05-24-21-R - Laserfiche WebLink

Home Browse Search

-2- OTHER OBSERVATIONS AND RECOMMENDATIONS Electronic Funds Transfers Fraud As the use of electronic funds transfers and payment methods has become more prevalent, we have seen increases in both the incidences of fraud related to these transactions and the dollar amounts involved. Operational changes related to the COVID-19 pandemic, including greater reliance on technology and more employees working remotely, have tended to increase risk in this area. We urge cities to carefully review controls over these transactions, and consider best practices to address these risks, such as: • Ensuring segregation of duties over these transactions by involving more than one employee in the process. • Requiring multi-factor authentication of requests for electronic payments from new vendors or for changes in wiring instructions for existing vendors. It is recommended that changes for existing vendors be verified through trusted contact information used previously for that vendor, not as provided in the change request, to verify the accuracy of the change. • Educate employees on the controls in place to protect the organization’s financial assets and ensure management is supportive and accepting of the processes in place. Attempted fraudulent transactions are often initiated using the profile of a supervisor. Employees must be comfortable questioning unusual transactions or requests, and instructed not to circumvent internal control procedures regardless of whom they believe initiated the transaction. • Recommended cyber security measures, such as limiting network access and requiring robust passwords that are changed regularly, should be implemented and followed by all city employees, not just those directly involved with financial transactions. • Review insurance policies to understand the coverage provided for financial losses due to cybersecurity risks and evaluate whether they provide adequate coverage based on management’s assessment of these risks. Uniform Guidance Written Controls and Federal Micro-Purchase Threshold Federal Uniform Guidance (UG) requires that nonfederal entities must have and use documented procurement procedures consistent with 2CFR § 200.317-320 for the acquisition of property or services required under a federal award or sub-award. Effective August 31, 2020, the federal micro-purchase threshold, which is the threshold that allows for procurements without soliciting competitive price or rate quotations given certain conditions, was increased from $3,500 to $10,000 in the Federal Acquisition Regulations (FAR). Effective November 12, 2020, the UG was also revised to allow nonfederal entities to establish a micro-purchase threshold higher than the $10,000 threshold established in the FAR under certain circumstances. The nonfederal entity may self-certify a micro-purchase threshold up to $50,000 if the requirements in 2CFR § 200.320(a)(1)(iv) are followed. Requirements include an annual self-certification and clear documentation of the justification to support the increase in the threshold. Acceptable reasons for justification must meet one of the following criteria: • A qualification as a low-risk auditee, in accordance with the criteria in §200.520 for the most recent audit, • An annual internal institutional risk assessment to identify, mitigate, and manage financial risks, or, • A higher threshold consistent with state law. This flexibility would allow Minnesota local governments to increase and align their federal procurement procedures, specifically the micro-purchase threshold, with state law, which allows for procurements below $25,000 to be made without competitive price or rate quotations.