An Audit Report on the Brazos River Authority
August 2014
Report Number 14-040
Overall Conclusion
The Brazos River Authority (Authority) has processes and controls for financial management, determining employee compensation, and funding and managing capital projects to ensure that it complies with state requirements and Authority policies and procedures. In addition, the Authority has sufficient documentation to support its decision to decommission a hydroelectric facility in 2010. That process included gathering information from multiple sources and performing a cost analysis.
However, the Authority did not always have approved, written procedures for certain key financial and information technology processes and did not consistently adhere to its human resources policy. The Authority also should strengthen certain information technology controls over its financial data.
The Authority substantially complied with state requirements and Authority policies and procedures for financial management.
The Authority has implemented processes for receiving and depositing customer payments, purchasing, paying invoices, paying employees, and managing its assets. Specifically, the Authority:
- Billed its water supply and cost reimbursable customers based on approved rates and contract terms, made timely deposits, and performed monthly account reconciliations.
- Adequately segregated its duties for paying invoices and ensured proper authorization of payments.
- Procured goods and services in compliance with statute and the Authority's operations policy.
- Recorded capital assets in its asset management system, performed annual inventories, and obtained approval from its Board of Directors for asset disposals in accordance with Authority procedures and state law.
However, the Authority does not have approved, written procedures for purchasing, paying invoices, or paying employees, and it did not consistently adhere to its human resources policy. Specifically, the Authority did not ensure that supervisors reviewed time sheets the Human Resources Department approved when the supervisors were not available. Without supervisor review, the Authority cannot verify that the reported hours on the approved time sheets accurately reflect the hours worked.
The Authority has implemented processes to ensure that its compensation decisions and pay actions are supported and authorized.
The Authority's process for determining compensation rates included contracting for compensation studies and annually monitoring economic conditions. In addition, the Authority performed employee evaluations to support recommended pay actions, which the Authority's general manager approved in accordance with Authority policies. The Authority's Board of Directors evaluated the general manager’s performance and approved all related pay actions.
The Authority has implemented processes for funding and managing capital projects.
The Authority has effective processes for assessing and funding capital projects to help ensure that it complies with Authority policies and state requirements when it issues bonds and disburses bond and reserve fund proceeds. Those processes include determining need, obtaining authorization, and monitoring project progress through onsite inspections and invoice review. For all projects audited, the Authority disbursed funds within the approved scope of the projects and, for bond-funded projects, in accordance with the bonds' purposes.
The Authority had sufficient documentation supporting its decision to shut down and decommission its hydroelectric facility at Possum Kingdom Lake.
The Authority considered information from multiple sources to arrive at its decision to shut down the hydroelectric facility at Possum Kingdom Lake for safety reasons. That included information from multiple engineering firms over several years regarding the deterioration of the facility and related safety issues. In addition, the Authority contracted with professional engineering, legal, and energy firms to assess the costs for alternate scenarios, including rehabilitating and decommissioning the facility.
The Authority also consulted with a finance company to determine the best financing options for both scenarios. The cost analysis showed a net loss of $17.8 million to rehabilitate the facility and a cost of $8 million to decommission the facility. The documentation shows that the Board was regularly updated about the Possum Kingdom Lake facility before it voted unanimously in November 2010 to decommission it.
The Authority should strengthen some of its information technology controls.
The Authority has some information technology controls over its financial data; however, it should implement a process to secure access to its financial data and remove inappropriate user accounts. Additionally, the Authority should strengthen its information technology policies and procedures related to user access, passwords, and backups.
Auditors communicated other, less significant issues related to the Authority's financial management processes to Authority management separately in writing.