Metropolitan Transportation Authority 2009-2010 Internal...

Metropolitan Transportation Authority 2009-2010 Internal Control Certification and Summary

Submitted as part of the MTA 2010 Annual Report Pursuant to New York State Public Authorities Law Section 2800(1)(a)(2)(iii)

2009 - 2010 -INTERNAL CONTROL-

CERTIFICATION AND SUMMARY

Submitted By MTA Corporate Compliance

2 Broadway, 16th Floor New York, New York 10004

- 1 -

2009-10 INTERNAL CONTROL SUMMARY _______________________________________________________________________

METROPOLITAN TRANSPORTATION AUTHORITY Date April 30, 2009

Completed by (Name) Phone

Lamond W. Kearse, Chief Compliance Officer (646) 252 1330

MTAHQ Michael Amrick (212) 878-7244 New York City Transit Kevin F. McKenna (646) 252-6610 Long Island Rail Road Mark Young (718) 558-7777 Long Island Bus Robert Picarelli (718) 927-7483 Metro-North Railroad Nathan Gilbertson (212) 340-2197 Bridges and Tunnels James Elkin (646) 252-7150 Capital Construction Richard Hoffman (646) 252-2095 MTA Bus Company Robert Picarelli (718) 927-7483

_______________________________________________________________________

A.Establish and maintain guidelines for a system of internal controls for the agency or authority. Internal control guidelines communicate an organization’s management and programmatic objectives to its employees and provide the methods and procedures used to assess the effectiveness of its internal controls in supporting those objectives. Internal control guidelines should:

1. State the agency head’s support of internal controls to provide staff with

an understanding of the benefits of effective controls; 2. Identify the agency’s primary responsibilities and the objectives; 3. Explain how internal controls are organized and managed; 4. Define responsibilities of agency management and supervisors and

agency staff; 5. Acknowledge that internal controls adhere to accepted standards; and, 6. Describe the organization’s process for evaluating internal controls.

For this requirement, the authority is:

Fully Compliant Partially Compliant Not Compliant Provide a thorough explanation of the specific actions your authority has taken, or are needed, to comply with this requirement. In 1990, the Metropolitan Transportation Authority (“MTA”) Board adopted MTA All-Agency Accountability and Internal Control Policy Statement 11-008 which applies to the Metropolitan Transportation Authority and its subsidiary and affiliated agencies. The Policy Statement became effective upon the signature of the MTA Board Chairman on June 8, 1990.

- 2 -

The Policy Statement establishes the MTA Board’s support of internal controls and its commitment to provide staff with an understanding of the benefits of effective controls. Policy Statement 11-008 also identifies the Authority’s primary responsibilities and the objectives of internal controls; explains how internal controls are organized and managed; defines responsibilities of the Authority’s management, supervisors and Authority staff; acknowledge that MTA’s internal controls adhere to accepted standards; and describes the organization’s process for evaluating internal controls. The MTA’s Internal Control Program is compliant with the Public Authority Law as amended by the New York State Governmental Accountability, Audit and Internal Act (“Act”), the Standards for Internal Control in New York State published by the Office of the State Comptroller, New York State Independent Authority Budget Office guidelines, and the Commission of Sponsoring Organizations (“COSO”) standards. MTA’s internal control program is modeled after current best practices of integrating corporate governance, internal controls, compliance and ethics. In order to ensure compliance with this Policy Statement, MTA’s affiliated and subsidiary Agencies may issue additional guidelines and policies applicable only to their specific agency. New York City Transit (“NYCT”) issued Internal Control Policy/Instruction (P/I) 1.8.1, which establishes the framework for NYCT based on information contained in publications from the State and MTA, including Policy Statement 11-008. This P/I establishes the requirements for each department/division to establish and maintain a system of internal controls that conforms to prescribed standards. Metro-North Railroad compliance with Policy Statement 11-008 is governed by Metro-North Corporate Policy 10-008, Internal Controls. The Policy clarifies responsibilities at Metro-North and describes the internal controls program. In addition to the formal guidelines as noted above, several agencies have issued additional guidance regarding the requirements of the program.

- 3 -

B.Establish and maintain a system of internal controls and a program of internal control review for the agency or authority. The system of internal control should be developed using the COSO (Committee of Sponsoring Organizations of the Treadway Commission) conceptual framework adopted in the Standards for Internal Controls in New York State Government, and should incorporate COSO’s five basic components of internal control: control environment, risk assessment, control activities, information and communication and monitoring.

The program of internal control review shall be a structured, continuing and well documented system designed to identify internal control weaknesses, identify actions that are needed to correct these weaknesses, monitor the implementation of necessary corrective actions and periodically assess the adequacy of the agency’s or authority’s internal controls.

Organizations can adopt a system of internal control review tailored to their needs, size and degree of centralization. The procedures for evaluating the adequacy of that system also vary, but at a minimum should:

1. Identify and clearly document the primary operating responsibilities

(functions) of the agency or authority; 2. Define the objectives of these functions so they are easily understood by

staff accountable for carrying out the functions; 3. Identify/document the policies and procedures used to execute functions; 4. Identify the major functions of each of the agency’s assessable units; 5. Develop a process or cycle to assess risk and test controls for major

functions; 6. Assess the risks and consequences associated with controls failing to

promote the objectives of major functions; 7. Test controls to ensure they are working as intended (see the “Manager’s

Testing Guide” which can be downloaded from BPRM Item B-350); 8. Institute a centrally monitored process to document, monitor and report

deficiencies and corrective actions. For this requirement, the agency/authority is:

Fully Compliant Partially Compliant Not Compliant

Provide a thorough explanation of the specific actions your agency has taken, or are needed, to comply with this requirement and specifically address the following points: 1. Describe the process used to review the authority’s internal controls. 2. List all high-risk activities and indicate which were reviewed during 2009-

10.

3. Identify the significant deficiencies revealed during the 2009-10 review process. Outline the actions taken, or planned, to eliminate deficiencies, highlighting the most important improvements made during the year.

- 4 -

4. Describe the monitoring system installed by the agency to verify that corrective actions are taken. Discuss the extent to which IT systems are used to track corrective actions.

5. Summarize specific actions the agency has taken to install a compliance

testing program. Describe actions taken during 2009-10 to verify test results and expand the testing program.

6. Describe measures instituted to sustain the effectiveness of the internal

control program during 2009-10. Include information on reorganizations and other revisions in the program to enhance operations.

7. Describe efforts agency/authority management has taken to coordinate

and integrate the documentation and reporting of activities the Office of the State Comptroller’s Standards for Internal Controls in New York State Government recognize as supporting a good internal control system: evaluation, strategic planning and internal audit.

8. Describe efforts agency/authority management has taken to effectively

communicate information within the organization. Information should be communicated to management and other employees who need it in a form and within a time frame that helps them to carry out their responsibilities. Communication is not an isolated internal control component. It affects every aspect of an organization’s operations and helps support its system of internal control. The feedback from this communication network can help management evaluate how well the various components of the system of internal control are working.

______________________________________________________________________ 1. Describe the process used to review the authority’s internal controls

The Internal Control Program is based on a self-testing process to determine if controls work and to track fixes to weaknesses that are found. The program is based on vulnerability (Risk) assessments and the ranking of activities based on the level of risk assigned to each one. MTA Agencies must identify all major activities, determine the level of risk and develop a system of controls to manage and mitigate the risk. They must perform self-assessments of existing internal controls. Testing of controls is required to determine whether they are functioning as intended and the adequacy of those controls. If weaknesses are detected, the agencies must create an action plan and timetable for addressing and resolving the deficiencies. The MTA Internal Control Committee meets semi-annually to review and suggest improvements to the program. Partially in response to the passage of the American Recovery and Reinvestment Act (“ARRA”) the MTA installed a new automated internal control system. The new system is comprised of Oracle’s Governance, Risk and Compliance Manager (“GRC”) and Oracle’s GRC Intelligence applications.

- 5 -

These applications, in the broadest sense, are designed to add greater transparency and accountability to the MTA’s Compliance/Internal Control efforts. The applications will allow the MTA to, among other things:

• monitor compliance with MTA and Agency policies and procedure, • monitor compliance with multiple regulatory requirements, • align internal controls with policies and regulations, • replace labor-intensive vulnerability assessments with automated GRC

process management, • monitoring internal controls not just by Agency but as part of an integrated

business processes across Agencies • track and document risks and internal controls related to those business

processes, • track corrective action plans and audit recommendations, and • evaluate, test and report on the status of internal controls.

Metropolitan Transportation Authority (“MTAHQ”) Internal controls within MTAHQ are assessed at the departmental level. Each department is assigned an internal control coordinator (“ICC”) to manage the program for their departmental level. Each department annually prepares a risk assessment and tests relevant controls. These risk assessments are then sent to MTAHQ’s Internal Control Officer (“ICO”) for review. In addition, MTAHQ continues the process of cross checking the vulnerability assessments with different departments to see if there are any common risks or issues which can be addressed. The ICO has continued to “market” the program as a method by which we can improve business processes. This is part of the effort to enhance “ownership” and participation in the program. Our marketing program continues to focus on making all employees aware of Internal Controls. This has been done by department specific e-mails (for the third year in a row), which included the name of the department coordinator and encouraged employees to participate in the “risk assessment “process. The annual “risk assessment” was reviewed by each coordinator, the department head and the ICO. All ICC were re-trained in the internal controls process and encouraged to widen participation by other employees in reviewing controls and making recommendations to make the business process more effective. Supporting this action, electronic summary booklets on Internal Controls were sent to HQ employees, and a Power Point Presentation on Internal Controls was sent to MTA’s new Business Service Center (BSC), which is establishing an internal control program in 2010.

- 6 -

Additionally, several meetings are held each year with counterparts in the MTA constituent Agencies to exchange ideas on the program and to discuss strengths and weakness in the program. We also exchange vulnerability assessments to look for common elements of risk. MTAHQ has also continued its practice of holding numerous individual one-on-one meetings with Department staff to discuss the program and to review their vulnerability assessments. New York City Transit (“NYCT”) NYCT is the largest mass transportation system in the United States. It provides subway, rail, bus, and paratransit services to the five boroughs of New York City. NYCT, through its mission statement, endeavors to provide customers with safe, convenient, comfortable and reliable train and bus service by the efficient and effective utilization of human, physical and financial resources. In pursuit of these goals, management and staff in the various operating and administrative functions understand the importance of working together to ensure that customers receive the best service that can be provided by utilizing the available resources. The President, Executive Staff and Senior Management supported by professional, technical and administrative personnel, unite to form a team to achieve these objectives. Because of the complexity of its business, NYCT must comply with a vast number of federal, state and local laws. In addition, it is subject to rigorous scrutiny and oversight by regulatory agencies such as the National Transportation Safety Board, Federal Transit Administration (“FTA”), Occupational Safety and Health Administration and the New York State Department of Labor. NYCT is also guided by internal policies and procedures that outline and provide detailed instructions on how to perform the major tasks within the organization. The NYCT program is based on vulnerability assessments and the ranking of activities based on the level of risk assigned to each one. Departments must identify all major activities, determine the level of risk and develop a system of controls to manage and mitigate the risk. The next step is to perform a self-assessment of existing internal controls for selected high-risk activities. Testing of controls is required to determine whether they are functioning as intended and the adequacy of those controls. If weaknesses are detected, the department must submit an action plan and timetable for addressing and resolving the deficiencies. The implementation of each corrective action is reviewed and monitored by the Office of the Controller.

- 7 -

Long Island Rail Road (“LIRR”) The LIRR is divided into two principal groups: Operations and Non-Operations. Operations is primarily responsible for train movement, terminal operations and passenger services, including ticket offices, TVMs and station operations (Transportation Services), maintenance of electric and diesel fleets (MofE), maintenance of right of way, including track, signals, communications, power and buildings & bridges (Engineering). Non-Operations is comprised of all administrative departments which support Operations (i.e., Legal, Finance, Public Affairs, Information Technology). Both groups work together to support the Agency’s core concept of providing safe and reliable transportation. This structure supports a control environment whereby ethical values, integrity, worker competency, managerial directive and employee development make up the philosophical control consciousness of the organization. The control consciousness of the agency results in a risk level being assigned to all major business activities. The higher the assigned risk level, the more closely the activity is monitored with its controls being evaluated on a more frequent basis. The established risk ranking for control evaluation and testing is as follows: every year (Very High), every other year (High), every three years (Moderate) and every four years (Low). The primary control techniques, which support the control evaluation process, are documentation and recordkeeping, authorization of transactions, segregation of duties, supervision and security of information and data. Policies and procedures, logs and records, supervision and structure based on corporate organization charts and the various levels of data security are examples of the control techniques which support the Internal Control Program and enable each department to effectively monitor their internal control system. Long Island Bus The Long Island Bus Internal Control program involves a risk/vulnerability assessment. Internal Controls scheduled for review are tested and evaluated by management. Additionally, Long Island Bus management requests Internal Audit to evaluate Internal Controls in targeted areas. Based on the evaluations, corrective action programs are developed and implemented. Metro-North Railroad (“Metro-North”) The Internal Control Review process at Metro-North is now fully performed and managed online using the Internal Control System (ICS), which was developed by Metro-North’s IT Department. Internal Control documents processed online include: Risk Assessments, which receive electronic authorizations from department heads; the Documentation of Activity Cycles form, which outlines the steps in a particular process or procedure; the Activity Cycle Objectives and Related Techniques form, which describes the control objectives and techniques; the Test of Internal Controls, which summarizes the tests performed to determine if the control is functioning and adequate (tests are performed and test documentation is retained outside of the online system); and finally, if weaknesses are found, the Corrective Action Plan, which also must receive electronic authorization from department heads. Automatically generated e-mails

- 8 -

direct the process through Departmental Administrators and Coordinators, who guide the process at the departmental level and are responsible for ensuring timely completion of reviews by managers and other staff in their respective departments. Metro-North’s ICO is the system owner and has authorization, monitoring, and tracking tools, as well reporting tools and a database. Security access is password controlled to authorized users only within their respective departments. The ICS Home Page includes active links to the Internal Control System Manual, an Internal Control Review Handbook that describe the process for conducting Risk Assessments and Internal Control Reviews, and the NYS Managers Guide for Testing. Bridges and Tunnels (“B&T”) The B&T ICO administers and assures implementation of the B&T Internal Control Program. Implementation of the Program is coordinated and facilitated by trained Departmental Internal Control Coordinators (DICCs) within each department. These individuals ensure that the Authority’s internal control systems are regularly reviewed and assessed for adequacy and effectiveness. With the guidance of these DICCs, managers are required to self-assess the vulnerabilities and risks within the business activities they control. From this assessment, managers then identify an appropriate schedule for testing all internal controls within those activities, with particular emphasis on the more critical controls. From this schedule, each department establishes yearly testing goals, which they provide to the ICO. Testing results are forwarded during the year by each department’s DICC to the ICO who, in turn, provides a monthly summary report to the President indicating each department’s progress against its goals. In addition, MTA Audit Services conducts selected independent audits and reviews of controls of critical functions. The results of those reviews are taken into account in improving management’s control self-testing process. Capital Construction (“MTACC”) MTACC’s Director – Internal Controls administers and monitors its Internal Control Program. Internal controls at MTACC are governed by the MTA Policy Directive 11-008, which was written to comply with the requirements of New York State law and Standards for Internal Control in New York State Government issued by the State Comptroller. These Standards require public authorities to promote and practice good internal control, as well as to provide accountability for their activities. Oversight for the Program is provided by the Chief Financial Officer and MTA’s Chief Compliance Officer. During the current certification period, MTACC’s Director – Internal Controls has continually trained individuals within program areas and among all departments, providing instruction and guidance on internal controls. A key component of this

- 9 -

training requires individual Internal Control Coordinators (ICC) to identify and self-assess the risks that may exist within each area of responsibility that could prevent their department from achieving its objectives. Based on the results of their self-assessment, activities which are considered high-risk are evaluated frequently. Quality and Safety Unit (QSU) personnel within MTACC perform quarterly oversight as follows: reviews of contractor performance for all on-going construction projects, conduct joint audits with representatives of the FTA to evaluate compliance with contract requirements, and perform oversight and follow-up reviews of contractor safety programs. Any deficiencies or exceptions noted are required to be corrected by the contractor the following quarter, or sooner, if necessary. MTACC’s Sustainability and Environmental Services (SES) Department monitors compliance with environmental laws, regulations and community commitments. This group performs regular field inspections, reviews monitoring data and environmental permit applications, working with the appropriate field personnel to resolve potential environmental issues. MTACC projects are funded by federal, state and local Governments and by the issuance of debt. Accordingly, our Agency is subject to oversight, reviews, and audits by these funding sources. The FTA, which funds the majority of MTACC projects, receives monthly reports from an outside independent engineering firm commenting on the Agency’s technical capability and ability to execute projects efficiently and effectively. The information contained in these reports is shared with MTACC, further enhancing our ability to identify controls that may need strengthening. MTA’s Audit Services, and to a lesser extent, the Agency’s public accountants, review internal controls as they relate to MTACC’s financial and operational systems. In addition, an Independent Compliance Monitor, hired in February 2006, has ensured compliance with specific contract provisions for contractors participating on Lower Manhattan Projects. This contract expired at December 31, 2009. The Office of the State Comptroller monitors the status of the Capital Security Program and performs periodic audits of other areas at its discretion. As described, information on internal controls received from our; ICC, QSU, SES, internal auditors, external auditors, independent compliance monitor, independent consultants and the State Comptroller comprise the framework for the oversight of MTACC’s internal control system.

- 10 -

MTA Bus The MTA Bus Internal Control program involves a risk/vulnerability assessment. Internal Controls scheduled for review are tested and evaluated by management. Additionally, MTA Bus management requested Internal Audit to evaluate Internal Controls in targeted areas. Based on the evaluations, corrective action programs are developed and implemented. 2. List all high-risk activities and indicate which were reviewed during

2009-10

Agency Department/Division Activity MTAHQ

Corporate Compliance Preparation of Key Regulatory Reports to the State, including Annual Report to the Governor (Reviewed)

Communications of Internal Controls (Reviewed)

Internal Controls Mgt Support (Reviewed)

Organizational Development Management Development Program

(Reviewed) Office of Diversity and Civil Rights Staffing (Reviewed) Treasury Interagency Loans (Reviewed)

Real Estate Environmental Working Conditions

(Reviewed) Facility Building Security (Reviewed)

Budgets & Financial Planning Overtime Reports and Monitoring on Police (Reviewed)

Budget Variances Reports (Reviewed)

Procurement Receive, Record and Secure Bids & Proposals (Reviewed)

Budget Prepare Reports to Finance Committee (Reviewed)

Prepare Budget Watch (Reviewed) Preparation of Preliminary & Final

Budgets (Reviewed) Preparation of Budget Revisions

(Reviewed)

Community Affairs Providing Information to Public (Reviewed)

Marketing Maintaining consistent "look" in publications (Reviewed)

Arts for Transit Poster Program / Electronic Storage (Reviewed)

Transit Museum Financial Administration of Stores (Reviewed)

Human Resources

Policy / HRIS proper flow of data (Reviewed)

Deferred Comp. communication of information (Reviewed)

MTA Police Integrity Inspections (Reviewed) Sick Visits (Reviewed)

- 11 -

NYCT

Department of Subways: Maintenance of Way / Electronic Maintenance Division (EMD):

Electronic Equipment Testing, Inspection, and Maintenance of AFC Equipment (Reviewed)

Electronic Equipment Testing, Inspection, and Maintenance for Subway Radio Communication Systems

Electronic Equipment Testing, Inspection and Maintenance for Bus Radio Communication Systems (Reviewed)

Electronic Equipment Testing, Inspection and Maintenance for Fire and Hazard Alarms/Suppression Systems in Buses and Depot Facilities Including Stations, Crew Facilities, and Booth Halon Systems (Reviewed)

Electronic Equipment Testing, Inspection and Maintenance for Subways Emergency Alarms and Telephones (Reviewed)

Electronic Equipment Testing, Inspection, and Maintenance for CCTV, Data and Fiber Optic Networks Telephone Switches (Reviewed)

Repair of Electronic Modules (Reviewed)

Security Equipment Installation – CCTV, Alarms, Monitoring Devices

Safety Training and use of Personal Protective Equipment (PPE) (Reviewed)

Prevention of Unauthorized Access to Areas Maintained by EMD, such as Signal Rooms, Emergency Exits, and Certain Communications Rooms (Reviewed)

Procurement Card Administration Hearing Conservation (Reviewed)

Department of Subways: Maintenance of Way / Administration

Employee Training: Track Safety and Flagging Training (Reviewed)

Central Payroll, Timekeeping and Check Distribution (Reviewed)

Central Material Control: Usage Forecasts, Inventory Management and Requisition Control (Reviewed)

Protection of Social Security Numbers (Reviewed)

Drivers’ License Monitoring (Reviewed)

Track Maintenance (Reviewed) Third Rail Maintenance (Reviewed)

- 12 -

Department of Subways: Maintenance of Way / Track

Flagging (Reviewed) Track Inspection (Reviewed) Safety Training and Use of Personal

Protective Equipment (PPE) (Reviewed)

Prevention of Unauthorized Access to Areas Within the System (Reviewed)

Payroll and Timekeeping Hearing Conservation (Reviewed) Procurement Card Administration

Department of Subways: Maintenance of Way / Infrastructure

Structures Maintenance Work Capital Construction Projects and

Capital Program Management Support

Inspection and Routine Maintenance of Fixed Assets and Equipment (Reviewed)

Flagging (Reviewed) Lead Abatement and Asbestos

Handling (Reviewed) Safety Training and Use of Personal

Protective Equipment (Reviewed) Prevent of Unauthorized Access to

Areas Within the System (Reviewed) Hearing Conservation (Reviewed) Procurement Card Administration

(Reviewed)

Department of Subways: Maintenance of Way / Electrical-Power

Substation Equipment Maintenance and Repair (Reviewed)

Power System Operation Procedure (Reviewed)

Power System Equipment Testing and Inspection – Substations (Reviewed)

Power System Equipment Testing and Inspections – Emergency Alarm Panels (Reviewed)

Power System Equipment Testing & Inspections – Supervisory Control Data Acquisition System (Reviewed)

Emergency Response (Reviewed) Safety Program Plan Implementation

(Reviewed) Access and Protection to Power

Substations and Prevention of Unauthorized Access (Reviewed)

Access and Protection to Cable Vaults and Prevention of Unauthorized Access (Reviewed)

Revenue Meter Reading (Reviewed) Hearing Conservation (Reviewed) Procurement Card Administration

Department of Subways: Maintenance of Way/Electrical-Signals

Signal Equipment Maintenance and Work Order Repair

Equipment Testing and Inspections (Reviewed)

Emergency Response (Reviewed) Flagging (Reviewed)

- 13 -

Department of Subways: Maintenance of Way/Electrical-Signals…cont’d.

Access and Protection of Signal Room (Reviewed)

Safety Training and use of Personal Protective Equipment (Reviewed)


Hearing Conservation (Reviewed) Procurement Card Administration

Department of Subways: Division of Service Delivery Operation


Timekeeping Activities Material Controls: Tools and

Equipment (Reviewed) Lost Property Bulletins and Notices Hearing and Conservation Program

(Reviewed) Procurement Card Administration

(Reviewed) Track Flagging (Reviewed)

Department of Subways: Division of Rapid Transit Operation

Communications: Proper Handling of Emergencies (Reviewed)

Communications: Inclement Weather (Severe Rain and/or Snowstorms) (Reviewed)


(Reviewed) Injury on Duty Prevention (Reviewed) Injury on Duty Procedures Track Flagging (Reviewed)

Department of Subways: Division of Stations Operations

Procurement Card Administration (Reviewed)

Department of Subways: Group Managers Program–Transportation Customer Service:

Injury while on Duty Prevention (Reviewed)

Injury on Duty Procedures Unsafe Acts by Customers

(Reviewed) Side Door Drags (Reviewed) Doors Open Outside and Wrong Side

(Reviewed) Hearing Conservation Program

(Reviewed) Procurement Card Administration

(Reviewed) Fare Media Sales (Reviewed) Revenue Accountability (Reviewed) Station Agent Safety and Security

(Reviewed) Station Cleaning Operations Vehicular Inspection and Operation

(Reviewed) Safety Training (Reviewed) Track Flagging (Reviewed) Business Travel (Reviewed) Material Forecasting for Schedule

Maintenance System (Reviewed) Yard Safety Procedures

- 14 -

Department of Subways: Division

of Car Equipment: Shop Safety Procedures Protection of Social Security

Numbers (Reviewed) Hearing Conservation Program

(Reviewed)

Department of Subways: Group Managers Program –Car Maintenance

Procurement Card Use/Payment Reconciliation (Reviewed)


Department of Subways: Staten Island Railway

Payroll, Timekeeping and the Attendance - Various Departments (Reviewed)

Signal Inspection Track and Switch Inspection Protection of Social Security

Numbers (Employee Accident/Injury Reports) (Reviewed)

Protection of Social Security Numbers (Personnel and Related Employee Records) (Reviewed)

Hearing Conservation Program (Reviewed)

DEPARTMENT OF SECURITY Access to Loading Docks & Receiving Areas - Livingston Plaza (Reviewed)

Challenging for Pass ID Policy and Procedure (Reviewed)

Visitors Policy and Procedure - Jay St. and Livingston Plaza (Reviewed)


Verifying Employee Drivers Licenses (Reviewed)

Electronic Access Control Functionality (Reviewed)

Department of Buses Diesel Fuel Meets Contract Specifications

Diesel Fuel Inventory Reconciliation Pre-Trip Inspections Daily Facility Inspection Safety Inspection Scheduled Maintenance Vehicle Accountability (Reviewed) New Bus Operator Training Bus Operator 19A Certification Bulk Fuel (Diesel) System Maintenance Training Warranty Claims

Department of Capital Program Management

Contractor Payment Verification Additional Work Order’s Verification

(Reviewed) Consultants Payments Verifications

(Reviewed) Estimating / Cost Control Compliance

(Reviewed) Schedule Control Compliance

- 15 -

Department of Executive Vice President: Office of Controller: Treasury / Disbursements

Processing Utility Bills and Other Miscellaneous Disbursements (Reviewed)

Protecting Social Security Numbers

Department of Executive Vice President: Office of Controller: Operations Accounting

Death Benefit Payments Protection of SSN Administration and Recording of

MaBSTOA Employee Pension Loans (Reviewed)

Department of Executive Vice President: Office of Controller: Payroll

Protection of Social Security Numbers

Accuracy of Special Payments, e.g. Retroactive Payments and Longevity Payments

Department of Executive Vice President: Office of Controller: Capital Payments

Process Release of Retainage (Reviewed)

Process Final Payments (Reviewed)

Department of Executive Vice President: Office of Controller: Capital Accounting

Preparation of Bidder Evaluations (Reviewed)

Control Letters of Credit Compliance with Prompt Payment

Law Control and Coordinate the

Recording, Analysis and Disbursing of Third Party Contract Payments and Documentation

Registration of Capital Contracts/TA Labor and Engineering Force Account in CAS (Reviewed)

Receipt, Recording, and Timely Billing of All Force Account Expenditures (Reviewed)

Department of Executive Vice President: Office of Controller: Procedures and Internal Controls

Quarterly Forecast of Actual Budget Expenses

Reconciliation of PSR Authorized Positions to Active Employee Listing (Reviewed)

Oversee the Internal Control Program (Reviewed)

Oversee the Controlling and Safeguarding of NYCT Furniture and Equipment

Review Authority-Wide Policy Instructions (P/I) (Reviewed)


Procurement Card Administration

Department of Executive Vice President: Office of Controller: Office of Management and Budget

Report Ridership Statistics (Reviewed)

Quarterly Hiring Plan Monthly Reports to the MTA Board Personnel Strength Report

(Reviewed) Protecting Social Security Numbers

and Other Sensitive Information (Reviewed)

- 16 -

Division of Operations Planning Maintain Data Integrity of the Service Information Used In Federally Mandated Programs (Reviewed)

Ensuring that NYCDOT Bills for Bus Stop Changes are in Accordance With NYCT’s Bus Stop Contract, are Accurate, and Adhere to the Budget (Reviewed)

Division of Supply Logistics Vendor Receipts (Reviewed) Issuance of Material to End Users

(Reviewed) Receipt and Issuance of Tools

(Reviewed) Control of High Pilferage Items Receipt and Issuance of Gas and

Diesel Fuel (Reviewed)

Division of Materiel Material Information Reporting (Reviewed)

Distribution of Sensitive Procurement Documents (Reviewed)

Monitor Vendor On-time Performance

Maintain an Effective Staff Summary Process (Reviewed)

Award of Contractual Options and Modifications (Reviewed)

Protecting Social Security Numbers and Other Sensitive Information

Procurement Card Administration

Division of Revenue Control Transport and Secure MetroCard Vending Machine (MVM) Revenue (Reviewed)

Process MVM Revenue (Reviewed) Transport and Secure Subway Booth

Revenue (Reviewed) Process Subway Booth Revenue

(Reviewed) Oversee Operation and Maintenance

of Security Equipment/Systems at Revenue Control Facilities (Reviewed)

Provide Oversight of Contracted Armed Security Services for Protection of Revenue, Fare Media, and Employees (Reviewed)


Division of Telecommunications & Information Services (TIS)

Develop and Maintain the Automated Fare Control (AFC) Application

Maintain the AFC Store and Forward System, which Reports Station/Depots/Bus Data on Farecard Sales Usage (Reviewed)

Protecting Social Security Numbers (SSNs) (Reviewed)

Develop and Maintain the Capital Accounting and Payments System

- 17 -

Division of Telecommunications & Information Services (TIS)…cont’d.

Develop and Maintain the Payroll Application, which Includes Pension Loan Administration, Family Court and Garnishments

Develop and Maintain the Human Resource Application (Reviewed)

Develop and Maintain the Fixed Asset Control System

Develop and Maintain the OA Miscellaneous Payment System (Reviewed)

Develop and Maintain the Paratransit Taxi Reimbursement System

Develop and Maintain a Working Pick System for the Department of Buses (DOB) and Rapid Transit Operations (RTO)

Develop and Maintain Working Crew System for DOB and RTO

Develop and Maintain Timekeeping System for DOB and RTO)

Develop and Maintain the Commodity Management System (CMS) and the Contract Tracking Management System (CTMS) Applications

Develop and Maintain the Material Management System (MMS) Application (Reviewed)

Manage Implementation and Testing of Public Address/Customer Information System (PA/CIS) Phase II Project for 156 Stations on the IND Division

Maintain the Unified General Order System (UGOS) (Reviewed)

Maintain the Automatic Train Supervision, Subdivision A (ATS-A) System

System Maintenance of the 63rd Street Queensborough Connection

Monitor the Implementation, Testing and Commissioning of the Communication Base Train Control (CBCT) Equip 60 R 160 Cars (Reviewed)

Maintain the Paratransit Dispatch and Scheduling System (ADEPT) (Reviewed)

Maintain the Fire Safety System Application (Reviewed)

Production of Payroll, Pension and Accounts Payable Checks

Manage the UNISYS Contract For SLA 3.2.2 Asset Tracking (Hardware) – Contract # 03A86902-2 (Reviewed)

Manage the UNISYS Contract For SLA 3.2.5 Asset Tracking (Software) – Contract # 03A8602-2 (Reviewed)

- 18 -

Division of Telecommunications & Information Services (TIS)…Cont’d

Manage the UNISYS Contract For SLA - 4.2.4-Timely Completion of Service Requests – Contract # 03A8602-2 (Reviewed)

Manage the UNISYS Contract for SLA 4.3.1-Timely Resolution Of Severity Level 1 Problems-Contract # 036A8602-2 (Reviewed)



Manage the UNISYS Contract For SLA 5.1.2-System Availability Metric is Equal to or Greater Than 99.5% for Each Server – Contract # 03A8602-2 (Reviewed)

Verification and Approval of UNISYS Invoices For the Payment on Contract # 03A8602-2

Verification and Approval of IBM Invoices For Payment (Reviewed)

Protect Sensitive and Confidential Data Stored in NYCT Information Systems (Reviewed)

Security Monitoring and Mainframe Applications (Reviewed)

Monitor all Requested Changes to the NYC Transit Enterprise Network (Reviewed)

Develop, Publish, and Maintain Technology Strategy

Develop, Publish, and Maintain Short Term Technology Roadmap

AFC Program Management & Sales Operations:

MVM Cash Sales Reconciliation (Reviewed)

MVM Debit/Credit Sales Reconciliation Safeguard and Control Debit/Credit

Card Information

Office of Equal Employment Opportunity

Pre-complaint and/or Intake Process (Reviewed)

Prepare Letters from the President concerning NYCT’s EEO, Sexual and the Other Discriminatory Harassment and Respect in the Workplace Policies

Protect and Safeguard Social Security Numbers (Reviewed)

Prepare Annual Report to the Governor’s Office of Employee Relations on Sexual Harassment Complaints (Reviewed)

- 19 -

DEPARTMENT of ADMINSTRATION: Office of Labor Relations/Research and Training


Use of Procurement Cards

Division of Human Resources Administer Procurement Card Charges (Reviewed)

Maintain Protection of Social Security Numbers

Administer MaBSTOA Pension Payments

Occupational Health Services: Drug and Alcohol Testing (Reviewed) Work Life Services (Formerly EAP) Infectious Waste Proposal Hearing Conservation Program

(Reviewed)

DEPARTMENT OF CORPORATE COMMUNICATIONS:

Protection of Social Security Numbers

OFFICE OF SYSTEM SAFETY: NYS Department of Labor (DOL) SH-900 Summary Report (Reviewed)

NYS Department of Labor (DOL) SH-900 Log Report (Reviewed)

Protection Of Social Security Numbers (Reviewed)

Procurement Card Administration (Reviewed)

Site Evaluations of Large Quantity Generators of Hazardous Waste (Reviewed)

P/I Compliance Oversight (Reviewed)

Contract Management/Admin. (Reviewed)

Job Task Evaluations (Reviewed) Chemical Product Evaluations

(Reviewed) Hearing Conservation Program Data

Analysis (Reviewed) Hearing Conservation Program

Reporting (Reviewed) Hearing Conservation Program

Audits (Reviewed) Hearing Conservation Program P/I

Maintenance (Reviewed) Contract Management/Administration OSS Managed Asbestos Abatement

(Reviewed) CPM Managed Asbestos Abatement Witness Acceptance Testing of Fire

Detection and Suppression Systems (Reviewed)

Perform Fire and Life Safety Oversight of Operating Procedures and Polices (Reviewed)

Investigate Collisions and Derailments (Reviewed)

Investigate Fatal Employee Accidents (Reviewed)

- 20 -

OFFICE OF SYSTEM SAFETY:…cont’d

Investigate “Near Miss’ Incidents (Reviewed)

Investigate Multiple Injury Collision (Reviewed)

Investigate Fatal Accidents (Reviewed)

Investigate Mechanical Failures and Bus Fires (Reviewed)

Joint OSS/TWU Track Safety Inspections

OFFICE OF WORK FORCE DEVELOPMENT:

Deliver Track Safety Training to Contractors (Reviewed)

LIRR

All Departments Employee Accident Reporting (Reviewed)

Employee Accident Counseling (Reviewed)

Controller Procurement Card Usage (Reviewed)

Diversity Management Management Compensatory Time

Department of Management and Budget

Management Compensatory Time (Reviewed)

Procurement Card Usage (Reviewed)

Budget Submission (Reviewed)

Engineering Department Force Account Management – Comparison of Estimates vs. Actual

Capital Management Information System (CMIS+) (Reviewed)


Quality Control – Track Geometry Measurement TC-82 (Reviewed)

Signals – Equipment/Tool Inventory (Reviewed)

Signals - Highway Crossing Inspections (Reviewed)

Management Compensatory Time (Reviewed)

FRA Inspection–Tracks (Reviewed) FRA Signals Appliance Testing

Human Resources Department Time and Attendance Procurement Card Usage

(Reviewed) FMLA Compliance (Reviewed) Employee Services- Manage DA/DS

Cases Disability Management and

Restricted Duty Manage Background Investigation

Process and Yale Account Meeting Hiring Plan Goals for Craft

Positions Recruitment of Craft Titles Recruitment of Management Titles Maintain Corporate Personnel

Records Monitor Vacation Usage

- 21 -

Human Resources Department…cont’d.

Planning and Administrative Services/New Hire Plan

Maintain Corporate Personnel Records

Produce/Deliver Mandated Training Administer Alcohol and Substance

Testing Program (Reviewed) Administer Sick Leave Buyouts for

Qualifying Retirees (Reviewed) Monitor Health and Welfare Plans

Information Technology Department

Administration of Systems Development

Manage System Security Plan Disaster Recovery Management Compensatory Time

(Reviewed) Procurement Card Usage

(Reviewed)

Law Department Collect Debt (Reviewed) Federal Employees Liability Act

(FELA) - Create File Federal Employees Liability Act

(FELA) Claims Insurance Cases- Create File Calculate Liens & Lost Wages

(Reviewed) Lawsuits-Assist Attorney Manage/Monitor Outside Counsel

Bills Payment Monitoring of Case Status & Workload

Review Medical Reports Approve Medical Bills (Reviewed)

Payment/Security -Subpoena Checks Payment/Security - Issue Settlement

Checks (within $10,000) Property Damage-Create File Business Transactions-FRA

Violations Procurement-Advise & Assist re: Bid

Protest Procurement-Analyze and Advise re

Procurement Law Matters (Reviewed)

Procurement-Advise & Assist re: Vendor Responsibility (Reviewed)

Procurement -Draft and/or Revise Procurement Contracts & Agreements (Reviewed)

Procurement- Negotiate Disputes & Settlements With Vendors

Procurement-Liaison With Other Agencies

Special Projects-Coordinate Inspector General Inquiries & Record Requests

Special Projects-Develop Corporate Policies

- 22 -

Law Department…cont’d. Special Projects-Handle Miscellaneous Matters as Assigned by General Counsel (Reviewed)

Administration-Approve & Voucher Payments (Reviewed)

Administration-Procurement Card Usage (Reviewed)

FRA Violations Non-Tort Litigation: Set and Adjust

Reserves (Reviewed)

Labor Relations Department Management of Compensatory Time (Reviewed)


Maintenance of Equipment Department

Train Accident Reporting (Reviewed) DH Coach EIC Cleaning - EIC/Lay-

up Cleaning DH Coach Toilet Servicing MU EIC Cleaning - EIC/Lay-up

Cleaning MU Toilet Servicing - Quality Control Quality Control Toilet Inspection Quality Control HVAC Inspection for

Risk Ranking/Relevancy Diesel Operations -Daily Inspection

Process - Diesel Locomotives (Reviewed)

Diesel operations Periodic Inspection Process - C3 Coach (Reviewed)

MU - Field Operation -MU Brake Test - Rear End Only (Class II Break Test)

MU - Field Operations- MU Full Train + Brake Test (Class I Break Test)

MU - Field Operations- MU-2B Inspections

M7 Project M7 Warranty Procedure and Controls (Reviewed)

MU Fleet Support MNCR and NYCTA Rebuild Programs

MU Fleet Support MU Periodic Inspection (M1-M3-M7)

MofE Production Plan Special Requisition Processing (Reviewed)

MofE Annual Production Plan Controls (Reviewed)


Time and Attendance Budget Submission

Office of Security LIRR Pass Issuance (Reviewed) Procurement Card Usage

(Reviewed)

President’s Office Correspondence Handling

(Reviewed)

Procurement & Logistics Department

Administration of Procurement Card (Reviewed)

Commodity Planning-Choice Contract

- 23 -

Procurement & Logistics Department…con’td.

Commodity Planning- Commodity Profile

Commodity Planning- Reporting Commodity Planning -Generation of

Requisition (Reviewed) Vendor Profile (Reviewed) Commodity Planning- Warehouse

Replenishment Commodity Planning- Warehouse

Assignment (Reviewed) Emergency Procurements Disposition of Scrap Procurement - Property Management Receipting of Material

Market Development and Public Affairs Department


System Safety Department Investigate and Evaluate Major Fires for Cause and Possible Trends (Reviewed)

Petroleum Bulk Storage Tank Management Program (Reviewed) Petty Cash (Reviewed) Budget Submission (Reviewed) Time and Attendance Compliance & Safety – Annual Driver

Qualification (Reviewed) Accidents Reporting – Motor

Vehicles (Reviewed)

Strategy Investments Department Shops and Yards Strategy- Monitor and Revisions to Environmental Strategy

Monitor Life Cycle Maintenance (LCM) Shop Strategy

Transportation Services Department

Hours of Service Card (Reviewed) Train Accident Reporting (Reviewed) Administer Random Drug Test

(Reviewed) Engineer Certification Special Services – Audit of

Employees Monthly Expense Report Reporting Special Services -Control Inventory

(Reviewed) Maintain Purchase Orders Claims Resolution and Payroll

Processing (Reviewed) Prepare Weekly Management Payroll

(Reviewed) Process Invoices Control Flag Conduct & Agency

Reimbursements Responsiveness to Customer

Correspondence Tower Inspections (Reviewed) On Time Performance Reporting

(Reviewed) Dispatch Trains (Reviewed) Monitor TIMACS

- 24 -

Transportation Services Department…cont’d.

Train Consist Compliance Fare Collection (Reviewed) ER Tests & Supervise Crew

Performance Procurement Card Usage

(Reviewed) Station Operations Ronkonkoma

Garage Monthly & Daily Sales (Reviewed)

Managing Penn Station Cleaning Contract

TOM Reporting of Ticket Sales by Ticket Clerks (Reviewed)

TVM Reporting of Ticket Sales (Reviewed)

TOM Reporting of Cash Receipts by Ticket Clerks (Reviewed)

TVM Reporting of Cash Receipts (Reviewed)

TSM Operations –Security Surveillance in Money Handling Room (Reviewed)

Maintaining and Distributing of Ticket Stocks

Penn Station Ticket Remittance Operations

Management of Lost & Found Operations

Labor Relations –Discipline & Monitor Absence Control Policy

Employee Probation Evaluations Records (Reviewed)

Mail & Ride Customer Assistance Program (CAP)

Database Administration Administration of CAP Stipend CAP Activation Planned and

Unplanned Events LI Bus

Random Drug (Reviewed) LI Bus Payroll Processing

(Reviewed) Mitchel Field Depot Maintenance,

Transportation and Administrative Procedures (Reviewed)

Fare-Box Revenue (Reviewed) Metro-North

General Counsel Torts Division Coordinate Hazardous Waste

Training Coordinate the Accumulation and

Disposal of Hazardous Waste Obtain Air Discharge Permits Oversee the Use of Pesticides Prepare and Obtain Wastewater

Discharge permits Prepare Annual Environmental Audit Reserve Increases and Decreases

(Reviewed)

- 25 -

General Counsel…cont’d. Claims Services – Timekeeping (Reviewed)

Claim Settlement Check & AP1 Issuance (less than $20,000)

Claim Settlement Check & AP1 Issuance (greater than $20,000)

Monitoring and Handling Captive Station Liability and Force Account Claims

Executive Division – Safety Security Planning

Executive Division – Customer Service

Respond to Customer information Calls

Customer Service Department – Timekeeping

Credit Card Processing – Group Travel (Reviewed)

Monitor Ticket Office Security Monitor and Control Procurement

Activities (Reviewed) Monitor and Review Employee

Safety Support Ticket Office Operations Accept and Monitor Conductor’s

Remittances Control of Working Funds

(Reviewed) Automated Ticket Selling – Control of

Material, Business Supplies and Equipment

Maintain Ticket Vending Machine Operation

Control Purchasing and Inventory of Commissary Goods

Monitor Commuter Bar/Car Sales

Executive Division – Business Development, Facilities and Marketing

Monitor Accounting/Revenue, Collection and Remittance Procedures for Community and MNR Private Operators

Human Resources and Diversity Deliver Training Programs Benefits – Verification NYSHIP billing

(Reviewed) Benefits – Deferred Comp Monitoring

(Reviewed) Employment Background

Verifications (Reviewed) Job Posting Monitoring

(Reviewed) HRIS Data Entry – General

Deductions (Reviewed) Health Insurance Enrollment Tapes HRIS Data Entry – Non-ESCF Prepare Title VI Program (Reviewed) Conduct Inquiries of EEO Complaints

Finance & Information Technology Wire Transfers (Reviewed) General Accounting – Timekeeping

(Reviewed)

- 26 -

Finance & Information Technology…con’td.

Account Distribution Edit Correction (Reviewed)

Balancing (Reviewed) Check Audit Review (Reviewed) Match and Validation (Reviewed) Match and Validation – AP-4

(Reviewed) Payroll – Timekeeping (Reviewed) Prompt Payment (Reviewed) Vendor Maintenance (Reviewed) Processing Capital Invoices Generate Retroactive Wage

Payments (Reviewed) Payment of Wage Claims (Reviewed) Payment of Weekly Payroll Taxes

(Reviewed) Payment of Weekly Wages to Other

than Train & Engine Crews (OT&E) (Reviewed)

Payment of Weekly Wages to Train & Engine Crews (CMS) Employees (T&E) (Reviewed)

Prepare and File Payroll Tax Returns (Reviewed)

Processing of Title 13C Wage Guarantee Claims (Reviewed)

Weekly Payroll Balancing (Reviewed) Balance Subsystems (Reviewed) Force Account Billing (Reviewed) Miscellaneous Billing (Reviewed) Payroll (Reviewed) Web Ticket Monthly Closing Web Ticket Production Web Ticket Refund Control Web Ticket Stock Control Bank Payment/Lockbox Payment

Processing (Reviewed) Mail & Ride Customer Maintenance –

financial (Reviewed) Mail & Ride Customer Maintenance –

non-financial (Reviewed) PAD payment of Mail & Ride Tickets

(Reviewed) Production of Mail & Ride Tickets

(Reviewed) Monthly CDOT Deficit Bill (Reviewed) Annual CDOT Deficit Bill Subsidy Accounting – Timekeeper Audit of Conductor Cash Fare

Reports (Reviewed) Control of Materials & Supplies

including Ticket Stock/Metrocard Orders (Reviewed)

Daily Balancing of CSS (Reviewed) Intercompany Metrocard

Reconciliation (Reviewed) Monitor TSM Credit Card Activity

(Reviewed)

- 27 -

Finance & Information Technology…cont’d.

Passenger Revenue – Timekeeping (Reviewed)

Audit Ticket Agency Accounts Monitor TSM Debit Card Activity Reconcile TSM Debit & Credit Fees Reconcile TVM Cash Deposits Track Conductor Remittances

Procurement & Materials Management

Overtime Timekeeping – All Locations

including Attendance Processing Inventory

Adjustments/Express Putaways (Reviewed)

Processing Vendor Repair and Return Items (Reviewed)

Receipting of Standard Stock Material; Vendor, Pick list, Transfers (Reviewed)

MM-26 Processing Vendor Management/Vendor

Approvals Blanket and Rate Order Analysis Issues of Standard Stock Material Requisition Processing (min/max

external) Preparation, Solicitation and Award

of Procurements (over $15k) (Reviewed)

Solicitation & Award – General Services (Reviewed)

Sole Source Procurements Contract/Cost/Price Analysis

(Reviewed) Processing of Change Orders,

Supplemental, Agreements and Claims (Reviewed)

Solicitation, Award and Administration – Capital Projects (Reviewed)

Contract Cost/Price Analysis – Capital (Reviewed)

RFP/Solicitation and Award-Capital Projects (Reviewed)

Contract Post Award Administration Asset Disposition through Solicitation

(Reviewed)

Operations Stations – Control of Materials, Business Supplies and Equipment

Stations – Monitor and Review Employee Safety

Stations – Oversee the Recording of Wustodial Work Cards

ADM – Requisitions via Peoplesoft (Reviewed)

Field – Employee Register Field – Radar Observations

- 28 -

Operations…con’d. OCC – Bulletin Orders/Daily Train Operations (Reviewed)

OCC – Coordinate Capital and Other Track Projects and schedule track outages (Reviewed)

OCC – Monitor Budget and Recommend Programs for Expenditure Reductions (Reviewed)

OCC – Document Train Performance Information for Corporate Use

OCC – Monitor Attendance, PR, Administration Requirements for RTC, Yard & Tower Personnel

CMC – Monitor Road Crew Availability By Crew Base (Reviewed)

Budgets – Monitor Mechanical Department Non-Stock Requisitions (Reviewed)

Budgets – Prepare Third Party Billing for Rolling Stock Warranty Claim (Reviewed)

Engineering – Accident Investigation (Reviewed)

Engineering – Timekeeping and Payroll

Quality Control – Material Testing and New Vendor Qualifications

Quality Control – Repair and Return of Components

Quality Control – Timekeeping and Payroll

Heating & Air Conditioning – Timekeeping and Payroll

Component Tracking – Monthly Repair and Return Purchase Order

Report (Reviewed) EMIS – Input Wheel Readings

(Reviewed) Component Tracking – System

Maintenance EMIS – Timekeeping and Payroll POK Yard – Timekeeping and Payroll POK Yard – Yard 2B Inspections and

Repairs (Reviewed) Harmon Yard – Review and Enforce

Personnel Safety Harmon Yard – Timekeeping and

payroll Harmon Yard – Training and

development Harmon Yard – Yard 2B inspections

and repairs NWP Car Shop – Review/Enforce

Personnel Safety NWP Car Shop – Timekeeping and

Payroll Brewster Shop/Yard – Special

Projects and Retrofits (Reviewed)

- 29 -

Operations…cont’d. Brewster Shop/Yard – Produce and

Maintain Trial and Discipline Records Brewster Shop/Yard –Enforce

Personnel Safety Brewster Shop/Yard – Timekeeping

and Payroll NWP Yard – Control Blue Forms NWP Yard – Produce and Maintain

Trial and Discipline Records NWP Yard – Yard 2B Inspections

and Repairs Harmon Diesel Shop – Review and

Enforce Personnel Safety (Reviewed)

Harmon Diesel Shop – Control Blue Forms

Harmon Diesel Shop – Produce and Maintain Trial and Discipline Records

Harmon Diesel Shop – Special Projects and Retrofits

Harmon Diesel Shop – Timekeeping and Payroll

Harmon Support Shop – Produce and Maintain Trial and Discipline Records

Harmon Support Shop – Review and Enforce Personnel Safety

Harmon Support Shop – Special Projects and Retrofits

Harmon Support Shop – Timekeeping and Payroll

Harmon Car Shop – Control Blue Forms

Harmon Car Shop – Produce and Maintain Trial and Discipline records

Harmon Car Shop – Review and Enforce Personnel Safety

Harmon Car Shop – Special Projects and Retrofits

Harmon Car Shop – Timekeeping and Payroll

Harmon Shop Material Dept. – Requisition Non-Stock Material (Reviewed)

Harmon Shop Material Dept. – Tool Disbursement (Reviewed)

Harmon Shop Material Dept. – Requisition Stock Material

Harmon Shop Material Dept. – Timekeeping and Payroll

NH Shop – Control Blue Forms NH Shop – Produce and Maintain

Trial and Discipline Records NH Shop – Review and Enforce

Personnel Safety NH Shop – Special Projects and

Retrofits NH Shop – Timekeeping and Payroll

- 30 -

Operations…cont’d. NH Yard – Perform Yard Inspections and Running Repairs

NH Yard – Review and Enforce Personnel Safety

NH Yard – Timekeeping and Payroll Danbury – Review and Enforce

Personnel Safety Danbury – Timekeeping and Payroll Danbury – Yard 2B Inspections and

Repairs Stamford Shop/Yard – Control Blue

Forms (Reviewed) Stamford Shop/Yard – Produce and

Maintain Trial and Discipline records (Reviewed)

Stamford Shop/Yard – Review and Enforce Personnel Safety (Reviewed)

Stamford Shop/Yard – Timekeeping and Payroll (Reviewed)

Stamford Shop/Yard – Yard 2B Inspections and Repairs (Reviewed) Stamford Shop – Control Blue Forms Stamford Shop – Produce and

Maintain Trial and Discipline Records Stamford Shop – Review and

Enforce Personnel Safety Stamford Shop – Timekeeping and

Payroll Bridgeport – Produce and Maintain

Trial and Discipline Records Bridgeport – Review and Enforce

Personnel Safety Bridgeport – Timekeeping & Payroll Bridgeport – Yard 2B Inspections NH CSR Shop – Control Blue Forms NH Support Shop – Review and

Enforce Personnel Safety NH Support Shop – Timekeeping and

Payroll GCT – Produce and Maintain Trial

and Discipline Records (Reviewed) GCT– Review and Enforce

Personnel Safety (Reviewed) GCT– Perform Calendar Day

Inspections and Repairs GCT– Timekeeping and Payroll Review AP-1’s MofW Administration – Timekeeping MofW Power – Control of Materials,

Supplies and Equipment MofW Power – Timekeeping MofW Structures – Timekeeping and

Payroll (Reviewed) MofW Track – Timekeeping and

Payroll (Reviewed) C & S – Training C & S – Safety C & S – Vehicles

- 31 -

Capital Programs MN Passes & ID Badges for Consultants and Contractors (Reviewed)

Support Force Account Management and Project Control Functions (Reviewed)

Monitor of Capital Program Commitments

Prepare Monthly Progress Reports Processing Capital Retainage

Invoices Review Employee Expense Accounts Timekeeping – Peoplesoft

Planning Preparation of Crew Schedules for Road Passenger Train and Engine Service Employees (Reviewed)

Administer the Contract for the Haverstraw/Ossining ferry

Assist in Development of Section 6 Proposals for Labor Negotiations

Conduct Revenue Collection Studies to Determine Effectiveness of on-Board Collection Procedures

Capital Program Development (Reviewed)

Coordinate/Manage East Side Access project

Bridges and Tunnels

Engineering & Construction Develop Plans and Goals to Support the Presidential Policy “Engineering & Construction Department Mission and Functions” (Reviewed)

Design and Review Architectural Engineering Projects (Reviewed)

Plan, Budget and Schedule Capital and Operating Projects (Reviewed)

Maintain Quality Assurance over Project Development, Design and Management Activities for all Construction Work (Reviewed)

Finance Financial Statement Preparation (Reviewed)

Purchasing Action Payment Processing (Reviewed) Maintain Proper Control/Security

over Payroll Records

Health & Safety Provide Statistical Analysis of Employee and Customer Lost Time and Frequency Data for Safety Program Management (Reviewed)

Oversight of all Hazardous Material Abatements (Reviewed)

Review all contracts, construction design plans and specifications, contractor and consultant Safety Plans for Environmental, Health and Safety Concerns (Reviewed)

- 32 -

Health & Safety…cont’d. Provide Industrial Hygiene Program Management (Reviewed)

Provide Technical Oversight and Guidance for All Safety Training Courses

Internal Security Manage and Administer Facility Security Systems (Reviewed)

Coordinate the Securing of Sensitive Documents (Reviewed)

Conduct Reviews and Investigations (Reviewed)

Perform Security Inspections in ISD Areas (Reviewed)

Perform Safety Audits at Toll Collection facilities (Reviewed)

Maintain and Manage In-Lane Toll Equipment (Reviewed)

Install, Maintain, Upgrade and Repair CCTV System (Reviewed)

Information Technology Conduct Annual Disaster Recovery Tests of Critical Applications (Reviewed)

Manage Consultant Design, Development and Maintenance of ITS Products

Labor Relations Represent Agency in Rights and interests Arbitrations (Reviewed)

Represent Agency at Public Employment Relations Board (Reviewed)

Review Grievance Proceedings (Reviewed)

Legal Administer Workers’ Compensation Program (Reviewed)

Administer Property Damage Program (Reviewed)

Operations Ensure Toll Collection Functions are Performed in Coordination with Directives (Reviewed)

Ensure Customer and Employee Safety (Reviewed)

Maintain Adequate Level of Security at Critical Areas against Potential Threats, Vandalism, Theft and Acts of Terrorism (Reviewed)

Provide Firearms Training (Reviewed)

Provide Respiratory Protection Equipment Training (Reviewed)

Ensure that E-ZPass Equipment is Operating Properly (Reviewed)

Planning and Budge Manage the Budget Encumbrance Tracking System Reporting and Maintenance Activities

Conduct inspection of planning /budget backup data in compliance w/agency data backup Initiative

- 33 -

Procurement Develop and Prepare RFP’s and RFQ’s

Evaluate Bids, Proposals and Quotes for Responsiveness (Reviewed)

Perform Safety Audits (Reviewed)

Revenue Management Perform Manual Audits to Identify and Document Cash Shortages in a Timely Manner (Reviewed)

Compile Traffic and Revenue Information for Monthly Management Reporting (Reviewed)

Monitor E-Z Pass Tag Inventory (Reviewed)

Count Cash Held at Facilities (Reviewed)

Review Daily Operations at the Revenue Processing Center (Reviewed)

Maintain and Test Alternate Processing Center (Reviewed)

Perform monthly Reconciliations of non-Revenue Tags (Reviewed)

Monitor Manual Toll Processing (Reviewed)

Staff Services Review Personnel Records Monitor Medical Leave Absences

and Family Medical Leave Coordinate and Manage Mail,

Courier, and Messenger Services for All Facilities

MTACC

Audit of Contract Closeout Payments (Reviewed)

Consultant and Contractor Invoices/Payments (Reviewed)

Executive Business and Travel Expenses (Reviewed)

Environmental Performance Commitments (Reviewed)

Project Management Security Contracts (Reviewed)

Oversight Reviews of Contractors Quality Program (Reviewed)

MTA Bus

Random Drug (Reviewed) Storeroom (Reviewed) Warranty Claims and

Reimbursement Accountability Safety (Reviewed) Pre-trip Inspections (Reviewed) In-Service Fare-Box Operations

(Reviewed)

- 34 -

3. Identify the significant deficiencies revealed during the 2009-10 review process. Outline the actions taken, or planned, to eliminate deficiencies, highlighting the most important improvements made during the year.

Metropolitan Transportation Authority More than 65 internal control reviews were conducted in 2009. There were no significant deficiencies revealed during the 2009-10 review. These tests revealed minor control weaknesses and corrective actions have been taken. New York City Transit DEPARTMENT OF SUBWAYS: Maintenance of Way / Electronic Maintenance Division: Activity: Electronic Equipment Testing, Inspection, and Maintenance for Fire and Hazard Alarms/Suppression Systems in Buses and Depot Facilities, Including Depot Gas Detections Weakness: Improper record timekeeping due to personnel moves and reorganization of the Fire Alarm Group caused a significant number of forms to be misfiled of lost Corrective Action: 1. Maintenance Supervisors I (MSI) will be held responsible for approving all

inspection forms at the end of every work day. MSIs will also be responsible for ensuring that inspection forms are properly filed and that the database is updated.

2. Maintenance Supervisors II will be responsible for performing weekly checks and follow-up on the maintenance scheduled.

Activity: Electronic Equipment Testing, Inspection, and Maintenance for Fire and Hazard Alarms/Suppression Systems in the Subways, Including Stations, Crew Facilities and Booth Halon System. Weakness: Improper record timekeeping due to personnel moves and reorganization of the Fire Alarm Group caused a significant number of forms to be misfiled of lost Corrective Action: Maintenance Supervisors I (MSI) will be held responsible for approving all inspection forms at the end of every work day. MSIs will also be responsible for ensuring that inspection forms are properly filed and that the database is updated. Maintenance Supervisors II will be responsible for performing weekly checks and follow-up on the maintenance scheduled.

- 35 -

Maintenance of Way / Administration: Activity: Employee Support: Administration of Civil Service Law §§71, 73 (Non-Service Connected Injuries/Illnesses). Weakness: 1 Unreported employee injuries, missing weekly reports, no current access

to non-ATS timekeeping systems, and data not entered into the database in a timely manner.

2. A delay in updating employee case files and notifying employees of their status in a timely manner.

3. Employee cases were not resolved in a timely manner. Corrective Action: 1. An e-mail was sent to the manager of timekeeping requesting the payroll

reports for EMD and for quarterly reports for employees on KRONOS to improve tracking of that population.

2. Modifications will be made to the Access Database for both service and non-service connected injuries/illness to be able to print a schedule of upcoming dates for notification letters and also to generate the letters to automate notification.

3. Monthly status meetings will be scheduled to discuss necessary actions to be taken. The Access database listed in Corrective Actions #2 will also be utilized to set the schedule for terminations and reclassifications and to draft the letters to be sent to employees.

Maintenance of Way / Track: Activity: Third Rail Maintenance Weakness: 1. The annual system-wide inspection fell short of its inspection goal for

calendar year 2009. 2. For under river tube inspection and cleaning, completion of the annual

cycle was adversely impacted by several factors and was not achieved Corrective Action: 1. Review the inspection schedule and make necessary adjustments to

reflect personnel strength and flagging requirements. 2. Third Rail Operations will complete the outstanding under river tube

cleaning within four months. Maintenance of Way / Infrastructure: Activity: Hearing Conservation Weakness: All employees in the HCP were not trained/tested in 2009 as is required. Corrective Action: 1. Nine employees were scheduled for hearing training in January, 2010.

Personnel out of work in no-pay status (Military and Union Release) will be tested and trained upon their return to paid work status.

2. Reminders will be sent to Station Maintenance Management requesting that the five employees from that division be scheduled for their required training and audiometric testing.

- 36 -

Maintenance of Way / Electrical-Power: Activity: Power System Equipment Testing and Inspections Substations Weakness: 4,132 (25%) of 16,765 substation inspections were not completed as scheduled. In addition, 518 (40%) of 1,301 battery maintenance inspections were not completed as scheduled and 924 (74%) of 1,254 filter maintenance inspections were not completed as scheduled. Corrective Action: Review the inspection schedule and make the necessary changes to reflect personnel capability to ensure that all scheduled inspections are completed. Activity: Emergency Response Weakness: As of December 31, 2009, 138 monthly inspections were not completed as scheduled. The shortfall is attributable to personnel shortages. Corrective Action: Review the inspection schedule and make the necessary changes to reflect personnel capability to ensure that all scheduled inspection are completed. Maintenance Of Way / Electrical-Signals: Activity: Signal Equipment Maintenance and Work Order Repair Weakness: Supervisors failed to close out the Track Wire tickets as required in the Signals Equipment Information System (“SEIS”). Corrective Action: The tracking of maintenance, tests and inspections appears to be deficient because the existing computerized tracking system, SEIS, is antiquated, making the process time consuming and a laborious task for managers and supervisors in Signals to monitor. The SEIS is not very user friendly system. It requires complicated downloads and difficult interpretational reviews of the limited report that it produces. There is a plan to replace this system, first developed in 1984, with a new computerized maintenance system. Activity: Hearing Conservation Weakness: Reorganization of the Division of Signals in 2009 resulted in the transfer of the previous Hearing Conservation Representative (HCR), resulting in a lack of administrative focus on the HCP. Since there was no HCR, the updated listings of employee in the HCP were not submitted to OSS and all employees in the HCP program were not trained/tested as is required. Corrective Action: The Chief Signals Officer has designated a new Hearing Conservation Representative in 2010 in order to ensure full compliance with training, testing and notification to the appropriate individuals and departments.

- 37 -

Group Managers Program – Car Maintenance: Activity: Procurement Card Use / Payment Reconciliation Weakness: In 19 (31% of 61) instances pre-approval of purchases were not documented. In 15 (33% of 45 monthly reconciliations) instances the supervisor’s signature, acknowledging receipt of goods or services and correct charges was missing on the Monthly Procurement Statement or the Monthly Activity Form. In 9 (20% of 45) instances, DCE Administration had not received and did not review Procurement Card Statements from the cardholders. Corrective Action: 1. DCE Administration will suspend the Procurement Card of any cardholder

who has at least two outstanding monthly reconciliations or who fails twice to submit his/her monthly reconciliation to Administration.

2. Administration will distribute a reinstruction memo to all cardholders and managers. The reinstruction memo will notify card holders and managers that having two outstanding monthly reconciliations or failing to submit two monthly reconciliations to Administration will be grounds for suspension of Procurement Card privileges. The memo will reiterate policy and procedures requiring documented pre-approval, by Supervisors, authorizing cardholders to make purchases.

DEPARTMENT OF BUSES: Activity: Sick leave Weakness: Missing documentation. No specific policy to follow up with Occupational Health and Safety with regards to FMLA related sick leave applications. No evidence of disciplinary action found on some instances of non-compliance with regards to sick application submission. Corrective Action: Review UTS leave reports and take appropriate action. Notify employees with missing documentation and follow-up. Retract pay for non-compliance and/or issue violations. Review EIS reports for OHS approval of specific FMLA leave dates and take appropriate action if dates are not approved. Communicate to supervision the need for proper record keeping and paper documentation filing. DEPARTMENT OF EXECUTIVE VICE PRESIDENT: Division of Technology & Information Services: Activity: Protecting Social Security Numbers Weakness: The EIS system uses employees’ social security number (SSN) as the key field (EMPLID) throughout the system and it appears on many reports. Corrective Action: EIS will be replaced with a system that uses a value other than the SSN in the EMPLID field.

- 38 -

Activity: Coordinate TIS employee Training and Travel Requests Weakness: Justification letters were incorrect or missing. Backup documentation was missing for training/travel. There was incorrect/missing information on the authorization for travel/training, NYCT requisition form and travel estimate worksheet. Corrective Action: Going forward, Training Liaisons will check the training/travel documents thoroughly before submitting them for approval. The training/travel procedures will be utilized at all times when preparing a package. More training sessions will be given to ensure that all liaisons and employees who travel frequently are in compliance with the travel/training process. DEPARTMENT OF ADMINISTRATION: Occupation Health Services: Activity: Medical Examination to Determine Physical Condition of Bus Operator Under Article 19A (NYS DMV Regulation) Weakness: There were no written procedures for conducting 19A certification and the use of the diagnostic equipment. Approximately half of the 19A Restricted Work Assessment forms on file were incomplete and missing key information such as physician and employee signatures Corrective Action: 1. A standard operating procedures for performing 19As and using the

diagnostic equipment must be prepared and distributed to the clinical staff. 2. The Restricted Work Assessment form for Bus Operators must be

completed by all physicians qualifying a permanent condition for 19A disqualification and signed by all the necessary parties.

3. Ensure completeness of all 19A forms before being sent to Buses Training School.

Activity: Hearing Conservation Program Weakness: Copies of the STS notification letter that are given to employees after testing were not sent to OSS. Corrective Action: 1. Standard operating procedures for conducting hearing tests were finalized

and distributed to the clinical staff. Certification was forwarded to the Office of the Controller on 11/3/09.

2. OHS trained its clinical staff to generate a form letter in the Medgate system to send copies of the employee notification to OSS. It is currently working to ensure that proper baseline calculations are accurate for all STS notification letters.

- 39 -

Activity: Medical Surveillance – Respiratory Clearance, Asbestos Clearance Weakness: Standard procedures for performing spirometric testing were not available to staff. Only half of the employees that were scheduled for follow-up examinations returned for their revisits. Corrective Action: 1. A copy of the standard operating procedures for performing spirometry

tests must be prepared and distributed to the clinical staff. 2. OHS will review missed medical tracking and follow-up measures to

ensure that employees who missed their revisit appointments are rescheduled.

Activity: Family and Medical Leave Weakness: Inspected the FMLA application box in which completed applications are deposited for collection and found that is was not properly secured. The door opened even though it had been locked with a key. The current situation compromises the confidentiality of the information included in the applications. Corrective Action: The Director of Compliance and Support will have the box properly secured without delay. OFFICE OF SYSTEM SAFETY: Activity: Hearing Conservation Program – Data Analysis Weakness: 1. The 4th quarter submittal of data from OHS was not received. 2. The first quarter submittal did not include the type of hearing loss

(conductive or sensorineural) sustained by employees. 3. 1st, 2nd and 3rd quarter submittals did not comply with the 21-day

notification requirement of an identified Standard Threshold Shift (STS). 4. Noise assessment of seven (7) job titles is pending. Corrective Action: 1. The Office of System Safety met with OHS (Asst. VP & Medical Director)

to discuss the 4th submittal. 2. OSS reiterated the policy to OHS that OHS must indicate the type of

hearing loss in quarterly reports. 3. OSS met with OHS (Asst. VP & 2 Senior Directors) to reiterate that written

notification for all STS cases is required within 21 days. 4. OSS will assess 4 job titles in 2010 for which no noise monitoring data

exists. Activity: Hearing Conservation Program – (HCP) Reporting Weakness: 1. The 2nd semi-annual submittal for MOW - Track & Infrastructure Division

was incomplete and submitted late. 2. Twenty-four out of thirty-five submittals (97%) indicated noncompliance

with HCP training and audiometric testing requirements.

- 40 -

Corrective Action: 1. OSS met with MOW (Safety Director, Chief Officer Administration &

Finance, and Hearing Conservation Representative) to remind them that their submissions were tardy and incomplete.

2. OSS sent memoranda to Dept/Division Heads indicating the status of compliance rates for each division.

3. Technology and Information Services (TIS) is developing an alternate system to be utilized by HCP Representatives to track and verify compliance.

Activity: Hearing Conservation Program – (HCP) Audits Weakness: 1. Noncompliance with mandatory HCP training and audiometric testing. 2. Noncompliance with mandatory use of PPE, HCP training and audiometric

testing. Corrective Action: 1. OSS issued a memorandum to the DOB Department Head detailing the

results of all audits and requesting appropriate actions to be taken. 2. OSS issued a memorandum to the DOS Department Head detailing the

results of all audits and requesting appropriate actions taken. 3. OSS notified the Dept. Head with instructions to ensure compliance with

PPE usage.

Long Island Railroad Transportation Services: Activity: Train Accident Reporting Weakness: Ten out of 68 Accident Reporting Forms AR10 were not submitted to the Chief Clerk to be entered into the ACS. Corrective Action: The Transportation Manager responsible for accident reporting was required to attend a refresher document training specific to Form AR10. The Transportation Services Department will also investigate the need to create and retain Form AR10 for incidents related to freight equipment. As a reminder, the policy and procedure specific to AR10 processing was redistributed to all Transportation Management personnel to reinforce compliance. Activity: Hours of Service Card Submitted Weakness: There are 1,476 Train and Engine Service employees required to submit Hours of Service cards. Out of a total 76,512, there were a total of 7,500 outstanding cards. Corrective Action: Although the outstanding cards included employees on the sick list and on disciplinary leave, Transportation Services Department will review its protocols in order to improve compliance.

- 41 -

Activity: Fare Collection Weakness: The Transportation Services Department, in conjunction with MTA Audit Services recognized a weakness to on-board fare collection, such as the collection of incorrect fares. Corrective Action: The Transportation Services Department has added new resources to re-evaluate auditor follow-ups. For instance, Transportation Test Team supervisors periodically observe train service personnel, assign extra and events collectors as needed. In addition, this activity is continuously reviewed and enhanced to ensure that all employees collect valid fares at all times. Activity: Transportation Services – Prepare Weekly Management Payroll Weakness: The processing of payroll does not always function as intended. Documents are not always submitted timely. Corrective Action: The departmental Policy and Procedure was revised and distributed, outlining the specific time frame payroll/attendance documents are to be submitted. In addition, periodic audits of submission will continue to ensure compliance. Activity: Transportation Services (formerly Passenger Services) – Employee Accident Reporting Weakness: Of the 16 AR-20’s prepared, four were entered late in the Accident Control System (ACS) due to the forms not having been forwarded to the Administrative group in a timely manner. With regards to employee counseling, 12 of the 16 employees were properly counseled after the accidents. Corrective Action: The Field Managers were reminded of the need to submit all AR-1 forms to the Administrative group within the required 24 hours so that the AR-20’s are prepared in a timely manner. Activity: Employee Accident Reporting Weakness: The Department submitted a total of 125 AR-1’s: all were entered on a timely basis. However, 47 AR-20/21’s were not entered into the ACS within the seven-day period. On the counseling side, 58 employees required counseling during the observation period and as of May 31, 2009, 53 counseling sessions were completed. The remaining five counseling sessions will be completed upon employee availability. Corrective Action: The Transportation Department continues to re-educate management with regard to proper employee accident reporting and counseling procedures. Activity: Station Operations; Recording of Ronkonkoma Garage Monthly & Daily Sales

- 42 -

Weakness: Central Parking Services Management provides invoicing and utilization reports to account for deferred and required maintenance and repair activities in the garage; however, many of the invoices that were reviewed did not contain correct or supportive documentation for expenses. Corrective Action: The Transportation Services Department has re-instructed Central Parking Services to review all support documents for completeness prior to submission. Activity: OSA/Engineering – Force Account Management -Comparison of Estimates and Budget vs. Actual Expenditures Weakness: The Department of Program Management Estimating Group is not inputting amended estimates into the system. Additionally, project changes are not always updated or inputted into the system. Corrective Action: The Department of Program Management and Office of Support and Analysis will work together to ensure the integrity of the system. The CMS+System needs to be updated. Once the Manager of Reimbursable Analysis position, currently vacant, is filled, the System will be updated. Activity: Engineering – Escalator and Elevator Inspections Weakness: An internal audit revealed some contractors did not always fulfill their obligations regarding the functionality of elevator exterior, interior and button indicator lighting and button service response on all elevator levels. Corrective Action: The Engineering department has re-instructed the Contractor of its obligations and had all the lights in the elevators, button indicator light and button service response on all elevators levels fixed. Activity: Labor Relations – Petty Cash Weakness: All transactions were not recorded in accordance with the Corporate Policy. For one transaction, only hand written note with no receipt was found. Corrective Action: The Labor Relations Department has re-instructed employees to adhere to the Policy and provide detailed receipts for all transactions. Activity: Procurement & Logistics – Vehicle Fleet Operations Fuel Card System Weakness: No weakness was found. Mileage information is now downloaded to Vehicle Fleet Asset Management (VFAM) Maximo on a daily basis. Corrective Action: Although no weakness was found; the implementation of “Start Up’ of Project Management (PM) Module pilot program to create PM Service lists will enhance the process.

- 43 -

Activity: Office of Management & Budget- Economic Analysis Weakness: Inconsistency of the release of the bi-monthly status reports of OFC Projects was found. For instance, there were no reports issued for the months of August and October. Correction Action: Going forward, Economic Analysis will make sure that the reports are issued as required. Periodic reports are an important tool in keeping others apprised of the status of project and flagging issues for correction. Activity: Law – Non Tort Litigation- Set and Adjust Reserves Weakness: Although all reserves reflected in monthly reserve listing were accurate, in one case, a Pink sheet could not be located. Corrected Action: All Pink Sheets will be scanned into the new enhanced LawTrack System and reserves will be inputted directly into the LawTrack system by one secretary who will also maintain the reserve listing. The original Pink Sheet will be put in the file. This change in procedure will also ensure that the function, which was originally the responsibility of the Law Register Clerk position, currently vacant, continues to be properly performed. Activity: Law- Procurement & Special Projects Weakness: Although no significant weakness was identified, closer coordination and review of work will be required. Additionally, there is a need to better clarify responsibilities of the Law Department in contract preparation. Corrective Action: The Law Department will begin weekly group meetings to ensure clear understanding and status of assignment. Activity: Law- Employee Accident Reporting Weakness: There was only one reportable accident in the reporting timeframe. The AR-1, AR-20 and AR-21 forms were completed in a timely manner and submitted to System Safety. However, the AR-30 form was not completed, although it was the employee’s first accident. Corrective Action: The Manager was reminded of the need for counseling and that an AR-30 must be completed in the event of an employee’s first accident. Activity: System Safety- Environmental Engineering- Incident/Accident Emergency Spill Response Weakness: Although no weakness was found, improvement is needed to map the spill locations using a Global Positioning System (GPS). Corrective Action: The System Safety Department plans on purchasing a handheld GPS unit this year, which will enable the LIRR to plot the spill incidents geographically. This

- 44 -

will then allow the LIRR to create Geographic Information Systems (GIS) maps of the spills for the System Safety intranet page. Activity: System Safety – Petroleum Bulk Storage Tank Management Program Weakness: Based on the NYS DEC regulations, one year of monthly inspection reports must be on site. However, during the field site visits, these inspection reports were missing. Corrective Action: The operating department environmental personnel were advised to provide copies of the missing reports to the operating department and instruct their field personnel that these reports must be kept on site for one year. Activity: Controller - Accident Reporting Weakness: The AR-1, 20 and 21 forms were completed in a timely manner. However, the AR-1 for one accident was entered into the Accident Control System (ACS) 48 hours after it was completed. Upon further investigation, it was learned that the entry was delayed because access to the system had not yet been granted to the Controller’s administrator. Corrective Action: Access to the ACS was granted to the administrator, which will ensure that future incidents within the Controller’s group are entered into the system in a timely manner. Activity: Engineering – Employee Accident Reporting Weakness: The AR-1’s were entered into the ACS within the required 24-hour period. The majority of AR-20/21’s averaged 11-13 days for final copies to be forwarded to the appropriate departments (Claims, System Safety, etc). This average is up slightly from the previous reporting period of 10-12 days. This increase is attributed to an investigating supervisor’s having been out sick. In addition, the department investigating supervisor is now devoting more time to investigating accidents in order to make more appropriate recommendations for effective preventive actions. The timeliness of AR-30 submission has continued to improve and for the most part MV-104’s forms were completed on a timely basis. Corrective Action: The Department will continue to monitor the AR-20/21 Accident Investigation process with dual goals of improving the investigation quality and reducing the paperwork submission time. AR-20/21 training sessions for Supervision were held in January 2009. It is expected that these training sessions will help improve the timeliness of submissions. Activity: Information Technology – Employee Accident Reporting Weakness: AR-1’s were properly completed for two reported accidents and entered in a timely manner into the ACS. However, the AR-20 for one of the accidents was entered into the ACS nine months after the AR-1 was completed. This was due to the Manager responsible for entering the information into the system having been out sick. Therefore the form was inadvertently overlooked.

- 45 -

Corrective Action: The Chief Information Officer sent out an e-mail to all IT Managers detailing the process to follow internally to further strengthen compliance to the current procedure. The e-mail required that, going forward, notification of an accident be sent out to three managers so that the information is entered into the ACS in a timely manner in the event that someone is out of the office. Activity: Maintenance of Equipment - Employee Accident Reporting Weakness: The Department submitted a total of 60 AR-1 forms. Nine were not entered in a timely manner into the ACS. Also, 60 AR-20/21’s were entered in the ACS during the reporting period; however, nine of the 60 were not entered in the mainframe within seven days after the occurrence of the accident. One MV-104 was completed within 24 hours. The original was forwarded to System Safety, as required. Corrective Action: The Department will continue to monitor the process to ensure the timely filing of incidents. Long Island Bus Activity: Payroll Weakness: The review of Long Island Bus payroll processing determined that there was inadequate supervisory review of transactions and journal entries prepared by the Assistant Controller, the Assistant Controller had excessive system access, there were inadequate system audit trails, and there were incomplete procedures and, in the payroll area, inadequate segregation of duties, and there was shared system access. Corrective Action: Procedures and processes are being revised. Metro-North Railroad For 2009-10, a total of 179 Internal Control Reviews were conducted throughout all departments at Metro-North and approximately 2% of the tests revealed minor control weaknesses. Corrective Action Plans (CAPs) were developed for reviewed activities with deficiencies and implemented immediately, or are scheduled for implementation. Weaknesses which were identified included: incomplete or insufficient documentation and insufficient reporting capabilities. and All corrective action information is captured by the online ICS for reporting and monitoring by the ICO. CAPs are created in response to weaknesses identified, and they are highlighted in the ICS through its various reporting tools. All business activities which require CAPs must receive an electronic approval from the Department Head in order for the ICR to be approved and closed-out for the reporting year. The ICO reviews and monitors CAPs with the Departmental Internal Control Coordinators on an ongoing basis until they are fully implemented. The new ICO is focused on working with Departments to ensure corrective actions are taken as quickly as possible. Weaknesses revealed during testing and corrective actions, along with target implementation dates, are

- 46 -

maintained in the ICS for tracking by the ICO. A specific report has been developed to monitor and track the progress of CAPs in the ICS reporting system by the ICO. A summary of the corrective actions to improve controls in 2009-10 are as follows: Human Resources and Diversity: Activity: Record Keeping Weakness: Recordkeeping deficiencies were found in the documentation and tracking of select employees who needed to attend Sexual Harassment Prevention and Diversity Training. Corrective Action: A new Senior Director of Training was hired in 2009, and he has since implemented a new Learning Management System for tracking of all Metro-North training activities. This new system allows for improved reporting of employees who need to attend required training in this area. Procurement & Materials Management: Activity: Procurement Weakness: A review of the various procurement awards for Asset Disposition Through Solicitation revealed a missing field inspection report for one of the awards. Corrective Action: The Assistant Director in charge of disposition will work with the user Departments to ensure that going forward, attendees at all the field inspection meetings sign attendance sheets and that this documentation is kept on file. Operations: Activity: Manning Level Reports Weakness: With the implementation of PeopleSoft, the Maintenance of Way Department was unable to produce manning level reports that met the Department’s criteria developed under the prior ATK system. Corrective Action: The KRONOS payroll system is currently being implemented. The development of a new reporting system that will meet the Department’s criteria will take place once KRONOS has been rolled-out. This will ensure compatibility between both new systems for the monitoring of manning levels in the Department. Planning: Activity: Timesheets Weakness: During their review, the Operations Planning Department found that random checks of survey technician time sheets were not always performed as intended.

- 47 -

Corrective Action: Since the review, the Department has hired a new Planner I, who will be directly responsible for the monitoring and qualitative reporting of Metro-North’s part-time counting staff. With this staffing change, all aspects of Metro-North’s counting program will now be strengthened. CAPs are created in response to weaknesses identified, and they are highlighted in the ICS through its various reporting tools. All business activities which require CAPs must receive an electronic approval from the Department Head in order for the ICR to be approved and closed-out for the reporting year. The ICO reviews and monitors CAPs with the Departmental Internal Control Coordinators on an ongoing basis until they are fully implemented. The new ICO is focused on working with Departments to ensure corrective actions are taken as quickly as possible. Weaknesses revealed during testing and corrective actions, along with target implementation dates, are maintained in the ICS for tracking by the ICO. A specific report has been developed to monitor and track the progress of CAPs in the ICS reporting system by the ICO. Bridges and Tunnels More than 178 internal control reviews were conducted in 2009. There were no significant deficiencies revealed during the 2009-10 review. About 15% of these tests revealed minor control weaknesses and corrective action has been taken. Capital Construction No. 7 Line Extension: Activity: Field Survey Weakness: An MTACC Environmental and Sustainability Field Survey of the Running Tunnels & Station Structures Contract (C26503), was conducted on September 30, 2009. The survey noted that the Ground Water Control System’s flow meter was out of service and not functioning as prescribed by New York City Department of Environmental Protection (NYCDEP) discharge permit (Conditional Approval Letter, File Case # C-4422) or the project specifications for Ground Water Control. The specifications state: “The Contractor to check the calibration of all flow meters at least once a month. Record the data of these calibration tests and submit to the Engineer. Replace or repair within 48 hours any flow meter that is found to be working improperly.” and “The Contractor shall be responsible for compliance with all regulatory requirements applicable to their specific activities of Work.” An Environmental Deficiency Report (EDR) was issued to the Contractor for the non-working flow meter. Corrective Action: MTACC worked with the Contractor’s environmental manager to resolve the issue. It was agreed that ground water could be diverted to a location with a working flow pump. The contractor was instructed to secure the non-working pump site, drain the settling tanks, clean the sludge, take an end point reading of the gauge, and provide a close-out of the EDR. In addition, the contractor was instructed to hire a plumber to verify the calibration of the working flow meter and revise their Dewatering Plan to reflect the sole use of the site with the working

- 48 -

flow meter and indicate the close-out of the non-working flow meter. The contractor was instructed to notify NYCDEP of the change in the Dewatering Plan, if required. On November 13, 2009 MTACC returned to the site and confirmed that the Contractor had corrected the deficiency as required and had also notified the NYCDEP. Activity: Quality Manager Report Weakness: MTACC’s Quality Manager reported on August 26, 2009 that a section of the concrete in the invert of Shaft K was patched without cleaning the rock prior to concrete placement. If the rock is not properly treated the probability exists that the patch would become brittle, no longer adhere to the shaft structure and ultimately become dislodged. The Contractor violated Spec. 3300-3.08.B1 by removing the concrete forms without requesting that the Engineer review the work before patching. An NCR (Non-Conformance Report) was generated based on no examination of approval of the prior work. Corrective Action: The Contractor was informed of this deficiency on August 27, 2009. The previous patch was removed, saw cutting was started immediately, and the new patch was installed in accordance with the required specifications. This transpired at no cost to MTACC. The Contractor agreed with our assertion that concrete forms should not be removed without the inspector witnessing their removal and that the placement of concrete triggers a “hold point,” requiring approval before work is continued. Fulton Street Transit Center: Activity: Environmental and Sustainability Field Survey Weakness: An MTACC Environmental and Sustainability Field Survey of the Foundations Contract (A36119), was conducted on September 30, 2009. One deficiency noted was that the Contractor failed to comply with the following contract specifications requirement: that all diesel powered non-road construction equipment with engine horsepower (HP) ratings of 50HP and above shall be retrofitted with a Diesel Particulate Filter (DPF). The Contractor requested a waiver for a wide track loader that was urgently needed and recently brought onto the site. Corrective Action: The Contractor was granted a 3-day waiver; and agreed to immediately order the DPF and install it upon receipt. On October 5, 2009 we observed that the required DPF had been installed properly on the wide track loader. Oversight Review: Activity: Oversight Review Weakness: An Oversight Review conducted by MTA’s Quality and Safety Unit on April 28, 2009 noted that the underpinning activity for 144 Fulton Street was performed according to specifications, but the work was not being properly documented. The Contractor considered the underpinning of 144 Fulton Street as part of

- 49 -

temporary activities (support of excavation) and was only documenting activity in the Quality Assurance Daily Report. No Quality Work Plan was submitted. Corrective Action: The Contractor is required to provide Quality Management Reports (Daily Reports and Shift Reports) to the Chief Engineer and the Engineer of Record. These documents and the debriefing provided to the Contractor’s Assistant Chief Engineer, who visited the site on two occasions, formed the basis for issuance of the underpinning certification by the Contractor’s Chief Engineer (a NY licensed P. E.) for underpinning activity at 144 Fulton Street. Further activities are to be covered by Quality Work Plans and Checklists, and a Certification by the Chief Engineer, as required by specifications. Activity: Field Visit Weakness: During a Quality and Safety field visit to the FSTC on November 12, 2009, the Contractor’s lathers (steel reinforcing workers) were preparing to install anchor bolts to be embedded in the foundation concrete pour together with the reinforcing. It was noted that the preparations included welding of the anchor bolt support assembly to the permanent reinforcing bars. The Contractor’s Quality Manager was advised that, according to contract specifications no welding is permitted on concrete structural steel reinforcing (rebars). Corrective Action: An onsite field meeting was held with the Contractor’s Quality Manger, the CCM Inspector and Contractor’s Supervisor to discuss the issue. It was decided that dummy bars will be added to the reinforcing steel and the anchor bolt assemblies are to be tack welded to these dummy bars. Welds to the reinforcing bars are eliminated, while stability and rigidity of the anchor bolt assemblies are assured and are expected to remain in their intended locations after the concrete placement. Activity: Oversight Review Weakness: The 2nd Quarter Oversight Review, conducted on July 28, 2009 noted that the Concrete Replacement Report Form being used; is the old form, which has been revised to apply to the current contract. The old form in use contained references to the wrong contract number, and a sign-off certifying to the wrong contract number. Corrective Action: The Concrete Replacement Report form was revised to delete all references to the incorrect contract number. All other forms were reviewed to ensure that forms do not refer to other contracts and that the correct contract number appears on the checklist form. Additionally, sign-off blocks are required to have printed names in addition to the signatures. East Side Access: Activity: NYSDEC Site Visit Weakness: In March 2009, the New York State Department of Environmental Conservation (NYSDEC) regional staff performed a site visit and identified two deficiencies related to East Side Access (ESA) construction activities in Sunnyside Yard,

- 50 -

which is a Class II Inactive Hazardous Waste Site (i.e., State Superfund Site). NYSDEC wrote to the Chief of Environmental & Sustainability Services at MTACC on April 2, 2009 detailing the these deficiencies: 1) the absence of a water truck in operation to minimize dust, and 2) uncovered stockpiles. The Contractor is required to comply with the requirements found in the Construction Contaminant Site Management Plan for Sunnyside Yard (CCSMP), which was developed by MTACC and approved by NYSDEC for all work occurring in Sunnyside Yard and is a reference document in the Queens Contract documents. The CCSMP, contract specifications, and a Community Air Monitoring Plan (an appendix to the CCSMP) require all practicable methods of minimizing dust to be utilized during the construction period and all stockpiles to be covered with tarp. Corrective Action: In less than a week, MTACC and ESA responded to NYSDEC and issued a change order to one contractor to take over dust control in the Yard and dedicate a water truck to continuously wet the site. Although the uncovered stockpiles could not be covered due to their proximity to railroad tracks, a silt fence was installed to prevent runoff and the stockpiles were continuously wet until their removal from the site. Second Avenue Subway: Activity: Site Visit Weakness: DEFICIENCY: As part of the third quarter site visits conducted by MTACC Environmental & Sustainability Services, general housekeeping issues, noise, and poor drainage and ponding in the vicinity of catch basins were identified as deficiencies within the work zones of Second Avenue Subway Contracts (C-26002, C-26005, and C-26013). Contractors are required to utilize all practicable noise attenuating measures as specified in the New York City Noise Control Code, including the use of mufflers on equipment and noise blankets/walls. In addition, contract specifications require the Contractor to prevent sediment from flowing or being tracked onto the public right-of-way. Sediment and erosion control measures include the use of filter fabric installed in catch basins to prevent sediment from blocking the flow into the storm drain and the use of hay bales to prevent runoff at yards and the edge of excavation activities. Corrective Action: MTACC Environmental & Sustainability Services monitored the progress of contractor measures to correct the deficiencies via weekly reporting by the Construction Management team. Filter fabric was installed in all storm drains and catch basins to improve drainage, additional noise blankets were ordered and installed at the perimeter of the construction site, drums were labeled property and debris cleaned up.

- 51 -

MTA Bus Activity: Storeroom Weakness: Storerooms generally had inadequate procedures. Corrective Action: Revised procedures are being prepared. Activity: Warranty Weakness: Warranty reimbursement checks were not deposited timely. Corrective Action: The process was revised to ensure deposits occur in a timely manner. Activity: Farebox Weakness: Fare boxes were not tested prior to entering services. Corrective Action: Fare boxes are now required to be checked prior to entering service.

- 52 -

4. Describe the monitoring system installed by the agency to verify that corrective actions are taken. Discuss the extent to which IT systems are used to track corrective actions.

Metropolitan Transportation Authority MTAHQ management is required to respond to each audit recommendation with a corrective action plan detailing steps that have or will be taken to address the recommendation. In 2009 the Compliance area has been assigned to monitor all outstanding audits and to report to the MTA Audit Committee all audit recommendations that have exceeded six months beyond their planned implementation date. For items that require action as found in the vulnerability testing, the department coordinator met or will meet with the appropriate level of management to address the item. The Internal Control Officer also discussed the matters with the coordinators and has or will discuss them with appropriate management. Both the audit recommendations and the vulnerability assessments are stored electronically. Later this year, MTA will begin to move the information to its new GRC platform which will reduce paper, allow easier follow up via e-mails, maintain a historical record, and allow easier transfer of information. The full transfer of data, training of coordinators and introduction of the system will be completed over a two year period. New York City Transit Follow-up on corrective actions taken to eliminate weaknesses is performed by departmental personnel. The results of the Departments’ review are monitored by the Office of the Controller. A schedule of control weaknesses, corrective actions, and dates of completion has been prepared. The Internal Control Coordinator corresponds with each Internal Control Manager to ensure that all action items are completed satisfactorily and on time. The status of weaknesses and related resolutions is tracked via electronic systems. All divisions/departments that identified weaknesses during the 2008-2009 internal control review process have provided documentation to the Office of the Controller to demonstrate that the appropriate corrective actions, necessary to correct those deficiencies, were properly implemented. Long Island Rail Road The system in place to monitor and track corrective actions is an MS Access application which was developed by the Re-engineering & Internal Control Department. The Re-engineering Department uses this internally developed application to supplement two critical forms used by every department, the Vulnerability Assessment (VA) Form and the Control Evaluation Record. These two forms serve as the basis for the listing of business activities, risk ranking,

- 53 -

controls techniques and control evaluation and testing. As previously indicated, to further enhance the efficiency and effectiveness of the MCR Program, in 2008, under the direction of the ICO, the Re-engineering & Internal Controls Department began coordinating and monitoring audits performed by MTA Audit Services, the MTA Inspector General and the New York State Comptroller. Long Island Bus The Internal Studies & Operations Improvement Division utilizes an automated system to monitor the implementation of recommendations. Metro-North Railroad In 2007, Metro-North’s Information Technology (IT) Department developed an online Internal Control System (ICS) for processing, tracking and managing Internal Control Reviews (ICRs). The online ICS resides on Metro-North’s intranet and mirrors the old manual paper process. For the last two reporting years, some Departments have used the new online system, while others have continued to use the manual system. Under the direction of the new ICO, all Departments were brought online and used the ICS to process their ICRs for the 2009-10 reporting year. Each Department’s business activities, including risk assessments, are updated annually through the ICS. Based on the risk levels assigned to each business activity, review cycles are established, and all Internal Control Reviews due in the current year are performed online using the ICS. Responsibility for ICRs is at the department level, with a combination of managers and their staff associated with particular business activities completing risk assessments and performing necessary reviews and testing of controls in order to complete the ICRs. A combination of Internal Control Administrators (responsible for managing multiple Coordinators in a department), Coordinators (responsible for a group of business activities), Initiators (managers who perform risk assessments) and Reviewers (staff more familiar with particular business activities who are responsible for completing the various online review forms) all have a role in completing the ICRs. Once ICRs are completed and approved by Coordinators, Department Heads and Vice Presidents certify departmental and divisional compliance with the provisions of the Internal Control Act annually. All Department Heads certified electronically using the online ICS for 2009-10, and while the Vice Presidents certified manually this year, the IT Department plans to modify the ICS to allow electronic VP certifications in the 2010-11 reporting year. ICRs for all activities conducted are maintained in the ICS while backup documentation, which supports testing activities, is maintained by the Departments. All material is subject to review and audit by MTA Audit Services.

- 54 -

Bridges and Tunnel All information on vulnerability self-assessments, internal control testing, and corrective action plans is captured and documented centrally and entered into one PC-based tracking system. A component of this system documents the corrective actions planned or taken. The documentation of corrective action plans are periodically reviewed by the ICO for appropriateness as well as for open items. Based on this review, the ICO requires DICCs to follow up with departmental management to ensure that corrective action was taken as reported, and, if not resolved, continue to report changes in the status of these actions until they are resolved. Capital Construction Project management is required to respond in writing to all audit recommendations with a corrective action plan detailing the steps that have been or will be taken to implement corrective action as well as committing to a time frame for completing the action plan. This information is stored in a PC based tracking system, and all open audit recommendations are periodically followed up with management. Any recommendation that has not been implemented within the agreed upon timeframe are reported to the MTA Chief Compliance Officer, who in turn forwards the information to the MTA Audit Committee for further review and evaluation. In addition, MTA Audit Services follows-up with MTACC on the status of their prior audit recommendations. MTA Bus The Internal Studies & Operations Improvement Division utilizes an automated system to monitor the implementation of recommendations.

- 55 -

5. Summarize specific actions the agency has taken to install a compliance testing program. Describe actions taken during 2009-10 to verify test results and expand the testing program.

Metropolitan Transportation Authority Annual “Risk Assessments” were conducted by all departments where major business activities were risk ranked and controls over those risks identified. Cycle testing is used where all “high risk” items are reviewed annually and medium to low risk ranked items are reviewed on a cycle of once every three years to once every five years depending on rank level. The vulnerability risk assessment sheets from the prior year (2008 – 2009) were sent to all departments through their coordinators. The sheets were reviewed with them by the Internal Control Coordinator where modifications were discussed. The coordinators in many cases solicited employees in their department for suggestions and or met with the department management on updates to the assessments sheets. The HQ Internal Control Officer was involved in most of these discussions and reviews. Some assessments were added, some changed, and some deleted as major business activities change. As to items to be tested, each department with the assistance of the Internal Control coordinator and the Internal Control Officer determined what the standards will be for testing in their department. These standards must be consistent with the training and re-training which the coordinators received from the Internal Control Officer on testing. The Internal Control Officer assisted with many of the tests and in some cases due to department work loads, did the testing himself. Most test results were reviewed with department management. All test results were read by the Internal Control Officer. Items for which corrective actions were required were noted and monitored. If any substantive issues were found they were raised to the attention of senior management. New York City Transit NYCT has always incorporated compliance testing in conducting internal control reviews. NYCT developed “Departmental Guidelines for Evaluating and Reporting on Internal Control Systems” to provide instructions on how to conduct both vulnerability assessments and internal control reviews. Testing procedures conform to the NYS Division of the Budget Manager’s Guide. Training on testing has been provided to personnel directly involved in the review process. Internal Control Managers have been trained on test methods, identification of testing techniques, and retention of documentation to support such transaction testing. Testers, Activity Managers and Division Heads were trained in the various aspects of the internal control program. In addition, organizational charts were used to help identify unreported activities. These techniques have been communicated to those performing the actual testing of controls.

- 56 -

Long Island Rail Road The MCR Program is one of “self-assessment” and, as such, the responsibility lies with each department for verifying its testing methodology and test results. The continued importance of compliance testing is stressed during one-on-one sessions between the MOCAs and the DCAs. Additionally, compliance testing is stressed and examples are provided during periodic workshops. The MCR Program Handbook, which is available on the Intranet, also notes various control techniques that are used or can be used to manage risks. Metro-North Railroad Departmental Internal Control Administrators, Coordinators, and other managers conducting Internal Control Reviews have the New York State Managers Guide for testing activities. The Internal Control Program stresses the importance of the testing aspect in the ICR process, and a link to the NYS Testing Guide is included on the home page of the ICS. Reviewers are encouraged to focus on compliance testing to verify process activities. Testing is a portion of every Internal Control Review conducted. The review form summarizes the sampling process and the methods utilized. Testing is conducted by authorized personnel in each department and test results are summarized in the online ICS Test of Controls form. Reporting tools allow the ICO to view testing forms and results for each ICR. Back-up materials are kept on file by the Department and are subject to audit. Bridges and Tunnel All departments establish a detailed risk-based testing plan that closely links control testing frequency to the relative risk defined in each department's vulnerability assessment. This allows managers to better plan for and allocate resources for testing. Using this plan, each department establishes goals for testing with the ICO at the beginning of the year. Subsequent progress against those goals is reported monthly by the ICO to the President. The results of control testing by activity managers are reported to the ICO, after the respective DICC and Department Head have reviewed the tests and signed off on the document. These enhancements have continued to increase both the number and quality of internal control testing performed and reported on each year. Capital Construction Program areas and departments are required to establish a detailed risk-based testing plan that closely links control testing frequency to the relative risk defined in each area’s vulnerability assessment. This plan allows managers to allocate resources for testing. Using this plan, each area establishes goals for testing with the ICC/ICO. The results of testing are reported to the ICO. In some cases, the ICO performs the testing to further assure independence. Based on the results of the tests a corrective action implementation plan is proposed for the following certification period.

- 57 -

Projects currently managed by MTACC, with an estimated value of over $15 billion, are funded in part through the FTA and are therefore subject to additional scrutiny. Supplemental testing of project management controls for these projects are performed by an independent engineering firm(s) hired by the FTA. Their recommendations are incorporated into our testing program. MTA Bus The Internal Studies & Operations Improvement Division uses an automated system to track internal control corrective actions for LI Bus, NYC Transit Bus, and MTA Bus.

- 58 -

6. Describe measures instituted to sustain the effectiveness of the internal control program during 2009-10. Include information on reorganizations and other revisions in the program to enhance operations.

Metropolitan Transportation Authority MTAHQ conducted informal “open house” information sessions on Internal Controls in 2009. In addition, e-mail notices and other information were sent to employees several times during the year to maintain continuing awareness of the program. New York City Transit NYCT is continually exploring opportunities to enhance its implementation of the requirements of the Internal Control Act. In addition to an Internal Control Policy and internally developed Departmental Guidelines which have been distributed to all departments, NYCT has been an active participant with the MTA in developing and enhancing agency-wide guidelines on internal controls. The internal control program has been upgraded to include vulnerability based testing, listing of all high, medium and low risk activities, and a consolidation of several forms into one testing record. Training continues to be provided by the Office of the Controller through an annual training seminar and expanded training for all internal control personnel involved in the program during the current year. Individual sessions with Internal Control Managers and other individuals are conducted as requested. During 2009-2010 NYCT instituted a number of initiatives to sustain the effectiveness of the internal control program. The program was adapted to accommodate a number of departments/divisions that were reorganized or streamlined in order to more effectively deploy resources. Key activities in a number of areas were consolidated and tested to avoid duplication of effort. Additionally, organizational charts were utilized to ensure that all departments/divisions and activities were reported. Long Island Rail Road Effectiveness and efficiency continue to be the key focus of the MCR Program. MOCAs are asked to review controls within their departments to ensure that they are working as required as well as to determine whether they are the correct controls. In 2009, the LIRR conducted four training classes that are part of the Management Education Core Curriculum Program. In addition, one-on-one training was provided as needed. Long Island Bus During 2009, the Director Internal Studies & Operations Improvement was hired. The Director’s responsibilities include coordinating Internal Control activities and

- 59 -

monitoring the implementation status of audit recommendations. The Director also oversees the aforementioned automated processes. Metro-North Railroad There were two significant developments in the Internal Control Program at Metro-North in 2009-10. A new ICO was hired to replace the ICO who retired in the spring of 2009. The new ICO reports to the Chief of Staff of the President of Metro-North. This new reporting structure aligns the Internal Controls work and responsibility more closely with the Agency Head, and as a result, has raised the profile of the importance of internal controls at Metro-North. The second development was the transition of all remaining departments at Metro-North onto using the online ICS. Over the past two years, some departments completed their reviews using the online ICS, while others completed them using the old manual paper process. For this year and going forward, all Internal Control work will be managed through the online ICS. With regards to Metro-North’s efforts to support a good internal control system, the new ICO’s organizational title is Deputy Director, Corporate Compliance and Strategic Development. The scope of his duties includes serving as Metro-North’s Audit liaison to ensure the linking of audit recommendations and Internal Controls. He is also directly involved in various organizational process review and improvement efforts which support and reinforce the Internal Controls program. Bridges and Tunnel MTA B&T recently implemented, on its Intranet site, a section dedicated to the B&T Internal Control Program. This section includes an Intranet based training program for employees to obtain, on-line, basic awareness of internal control concepts. It also contains B&T and MTA All-Agency Policies, internal control related forms, and other information on the Internal Control Act and internal control standards and techniques. In 2009, a more detailed classroom-based course on implementing the B&T Internal Control Program and compliance with the Internal Control Act was provided to selected managers. In 2010, this course will be offered to a wider range of employees who have specific control responsibilities. In 2010 the effectiveness of departmental compliance with the B&T Internal Control Program will be further reviewed, including evaluations of the adequacy of vulnerability assessments and quality of internal control testing performed. Capital Construction MTACC capital project and program management activities are performed in accordance with uniform methods, standards, procedures and guidelines (established by NYCT Capital Program Management and MTA Headquarters), to assure that project management activities are performed efficiently and in a manner that best serves the interests of the Agency.

- 60 -

MTACC is in the process of formally preparing its own Manual of Operations; updating and revising forms and procedures where necessary. Since the last certification, 21 Agency Policies were issued and 19 are awaiting final approval. Eighteen Quality and Safety Procedures were issued and 14 are awaiting final approval. MTA Bus During 2009, the Director Internal Studies & Operations Improvement was hired. The Director’s responsibilities include coordinating Internal Control activities and monitoring the implementation status of audit recommendations. The Director also oversees the aforementioned automated processes.

- 61 -

7. Describe efforts agency/authority management has taken to

coordinate and integrate the documentation and reporting of activities the Office of the State Comptroller’s Standards for Internal Controls in New York State Government recognize as supporting a good internal control system: evaluation, strategic planning and internal audit.

Metropolitan Transportation Authority Communication to employees on the program was done by e-mail and “open houses” several times during the year. Copies of all the vulnerability assessments are made available to both internal and external auditors to aid them in determining matters to audit. MTAHQ has an ongoing Ethics/Compliance Training program that covers employees at various levels. This program is conducted with assistance of a representative from the MTA Inspector General’s Office and a representative from the NYC Commission on Public Integrity. This program along with ongoing communication by posters and similar help to reinforce the importance of ethical values and integrity. Also, in the last quarter of 2009, we ran a series of American Recovery and Reinvestment Act Fraud Awareness Training sessions. These sessions were conducted with assistance from the MTA Office of the Inspector General, U.S. Department of Transportation Inspector General and the United States Department of Justice. New York City Transit NYCT has been proactive in coordinating and integrating the requirements of the State Comptroller’s Standards for Internal Controls in New York State Government that support a good internal control system. This is reflected by the fact that the updated Policy/Instruction (P/I) on Internal Control Policy cites the Office of the State Comptroller as a major source of the information contained therein. The P/I refers to, and in some cases incorporates excerpts from, the standards that are enumerated in the State Controller’s guidance. These references include, but are not limited to, the definition and purpose of internal control, the specific techniques that provide the greatest assurance of a strong system of control and the five components of an internal control program. The P/I also contains instruction regarding the ongoing evaluation of activities, risks and controls and the periodic testing of controls to ensure that they are functioning as intended; strategic planning to focus on the long range goals of the organization in an effort to achieve its mission; and the role of the Internal Audit function to perform independent reviews of the internal control function to assess the effectiveness of the program and recommend changes if necessary. This information has been widely distributed throughout the organization and has become a part of the annual training effort. By recognizing and incorporating

- 62 -

these important concepts from the Standards for Internal Controls in New York State, NYCT has enhanced the quality and effectiveness of its internal control program. Long Island Rail Road The DCAs have been working very closely with the MOCAs to ensure that key business activities are reviewed. The continued involvement of the DCAs has been key in the success and effectiveness of the MCR Program. This involvement has allowed departments to critically review their activities and associated controls and make the necessary changes to ensure that effective and efficient controls are in place. To further enhance the efficiency and effectiveness of the MCR Program, during 2009, under the direction of the ICO, the Re-engineering & Internal Controls Department coordinates and monitors audits performed by MTA Audit Services, MTA Inspector General and New York State Comptroller. Long Island Bus The Internal Control program is coordinated by the Internal Studies & Operations Improvement Division to ensure consistency and the use of best practices throughout the MTA’s bus operations. This division also is responsible for coordinating external audits of the bus operations. Accordingly, findings and recommendations made during these audits are integrated into the Internal Control program and effectively shared throughout the bus operations. Metro-North Railroad An annual memo from the President to all current employees stresses Metro-North’s commitment to Internal Controls and the importance of complying with the Internal Control Act. All new employees receive this memo with their orientation packets. The Internal Control Officer conducts one-on-one and group training activities and acts as a resource to managers on internal control program issues. The ICO works with Department Heads, Internal Control Administrators, Coordinators, and managers to continually improve departmental compliance and educate employees about Internal Controls. Metro-North’s Weekly News (Metro-North’s weekly newsletter/e-newsletter) is utilized for Internal Control messages and alerts regarding deadlines for managers for Internal Control submissions. E-mail is also utilized to contact Department Heads, Departmental Internal Control Administrators and Coordinators regarding program deadlines, schedules and requirements. Metro-North’s Corporate Policy 10-008, Internal Controls, is also posted on the Intranet along with all corporate policies and procedures. Periodically, the ICO contacts and meets with Departmental Internal Control Administrators and Coordinators to review program status and provide additional program information and deadlines for departmental reporting. Bridges and Tunnel The MTA Chief Compliance Officer disseminates information related to activities of the Office of the State Comptroller with respect to internal controls at the

- 63 -

quarterly ICO meetings. Information regarding any significant changes is then provided to applicable staff at all levels. Capital Construction The Standards for Internal Controls in New York State Government is the source for our training on internal controls. The training program also refers to applicable provisions of the Public Officers Law, including rules on ethics and conflicts of interests. Included in the training materials is the Managers Guide for testing compliance with internal control requirements. Where applicable, MTACC incorporates recommendations made by the New York State Internal Control Task Force report. MTA Bus The Internal Control program is coordinated by the Internal Studies & Operations Improvement Division to ensure consistency and the use of best practices throughout the MTA’s bus operations. This division also is responsible for coordinating external audits of the bus operations. Accordingly, findings and recommendations made during these audits are integrated into the Internal Control program and effectively shared throughout the bus operations.

- 64 -

8. Describe efforts agency/authority management has taken to effectively communicate information within the organization. Information should be communicated to management and other employees who need it in a form and within a time frame that helps them to carry out their responsibilities. Communication is not an isolated internal control component. It affects every aspect of an organization’s operations and helps support its system of internal control. The feedback from this communication network can help management evaluate how well the various components of the system of internal control are working.

Metropolitan Transportation Authority MTAHQ has an ongoing electronic newsletter for all its employees that are released on a periodic basis. MTA’s Chief Compliance Officer sends out numerous reminders throughout the year regarding compliance and ethics issues. Employees also receive a yearly reminder regarding key MTAHQ policies. Senior Management also periodically sends out e-mails to employees on key issues. All MTA Committee Meetings and Board Meetings are made available to employees through a Web Broadcast and are also archived, enabling employees to review the sessions at a later time. New York City Transit NYCT has developed a multi-faceted approach to effectively communicate information within the organization. Formal memoranda from top management are distributed through a number of media channels to apprise staff of important issues and changes that will be taking place. The specific means of communication includes distribution with paychecks, mass e-mail, posting on the intranet and interoffice mail. These methods are also used to distribute policies, procedures, directives and brochures that deal with a variety of topics. Formal meetings and training seminars are convened to provide guidance, instruction and feedback on specific topics of interest. There are also financial and management reports that provide insight into the results of operations and audit reports that indicate the organization’s compliance with the applicable laws, rules, regulation, policies and procedures that govern the numerous activities that are undertaken by NYCT. When taken together, these methods of communication provide NYCT with an effective network that ensures that information is conveyed in a timely manner to all of those involved in the process. Long Island Rail Road Communication and the dissemination of information at the Agency is bi-directional: from Senior Staff to the rank and file and from the rank and file to Senior Staff. Employee awareness of the Internal Control Program is maintained

- 65 -

through the Management Education Core Curriculum Program, one-on-one new MOCA training, and the mailing of a letter under the President’s signature entitled “Management Controls at the LIRR.” In addition, Re-Engineering and Internal Controls sends reminders to the MOCAs as deadlines approach to review and submit their VA’s. During the 3rd Quarter 2009, a pamphlet, stressing the adherence to the Internal Control Act, was updated and distributed to all employees. Long Island Bus The Internal Control program has been communicated to senior management of the MTA’s bus operations as a priority. Policies and procedures are disseminated throughout the organization. Additionally, NYC Transit, LI Bus, and MTA Bus Internal Control liaisons and depot managers received Internal Control training. Metro-North Railroad An annual memo from the President to all current employees stresses Metro-North’s commitment to Internal Controls and the importance of complying with the Internal Control Act. All new employees receive this memo with their orientation packets. The Internal Control Officer conducts one-on-one and group training activities and acts as a resource to managers on internal control program issues. The ICO works with Department Heads, Internal Control Administrators, Coordinators, and managers to continuously improve departmental compliance and educate employees about Internal Controls. Metro-North’s Weekly News (Metro-North’s weekly newsletter/e-newsletter) is utilized for Internal Control messages and alerts regarding deadlines for managers for Internal Control submissions. E-mail is also utilized to contact Department Heads, Departmental Internal Control Administrators and Coordinators, regarding program deadlines, schedules and requirements. Metro-North’s Corporate Policy 10-008, Internal Controls, is also posted on the Intranet along with all corporate policies and procedures. Periodically, the ICO contacts and meets with Departmental Internal Control Administrators and Coordinators to review program status and provide additional program information and deadlines for departmental reporting. Bridges and Tunnel An annual letter from the President is sent to all employees to reaffirm B&T’s internal control policy and to reemphasize the importance to the Agency of effective internal controls. An annual internal control training course was provided to selected managers in November 2009 to allow them to attain a more comprehensive understanding of internal control concepts. On a quarterly basis, the ICO also meets with all DICCs to alert them of any new developments in internal controls. Capital Construction

- 66 -

Information is communicated (for all projects) between and among all levels at MTACC to help the organization achieve its objectives in areas such as project management, quality assurance, financial reporting and compliance. MTACC operations are monitored in two ways: through ongoing or continuous monitoring of activities and through regular evaluations. The information received as a result of this monitoring process is communicated to appropriate management. The ongoing or continuous evaluations are performed by the respective Program Managers, Project Managers, Design / Construction Manager, Construction Coordinators, Field Engineers and field personnel at site locations. These individuals are responsible for verifying and documenting that the contractor is completing the project according to contract specifications. For example, production meetings are scheduled on a regular basis to discuss items such as drawings, materials, fabrication, acceptance testing and other issues relating to the production schedules. More specifically, weekly staff meetings are held with all direct reports and bi-weekly meetings are held with all Project Management Teams. On a monthly basis MTACC reports to the MTA Board of Directors at their Capital Program Oversight Committee and Finance Committee meeting. On a bi-monthly basis a project status meeting is held with the MTA/MTACC Security Team. There is also a quarterly oversight meeting with the FTA. Other meetings are scheduled as needed. MTA Bus The Internal Control program has been communicated to senior management of the MTA’s bus operations as a priority. Policies and procedures are disseminated throughout the organization. Additionally, NYC Transit, LI Bus, and MTA Bus Internal Control liaisons and depot managers received Internal Control training.

- 67 -

C. Make available to each officer and employee of the agency or authority a clear and concise statement of the generally applicable management policies and standards with which the officer or employee of such agency or authority shall be expected to comply along with detailed policies and procedures the employees are expected to adhere to in completing their work. The statement should set the tone at the top. It should be issued periodically and emphasize the importance of effective internal controls to the agency or authority and the responsibility of each officer and employee for effective internal controls. Managerial policies and procedures for the performance of specific functions are articulated in administrative manuals, employee handbooks, job descriptions and applicable policy and procedure manuals. While it is not necessary for all employees to possess all manuals, employees should be provided with, or have access to, applicable policies and procedures for their position.

For this requirement, the agency/authority is:

Fully Compliant Partially Compliant Not Compliant Provide a thorough explanation of the specific actions your agency has taken, or are needed, to comply with this requirement. Metropolitan Transportation Authority The MTA Policies and Procedures Manual is available on the MTA Intranet site for employee to access easily. In addition, The MTA Code of Ethics is also on the MTA’s Intranet and the internet sites. An annual memorandum from the MTA’s Chief Compliance Officer to all MTAHQ employees communicates the importance of Internal Controls at MTAHQ. New York City Transit The Officers, Managers and Employees of NYCT are frequently notified of the policies and standards with which they are expected to comply. The President and Senior Management issue bulletins and other correspondence that provide clear instructions and guidance on a variety of topics. These high level publications are provided to employees as reminders of existing policies or as instruction on new activities and initiatives. They contain general information in the areas of operations, administration, finance and internal controls. NYCT stresses the theme that internal control is everyone’s business. This principle is the focal point of the NYCT brochure and Presidential memos on internal controls, which are distributed to all employees on a regular basis. By incorporating internal control into every task that is performed, NYCT is creating an environment that provides reasonable assurance that its resources are protected against fraud, waste and mismanagement and that its activities are performed in an effective and efficient manner. In addition to the general guidance provided by management, NYCT maintains policies, procedures,

- 68 -

handbooks and management directives for all major activities. These manuals are available in hard copy or online. They are reviewed, updated and distributed to the appropriate areas of responsibility on a regular basis. Long Island Rail Road

To comply with the requirement of the New York State Governmental Accountability, Audit and Internal Control Act of 1999 (the Act), the LIRR has developed and made available to all employees, via the Intranet, Corporate Policy & Procedure No.RIC-003 This policy and procedure emphasizes the importance of internal controls and the responsibility of all employees to ensure that effective controls are maintained in the performance of their daily activities. Furthermore, a letter under the President’s signature and pamphlet titled “Management Control Responsibility at the LIRR” is published and distributed to both management and union employees. Within the letter and pamphlet, the President strongly emphasizes the key role of the ICO and the importance of employee compliance with the Act. In addition, the MCR handbook is available to all employees that have access to the Intranet. For employees that do not have access the Intranet, a physical copy of the handbook is available within their department or can be obtained by contacting the Re-engineering and Internal Controls Department.

At the department level, standards operating procedures and corporate policies are developed and made available to staff, as applicable. A process is also in place to ensure that policies and procedures are reviewed to ensure that they are updated. In 2009, twenty-three corporate policies were reviewed for adequacy, and reformatted as appropriate. In addition, three new corporate policies were developed. Most of the departments at LIRR, particularly HR, have not only developed policies for new processes, but also have updated internal policies based on new business processes or the implementation of new systems. HR-maintained supplemental documentation which further supports internal control efforts, include organization charts and job descriptions. Job descriptions of management personnel who are directly involved in administration the MCR Program are noted accordingly. Long Island Bus The Internal Control program has been expressed as a priority to senior management of the MTA’s bus operations. Training was provided to Internal Control coordinators. Additionally, policies and procedures that include essential internal controls are disseminated throughout the organization.

- 69 -

Metro-North Rail Road

An annual memo from the President to all Metro-North employees communicates the importance of Internal Controls at Metro-North. The memo refers employees to Metro-North’s Corporate Policy 10-008, internal controls, which is posted on the Intranet along with all corporate policies and procedures. The Policy clarifies responsibilities and describes the Internal Controls process at Metro-North.

In addition to specific guidance, manuals and procedures provided to managers and employees in their respective Departments at Metro-North, all Metro-North employees are expected to be familiar with and adhere to the MTA All-Agency Code of Ethics. New York City Transit

The Officers, Managers and Employees of NYCT are frequently notified of the policies and standards with which they are expected to comply. The President and Senior Management issue bulletins and other correspondence that provide clear instructions and guidance on a variety of topics. These high level publications are provided to employees as reminders of existing policies or as instruction on new activities and initiatives. They contain general information in the areas of operations, administration, finance and internal controls. NYCT stresses the theme that internal control is everyone’s business. This principle is the focal point of the NYCT brochure and Presidential memos on internal controls, which are distributed to all employees on a regular basis. By incorporating internal control into every task that is performed, NYCT is creating an environment that provides reasonable assurance that its resources are protected against fraud, waste and mismanagement and that its activities are performed in an effective and efficient manner. In addition, to the general guidance provided by management, NYCT maintains policies, procedures, handbooks and management directives for all major activities. These manuals are available in hard copy or online. They are reviewed updated and distributed to the appropriate areas of responsibility on a regular basis. Bridges and Tunnel An annual letter from the President is sent to all employees to reaffirm B&T’s policy in compliance with the New York State Governmental Accountability, Audit and Internal Control Act. It reemphasizes the importance of effective internal controls to the Agency and the responsibility of each employee for the maintenance of effective internal controls. Attached to the President’s letter is an internally generated brochure “Internal Controls and You,” which defines what internal controls are, what is required by the Internal Control Act, how the Internal Control Act is carried out at B&T and employees’ responsibilities for internal controls. It also gives an updated listing, by department, of the Departmental Internal Control Coordinators as well as their telephone numbers. Capital Construction

- 70 -

MTACC conducts its business primarily by reference to written policies, such as MTACC’s plan of organization, the formal delegation of responsibilities, and program area procedures. Copies of MTACC’s policies are maintained within each program area or department. Employee conduct is governed by the MTA All-Agency policies including the Code of Ethics, applicable provisions of the Public Officers Law including rules on ethics and conflicts of interests. A copy of the MTA-All Agency Code of Ethics and the Public Officers Law is provided to all employees at the time of their employment. All new hires also receive a copy of a letter from the President] stressing the importance of internal controls and a pamphlet emphasizing everyone’s responsibility for internal controls. MTA Bus

The Internal Control program has been expressed as a priority to senior management of the MTA’s bus operations. Training was provided to Internal Control coordinators. Additionally, policies and procedures that include essential internal controls are disseminated throughout the organization.

- 71 -

D. Designate an Internal Control Officer (ICO), who shall report to the head of the agency or authority or to their designee within the executive office, to implement and review the internal control responsibilities established pursuant to this Item. The designation of the ICO should be communicated to all employees.

The ICO works with appropriate personnel within the agency or authority to coordinate the internal control activities and to help ensure that the internal control program meets the requirements established by BPRM Item B-350. Although the ICO evaluates the adequacy of the internal control reviews performed by agency or authority staff, program and line managers are primarily responsible for conducting reviews to assure adherence to controls and analyzing and improving control systems. The ICO should be an individual with sufficient authority to act on behalf of the agency head in implementing and reviewing the agency’s internal control program. This individual should have a broad knowledge of agency operations, personnel and policy objectives.


Fully Compliant Partially Compliant Not Compliant Provide a thorough explanation of the specific actions your agency has taken, or are needed, to comply with this requirement. Pursuant to Public Authorities Law Section 2931, the MTA Board designed its Chief Compliance Officer as the MTA’s Internal Control Officer (“ICO”) with responsibilities for overseeing MTA’s Corporate Compliance efforts, which include corporate governance, internal controls, ethics and compliance. The MTA’s Chief Compliance Officer is a direct report to the MTA General Counsel. He also is responsible for reporting on ethics and internal controls to MTA’s Chairman and the MTA Board. Pursuant to the Audit Committee’s Charter the Chief Compliance Officer has an affirmative reporting obligation to the MTA Board on the internal control programs through the Audit Committee. The Chief Compliance Officer has several years of experience in the area of finance and financial institution regulation. Before coming to the MTA, he spent 10 years at the United States Securities and Exchange Commission and 6 years with the New York City Department of Finance. Metropolitan Transportation Authority The MTAHQ Internal Control Officer has over 35 years experience in Human Resources of which 18 were with the MTA in Compensation. Most of the jobs descriptions in HQ were written and evaluated by this individual. Thus, the scope of HQ operations and the history of various departments are well known to the Internal Control Officer. Additionally, the incumbent holds two advance degrees, a MBA in Organizational Development and a Post Masters Certificate in Marketing.

- 72 -

The ICO works with appropriate personnel within authority to coordinate the internal control activities and to help ensure that the internal control program meets the requirements established by BPRM Item B-350. Although the ICO evaluates the adequacy of the internal control reviews performed by Agency or authority staff, program and line managers are primarily responsible for conducting reviews to assure adherence to controls and analyzing and improving control systems. The ICO is an individual with sufficient authority to act on behalf of the Agency head in implementing and reviewing the agency’s internal control program. As previously stated, he has a broad knowledge of agency operations, personnel and policy objectives. New York City Transit The President has designated an Internal Control Officer (ICO) to implement, oversee and review the internal control program and its responsibilities within NYCT. The ICO reports to the Executive Vice President while interfacing with the President, Senior Management, MTA Headquarters, and New York State on the status and progress of the program. Additionally, the ICO prepares NYCT’s annual Internal Control Summary and Certification for the MTA and State and keeps the departments and divisions apprised of their responsibility to comply with the P/I and the provisions of the Internal Control Act. Another important function is to ensure that management and staff receive the appropriate level of IC training and the information necessary to execute the requirements of the IC program. NYCT’s ICO is the Controller, a Certified Public Accountant, who presides over all accounting and financial matters within the organization. As such, he is well versed in all aspects of internal control relating to operations and administration due to the high level of interaction with Senior Management in NYCT, the MTA, and state and local government. The ICO is assisted by an Internal Control Coordinator (ICC) and other members of staff within the Office of the Controller, who manage the day to day implementation of the IC program. These functions include providing training to internal control personnel on an annual basis, reviewing and commenting on the quality of items that are submitted, providing feedback to the Department/Division Heads in cases of significant non-compliance with the Act and receiving, reviewing, interpreting and distributing all correspondence from the MTA and the State. The appointment of the ICO was communicated to all employees via the Internal Control Brochure and to internal control personnel during training sessions. Long Island Rail Road Under the delegating powers of the President, the ICO is the person ultimately responsible for the administration of the Internal Control Program. At the LIRR, the ICO is the Vice President & Chief Financial Officer and reports directly to the President. Under his direct leadership the DCAs administer the program in conjunction with the MOCAs. Since 2008 the ICO has tasked the Re-engineering and Internal Controls department with the coordinating and monitoring of audits performed by MTA Audit Services, the MTA Inspector

- 73 -

General, the New York State Controller, as well as other external audits. The objective is to link audit findings with business activities and compare those findings to the control testing performed at the department level. In addition, the ICO has further strengthened the linkage between Corporate Policies & Procedures with control assessment and testing. The objective is to ensure that business activities are governed by policy and procedure thus providing congruence with the control technique of documentation and recordkeeping. Finally, the ICO provides periodic updates to fellow Senior Staff members on the status of the MCR program and reinforces the need for their continued support of the program. Long Island Bus and MTA Bus The Chief Officer, Internal Studies & Operations Improvement, is designated as the Internal Control Officer (ICO) for LI Bus and MTA Bus. Audit findings and recommendations are integrated into the Internal Control program as required across the operations. Metro-North Railroad Metro-North’s new Internal Control Officer reports directly to the Chief of Staff of the President of Metro-North. He has been working with and for large public sector transportation agencies in the areas of planning, policy, management and operations for the past 10 years and holds a Masters of Urban Planning from New York University. An annual memo from the President to all employees communicates who the ICO is and reinforces the importance of and responsibility for Internal Controls at Metro-North. The ICO administers the Internal Control Program and monitors compliance with the program. The ICO works with Department Heads, Internal Control Administrators, Coordinators, and managers, to continuously improve departmental compliance and educate all employees about internal controls. Bridges and Tunnel The B&T Internal Control Officer was appointed by the President to administer and assure implementation of the B&T Internal Control Program. The ICO, working with MTA Audit Services and the Independent Auditors, directs and continually evaluates and assesses B&T’s system of internal controls. Together, they help B&T management maintain B&T’s system of controls in a complete and current condition and ensure that all employees are adequately trained in the requirements of their jobs and the principles of internal control. The ICO is also supported by Departmental Internal Control Coordinators within various B&T departments who provide additional administration of the B&T Internal Control Program. B&T’s Internal Control Officer (ICO) reports to the President through the organization’s Chief Financial Officer. The ICO, with the assistance of the Internal Control Coordinators, directs and continually evaluates and accesses

- 74 -

B&T’s system of internal control. Oversight for the Program is provided by MTA’s Chief Compliance Officer. The Internal Control Officer annually sends a memorandum to all employees reaffirming the organizations policy on internal control and requesting their cooperation with B&T’s ICO. Attached to this memo is a pamphlet on internal controls entitled Internal Controls and You. The objective of the pamphlet is to provide employees with a basic understanding of internal controls and demonstrate how controls help the agency meet its operational goals. This pamphlet also lists the name and phone number of the appropriate Internal Control Coordinator to be contacted if additional information is needed. B&T’s ICO is a CPA and has a Masters Degree in Accounting. He has more than 16 years of experience with the MTA in areas such as auditing, finance, operational performance and information systems. Previously he was the ICO at MTA Headquarters and an Audit Manager in MTA’s Audit Department. Capital Construction MTACC’s Internal Control Officer (ICO) reports to the Agency’s President through the organization’s Chief Financial Officer. The ICO, with the assistance of MTACC’s Internal Control Coordinators, directs and continually evaluates and accessed MTACC’s system of internal control. Oversight for the Program is provided by MTA’s Chief Compliance Officer. On an annual basis MTACC’s President sends a memorandum to all employees reaffirming the organizations policy on internal control and requesting their cooperation with MTACC’s ICO. Attached to this memo is a pamphlet on internal controls entitled Internal Controls and You. The objective of the pamphlet is to provide employees with a basic understanding of internal controls and demonstrate how controls help meet operational goals. This pamphlet also lists the name and phone number of the appropriate Internal Control Coordinator to be contacted if additional information is needed. MTACC’s ICO is a CPA and has a masters degree in accounting. He has more than 16 years of experience with the MTA in areas such as auditing, finance, operational performance and information systems. Previously he was the ICO at MTA Headquarters and an Audit Manager in MTA’s Audit Department.

- 75 -

E. Implement education and training efforts to ensure that officers and employees have achieved adequate awareness and understanding of internal control standards and, as appropriate, evaluation techniques.

Agencies and authorities should identify staff requiring internal control training and the depth and content of that training. Such education and training should be on-going with specific courses directed at line staff, middle managers and executive management. For organizations that have established internal audit functions, training and education should be offered on the appropriate role of the internal auditor within the organization’s internal control system.


Fully Compliant Partially Compliant Not Compliant Provide a thorough explanation of the specific actions your agency has taken, or are needed, to comply with this requirement. Metropolitan Transportation Authority The MTA provided over 330 employees with internal control training relating to ARRA. In addition, MTA held over 20 ethics/compliance training sessions covering over 1,000 employees. All Coordinators have yearly training on Internal Controls and their role in the program. Employees were given information on the program via e-mails, and “open house” information sessions. New York City Transit Education and training regarding internal control is provided to all departmental personnel that are involved in the internal control process. The Office of the Controller conducts an annual training seminar for Internal Control Managers and their support staff that provides a general framework of the internal control process and detailed instructions on the various components of which it is comprised. Information is provided on the identification and listing of major activities, the assessment of risk for each activity via the vulnerability assessment, the development of controls to counteract the risks, the testing of controls on a regular basis, reporting weaknesses found, and implementation of corrective actions to eliminate the weaknesses. In addition, all IC Testers, Activity Managers and Division/Subdivision Heads receive comprehensive training each year. The additional training is in conjunction with the recommendation from the Internal Control Task Force requiring employees to be grouped and trained by tier. It also ensures that NYCT is in compliance with this important aspect of the Act. Throughout the year, individual department personnel are trained in closed group sessions.

- 76 -

The format utilized by the Office of the Controller is based on the COSO model and the five basic components of internal control that it stresses: control environment, risk assessment, control activities, information and communication, and monitoring. In support of the training effort, a guide was developed to interpret and clarify the tenets of the COSO model and present a detailed step-by-step description of the IC process. To further assist in the process, there is a continuous dialogue as the process is undertaken to ensure a high level of understanding of the Internal Control program. Internal control education is achieved through letters and other correspondence from the President, Senior Management and the ICO’s Office that are distributed to NYCT employees to emphasize the requirements of the Act. An Internal Control Brochure, detailing NYCT’s commitment to the Internal Control Program, was placed on the TENS website and is available for viewing by employees. The following correspondence was either posted on the NYCT Intranet or distributed to employees directly in an effort to heighten awareness on these internal control related subjects: • Equal Employment Opportunity Policy • Respect for Fellow Employees • Workplace Violence • Sexual and Other Discriminatory Harassment • Respectful Workplace Policy • Track Safety Procedures

Long Island Rail Road The Re-Engineering & Internal Controls department, under the supervision of the ICO, provided the following to promote Internal Control Education and foster Management Control Awareness at the LIRR: In 2009 the LlRR conducted four “Business Administration & Processes” classes that are part of the Management Education Core Curriculum Program. The classes include a two-hour session on “Management Control Review Program & Managing Internal Controls.” In addition, as part of orientation, all new employees are provided with information on internal controls and its importance at the LIRR and are required to take a Management Control Review class. Employees are also encouraged to reach out to their MOCAs and/or DCAs with any question or concerns. Throughout the year, the importance of effective and efficient controls is stressed. On an as needed basis, the DCAs meet with the MOCAs to review, clarify and help with the completion of control evaluations or with updating of the Vulnerability Assessment form when there are any changes in the procedures or processes.

- 77 -

A letter and pamphlet from the President stressing adherence to the Act, the role of the ICO and employee internal control responsibilities was updated and distributed to all employees in the 3rd Quarter 2009. A Management Control Review handbook is made available to management and published on the Intranet. This handbook provides managers with the guidance and tools needed to perform their internal control responsibilities under the MCR Program. Additionally, during 2010 with the implementation of the new Governance, Risk & Compliance software, the Re-Engineering & Internal Controls Department together with the individual department, plan to review and update risk assessment and the controls associated with the activities. The LIRR does not have its own internal audit function. There is a centralized audit services at the MTA which provides services to all the MTA agencies. Long Island Bus The Internal Control program has been expressed as a priority to senior management of the MTA’s bus operations. Training was provided to Internal Control coordinators. Additionally, policies and procedures that include essential internal controls are disseminated throughout the organization. Metro-North Rail Road The new ICO worked with MTA Headquarters to provide a general Internal Controls Training session open to all employees. The ICO also held numerous “drop-in” help sessions to assist staff working on their Internal Control Reviews through the ICS. These sessions provided one-on-one and group assistance with all aspects of the internal control process. In addition, the ICO provided one-on-one and group assistance as requested and needed by Department Administrators, Coordinators and Reviewers. Special training sessions were provided to Maintenance of Equipment Department personnel as they transitioned from the manual process to the online ICS process this year. Metro-North also utilizes an online Internal Control Awareness Training Program available on Metro-North’s Intranet. The program is available to all employees with Intranet access at all Metro-North facilities, and many employees have taken the on-line course. A database of “attendees” is maintained by IT and provided to the ICO upon request. Additional Internal Control informational material is contained on the electronic Internal Control System (ICS) home page. All Departmental Administrators and Coordinators, as well as authorized reviewers and initiators, have access to the system. The home page includes links to the ICS Training Manual, the Internal Control Handbook, and the NYS Manager’s Guide for Testing. Bridges and Tunnels

- 78 -

All employees receive exposure to B&T’s and MTA’s All-Agency policies on the Intranet. Copies of the Authority’s internal control awareness brochure Internal Controls and You is distributed to employees periodically at ethics training sessions and other Agency forums. An Intranet-based, interactive internal control awareness course was implemented and is updated annually when necessary. This tool serves as an additional vehicle for a broad range of employees to receive basic training in internal control concepts. A more detailed updated classroom-based training program, with specific instructions on implementation of the Internal Control Program and compliance with the Internal Control Act, was provided to selected managers in November 2009. The ICO also meets with all DICCs on a quarterly basis to review progress towards implementing various Internal Control Program initiatives and provides them with additional control information, and reviews ways to improve the Internal Control Program. Capital Construction To make certain that the agency’s officers and employees continue to maintain a satisfactory awareness and understanding of internal control standards, an Internal Control Training & Educational Program has been established. The Program is as follows. As previously mentioned, a memorandum from the Agency President stressing the importance of having an effective and efficient Internal Control Program. including management’s responsibility for ensuring effective Management Control Reviews and the Agency’s obligation to comply with the requirements of the New York State Governmental Accountability, Audit and Internal Control Act was sent to all employees on January 19, 2010. Attached to this memorandum is a pamphlet entitled Internal Controls and You. The objective of the pamphlet is to provide employees with a basic understanding of internal controls and demonstrate how controls help MTACC meet its operational goals. Numerous one-on-one training and information sessions were provided by the ICO to our ICC’s during the certification period. In addition, 15 employees, consisting predominately of new hires, completed MTACC’s required two and a half hour course on Internal Controls. The source of this course is Standards for Internal Control in New York State Government.

- 79 -

MTA Bus

The Internal Control program has been expressed as a priority to senior management of the MTA’s bus operations. Training was provided to Internal Control coordinators. Additionally, policies and procedures that include essential internal controls are disseminated throughout the organization.

- 80 -

F. Periodically evaluate the need for an internal audit (IA) function. If an IA function exists, it should be maintained in compliance with generally accepted professional auditing standards. Agencies on the Division of the Budget’s list of agencies required to establish IA functions – and those choosing to have an IA function – are required to comply with The Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing (see BPRM Item B-350 Section III “IA Responsibilities”).

As outlined in BPRM Item B-350, agencies and authorities are required to periodically evaluate the need to establish, maintain or modify an IA function utilizing the Internal Audit Evaluation Criteria (Attachment C). Agencies concluding that an IA function is warranted should submit their evaluation to DOB as outlined in BPRM Item B-350. Periodically thereafter, agencies with IA functions should review current operations to determine whether the function should be altered or maintained. Agencies concluding an IA function is not warranted should periodically reevaluate the need for such a function using Attachment C, especially when organizational, operating, fiscal, program, legal or personnel changes occur which affect the Agency’s exposure to risk or which could otherwise change the results of the initial assessment. Pursuant to BPRM Item B-350, agencies required to have – and those entities choosing to have – an internal audit unit should comply with The Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing. Therefore, IA units should comply with the guidance outlined below regarding organizational placement, independence and reporting.

1. Directors of Internal Audit (DIA) should report functionally to the Agency head

or audit committee and may report administratively to the designated executive deputy (or equivalent position). If the executive deputy has line or staff duties, the DIA should report directly to the Agency head.

2. A current organizational chart should be available that identifies the

placement of the IA unit, the individual that has responsibility for overseeing the internal audit activity and other organizations/activities under its purview.

3. The IA function should be independent of the ICO, but should work closely

with the ICO. Limitations should be established on IC activities where those duties overlap. Agencies should identify impairments to the independence of the DIA that may be created where the DIA is performing the ICO function. Furthermore, IA units should not assume operating responsibilities, perform management functions, make management decisions or assume other monitoring roles (e.g., Information Security Officer).

4. Internal audit staff should complete an annual independence statement

identifying actual/potential impairments to independence and notifying the DIA whenever a new actual/potential impairment arises.

- 81 -

5. At a minimum, DIAs should hold quarterly meetings with agency executive management and the audit committee, where applicable, to report on audit results. Final reports should be distributed to the Agency head, executive deputy, auditee, ICO and the audit committee.

6. The DIA should assure that agency audit staff have the skills, knowledge and

ability to perform the audit work required and that the size of the audit staff is appropriate given the size and complexity of the organization.

7. IA units should take steps to ensure sufficient audit resources are available

given the size and complexity of the organization. This can be accomplished by exploring in-sourcing, outsourcing and sharing audit services.

For this requirement, the agency/authority is: Not Applicable – This agency/authority does not have an IA function.

Fully Compliant Partially Compliant Not Compliant Provide a thorough explanation of the specific actions your agency has taken, or are needed, to comply with this requirement by providing the following information:

1. A current organizational chart identifying the placement of the IA unit, the

name and title of the IA director, other organizations/activities under the IA function’s purview and the name and title of the person to whom the IA director reports.

2. A description of how the internal audit director’s credentials, education and experience meets the minimum qualifications established in BPRM Item B-350.

3. A description of how continuing professional education requirements are

met by the director and each staff member.

4. A description of how quality assurance review requirements are being met.

5. A description of how the IA function ensures that it does not compromise

its independence if it is also responsible for other functions (i.e., internal control, information security or other duties).

6. A copy of your 2009-10 and 2010-11 internal and contract audit plans.

(Please note: Dennis Whalen’s memo of April 1, 2009 called on internal audit units to include the impact of Federal American Recovery and Reinvestment Act (ARRA) funding in their risk assessment and audit planning. If your agency is receiving ARRA funds, please be sure that your 2010-11 internal audit plan addresses this issue.)

- 82 -

7. Documentation pertaining to the risk-assessment utilized in formulating the 2010-11 audit plans.

8. An indication of which audits in the audit plan for FY 2009-10 were not

conducted, and an explanation as to why they were not conducted.

9. An estimate of the cost savings to be achieved by virtue of implementing the recommendations contained in each conducted audit described in the FY 2009-10 audit plans and any audits that were conducted during that time period that were not in the audit plan. If it is not feasible to provide a cost estimate for savings, please identify process improvements, risk mitigation, fraud prevention or cost avoidance measures that result from implementation of such recommendations.

10. Identify the recommendations contained in the audits described in the FY

2009-10 audit plans that were not implemented, if any, and provide a full explanation why they were not implemented.

11. Identify the recommendations contained in final audits issued by the Office

of State Comptroller between July 1, 2008 and March 31, 2010 that were not implemented, if any, and provide a full explanation why they were not implemented.

The Governor’s Office of Taxpayer Accountability (OTA) and the Division of the Budget (DOB) will be conducting a review of these State agency and authority internal and contract audit plans and audit recommendations to assess (i) whether the audit plans are based on a documented risk assessment which captures areas for review that have the greatest risk exposure, (ii) the percentage of audits identified in each audit plan that were conducted, (iii) whether recommendations contained in audits were implemented, and any reasons for non-implementation, and (iv) cost savings and other benefits attributable to the audits. In addition, the OTA and DOB will assess whether recommendations contained in audits conducted by the Office of the State Comptroller were implemented, and any reasons for non-implementation.

200912010 INTERNAL CONTROL SUMMARY

RESPONSE TO SECTION F

February 26,2010

F. Periodically evaluate the need for an internal audit (IA) function. If an IA function exists, it should be maintained in compliance with generally accepted professional auditing standards. Agencies on the Division of the Budget's list of agencies required to establish IA functions - and those choosing to have an IA function - are required to comply with The Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing (see BPRM Item B-350 Section I11 "IA Responsibilities").

As outlined in BPRM Item B-350, agencies and authorities are required to periodically evaluate the need to establish, maintain or modify an IA function utilizing the Internal Audit Evaluation Criteria (Attachment C).

Agencies concluding that an IA function is warranted should submit their evaluation to DOB as outlined in BPRM Item B-350. Periodically thereafter, agencies with IA functions should review current operations to determine whether the function should be altered or maintained.

Agencies concluding an IA function is not warranted should periodically reevaluate the need for such a function using Attachment C, especially when organizational, operating, fiscal, program, legal or personnel changes occur which affect the agency's exposure to risk or which could otherwise change the results of the initial assessment.

Pursuant to BPRM Item B-350, agencies required to have - and those entities choosing to have - an internal audit unit should comply with The Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing. Therefore, IA units should comply with the guidance outlined below regarding organizational placement, independence and reporting.

1. Directors of Internal Audit (DIA) should report functionally to the agency head or audit committee and may report administratively to the designated executive deputy (or equivalent position). If the executive deputy has line or staff duties, the DIA should report directly to the agency head.

2 . A current organizational chart should be available that identifies the placement of the LA unit, the individual that has responsibility for overseeing the internal audit activity and other organizations/activities under its purview.

3. The IA function should be independent of the ICO, but should work closely with the ICO. Limitations should be established on IC activities where those duties overlap. Agencies should identify impairments to the independence of the DIA that may be created where the DIA is performing the ICO function. Furthermore, IA units should not assume operating responsibilities, perform management functions, make

management decisions or assume other monitoring roles (e.g., Information Security Officer).

4. Internal audit staff should complete an annual independence statement identifling actuaYpotentia1 impairments to independence and notifying the DIA whenever a new actudpotential impairment arises.

5. At a minimum, DIAs should hold quarterly meetings with agency executive management and the audit committee, where applicable, to report on audit results. Final reports should be distributed to the agency head, executive deputy, auditee, ICO and the audit committee.

6. The DIA should assure that agency audit staff have the skills, knowledge and ability to perform the audit work required and that the size of the audit staff is appropriate given the size and complexity of the organization.

7. IA units should take steps to ensure sufficient audit resources are available given the size and complexity of the organization. This can be accomplished by exploring in-sourcing, outsourcing and sharing audit services.

For this requirement, the agencylauthority is:

Not Applicable - This agencylauthority does not have an IA function.

Fully Compliant Partially Compliant Not Compliant

Provide a thorough explanation of the specific actions your agency has taken, or are needed, to comply with this requirement by providing the following information:

1. A current organizational chart identifying the placement of the IA unit, the name and title of the IA director, other organizations/activities under the IA fbnction's purview and the name and title of the person to whom the IA director reports.

See Attachment A (Page 1)

2. A description of how the internal audit director's credentials, education and experience meets the minimum qualifications established in BPRM Item B-350.

The Auditor General is Michael J. Fucilli He has a BS in Accounting; an4 he is a Certifwd Internal Auditor and Certijkd Fraud Examiner. He has over 31 years of experience in financial, operational, performance, and information systems auditing, of which more than 16 years have been at the executive leveL This combination of experience and education, supported by the diverse education, experience, and credentials (CPA, CIA, CFE, CISA) of the professwnal staa members within MTA Audit Services, meets or exceeds generally accepted internal auditing standards.

3. A description of how continuing professional education requirements are met by the director and each staff member.

As part of the External Auditors Engagement, a 2-day training session is now being provided to the Audit staflyear&.

In addition, the department maintains a budget line for education and a policy. Subscriptions are purchased for the local seminars and workshops provided by the IU. A subscription for online training is also maintained Other training involves in-house classes for Audit Command Language training, ethics, professional development, and computer sop skills. Also, as appropriate, members of the stafl participate in the Citywde Training and the State Seminars.

4. A description of how quality assurance review requirements are being met.

MTA Audit Services adheres to the Standards for Professional Practice in Internal Auditing promulgated by the Institute of Internal Auditors (IZA). In 2008, PricewaterhouseCoopers conducted an independent quality assurance r e v h and strategic business assessment of the organization, administration, and activities of MTA Audit Services. The results of this review confirmed full adherence to the standards of the professwn. The next review will be scheduled for 2013.

Also, the department performs internal quality reviews of the workpapers for each audit conducted before the issuance of the report. Yearly, an internal Quality Assurance review is performed; and the one conducted in 2009 indicated adequate compliance with the Internal Auditing promulgated by the Institute of Internal Auditors (IU).

5. A description of how the I . function ensures that it does not compromise its independence if it is also responsible for other functions (i.e., internal control, information security or other duties).

The Auditor General has a reporting relationship with the Audit Committee of the MTA Board, the Chairman of the MTA, and the MTA Executive Director & CEO.

Audit Services performs audits, aaminations, and provides consultation on specific rnanagement-requested issues and is not responsible for other business functions.

The purpose, authority, and responsibility of Audit Services are defined in its Charter, which also states that auditors are to have no authority or responsibility for the activities they audit

6. A copy of your 2009-10 and 2010-1 1 internal and contract audit plans. (Please note: Dennis Whalen's memo of April 1,2009 called on internal audit units to include the impact of Federal American Recovery and Reinvestment Act (ARRA) funding in their risk assessment and audit planning. If your agency is receiving ARRA funds, please be sure that your 2010-1 1 internal audit plan addresses this issue.)

See Attachment A (Page 2 - 3)

7. Documentation pertaining to the risk-assessment utilized in formulating the 2010-1 1 audit plans.

See Attachment A (Page 4 - 6)

A yearly Risk Assessment is performed. The process is started in September Management from all Agencies is interviewed The comprehensive risk assessment is fully documented.

8. An indication of which audits in the audit plan for FY 2009-10 were not conducted, and an explanation as to why they were not conducted.

The 2009 Plan has been augmented with 36 audits requested by management or deemed critical to be performed at the time. Some of the most significant audits added are the American Recovery & Reinvestment Act Funds; Business Service Center support in the areas of Quality Assurance, Procurement, Internal Controls, and Technology; Inventory Accountability at the Commuter Railroads; and Agency-wide Capital Project Status reporting.

We have deferredtcancelled 15 audits; three in the area of Technology due to system re-design; one in the area of Safety/Security since coverage was provided by the recent completion of a security review undertaken by a consultant; and the rest in the Rnance, Service Delivery and Workforce areas, the coverage of which is included in our 2010 Plan.

9. An estimate of the cost savings to be achieved by virtue of implementing the recommendations contained in each conducted audit described in the FY 2009-10 audit plans and any audits that were conducted during that time period that were not in the audit plan. If it is not feasible to provide a cost estimate for savings, please identify process improvements, risk mitigation, fiaud prevention or cost avoidance measures that result fiom implementation of such recommendations.

See Attachment A (Page 7)

10. Identify the recommendations contained in the audits described in the FY 2009-10 audit plans that were not implemented, if any, and provide a full explanation why they were not implemented.

See Attachment B

11. Identify the recommendations contained in final audits issued by the Office of State Comptroller between July 1,2008 and March 31,2010 that were not implemented, if any, and provide a full explanation why they were not implemented.

See Attachment C

The Governor's Office of Taxpayer Accountability (OTA) and the Division of the Budget (DOB) will be conducting a review of these State agency and authority internal and contract audit plans and audit recommendations to assess (i) whether the audit plans are based on a documented risk assessment which captures areas for review that have the greatest risk exposure, (ii) the percentage of audits identified in each audit plan that were conducted, (iii) whether recommendations contained in audits were implemented, and any reasons for non- implementation, and (iv) cost savings and other benefits attributable to the audits. In addition, the OTA and DOB will assess whether recommendations contained in audits conducted by the Ofice of the State Comptroller were implemented, and any reasons for non-implementation.

Metropolitan Transportation Authority 2009-2010 Internal...

Documents

Transcript of Metropolitan Transportation Authority 2009-2010 Internal...