KPMG Forensic (KPMG) was engaged by the DeKalb County Board of Commissioners (BOC) to review DeKalb County's Purchasing and Procurement Process. KPMG reviewed the December 10, 2004 and January 22, 2008 Policy/Procedure for Purchasing Administration (“Policy”), the DeKalb County Code Sec. 18: Purchasing; contracts. Additionally, we reviewed the November 14, 2007 Internal Audit Report and November 21, 2007 Addendum, and the Internal Audit Work Papers.

After reviewing these documents and obtaining an understanding of the procurement process in Oracle, KPMG gathered and reviewed all available contracts for four Information Systems (“IS”) vendors: Basic Commerce and Industries (“BCI”), EMA, Inc (“EMA”), ISPA, Inc (“ISPA”), and Scicom Infrastructure Services, Inc (“Scicom”). Additionally, KPMG gathered purchase order (PO) data for the above IS vendors.

After reviewing these four vendors, KPMG selected a sample of an additional twenty-nine vendors from nine different service categories within Oracle. KPMG performed the following procedures on the thirty-three vendors:

• Gathered PO data for the thirty-three vendors (2,184 POs)
• Reviewed a sample of 140 POs to determine if appropriate procedures were followed
• Reviewed all POs to determine if any other inconsistencies could be identified
• Reviewed all available contracts for the thirty-three vendors (91 contracts)
• For each vendor, compared total amount paid to the total value of all contracts
• Had discussions with outside IS vendors (BCI and Scicom)
• Conducted background checks to determine if a business relationship exists between any relevant party

During our review, KPMG had discussions with county employees from the following departments: Purchasing, Contracting, Finance, Internal Audit, Office of BOC, IS, Human Resources, Fleet Maintenance, Police Department, and CEO's office.

KPMG discovered the following findings:

• There is a lack of consistency between the Policy and Code; therefore, certain procurement procedures were not being adhered to since it is unclear which document should be followed in certain circumstances.
• Procedures in the procurement process were not being followed since the employees were not familiar with the responsibilities associated to their job function.
• All necessary information may not be captured within Project Contracts since a contract number is assigned prior to the terms of the contract being populated.
• Amendments to a contract have to be manually changed within the purchasing module in Oracle.
• Information contained in the purchasing module in Oracle does not always match the terms of the contract and the information entered into Project Contracts. In some instances, there was no limit on the contract in the purchasing module in Oracle.
• Employees within the contracts department noted that they would receive fully executed contracts with a memo from the Executive Assistant requesting a number be assigned to the contract.
• In some instances professional services were being performed without a contract.
• POs which referenced a state/federal contract did not contain any type of agreement between the county and the vendor; therefore, there was no limit to the amount of money that could be spent under these state/federal contracts.
• Vendors with contracts were paid $10.9 million in excess of contract amounts.
• Vendors without contracts were paid in excess of $5.4 million.
• In certain instances, the same vendor was issued multiple POs totaling or greater then $50,000 on the same day for similar services.
• Due to the length of time it takes to hire an individual, qualified IS candidates were no longer available when offered a position.
• The IS department is not able to internally support all of its critical functions.

Due to the above findings, KPMG made the following recommendations:

• The Code and the Policy should be reconciled.
• Employees should be provided with a manual (“how to guide”) which provides the step-by-step procedures in the procurement process and outlines the duties of each job function. All employees must be trained on the manual.
• Employees must be held accountable when they do not follow Policy.
• Project Contracts should require certain terms to be populated prior to the contract number being assigned and automatically feed all new and amended contracts into the purchasing module in Oracle.
• No one other then the contracts department should be able to draft a contract or assign a PO for professional services.
• The contract “amount limit” field in the purchasing module should be automatically linked to the “contract value” field in Project Contracts and tie to the amount identified on the contract.
• Documentation must be maintained for “sole source” contracts.
• Oracle should mandate a contract number be entered into the contract number field.
• All professional service POs should be routed to the contracts department so a Contract Administrator can draft a contract or determine if a contract already exists.
• For all POs issued under a state/federal contract, the county should require an agreement which defines the time, payment and scope of services to be rendered under the state/federal contract.
• POs issued under a different state's contracts should follow the proper competitive bids/RFP process.
• All professional service POs must be issued by a contract administrator who can ensure that the proper procedures were followed.
• “User” departments must be held accountable for adhering to the terms of their departments' contract.
• Vendors must be aware of county policies and procedures and be held accountable to those and terms of the contract.
• A contracts director (or designee) should run a daily reports which would provide vendors who:
  • Were issued multiple contracts that have overlapping service periods – this report can be used to identify if any of the overlapping contracts are for similar services
  • Were issued multiple POs in one day referencing the same contract number
• Consistently post job openings which require a specific skill set in other areas then only on the county website (i.e. trade magazines, job fairs, internet job search sites, AJC).
• Before an IS project is started, the IS department should ensure that they can internally support the application and have an exit strategy for the consultants is in place.
• All professional service projects which are related to the IS department and another department should first be approved by both department heads. The department heads should agree on how the costs of these projects will be allocated to the different department budgets. The user departments have to be held accountable to pay for their portion of the contract.

The full presentation which provides KPMG's process, observations, findings, and recommendations was presented to the Audit Committee of the BOC on Monday, March 10, 2008 and will be presented to the full BOC on Tuesday, March 25, 2008.