Schedule of Audit Findings and Responses

Port of Seattle King County December 4, 2012

1. The Ports internal controls were inadequate to ensure all credit card transactions at the parking garage were processed, resulting in lost revenue of $394,982. SUMMARY
The Ports Landside Operations division manages Seattle-Tacoma International Airports (Sea-Tac) onsite parking garage. It collected approximately $49,367,630 in parking fees in 2011 and $37,251,336 from January through September 2012. Credit cards are used to pay approximately 75 percent of parking fees. On June 26, 2012, a parking garage customer called Landside Operations customer service to report that a parking fee did not appear on a credit card statement. This was the second call in two weeks the Port had received regarding this issue. Landside researched the customers claims and found the receipting system failed to process all credit card payments. It determined the issue was isolated to one parking garage exit lanes credit card processor. When it found the possible loss in July 2012, the Port immediately secured the systems hardware and software data and began an investigation into the issue. The Port found the receipting system failed to process approximately 10,514 parking fee credit card transactions, totaling $387,986 from January through August 2012. During this period, the Port did not have internal controls in place to ensure all credit card transactions were processed. We reviewed the Ports work and found it had correctly calculated the loss during this period. The Ports investigation also identified 864 failed credit card transactions in 2011. However, the Port did not calculate the amount associated with these failed transactions. On August 8, 2012, the Port reported to the State Auditors Office that the malfunctioning credit card processing system had led to a loss of revenue at the parking garage. We reviewed the Ports investigation to determine if it was complete, had calculated the loss correctly and if the Port established procedures to prevent and detect future credit card losses. We found the Port did not identify the full amount of the loss. We found no evidence to suggest the credit card processing failures were isolated to 2011 and 2012. The Port has not yet identified the cause of the incidents. We also found the Port did not adequately test the installation of the new parking garage receipting equipment to ensure it was receipting all credit card transactions.

Washington State Auditors Office 5

Port management appears committed to determining the cause of the credit card processing failure and to pursuing recovery of lost amounts from the vendor if possible. We commend the Port for this action. Between June and August 2012, Landside installed a new receipting parking system. To safeguard public funds, the Port has initiated development of internal controls for monitoring credit card transactions in the new system. Although the new procedures are not fully in use, they appear to identify credit card exception transactions including overbillings and failed payment processing. However, the reconciliation procedures do not include procedures for determining the cause of any identified exception(s). In addition, the Port lost $6,997 in revenue when the new receipting system failed to process credit card transactions properly. We believe this amount could be higher by about 50 percent. Further, we note the new system still is not accurately processing all credit card transactions or does not process them at all, does not always operate and overbills customers. RECOMMENDATION To ensure the Port adequately safeguards public resources, we recommend the Port: Adopt a formal risk assessment process that includes credit card transactions at all Port locations where they are accepted and establish internal controls to ensure complete receipt of revenues. Include accounting management in planning phases of all revenue-receipting systems to ensure system capabilities meet reconciliation requirements. Follow recently developed receipting procedures at Sea-Tac parking garage and determine the cause for all irregular transactions when they are identified. Continue to pursue the cause of old system failures and recover losses, if possible. Determine the cause of new system failures and recover losses from the vendor, if possible. Ensure the new system accurately processes all credit card transactions.

We also recommend the Port take appropriate steps to recover the loss from responsible parties. We further recommend the Port calculate the total revenue lost, including those due to credit card payment failures detected in 2011, and investigate the potential amount lost in prior years. When performing our audit we considered the following requirements: RCW 43.09.185: Loss of public funds Illegal activity Report to state auditor's office.

Washington State Auditors Office 6

Budget Accounting and Reporting System (BARS) Manual, Part 3, Accounting, Chapter 1, Accounting Principles and General Procedures, Section B, Internal Control. The Port provides the following information related to the findings of this audit: The Ports parking revenue controls system consists of two parts one that tracks all the traffic in and out of the Airports parking garage and another that processes credit card charges at the exit lanes and transmits them to the banking system. In June 2012, the Port implemented an upgraded parking revenue controls system. During this process, an as-yet-unidentified error associated with the old system meant certain credit card transactions were not processed. The Port failed to discover the loss because the old parking revenue control system failed to balance completed parking transactions in one part of the system with processed credit card transactions in another. Upon learning of these failures, the Port immediately took steps to fully assess the nature and extent of the problem. The Port confirmed that the problem was primarily limited to June 2012, during the migration to the new system. Nonetheless, the Port expanded its review for similar discrepancies to include all of 2011 and 2012. This review identified additional discrepancies but also determined that the June 2012 time period accounted for an estimated $350k of the $387k in failed credit card transactions in 2012. The Port has estimated the discrepancies during 2011 to be about $39k total. The Port has worked with the parking revenue control system vendor, Scheidt & Bachmann, to conduct a root cause analysis to determine the cause of the failure, but that analysis so far has been inconclusive. As a result, the Port has elevated the matter internally and intends to retain a qualified technical forensics examiner in an effort to determine why the failure occurred. To protect the integrity of the original data, the Port has secured the hardware and system data and is providing only copies of the data set to support the Ports investigation. The Port is also applying the lessons learned from the loss associated with the old system in the testing, configuration and acceptance of the new parking revenue control system. This effort involves the Ports subject matter experts in accounting, audit, information technology, project management and Aviation parking operations and system maintenance, to ensure the accurate, auditable processing of all credit card transactions. The Port has designed a reconciliation model and recently implemented a daily balancing protocol. Currently this work is being done manually, but steps are currently underway to automate exception reporting between the system and transactions processed through the banking system. This will immediately and automatically identify any discrepancies and facilitate their resolution on a daily basis. The SAO also noted that, due to internet connectivity failures for this point-of-sale system, the Port experienced additional, unrelated losses. To mitigate any future exposure to connectivity risks, the Port is moving to redundant, dedicated T1 telecommunications lines with failover mechanisms. Finally, the SAO made reference to isolated systems issues during cutover and testing of the new system that implicated the reliable functioning and accurate processing of transactions by that system. The Port has kept a complete post go-live accounting of all system performance issues and continues to pursue their resolution with the vendor.

Washington State Auditors Office 7

Port Response to Auditor Recommendations Auditor Recommendation: Adopt a formal risk assessment process that includes credit card transactions at all Port locations where they are accepted and establish internal controls to ensure complete receipt of revenues. Port Response: Agree. The Port will engage the Internal Audit Department to complete the recommended risk assessment. We respectfully note that for all other revenue collection points at the Port of Seattle, effective balancing protocols are in place to ensure completeness and proper administration of revenues, as confirmed by various internal and annually recurring independent external audits conducted of the Port over the years. Auditor Recommendation: Include accounting management in planning phases of all revenue-receipting systems to ensure system capabilities meet reconciliation requirements. Port Response: Agree. The Port will establish a clear policy and protocol that ensures all appropriate expertise is fully engaged in any revenue-receipting systems implemented by the Port. Auditor Recommendation: Follow recently developed receipting procedures at Sea-Tac parking garage and determine the cause for all irregular transactions when they are identified. Port Response: Agree. The Port is in the process of automating interim manual reconciliation procedures to provide daily, automated exception reporting and detailed transaction comparatives. This will prompt daily identification of any irregularities, their cause and resolution. Auditor Recommendation: Continue to pursue the cause of old system failures and recover losses, if possible. Port Response: Agree. To further this investigation, the Port is contracting with an independent third-party system forensics audit firm, experienced in both technology and financial systems, to identify the root cause of the system failure. Once the cause of the failure is identified, the Port will determine whether recovery is feasible. Auditor Recommendation: Determine the cause of new system failures and recover losses from the vendor, if possible. Port Response: Agree. The Port has kept a complete post go-live accounting of all system performance issues and has been pursuing their resolution. Once the cause of any particular issue is identified, the Port will determine whether recovery is feasible. Auditor Recommendation: Ensure the new system accurately processes all credit card transactions. Port Response: Agree. The Port is continuing to work with the vendor to resolve any and all intra-system component discrepancies. The Port is also working to install automated exception reporting to validate accuracy and completeness of credit card transactions processed from the vendors parking system.
Washington State Auditors Office 8

Schedule of Audit Findings and Responses

Port of Seattle King County December 4, 2012
2. The Port exceeded its authority when it funded an incentive program.
In July 2009, the Port entered into an agreement with the Puget Sound Clean Air Agency to administer a program designed to reduce diesel emissions from maritime industry activity in the Puget Sound Region. The agreement provided $2.2 million through June 2012 for the At-Berth Clean Fuels (ABC Fuels) Incentive Program. The ABC Fuels program reimbursed shipping lines to use low-sulfur fuel while berthed at the Port. Reimbursements ranged from $1,200 to $2,850 for each berth, depending on the amount of low-sulfur fuel used. Our audit identified the following concerns related to the Ports agreement: Exceeding authority Prior to the July 2009 agreement with the Agency, the Port performed a legal analysis to determine whether it had the authority to administer air-pollution reduction programs. The Port concluded that certain aspects of air-pollution reduction programs were outside of its authority and entered into an agreement with the Agency to operate the ABC Fuels program. The Port may not pay another party to perform the activities it is not authorized to do. Oversight of contracted services The agreement with the Agency lacked a specific description of the services to be provided by the Agency. It did not provide the Port with a right to refuse payment or other remedy should the Agency spend the money for purposes beyond the Ports authority. Additionally, the Port did not pre-approve Agency expenditures of port funds to ensure they were for allowable purposes. Gift of public funds The Port, through the Agency, used public funds to pay for fuel for shipping lines. The Port believes these payments assisted it in promoting itself and in attracting shipping lines. However, under the state Constitution, use of public funds to promote trade is considered a gift of public funds unless the Legislature has expressly authorized the type of payment. The Legislature did not authorize this type of payment. Moreover, the Port did not have agreements with these ship operators, and it could not demonstrate what it received in return for purchasing the fuel. Because the ABC Fuels program is outside of the Ports authority and because the Port did not receive legally sufficient consideration, all of the programs costs are considered unallowable use of Port funds.

Washington State Auditors Office 9

We recommend the Port ensure its activities, including contracted services, are within its statutory authority. We further recommend the Port establish internal controls to ensure: Contracts with third parties sufficiently describe the work to be performed and monitoring is performed to ensure the work is completed before payment is made. Public funds are only spent on allowable activities and are not considered a gift of public funds.

When performing our audit we considered the following requirements: RCW 53.08.040, Improvement of lands for industrial and commercial purposes Providing sewer and water utilities Providing pollution control facilities. State of Washington Constitution: Article VIII, Section 7 No county, city, town, or other municipal corporation shall hereafter give any money, or property, or loan its money, or credit to or in aid of any individual, association, company or corporation, except for the necessary support of the poor and infirm, or become directly or indirectly the owner of any stock in or bonds of any-association, company or corporation. Article VIII, Section 8 The use of public funds by port districts in such manner as may be prescribed by the legislature for industrial development or trade promotion and promotional hosting shall be deemed a public use for a public purpose, and shall not be deemed a gift within the provisions of section 7 of this Article. The Port provides the following information related to the findings of this audit: This response addresses all three findings made by the SAO regarding the ABC Fuels Program. The Port entered into an agreement with the Puget Sound Clean Air Agency (PSCAA), a state government agency that has the authority to monitor and maintain air quality in this region. The agreement was narrowly focused on finding ways to reduce air pollution from maritime activities originating in Elliott Bay, especially diesel pollution. The largest share of this diesel pollution (78%) is generated by ocean-going vessels (OGV), most of which call at the Ports container terminals. The Port partnered with PSCAA by entering into an agreement whereby PSCAA would pursue and implement measures that would address maritime pollution. The agreement did not specify the kinds of programs that had to be implemented, but did require that the programs be directed towards reducing maritime pollution. The At-Berth Clean Fuels (ABC Fuels) Program arose out of this contract.

Washington State Auditors Office 10

The ABC Fuels Program, as funded by the PSCAA, has been lauded by the maritime business community as being friendly to industry without being heavy-handed. The program is designed to encourage and provide an incentive to OGVs to burn cleaner diesel fuel while moored in Seattle. Because cleaner diesel fuel is more expensive, the PSCAA, with the Ports assistance, designed the ABC Fuels Program to make up the cost differential between regular and cleaner diesel. The program has been very effective as demonstrated by the fact that in the short time since the program began, diesel particulate emissions from OGVs while at berth have gone down by 34%. This kind of pollution reduction incentive program is present in other ports in the United States, including those that are competing with the Port of Seattle for this same shipping business. The ABC Fuels Program is touted by the Port when it meets with OGV companies and it is part of the list of incentives that make Seattle a desirable destination for cargo ships. The Port understands the SAOs position and recognizes that it is not unreasonable to take the view that the contract exceeds the Ports authority. The Port believes, however, that it is equally reasonable to view the contract as one for the purchase of general services designed to reduce maritime pollution from Port facilities. The specific service (the ABC Fuels Program) was not specified, identified, or mandated in any way under the agreement and the PSCAA could have spent the money on other programs, so long as that spending was within the general scope of reducing maritime pollution. Because the money was spent at the discretion of the PSCAA and not directed by the Port or required by the contract, the Port believes the Ports payments to the PSCAA were within the Ports powers. The SAO contends that the PSCAA agreement did not allow the Port to refuse payment or provide a remedy if the Agency spent the money for purposes beyond the Ports authority. In response, the Port would like to highlight two issues. The first is that the Port did not believe the contract exceeded the Ports authority (see discussion above). The second is that the Port did have remedies available. If the PSCAA had spent money beyond the specified scope, the Port could have brought a legal action for damages and specific performance. The Port also had the ability to terminate the contract for any reason after giving proper notice to PSCAA. The SAOs determination that the Port made a gift of public funds through this program is based on the assertion that the contract exceeded the Ports authority. As discussed above, while that is not an unreasonable interpretation, it does not preclude the Ports interpretation regarding the validity of the contract. The SAO has correctly cited case law authority that public funds cannot be used for trade promotion. The Port suggests, however, that more recent case law from the state Supreme Court has recognized that governments proprietary powers are broad and these cases may supersede the limitations described in the 1965 case cited by the SAO as authority. The Port will review the ABC Program in light of the SAOs findings and will work with the SAO to reconstruct the program so that it meets the SAOs concerns.

Auditors Remarks
The Port is responsible for how public funds are used. It is the Ports responsibility to ensure that all its public funds are used for an allowable purpose. In addition, the Port must function within its statutory authority. We reaffirm our finding.

Washington State Auditors Office 11