An Audit Report on the Real Estate Commission: A Self-directed Semi-independent Agency
September 2014
Report Number 14-037
Overall Conclusion
The Real Estate Commission (Commission) accurately and completely recorded $23.5 million in license and permit-related receipts during fiscal year 2013. However, the Commission should improve the reporting of its finances on the Annual Financial Report and the annual Self-directed Semi-independent Agency Report (SDSI Report).
Annual Financial Report. The Commission's fiscal year 2013 Annual Financial Report was significantly misstated, with misstatements in both revenues and expenditures. For example, the Commission overstated revenues and transfers related to license and permit activities by approximately $4.1 million.
SDSI Report. The financial information in the Commission's fiscal year 2013 SDSI Report was incomplete. The SDSI Report contained information only on operational revenues and expenditures. That report did not present information on accounts totaling $16.7 million in nonoperational revenues and fee surcharges and $16.4 million in nonoperational expenditures, transfers, and payments of fee surcharges to third parties.
The accuracy of the Commission's reports is important because the Legislature may use both of those reports to monitor the Commission's and the Texas Appraiser Licensing and Certification Board's finances.
The Commission also should strengthen access controls over data in its automated regulatory system, which is called Versa. The Commission adequately controls access to the Versa application, but it does not adequately protect Versa data. The Commission does not ensure segregation of duties and the integrity of data stored on its network, the Versa database, and servers. Certain information technology staff also have administrator access that would allow them to change Versa data without a record of who accessed the administrator account or made the changes. In addition, the Commission assigns Versa user IDs by position, rather than assigning user IDs to specific individuals, and it does not consistently comply with its policy to disable and remove user accounts when users' employment is terminated. The Commission also did not have evidence showing that it regularly reviewed user access to Versa.
The Commission sets fee rates based on its budgetary needs, and it assesses penalties in accordance with statute. It collected approximately $10.0 million in license fees and more than $187,000 in penalties during fiscal year 2013.
Auditors communicated other, less significant issues to the Commission's management in writing.