Marine Maintenance Shop Report
INTERNAL AUDIT REPORT
OPERATIONAL AUDIT
MARINE MAINTENANCE SHOP
JANUARY 2017– FEBRUARY 2019
ISSUE DATE: JUNE 14, 2019
REPORT NO. 2019-09
INTERNAL AUDIT
Marine Maintenance Shop Audit
January 2017 – February 2019
TABLE OF CONTENTS
EXECUTIVE SUMMARY ........................................................................................................................................... 3
BACKGROUND ........................................................................................................................................................ 4
AUDIT SCOPE AND METHODOLOGY ..................................................................................................................... 5
SCHEDULE OF FINDINGS AND RECOMMENDATIONS......................................................................................... 7
APPENDIX A: RISK RATINGS ................................................................................................................................ 10
APPENDIX B: DETAILED MANAGEMENT ACTION PLAN .................................................................................... 11
2
Marine Maintenance Shop Audit
January 2017 – February 2019
EXECUTIVE SUMMARY
Internal Audit (IA) completed an audit of the Marine Maintenance Shop for the period January 2017
through February 2019. Marine Maintenance management has the primary responsibility to establish,
implement, and monitor internal controls. Internal Audit’s function is to assess and test those controls
to provide reasonable assurance that the controls are adequate and operating effectively. The audit
focused on the following key processes at Marine Maintenance:
• Inventory
• Maximo Access Controls
• Capital/Small Works Projects
• Physical Access Security
• Fleet & Fuel Management
Marine Maintenance provides maintenance of all Port waterfront properties, fleet and equipment. They
are an active partner in the responsible stewardship of Port held community assets. They also support
the Real Estate Department and Maritime Lines of Business within the Port, with 14 specialized craft
functions that respond to customer requests.
Our audit identified opportunities where internal controls could be enhanced or developed. These
opportunities are listed below and are discussed in more detail beginning on page seven of this report.
1. (High) - Management self-identified that the process to issue and track keys and badges needs to
be enhanced. Marine Maintenance has the ability to issue badges that allow individuals to access
secure Maritime facilities.
2. (High) - Internal controls to monitor and account for fleet and fuel usage need to be strengthened.
This will also help prevent the need to make future adjustments to the year-end fuel balance such as
the $86,000 fuel adjustment made in 2018.
Our report includes recommendations that are intended to improve the internal controls and overall
monitoring of these controls.
We extend our appreciation to management and staff of Marine Maintenance for their assistance and
cooperation during the audit.
Glenn Fernandes, CPA
Director, Internal Audit
RESPONSIBLE MANAGEMENT TEAM
Stephanie Jones Stebbins, Managing Director, Maritime
Skip Himes, Director, Marine Maintenance
3
Marine Maintenance Shop Audit
January 2017 – February 2019
BACKGROUND
The Port’s Maritime Division includes four major business groups: Cruise Operations, Fishing and
Commercial Operations, Grain, and Recreational Marinas. It also includes Marine Maintenance, which
provides maintenance of all Port’s waterfront properties, fleet and equipment. Marine Maintenance is
an active partner in the responsible stewardship of Port held community assets and supports the Real
Estate Department and Maritime Line of Business within the Port with 14 specialized craft functions
that respond to customer requests.
Marine Maintenance operates one central repair facility located at 25 S. Horton Street, Seattle. Locked
gates and barbed wire secure the areas where vehicles and other equipment are parked, and video
cameras are installed at various locations which record activity. Access to the building is secured via
key cards. The Marine Maintenance Shop is staffed by 114 FTEs, including foremen, carpenters,
mechanics, etc. Marine Maintenance provides preventive maintenance services and performs a wide
range of repairs. It also performs small works capital and expense projects, including landscaping,
plumbing, painting, electrical work, etc. for other Port departments, and recovers its costs through user
charges. Marine Maintenance is not a revenue-generating department; only miscellaneous revenues
are received by the department.
In addition to the S. Horton Street Facility, Marine Maintenance maintains the following Port facilities:
• Maritime Industrial Center • Cruise Terminals
• Bell Harbor Cruise Terminal (Pier 66) • Smith Cove Cruise Terminal
• Pier 69 • Shilshole Bay Marina (SBM)
• Multiple parks • Fisherman’s Terminal
• Container Terminals and Container • Terminal 91 and Terminal 86 – Grain
Support Properties Terminal
Marine Maintenance manages the acquisition, maintenance, service, repairs, fueling, replacement and
disposal of fleet vehicles and motorized equipment. These include vehicles and equipment such as
sedans, light and heavy duty trucks, trailers, and miscellaneous motorized equipment.
The Port owns about 1,300 fleet vehicles and equipment. Marine Maintenance manages about onethird
of the vehicles and equipment, while the remaining two-thirds are managed by Aviation
Maintenance (AVM).
A Fleet fueling station is located at Marine Maintenance. The tank holds around 6,000 gallons of
unleaded fuel and 3,000 gallons of diesel fuel. Marine Maintenance also has a mobile fuel truck which
holds 2000 gallons of fuel and is used to deliver fuel to Terminal 91, for the large forklifts that are not
street safe and cannot leave the property.
4
Marine Maintenance Shop Audit
January 2017 – February 2019
AUDIT SCOPE AND METHODOLOGY
We conducted this performance audit in accordance with Generally Accepted Government Auditing
Standards and the International Standards for the Professional Practice of Internal Auditing. Those
standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to
provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe
that the evidence obtained provides a reasonable basis for our findings and conclusions based on our
audit objectives.
We reviewed information for the period January 1, 2017 through February 28, 2019, using a riskbased
approach from planning to testing. We gathered information through document requests,
research, interviews, observations, and analytical procedures. We assessed significant risks and
identified controls to mitigate those risks. To achieve the audit objectives, we performed the following
procedures:
I. Inventory:
• Gained an understanding of the Inventory Process via walkthroughs and interviews of
management.
• Performed an analytical review of inventory levels and calculated both the Inventory
Turnover ratio (number of times inventory is sold or used in a time period) and Days in
Inventory ratio (average number of days current stock of inventory will last).
• Performed physical inventory inspections of all inventory locations to determine if the
inventory items are stored in a secure location and observed a physical inventory count
performed by Marine Maintenance personnel.
• Obtained a list of inventory items in Marine Maintenance and judgmentally selected a
sample of 30 items to determine if inventory exists and selected 30 items on the floor to
determine if inventory is complete.
• Performed testing to assure segregation of duties existed around the receiving and
purchasing of inventory, by reviewing Maximo User Access roles.
• Reviewed the inventory listing from Maximo, to determine if all inventory items were
counted at least once every year.
II. Maximo User Access:
• Compared Maximo Access Reports to the Port’s Active Employee’s Report, to determine if
any employees who were no longer an active Port employee still had access to Maximo.
• Traced a sample of terminated employees with Maximo Access to Active Directory, to see if
their network access had been removed.
III. Capital/Small Works Projects:
• Reviewed listing of capital projects performed by Marine Maintenance for the period under
audit for reasonableness.
• Picked a judgmental sample of five high value capital projects and reviewed background
information in PeopleSoft, for reasonableness.
• Validated that projects over $300,000 received Commission Authorization.
5
Marine Maintenance Shop Audit
January 2017 – February 2019
IV. Physical Access Security:
• Performed a walkthrough of the physical keys process.
• Observed the facility where the key blanks and master keys were stored, and key cards
were printed.
• Obtained a report of Seaport badges issued during the audit period; January 1, 2017
through February 28, 2019.
• Compared this report to the active employees report from HR as well as the Human
Resources (HR) Changes report to determine if any non-Port employees had been
provided with a Port Badge.
• Judgmentally selected a sample of 12 employees and requested badge authorization
support to determine if proper authorization had been received for these individuals.
V. Fleet & Fuel Management:
• Interviewed process owners to gain an understanding of the process around fleet and fuel
management at Marine Maintenance.
• Conducted a walkthrough of the fleet fueling station at the Marine Maintenance Shop.
• Obtained a listing of Marine Maintenance fleet vehicles and equipment and a listing of fuel
transactions and judgmentally selected a sample of 30 vehicles and equipment to
determine if fuel was used for business purposes.
• Reviewed video surveillance for a 14-day period.
6
Marine Maintenance Shop Audit
January 2017 – February 2019
SCHEDULE OF FINDINGS AND RECOMMENDATIONS
1) RATING: HIGH
Management self-identified that the process to issue and track keys and badges needs to be
enhanced. Marine Maintenance has the ability to issue badges that allow individuals to access
secure Maritime facilities.
Based on our physical observation and discussion with the process owner, it was affirmed that the
process around the issuance, tracking and collection of physical keys and badges needs to be
strengthened. The following are a few examples of critical areas where controls can be improved:
• A comprehensive listing of physical access points had not been completely established.
• Segregation of duties for authorization, custody, and distribution of badges and keys did not
exist.
• A key request form was not required to obtain a key.
• Badges of employees (including interns) who were no longer employed at the Port were still
active in the system.
• Badge Applications, showing authorization for new badges issued were not being retained.
• Policies and Procedures related to the replacement of locks, keys, and issuance of badges
had not been established.
Recommendations:
Management should develop and implement a process that identifies access points, and accurately
accounts for and collects keys and badges when an employee no longer needs access. After a
process has been established, policies and procedures should be developed and adhered to.
Management Response/Action Plan:
Marine Maintenance Management recognizes the assessment and recommendations from our Internal
Audit department highlighted in the report, and are immediately working towards a series of
corrections. A project to capture critical security access data is currently underway which will support
future enhancements within the Seaport Division.
Project #105909 outline for Internal Lock & Security Assessment:
Below is a synopsis of the current Marine Maintenance Lock and Security Assessment Project created
to capture access data across Seaport properties.
Broadly, overarching and long term goals were discussed in regards to access control from the
Security perspective and the lock and security assessment was identified as Phase I in a three phase
endeavor;
• Phase I – Perform an assessment to identify current state of access control systems.
DUE DATE: 12/31/2019
7
Marine Maintenance Shop Audit
January 2017 – February 2019
• Phase II – Based off findings from Phase I, define the parameters for implementation of a
new access control system.
DUE DATE: 07/31/2020
• Phase III – Implementation of new access control system. Likely a comprehensive major
works project – Seaport wide or Port wide.
DUE DATE: 12/31/2023
Phase I will involve performing a physical-inspection of the lock / access systems and hardware on all
Seaport building facilities, an inventory of all existing ownership of keys, and identification of Marine
Maintenance’s current policies and procedures for granting (or restricting) authorization for access.
This will be a sustained, collaborative effort resulting in multiple end products. Asset Management is
spearheading the initiative to create a SharePoint tool that will be used to remotely enter the surveyed
lock & hardware information from the field at each Seaport facility. Efforts are underway to build out
this tool and field surveys have begun. This SharePoint tool will serve as a database for all inventoried
access systems once site visits are complete. The Marine Maintenance Lock & Security Shop will lead
the initiative to audit existing key ownership, consult with Asset Management on necessary information
to collect in the field, and be integral in conversations with Seaport Security regarding policy and
procedure.
8
Marine Maintenance Shop Audit
January 2017 – February 2019
SCHEDULE OF FINDINGS AND RECOMMENDATIONS
2) RATING: HIGH
Internal controls to monitor and account for fleet and fuel usage need to be strengthened. This
will also help prevent the need to make future adjustments to the year-end fuel balance such as
the $86,000 fuel adjustment made in 2018.
Below are some examples of areas where internal controls could be enhanced or developed:
• Although Fuel Master has functionality to limit the number of gallons for a specific vehicle,
these limits were excessive (50 gallons per transaction and 100 gallon daily limit per
vehicle).
• A process had not been designed to assure that Marine Maintenance fleet vehicles are only
used for business purposes. The vehicles did not have a GPS system making it difficult to
determine how they are being used.
• Although fuel consumption data was available, a process was not in place to monitor
usage. Establishing a monitoring function was useful to identify unusual patterns such as
high or frequent consumption that could result from pilferage.
• Any employee ID could be used to obtain gas.
• The vehicle mileage number was required to be entered into the system, however, this was
not always followed. When reviewing the consumption log, we identified several entries of
9999 and 0 for vehicle mileage.
• Although fuel logs were maintained to account for mobile truck usage, they were not always
completed and, in some cases, had been lost.
• Although a surveillance camera was nearby, it was not specifically focused to monitor the
fuel pump or positioned to identify the license plate number. In several instances the
camera had been moved to focus on the railroad tracks.
Recommendations:
Management should develop processes to monitor and account for fleet and fuel usage. Furthermore,
new technology could be explored with better built in controls, that will help track the fuel consumption
and provide visibility of vehicle location.
Management Response/Action Plan:
Management recognizes the deficiencies highlighted in the report and is immediately working towards
a series of corrections. The team is developing several solutions and processes to improve control and
accuracy over fuel inventory transactions and the overall access to Port fuel. The initial methods are
classified as immediate, short term, midterm and long term in implementation time, budget and effort.
There will be more methods developed as solutions are discovered. The detailed response outlining
these initial solutions and processes can be found under Appendix B on page 11 of this report.
DUE DATE: IMMEDIATE/SEE APPENDIX
9
Marine Maintenance Shop Audit
January 2017 – February 2019
APPENDIX A: RISK RATINGS
Findings identified during the course of the audit are assigned a risk rating, as outlined in the table below.
The risk rating is based on the financial, operational, compliance or reputational impact the issue identified
has on the Port. Items deemed “Low Risk” will be considered “Exit Items” and will not be brought to the final
report.
Port Commission/
Rating Financial Internal Controls Compliance Public
Management
Large financial
impact Noncompliance
High probability
with applicable Important
Missing, or inadequate for external audit
Remiss in Federal, State,
HIGH key internal controls issues and/or
responsibilities and Local Laws, Requires immediate
negative public
of being a or Port Policies attention
perception
custodian of
public trust
Partial controls Inconsistent Potential for Relatively important
compliance with external audit
Moderate
MEDIUM Not adequate to identify Federal, State, issues and/or May or may not
financial impact
noncompliance or and Local Laws, negative public require immediate
misappropriation timely or Port Policies perception attention
Generally
Internal controls in place Low probability
complies with
but not consistently for external audit
Federal, State and Lower significance
Low financial efficient or effective issues and/or
LOW/ Local Laws or Port
impact negative public
Exit Items Policies, but some May not require
Implementing/enhancing perception
minor immediate attention
controls could prevent
discrepancies
future problems
exist
Efficiency An efficiency opportunity is where controls are functioning as intended; however, a modification would make
Opportunit y the process more efficient
1 0
Marine Maintenance Shop Audit
January 2017 – February 2019
APPENDIX B: DETAILED MANAGEMENT ACTION PLAN
FUEL AND FLEET MANAGEMENT
Port Fuel Site Controls
Immediate Actions:
1. Craft Labor managers will review a daily log of fuel transactions. These transactions will be
filtered out based on the following criteria:
a. Non-Police transactions between 5 p.m. and 5 a.m.
b. Non-Police double transactions that occur within a 10-minute period of each other.
c. Non-Police transactions that occur on the weekends.
d. Managers will cease daily reviews once Fuel Master and GPS are fully functional and
automated exception reports can be developed.
2. Adjust all assets in Fuel Master so that their fuel tank capacities and authorized fuel limits
match.
Short term plan (Within 1 Year):
1. Discussed with our Electrician General Foreman, Fleet Manager, and Seaport Security. We are
defining the current needs of monitoring use at the Marine Maintenance fuel pumps. Options
include, but not limited to, a camera at the control box to determine facial recognition and
another camera set up to capture the license plate of the vehicles. Seaport security will work
with our ICT department to specify the project and make equipment recommendations. Type of
system would be a dedicated camera(s) linked to our current monitoring system that cannot be
manipulated away from the specific location.
2. Investigate Port Installed RFID Card Readers to authorize employees during Fuel Transactions
versus Fuel Master Provided hardware. Once the best course of action is determined, the Fleet
Manager will request a project to implement this change.
3. Request Funding, CPO coordination and ICT review of new Fuel Master and Veeder Root
hardware, software and interface creation.
Medium / Long Term Plan (1 to 5 years):
1. Upgrade the fuel island hardware and software. Install card reader access to validate employee
use of fuel Island. Install hardware on vehicles that validate the fueled vehicle is in fact a Port
owned vehicle. Calibrate fuel system so that each valid vehicle fueling can only dispense
enough fuel to fill the vehicle’s fuel tank to capacity and no more.
2. Install GPS devices on all Port vehicles. GPS will be utilized to collect mileage data. Once the
devices are installed, there will no longer be mileage entries at the fuel island.
3. Fuel consumption tracking will be implemented with GPS. GPS will also provide engine run
data and mileage. Right now, we do not collect engine run data on all assets.
PORT FUEL TRUCK CONTROLS
Immediate Action:
Employee fueling will have to complete and sign off on a fuel distribution sheet. General Foreman /
1 1
Marine Maintenance Shop Audit
January 2017 – February 2019
Crew Chief will have to review the fuel distribution sheet as they are filled out and turned in for
completeness and accuracy. They will then sign off on the sheet and deliver the Fuel Distribution
Sheet to Stores. Stores Personnel will then enter the fuel transactions into Maximo, and they will sign
off on the fuel sheet before turning it in to the Fleet Program Coordinator for storage.
Short Term Actions (0 – 1 Year):
1. Determine a cost for retrofitting Fuel Master on to the existing fuel truck.
2. Determine a cost for a new, smaller capacity fuel truck with Fuel Master installed.
3. Explore other options for fueling Port equipment without the use of a Fuel Truck.
4. Explore third party fueling options.
Medium Term Actions (1-3 Years):
1. Automate the Fueling of off-site assets through use of a new Fuel Truck or:
2. Automate fuel transactions through use of on-site Fuel Cells or:
3. Fuel offsite equipment through a 3rd Party vendor or:
4. Develop another method that meets the needs of our customers but can be tracked and
monitored.
1 2
Limitations of Translatable Documents
PDF files are created with text and images are placed at an exact position on a page of a fixed size.
Web pages are fluid in nature, and the exact positioning of PDF text creates presentation problems.
PDFs that are full page graphics, or scanned pages are generally unable to be made accessible, In these cases, viewing whatever plain text could be extracted is the only alternative.