Parking Garage Access CardsMIA),;\ I BIEA H
BUDGET AND PERFORMANCE IMPROVEMENT
Internal Audit Division INTERNAL AUDIT REPORT
TO:
VIA:
FROM:
Jorge M. Gonzalez, City Manager tf
Kathie G. Brooks, Budget and Pe~Z. r9·Jance !mprovement Director;\ · ·
James J. Sutter, Internal Audito'j~ '
DATE: April 12, 2010
AUDIT: Parking Garage -Access Cards
PERIOD: October 1, 2006 through September 30, 2009
This audit report reflects the results of a regularly scheduled compliance audit of the parking space
rental in the municipal parking garages.
INTRODUCTION
The City of Miami Beach Municipal Parking System is funded in part through public revenue bonds.
As stated in Chapter 106, Section No. 1 06-55(c) of the City of Miami Beach Code, "facility specific
monthly parking in municipal parking garages is available on a first-come, first served, space
available basis".
In an effort to made parking in municipal parking facilities more affordable and accessible to
frequent users, the City's Parking Department designed and offers a facility specific monthly parking
program that provides consistent users of facilities (residents, businesses, employees from local
businesses, etc.) a discounted rate. The discounted monthly fee is $7 4.90 including tax, as
compared to a maximum daily rate for use over 15 hours of $20.00 in all municipal garages with the
exception of the 42nd Street Garage which is a maximum of $8.00. Permits are issued by the
Parking Department's permit liaison at the offices of the Parking Department. Monthly permits for
the Anchor Garage are also sold on the garage premises at a monthly fee of $107.00 including
taxes.
In order to access municipal parking garages under this program, the Parking Department provides
an access card, for which the user is charged a $10.00 deposit in order to protect the department's
investment in the card and to encourage proper use and storage of the access card while in the
patron's possession. This deposit is refunded if the user returns the access card in good condition,
as determined by the Parking Department. In the event that a patron looses or damages the access
card, then he/she is required to pay a replacement fee of $25.00 each time a replacement card is
issued.
The access card issued controls the access to the facility and is monitored by an access revenue
control system. The access card has a specific number assignment, which should correspond with
the account number, name, and vehicle information. Each card is not transferable and authorizes
the holder to park one vehicle at a time. Motorcycles and trailers are not permitted.
In addition to the facility specific monthly parking permit program, access to specific parking facilities
are granted to City employees that frequently perform work at the parking facilities and/or at City
Hall, considering the lack of parking alternatives. The parking department provides each new
employee with access to the appropriate facility depending on the requirements and responsibilities
of the employee position. Cards provided to City employees are exempt and therefore no deposit or
payments are required for these cards. Employee ID cards are utilized in lieu of access cards for
We me commit/eel to providing excellent public se!Vice ond solely to oil who live, work, one/ ploy in our vibront, tropicol, historic community.
Internal Audit Report
Parking Garage -Access Cards
April 12, 2010
those facilities having separate readers located next to City Hall.
The Parking Department is responsible for monitoring and verifying compliance to program
requirements and policies, as well as compliance to the City's Code and Ordinances.
OVERALL OPINION
The Parking Department is responsible for the difficult and overwhelming responsibility of issuing
garage specific access cards under the City's monthly parking permit program. Furthermore, they
process and monitor monthly customer payments, along with ensuring compliance to City Code and
Ordinances among with other responsibilities. Internal Audit identified the following areas in need of
corrections with respect to the aforementioned responsibilities:
1. Valet Parking Storage and rates charged for the same are being allowed in disagreement
with Chapter 1 06 of the City Code.
2. Departure from City Code observed with respect to the management of the facility specific
monthly parking permit program at the Anchor Garage.
3. There is a lack of controls restricting system access to Consolidated Parking Equipment
(CPE) personnel, currently the contractor in charge of the maintenance and programming for
the municipal parking facility's ADP equipment and the access card system.
4. Access cards issued to business entities are not vehicle and account specific allowing
departures from Monthly Parking program policies and requirement.
5. No procedures are currently documented with respect to issuing and granting of access card
monthly parking permits.
6. Documentation is insufficient for approval of some exempt access cards issued.
7. Insufficient reviews and updates are performed to the "issued access cards" database.
8. Reconciliation of access card deposits are based upon estimated users and not on actual
users.
9. Un-issued access cards are reflected as issued and active on the Parking Department's
Database.
Additional details of our findings and proposed recommendations are included in the "Findings,
Recommendations and Management Responses" section of this report.
PURPOSE
The purpose of this audit is to ensure Parking Department's compliance with applicable State,
County, and City laws and regulations; verify sufficiency of supporting documentation and records;
verify that policies and procedures are written, known, and followed consistently; to verify that proper
system controls exist to ensure the reliability and accuracy of data and revenue collections, with
respect to the rentals of garage parking spaces and garage specific monthly parking permits.
SCOPE
1. Ensure compliance to City Ordinances, regulations and agreements.
2. Ensure that sufficient controls exist to reasonably assure the reliability, accuracy, and
Page 2 of 8
Internal Audit Report
Parking Garage -Access Cards
April 12, 2010
accountability of all revenues collected.
3. Confirm that revenue collected is accurately recorded and posted to the City's general
ledger, and that sufficient documents for support are maintained.
4. Ensure that sufficient documentation and approvals are maintained for non-paid exemptions.
5. Confirm that policies and procedures are complete, known, and followed by personnel.
FINDINGS, RECOMMENDATIONS AND MANAGEMENT RESPONSES
1. Finding: Valet Parking Storage and rates charged for the same are being allowed in
disagreement with Chapter 106 of the City Code.
Chapter 106, Section 1 06-55(f), of the City Code states that "The City may provide on an as-
needed basis, the ability for a valet seNice company to rent public parking spaces to
accommodate valet parking storage for special events. The parking director shall weigh the
impact of each request on the parking area and its users, and shall determine both, the ability to
lease spaces, and the number of spaces that may be lease for the special event. The fee per
space is $14.00 per day, payable 48 hours in advance. The daily rate includes applicable sales
tax. No additional public parking space rentals for valet storage shall be allowed unless by the
action of the mayor or city commission". For further reference, "Special Event" has been later
defined in Section No. 1 06-55(1) (1).
However, results from our observations and inquiries revealed that there are currently at least
four (4) valet parking companies that have been provided with access cards, under the facility
specific monthly parking permit program, using the municipal parking garage of their choice for
storage purposes without the approval of the City's Mayor and Commission, or a previous
approval for a special event. Moreover, the monthly fee of seventy-four dollars and ninety cents
($7 4.90), including taxes, is well bellow the required price for valet storage for special events of
fourteen ($14.00) dollars per space per day, consequently in contradiction to the referenced
code section.
Recommendation(s):
The Parking Department should implement remediation procedures and processes in order to
achieve compliance with all sections of the applicable chapter of the City Code as soon as
possible. Any proposed modifications to processes and rates should be presented to the Mayor
and City Commission as proposed modifications to the City Code.
Management Response(s):
Agreed. All valet parking storage fees assessed are in compliance with the City's Parking Rate
Ordinance.
2. Finding: Departures from City Code obseNed
Facility specific monthly parking permits for the Anchor Garage under the facility specific monthly
parking program are being issued by contractor employees (Imperial Parking (U.S.), Inc.)
responsible for the garage operations and oversight of cashiers and attendants provided by the
contractor. Although well organized and carefully managed, this assignment of responsibilities
contradicts stipulations in Chapter 106, Section 106-55 of the City's Code, which mentions that
"permits under this program are issued by the Parking Depa1tment's permit liaison at the offices
of the Parking Department".
Page 3 of 8
Internal Audit Report
Parking Garage -Access Cards
April 12, 2010
Recommendation(s):
The Parking Department should implement remediation procedures and processes in order to
achieve compliance with the above section of the City Code as soon as possible.
Management Response(s):
The Parking Department is currently transitioning the processing of all monthly access card
transactions from contract employees to city employees. This transition shall remain transparent
to the user in order to maintain service levels to its users.
3. Finding: Lack of controls restricting system access to Consolidated Parking Equipment
Consolidated Parking Equipment (CPE) is currently the contractor in charge of the maintenance
and programming for the municipal parking facility's ADP equipment and the access card
system. Currently Consolidated Parking Equipment holds unrestricted privileges to access our
parking facilities access system without limitations and/or approvals. They can even access the
system wireless from remote locations without requiring a granted authorization by the City.
These privileges allow the contractor to create facility codes, activate or deactivate access
cards, and create new accounts, among other privileges.
Recommendation( s):
The Parking Department should work to implement control filters restricting the access of the
contractor to the system without prior authorization and monitoring. Any control implemented
should be able to provide audit trails detailing any alterations/changes to the system and the
individual involved in the same.
Management Response(s):
The Parking Department will work with the Information Technology department to implement
control filters restricting the access of the contractor to the system without prior authorization and
monitoring. Any control implemented should be able to provide audit trails detailing any
alterations/changes to the system and the individual involved in the same.
4. Finding: Access cards issued to business entities are not vehicle and account specific,
representing departures from Monthly Parking program policies.
Many sold access cards have been issued under business entity names without requiring any
business entity vehicle description including tag number, vehicle identification number (VIN),
and/or license plate number. Further inquiries and research showed that in many cases, the
cards are being used by employees, contractors, and/or assignees from those businesses
therefore transferring the permits and access to the municipal facility to other users.
Furthermore, not properly documenting the permit holder and vehicle information provides an
opportunity to create a secondary market for these access cards/permits where a business entity
with available access cards and facing financial distress could sublease/rent some of the
assigned access cards for a short term at a reasonable rate lower than the short term rate
offered by the City, yet higher than the monthly rate, to a third party. As a result, parking
revenues for the City could be adversely impacted from the competition of businesses using this
practice.
Recommendation(s):
As stipulated on documented policies for the garage specific monthly parking permit program,
issued access cards should be nontransferable. To achieve this, all issued cards should be
identified to a specific account, a specific permit holder, and a specific vehicle. Access cards
Page 4 of 8
Internal Audit Report
Parking Garage -Access Cards
April 12, 2010
issued to businesses should identify the specific business or employee vehicle that will be using
the permit.
Management Response(s):
As stipulated on documented policies for the garage specific monthly parking permit program,
issued access cards should be nontransferable. To achieve this, all issued cards should be
identified to a specific account, a specific permit holder, and a specific vehicle. Access cards
issued to businesses should identify the specific business or employee vehicle that will be using
the permit.
5. Finding: No procedures are currently documented with respect to the issuing and granting for
access card monthly parking permits.
There are no procedures with respect to requirements for issuing access cards and privilege
granting currently documented and consistently followed by Parking Department personnel. In
addition, there are no guidelines establishing the eligibility and/or the number of permits that can
be issued to one entity (business and/or individual) at a time. Also no procedures for issuing
exempt access cards, showing the reasons for the permit and the access privileges granted are
documented.
Recommendation(s):
The department should create, document, and implement procedures to be consistently followed
by all personnel involved in the garage specific parking permits. Procedures and guidelines
should incorporate an eligibility and access privilege approval process for all paid and exempt
cards issued with approvals from the Parking Director. Approval of the employee's department
directors should be included for employee exempt cards issued.
Management Response(s):
Agreed. The Parking Department will develop and issue a policy statement regarding issuance
of monthly access cards to eligible customers.
6. Finding: Documentation is insufficient for approval of some exempt access cards issued.
Subsequent to reviewing reports listing all issued and active access cards for each municipal
parking garage, Internal Audit noted that there were access cards and access privileges granted
to City contractors and City employees for which no information justifying the permits and/or the
access privileges granted, with the appropriate department director's signature, were available.
Examples of permits and/or access privileges provided that were not properly documented
included the following:
a)
b)
c)
d)
e)
f)
An Office Associate V was provided with an exempt access card with access granted to all
municipal parking garages.
Eight (8) cards with access to different facilities provided to Consolidated Parking
Equipment.
Two (2) cards issued to an organization for valet parking with unrestricted entry access to
the parking facility located at 42nd Street.
Eight (8) exempt access cards issued to Standard Parking.
Exempt access card with access privileges to more than one location provided to the
General Manager of Imperial Parking.
Three (3) exempt cards issued to "Armor", which is probably the armored vehicle from
Brinks.
Page 5 of 8
Internal Audit Report
Parking Garage -Access Cards
April 12, 2010
Recommendation(s):
The Parking Department should consider maintaining a centralized filing system where all
relevant information related to the issuance and approvals for access cards (particularly exempt
cards) are maintained and easily accessible. The preferred system should be automated with
documentation being scanned. In addition, the department should prevent and/or minimize the
number of exempt cards issued to contractors and contractor employees to prevent potential
costs resulting from damaged and/or lost cards, as well as misuses of the same. Access
privileges granted under these cards, and the number of cards issued should be restricted and
scrutinized by the Parking Department Director to prevent providing excessive number of cards
and access privileges accordingly. Placing expiration dates of these cards should be explored.
Any exempt access card unnecessarily issued should be requested to be returned and made
invalid as soon as possible.
Management Response(s):
The Parking Department identified this as an issue late last year (2009) and as a result
developed a procedure and form to issue, track, and reconcile all exempt monthly access cards
on a monthly basis. In regards to the findings, the following justification and/or actions have
been taken:
a. Access card was restricted to one facility (City Hall Garage).
b. These cards are issued to CPE Technicians to identify, troubleshoot, and correct any gated
equipment issues that may arise.
c. Two (2) access cards were issued in lieu of valet parking runners using transient mag-stripe
tickets.
d. All eight (8) access cards issued to Standard Parking have been deactivated.
e. Chester Escobar is Imperial Parking's General Manager (GM). As GM, Mr. Escobar requires
access to all municipal garages as he is responsible for monitoring and addressing any
issues that may arise at any parking garage.
f. Three (3) access cards were issued to Security Alliance (security contractor) to provide
security services at all municipal garages.
7. Finding: Insufficient reviews and updates to the "issued access cards" database ofthe
parking facility access system (ScanNet).
Although information for payments from permit holders are being frequently updated on the
parking Permit Software, which is the system used to record financial information and payments
for the program, Internal Audit found issues in relation to outdated access card information on
the parking facility access system (ScanNet), a second system compatible with equipment
installed in the facilities for access, that compromise the reliability of the data, as well as the
access controls to the corresponding garage. Issues observed included the following:
a) There were at least seven City employees that show multiple active access cards.
Additional inquiries with the Off-Street Parking Division suggested that it could be the
result of replaced cards, as a result of lost/stolen or damaged cards that were not made
inactive at all parking facilities immediately after replacement.
b) There were at least seventy nine access cards with Status "DELQ", which stands for
delinquent account. However, this status does not prevent the card from opening the
gates at the parking garage.
c) There are at least twelve active exempt access cards for former City employees and
elected officials that were not made invalid immediately after their departure.
d) There are at least seventy three duplicate access card identification numbers with multiple
Page 6 of 8
Internal Audit Report
Parking Garage -Access Cards
April 12, 2010
card status under the ih Street Garage.
Recommendation(s):
The Parking Department should perform a detailed review of all access card information in its
parking facility access system's database for each of the City's parking garages in order to
correct and update its records. Lost cards by employees should be made invalid at all parking
garages, as well as duplicate cards and multiple cards issued to the same employee. Only one
card should be valid for each City official, whether elected or not, and/or employee at all times.
Also, all access cards with a "DELQ" status should be reviewed to verify whether payment has
been received for them; otherwise their status should be changed to invalid. In the future, steps
should be taken to prevent using the "DELQ" status on the parking facility access system for
access cards.
Lastly, all currently active exempt access cards for former City employees, and elected officials
should be made invalid immediately.
Management Response(s):
The Parking Department identified these issues last year (2009) and developed a
comprehensive policy and procedure to record, track, and reconcile monthly access card
database. As a result, all findings, including items A, B, C, and D have been addressed.
8. Finding: Accountability and reconciliation of access card deposits.
Every time an access card is issued, it is required for the cardholder to pay a ten dollars ($1 0.00)
deposit that helps to protect the City's investment on the cards in case that the card is never
returned. However, Internal Audit confirmed that no monthly reconciliations are being done for
these actual deposits. In addition, deposits are not being identified to a particular card and/or
account. Instead, at the end of each fiscal year, the department accounts for all access cards
that are active at fiscal year end and ensure that sufficient funds in relation to the number of
active cards are available in the deposit account. This process makes no regards to access
cards that may be temporarily inactive due to activation delays, monthly payment delays, and or
system failure, among other probable scenarios. Annually at fiscal year end, an analysis is
performed by the Parking Department where accumulated deposits for active cards remain
intact on the deposit account. However, only forty percent (40%) of deposits received for access
cards showing as inactive I invalid is maintained and sixty percent (60%) is recognized as
revenues for that year. Internal Audit inquired as to the rationale behind the sixty percent (60%)
revenue recognition, however no response was provided. Furthermore, there are no
documented guidelines establishing a maximum period of time for which inactive access card
deposits would be held without being recognized as revenue.
Recommendation ( s):
Deposits received for issued access cards should be recorded and documented to the
corresponding account. In addition, reconciliations should be documented and performed
periodically to the deposit account and to the two systems, the financial and parking facility
access systems (ScanNet), in order to ensure the accuracy, reliability, and correlation of the
same. In addition, policies and procedures identifying a maximum period of time for which an
account can be inactive, without loosing its deposit should be formulated, documented,
implemented and distributed to all employees and cardholders to be consistently followed and
monitored. Once a card is invalid for periods longer than the established reasonable time, then
the department can assume the card will not be returned and the deposit should be recognized
as revenue.
Page 7 of 8
Internal Audit Report
Parking Garage -Access Cards
April12, 2010
Management Response(s):
The Parking Department in conjunction with the City's Finance Department conducts an annual
reconciliation of all access card deposits. 100% of all active access car deposits and 40% of all
"delinquent" account deposits are retained for potential disbursement. All other funds are
recognized as revenue.
Internal Audit Observation:
While we recognize management's reasons for estimating the deposits on an annual basis, we
feel that this is only an estimate and does not reflect the actual deposits outstanding. Also, the
basis used (40%) for delinquent account deposits is not documented.
9. Finding: Un-issued access cards are reflected as issued and active on the Parking
Department's Database.
There are currently about 9,982 un-issued access card numbers that show as issued and active
for the 131h Street and Collins Avenue parking garage. These cards show on the database as
issued to one local business that currently holds access card accounts for that facility. However,
according to parking department staff, not all of the 9,982 access card numbers represent actual
cards issued to that business, instead, most of the numbers were created as a result of an
inadvertent error made in the system.
Recommendation(s):
The Parking Department should perform a detail review of these access cards numbers and
accounts as soon as possible in order to delete all fictitious card numbers created as a result of
this inadvertent error. Only accounts that have been paid for should be left active.
Management Response(s):
The incident was also identified by the Parking Department shortly after it took place and it was
corrected.
EXIT CONFERENCE
An exit meeting was held on February 9, 2010 to discuss the audit report and to solicit management
responses noted above. Attendees were Saul Frances, Parking Director, Charles Adams, Parking
Assistant Director, Grady Martinez, Senior Administrative Manager, Miguel Beingolea, Parking
Operations Manager, Rocio Rodriguez, Financial Analyst Ill, James Sutter, Internal Auditor and
Fidel Miranda, Auditor. Management responses were received shortly thereafter. All were in
agreement with the contents of this report.
(Audit performed by Fidel Miranda, Auditor)
F:\obpi\$AUD\INTERNAL AUDIT FILES\DOC08-09\REPORTS-FINAL\PARKING GARAGE-ACCESS CARDS.doc
cc: Jorge Gomez, Assistant City Manager
Saul Frances, Parking Director
Charles Adams, Parking Assistant Director
Page 8 of 8