Results of Agreed-Upon Procedures to Assess Controls over Pay and Display Credit Card Revenues

The Auditor General also considered the scope of prior audits of Toronto Parking Authority completed by her Office and held preliminary discussions with Toronto Parking Authority management and their external financial statement auditor. After this initial assessment, further consideration was given to the following allegations: 1. Toronto Parking Authority credit card revenue was redirected by the Vendor (meaning Toronto Parking Authority was not receiving parking revenues processed by the Vendor through the Pay and Display machines). 2. Toronto Parking Authority did not exercise appropriate due diligence in procurements from the Vendor. For the first allegation, the Auditor General liaised with Toronto Parking Authority and its external auditor to decide the level of work required to assess risks to the City and how those risks were being managed by Toronto Parking Authority. The external auditor performed agreed upon procedures to test key controls including controls that provide reasonable assurance over the completeness and accuracy of recorded revenue and receivables. Although we did not conduct in-depth testing of the Vendor's systems and records ourselves, no evidence came to our attention through the work of the external auditor that would suggest that Toronto Parking Authority credit card parking revenue was being redirected by the Vendor. The Auditor General's Office has closed this Fraud and Waste Hotline allegation - no further work will be conducted at this time. For the second allegation, Toronto Parking Authority has purchased Pay and Display equipment and related services on a non-competitive/sole-source basis from the same vendor since 1998. In 2009, the Auditor General's Office completed an audit of Toronto Parking Authority Pay and Display Parking Operations - Review of Revenue, Expenditure and Procurement Practices. Given the length of time that has passed since the Auditor General's Office last conducted an audit in this area, and because of the longstanding relationship between Toronto Parking Authority and this Vendor, we may consider doing further work in the future to examine this relationship in the context of current procurement rules and contract management. This report presents the Auditor General's consideration of risks raised in the complaint allegations as noted above.

obtaining an annual CSAE 3416/SOC1 (Service Organization Control) Type 2 report from the vendor of its Pay and Display machines and related services. 2. The Board forward this report to City Council for information through the City's Audit Committee.