To:   Mark Reis, Managing Director Aviation 
James Schone, Director Business Development & Management 
From:  Joyce Kirangi, CPA, 
Director, Internal Audits 
Date:  December 17, 2009 
Re:   AV Business Development & Management Department 

Internal Audit has completed an audit of the Business Development & Management Department. The audit
covered the period January 1, 2007 through December 31, 2008. Our audit report contains no findings;
however, during the course of the audit, we noted some internal control weaknesses that could be
improved. The noted weaknesses were not significant enough to rise to the level of a finding; however, if
these controls are not addressed, the weaknesses could develop into significant issues in the future. 
The noted weaknesses involved: a lack of formalized risk assessment process, untimely processing and/or 
input of the lease agreement terms, and segregation of duties. This management letter is intended to
assist you as you continue to improve internal controls and operational efficiency of your department 
A.  Risk Assessment 
Through discussions with you and your senior managers, we determined that risk assessment is part
of your normal process. You were able to articulate several risks facing your department as well as
several key controls implemented to mitigate those risks to an acceptable level. The department does
a good job of establishing holistic goals and objectives in line with the overall goals and objectives of
the Port. You were able to articulate several risks facing your department as well as several key
controls implemented to mitigate those risks to an acceptable level.
Your risk assessment procedures; however, appear to be rather informal and fragmented. A
formalized Risk Assessment helps identify in advance those obstacles that can prevent your
department from achieving its goals and objectives. Once you identify the risks, you can design and
implement controls to mitigate those risks to an acceptable level. In essence, a formalized Risk
Assessment helps management proactively manages its risks. Without a formalized Risk
Assessment, management risks not being alerted when department objectives are in danger of not
being achieved. 
Recommendation 
We recommend that management formalize its risk assessment process. Specifically we believe that
the department should consider: 
Seek input from all levels of employees when identifying risks. 
Make risk identification and assessment a regular and ongoing process. 
Document and formalize the results of risk assessment discussions. 
Develop internal controls designed to mitigate each risk to an acceptable level, or complete an
action plan to address each risk. 
1

Summarize the risk assessment procedures in a single Risk Assessment document. 
Continually revisit and reassess risks on an ongoing basis. 

B.  Untimely Processing of Agreement Information 
1.  Minimum Annual Guarantee (MAG) Increase Notification 
The annual MAG increase is calculated based on a certain percentage of prior year concessionable
revenue. We tested a sample of 36 MAG and holdover (month-to-month) notifications to establish
whether Port management had notified the lessee timely. From our test, we noted five instances
where more than 100 days had elapsed before the lessee was notified of the MAG change as
follows: 
# 
Date      of Days 
MAG   POS Sent  Passed the
Agreement                 Effective      the     Effective    Over 
#      Lessee                Date      Notification     Date      60 Days 
629     Smart Cart              2/1/07    6/19/07      138       78 
437     Airport Management        5/1/07    8/27/07      118       58 
629     Smart Cart              2/1/08    5/13/08      102       42 
923*    AT&T                  1/1/06    1/2/08       731       571 
923*    AT&T                  1/1/07    1/2/08       366       306 
Although expected payments were ultimately billed and collected in full, the Port did not receive the
agree-upon MAG increase timely. 
The timeline of the MAG notification is not just an incidental administrativeresponsibility. Rather, it 
has a direct financial impact. Delayed notifications result in late payments and as such represent lost
opportunities to the Port to utilize that cash flow (i.e., interest). The foregone interest on the noted five
exceptions is $12,175 at an approximate interest rate of 2%/annum. 

2.  PROPWorks 
PROPWorks is a comprehensive software package designed to manage lease and property at the
Port. The Aviation Business Development & Management Department utilizes the system to manage
lease agreements and relies heavily on the system to maintain and track all material lease provisions 
including, but not limited to, expiration date, renewal dates, and billing terms. Based on information
entered into the PROPWorks system, Accounting and Financial Reporting (AFR) performs billing on
a monthly basis. 
We selected a sample of sixteen (16) agreements and tested them to establish whether lease term
information was entered into PROPWorks timely. From our sample, we noted four (4) agreements
that were not entered into PROPWorks timely.  The auditor set a threshold of 14 days following
execution of the lease as a reasonable period within which to administratively process the agreement 
and enter all the lease terms and information into PROPWorks. 

2

Agreement                    Lease    Lease    Lease   # of Days 
#      Lessee                Effective    signed     Terms      Late 
Date      and    entered into
Executed  PROPWorks
Date      and 
Transmittedl 
to
Accounting 
941      Butter London, Inc         5/21/07   8/23/07    10/19/07    57 
916      Highline Historical Society     2/1/07   12/7/06      3/5/07    88 
953      Security Point Media        5/17/07   5/17/07     8/29/07    104 
950      Clear Channel            8/1/07   7/19/07    10/15/07    88 
Timely input into PROPWorks system is critical as it triggers subsequent processing including 
billings. Fully executed a greements will not be billed if the agreements do not exist in the
PROPWorks system. Thus untimely input into PROPWorks inevitably leads to untimely billings which
could have a cash flow financial impact to the Port. 
Recommendation 
We recommend that management strengthen existing controls to ensure timely MAG notifications
and any necessary follow-up. If practical, establish a performance matrix as to when lease
information should be fully entered into PROPWorks. 

C.  Segregation of Duties in PROPworks 
Separation of duties is a necessary, not required, element of a sound internal control system. It
prevents a single person from performing incompatible tasks from beginning to end. As such, it
provides management with reasonable assurance over potential wrongdoing including fraud. 
We observed that system access of one manager to PROPWorks is too concentrated. The manager 
could enter, edit, and/or delete any agreement information in the system. While there is a degree of
management monitoring, the control is unlikely to be effective as the manager could easily
circumvent the control (modify or delete after the fact). 
Mere absence of separation of duties, in and of itself, is not an indication of inadequate controls. The
absence could be unavoidable if available staff is not adequate. It should be recognized, however,
that concentration of incompatible duties has numerous risks, and these risks must be subject to
additional indirect controls to compensate for the absence. 

Recommendation 
We recommend that management expand its current monitoring role as a compensating control, if
the segregation of duties is not operationally feasible. 

3

Joyce, 
The following is the AVBD management response to the audit. 
First of all, I would like to express my appreciation to the Internal Audit staff for their thorough review of AV Business
Development (AVBD) processes and procedures. Their work is important to validating both what we are doing well and where
we need to improve. 
In regards to the items listed in the Management Letter, I offer the following response. 
A) Risk Assessment 
The report states that the department's risk assessment procedures are rather informal and fragmented. When it comes to three
of the most significant risks associated with our responsibilities, that of payment, surety and insurance from our tenants, our
risk assessment procedures are quite formal and well-coordinated with all appropriate stakeholders throughout the
organization. There are regular updates from Accounting staff on late payment issues. The AVBD Properties staff provides biweekly
updates on all surety and insurance expiring that month with the relevant documentation of all communication with the
tenants on these matters. And with the myriad other risks that develop at any given time that could impact airport business,
there are well organized mechanisms for keeping senior management apprised of these matters. 
I also recognize that we can always improve and need to learn from best practices for risk assessment. I understand that the
organization has undertaken a risk assessment and management pilot project at Fisherman's Terminal. We look forward to
studying the results of this pilot project when it is completed and incorporating any recommendations from that effort into our
practices. 
B) Untimely Processing of Agreement Information 
1.  Minimum Annual Guarantee (MAG) Increase Notification: 
AVBD Lease Administration staff are now utilizing a program component within PROPworks to remind staff of
when these recalculations are due. There are also monthly meetings with Accounting to review any problems that
either group is encountering so that they can be addressed collaboratively. 
2.  PROPworks: 
As lease agreements vary a great deal in complexity, the time needed to properly enter them into the PROPworks
system also varies a great deal.  I have asked the AVBD Lease Administration staff to create a tracking
mechanism for all leases from start of negotiations to entry into the PROPworks system that will be reviewed
monthly to ensure that staff are completing all necessary tasks in a timely fashion. 

C) Separation of Duties with PROPWORKS 
I agree with Internal Audit's recommendations regarding the need for separation of duties between those responsible for
negotiating leases and those entering the lease information into the PROPworks system. However, given the cutbacks in
AVBD staffing that occurred in 2009, my ability to completely eliminate this risk is limited without causing additional
problems in other areas of the lease administration process. 
Thank you for the opportunity to comment. 
Sincerely, 
Jim Schone 
Director - Aviation Business Development 
Seattle-Tacoma International Airport 
Port of Seattle 

4