The Office of Internal Performance Audit Internal Audit Report PPS

The Office of Internal Performance Audit

Internal Audit Report

PPS Automated Clearing House (ACH)

Payment Method Audit

January, 2021

Internal Performance Audit Report

ACH Audit

PPS Automated Clearing House (ACH) Payment Method Audit

Page 2 of 9

Table of Contents

Letter of Transmittal ………………………………………………….…………………………..3 - 4

ACH Payment Method Audit Report ……………………………………………………………5 - 6

Appendix A – Memo to the Audit Committee ………………………………………………….7 - 9

Internal Performance Audit Report

ACH Audit

PPS Automated Clearing House (ACH) Payment Method Audit

Page 3 of 9

Letter of Transmittal

January 13, 2021

Portland Public Schools

Audit Committee

501 North Dixon Street

Portland, OR 97227

At the October 9, 2019 meeting of the Audit Committee, Deputy Superintendent Claire Hertz

requested the Audit Committee to add the Automated Clearing House (ACH) Payment Method

Audit to the 2019-20 Audit Plan. The Audit Committee reviewed, supported the addition to the

Audit Plan, and recommended the addition of the ACH Payment Method Audit to the Board of

Education for approval. The Board of Education approved this addition on October 29, 2019,

via Resolution No. 5988.

The objective of the ACH Payment Method Audit was to determine whether internal controls over

the District’s ACH payment process, follow best practices in design, and are working efficiently

and effectively to mitigate potential fraud and safeguard District funds.

On Friday, August 16, 2019, Portland Public Schools (the District) experienced a fraudulent

transaction attempt through its ACH payment method in the amount of approximately $2.9

million in District funds. The Portland Police, the FBI, and PPS’ partners at its banking

institution quickly responded and recovered all District funds.

Due to the fraudulent transaction attempt, the District suspended enrolling new vendors in the

ACH payment program. The District also suspended making changes in vendor payment

account information that participate in the ACH payment program. And, if a change to the

vendor account information was requested, the District removed the vendor from the ACH

payment program and made subsequent payments to the vendor via check until further notice.

As of the end of our field work (November 2020), the District has not restarted its ACH payment

program. As a result, we reviewed internal controls related to the setup of new vendors to the

ACH payment program and account information changes for vendors who are enrolled in the

ACH payment program; however, testing of these controls was not performed.

The Office of Internal Performance Audit has completed the ACH Payment Method

Audit. Based on the results of work performed within the scope of the audit, it is our opinion

that, overall, the internal controls over the District’s ACH payment program follow best practices

in design, and are working efficiently and effectively to mitigate potential fraud and safeguard

District funds. Minor items that were not of a magnitude to warrant inclusion in the report were

discussed verbally with management.

Internal Performance Audit Report

ACH Audit

PPS Automated Clearing House (ACH) Payment Method Audit

Page 4 of 9

Auditing standards require that we obtain sufficient, appropriate evidence to provide a reasonable

basis for our findings and conclusions based on our audit objective. We believe that the evidence

obtained provides a reasonable basis for our findings, if applicable, and conclusions based on our

audit objective.

We extend our appreciation to the staff within Finance Department and the Office of Information

Technology for their assistance and cooperation during the course of the audit.

We look forward to discussing the report with you at an upcoming Audit Committee

meeting. Thank you for your ongoing support of the Office of Internal Performance Auditing.

_Janise Hansen_ Marry Catherine Moore

Janise Hansen, CIA Mary Catherine Moore

Senior Internal Performance Auditor Internal Performance Auditor

Internal Performance Audit Report

ACH Audit

PPS Automated Clearing House (ACH) Payment Method Audit

Page 5 of 9

ACH Payment Method Audit Report

Background Information

The Automated Clearing House (ACH) Network is an electronic funds transfer process between

bank accounts. The ACH Network essentially acts as a financial hub and helps people and

organizations move money from one bank account to another. ACH transactions consist of

direct deposits and direct payments.

The District utilizes the ACH Network to process approximately $269 million and $353 million in

payments for the 2018-19 and 2019-20 fiscal years respectively.

In August of 2019, the District experienced a fraudulent transaction attempt through its ACH

payment method in the amount of approximately $2.9 million in District funds. In a memo to the

Audit Committee, the District detailed actions taken, to address the fraudulent transaction

attempt. The full memo is included in Appendix A. Below is a list of some of the actions taken

by the District’s Finance Department:

• Immediately stopped all ACH payments and verified the accuracy on all accounts that

were scheduled to be paid on the week of August 19, 2019 and verified the accuracy on

all accounts scheduled for payment this week and any ACH change requests submitted

in the past six months.

• Finance Department reviewed existing protocols and procedures related to the process

for paying suppliers via ACH and updated their internal controls and approval levels.

• Updated the staff training materials and conducted a mandatory training on Fraud

Awareness.

• Removed the ACH Enrollment form from the District’s website.

Additionally, Deputy Superintendent Claire Hertz requested the District’s Office of Internal

Performance Audit perform the ACH Payment Method Audit. The Audit Committee reviewed

and supported the addition of the ACH Audit to the District’s Office of Internal Performance

Audit, and agreed to present it to the Board of Education for approval. The Board of Education

approved this addition on October 29, 2019, Resolution No. 5988.

Roles and Responsibilities

District Accounts Payable management has the primary responsibility to establish, implement,

and monitor internal controls. Internal Audit’s function is to assess and test those controls in

order to provide reasonable assurance that the controls are adequate and operating effectively.

We conducted this performance audit in accordance with Generally Accepted Government

Auditing Standards (GAGAS, aka Yellow Book). Those standards require that we plan and

perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our

findings and conclusions based on our audit objective. We believe that the evidence obtained

provides a reasonable basis for our findings and conclusions based on our audit objective.

Audit Objective(s)

The objective of the ACH Payment Method Audit was to determine whether internal controls over

the District’s ACH payment process, follow best practices in design, and are working efficiently

and effectively to mitigate potential fraud and safeguard District funds.

Internal Performance Audit Report

ACH Audit

PPS Automated Clearing House (ACH) Payment Method Audit

Page 6 of 9

Scope of the Audit

ACH payments made in January 2020 and vendor information changes from January 2020

through May 2020.

Audit Approach and Methodology

To achieve the audit objectives, we performed the following procedures:

• Planned the audit in cooperation with the Finance Department to ensure that we had an

understanding of the District’s accounts payable processes, policies and procedures.

• Reviewed processes/actions taken by the District (as detailed in the memo to the Audit

Committee – see Appendix A) after the attempted ACH fraudulent activity in August

2019.

• Reviewed the reports issued by a global cyber security consultant contracted by the

District to perform an investigation after the attempted ACH fraudulent activity.

• Reviewed any internal investigations that were performed.

• Inquired with PPS’ Office of Technology and Information Services (OTIS) to determine if

any security improvements were implemented or tested to prevent future malicious

attempts.

• Analyzed available data to corroborate the information obtained during our

walkthroughs.

• Reviewed applicable PPS Accounts Payable Internal Control Narrative and PPS

Purchases and Accounts Payable Policy and Procedure.

• Drew on criteria from suggestions made by the District’s financial institution.

• Gathered information on ACH payment processing best practices and how to combat

fraud from external sources.

• Verified that all Finance staff members completed the mandatory Fraud Awareness

training.

• Reviewed segregation of duties in the Finance Department.

• Reviewed appropriateness of Finance staff’s access to the District’s financial system.

• Utilized a sampling methodology with 95 percent confidence level to select 42 ACH

transactions that occurred in January 2020 for testing of ACH payment transactions, and

20 vendor information changes from January 2020 through May 2020.

• Performed tests and analysis of the objective areas to support our conclusions.

Conclusion

Based on the results of the audit, overall we found the District’s internal controls over ACH

payments follow best practices in design and appear to be working efficiently and effectively to

mitigate potential fraud and safeguard District funds. Testing of the Districts internal controls for

setting up new vendors to the ACH payment program and updating ACH payment information

was not completed. When the District has resumed the process for setting up new and updated

ACH payments, the Office of Internal Performance Audit will test these internal controls and issue

an updated audit report.

Internal Performance Audit Report

ACH Audit

PPS Automated Clearing House (ACH) Payment Method Audit

Page 7 of 9

Appendix A: Memo to the Audit Committee

Internal Performance Audit Report

ACH Audit

PPS Automated Clearing House (ACH) Payment Method Audit

Page 8 of 9

Internal Performance Audit Report

ACH Audit

PPS Automated Clearing House (ACH) Payment Method Audit

Page 9 of 9