The Independent Office of Audits and Investigations (IOAI) completed an audit of Caltrans’ certification process of Disadvantaged Business Enterprises (DBE). The purpose of the audit was to assess whether the Caltrans DBE certification program overseen by the Office of Business and Economic Opportunity (OBEO) complies with applicable federal and state requirements.

Our audit determined the following OBEO process and procedures do not comply with federal and state requirements:

• Certification decisions exceed the 90-day federal requirements for in-state applications.
• On-site interviews of disadvantaged owners instead of principal officers.
• Evaluation of eligibility evidence is inconsistent.
• Internal control weaknesses exist over certification process and procedures.

Our audit disclosed, however, that OBEO is processing certification decisions for out-of-state applications within the 60-day federal requirements.

The objectives of the audit were to:

• Determine if Caltrans’ Disadvantaged Business Enterprises (DBE) certification process meets federal and state requirements.
• Verify if the Office of Business and Economic Opportunity (OBEO) policies and procedures are able to prevent firms from circumventing the certification process.

The audit reviewed Caltrans’ DBE certification process, compliance with applicable regulations, and the DBE certification database as it relates to the audit objectives. The audit did not cover the content of the database as it was outside the scope of the audit. The audit period is between January 1, 2018, and March 22, 2019.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

We reviewed policies and procedures, collected and analyzed documents, and observed and interviewed OBEO staff with direct knowledge of areas relevant to the audit objectives. A sample size of 50 DBE application files representing approximately 11% of the total audit population was randomly selected and stratified for testing based on our assessment of the internal controls and risks. Of the 50 files selected, 27 in-state and 9 out-of-state applications were processed by OBEO for initial certification and the remaining 14 files were reviewed by OBEO for compliance issues only as these had existing certifications.

California Senate Bill 103 (SB103) (Chapter 95, Statutes of 2017) directs the Inspector General of the Independent Office of Audits and Investigations (IOAI) to audit contract-seeking businesses as appropriate to ensure that they do not subvert the purposes of the provisions of SB103. To meet this requirement, IOAI performed an audit of OBEO’s DBE certification process.

The United States Department of Transportation (DOT) distributes funds each year to finance projects initiated by state and local governments, public transit, and airport agencies. DOT has the responsibility of ensuring that firms competing for federally assisted projects have a level playing field of equal opportunity for socially and economically disadvantaged firms. The DOT’s most important tool for meeting this responsibility has been its DBE program. The integrity of the DBE program depends upon systematic procedures to ensure that only bona fide small firms, owned and controlled by a socially and economically disadvantaged individual(s), are certified to participate as DBEs in federally assisted programs.

To meet the objectives of the DBE program, DOT requires recipients and pass through agencies of its funds to comply with 49 Code of Federal Regulations (CFR) Part 26. These regulations also require a unified certification program (UCP) be formed by the state transportation agency and all other certifying agencies within the same state. When a firm is certified by one member of the UCP, the DBE certification is recognized by all other certifying agencies.

Caltrans is a recipient of federal funds for transportation projects, funding that creates business opportunities for socially and economically disadvantaged individuals. Hence, Caltrans is subject to the DBE standards within 49 Code of Federal Regulations (CFR) Part 26. These regulations define the elements that must be addressed and incorporated in Caltrans’ DBE program. Firms seeking DBE certification from Caltrans must submit an application to OBEO. The CFR states that the applicant firm has the burden of demonstrating by a preponderance of the evidence that it meets the requirements concerning group membership, individual disadvantage, business size, ownership, and control. After evaluating the evidence contained in the application file and information obtained during the site visit interview, an eligibility determination is made, and the firm is entered as approved or denied into the UCP directory of DBEs published online.

OBEO’s current certification process consists largely of the five distinct stages below which involve various roles, including review and decision-making.

 

If at any time, the DOT or a certifying agency has reason to believe a firm has willfully and knowingly provided incorrect information or made false statements to circumvent the process, the DOT may initiate suspension proceedings against the firm.

Our audit determined that the following OBEO process and procedures did not comply with federal and state requirements:

• Certification decisions exceed the 90-day federal requirements for in-state applications.
• On-site interviews of disadvantaged owners instead of principal officers.
• Evaluation of eligibility evidence is inconsistent.
• Internal control weaknesses exist over certification process and procedures.

This audit report is a matter for public record and will be placed on IOAI’s website, which can be viewed at https://ig.dot.ca.gov

We requested and received a written response to our findings from the Assistant Director’s Office of Business and Economic Opportunity. Please see Attachment for their response.

We tested a sample of 27 in-state application files, of which 8 did not have sufficient information (see Finding 4-D) to determine compliance with the 90-day requirement to make certification decisions. We found that of the 19 remaining sampled files, 8 (42%) did not meet the 90-day requirement and took an average of 120 days to be processed. Thus, OBEO is not in compliance with 49 CFR Part 26.83(k) which requires that in-state certification decisions be made “within 90 days of receiving all information required from the applicant firm.”

In November 2018, OBEO implemented a lean six sigma project to streamline the certification process, which we noted reduced the backlog of applications that were waiting to be processed. However, it did not address the timeliness of certification decisions and OBEO’s need to develop a process for managing the 90-day requirement. OBEO is currently in the process of procuring an off-the-shelf system that will assist with tracking the start and end dates.

To calculate the number of processing days for our testing, we identified when all required information was received from the applicant and used the document packages’ date stamp as the start date, and used the date contained in the certification decision letter as the end date. This was necessary because OBEO’s procedures are inadequate to:

• Identify when all required information is received from the applicant.
• Document the start date.
• Document the end date when certification decisions are made.
• Track the application status.

Recommendation:

We recommend OBEO to:

• Develop or procure a system to assist in tracking and monitoring the start and end dates for each DBE application.
• Ensure certification decisions on in-state applications are made within 90 days.

Office of Business and Economic Opportunity Response:

OBEO concurs with the finding and recommendations. Please see attachment for details of the response and action plan.

OBEO is federally mandated to conduct an on-site interview of applicant firms to obtain eligibility
information that will be reviewed as a whole with supporting documents received from the
applicant. Our interviews of Certification Branch staff and observance of an on-site interview
found OBEO places primary focus of the interview on the disadvantaged owner rather than on
principal officers of the firm. Thus, OBEO is not in compliance with 49 CFR 26.83(c)(1i) which
requires an on-site visit to “interview the principal officers of the firm.”

OBEO uses a Site Visit Questionnaire that is designed to establish ownership and control eligibility
of the disadvantaged owner. By focusing on the disadvantaged owners, OBEO may miss the
opportunity to assess other eligibility factors such as group membership, individual disadvantage,
and business size from the principal officers.

Recommendation:

We recommend OBEO to ensure their on-site interview is focused on principal officers.

Office of Business and Economic Opportunity Response:

OBEO concurs with the finding and recommendation. Please see attachment for details of the
response and action plan.

Although OBEO follows its documented process and procedures for determining eligibility of applicant firms, staff do not evaluate evidence consistently to ensure that only eligible firms are certified as DBEs. We judgmentally selected 10 in-state application files that appeared questionable in the areas of ownership and control, which are the most complicated and high-risk eligibility criteria to assess for DBE certification. In 6 of the 10 files tested, the evidence to support ownership and control eligibility was insufficient or interpreted inconsistently. Our review of the files found that documents to assess ownership and control such as tax returns, articles of incorporations, bank documents, stock certificates, and agreements were missing, or the documents were misinterpreted, i.e., we found two firms with similar circumstances where one firm was approved, but the other firm was denied. 49 CFR 26.83(a) requires OBEO to “determine the eligibility of firms as DBEs consistent with the standards....”

Assessing which documents are necessary for ownership and control eligibility and the interpretation of those documents can be complex. For example, 49 CFR 26.69 (h)(2)(i) requires OBEO to determine whether the gift or transfer of ownership to a disadvantaged individual was made for the purpose of obtaining certification as a DBE. The determination of ownership becomes complex because the analysis of the source of funds used to purchase the entity, could depend on California community property laws which are nuanced. The determination of control of the business entity when ownership is transferred is complex since Caltrans must determine whether the disadvantaged individual actually controls the management, policy, and operations of the firm. These complexities increase the possibility for making erroneous DBE certification decisions which may expose Caltrans to potential litigation and ineligible firms participating in federally funded contracts.

Recommendation:

We recommend OBEO to:

• Implement a quality assurance process to ensure consistent evaluation of evidence supporting eligibility determinations.
• Develop training for staff to interpret and evaluate eligibility evidence consistently that may include identifying best practices from other diverse certifying agencies.

Office of Business and Economic Opportunity Response:

OBEO concurs with the finding and recommendations. Please see attachment for details of the response and action plan.

The State Administrative Manual (SAM) Section 20060 defines internal control as a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. It requires all levels of management be involved in assessing and strengthening the systems of internal controls to minimize fraud, errors, abuse, and waste of government funds. In addition, it requires management to make necessary corrections when symptoms of control deficiencies such as when policy, procedural or operational manuals are not current or are nonexistent or operation controls are not regularly evaluated for effectiveness, are identified.

Our audit found the following internal control deficiencies:

A. OBEO does not have written policies to ensure safeguard of proprietary information. Certification Branch staff are granted access to DBE applicants’ personally identifiable information such as Social Security numbers, bank account details, date of birth, tax ID numbers and information, etc., without signing appropriate access agreements. Thus, OBEO is not in compliance with federal and state requirements.

49 CFR Part 26.83(g) requires OBEO to “safeguard from disclosure to unauthorized persons information gathered as part of the certification process that may reasonably be regarded as proprietary or other confidential business information…”

SAM 5320.4 requires individuals seeking access to information assets sign appropriate user agreements prior to being granted access.

B. OBEO does not have written policies to ensure unauthorized staff do not have access and rights to confidential information that are not required for their current job. Two analysts who moved out of the Certification Branch retained access to DBE applicants’ personally identifiable information (See Finding 4-A). However, their current job responsibilities do not require such access. Thus, OBEO is not in compliance with state requirements.

SAM 5320.4 requires each state entity to establish processes and procedures to ensure that individual access to information assets is commensurate with job-related responsibilities and prevent accumulation of access.

C. The Certification Branch Manager performed duties of the File Analyst, On-site Analyst, and/or Office Chief (See diagram on page 3) in 6 of 27 sampled files. The manager performs multiple duties in the DBE certification process because proper segregation of duties is not implemented; and therefore, the risk of error or fraud related to certification decisions is increased.

Per the Government Accountability Office’s Standards for Internal Control, management should consider the need to segregate control activities to ensure no one individual controls all key aspects of an event. Segregation of duties require separating responsibilities among different people for the authorizing, reviewing, processing, and handling of any related assets to reduce the risk of error or fraud.

D. OBEO policy requires staff to record events or actions performed on an application in the case history sheet and retain copies of letters sent to firms. This policy is not enforced. The following issues were noted in the files sampled:

• 8 of 27 in-state (See Finding 1) and 4 of 9 out-of-state files did not contain a copy of the letter confirming receipt of all required information and notifying the firm of the start date of the 90-day certification process.
• 3 of 27 in-state files did not contain a copy of the letter notifying the firm of their approval or denial for certification.
• All 27 in-state and 9 out-of-state files did not contain complete records of events or actions performed on the application file. The absence of records may expose OBEO to loss of information assets and the inability to support certification decisions.

Recommendation:

We recommend OBEO to:

a. Develop written policies and procedures to ensure that staff sign appropriate access agreements prior to being granted access to personally identifiable information.

b. Develop written policies and procedures to ensure that individual access is commensurate with job-related responsibilities. c. Implement proper segregation of duties for all Certification Branch staff. d. Enforce the record retention policy.

Office of Business and Economic Opportunity Response:

OBEO concurs with the finding and recommendations. Please see attachment for details of the response and action plan.

Finding # 1: Certification Decisions Exceed 90-Day CFR Requirement for In-State Applications

1.1 IOAI Audit Recommendation

Develop or procure a system to assist in tracking and monitoring the start and end dates for each DBE application.

Auditee Response to Draft Report

The following system has been developed: The Certification Analysts are required to report on a daily basis to the, Staff Services Manager I (SSMI) any and all files that have been completed. This means all documents required for determining DBE certification eligibility have been received from the applicant. The SSM I reports these dates to the Staff Services Analyst (SSA) who inputs them into an excel spreadsheet. This excel spreadsheet has formulas to calculate the 90 day deadline for making a certification decision on in-state applications and the 60 day deadline for making a certification decision on interstate applications from the file complete date. The SSA provides this report to the SSM I at least twice weekly. Should deficiencies with staff meeting these deadlines be found the corrective action process will be followed in order to correct them.

Estimated Completion Date

7/15/2019

Staff Responsible

Deb Stewart, SSM I

1.2 IOAI Audit Recommendation

Ensure certification decisions on in-state applications are made within 90 days.

Auditee Response to Draft Report

The SSM I meets with the Certification Analysts weekly as well as needed to ensure DBE certification decisions are made within 90 days for in-state applications and within 60 days for interstate applications. The SSM I reviews the reports and reassigns files if needed in order to reach these deadlines. The SSM I reports to the Staff Services Manager II (SSMII) weekly as well as on an as needed basis on the status of the DBE certification applications.

Estimated Completion Date

7/15/2019

Staff Responsible

Deb Stewart, SSM I

Finding # 2: On-Site Interview of Disadvantaged Owners Instead of Principal Officers

2. IOAI Audit Recommendation

OBEO to ensure their on-site interview is focused on principal officers.

Auditee Response to Draft Report

SSMII to train the Certification Manager (SSMI) and Certification Analysts on how to determine and interview the principal officers of various business structures: sole proprietor, partnership, limited liability corporation and corporation. SSM I to review and revise onsite interview processes and procedures as needed to ensure the on-site interview focuses on principal officers. SSM I to revise the Onsite Interview Procedures to reflect the inclusion of principal officers at the on-site interview when scheduling the on-site interview.

Estimated Completion Date

9/13/2019

Staff Responsible

MaryLee Miglino, SSM II/Deb Stewart, SSM I;

Finding # 3: Inconsistent Evaluations of Eligibility Evidence

3.1 IOAI Audit Recommendation

Implement a quality assurance process to ensure consistent evaluation of evidence supporting eligibility determinations.

Auditee Response to Draft Report

To consistently evaluate the evidence supporting eligibility determinations, the DBE Certification File Quality Review operating procedure on how to quality review a certification file for consistent evaluation of the supporting evidence has been implemented. The SSM II will train the SSM I on the DBE Certification File Quality Review operating procedure including the New DBE Application Quality Review Checklist and Checklist of Documents (for each type of business structure) used in the quality review. The Documents in the Certification File (For Certification Analysts) document was reviewed and revised. The Certification Analysts utilize this to determine what required documents have been received and to complete the request for additional documents, if needed, to the applicant. The SSM I will meet with the Certification Analysts to discuss any and all deficiencies found during quality review process on each file.

Estimated Completion Date

10/1/2019

Staff Responsible

MaryLee Miglino, SSM II/Deb Stewart, SSM I

3.2 IOAI Audit Recommendation

Develop training for staff to interpret and evaluate eligibility evidence consistently that may include identifying best practices from other diverse certifying agencies

Auditee Response to Draft Report

The SSM II will develop for a training plan for the SSMI and Certification analysts on how to interpret and evaluate eligibility evidence consistently. Best practices from other diverse certifying agencies such as the CUCP certifying agencies and other state UCPs will be researched and incorporated as appropriate. Also the Certification Manager (SSMI) will be trained on the Quality Review Process. All Certification Analysts will receive training on what documents are required using Documents in the Certification File (For Certification Analysts). Th SSMI will meet with the Certification Analysts to discuss any and all deficiencies found during quality review process performed on each file.

Estimated Completion Date

1/13/2020

Staff Responsible

MaryLee Miglino, SSMII / Deb Stewart, SSMI

Finding # 4: Internal Control Weaknesses over Certification Process and Procedures

4.A Proprietary information not safeguarded

IOAI Audit Recommendation

Develop written policies and procedures to ensure that staff sign appropriate access agreements prior to being granted access to personally identifiable information.

Auditee Response to Draft Report

Written policies and procedures to ensure that staff sign appropriate access agreements prior to being granted access to personally identifiable information will be developed. Also staff currently working in DBE Certification will sign appropriate access agreements

Estimated Completion Date

9/13/2019

Staff Responsible

Deb Stewart, SSM I

4.B Unauthorized staff have access and rights to confidential information

IOAI Audit Recommendation

Develop written policies and procedures to ensure that individual access is commensurate with job-related responsibilities.

Auditee Response to Draft Report

Written policies and procedures to ensure individual access is commensurate with job-related responsibilities are included in the DBE Certification Information Security Procedures .

Estimated Completion Date

7/8/2019

Staff Responsible

 Deb Stewart, SSM I

4.C Segregation of duties not Implemented

IOAI Audit Recommendation

Implement proper segregation of duties for all Certification Branch staff.

Auditee Response to Draft Report

The following has been implemented: Certification analysts do not conduct quality reviews on certification files. If the Certification Manager processes a DBE Certification application including an on-site interview or an action, the quality review and final approval must be done by the SSM II (or higher) trained in DBE certification

Estimated Completion Date

3/25/2019

Staff Responsible

MaryLee Miglino, SSM II

4.D Policy to record events and actions performed on application files not enforced

IOAI Audit Recommendation

Enforce the record retention policy.

Auditee Response to Draft Report

The New DBE Application Processing Verification document has been created and certification analysts are required to complete it. The SSM I will conduct a periodic review of each certification analyst's DBE certification files and the corresponding CUCP database record to ensure all documents have been filed, and all events or actions performed by the certification analyst have been recorded. Should deficiencies be found the corrective action process will be followed in order to correct them. A written process on how to complete the New DBE Application Processing Verification document has been drafted and is in review by management.

Estimated Completion Date

10/1/2019

Staff Responsible

Deb Stewart, SSMI