State of New York Office of the State Comptroller Division of Management Audit and State Financial Services

State of New York Office of the State Comptroller Division of Management Audit and State Financial Services NEW YORK CITY DEPARTMENT OF HOUSING PRESERVATION AND DEVELOPMENT CONTROLS OVER RENT REVENUES REPORT 2000-N-4 H. Carl McCall Comptroller

State of New York Office of the State Comptroller Division of Management Audit and State Financial Services Report 2000-N-4 Ms. Jerilyn Perine Commissioner New York City Department of Housing Preservation and Development 100 Gold Street, Fifth Floor New York, NY 10038 Dear Ms. Perine: The following is a report of our audit on the internal controls over rent revenues at the Department of Housing Preservation and Development. This audit was performed pursuant to the State Comptroller s authority as set forth in Article V, Section 1 of the State Constitution; Article II, Section 8 of the State Finance Law; and Article III of the General Municipal Law. Major contributors to this report are listed in Appendix A. October 25, 2000 OSC Management Audit reports can be accessed via the OSC Web Page : http://www.osc.state.ny.us. If you wish your name to be deleted from our mailing list or if your address has changed, contact the Management Audit Group at (518) 474-3271 or at the Office of the State Comptroller, Alfred E. Smith State Office Building, 13th Floor, Albany, NY 12236.

Executive Summary New York City Department of Housing Preservation and Development Controls Over Rent Revenues Scope of Audit The New York City Department of Housing Preservation and Development (HPD) was created in 1977 to preserve, upgrade and develop affordable and decent housing for residents of the City of New York (City). Since the 1970s, when the City took In Rem (tax foreclosure) actions to seize an inventory of deteriorated and/or abandoned apartment buildings, HPD s Division of Property Management (DPM) has been responsible for the management and maintenance of these properties. As of January 31, 2000, HPD s inventory of buildings comprised more than 9,000 occupied units. HPD uses a private vendor to handle its monthly tenant billings, and contracts with the Chase Manhattan Bank (Chase) to collect and process rent payments that tenants mail directly to a lockbox. Rent is also collected at DPM s three field offices in the City, as well as two units of HPD s central office. All revenues collected are deposited into the City s account at Chase. Tenant account information is maintained on HPD s Tenant Accounts System (TAS). HPD reported that $25.6 million in rent revenues were collected for the fiscal year that ended on June 30, 1999. Another $13.1 million was collected for the subsequent seven-month period that ended on January 31, 2000. This financial-related audit, which covered the period of July 1, 1998 through January 31, 2000, addressed the following question:! Has HPD established adequate internal controls to ensure that rent revenues are collected, safeguarded and recorded in a timely manner; and that adjustments to tenant accounts are authorized and documented properly? Audit Observations and Conclusions Our evaluation of the internal control structure related to HPD s rent revenues identified several control weaknesses. As a result of these weaknesses, there is the risk that rent revenues may not be properly accounted for at the field offices, and that adjustments to tenant accounts and access to the TAS system may not be properly authorized. Our review at HPD s three field offices found that there is no process for independently verifying that checks collected from tenants by the field offices are, in fact, transmitted to the central office. In addition, we noted that if tenants who have moved out of their apartments have unpaid balances, the arrears stay on TAS and are not written off, even though HPD officials deem these accounts to be uncollectible. Also, we were informed that management reports do not include past due accounts receivable balances of the noncurrent tenants because they do not warrant the time and effort it would take to age and write them off. (See pp. 5-6)

Our review of a random sample of 44 tenant accounts out of a population of 9,421 current tenants as of January 31, 2000, found that rent receipts had not been posted to the accounts of 10 (23 percent) of the sampled tenants on a timely basis. If receipts are not posted to tenant accounts in a timely manner, the accuracy of the tenant account balances is distorted. We also found that HRA had subsidized a portion of the rent paid by 3 of the 44 tenants, whose rent arrears totaled $14,367 as of January 31, 2000. We were informed that, according to HPD policy, no legal action is taken to collect the accumulated shortfalls between the amount of rent charged and the level of HRA payments. We found no written policy that allows HPD officials to forgive the difference in rent for these tenants. (See p. 6) We also reviewed a random sample of 50 adjustments to tenant accounts from a population of 18,605 that were made between July 1, 1998 and January 31, 2000, and found that authorization for 8 (16 percent) of the adjustments, totaling $774, could not be documented. Without adequate documentation, we could not be reasonably assured that these adjustments were proper and valid. (See p. 7) In addition, we performed a limited general and application control review of TAS and found several control deficiencies that need to be corrected. As a result, the security of TAS records could be compromised, and individual users cannot be held accountable for their activities in the system. TAS users in the HPD field offices also feel constrained by the system, which does not allow them to generate timely reports that are needed to perform their jobs efficiently. (See pp. 9-10) Our report contains six recommendations to address the specific control weaknesses we identified. Comments of HPD Officials HPD officials fully or partially agreed with most of our recommendations. HPD officials did not agree with our recommendation to report on past due tenant accounts or to modify the Tenant Accounts System. A complete copy of HPD s response is included as Appendix B to this report.

Contents Introduction Controls Over Rent Revenues Controls Over TAS Appendix A Appendix B Background... 1 Audit Scope, Objective and Methodology... 2 Internal Control and Compliance Summary... 3 Response of HPD Officials to Audit... 4 Reconciliation of Rent Checks... 5 Tenants Accounts Receivable and Write-Offs... 5 Sample of Rent Billings... 6 Sample of Adjustments to Tenant Accounts... 7 Recommendations... 7 Access to TAS... 9 TAS Program Flexibility... 10 Recommendation... 10 Major Contributors to This Report Response of New York City Department of Housing Preservation and Development Officials

Introduction Background The New York City Department of Housing Preservation and Development (HPD) was created in 1977, under Local Law 29, to preserve, upgrade and develop affordable and decent housing for residents of the City of New York (City). Beginning in the 1970s, through In Rem (tax foreclosure) actions, the City took ownership of a massive inventory of deteriorated and/or abandoned buildings. HPD s Division of Property Management (DPM) manages and maintains these buildings. According to HPD officials, one of their goals is to privatize these buildings so that HPD can get out of the landlord/ tenant business. On occasion, when apartments become vacant, they are rented to the homeless through the City s shelter program. As of January 31, 2000, HPD s inventory of buildings comprised more than 9,000 occupied units. HPD reported that rent revenues totaling $25.6 million were collected for the fiscal year that ended on June 30, 1999. Another $13.1 million was collected for the subsequent seven-month period that ended on January 31, 2000, when the reported accounts receivable balance was $15 million (not including unpaid rent arrears of tenants who had already vacated their apartments). HPD uses a private vendor to handle monthly tenant billings, and also contracts with the Chase Manhattan Bank (Chase) to collect and process rent from tenants through a lockbox operation. Tenants mail their rent payments, along with the return portion of their monthly bill, directly to the lockbox for processing. In addition to the lockbox, rent is collected at DPM s three field offices, as well as two units at HPD s central office the Revenue Services Office (RSO) and the Landlord Tenant Litigation Division. Rent collected at the field offices is first forwarded to RSO, then sent to the lockbox. Approximately 50 percent of HPD s residential tenants are public assistance recipients whose rents are paid by the New York City Human Resources Administration (HRA) through direct vendor payments (wire transfers) to HPD. Approximately 95 percent of the remaining tenants mail their rent payments directly to the lockbox, while the remaining 5 percent pay at DPM s three field offices. All revenues collected are deposited into the City s account at Chase, which, in turn, sends HPD officials a computer tape record of the deposit transactions. HRA also sends tapes to HPD that document the direct vendor payments. Tenant account information is maintained on HPD s Tenant Accounts System (TAS), which is one of many applications maintained on the City s mainframe computer. No direct online entries are made to TAS for rent collected; instead, the tapes from Chase and HRA are used to update tenant accounts periodically. The only direct entries made to tenant accounts are for adjustments such as abatements, terminations of accounts, transfers of tenants to different apartments, etc.

Audit Scope, Objective and Methodology The audit scope covered the period of July 1, 1998 to January 31, 2000. The objective of this financial-related audit was to evaluate HPD s internal controls over rent revenues. As part of this audit, we sought to determine whether rent billings were being collected, safeguarded adequately and recorded in a timely manner; and whether adjustments to tenant accounts were being authorized properly and documented adequately. To accomplish our objective, we selected a random sample of 50 tenant accounts from a data base provided by HPD that consisted of a population of 9,421 accounts that represented current tenants as of January 31, 2000. For each of the sampled tenants, we then judgmentally selected rent billings for January 2000 and June 1999, to determine whether their rents had been paid and recorded properly in a timely manner. Because 5 of the 50 tenants had not yet occupied their apartments and that the account of a sixth sample tenant was inactive, we excluded these six accounts from our sample. As a result, we reviewed a random sample of 44 tenants. We reviewed the tenants accounts recorded on TAS, as well as supporting documents such as billing statements and deposit slips. In addition, we selected a random sample of 50 adjustments to tenants accounts from a population of 18,605 such adjustments that were made between July 1, 1998 and January 31, 2000, to determine whether they had been authorized properly and documented adequately. We also performed a limited general and application control review of TAS to determine the reliability and accuracy of the system s data. In addition, we interviewed HPD officials and reviewed relevant laws, rules, regulations, policies and procedures. Except as discussed in the following paragraph, we conducted our audit in accordance with generally accepted government auditing standards. Such standards require that we plan and perform our audit to adequately assess those operations of HPD which are included in the audit scope. Further, these standards require that we understand HPD s internal control structure and compliance with those laws, rules and regulations that are relevant to the operations which are included in our audit scope. An audit includes examining, on a test basis, evidence supporting transactions recorded in the accounting and operating records and applying such other auditing procedures as we consider necessary in the circumstances. An audit also includes assessing the estimates, judgments and decisions made by management. We believe that our audit provides a reasonable basis for our findings, conclusions and recommendations. As is our practice, we notified HPD officials at the outset of the audit that we would request a representation letter in which management provides assurances, to the best of their knowledge, concerning the relevance, accuracy and competence of the evidence provided to the auditors during the 2

course of the audit. The representation letter is intended to confirm oral representations made to the auditors and to reduce the likelihood of misunderstandings. Agency officials normally use the representation letter to assert that, to the best of their knowledge, all relevant financial and programmatic records and related data have been provided to the auditors. They affirm either that the agency has complied with all laws, rules and regulations applicable to its operations that would have a significant effect on the operating practices being audited, or that any exceptions have been disclosed to the auditors. However, officials at the New York City Mayor s Office of Operations have informed us that, as a matter of policy, Mayoral agency officials do not provide representation letters in connection with our audits. As a result, we lack assurance from HPD officials that all relevant information was provided to us during the audit. We consider this refusal to provide a representation letter to be a scope limitation on our audit. Therefore, readers of this report should consider the potential effect of this limitation on the findings and conclusions presented in the report. We use a risk-based approach to select activities to audit. We focus our audit efforts on those activities we have identified through a preliminary survey as having the greatest probability for needing improvement. Consequently, by design, we use finite resources to identify where and how improvements can be made. We devote little audit effort reviewing operations that may be relatively efficient or effective. As a result, we prepare our audit reports on an exception basis. This report, therefore, highlights those areas needing improvement and generally does not address activities that may be functioning properly. Internal Control and Compliance Summary Our evaluation of the internal control structure related to HPD s rent revenues identified several control weaknesses. As a result of these weaknesses, there is the risk that rent revenues may not be properly accounted for at the field offices, and that adjustments to tenant accounts and access to TAS may not be properly authorized. These matters are presented throughout the report. 3

Response of HPD Officials to Audit We provided draft copies of this report to HPD officials for their review and comment. We considered their comments in preparing the final report and included their comments as Appendix B. Within 90 days after the release of the final report, we request that the Commissioner of the New York City Department of Housing Preservation and Development report to the State Comptroller, advising what steps were taken to implement the recommendations contained in the report, and, where recommendations were not implemented, the reasons therefor. 4

Controls Over Rent Revenues An effective system of internal controls provides reasonable assurance that all cash receipts are safeguarded adequately, posted to appropriate accounts in a timely manner, and deposited promptly. In addition, adjustments to the accounts should be authorized properly and documented adequately. We found that HPD does not have a process for independently verifying that all checks collected from tenants are accounted for. In addition, if tenants who have moved out of their apartments have unpaid balances, the arrears stay on TAS and are not written off. Also, the past due accounts receivable balances for such tenants are not included in management reports and no effort is made to collect the unpaid rents. We also found that rent receipts are not always posted to tenant accounts in a timely manner, and that HPD has no formal policy addressing unpaid balances owed by tenants receiving public assistance. Finally, in some cases, we found inadequate supporting documentation that would indicate proper authorization of the adjustments made to sampled tenants accounts. Reconciliation of Rent Checks Tenants Accounts Receivable and Write-Offs Internal controls are necessary in order to provide proper accountability and adequate safeguarding of rent checks. Our review at HPD s three field offices found that the procedures for collecting tenants rent checks and submitting them to HPD s central office should be improved. There is no process for independently verifying that all checks collected from tenants are accounted for. When the clerk collects the rent check, he/she gives a receipt to the tenant and records the check on a transmittal sheet. The supervisor verifies that the total of the rent payments listed on the transmittal sheet is arithmetically correct, signs the sheet, and sends it together with the rent checks to the central office. However, the supervisor does not reconcile the amount of rent recorded in the receipt books with the amounts reported on the transmittal sheet. As a result, there is increased risk that rent checks may not be properly accounted for. To provide an accurate accounting of HPD s financial position, tenant accounts receivable balances should be reported, aged and uncollectible accounts should be written off. According to HPD officials, tenants accounts are closed when they vacate their apartments. If these tenants have unpaid balances, the arrears stay on TAS and are not written off even though HPD officials deem these accounts to be uncollectible. In addition, we were informed that management reports do not include past due accounts receivable balances of the non-current tenants because they do not warrant the time and effort it would take to age and write them off. They further 5

explained that the current TAS does not provide for the aging of the tenants accounts receivables. In our judgement, data on past due accounts should be reported to provide an accurate accounting of HPD s financial position. Sample of Rent Billings We selected a random sample of 50 tenant accounts from HPD s data base that represented, according to HPD officials, the current tenant population as of January 31, 2000. However, we found that 5 of the 50 tenants had not yet occupied their apartments and that the account of 1 tenant was inactive. As a result, we sampled 44 tenant accounts. Our review of the 44 sampled tenant accounts revealed that, although 33 of these tenants had made rent payments, the remaining 11 had not paid their rent for January 2000 and/or June 1999. We determined that these 11 tenants did not pay rent because of court decisions and HPD s policy of not forcing tenants whose apartments/buildings need major repairs or who are being subsidized by HRA, to pay their rent or rent arrears. Good business practices require that revenues should be posted to tenant accounts in a timely fashion after they are received. However, our review found that for 10 (23 percent) of the 44 sampled tenants, HPD had taken more than 3 days to update their accounts with delays ranging from 6 to 17 days. If receipts are not posted to tenant accounts in a timely manner, the accuracy of the tenant account balances is distorted. In this regard, HPD officials stated that updating delays occur when they receive a tape from Chase that cannot be read, requiring return of the tape to Chase and a subsequent wait for a replacement tape. They added that this problem will be resolved when HPD starts using an electronic transfer process. From our review of tenant accounts, we found that HRA paid a portion of the rent owed by three of the 44 sampled tenants for both of our sampled months. The unpaid account balances for these tenants the difference between the rent HPD charged and the amount HRA had paid on their behalf because they were on public assistance totaled $14,367 as of January 31, 2000. We found that HPD had made no effort to collect or to write off the unpaid balances. We were informed that HPD has a policy whereby legal action is not taken to collect the accumulated shortfalls between the rent charged and HRA payments because, according to HPD officials, the indebted tenants would most likely not be able to pay the difference. However, we found no written policy regarding the treatment of such unpaid balances. 6

Sample of Adjustments to Tenant Accounts HPD staff should maintain documentation that will support the authorization of any adjustments made to tenants accounts. We selected a random sample of 50 adjustments from a population of 18,605 adjustments made between July 1, 1998 and January 31, 2000, to determine whether they had been authorized properly and documented adequately. We found no supporting documentation that would indicate that 8 (16 percent) of the 50 adjustments, totaling $773.50, had been authorized. HPD officials stated that such documentation for 7 of the 8 sampled adjustments was supposed to be maintained at the field offices, but that it had evidently been misplaced when the three offices were merged. They informed us that a search for the missing documents was underway. They further explained that there is a control system in place whereby a monthly listing of adjustments is sent to the field offices for verification and sign-offs. However, the officials conceded that the original source documents to support the authorization for adjustments should be maintained. They also pointed out that, although the eighth sampled adjustment ($180) had been authorized, the clerk entering the adjustment had made an error and did not follow the required procedure of obtaining written authorization from his supervisor. Without documentation, we cannot be reasonably assured that these adjustments were proper and valid. Recommendations 1. Revise rent collection procedures so that supervisors at the field offices are required to reconcile the amount of rent recorded in the receipt books with the amount reported on the transmittal sheets. (HPD officials agreed to implement this recommendation.) 2. Provide reports on accounts receivable balances on past due tenants accounts, and write off those accounts deemed uncollectible. (HPD officials replied that aging arrears would not improve management of their collection process and it would entail considerable expense to reprogram the Tenant Account System (TAS) and for ongoing maintenance of the data. They also stated that it is not prudent to make an effort to collect arrears on terminated accounts and that once terminated, an account is in effect written off. ) 7

Recommendations (Cont d) Auditors Comment: HPD s response did not fully address the issues contained in this recommendation. We reiterate that as a good business practice and sound management tool, HPD should produce reports on past due tenants accounts, specifically terminated accounts, and write off uncollectible accounts from TAS. 3. Take steps to ensure that tenant accounts are updated on a timely basis after the rent payment is received. (HPD officials replied that there is no requirement that deposits be posted to tenant accounts within three days. However, they added that they expect to implement a direct file transfer process with the bank shortly that would eliminate problems with the transmission of data from the bank to their computer center.) Auditors Comment: Based on HPD s response, we amended our report and modified this recommendation to indicate that payments to tenant accounts should be recorded on a timely basis. 4. Establish a written policy to be followed when collecting and accounting for any unpaid balances owed by tenants on public assistance and receiving rent subsidies from HRA. (HPD officials agreed to implement this recommendation. The officials stated that although a written policy statement did not exist, the Deputy Commissioner confirmed for the auditors that the correct policy was being followed.) 5. Enforce the requirement that all adjustments to tenant accounts be authorized properly and documented adequately. (HPD officials agreed with this recommendation, stating that they will retrain the field office personnel responsible for maintaining these records, to remind them of the importance of maintaining complete and accessible back up for each transaction.) 8

Controls Over TAS We performed a limited general and application control review of TAS and found several control deficiencies that need to be corrected. As a result, the security of TAS records could be compromised, and individual users cannot be held accountable for their activities in the system. TAS users in the HPD field offices also feel constrained by the system, which does not allow them to generate timely reports that could guide management in legal actions. Access to TAS Maintaining the accuracy and integrity of data on TAS is vital for HPD s operations. Consequently, controls should be established to ensure that only authorized users have access to data files. Such controls can be implemented by using software that can specify which individuals have access to a system and can authorize the specific resources and capabilities available to them. The software would also enable management to log and report access activity. We noted that HPD does not provide unique individualized passwords to employees who are authorized to make adjustments to the records in the TAS database. Rather, one generic password is used by authorized members of the field staff, while central office staff use another password for entering transactions. Furthermore, HPD does not change the passwords on a regular basis or when an employee leaves HPD s employment. Moreover, TAS does not provide a user identification code for each transaction that would enable a supervisor or manager to determine who processed the transaction. For example, the Revenue Services Office must send monthly transaction reports to the field offices so that field office managers can verify whether or not they processed the transactions. HPD management explained that TAS is an old program and was not developed with the ability to change passwords and stamp user IDs on each transaction report. However, we were informed that HPD s Technology Service Department (TSD) can add modules to the program that would enable it to add and delete passwords, and also make it possible for the user ID to be stamped on each transaction report. TSD officials told us that such modifications would entail a great deal of time, effort, and cost; but, in our judgement, HPD should consider the cost and benefits of modifying TAS in ways that would improve its internal controls. TAS Program Flexibility In our visits to the field offices, TAS users indicated that TAS does not allow them to generate certain reports that are needed to perform their jobs efficiently. As an example, they stated that they cannot generate a monthly 9

report that lists the names of tenants who owe rent. Using such a report, HPD could collect rent arrears in a more timely fashion. Also, the Landlord Tenant Litigation Division (LTLD) would have ready access to the information it would need if it were necessary to take legal action against a tenant. LTLD can not proceed legally until it receives the results of the apartment inspection it asks the field office to perform. LTLD officials point out that delays in obtaining reports from the field office hinder them from collecting rent from tenants. In fact, in the case of our random sample tenant accounts, LTLD officials were waiting to obtain reports from the field office before they could proceed with legal actions to collect rent from one tenant who had arrears of $20,155. This example points out the possible costeffectiveness of an effort to modify the TAS software so that monitoring reports could be generated. Recommendation 6. Assess the costs and benefits of modifying TAS so that:! each authorized user is assigned a unique password to TAS that is changed on a regular basis and is deleted from the system when the user leaves HPD employment;! a user identification code is indicated for each transaction processed by the system; and! HPD s field offices can use TAS to generate computer reports that will enable their operations to be more efficient and effective. (HPD officials partially agreed with this recommendation. Regarding the first component of the recommendation, the officials indicated that the mainframe operating system will be upgraded during the fourth quarter of 2000 so that each user will have a unique password to gain access to the system. However, in response to the second component, they stated that the recording of the specific user on each transaction cannot be implemented without a significant amount of reprogramming of the existing TAS and stated their belief that the minimal benefit that would result does not justify the cost. HPD officials disagreed with the third component of the recommendation, indicating that an adequate reporting facility exists in the form of 10

Recommendation (Cont d.) monthly extracts of TAS. They further added that HPD reorganized its collection process several years ago to centralize the initial review of delinquent accounts in order to allow field staff to concentrate more on their primary responsibilities.) Auditors Comment: We maintain that associating a user code with each transaction on TAS provides a more effective audit trail in detecting unauthorized transactions. Further, HPD s assertion that it would not be cost-beneficial to reprogram TAS is not supported by analysis. Regarding HPD s field offices needs to use TAS to generate computer reports, we believe it is important that management evaluate the needs of its customers (in this case, field office staff) who informed us that TAS does not fulfill their needs for information. 11

Major Contributors to This Report Kevin McClune Howard Feigenbaum Albert Kee Tenneh Blamah Donna Sylvester Legendre Ambrose Hugh Zhang Marticia Madory Appendix A

Appendix B

B-2

B-3

B-4

B-5