8. Operational Audit - Ground Transportation
INTERNAL AUDIT REPORT OPERATIONAL AUDIT GROUND TRANSPORTATION TAXI CABS OCTOBER 2019 AUGUST 2020 ISSUE DATE: December 1, 2020 REPORT NO. 2020-16 INTERNAL AUDIT Ground Transportation Taxi Cabs TABLE OF CONTENTS Executive Summary ................................................................................................................................................ 3 Background ............................................................................................................................................................. 4 Audit Scope and Methodology ............................................................................................................................... 5 Schedule of Findings and Recommendations ....................................................................................................... 6 Appendix A: Risk Ratings ..................................................................................................................................... 11 2 Ground Transportation Taxi Cabs Executive Summary Internal Audit (IA) completed an audit of Ground Transportation - Taxicabs for the period October 2019 through August 2020. The audit was performed to assure compliance with policies, procedures and contractual obligations, and to evaluate internal controls governing taxicabs operations. In October 2019, the Port of Seattle launched a Taxicab pilot program. The pilot program was established through Commission Motion number 2019-03 and is scheduled to run for two years. The pilot program has 409 taxi operators. To respond to the impacts of Covid-19, motion number 2020-07 was issued by Port commission that included providing relief of activity fees between March 25, 2020 and July 31, 2020. Deferred payments totaled $91,248 and are due by March 31, 2021. In general, Port Management complied with policies and procedures governing Taxicab Operations. However, our audit identified opportunities where internal controls needed to be enhanced or developed. These opportunities are listed below and discussed in more detail beginning on page six of this report. 1. High The reconciliation process to identify and resolve differences between the Port's Automated Vehicle Identification (AVI) system and the in-house phone billing application (App) need to be enhanced and performed on a timely basis. Both the AVI system and App are technology-based tools that, when functioning as intended, should produce little to no variance, which will indicate that vehicles are being billed accurately. 2. Medium - An Information Technology Control for ensuring that only authorized individuals had access to the Taxi application, had failed. Although not exploited, an error in coding allowed all users of the Port's Enterprise network to have limited access to the application. 3. Low - The process to assure that all vehicles in the taxicabs program were inspected within a specified/predetermined frequency, needed to be improved. Prior to the COVID Pandemic, vehicle inspections were carried out on a random basis, which did not assure that all vehicles were inspected. We extend our appreciation to Port management and staff for their assistance and cooperation during this audit. Glenn Fernandes, CPA Director, Internal Audit Responsible Management Team Laurel Dunphey, Director, Airport Operations Dawn Hunter, Director, Aviation Commercial Management Lance Lyttle, Managing Director, Aviation 3 Ground Transportation Taxi Cabs Background In May 2019, the Port of Seattle Commission, through Motion number 2019-03, established a two year pilot program for the on-demand (flat rate / for hire) service at the Seattle Tacoma International Airport. The program included the following key elements: Vehicle owners that were offering on-demand taxi and flat-rate for-hire services under the previous program (East Side for Hire) were retained for the pilot program through September 30, 2021. The total number of vehicles in the pilot program were limited to no more than 410. Currently 409 vehicles are in the program. Permits were issued for every vehicle/owner(s) and were not transferable. Prior to issuance of permits, the Port obtained complete ownership information on each vehicle. Taxi owners could associate with any dispatch company. The Port earns an all-inclusive per-trip fee of six dollars ($6.00) per outbound trip. A quarterly outreach program was implemented by the Port to collect feedback and input from owners and drivers. A curb side management contract was procured directly with ABM Aviation Inc. The curb side services included passenger loading assistance, holding lot and queue management, and oversight of adherence to operating rules and requirements. The Port historicaly used the AVI system to track outbound trip activity. This system uses a magnetic card affixed to the windshield of the taxi. When exiting, the activity is logged using a separate scanning device which is attached to the overhead outbound street signage. For the pilot program, an App was developed internally and is used as similar to a "point of sale" transaction. This system includes a portal where drivers register a payment method, an internal web application for Ground Transportation Management to manage the operation, and an iOS App used by the Curbside Management company to validate a vehicle, driver and initiate payments. On April 1, 2020, Port Commission issued Motion number 2020-07 to provide relief and support to Port tenants and concessionaires due to impacts from Covid-19. The motion deferred Minimum Annual Guarantees and activity fees. Based on this motion, taxicab operators were granted relief of activity fees and permit payments between March 25, 2020 and July 31, 2020. Payments were deferred for six months and are due by March 31, 2021. Outstanding balances beginning April 1, 2021 are charged one percent (1%) interest per annum. The deferred payments per month is reflected below. As of November 10, 2020, $6,048 of the $91,248 had been collected. Month Revenue Billed ($) March 2020 2,994 April 2020 9,018 May 2020 16,194 June 2020 28,020 July 2020 35,022 Total $91,248 Source Billing schedule provided by Accounting Finance Reporting department 4 Ground Transportation Taxi Cabs Audit Scope and Methodology We conducted the engagement in accordance with Generally Accepted Government Auditing Standards and the International Standards for the Professional Practice of Internal Auditing. Those standards require that we plan and conduct an engagement to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our engagement objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our engagement objectives. The period audited was October 1, 2019 through August 31, 2020 and included the following procedures: Policy, Process, and Procedure Review Reviewed Commission policy and minutes to verify that the program was approved. Reviewed documentation to determine whether ABM and Taxi Operators complied with key provisions stipulated in their contracts. Reviewed the application process documentation to determine if controls were identified to facilitate complete and accurate data capture. Data Analysis Obtained trip data for a three-month period to assess completeness, accuracy, and timeliness of revenue and non-revenue trip data. Management Interviews Conducted interviews with management and staff from various departments to gain a better understanding of the various processes within the taxicab operations. Process Walkthrough Observed the process of trip data capture on a specific date, taking note of relevant vehicle information. Traced the details of the vehicle from the observation to the taxi application. 5 Ground Transportation Taxi Cabs Schedule of Findings and Recommendations 1) RATING: HIGH The reconciliation process to identify and resolve differences between the Port's Automated Vehicle Identification (AVI) system and the in-house phone billing application (App) needs to be enhanced and performed on a timely basis. Both the AVI system and App are technology-based tools that, when functioning as intended, should produce little to no variance, which will indicate that vehicles are being billed accurately. The on-demand taxi model uses 409 owner operators to transport customers from the airport. These owner operators transport customers multiple times daily resulting in thousands of transactions monthly. Because of the high volumes of transactions, a reconciliation to identify and resolve differences should be established and performed monthly. This will help assure fair and accurate billing for both parties; the vehicle owners and the Port. To assess the differences between the AVI system and the App, we tested two months of activity; November 2019 and August 2020. In November of 2019, the App count of 43,500 trips, was 3,100 trips higher than the AVI count of 40,400 trips. The data from the App is used to bill the drivers. There can be several reasons why the App count is higher than the AVI count, however, they can also indicate that drivers are being potentially overcharged, or that the systems are not accurate and need further investigation. While we noted a significant improvement in August of 2020, trip volumes were significantly lower as well, and we did not have sufficient data to conclude as to whether the issues had been fixed. Management was forthcoming and self-disclosed that they identified instances where operators had been erroneously double charged via the App, at inception of the program. This example, in addition to what the raw data tells us, illustrates the importance of performing timely reconciliations. Beginning in March of 2020 through June 2020, fees due from operators were deferred until March 31, 2021. Thereafter a 1% interest rate is levied on outstanding balances. During this time, the App was turned off and manual counts of vehicle trips were performed. The decision was made to use the lower of the manual counts, performed by ABM, or the AVI counts, to bill taxi operators. We tested the month of May 2020 and identified a 4.3% variance. This is reflected in the table below: May 2020 AVI count (without Code 11 trips) 2,899 ABM manual count 2,778 Difference 121 Recommendations: Management should continue to engage the Business Intelligence department which possesses subject matter expertise for building a technology-based reconciliation. We recommend that BI fully develop the reconciliation based on input from both Operations and Business Development. Management Response/Action Plan: The Ground Transportation (GT) team has a system in place to consistently perform monthly reconciliations/comparisons of the Taxi App's trip activity and the AVI system trip activity. That process continues to be refined and streamlined as the Pilot Program advances. 6 Ground Transportation Taxi Cabs The Operations team met with members of the Business Intelligence (BI) team (Dave Lutz & Frances Goli) in June 2020 asking for their assistance to develop a tool for the monthly reconciliation, as the months prior to June 2020 were completed manually. Our partners in BI informed us that the Tableau program was not actually designed for this type of reconciliation and that an Excel spreadsheet could be developed as an alternative. At the outset of the Pilot Program, we relied heavily on a newly developed App to support fee collection and activity for each vehicle transporting customers from Sea-Tac. We also utilize an automated vehicle identification (AVI) system that electronically records each vehicle movement through the facility. As a result of the significant reduction in traffic at the airport, Operators participating in the Pilot Program were offered a deferment of fee payment from March 2020 through June 2020. During that time, staff were compelled to conduct a reconciliation of manual counts for revenue trips leaving the airport (typically accounted for in the App) and AVI activity. The manual activity counts were performed by American Building Maintenance (ABM), a Port contractor who provides curbside management services specifically for the Taxi/Flat Rate Pilot Program. These manual counts also considered non-revenue trips (no customers), or "Code 11" as referred to in the Pilot Program. In response to the need to reconcile activity, GT staff developed an Excel pivot table that helped to automate the process. Staff load all recorded AVI trips and revenue Taxi/Flat Rate trips recorded by the APP into the Excel spreadsheet. The Excel pivot table can sort through both lists and identify matches. It then identifies which AVI trip does not have an accompanying Taxi App trip or vice versa. These "outlier" trips are then discussed with ABM to better understand how the trip should have been processed. In many cases, the trips are identified as "Code 11" or non-revenue (no customer). While we aspire to a 100% match and reconciliation, the process of recording trip activity requires a manual scan of each vehicle accessing the Taxi curb in the airport garage. Challenges remain with the Taxi App and the AVI system recording equivalent numbers of trips. The Taxi App records revenue-generating trips only, as manually scanned by an ABM employee and has risk for human error (missed scan, double scan etc.), while the AVI system reports ALL exits from the Airport. Therefore, AVI counts both revenue-generating and non-revenue generating trips (Code 11). Assuming the AVI system and the Taxi App are performing as designed, and that non-revenue trips are accurately reported, the reconciliation is as follows: AVI trips (all activity) App recorded (revenue trips) = Code 11 (non-revenue) We will continue to work with BI to look at the process and have a goal of matching all trips. We'll also continue to investigate a technology solution that will support both the current Pilot Program and its successor. DUE DATE: Completed 7 Ground Transportation Taxi Cabs 2) RATING: MEDIUM An Information Technology Control for ensuring that only authorized individuals had access to the Taxi application, had failed. Although not exploited, an error in coding allowed all users of the Port's Enterprise network to have limited access to the application. Users in the Taxi application can enable or disable taxi operators signed up in the program. While this does not appear to affect the number of billed trips, an issue with approved access could potentially allow unauthorized vehicles to be added to the system or inappropriately denied access. During testing, Internal Audit noted that an individual had access to the Taxi application but did not appear on a list of authorized users maintained by the Information and Communications Technology department (ICT). Upon investigation, ICT identified a coding flaw in the application that allowed the access noted above to all users of the Enterprise network. The coding flaw has been corrected, and ICT has added additional testing practices that look for this type of defect to help prevent it from reoccurring. Recommendation ICT should review the application's audit logs to confirm that the vulnerability was not exploited. Ground Transportation Management should carry out periodic user access reviews, to confirm that only authorized users have access and that they have been assigned the appropriate access rights. Management Response/Action Plan: A fix for this defect was deployed in October 2020. This fix applied corrected authorization logic. Audit logs for the application were also reviewed to look for cases where inappropriate personnel would have made any modifications. This review did not find evidence of the defect being inappropriately exploited. Since the bug was introduced, additional testing practices have been developed. These testing practices include checks specific to this type of defect and are expected to help prevent this in the future. As the On-Demand Taxi Pilot Program was implemented, the Ground Transportation Manager provided ICT with a list of staff who should be given access to the Taxi App in order to authorize and de-authorize vehicles. The Ground Transportation team will continue to work with our ICT partners to ensure authorized users have access. Ground Transportation will request a list of authorized users from ICT on a quarterly basis to validate users in the Taxi App. DUE DATE: Completed 8 Ground Transportation Taxi Cabs 3) RATING: LOW The process to assure that all vehicles in the taxicabs program were inspected within a specified/predetermined frequency, needed to be improved. Prior to the COVID Pandemic, vehicle inspections were carried out on a random basis, which did not assure that all vehicles were inspected. The agreement with Operators states that 'Operator shall make its employees, agents, drivers and vehicles available for inspection and review by representatives of the Port at any time while on Port property. The Port may inspect employees, agents, drivers and vehicles at any time for compliance with the standards in this Agreement. Operator's vehicles, employees, agents and drivers may be inspected for cleanliness, proper equipment, good appearance, safe operating conditions and violations of any laws, ordinances, or the terms of this Agreement'. Port representatives include Ground Transportation (MGT), King County, and City of Seattle Inspectors. King County provides decals to vehicle owners after their safety inspection. This control assures that operators have the appropriate documentation for both the vehicles and the drivers, and that the King County decals exist and are current. Inspecting vehicles helps assure the safety of passengers transiting through SeaTac and using the Port's Ground Transportation options. These inspections also allow for quality control, thereby helping SeaTac develop a "best in class" ground transportation experience for customers. From the sample of 15 vehicles reviewed, there was no evidence of inspection for the two vehicles below; Taxi 284 Yellow Cab on demand - there was no recent record of vehicle inspection. Taxi 528 E Cab was last inspected in July 2019. Recommendation Management should design a process to assure that all vehicles in the program are inspected within a pre-determined frequency, retain documentation to evidence the inspection, and assure items requiring attention are monitored until they are fully resolved. Management Response/Action Plan: There is not a specific requirement for Port staff to license or inspect Taxi/Flat Rate vehicles. However, prior to the COVID-19 pandemic, each on-demand taxi was physically inspected by Ground Transportation staff each regularly. This is in addition to the work performed by the Department of Licensing and King County. The primary responsibility for vehicle inspection is with King County, but the Airport staff have added inspections to provide an additional layer of quality support. These inspections include current licensing, insurance, and physical vehicle inspection. Over the past few years the airport's Taxi/Flat Rate fleet has grown despite lagging customer demand. Given that Taxi/Flat Rate Operators have access to the airport, but may not choose to operate consistently, the GT team has found it difficult to inspect vehicles consistently. With the Pilot Program, there is not a requirement for the Port to conduct inspections, only that Operators are to make their vehicles available for inspection as requested by the Port GT team. Given the more recent concerns about the safety of doing in-person, onsite vehicle inspections, we have modified our inspection process; Since March 2020, the inspection process has become a virtual review of driver credentials, i.e., for-hire license, business license, vehicle insurance, etc. We partner with King County for current information related to driver credentials 9 Ground Transportation Taxi Cabs and by contacting drivers directly to see how they've been faring during this pandemic and collect any missing information. Minimum staffing available due to approved public health emergency leave had a temporary impact on the Ground Transportation team. During this time, inspections were not done as frequently as expected for nor were taxis regularly available at the airport. As of November 23, 2020, the two taxis referenced above were seldom at the airport. Cab 284's last recorded trip was on Mar 23 and Cab 528's last recorded trip was on Mar 18. Effective January 1, 2021 our process will include: Vehicles and operating documents will be inspected on a quarterly basis. Each GT Controller will be assigned a specific set of vehicles for inspection. Inspections will primarily be accomplished by reviewing operating documents (licenses, insurance, operating agreement) o If additional information is required, Operators will update with the assistance of Port staff at our location on the 3rd floor of the garage. o Operators that are not current with appropriate documents may be suspended from serving the airport until such time all required operating information is in place. Lead GT Controllers will review the list of active vehicles monthly for compliance. DUE DATE: 01/01/2021 1 0 Ground Transportation Taxi Cabs Appendix A: Risk Ratings Findings identified during the audit are assigned a risk rating, as outlined in the table below. Only one of the criteria needs to be met for a finding to be rated High, Medium, or Low. Findings rated Low will be evaluated and may or may not be reflected in the final report. Financial Internal Commission/ Rating Compliance Public Stewardship Controls Management High probability Non-compliance Missing or not for external audit Requires with Laws, Port High Significant followed issues and / or immediate Policies, negative public attention Contracts perception Partial Potential for Partial controls compliance with external audit Requires Medium Moderate Laws, Port issues and / or Not functioning attention Policies negative public effectively Contracts perception Functioning as Low probability intended but Mostly complies Does not for external audit could be with Laws, Port require Low Minimal issues and/or enhanced to Policies, immediate negative public improve Contracts attention perception efficiency 1 1
Limitations of Translatable Documents
PDF files are created with text and images are placed at an exact position on a page of a fixed size.
Web pages are fluid in nature, and the exact positioning of PDF text creates presentation problems.
PDFs that are full page graphics, or scanned pages are generally unable to be made accessible, In these cases, viewing whatever plain text could be extracted is the only alternative.