Douglas A. Ducey Craig Brown, Governor Director ARIZONA DEPARTMENT OF ADMINISTRATION 100 NORTH FIFTEENTH AVENUE « SUITE 400 PHOENIX, ARIZONA 85007 ‘September 21, 2017 William Thorpe ‘Thorpe Shwer, P.C. 3200 North Central Avenue, Suite 1560 Phoenix, AZ 85012 Dear Mr. Thorpe: Tam writing to follow-up on the Confidential Draft Report presented to the Board of Cosmetology Chair on August 17. The Board has failed to provide a response by the agreed upon date of September 8°. Aceordingly, due to the very serious nature of the findings and the financial liability to the State, we have inactivated the Executive Director’ Purchasing Card and Travel Card, and are revoking your Delegation of Procurement Authority. This action is effective immediately and remains in place until further notice, in the interest of ensuring the proper and ethical use of public dollars. Violations uncovered by the Department’s recent investigation include not only inappropriate use of the Board’s debit card equivalent (Purchasing Card), improper recording, and subsequent reimbursement for travel by board members and staff (Travel Card), but also several accounts of improper usc of the Executive Director's delegation authority. ‘The numerous violations conflict with the State Employee Code of Conduct, the State Accounting Manual, and state law. This investigation follows regular improper use of state fleet vehicles by Board of Cosmetology employees in 2016 which ultimately led to the complete forfeiture of the Board’s authority to use state fleet vehicles. As such, the State must act in its own right to mitigate potential liability by revoking all aforementioned authority in full and until further notice. At the request of the Board, a deadline for responses was extended to September 8°, Due to the inaction of the Board, the finalized investigative report provided does not include any responses. Should the Board choose to provide overdue responses to the Department’s General Accounting Office, my team remains available to review and assist accordingly. As previously stated, as the Board's subsequent responses may bbe deemed inadequate to properly mitigate the related risks, further action may still be warranted. If you have any questions or need any additional information, please call me at (602) 542-1500, "Thank you. Sincerely, Craig Brown Director, Arizona Department of AdministrationSeptember 21, 2017 Page 2 of 2 ce: Gary Begley Jessica Rainbow Melissa Porter Nicole Colyer ‘Mara Mellstrom Ashoke Seth Karla Clodfelter Charlie Phan ‘Thomas Rough Clark Partridge Elizabeth Thorson.Douglas A. Ducey Craig C. Brown Governor Director ARIZONA DEPARTMENT OF ADMINISTRATION GENERAL ACCOUNTING OFFICE 100 NORTH FIFTEENTH AVENUE » SUITE 302 PHOENIX, ARIZONA 85007 Prone: (602) 542-8601 « Fax: (602) 542.5749 September 21, 2017 Gary Begley, Board Chair Arizona State Board of Cosmetology 1721 B. Broadway Road Tempe, AZ 85282 Mr. Begley: ‘The General Accounting Office (GAO) of the Arizona Department of Administration (ADOA), in ‘cooperation with the ADOA Human Resources Division (HRD) and the ADOA State Procurement Office (SPO), has conducted a review of intemal controls and operations of the Arizona State Board of Cosmetology (BOC). This review was conducted pursuant to Arizona Revised Statutes (A.R.S.) § 41-735 with emphasis on compliance with certain sections of the State of Arizona Accounting Manual (SAAM) and on the internal controls over travel, purchasing cards, and employee travel cards. In general, our review focused on FY16 and FY17 activity. A previous review of matters brought to ADOA’s attention that were referred to the HRD and the SPO, were addressed with management. The matters set forth below and explained in detail in the report's subsequent pages came to our attention, asa result of those conversations, that warrant further management consideration and relate to the following: ‘Adherence to Travel Policies Purchasing Cards Independent Contractors Procurement Delinquent Payments Improper Use of State-Issued Cell PhonesLetter: Gary Begley September 21, 2017 Page 2 ‘Concerns Concerns involve matters that, by their nature, materiality of amount, or frequency of occurrence, may expose the State to significant risk. Relevant citations of laws, rules, and/or policies are provided in parentheses for each point. TRAVEL Background: State travel policies exist to ensure that travel expenses incurred while conducting business for the State of Arizona are authorized, necessary, reasonable, and appropriate. Agency management and all those traveling on State business should be familiar with, and understand, the State’s travel policies. ‘An Employee Travel Card (ETC) may be issued to State employees to pay for expenses incurred in ‘connection with authorized travel for the State. The ETC is a personal-liability card. Employees are reimbursed for travel expenses by submitting a travel claim with the required receipts and documentation. Employees with an ETC receive a monthly billing statement from the issuing bank and are responsible for ‘using their travel reimbursements to help pay the statement balance in full. For delinquent ETC account balances, the issuing bank can recover the balance by reducing card incentives paid to the State, Concerns 1, Travel Reimbursements © The Executive Director was reimbursed for meals during out-of-state travel when meals were provided by conferences and hotels. The Executive Director was also reimbursed for meals at the beginning and end of out-of-state travel that were not eligible for reimbursement under the State's criteria for travel status (SAM 5025). © Some employees were reimbursed for meals while driving to local-area inspections and investigations that were not eligible for reimbursement under the State's criteria for travel status (SAAM 5025), © The Executive Director was reimbursed for mileage more than what appeared reasonable ‘on two separate trips to Laughlin, Nevada (SAAM 5015). ‘© One board member was reimbursed for more than double the actual trip mileage on two separate occasions. Both travel claims were reviewed and approved by the Executive Director (SAAM $015). ‘© One employee was reimbursed twice for the same travel claim, resulting in an overpayment of $1,094.46. The discrepancy was not detected or corrected by the BOC (SAAM 5005). The employee has since retied. 2. Travel Planning and Travel Decisions © When traveling out-of-state for conferences, the Executive Director sometimes arrived earlier or departed later than appeared reasonable. In some cases, the conferences ended at 12:00pm one day and the Executive Director left the following day. This resulted in additional reimbursements of meals, transportation, and lodging. There were no documented explanations for arriving early or departing later (SAAM 5006),Letter: Gary Begley September 21, 2017 Page 3 ‘The Executive Director made two trips to Laughlin, Nevada on weekends to conduct licensee inspections and investigations in northern Arizona, in-lieu-of sending an inspector or investigator during the week. There were no documented explanations as to why it was prudent for the Executive Director to conduct the inspections and investigations (SAAM 5006). 3. Travel Review, Approval, and Documentation ‘The Executive Director approved her own travel claims for two out-of-state trips (SAAM 0505). ‘The supporting documentation for all out-of-state travel claims did not include the required Out-of-State Travel Approval Requests (Form GAO-509). The Executive Director stated the forms were completed but they could not be located (SAAM 5007). One travel claim was filed by a board member approximately 6 months after the trip. The BOC did not process a Form GAO-513 for the delinquently filed travel claim, which would have required approval by the State Comptroller (SAAM 5056). Based on our review of departures from travel policy, it appeared that the BOC had inadequate knowledge of relevant travel policies and inadequate review procedures in place to verify that travel claims were allowable, accurate, reasonable, timely submitted, and included all required documentation (SAAM 5007). 4. Employee Travel Cards (ETC) Based on our review of ETC charges and travel reimbursements, it appears that some ‘employees frequently used their ETC for personal purchases. For example, we noted that 56 out of 105 purchases on the Executive Director’s ETC occurred while not in travel status, These included purchases at grocery stores, convenience stores, retail stores, and fueling stations (SAM 5051). ‘The BOC did not adequately review the ETC charges and payments of all cardholders monthly. As a result, some irregularities were not detected. For example, there were late payment charges on the Executive Director's ETC account for delinquent balances on 5 different occasions (SAAM $051). 5, Other Travel Concems For two trips to Laughlin, Nevada by the Executive Director, the GAO requested the related inspection and investigation records to support the explanation for travel. The records were not forthcoming. Approximately 30 hours had passed before some of the requested records were provided. In addition, the information provided was incomplete. For example, the GAO examined some inspection files for the two above-mentioned trips and discovered inspection checklists that were not previously provided by the BOC. This lack of disclosure appeared to thwart the GAO's authority provided by A.R.S. § 41-735 For a conference trip to Minneapolis, Minnesota, the Executive Director traveled there a few days early to visit family. According to payroll records, one of the personal days was reported as a regular work day. Based on a discussion with the Executive Director, we ‘determined there was no State travel or business conducted on that day (SAAM 5005).Letter: Gary Begley ‘September 21, 2017 Page 4 CARDS Background: To facilitate the purchase of goods and services and to provide an efficient method of paying for these goods and services, the BOC utilizes state-issued Purchasing Cards (P-Cards). P- Cardscan be used to make purchases online or in stores, similar to using a credit card in a merchandise store. The BOC has two P-Card holders, which are the IT Manager and Executive Director. Concerns 1. Intemal Controls Over P-Cards + The P-Card issued to the Executive Director was used primarily by three different people, which is probibited by policy and is inconsistent with intemal control standards (SAAM 4535; 0505). ‘© The Accounting Manager maintained custody of the Executive Director's P-Card, was authorized to use the P-Card, and recorded and reconciled the P-Card transactions. There ‘was no independent review process for the P-Card reconciliations (SAAM 0505). ‘© The BOC did not have agency-specific P-Card policies and procedures (SAAM 4536-4). 2, Purchases Not For Valid Public Purpose ‘© Some purchases made with the Executive Director's P-Card were not for a valid public purpose. This included occasional purchases of food for employees, holiday decorations, treats and beverages for board mectings, and gifts for conference attendees. During our discussions with BOC staff regarding these transactions, it came to our attention that they also purchase similar items using their petty cash fund (SAAM 4520). We noted that this, ‘compliance concem was previously reported to the Executive Director in a GAO report dated June 3, 2011 INDEPENDENT CONTRACTORS Background: An independent contractor is defined as an individual who agrees to work for others without having the legal status of an employee. By engaging independent contractors, employers can avoid many of the cosis associated with hiring employees, such as paying Federal and State payroll taxes, providing workers’ compensation insurance, and other benefits. Prior to engaging an individual, agencies should review the nature of the working relationship to determine if the individual should be categorized as an employee or an independent contractor under criteria set forth by federal agencies. An incorrect employment categorization can result in significant and unfavorable financial consequences. Concerns 1. Contracted Retirees ‘© The BOC engaged, as independent contractors, two retired State employees who previously provided services to the BOC. It appears that these individuals were inappropriately categorized under criteria set forth by the Internal Revenue Service and/or the U.S. Department of Labor (SAAM 5506). ‘¢ The BOC has not been making alternative contributions to ASRS on behalf of the two above-referenced contracted retirees. Alternate contributions to ASRS are required for contracted retirees who return to work in a position for which retirement contributions to ASRS would otherwise be paid, irrespective of retirement dates (SAAM 5545),Letter: Gary Begley September 21, 2017 Page 5 he State Procurement Office (SPO) delegates procurement authority to agencies. The agencies must submit to the SPO any procurement that exceeds their delegated authority. Additional requirements exist relating to methods of source selection, as described in the Arizona Procurement Code. Concerns 1, Delegation of Authority * The BOC executed contracts with two independent contractors that exceeded its delegated authority of $10,000 without submitting the procurement to the SPO (A.A.C. R2-7-202), 2. Methods of Source Selection «The BOC procured services of two independent contractors without adhering to appropriate source selection requirements. For example, the BOC entered a contract with 2 part-time independent contractor for services at a cost of $85 per hour without involving the SPO or documenting the method of selection and justification (A.RS. § 41- 2532 and A.A.C. R2-7-£301). OTHER CONCERNS 1. Delinquent Payments * The BOC has frequently incurred late fees because of overdue balances owed to vendors. ‘This includes late payments to SRP, US Bank, Staples, and Konica Minolta. In one instance, an overdue balance to SRP resulted in a temporary disconnection of utility services (ARS. § 35-342). 2. Improper Use of State-Issued Cell Phones «The Executive Director and one other BOC employee utilized their State-issued cell phones for personal purposes because they did not own personal cell phones. The BOC 4id not have a policy for proper use of ceil phones provided to BOC employees. In addition, the BOC did not have an adequate process for reviewing records of call activity to affirm proper use (SAM 5560),Letter: Gary Begley September 21, 2017 Page 6 BOC management is responsible for establishing and maintaining an effective system of internal controls ‘and accounting procedures to provide reasonable assurance that all transactions are properly recorded, that relevant laws and policies are followed, and that assets in its custody are protected from loss or misuse. Our review may not detect—and should not be relied upon to detect—all deficiencies, errors, and irregularities that may exist in a system of internal controls and accounting procedures that may result from such deficiencies. ‘The results contained in this report are based upon conditions in effect at the time period under review. Changing circumstances may render currently satisfactory procedures and controls inadequate inthe future. ‘Weaknesses in internal controls and deficiencies in accounting procedures are situational—they involve incompatibilities of positions and responsibilities, irrespective of the individuals who may hold such positions or have such responsibilities. ‘To date, no responses to these concerns have been submitted. Should the Board choose to provide overdue responses to this report, they will be reviewed appropriately. I remain available to assist you and can be reached at (602) 542-5408. Sincerely, DA LA D. Clark Partridge State Comptroller ce: Craig C. Brown, Director Mia Buller, Office of the Auditor General Ashoke Seth, State Procurement Administrator