Vendor Master File City Auditor Report - Recommendations for July 1, 2021 to July 21, 2022

Sep 11, 2026

Upload by Dipper

A desk audit of the Vendor Master File covering July 1, 2021 through July 21, 2022 assessed whether adequate controls existed over vendor setup, modification, and maintenance. The review found Finance generally had appropriate controls and access controls, but inconsistently followed vendor policies. Key gaps included missing W-9s for eligible vendors, lack of annual conflict-of-interest cross-referencing, failure to implement duplicate-vendor resolution procedures, and no action on identified inactive-vendor accounts.

LanguageEnglish

CategoryForms

FormatPDF

Pages11

Reading Time4 min

AccessFree to download

Executive Summary and Observations

Detailed Observations

Moderate-Risk Observations

Appendices

A – Background, Objectives, and Scope

B – Data Reliability and Risk Rating

C – Standards and Acknowledgements

Vendor Master File City Auditor Report September 30, 2022 Table of Contents | City Auditor Report | | | --- | --- | | Executive Summary and Observations | Page 3 | | Detailed Observations | Page 4 | | Moderate-Risk Observations | Page 4 | | Appendices | | | A – Background, Objectives, and Scope | Page 9 | | B – Data Reliability and Risk Rating | Page 10 | | C – Standards and Acknowledgements | Page 11 | Figure 1 Vendor status in Munis as of July 21, 2022, shows 88 percent of 5,083 total vendors were active 1 Stop vendor status prevents the use of the vendor on requisitions, purchase orders, and invoices . 2 Other vendors include vendors w ith temporary, inactive, one-time pay, and vendor selfservice status . Source: City Auditor Department staff analysis of Munis vendors as of July 21, 2022. Executive Summary and Observations | Executive Summary | | | --- | --- | | As part of the City Auditor Department’s (CAD) FY2022-2023 Annual Audit Plan, a desk audit of the Vendor Master File for July 1 , 2021 , to July 21 , 2022 , was performed. The purpose of the audit was to determine whether adequate controls were in place over vendor setup, modification, and maintenance processes to prevent duplicate payments, errors, and unauthorized transactions. The audit is part of the CAD’s continuous auditing program in which professional judgment and CaseWare IDEA software are used to periodically test a sample of high-risk transactions based on the nature of the transaction type. Previously, in April 2019 , the Vendor Master File controls were addressed in the Accounts Payable Continuous Review Program audit report.
Overall, the Finance Department (Finance) has controls over the setup, modification, and maintenance of its Vendor Master File. Additionally, access controls to the Vendor Master File were adequate. However, not all policies and procedures were consistently followed, and some controls require strengthening. Specifically, Finance did not maintain W-9s for all eligible vendors and it did not follow the City’s Conflict of Interest Employee Policy Manual (EPM) policy 9.2 that directs it to cross-reference employee data with vendor data to check for possible conflicts of interest on an annual basis. Further, although Finance had a policy to detect and resolve duplicate vendor records in the City’s financial system (Munis), it did not implement the policy during FY2021-2022 through July 21 , 2022. Lastly, approximately two years ago, Finance’s Accounts Payable (AP) Division reviewed the Vendor Master File for inactive vendor accounts but did not act on the 1 , 123 accounts it identified.
As a result, this report makes recommendations to implement and consistently follow vendor policies and procedures and to establish controls over inactive vendors. Further, by establishing controls over inactive vendors that were never used or not used within an established period, Finance can improve the efficiency of its other review processes, like its reviews for duplicate vendors, conflict of interest, and potential double payments.
Refer to Appendix A for more information about the Vendor Master File. | | | Observations | Observation Risk Rating | | 1. Finance did not consistently follow its vendor setup, modification, and maintenance policies and procedures because it: | | | a. Did not maintain W-9s for all eligible vendors. |
| | b. Did not cross-reference employee and vendor data to identify possible conflicts of interest. |
3

2
| | | | | 2. Finance did not implement its policy to detect and resolve duplicate | | | vendor records in Munis. | | | 3. Finance did not take action on the 1 , 123 active vendor accounts identified during AP’s review for inactive vendors. | RISK
Audit observations have been assigned a qualitative assessment of high, moderate, or low priority based on the need for action or correction. Refer to the rating definitions in Appendix B. | Detailed Observation – Mode

FAQs

What was the audit scope for the Vendor Master File?

The audit covered vendor setup, modification, and maintenance from July 1, 2021 to July 21, 2022.

What control gaps were identified in vendor setup and maintenance?

Finance did not consistently maintain W-9s for eligible vendors and did not cross-reference employee and vendor data for annual conflict-of-interest checks as required.

What recommendations were made based on moderate-risk observations?

The report recommends implementing and consistently following vendor policies and procedures, including actions on missing W-9s, conflict-of-interest cross-referencing, duplicate vendor resolution, and controls over inactive vendors.

Sep 11, 2026

Upload by Dipper