Full Text
2019 Assessment of the Effectiveness of Internal Controls ACDA’s Major Business Functions: The mission of ACDA remains unchanged from its inception… ‘Authority Mission Statement- (ACDA) goal is to provide suitable living environments and economic opportunities for persons of low and moderate income, and secures and administers community development funds to increase homeownership and property rehabilitation efforts.’ The mission is accomplished primarily through the receipt through the City of Albany of HUD CDBG, HOME, HESG and HOPWA funds. During 2016 a 3-year period lead hazard grant was awarded to ACDA. The grant period began 11/1/16 and was extended during 2019 to encompass a 4th year. During 2017 ACDA was awarded a $300,000 NYS grant; however the project related to the grant did not begin until 2018. Eligible activities were performed on this project in 2019 and will continue into 2020. Program income is earned through the use of the Federal funds received and is programmed under the same rules for the HUD monies. All income received, regardless of source is subject to the same requirements of the mission. The HUD national objectives ACDA applies to the HUD funds are applied to the organization as a whole. No changes have occurred with respect to the primary funding sources, mission or objectives of ACDA during 2019. Each year ACDA must complete a Federal CAPER report (due 8/31) that ensures the monies going through ACDA adhere to the stated objectives and are fitting with an annual plan as well as within an applicable 5-year plan. All employees are aware of the mission and as any new employees become involved, they are provided the various policies and procedures that enable them to perform their duties. There were no new employees added during 2019. Periodic staff meetings also take place to ensure staff members are abreast of any changes in rules and regulations. Risks Associated with ACDA Operations: Given the environment in which ACDA operates whereby there is considerable outside monitoring completed by both HUD and financial auditors as well as a highly public annual presentation, review and approval process for expenditure plans that involves internal staff, City of Albany management, City of Albany Common Council and City of Albany public input, and the significant number of internal approvals required at a transactional level, risks are deemed to be low for all activities and functions within ACDA. A review for 2019 finds no change to the differing levels of involvement and approval. The City of Albany IT department who manages all of ACDA’s systems has implemented the protections, as much as able, to protect the data and information housed within ACDA. IT department personnel periodically provide cautionary information with respect to receipt of electronic documents and requests. ACDA uses a cloud-based accounting system. This was done after research into the controls in place at the provider level as well as the provider reputation for data security. Operations with respect to the accounting system during 2019 went smoothly and the cloud-based system has operated as expected. The software vendor requires periodic password updates and consistently upgrades the system. A limited number of people, all of which have direct accounting related responsibilities, continue to have access to the accounting system. The technological systems and their protections were tested during 2019 as the City of Albany had a ransomware attack. With respect to ACDA operations, there was no negative impact. As a result of the use of the cloud-based accounting system, the attack did not involve the ACDA accounting system. Additionally, the City of Albany had alternative methods ---PAGE BREAK--- in place for tracking staff time and attendance and for producing the payroll that is ultimately billed to ACDA for employees working on ACDA operations. Other systems used by ACDA had backups and as such, were restored. During 2019, personnel risks have been assessed and also deemed to be low. As noted previously, the number of authorizations needed combined with the internal controls that have been implemented (as more fully described below) in combination with ACDA employees needing to adhere to all City of Albany employee policies and ethics requirements maximizes the minimization of personnel risks. Those working at ACDA have remained consistent during 2019. Internal Control Systems in Place There has been longstanding a set of policies, procedures and guidelines in place at ACDA that are designed to ensure ACDA’s mission is carried out in full and to minimize risk. These items remain in place during 2019. Some of the key internal controls in place include: The level of input into how ACDA’s monies are expended include both internal management, City management, City of Albany Common Council and the public and are subject also to HUD review. Internally there are several layers of approvals that encompass management at the highest level to the individuals responsible for the applicable area to compliance required for all transactions. Division of duties is employed whenever possible. Monies flow in primarily via Federal draws that have separate approval processes and for which support for the corresponding expenditures are required. Most deposits come in the form of electronic deposits as opposed to the receipt of checks, which decreases the risk of theft or delay in deposits. ACDA does not accept cash. ACDA’s personnel structure in of itself allows for mitigation of risks in that there are separate departments for the handling of the various aspects of transactions. ACDA employs a compliance officer specifically charged with ensuring ACDA’s transactions and decisions are allowable with respect to the applicable rules and regulations tied to each funding source. Reports are provided to both management and the City of Albany and for HUD grants, which entail the majority of ACDA’s transactions, detailed information is entered into a HUD system that is then subject to HUD review. ACDA utilizes the City of Albany IT department who employs personnel with the credentials to safeguard the IT systems of ACDA. ACDA is also housed in a building that is kept secure and with appropriate levels of insurance. ACDA is subject to HUD and other grantor monitoring and annually has a financial audit. The financial audit provides an opinion on the financial statements of ACDA and also encompasses an audit based assessment of internal controls. As a public authority, ACDA is also subject to the NYS Authority Budget Office’s guidelines and has reporting responsibilities under the Public Authorities Accountability Act. ACDA regularly sends various personnel to trainings on the pertinent rules and regulations that apply. Additionally, personnel with backgrounds and experience to apply to such functions as helping identify such items as legal or financial risks are involved. Extent to Which the Internal Control System is Effective Management has reviewed the internal control system for 2019 and finds that the items as outlined above remain in place and functioning as expected. ACDA’s most recent financial audit (for the calendar year 2018 and the year then ended) identified no material weaknesses or significant deficiencies. Policies and procedures in place are deemed sufficient. As noted ACDA regularly reviews updates to grantor rules and regulations and continues to work to have all staff knowledgeable on any changes in a timely fashion. ACDA consistently reviews controls. Assessment completed December 2019 as completed by the Director and Fiscal Management