Controls need to be implemented to improve accountability for fuel usage and provide safeguards for fuel and facilities where fuel is supplied, stored, and dispensed.
The Office of Internal Audit (OIA) conducted a management audit of fuel usage and security managed by the Department of Finance and Administrative Services (DFAS) - Fleet Management Division (FMD). The audit was included in the fiscal year (FY) 2012 audit plan.
The City of Albuquerque (City) provides fleet management services and fuel operations to more than 4,000 rolling and non-rolling stock (units) that support 18 City departments. FMD oversees the main responsibilities for management of the City’s fuel operations. Other departments with fuel operation responsibilities include the Solid Waste Management Department (SWMD) and the Transit Department. FuelFocus, the City’s automated fuel management system tracks, monitors and administers fuel usage.
According to the City’s budget documents, fuel operation is the largest activity within the Fleet Management Program. Fuel expenses were approximately $7.5 million during FY 2011. The mission of fuel operations is to supply, store, and dispense fuel to City vehicles and equipment and to ensure that City fleet fueling stations comply with applicable environmental regulations to include the New Mexico Underground Storage Tank Regulations, City and County fire codes, and Federal environmental laws and regulations.
Does FMD have adequate information system controls?
FMD does not have information system general or application control policies and procedures documented.
FMD does not have a written process in place to grant and terminate database access, or to require users to change their passwords regularly.
- 14 employees remained on the list after terminating employment with the City during FY 2011.
- 1 employee appeared on the list three times, with three different usernames.
OIA observed three user access control weaknesses involving separation of duties.
There were additional items found as a result of the testing performed for this objective.
- FMD does not keep a master inventory list of the individuals possessing keys to the Island Control Unit (ICU).
- There were 3,302 manual fuel transactions recorded in FuelFocus during FY 2011. Approximately 98% of these occurred at SWMD facilities. SWMD does not keep an inventory list of individuals possessing keys to the ICU.
Does FMD maintain adequate fuel card inventory records?
FMD does not follow the FMD Fuel Operations Procedures Manual regarding driver authorization forms and fuel usage logs.
- 23 of 24 driver authorization forms could not be found.
- Fuel usage logs from facilities without an ICU are not forwarded to the FMD accounting assistant.
FMD does not have a documented process for assigning fuel pin or card numbers, or for removing fuel users from FuelFocus, who terminated employment with the City.
OIA noted 221 of 308 units that have an active Wright Express (WEX) fuel card also have an active City-issued fuel card.
Are there adequate internal controls over fuel usage?
FuelFocus controls limiting the amount of fuel that can be pumped into a specific vehicle are working as intended, but unreasonable parameters have made the established control ineffective.
- OIA noted 12 of 24 units sampled have defined tank capacities that exceed the vehicle’s specifications.
- From a sample of 24 of 1,723 units allowed to fill-up 99 times per day, OIA noted not one fueled more than 4 times in any one day during FY 2011.
Additional items found as a result of the testing performed for this objective:
- FMD does not perform an appropriate level of management review of the WEX fuel credit card statement.
Are controls in place to monitor access to the City fleet’s fueling stations?
The Parks and Recreation Department – Golf Management Division does not reconcile fuel usage records to fuel purchases.
Audit testing concluded that 464 gallons could not be accounted for during August 2011 at the Puerto Del Sol Golf Course. Documents needed in order to perform reconciliations of fuel usage for September and October 2011 were illegible, incomplete, or could not be provided at all.
The fuel usage logs used at Puerto Del Sol Golf Course do not require employees to document unit numbers.
Of the City’s 23 fueling facilities, 13 do not have pumps that interface with FuelFocus through an ICU. OIA observed 9 of 23 City fueling facilities that lacked some security controls.
Is FMD properly billing City departments for the amount of fuel used by City employees?
From a sample of 20 of 3,607 units billed by FMD during FY 2011, OIA noted the following errors:
- 1 of 20 items tested was billed incorrectly by FMD.
- 2 of 20 items tested obtained fuel from the SWMD facility, but were billed by FMD.