible information technology duties. Ensure the same staff person cannot independently write, test, approve, and implement program changes.
CLO Response: Job descriptions were updated at the last focal review in September 2004 to segregate phases of the system development life cycle between business analysts and programmers. In addition, the organizational structure of the IT Department was altered in September 2004 to segregate the production control function under the Database Administrator who now reports directly to the Chief Information Officer (CIO).
Evaluation of Response: We commend the CLO on its efforts of implementing corrective actions to date.
FINDING IVe Insufficient Monitoring of Information Technology Transaction History Logs
CLO information technology managers do not periodically review information technology transaction history logs or investigate abnormal activity. Additionally, history logs are not maintained but rather deleted. Failure to review and monitor history logs increases the risk that unauthorized transactions may go unnoticed and undetected.
Recommendation: Review transaction history logs daily and investigate abnormal activity. Maintain these history logs in accordance with CLO’s record retention policies or a reasonable length of time.
CLO Response: Regular monitoring of application, system and security logs for Windows servers commenced in May 2004 with the publication of the Information Technology Audit Manual. As per the manual, domain controllers are monitored daily and other servers are monitored weekly. Log history documentation is maintained in folders for quarterly compliance reviews and filed for long-term historical review for up to 2 years.
Evaluation of Response: We commend the CLO on its efforts of implementing corrective actions to date.
FINDING IVf Undefined Profiles for Specific User Groups
The CLO maintains a listing of standard profiles for specific user groups, but specific access afforded to these users is not documented or defined. Thus, the access afforded to a particular group is unknown and therefore inhibits the CLO’s monitoring abilities.
Recommendation: Document and define the specific access afforded to user groups. Revise and update as necessary.
CLO Response: The network was upgraded in June of 2004 to Windows 2000 featuring Active Directory. In conjunction with the upgrade, new user groups were created and improved security was placed over departmental drives and user folders with more detail related to resource access documented in the descriptions and notes fields. By April 30, 2005 the descriptions and notes fields for older groups will be updated to include resource and permissions details.
Evaluation of Response: We commend the CLO on its efforts of implementing corrective actions to date.
CONCLUSION
Our examination of the Conservation and Liquidation Office's (CLO) internal control presents opportunities for CLO management to correct identified weaknesses and improve its operations. We believe internal control would be strengthened and the CLO would operate more efficiently and effectively if management implements our recommendations. The internal control weaknesses, if left uncorrected, increase the risk that material errors or irregularities could occur and remain undetected, and could affect the accuracy of the CLO’s financial statements.
The findings in this report are based on fieldwork performed between June 7, 2004 and July 21, 2004, and March 2003 for information technology controls. We presented our findings and observations to the CLO management and the California Department of Insurance internal auditors upon completion of our examination.
APPENDIX A
SUMMARY OF PRIOR AUDIT FINDINGS
The following table summarizes the status of prior audit findings discussed in Finding IIIa of the Findings and Recommendations section of this report. The statuses of the findings are separated by report: (A) PriceWaterhouseCoopers; (B) State Auditor; and (C) Department of Insurance. Of the 34 findings, we identified 70 issues of which 4 issues pertained to the seizure process, which we did not review, 38 issues were fully resolved, 13 issues are currently in the process of being resolved and/or are partially resolved, 9 issues have not been resolved, and 1 issue has not been resolved because the CLO does not agree with the finding; however, we determined that corrective action is required. The remaining 5 issues will be reviewed in the 2003 AUP or the 2004 AUP, as identified in the table below. Additionally, 7 of the issues are also current findings in our report. Those findings are identified as a Recurring Condition within the table and the Findings and Recommendations section of our report.
A. PriceWaterhouseCoopers (PWC) Report to Management, December 31, 2001
|Finding |Issue |PWC’s Finding |Finding |Resolved? |Comments |
|No. |No. |Description |Category |Yes |In Progress/ |
| | | | | |Partially |
|Finding |Issue |PWC’s Finding |Finding |Resolved? |Comments |
|No. |No. |Description |Category |Yes |In Progress/ |
| | | | | |Partially |
| |10 |CLO does not have policies | | | |
| | |and procedures in place that | | | |
| | |is being consistently applied| | | |
| | |to account for the conversion| | | |
| | |and integration of new | | | |
| | |estates. | | | |
|6 | |Revise Policies and |Operations Oversight | | |
| | |Procedures Manuals for All | | | |
| | |Departments | | | |
|No. |No. |Description |Category |Yes |In Progress/ |
| | | | | |Partially |
| |29 |For some estates, | |Will Review in 2003 AUP. |We will perform |
| | |particularly the Mission | | |testing in our 2003 |
| | |estates, amounts due to the | | |AUP |
| | |IGAs and reserves for future | | | |
| | |amounts due to IGAs recorded | | | |
| | |in the general ledger are not| | | |
| | |reconciled to the IGA | | | |
| | |statements. | | | |
| |30 |Claims files to support | |Will Review in 2004 AUP. |We will perform |
| | |reserve amounts recorded | | |testing in our 2004 |
| | |could not be located or | | |AUP |
| | |portions of a file was | | | |
| | |missing. | | | |
| |31 |The CLO does not have a | | |
| | |formal policy to ensure all | | |
| | |salvage and subrogation is | | |
| | |identified and accrued. | | |
| | | | | |
| | |Recurring Condition, See | | |
| | |Section I, Finding I | | |
| | |2001 Update – Computer | |Our reviews of the Information Technology findings are as of March 31,|
| | |Control Recommendations | |2003. |
|1 | |Segregate Individuals’ Access Between |Information | | |
| | |Testing and Production Environment |Technology | | |
|No. |No. |Finding/Recommendation Description |Category |Yes |In Progress, Partially |
| |48 |To maximize the return on the assets it |Seizures |Not Reviewed by Finance |We did not review. DOI|
| | |manages, the DOI should ensure the CLO | | |performed a specific |
| | |creates or updates closing plans that | | |Seizure review of CLO’s|
| | |include estimates of the future cash needs | | |procedures concurrent |
| | |for each estate. The CLO should use this | | |to our review. |
| | |information to ensure that it reaches its | | | |
| | |goals. | | | |
| |49 |Periodically reevaluate its investment |Invest-ments |X | |
| | |strategy and benchmark to reflect changing| | | |
| | |conditions and requirements | | | |
|No. |No. |Finding/Re|Category |Yes |In Progress, Partially |
| | |commendati| | | |
| | |on | | | |
| | |Descriptio| | | |
| | |n | | | |
|Finding # |Finding |Section |Finding |Finding # |Finding |
| |Conservation and Liquidation Office (CLO) | | | | |
| |Financial Statements And General Ledger Do | |Ineffective Controls over the | |Improve Review Procedures Over |
|1 |Not Reconcile |IIIb |Financial Reporting Process |PWC 1 |Financial Statements |
| |Inappropriate Exclusion From the Financial | | | | |
|2 |Statements | |Footnote 1 | | |
|3 |Incomplete Financial Statements |IIa |Incomplete Financial Statements | | |
| |Inconsistent and Untimely Uploading of New | |Inconsistent and Untimely Uploading | |Enhance Controls and Procedures Over|
|4 |Estates' Balances |IIa |of New Estate's Balances |PWC 4 |New Estates |
| | | |Improper Bank Reconciliation | | |
|5 |Cash Account Variances |IIb |Procedures | | |
| | | |Improper Bank Reconciliation | | |
|6 |Improper Bank Reconciliation Procedures |IIb |Procedures | | |
| | | |Inconsistent Research and Review of | | |
|7 |Long Outstanding Stale Dated Checks |IIa |Outstanding Checks | | |
| |Outdated Written Cost Allocation Methodology| |Insufficient Documentation of | |Revise Polices and Procedures Manual|
|8 | |I |Policies and Procedures |PWC 6 |for All Departments |
| | | |Inconsistent Documentation and | | |
| |Inconsistent Documentation and Performance | |Performance of Investments | |Enhance Investment Reconciliation |
|9 |of Investments Reconciliations |IIb |Reconciliations |PWC 9 |Procedures |
|10 |Unsupported Restricted Pooled Investments | |Footnote 1 | | |
| |Questionable Valuations of Non-Pooled | | | | |
|11 |Investments | |Footnote 1 | | |
| | | | | |Improve Monitoring Procedures to |
| |incomplete and Inaccurate Statutory Deposit | | | |Maximize Interest and Dividends |
|12 |Subsidiary Schedule | |Footnote 1 |PWC 10 |Earned |
| | | | | |Improve Review Procedures Over |
|13 |Inaccurate Posting to the General Ledger |IIb |Insufficient Receivable |PWC 1 |Financial Statements |
| | | |Reconciliations | | |
| | | |Ineffective Controls over the Review | | |
| | | |and Posting of Receivables to the | | |
| | |IIIb |General Ledger | | |
| |Unable to Confirm the Accuracy of Mission | | | | |
|14 |Reinsurance Billings | | | | |
| | | |Incorrect Reinsurance Premium | | |
|15 |Inaccurate Reinsurance Billing |IIIb |Processing | | |
| |Failure to Establish an Allowance for | | | | |
|16 |Uncollectible Receivables | |Footnote 1 | | |
| |Lack of Methodology for Determining | |Insufficient Documentation of | |Revise Polices and Procedures Manual|
|17 |Allowance for Uncollectible Receivables |I |Policies and Procedures: Receivables|PWC 6 |for All Departments |
| | | |Item 2 | | |
| |Failure to Maintain an Aging of Receivables | |Weakness in Monitoring and Collecting| |Improve Monitoring of Reinsurance |
|18 |Report |IIa |Outstanding Receivables |PWC 15 |Recoveries and Payables Activity |
| |Misstated Funds Held By Guarantee | | | | |
|19 |Associations Balances | |Footnote 2 | | |
| |Inconsistent Application of Fund Held by | | | | |
| |Guarantee Associations Calculation | |Footnote 1 | | |
|20 |Methodology | | | | |
| |Failure to Maintain Supporting Subsidiary | | | | |
| |Ledger for the Non-Pooled Accrued Investment| |Footnote 1 | | |
|21 |Income | | | | |
| | | | | | |
|22 |Misposting of Accrued Investment Income | |Footnote 2 | | |
| |Lack of Documentation to Support Other | | | | |
|23 |Assets Accounts | |Footnote 1 | | |
| | | | | | |
|24 |Misstated Balance in Other Assets Accounts | |Footnote 2 | | |
| | | |Insufficient Documentation of | | |
| |Lack of Written Procedures For Compiling | |Policies and Procedures: Financial | |Revise Polices and Procedures Manual|
|25 |Annual Report to the Governor Information |I |Reporting Item 1 |PWC 6 |for All Departments |
| | | | | | |
| |2002 AUP - Other Matters Outside the | | | | |
| |Agreed-Upon Procedures | |Internal Control Review | |Prior Findings, Appendix A |
|Finding # |Finding |Section |Finding |Finding # |Finding |
| | | | | | |
|N/A |Legal Representation Letters Analysis | | | | |
| | | | | | |
|N/A |Multiple Version Financial Statements |IIa |Multiple Version Financial Statements| | |
| | | | | |The CLO Has Poor Practices In Place |
|N/A |Incomplete Year-End Reinsurance Recoverable | | | |To Conserve Assets Of Estates It |
| |Balances | |Footnote 1 |BSA 2 |Manages |
| | | | | |The CLO Has Poor Practices In Place |
| |No Evaluation of Reinsurance Reserves after | |No Evaluation of Reinsurance Reserves| |To Conserve Assets Of Estates It |
|N/A |Conservation |IIa |after Conservation |BSA 2 |Manages |
| | | | | | |
| |Unreconciled Variance Between the CLO's | | | | |
| |General Ledger and the Mission Insurance | | | | |
|N/A |Companies Information Technology System | |Footnote 1 | | |
| | | | | | |
| | | | | | |
| | | | | |The CLO Neither Adequately Protects |
| | | | | |Insurer's Physical Assets Nor |
|N/A |Inadequacies With CLO's Fixed Assets |IIa |Inadequate Monitoring of Fixed Assets|BSA 1 |Ensures That Investment Decisions |
| | | | | |Are Optimized |
Footnotes:
1. Although no specific internal control finding observed, this issue is related to Section II: Insufficient and Inconsistent Practices.
2. Although no specific internal control finding observed, this issue is related to Section III: Ineffective Controls.
CLO REPSPONSE
[pic]
[pic]
[pic]
EVALUATION OF REPSPONSE
We are in receipt of the Conservation and Liquidation Office’s (CLO) response, dated March 30, 2005, to our draft report on the CLO’s Internal Control. The CLO’s responses, along with our evaluations are incorporated into the body of this report. In evaluating the CLO’s response to our draft Internal Control Review report, we provide the following comments.
The CLO provided information relating to the continuity of management at the CLO over the past 11 years. We recognize that the CLO has had numerous Chief Executive Officers as well as Chief Financial Officers that may have had a negative impact on internal controls and procedures. However, the CLO is appointed by the Commissioner of the California Department of Insurance to act as the liquidator of insolvent insurance companies on his behalf. As such, the Commissioner has a fiduciary responsibility to oversee the operations of the CLO in ensuring that continuity is maintained with the financial operations of liquidating estates regardless of the frequent change in management.
In 2002, the CLO requested our office to reconvene the examination of the CLO’s books and records in accordance with California Insurance Code Section 1061. At this time, many discussions were held with CLO management regarding the basis of accounting followed and presentation of financial statements. Because of the many departures from Generally Accepted Accounting Principles (GAAP) in the presentation of financial statements based on the GAAP liquidation basis of accounting, the CLO management expressed its desire to report on an alternative basis. The CLO chose to report and maintain their financial records on the modified-cash basis of accounting. As such, and as documented in our Agreed-Upon Procedures, we performed our internal control review and Agreed-Upon Procedures reviews for 2002 and 2003 on this basis.
Preface
The CLO recommended changes to the preface. We incorporated certain changes to the Preface section of this report in an effort to clarify the roles and responsibilities of the Department of Insurance and the CLO.
Executive Summary
The second paragraph, third sentence was revised to read “When corrected, these controls will reduce the CLO’s exposure to risk of errors, irregularities, and material misstatements in the financial statements.”
Independent Auditor’s Report
The fifth paragraph was revised to read “Subsequent to the completion of our fieldwork in July 2004, but prior to the issuance of our draft report, we became aware of events occurring at the CLO that we feel require disclosure. Specifically, during August 1, 2004 through February 1, 2005, key figures within the CLO organization have resigned or have been terminated. These positions, including the Chief Executive Officer and the Chief Financial Officer, represent 34 percent of the CLO organization’s management team. The changes within the CLO have resulted in the reorganization of certain units, elimination of positions, and hiring of new staff. As such, these changes may impact the results of our examination as described within this report.”
................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related searches
- south dakota school report card
- state of tn report card
- state school report card
- student report cards samples
- kentucky school report cards
- wisconsin school district report cards
- wisconsin state school report cards
- tennessee department of education report card
- tennessee report card
- texas school report cards
- tn education report card
- tn report card data