Item - 2021.PA23.1

The Board of Directors of Toronto Parking Authority:

1.  Requested the President, Toronto Parking Authority to address the findings of the external auditor including:

a.  requesting the vendor of its Pay Display machines and related services to implement formal reporting mechanisms to identify, assess, track and report internal control deficiencies and subsequent remediation efforts;

b.  requesting the vendor of its Pay and Display machines and related services to implement appropriate controls to be able to monitor activity of users that are able to access the system underlying Toronto Parking Authority's Pay and Display machines; and

c.  obtaining an annual CSAE 3416/SOC1 (Service Organization Control) Type 2 report from the vendor of its Pay and Display machines and related services.

2.  Forwarded this item to City Council for information.

In late 2017, the City's Fraud and Waste Hotline (operated by the Auditor General's Office) received a complaint regarding Toronto Parking Authority's vendor (the Vendor) of Pay and Display machines and related services.

The Auditor General undertook an initial assessment of the allegations to better understand the information provided and to consider what actions would be appropriate in order to prioritize available resources. The Auditor General also considered the scope of prior audits of Toronto Parking Authority completed by her Office and held preliminary discussions with Toronto Parking Authority management and their external financial statement auditor.

After this initial assessment, further consideration was given to the following allegations:

1.  Toronto Parking Authority credit card revenue was redirected by the Vendor (meaning Toronto Parking Authority was not receiving parking revenues processed by the Vendor through the Pay and Display machines).

2.  Toronto Parking Authority did not exercise appropriate due diligence in procurements from the Vendor.

For the first allegation, the Auditor General liaised with Toronto Parking Authority and its external auditor to decide the level of work required to assess risks to the City and how those risks were being managed by Toronto Parking Authority. The external auditor performed agreed upon procedures to test key controls including controls that provide reasonable assurance over the completeness and accuracy of recorded revenue and receivables.

Although we did not conduct in-depth testing of the Vendor's systems and records ourselves, no evidence came to our attention through the work of the external auditor that would suggest that Toronto Parking Authority credit card parking revenue was being redirected by the Vendor.

The Auditor General's Office has closed this Fraud and Waste Hotline allegation – no further work will be conducted at this time.

For the second allegation, Toronto Parking Authority has purchased Pay and Display equipment and related services on a non-competitive/sole-source basis from the same vendor since 1998. In 2009, the Auditor General's Office completed an audit of Toronto Parking Authority Pay and Display Parking Operations - Review of Revenue, Expenditure and Procurement Practices. Given the length of time that has passed since the Auditor General's Office last conducted an audit in this area, and because of the longstanding relationship between Toronto Parking Authority and this Vendor, we may consider doing further work in the future to examine this relationship in the context of current procurement rules and contract management.

This report presents the Auditor General's consideration of risks raised in the complaint allegations as noted above.