Metropolitan Transportation Authority ERM/Internal Control ...

Metropolitan Transportation Authority

ERM/Internal Control Summary Report

2013 – 2014

SubmittedBy

MTACorporateCompliance

2Broadway,16thFloor

NewYork,NewYork10004

TableofContents

Page

Section A. Requirement: Establish and Maintain Guidelines for a System of Internal Controls 1

Section B. Requirement: Establish and Maintain a System of Internal Controls and a Program

of Internal Control Review 3

Part 1. Process Used To Review Internal Controls 3

Part 2. Significant Business Processes Identified During the 2013-14Review Process 4

Part 3. Material Weakness or Significant Deficiencies Revealed During the

2013-14 Review Process _____________________45

Part 4. The Internal Control Program Details 2013-14 89

Section C. Requirement: Make Available to Each Officer and Employee a Clear and Concise Statement

of the Generally Applicable Management Policies and Standards __________________ 99

Section D. Requirement: Designate an Internal Control Officer (ICO), Who Shall Report to the

Chairman of the MTA, to Implement and Review the Internal Control Responsibilities

Established Pursuant to The Act and Internal Standards _____________________104

Section E. Requirement: Implement Education and Training Efforts to Ensure that Officers and

Employees Have Achieved Adequate Awareness and Understanding of Internal Control

Standards and, as Appropriate, Evaluation Techniques _____________________109

_______________________________________________________________________

METROPOLITAN TRANSPORTATION AUTHORITY

2013-14 INTERNAL CONTROL SUMMARY REPORT

2013-2014 Internal Control Summary Report Page 1 of 114

Date September 16, 2014

Completed by Phone

Lamond W. Kearse, Chief Compliance Officer (646) 252-1330

MTAHQ Michael Amrick (212) 878-7422

New York City Transit William Vazoulas (646) 252-6610

Long Island Rail Road Mark Young (718) 558-7777

Metro-North Railroad Nathan Gilbertson (212) 340-2197

Bridges and Tunnels James Elkin (646) 252-7150

Capital Construction Daniel Worrell (646) 252-1303

MTA Bus Company Robert Picarelli (718) 696-3614

_______________________________________________________________________

Section A. Requirement: Establish and Maintain Guidelines for a System of Internal

Controls

Standard: Internal control guidelines communicate an Organization’s management

and programmatic objectives to its employees and provide the methods and

procedures used to assess the effectiveness of its internal controls in supporting those

objectives. Internal control guidelines should state the Board’s support of internal

controls to provide staff with an understanding of the benefits of effective controls;

identify primary responsibilities and the objectives; explain how internal controls are

organized and managed; define responsibilities of management and staff; acknowledge

that internal controls adhere to accepted standards; and describe the process for

evaluating internal controls.

The Metropolitan Transportation Authority, a public benefit corporation of the State

of New York, has the responsibility for developing and implementing a unified mass

transportation policy for The City of New York and Dutchess, Nassau, Orange,

Putnam, Rockland, Suffolk and Westchester counties.

In November 2011, the Metropolitan Transportation Authority Board adopted

Enterprise Risk Management and Internal Control Guidelines (“ERM Guidelines”).

These guidelines replaced MTA All Agency Policy Directive 11-008 entitled

Accountability & Internal Control issued June 8, 1990. The purpose of the ERM

Guidelines is to establish an effective system of internal controls for the Metropolitan

Transportation Authority and each of its subsidiary and affiliated agencies (“MTA”)

_______________________________________________________________________




which complies with the requirements of the New York State Government

Accountability, Audit and Internal Control Act of 1999, Public Authorities Law

Sections 2930 through 2932 (“the Act”), the Standards for Internal Control in New

York State published by the Office of the State Comptroller, Guidelines issued by the

Independent Authority Budget Office (“IABO”), and the Commission of Sponsoring

Organizations of the Treadway Commission standards (“COSO”).

The ERM Guidelines establish the MTA Board’s support of internal controls and its

commitment to provide staff with an understanding of the benefits of effective

controls. It also identifies the Authority’s primary responsibilities and the objectives

of internal controls; explains how internal controls are organized and managed;

defines responsibilities of management, supervisors and staff; acknowledges that

MTA’s internal controls adhere to accepted standards; and describes the

organization’s process for evaluating internal controls.

In 2004, the MTA Board established the position of Chief Compliance Officer. The

Chief Compliance Officer serves as the Chief Risk Officer known as the Internal

Control Officer (“ICO”) for the MTA and its Affiliated and Subsidiary Agencies. In

addition, each Agency appoints an Authority Internal Control Officer for their

Agency (“AICO”) who is a direct report to the Agency President or their designee.

The guidelines also establish an Enterprise Risk Management Committee. The

Committee meets at least quarterly to review and suggest improvements to the

program. AICO’s or their designees serve on the Committee, which is chaired by the

Chief Compliance Officer.

MTA’s Enterprise Risk Management/Internal Control Program is compliant with the

Act, the Standards for Internal Control in New York State published by the Office of

the State Comptroller, IABO guidelines, and COSO standards. MTA’s Enterprise Risk

Management/internal control program is modeled after current best practices of

integrating corporate governance, internal controls, compliance and ethics.

_______________________________________________________________________




Section B. Requirement: Establish and Maintain a System of Internal Controls and a

Program of Internal Control Review

Standards: The program of internal control review shall be a structured, continuing

and well documented system designed to identify internal control weaknesses,

identify actions that are needed to correct these weaknesses, monitor the

implementation of necessary corrective actions and periodically assess the adequacy

of the internal controls. The procedures for evaluating the adequacy of that system

also vary, but at a minimum should: Identify and clearly document the primary

operating responsibilities; define the objectives of these functions so they are easily

understood by staff accountable for carrying out the functions; identify/document the

policies and procedures used to execute functions; identify the major functions of

each assessable unit; develop a process or cycle to assess risk and test controls for

major functions; assess the risks and consequences associated with controls failing to

promote the objectives of major functions; test controls to ensure they are working as

intended; and institute a centrally monitored process to document, monitor and

report deficiencies and corrective actions.

Part 1. Process Used To Review Internal Controls

Metropolitan Transportation Authority-Enterprise

The Enterprise Risk Management/Internal Control Program is based on vulnerability

(Risk) assessments and the ranking of business processes based on the level of risk

assigned to each one. The MTA identifies all major business processes, determines the

level of risk and develops a system of controls to manage and mitigate those risks.

Self-assessments and testing of existing controls is required to determine whether

they are functioning as intended and the adequacy of those controls. If weaknesses

are detected, a corrective action plan is created with a timetable for addressing and

resolving the deficiencies.

The primary control techniques, which support the control evaluation process, are

documentation and recordkeeping, authorization of transactions, segregation of

duties, supervision and security of information and data. Policies and procedures, logs

and records, supervision and structure based on corporate organization charts and the

various levels of data security are examples of the control techniques which support

the Internal Control Program and enable each department to effectively monitor

their internal control system.

_______________________________________________________________________




MTA is utilizing a Governance, Risk and Compliance system to manage the MTA’s

Internal Control, Compliance and Governance programs.

This application, in the broadest sense, is designed to add greater accountability and

transparency to the MTA’s Compliance/Internal Control efforts. The applications

allow the MTA to, among other things:

monitor compliance with MTA and Agency policies and procedure,

monitor compliance with multiple regulatory requirements,

align internal controls with policies and regulations,

replace labor-intensive vulnerability assessments with automated GRC

process management,

monitor internal controls not just by Agency but as part of an integrated

business processes across Agencies,

track and document risks and internal controls related to those business

processes,

track corrective action plans and audit recommendations, and

evaluate, test and report on the status of internal controls.

MTA utilizes a risk-based approach for continuous internal control monitoring and

testing, based upon annually reviewed vulnerability assessments. These assessments

assist Agencies in identifying key vulnerabilities and controls in place throughout the

Authority.

Part 2. Significant Business Processes Identified During the 2013-14

Review Process

MTA Headquarters – Significant Business Processes

Department Subdivision Business Process Reviewed

Administration Operation Support Emergency Preparedness

for Natural Disasters

No

Budget Budget Budget and Financial

Statement Preparation

No

_______________________________________________________________________






Business Service

Center

Finance

Accounts Payable Yes

Payroll Administration –

Run Payroll

Yes

Travel and Business

Expense Reimbursement

No

Human Resources

Administration Items No

Benefits No

HRIS Yes

IT Coordinate Disaster

Recovery Test

No

Procurement

Issue Various Reports on

Procurement Activities

No

Tracking No

Capital Program

Management

Capital Program Budget

and Grants Management

Preparation ARRA 1512

Report

Yes

Comptroller Comptroller Financial Statements Yes

Corporate Affairs

and Communications

Arts for Transit and

Facilities Design

Coordination No

New York Transit

Museum

Operate the New York

Transit Museum

No

Policies and Procedures Community Affairs Yes

Corporate

Compliance

Ethics Program Code of Ethics Yes

Ethics Training Yes

Regulatory Reporting Preparation Annual

Report

Yes

Compliance Whistleblower Protection Yes

Internal Control System Internal Control Program Yes

Department of

Diversity and Civil

Rights

Certification Unit

Determine Eligibility of

New Applicants for DBE

Certification

Yes

Contract Compliance

Unit

Contract Integrity

Monitoring

No

Contract Integrity

Monitoring Review of

Monthly Participation

Report Submissions

Yes

Field Visits No

_______________________________________________________________________






Department of

Diversity and Civil

Rights

EEO Investigations Investigations No

Outreach Outreach Program No

Mentoring Mentoring Program No

Enterprise

Information

Technology Group

Enterprise Security Data Protection Yes

Information Services Information Services No

Facilities Operations

Office Services and

Building Services and

Administrative Services

Building Security No

General Counsel

Legal

Contracts and

Procurements

Yes

Environmental Yes

Litigation Yes

Legal Library Administration of the Law

Library

No

Human Resources

Benefits Benefit Policy and

Research

No

Deferred Compensation Communications Yes

Offer Deferred Yes

Defined Benefit Pensions Defined Pensions No

Recruitment Staffing and Employee

Relations

Yes

Risk and Insurance

Management

Claims Claims Management No

Risk Assessment and

Coverage

Insurance Coverage Yes

Risk Control and

Reporting

OCIP Yes

Treasury Treasury Cash and Investments No

MTA Bus Company – Significant Business Processes


Depot Operations

Maintenance Operations Fuel Administration Yes

Transportation Pre-Trip Inspection Yes

Administration Random Drug Testing Yes

Security Daily Facility Inspection Yes

Facilities Environmental/Compliance SPCC Inspection Report Yes

_______________________________________________________________________




MTA Bus Company – Significant Business Processes


Central Maintenance

Administration Random Drug Testing Yes

Safety Facility & Safety Yes

Maintenance Maintenance Program

Work

Yes

Paratransit Transportation Vehicle Accountability Yes

Security CCTV Yes

Facility/Property Access Yes

Safety & Training Transportation Accident Performance

Monitoring Program

Yes

Procurement Contract Administration Managing Contract

Dollars

Yes

MTA Bridges and Tunnels – Significant Business Processes


Engineering &

Construction

Planning

Develop Plans and Goals

to Support the

Presidential Policy

“Engineering &

Construction

Department Mission

and Functions”

Yes

Design

Design and Review

Architectural

Engineering Projects

Yes

Program/Project

Management

Plan, Budget and

Schedule Capital and

Operating Projects

Yes

Perform Construction

Safety Oversight and

Monitor Work Injuries

Yes

Quality Assurance

Maintain Quality

Assurance Over Project

Development, Design

and Management

Activities for all

Construction Work

Yes

Finance Accounting Financial Statement

Preparation

Yes

_______________________________________________________________________






Finance Payroll

Ensure Proper

Preservation of Payroll

Records

Yes

Maintain Proper

Control and Security

Over Payroll Records

Yes

Health & Safety

Provide Statistical

Analysis of Employee

and Customer Lost Time

for Safety Program

Management

Yes

Oversight of all

Hazardous Material

Abatements

Yes

Review All Contracts,

Construction Design

Plans and Specifications,

Contractor and

Consultant Safety Plans

for Environmental,

Health and Safety

Concerns

Yes

Provide Technical

Oversight and Guidance

for all Safety Training

Courses

Yes

Prepare and Submit

Compliance Reports

with Environmental and

Occupational Safety and

Health Regulations

Yes

Internal Security

Security Operations

Manage Armed Security

Operations

Yes

Coordinate the Securing

of Sensitive Documents

Yes

Electronic Security Support

Maintain and Manage

Electronic Security

Systems

Yes

Special Investigations

Perform Integrity

Testing of Revenue

Stream

Yes

_______________________________________________________________________






Internal Security Special Investigation

Perform Security

Inspections in ISD Areas

Yes

Perform Safety Audits at

Toll Collection Facilities

Yes

Information

Technology

Conduct Annual

Disaster Recovery Tests

of Critical Applications

Yes

Manage Consultant

Design, Development

and Maintenance of ITS

Products

Yes

Perform Safety Audit

Trails

Yes

Labor Relations

Represent Agency at

Public Employment

Relations Board

Yes

Represent Agency in

Interest and Rights

Arbitrations

Yes

Legal

Administer Agency’s

Worker’s Compensation

Program

Yes

Administer Agency’s

Property Damage

Program

Yes

Manage Employment

Actions

Yes

Operations

Facilities

Ensure Toll Collection

Functions are

Performed in

Coordination with

Directives

Yes

Ensure Customer and

Employee Safety

Yes

Maintain Adequate

Level of Security at

Critical Areas Against

Potential Threats,

Vandalism, Theft and

Acts of Terrorism

Yes

Administration Provide Firearms

Training

Yes

_______________________________________________________________________






Operations Administration

Provide Respiratory

Protection Equipment

Training

Yes

Planning and Budget Operating

Manage And Maintain

the Hyperion Budget

System (BSCFIN &

BSCENC)

Yes

Conduct Safety Audits of

Office Conditions in

Compliance with the

All-Agency Safety

Initiative

Procurement

Develop and Prepare

RFP’s and RFQ’s

Yes

Ensure Awards are Made

to Responsible Bidders

Who are Technically,

Financially and Ethically

Able to Meet Contract

Requirements

Yes

Bid Admin/Vendor

Relations

Yes

Revenue

Management

E-ZPass Contract

Compliance

Monitor Video Tolling

and Reload Cards

Yes

Monitor DMV

Validation

Yes

E-ZPass Project

Management

Monitor Manual Toll

Processing

Yes

Revenue Audit

Perform Manual Audits

to Identify and

Document Cash

Shortages in a Timely

Manner

Yes

Compile Traffic and

Revenue Information for

Monthly Management

Reporting

Yes

Revenue Operations

Count Cash Held at

Facilities

Yes

Review Daily Operations

at the Revenue

Processing Center

Yes

_______________________________________________________________________






Revenue

Management

Revenue Operations

Maintain and manage

armored carrier

operations

Yes

Revenue Systems

Maintenance

Perform monthly

reconciliations of non-

revenue tags

Yes

General Conduct employee

safety audits

Yes

Staff Services

Human Resources

Review and maintain

personnel records

Yes

Monitor medical leave

absence/family medical

leave

Yes

Administration

Coordinate/manage

mail, courier and

messenger services for

all facilities

Yes

MTA Capital Construction – Significant Business Processes


Capital Security

ProgramSecurity

Program Security No

Chief Engineer Engineering

Code Compliance No

Design Integration No

System Integration No

Government &

Community Affairs

Community Affairs Community Outreach No

Governmental Affairs Government Outreach No

Finance Budget &

Administration

Finance

Accts

Payable/Disbursement

No

Accounts Receivable No

Budget & Forecasting No

Expense Review No

Financial Reporting No

Grant Management Grant Management No

General Counsel,

Procurement &

Human Resources

General Counsel

General Counsel No

_______________________________________________________________________




MTA Capital Construction – Significant Business Processes


General Counsel,

Procurement &

Human Resources

Procurement &

Administration

Procurement Yes

Human Resources

Payroll Yes

New Hire /Changes /

Terminations

Yes

Information

TechnologyInformation Technology

Systems' Access & User

Rights

No

Planning and

Development &

Chief Architect

Sustainability &

Environmental Services

Sustainability &

Environmental Services

Yes

Program Controls &

Quality Assurance

Claims Management &

Scheduling

Scheduling Design &

Construction

No

Estimating & Cost Controls Cost Estimating No

Program Controls Policies & Procedures No

Quality Quality Assurance Yes

Risk Management &

Budget Controls

Risk Management /

Liability Protection

No

Project and

Construction

Management

7 Line Extension Project Construction

Management

Yes

East Side Access Project Construction

Management

No

Fulton Street Transit

Center

Project Construction

Management

Yes

Second Avenue Subway Project Construction

Management

Yes

Safety Safety Safety & Site Security No

Strategic Initiatives

& Communications

Strategic Initiatives &

Communications

Communications Policy Yes

MTA Long Island Rail Road – Significant Business Processes


All All

Management

Compensatory Time

Yes

Overtime Yes

Procurement Card Yes

Employee Accident

Reporting

Yes

Employee Accident

Counseling

Yes

_______________________________________________________________________






All All Train Accident Report Yes

Budget Submission Yes

Information

TechnologyN/A

Manage System Security No

Plan Disaster Recovery No

Administration of

Systems Development

Yes

Department of

Program

Management

Project Planning &

Controls

Productivity Tracking No

Design Management Consultants Contracts Yes

Best Value Analysis No

Construction Management

Force Account

Construction

No

Managing Change

Requests

No

Central Administration

Invoice Processing (3rd

Party Contracts)

No

Invoice Processing

(Force Account)

No

M/W/DBE Compliance

Reporting

Yes

Code Compliance

Process

No

Law Department

Torts & Administration

Monitoring – Outside

Counsel

Yes

Approve & Voucher

Payments

No

Procurement

Draft/Revise

Procurement

Contract/Agreements

Yes

Advise/Assist Vendor

Responsibility

Determinations

Yes

Advise & Assist – Bid

Protest

Yes

Liaison with Other

Agencies

No

Negotiate Disputes &

Settlements with

Vendors

No

_______________________________________________________________________






Law Department

Claims

Lawsuits – Support

Attorney in Trial

Preparation

Yes

Federal Employees

Liability Act (FELA)

Claims

No

Property Damage No

Insurance Cases No

Payment/Security –

Settlements

No

Subpoena Checks No

Calculate Liens & Lost

Wages

No

Collect Debt No

General Law Oversight – FRA

Violations

No

Engineering

Signals & Communications

Equipment/Tool

Inventory

Yes

FRA Signal Appliance

Testing

No

Highway Crossing

Inspections

No

Planning & Administration Track Geometry

Measurement TC-82

Yes

Facility Management Contract Compliance Yes

Maintenance of Way FRA Inspections Yes

Office of Security Pass Office

Pass Issuance,

Destruction and

Property Access

Yes

Pass Issuance to

Employees

Yes

Issuance of

Transportation Pass and

ID only to Contractors

Yes

Employee Status

Changes (Terminations,

Retirements, etc.)

Yes

Recovery & Destruction

of Invalid/Expired

Employee, Contractor

Passes and Voided Stock

Yes

_______________________________________________________________________






Office of Security

Pass Office

Review and Approval of

Medical Certification

Forms Submitted by

Applicants Requesting

Permanent

Transportation Pass

Yes

Vehicle Fleet Operations

Accident Reporting

Motor Vehicle

Yes

Annual Driver

Qualifications

Yes

President’s Office N/A Correspondence

Handling

Yes

Office of

Management BudgetN/A

Operating Budget –

Budget Submission

Yes

Development of

Monthly Financial

Package

Yes

Human Resources

Employment

Respond to Report of

Medical Condition by

Employer

Yes

Update Job Description

and Physical Agility

Screening (PAS)

Yes

HR Planning & Admin

Services

New Hire Plan Yes

Employee Services

FMLA Compliance Yes

Administer Alcohol and

Substance Testing

Program

Yes

DA/DS Compliance Yes

Administer Sick Leave Yes

Transportation Safety

Compliance with

Federal Mandates &

Safety for Hours of

Service

Yes

Compliance with

Federal Mandates &

Safety – Random Drug

Testing

Yes

Engineer Certification No

_______________________________________________________________________






Transportation

Safety Safety Inspections &

Safety Discussions

No

Train Movement

Tower Inspections Yes

Train Dispatchers Yes

Monitor TIMACS &

OTP Reporting

Yes

On-Board Fare

Collection

Yes

Train Consist

Compliance

No

Safety Observations –

Workplace Safety

No

Safety Observations –

Train Operations

No

Internal Administration

Requisitions No

Agency

Reimbursements –

Capital Projects

No

Administer Flagging

Needs

No

Identifying Needs for

Certain Essential

Personnel

No

Addressing Customer

Complaints

No

Customer Services,

Marketing & Public

Affairs

Customer Services

Administration of CAP

Database

Yes

CAP Activation -

Planned & Unplanned

(Emergency) Events

Yes

Time & Attendance Yes

TOM Reporting of Cash

Receipts by Ticket

Clerks

Yes

TVM Reporting of Cash

Receipts

Yes

Maintaining &

Distributing Ticket

Stock

Yes

_______________________________________________________________________






Customer Services,

Marketing & Public

Affairs

Customer Services

Discipline Represented

Employees and monitor

absence control policy -

Notices & Trials

No

Employee Probation

Evaluation Records

No

Recording of

Ronkonkoma Garage

Monthly & Daily Sales

No

Ronkonkoma Garage -

Refund Transactions

No

Recording of

Ronkonkoma Garage

Monthly & Daily

Deposit

No

Managing Penn Station

Cleaning Contract with

Fed Cap a Subsidiary of

NYSID

No

TOM Reporting of Cash

Receipts by Ticket

Clerks

No

TVM Reporting of

Ticket Sales

No

Penn Ticket Remittance

Operation

No

Maintaining &

Distributing Ticket

Stock

No

Special Services - Sell To

Customers

No

Audit Sales and

Inventory Activity

No

Monthly Expense &

Revenue Reporting

No

Maintain and Track

Purchase Orders

No

_______________________________________________________________________






Procurement &

Logistics

Contracts Emergency

Procurements

No

Stores

Material Handling –

Receipt of Materials

No

Procurement – Property

Management

No

Controller

Accounting

Calculation of Overhead

Rates

No

Verification of Trackage

Fees Payable from

NYAR

No

Verification of Royalty

and Switch Fees Payable

from NYAR

No

Treasury

Cash Management &

Banking: Deposits

Yes

Cash Management &

Banking: Wire Transfers

Yes

Payroll

Processing of Weekly

Time and Labor

Information

Yes

Revenue Information &

Control

Tariff Table No

Ticket Stock No

Maintenance of

Equipment

RCM Administration RCM Management &

Review

Yes

Fleet Support Shops

Support Shop Rebuild

Program

Yes

MU Periodic

Inspections

No

MU Heavy Repairs,

Overhauls and Fleet

Modifications

No

Fleet Operations

MU-2B Inspection No

MU Class I Brake Test No

MU Toilet Servicing No

MU EIC (Extraordinary

Interior Cleaning)

Yes

Diesel Shops and Yards

Locomotive Daily

Inspection

Yes

Diesel Coach (C3)

Periodic Inspection

Yes

_______________________________________________________________________






Maintenance of

Equipment

Diesel Shops and Yards

Diesel Locomotive

Periodic Inspection

Yes

Running Repairs of

Diesel Locomotive and

Coach Equipment

Yes

Reliability-Centered

Maintenance, Fleet

Modifications and

Heavy Repairs

Yes

DH Coach EIC Cleaning No

Diesel Hauled Coach

Toilet Servicing

No

Quality Assurance &

Control

QC Inspections of

Periodic Inspections,

RCM, Fleet

Modifications, etc. done

in MofE repair shops.

Yes

QC inspection of Fleets:

Extraordinary Interior

Cleaning (EIC), Lay-Up

Cleaning (LUC) and

Turn Around Cleaning

Yes

MU and DH Fleets:

Toilet Inspection

No

DM Locomotive Shoe

Beam Cleaning

Inspections

Yes

In-Service HVAC

Temperature Survey

No

Perform Surveys as

Requested by

Management,

Performance

Improvement Teams

(PIT) / Task Forces or

Engineering

Yes

MOfE Administration

Recovery information

and report coordination

Yes

Fleet Analysis and

Document Control

Yes

_______________________________________________________________________






Safety & Training

Occupational &

Environmental Safety

Petroleum Bulk Storage

Tank Management

Program

Yes

Fire Marshal

Investigate & Evaluate

Fires for Causes and

Possible Trends

Yes

Training & Development

Produce and Deliver

Mandated Training

Yes

Ensure the Instructors

are Qualified

Yes

Ethics Training Yes

Service Planning Scheduling

Produce Equipment

Manipulation Schedule

No

Produce Employee &

Public Timetables

No

Produce Crew

Assignment Books

No

MTA Metro-North Railroad – Significant Business Processes


Administration

Human Resources

ADA Compliance No

Avoidance of Nepotism Yes

Dual Employment Yes

Family and Medical

Leave Case Management

Yes

Military Leave

Management

Yes

Selections Testing No

Short Term Disability

Leave

No

Occupational Health

Services

Manage the Take Care

Health Contract

Yes

Pre-Placement/Periodic

and Mandated Medical

Exams

Yes

Provide Return to Duty

Examinations

Yes

Safeguard Employee

Medical Records

Yes

Training

Provide Mandated

Training for Operations

Services Employees

Yes

_______________________________________________________________________






Administration Training

Provide Mandated

Training for

Maintenance of

Equipment Employees

Yes

Provide Mandated

Training for

Maintenance of Way

Employees

Yes

Budget

Preparation and

Monitoring of the MNR

Financial Plan

No

Business

Development,

Facilities and

Marketing

Destination Services

Trackside Commissary

Operations and Sales

Yes

Capital Programs

Construction Management

Capital Project

Emergency Response

Compliance

Yes

Capital Project Quality

Compliance

Yes

Capital Project Safety

Compliance

Yes

Capital Project Security

Compliance

Yes

Program Management

Capital Project

Management - Bridges,

Tunnels and Track

Yes

Capital Project

Management - Power

Yes

Capital Project

Management - Rolling

Stock

Yes

Capital Project

Management - Shops,

Yards, Environmental,

and Special

Yes

Project Controls and

Technical Services

Capital Project Status

Reporting

No

Chief of StaffCorporate Compliance &

Strategic Development

Business Continuity

Plan

No

Manage the Internal

Control Program

No

_______________________________________________________________________






Controller

General and Subsidy

Accounting

Capitalization of Fixed

Assets

Yes

FTA-NTD Regulatory

Reporting Requirements

Yes

Passenger Revenue

Accounting

Mail & Ride Ticket

Program Management

Yes

Operations Revenue

Reporting

Yes

Ticket Refund

Management

Yes

Ticket Revenue

Management

No

Ticket Stock Manage Yes

Payroll and Timekeeping

Leave Balance Payouts

T&E

Yes

Leave Balance Payouts

OT&E

Yes

Time and Labor Payroll

Close Process

Yes

Treasury Daily Cash Management Yes

Customer Service

and Stations

CS&S Administration

Parking Facilities

Management

Yes

Manage CS&S Vendor

Contracts

No

Service Quality

Inspection Program

No

Station and Customer

Inform/Distribution

No

Timetables and

Schedules

No

Ticket Sales and Service

Manage Ticket Sales

(Stations and TRO)

No

Manage Ticket Sales

(TVM)

Yes

Diversity and EEO EEO Office

Investigate

Discrimination

Complaints

Yes

Mandatory EEO

Reporting

Yes

Information

TechnologyIT Infrastructure

Confidentiality,

Integrity, and

Availability of Data

Yes

_______________________________________________________________________






Information

Technology

IT Infrastructure

Protect Customer

Cardholder Data

Yes

Restoration of Critical

IT Services

Yes

Program Management

Office

Manage IT Related

Projects

No

Legal

Claims Services Claims Management No

Environmental Compliance

and Services

Handling Hazardous

Waste

No

Prepare Annual

Environmental Audit

No

Wastewater Testing and

Permits Renewal

No

Maintenance of

Equipment

ACMO

Identification and

Repair of In-Service

Rolling Stock Failures

No

Maintain Rolling Stock No

Perform Calendar Day

Mechanical Inspections

- H&H

No

Perform Calendar Day

Mechanical Inspections

- NHL

No

Perform Maintenance

Per MNR RCM

Requirements

No

Perform Periodic Safety

Inspections H&H

No

Perform Periodic Safety

Inspections NHL

No

Repair Rolling Stock No

M of E Administration

Manage M of E Vendor

Contracts

Yes

M of E Timekeeping Yes

Maintenance of Way Communications & Signals

Grade Crossing

Inspection &

Maintenance

Yes

Maintenance & Repair

Customer Information

Systems at Stations

No

_______________________________________________________________________






Maintenance of Way

Communications & Signals

Maintenance and Repair

Security Systems

No

Monitoring Employee

Hours of Service Regs

No

Signal Inspection Yes

Signal Maintenance and

Repair

Yes

Grand Central Terminal GCT Inventory Yes

M of W Administration

M of W Timekeeping Yes

Manage M of W Vendor

Contracts

No

Operating Capital

Manage Force Account

Projects

No

Management Monitor of

Diesel Fuel

Yes

Management and

Monitoring of Heating

Fuel

Yes

Power

Catenary Inspection and

Maintenance

No

Circuit Breaker

Inspection and

Maintenance - H & H

No

Circuit Breaker

Inspection and

Maintenance - NHL

No

Third Rail Inspection

and Maintenance

No

Third Rail Repair No

Track and Structures

Annual Bridge

Inspection

Yes

Bridge Maintenance and

Repair

Yes

Equipment Run Track

Inspection

Yes

Facility Inspection Yes

Facility Maintenance

and Repair

Yes

_______________________________________________________________________






Maintenance of Way Track and Structures

Inspection,

Maintenance, and

Repair of Work

Equipment

No

Load Rating Bridge

Inspection

Yes

Station Inspection No

Station Maintenance

and Repair

No

Track Maintenance and

Repair

Yes

Visual Track Inspection Yes

Operations

Operating Rules

Administer the Drug

and Alcohol Testing

Program

Yes

Efficiency Testing

Program

Yes

Operations Administration

Monitoring of Fuel

Cards and Fuel Usage

Yes

Non-Revenue Vehicle

Management and

Monitoring

No

Operations Services

Field Operations

Field Incident

Management

No

Field Safety

Management

No

Finance, Administration

And Crew Management

Availability Monitoring

- CMC

Yes

Capital Support Yes

T&E Employee Hours of

Service (HOS)

Monitoring

No

Speed Compliance

Monitoring

No

Train Staffing - CMC No

T&E Employee Claims

Quality Control-CMC

No

T&E Timekeeping No

Operations Control Center

Job Training-OCC Yes

Track Outage

Scheduling-OCC

No

_______________________________________________________________________






Operations Services Operations Control Center

Train Dispatching &

Incident Management-

OCC

No

PlanningOperations Planning and

Analysis

Monitoring and

Reporting Ridership

No

New Fare Payment

Systems

No

Schedule Development

and Implementation

No

Procurement and

Material

Management

Material Management

Asset Disposition No

Maintain Warehouse

and Inventory Security

Yes

Perform Inventory

Cycle Counts

Yes

Non-Operations

Competitive

Procurements-

Capital/Non-Operations

Yes

Contract Administration

- Capital/Non-

Operations

No

Emergency

Procurements -


Yes

Non-Competitive

Procurements -


Yes

Operations

Competitive

Procurements -

Operations

Yes

Contract Administration

- Operations

No

Emergency

Procurements -

Operations

Yes

Non- Competitive

Procurements -

Operations

Yes

P&MM Administration

Procurement Card

Management and

Monitoring

Yes

_______________________________________________________________________






Safety

Fire Brigade and

Emergency Medical

Services

Yes

System Safety Program

Plan (SSPP)

Yes

Mandated Safety

Reporting-(FRA, FTA,

MTA)

Yes

Security

Security Command

Center and Security

Systems Administration

No

MTA New York City Transit – Significant Business Processes


Department of

Subways

Maintenance of

Way/Electronic

Maintenance Division

Maintain and Monitor

AFC Equipment

Yes


VHF Subways Radio

Communication

Systems

No


Electronic Equipment

for Bus Radio

Communications

Systems

No

Inspect Fire and Hazard

Alarms in Bus and

Depot Facilities

Including Detection

Depot Gas Systems

Yes

Inspect Fire and Hazard

Alarms/Suppression

Systems in the Subway,

Including Stations,

Crew Facilities, and

Booth Halon Systems

Yes

Inspect Subway

Emergency Alarms and

Telephones

Yes

_______________________________________________________________________






Department of

Subways

Maintenance of

Way/Electronic

Maintenance Division


Electronic Equipment

for Communications

Infrastructure

Yes

Repair Electronic

Modules

Yes


CCTV/Monitoring

Devices

Yes

Safety Training and Use

of Personal Protective

Equipment

Yes


EMD Access &

Intrusion Systems

Yes

Procurement Card

Administration

No

Hearing Conservation

Program

Yes

Random Drug and

Alcohol Testing

No

Maintenance of

Way/Administration

Central Payroll,

Timekeeping and Check

Distribution

Yes

Central Material

Control-Inventory

Management

Yes

Protection of Social

Security Numbers

Yes

Maintenance of Way/Track

Track Maintenance Yes

Third Rail Maintenance Yes

Track Flagging Yes

Track Inspection Yes



Equipment

Yes


Program

Yes

Procurement Card

Administration

No

Random Drug and

Alcohol Testing

No

_______________________________________________________________________






Department of

Subways

Maintenance of

Way/Infrastructure

Structures Maintenance

Work

No

Infrastructure Capital

Construction Projects

No

Inspection and Routine

Maintenance of Fixed

Assets and Equipment

Yes

Track Flagging Yes

Lead Particulate

Management

Yes

Asbestos Handling No

Safety Training Use of

Personal Protective

Equip

Yes

Prevention of

Unauthorized Access to

Areas Within the

System

Yes


Program

Yes

Procurement Card

Administration

No

Random Drug and

Alcohol Testing

Yes

Maintenance of

Way/Electrical/Power

Substation Equipment

Maintenance and Repair

Yes

Power System

Operation Procedure

Yes

Power System

Equipment Testing and

Inspection –

Substations

Yes

Power System


Inspections –

Emergency Alarm

Panels

Yes

Power System


Inspections –

Supervisory Control

Data Acquisition System

Yes

_______________________________________________________________________






Department of

Subways

Maintenance of

Way/Electrical/Power

Emergency Response Yes

Safety Program Plan

Implementation

Yes

Access and Protection

to Power Substations

and Prevention of

Unauthorized Access

Yes

Access and Protection

to Cable Vaults and

Prevention of

Unauthorized Access

Yes

Revenue Meter

Readings

Yes


Program

Yes

Procurement Card

Administration

No


Security Numbers

Yes

Random Drug and

Alcohol Testing

Yes

Maintenance of Way/

Electrical/Signals

Signal Equipment

Maint/Work Order

Repair

Yes


Inspections

Yes

Emergency Response Yes

Track Flagging Yes

Access and Protection of

Signal Rooms

Yes



Equipment

Yes


Security Numbers

Yes


Program

Yes

Procurement Card

Administration

No

Random Drug and

Alcohol Testing

No

_______________________________________________________________________






Department of

Subways

Maintenance of Way/

Elevators and Escalators



Equipment

Yes

Procurement Card

Administration

Yes

Maintenance of Way/Ops

Support/Ops Training

Deliver Track Safety

Training to Contractors

Yes

Division of Operations

Support


Security Numbers

Yes

Timekeeping Activities No

Material Controls: Tools

and Equipment

Yes

Lost Property No

Procurement Card

Administration

Yes

Random Drug and

Alcohol Testing

Yes

Division of Rapid Transit

Operations

Communications:

Proper Handling of

Emergencies

Yes

Communications:

Inclement Weather

(Severe Rain and/or

Snowstorms)

No

Track Safety Task Force

Recommendation #16

Yes


Scheduling

Yes


Compliance

Yes

Procurement Card

Administration

Yes

Injury on Duty

Prevention

Yes

Injury on Duty

Procedures

No

Track Flagging Yes

Random Drug and

Alcohol Testing

Yes

Unsafe Acts by

Customers

Yes

_______________________________________________________________________






Department of

Subways

Division of Rapid Transit

Operations

Side Door Drags Yes

Doors Open

Outside/Wrong Side

Yes

Use of Personal

Protective Equipment

Yes

Bulletins and Notices No

Safeguarding Authority

Assets

No

Division of Station

Environment

Procurement Card

Administration

Yes

Station Maintenance

Operations

Yes

Station Cleaning

Operations

No

Vehicular Inspections

and Operations

No

Use of Personal

Protective Equipment

Yes

Injury on Duty

Prevention

Yes

Injury on Duty

Procedures

No


Scheduling

Yes

Division of Station

Environment


Compliance

Yes

Safety Training Yes

Track Flagging Yes

Fare Media Sales –

Revenue Accountability

Yes

Fare Media Sales –

Station Agent Safety

and Security

Yes

Division of Station

Environment

Random Drug and

Alcohol Testing

Yes

Operations Support/Safety

Unit


Program

Yes

Scheduling of Safety

Training

Yes

Scheduling of Medical

Examinations

Yes

_______________________________________________________________________






Department of

Subways


Unit

Track Flagging Yes

Random Drug and

Alcohol Testing

Yes


Security Numbers

Yes

Efficiency Test Program Yes

Division of Car Equipment

Procurement Card Use /

Payment Reconciliation

Yes

Business Travel No

Material Forecasting for

SMS

Yes

Yard Safety Procedure No

Shop Safety Procedures No


Security Numbers

Yes


Program

Yes

Random Drug and

Alcohol Testing

Yes

Staten Island Railway

Employee and Customer

Safety

No

Payroll, Timekeeping

and Attendance -

Various Department

Yes

Signal Inspection No

Track and Switch

Inspection

Yes


Security Numbers -

Employee

Accident/Injury Reports

Yes


Security Numbers -

Personnel and Related

Employee Records

Yes


Program

Yes

Department of

Security

Access to Loading Docks

& Receiving Areas -

Livingston Plaza

Yes

_______________________________________________________________________






Department of

Security

Challenging for Pass ID

Policy and ProcedureYes

Visitors Policy and

Procedure - Jay St. and

Livingston Plaza

Yes


Security NumbersYes

Verifying Employee

Drivers LicensesYes

Electronic Access

Control FunctionalityYes

Readiness of NYCT

Weapons of Mass

Destruction HazMat

Team

Yes

WMD Detection

Equipment

Functionality

Yes

Safeguarding Agency

AssetsNo

Department of Buses

Random Drug Testing No

Fuel Reconciliation Yes

Fuel Sampling Yes

Fuel Delivery Yes

Pre-Trip Inspection No

Bus Accident

Procedures

Yes

Bus Operator

Observations

Yes

Central Maintenance

Facility Inspections

No

Central Maintenance

Facility Safety

Inspections

No

Scheduled Program

Maintenance

No

Daily Security

Inspection

Yes

Manage Contract

Dollars

No

_______________________________________________________________________






Department of Buses

Paratransit – Vehicle

Accountability

Yes

Material Purchases No

Material Purchases

Authorization

No

Project Management

Review & Approval

No

Spill Prevention Control

Countermeasure (SPCC)

Policy & Procedures

Yes

SPCC Inspections No

Spill Containment

Reporting

Yes

Department of

Capital Program

Management

Contractor Payments

Verification

No

Additional Work

Orders(AWO’s)

Verifications

Yes

National Environmental

Policy Act Review of

Projects for Federal

Funding

Yes

Estimating/Cost Control

Compliance

Yes

Schedule Control

Compliance

No

Department of the

Executive Vice

President

Office of the Controller

MaBSTOA Pension

Death Benefit Payments

No

Protecting Social

Security Numbers

No

Administration and

Recording of MaBSTOA

Employee Pension

Loans

No

Preparation of Bidder

Evaluations

Yes

Control Letters of

Credit

No

_______________________________________________________________________






Department of the

Executive Vice

President

Office of the Controller

Control and Coordinate

the Recording, Analysis

and Disbursing of Third

Party Contract

Payments and

Documentation

No

Receipt, Recording, and

Timely Billing of all

Force Account

Expenditures

Yes

Process Release of

Retainage

Yes

Process Final Payments Yes

Quarterly Forecast of

Actual to Budget

Expenses

No

Reconciliation of PSR

Authorized Positions to

Active Employee Listing

Yes

Oversee the Internal

Control Program

Yes

Oversee the Controlling

and Safeguarding of

NYCT Furniture and

Equipment

No

Review Authority-Wide

Policy/Instructions (P/I)

Yes


Security Numbers

Yes

Office of Management and

Budget

Report Ridership

Statistics

Yes

Quarterly Hiring Plan No

Monthly Reports to the

MTA Board

Yes

Personnel Strength

Report

Yes

Protecting Social

Security Numbers and

Other Sensitive

Information

Yes

Procurement Card

Administration

Yes

_______________________________________________________________________






Department of the

Executive Vice

President

Division of Operations

Planning

Ensuring that NYCDOT

Bills for Bus Stop

Changes are in

Accordance with

NYCT’s Bus Stop

Contract, are Accurate,

and Adhere to the

Budget

No

Division of Supply Logistics

Vendor Receipts Yes

Issuance of Material to

End Users

Yes

Receipt and Issuance of

Tools

Yes

Control of High

Pilferage Items

No

Receipt and Issuance of

Gas and Diesel Fuel

Yes

Division of Materiel

Material Information

Reporting

Yes

Distribution of Sensitive

Procurement

Documents

Yes

Monitor Vendor On-

Time Performance

No

Maintain an Effective

Staff Summary Process

Yes

Award of Contractual

Options and

Modifications

Yes


Security Numbers and

Other Sensitive

Information

No

Procurement Card

Administration

No

Division of Revenue

Control

Transport and Secure

MetroCard Vending

Machine (MVM)

Revenue

Yes

Process MVM Revenue Yes

Transport and Secure

Subway Booth Revenue

Yes

_______________________________________________________________________






Department of the

Executive Vice

President

Division of Revenue

Control

Process Subway Booth

Revenue

Yes

Oversee the Operation

and Maintenance of

Security

Equipment/Systems at

Revenue Control

Facilities

Yes

Provide Oversight

Contracted Armed

Security Services for

Protection of Revenue,

Fare Media, &

Employees

Yes


Program

Yes

Procurement Card

Administration

No

Safeguard/Control

Debit/Credit Card Info

No

Division of Technology &

Information Services

Develop/Maintain the

Automated Fare Control

Application

No

Maintain the AFC

Store/Forward Sys

Reporting

Station/Depot/Bus Data

Farecard Sales and

Usage

Yes

Develop and Maintain

the Capital Accounting

and Payments System

No


the MABSTOA Pension

Payroll

Yes


the MABSTOA

Miscellaneous Payment

System

Yes

_______________________________________________________________________






Department of the

Executive Vice

President



Develop, Maintain and

Monitor the Unified

Timekeeping System

(UTS) Application

No

Manage the

Implementation and

Testing of the Public

Address/Customer

Information System

(PA/CIS) Phase II

Project for 156 Stations

on the IRT Division

No

Maintain the Unified

General Order System

(UGOS)

Yes

Maintain the Automatic

Train Supervision,

Subdivision A (ATS-A)

System

No

System Maintenance of

the 63rd Street

Queensborough

Connection

No

Monitor the

Implementation,

Testing and

Commissioning of the

Communication Base

Train Control (CBCT)

System

Yes

Maintain the Paratransit

Dispatch and

Scheduling System,

(ADEPT)

Yes

Maintain the Fire Safety

System Application

Yes

Maintain Code

Repository and Migrate

Application Changes via

SCLM (Software

Configuration Library

Management)

No

_______________________________________________________________________






Department of the

Executive Vice

President



Maintain Code

Repository/Migrate

Application Changes via

Harvest Labor Deviation

System, Payroll,

KRONOS, RRS, UTS,

CMS Apps.

Yes

Verification and

Approval of IBM

Invoices for Payment

Yes

Production of Payroll

and Pension Checks

No

Protect Info & Sensitive

Data – Data Loss

Prevention

No

Security Monitoring and

Mainframe Applications

Yes

Provide Disaster

Recovery NYCT Virtual

Server Environment 2

Broadway Livingston

Plaza Data Centers

Yes

Protect Sensitive and

Confidential Data

Yes

Manage the UNISYS

Contract for SLA 3.2.2

Asset Tracking

(Hardware) – Contract #

03A8602-2

Yes

Manage the UNISYS

Contract for SLA 3.2.5

Asset Tracking

(Software) – Contract #

03A8602-2

Yes

Manage the UNISYS

Contract for SLA 4.2.4 -

Timely Completion of

Service Requests –

Contract# 03A8602-2

Yes

_______________________________________________________________________






Department of the

Executive Vice

President



Manage the UNISYS

Contract for SLA 4.3.1 –

Timely Resolution of

Severity Level 1

Problems – Contract #

036A8602-2

No

Manage the UNISYS



Severity Level 2


036A8602-2

No

Manage the UNISYS



Severity Level 3


036A8602-2

No

Verification and

Approval of UNISYS

Invoices for Payment on

Contract# 03A8602-2

No

Division of Human

Resources

Administer

Procurement Card

Usage

Yes

Maintain Protection of

Social Security Numbers

Yes

Administer MaBSTOA

Pension Payments

Yes


Program

Yes

Drug and Alcohol

Testing

Yes

Work Life Services No

Infectious Waste

Disposal

No

_______________________________________________________________________






Office of Equal

Employment

Opportunity

Investigate Complaints

of Employment

Discrimination Filed by

Employees and Job

Applicants –Pre-

complaint and/or Intake

Process

Yes

Investigate Complaints

of Discrimination Filed

by Customers –Pre-

complaint and/or Intake

Process

No

Prepare Letters from the

President Concerning

NYCT’s EEO, Sexual

and the Other

Discriminatory

Harassment and Respect

in Workplace Policies

Yes

Protect and Safeguard

Social Security Numbers

Yes

Prepare/Submit Biennial

EEO - 4 Reports to the

Equal Employment

Opportunity

Commission on Gender,

Race, Ethnic

Demographics of

NYCT’s Workforce

Yes

Eliminate the Hard-

Copy Distribution of

Documents and Reports

in Favor of Electronic

Distributions

Yes

Monitor all Applications

for Dual Employment

for Compliance with

NYC Transit Policy

Yes

Safeguard NYC Transit

Assets

No

_______________________________________________________________________






Department of Labor

Relations


Security Numbers

Yes

Use of Procurement

Card

No

Department of

Corporate

Communications


Security Numbers

No

Office of System

Safety (OSS)

Site Evaluations of Large

Quantity Generators of

Hazardous Waste

Yes

Policy/Instruction

Compliance Oversight

Yes

Contract Management/

Administration

Yes

Job Task Evaluations Yes

Chemical Product

Evaluations

Yes


Program - Data Analysis

Yes


Program – Reporting

Yes


Program – Audits

Yes


Program - P/I

Maintenance

Yes

Mercury Bulb Recycling

Contract Management/

Administration

No

Safeguarding Authority

Assets

No

NYS Department of

Labor (DOL) SH-900

Summary Report

Yes

NYS Department of

Labor (DOL) SH-900

Log Report

Yes


Security Numbers

Yes

_______________________________________________________________________






Office of System

Safety (OSS)

Dual Employment No

Procurement Card

Administration

No

OSS Managed Asbestos

Abatement

Yes

CPM Managed Asbestos

Abatement

No

Investigate Collisions

and Derailments

Yes

Investigate Fatal

Employee Accidents

Yes

Investigate “Near Miss”

Incidents

Yes

Investigate Multiple

Injury Bus Collisions

Yes

Investigate Fatal

Accidents

Yes

Investigate Mechanical

Failures and Bus Fires

Yes

Witness the Acceptance

Testing of Fire

Detection and

Suppression Systems

Yes

Perform Fire and Life

Safety Oversight of

Operating Procedures

and Policies

Yes

Joint OSS/TWU Track

Safety Inspections

No

_______________________________________________________________________




Part 3. Material Weakness or Significant Deficiencies

Revealed During the 2013-14 Review Process

MTA – Enterprise

Subsidiary Subdivision

Enterprise N/A

Business Process

WAR Certificate

Weakness/Deficiency: Within HQ’s Capital Budgeting system (Impact), the Centrak

module which identifies the current WAR funding on Capital Projects, was not in

agreement with the PACMAN module, which interfaces with the BSC PeopleSoft

system that processes Capital Payments, which caused the WAR Certificates to go

into suspense because of the differences. Without the appropriate changes being

made to the contracts in PeopleSoft, there is a risk that improper payments can be

made where funding is not budgeted because of excess balances in PeopleSoft. In

addition, in the long term the contracts could not be closed out as needed, because

they were in suspense.

Corrective Action: The current Capital Budget and Payment process needs to be

reengineered to ensure critical controls over Capital funds are working efficiently and

effectively. While the backlog of WAR’s in response has been successfully reduced.

A review of this process is needed so that it can be re-engineered to achieve

efficiencies, and reduce the potential for future errors.

MTA – Headquarters – Material Weakness/Substantial Deficiency

There were no material weakness or significant deficiencies revealed during the 2013-

14 review process.

MTA Bus Company – Material Weakness/Substantial Deficiency


MTA Bus Company Bus Operations

Business Process

Fuel Administration/Fuel Reconciliation

_______________________________________________________________________




MTA Bus Company – Material Weakness/Substantial Deficiency

Weakness/Deficiency: Several locations identified variances between allowable and

actual limits which were not properly reconciled.

Corrective Action: Revised the Policy. Trained employees in revised policy.

Required reconciliations to be properly performed at the depot level and that

variances outside prescribed limits are reported to the division.

MTA Bridges and Tunnels – Material Weakness/Substantial Deficiency

MTA Bridges and Tunnels conducted 146 internal control reviews in 2013, including

a number of safety audits in accordance with the All-Agency Safety Initiative. There

were no significant deficiencies revealed during the 2013-14 review process.

MTA Capital Construction– Material Weakness/Substantial Deficiency

There were no material weakness or significant deficiencies revealed during the 2013-

14 review process.

MTA Long Island Rail Road – Material Weakness/Substantial Deficiency


Engineering Department Administration

Business Process

Accident Reporting and Counseling

Weakness/Deficiency: All AR1s, except three were entered timely into the Accident

Control System (ACS) within 48 hours. Seventy-seven out of 80 AR-20/21s took an

average of less than 17 days for final copies to be signed off by the Chief Engineer and

forwarded to the LIRR Claims Bureau & System Safety. Three AR-20/21’s took 155,

56 & 55 days to enter due to an expansion of investigation scope. Seven AR20/21s

took 30 days or more to finalize because the scope of the investigation was increased,

thereby delaying processing. Overall, the AR-20/21 reporting timeline has decreased

between 2013 (18 days) and 2014 (17 days) as investigating supervisors continue to

improve efforts in obtaining information, performing safety counseling, determining

root cause, and following up with effective and practical remedial/preventive actions.

Submission of AR30’s continues to improve also. Several departments are providing

safety counseling to employees after each accident, including Motor Vehicle

_______________________________________________________________________





Accidents (MVA’s). Additionally, MV-104s are regularly completed & submitted

within 24 hours of the MVA.

Corrective Action: Engineering Administration continues to monitor, instruct and

remind personnel on the importance of submitting documentation properly,

completely and on a timely basis. The Chief Engineer has notified all departments

that they need to shorten the time it takes to complete and submit AR20/21s.

Departments have again been reminded to report all injuries immediately even if

there is confusion over sick vs. accident classification.


Law Administration

Business Process

Administration and Management – Management Comp Time

Weakness/Deficiency: The department tested the controls for monitoring

compliance using May 6 and May 19, 2013 to verify whether compensatory time was

earned, charged, and approved according to policy. CTAMS was used to verify that

compensatory time was recorded, charged, or expired. Testing revealed that not all

2013 documentation supporting compensatory time authorization was available as the

department did not maintain the documentation.

Corrective Action:

The activity manager has been instructed, and agreed, to maintain all documentation

related to approvals and usage of compensatory time for five years.


Transportation Administration

Business Process

Time and Attendance

Weakness/Deficiency: Yardmaster employees often work overtime at the beginning

or end of their shifts. In order to be paid, they are required to complete a Yardmaster

Time Slip, which should identify overtime hours worked, describe tasks performed

and indicate overtime approval. In order to test the controls, 39 time slips submitted

_______________________________________________________________________





during May through August 2013 were reviewed. This review revealed that five

employees were paid overtime without the supervisor’s approval. For two of the five

employees, the time slip simply referred to an agreement as a justification for the

overtime.

Corrective Action: Transportation agrees that all Yardmaster Time Slips should be

approved by a manager and will re-instruct them to sign and print their names on the

forms. Additionally, the department will develop an “authorization sheet” listing

authorized managers who may sign the slips. Payroll Dispatchers will refer to the

listing to verify authorization. Employees will be notified of the revised procedure

via email and a Policy & Procedure will be implemented by the end of the 3rd Quarter

2014. With the introduction of paperless time slips, scheduled for roll out by the 1st

Quarter 2015, this issue will be addressed.

For those yardmaster employees earning overtime during training, the department

will perform random audits, starting at the end of the 3rd Quarter 2014, to ensure

claims are paid accurately. In addition, as previously mentioned, with the roll-out of

paperless time slips, the Manager-Equipment & Energy will be the authorizing

manager and will be responsible for ensuring the time slips are accurate.


Office of Security Vehicle Fleet Operations

Business Process

Vehicle Fleet Maintenance

Weakness/Deficiency: An MTA Audit found that user departments were not

responding to VFO notifications of overdue inspections. Further four trailers assigned

to the Track Department could not be accounted for during the performance of the

audit.

Corrective Action: LIRR Management will install a GPS system to track the

movement of trailers. Additionally, the VFO has implemented a process to ensure

that the report from Automotive Resources Inc. (ARI) properly recognizes inspection

codes to accurately reflect vehicles due for inspection. This will also enhance the

controls over the VFO’s inspection notification process.

_______________________________________________________________________






Office of Security Vehicle Fleet Operations

Business Process

Vehicle Invoice Processing

Weakness/Deficiency: An MTA Audit found that the VFO was not reconciling the

monthly invoices against ARI purchase orders and Maximo work orders to avoid

possible duplications or overcharges of repairs. MTA Audit recommended that the

VFO perform a reconciliation of ARI monthly billing Invoices and match the work

orders generated in the Maximo Inventory System to ARI purchase orders appearing

on the monthly invoice.

Corrective Action: In the 2nd Quarter 2013, the VFO department implemented the

recommendation by activating “Require Client Authorization when purchase orders

exceed limit” features of ARI application. This enhances the controls over

authorizations.


Department of Program Management Central Administration

Business Process

Commissioning, Acceptance and Maintenance Plan (CAMP)

Weakness/Deficiency: An MTA Audit found that four of 27 projects reviewed had

not complied with the CAMP procedure as required. The CAMP procedure is a

quality-focused plan to ensure that the major project assets fulfill their intended

purposes and that the commissioning, maintenance, acceptance and warranty

requirements of facilities, equipment and systems are consistent with the needs of the

LIRR. MTA.

Audit recommended that Capital Program procedures be amended to include criteria

conditions and approval procedures for granting construction projects full exemption

or waivers from CAMP. It was also recommended that program managers be

instructed to use the Components and Systems Turn Over (CSTO) document when

CAMPs are required.

_______________________________________________________________________





Corrective Action: By the 3rd Quarter of 2014, Department of Program Management

will include requirements for allowing CAMP waivers to Capital Program Procedures

645. Additionally, management will instruct program managers to use CSTO forms

when CAMPs are required.


Department of Program Management Project Planning &Controls

Business Process

Project Plan Implementation: Develop, Assemble and Revise a Project Plan for

approval

Weakness/Deficiency: Some of DPM’s active projects did not have an updated Risk

Assessment Plan filed with the Central Administration group, as required.

Corrective Action: It is recommended that going forward, the Tracking Log be

modified to include the Chief Program Officer‘s sign-off dates and the Plan’s revision

number. Also on a Quarterly basis, if Risk Plan updates are not submitted by the

Project Manager, DPM Central Administration will be required to send a notification

to the Assistant Chief Program Officer with a copy to the Chief Program Officer.


Human Resources Employee Services

Business Process

Alcohol and Drug Testing Program

Weakness/Deficiency: An MTA Audit performed during 2013 found that while

drug and alcohol testing was performed randomly and spread throughout the year,

none of the tests were performed on weekends or major holidays as federal

regulations required that tests be performed in a non-predictable manner. Therefore

MTA Audit recommended that Human Resources work with the operating

departments to ensure that random drug and alcohol testing is performed as

scheduled on Saturdays, Sundays and holidays.

Corrective Action: Management agreed with the recommendation. In the 2nd

Quarter of 2014, Employee Services met with management in Transportation Services

to discuss how the department can support random testing on Sundays and holidays,

and to reinforce the need to spread testing throughout the week.

_______________________________________________________________________







Business Process

Alcohol & Drug Testing Program

Weakness/Deficiency: MTA Audit Services noted that Federal Motor Carrier Safety

Administration (FMCSA) random drug and alcohol tests within Engineering are

routinely scheduled at the beginning of employee work shifts. Therefore, they

recommended that Engineering perform random FMCSA drug and alcohol tests at

different intervals (such as the middle and end of employee work shifts) in order to

provide a measure of deterrence throughout an employee's work day.

Corrective Action: Recommendation was implemented. Starting June 2014, random

drug and alcohol tests were scheduled at different intervals, including mid-shift and

end-of-shift testing.



Business Process


Weakness/Deficiency: A review revealed that two Transportation employees

selected in November 2013 for FRA random testing were not tested due to

insufficient manpower available to cover the selected train crew (both of whom

worked the overnight third trick). Therefore, MTA Audit Services recommended

that Human Resources Employee Services work with Transportation Services to

explore options and corrective actions to ensure that Transportation employees are

randomly tested within the selection cycle.

Corrective Action: In the 2nd Quarter of 2014, Employee Services met with

management in Transportation Services to discuss the issues cited in the audit report

and to reinforce the need to send employees for random testing as scheduled within a

selection cycle. Additionally, going forward, Employee Services will request that

Transportation Services document the specific circumstances if a test is not performed

on the scheduled date, and that they ensure that subsequent attempts are made

until the test is completed.

_______________________________________________________________________







Business Process


Weakness/Deficiency: MTA Audit Services reviewed a random sample of 50

Alcohol Testing Forms (25 for each random program) for completeness and found

that 6% (three forms) were missing required information. Specifically, two forms

did not contain the signature ("certification") of the employee. One form was not

signed by the Breath Alcohol Technician and did not indicate the technician's name.

Therefore, they recommended that Human Resources Employee Services reinstruct

the Breath Alcohol Technician regarding the findings noted in the audit, and that it

also takes other required actions as defined in DOT regulation 49 CFR Part 40. In

addition, Human Resources Employee Services should implement controls going

forward to ensure the completeness of DOT Alcohol Testing Forms.

Corrective Action: Management agreed with the recommendation. In the 2nd

Quarter of 2014, the Breath Alcohol Technician was reinstructed on the importance

of accurate completion of Federal testing forms. Additionally, action was taken by

Employee Services to correct the cited forms, in accordance with DOT Regulation

Section 40.271 b(I ); in order to avoid having to cancel the tests.


Safety & Training Occupational &


Business Process

State Agency Environmental Audits

Weakness/Deficiency: LIRR is charged with adhering to requirements established by

the State Agency Environmental Audit (SAEA) Program (Program). The Program

provides the basis for conducting annual environmental audits of its facilities, projects

and operations and reporting the results to the New York State Department of

Environmental Conservation (DEC). The Safety Department conducts annual

_______________________________________________________________________





meetings with the departments to plan the Program for the coming year, however

opening and closing meetings are not documented via minutes. The meetings should

be documented so all parties are aware and in agreement with steps to be taken to

implement the Program. Also, SAEA files contained questionnaires that were missing

responses to non-LIRR related questions.

Corrective Action: The Safety Department began documenting opening and closing

SAEA meetings via minutes. It also instructed project managers not to leave any

questions on the questionnaire unanswered. Both corrective actions were

implemented May 2014.


Safety & Training Occupational &


Business Process

Petroleum Bulk Storage Tank Management Program

Weakness/Deficiency: All five Underground Storage Tank (UST) tightness reports

were missing the tank's Petroleum Bulk Storage (PBS) number making it difficult to

associate the results of reports to the correct tanks.

Corrective Action: Safety re-instructed the vendor to fill out reports completely by

including the PBS number. This was completed May 2014.


Safety & Training Safety Operations

Business Process

Maintenance of Personal Protective Equipment (PPE) Approved Product List (APL)

Weakness/Deficiency: The Safety Department reviews and approves all PPE on the

Approved Product List (APL) and ensures that it meets current standards and is

included in the PPE catalog. However, this process is not sufficiently documented.

_______________________________________________________________________





Corrective Action: The Safety Department will revise this process to ensure that

review and approval of PPE is documented. Estimated date of completion is 1st

Quarter of 2015.


Safety & Training Safety Operations

Business Process

Internal and External Outreach Programs

Weakness/Deficiency: The Safety Department is responsible for implementing

various targeted outreach programs. For example, the T.R.A.C.K.S Program (Together

Railroads and Communities Keeping Safe) is a joint venture between Corporate Safety

and the MTA PD reaching out to schools, camps, day care facilities and community

groups stressing the importance of safety at grade crossings and the dangers of being

on or near the tracks. Operation Lifesaver is a joint venture between the Safety

Department and the MTA PD, in conjunction with LIRR’s Transportation Services

Department, the Public Transportation Safety Board (PTSB), and the Federal Rail

Administration (FRA). In 2013 over 7,000 pamphlets were distributed to pedestrians

and motor vehicle users and 16 system-wide events were held to educate the public

on the laws aimed at preventing pedestrians and motor vehicles from going around

lowered gates at railroad crossings. Internally, the ROWTF (Right-of-Way Task

Force) is a joint operation/partnership between the Safety Department and MTA PD

to review trend analysis and conduct real time patrols to identify potential security

breaches, homeless conditions, illegal dumping, encroachments, and trespass

conditions on LIRR property. Identified conditions are abated through coordinated

oversight of clean ups, enforcement, community education, and Right of Way

hardening (fencing). The Safety Department periodically reviews its Outreach

presentations and also establishes future goals for the Program, but documentation of

these reviews and projected goals was missing. Documentation should be

maintained to track the progress and success of the presentations for future reference

as well to monitor that goals set for the Program are reached.

Corrective Action: The Safety Department will revise this process to ensure the

review of Outreach presentations and establishment of Program goals is documented.

Estimated date of completion is 1st Quarter of 2015.

_______________________________________________________________________






Safety & Training Fire Marshal

Business Process

Corporate Fire/Life Safety Compliance Investigations & Audits

Weakness/Deficiency: The Office of the Fire Marshal (OFM) performs inspections to

ensure that the LIRR is in compliance with applicable codes, regulations and

corporate policies. Any deficiencies are recorded on the Office’s internal Fire

Inspection Corrective Action Form FM2. The FM2 form is then provided to user

department representatives responsible for taking corrective action. The OFM uses

an Annual Inspection Tracking Spreadsheet, which is populated based on the FM2

and used as the repository of all property inspections, deficiencies, and corrections.

According to the review, some information captured on the inspection forms FM2

was not entered on to the tracking spreadsheet. The spreadsheet needs to be

complete since it is the tool that OFM uses to ensure all deficiencies are addressed and

corrective actions are implemented.

Corrective Action: Effective immediately, the OFM will ensure all information from

FM2's is entered on to the tracking spreadsheet. In addition, the OFM is working

collaboratively with IT and MNR to procure a software solution to improve the

inspection and documentation process which would include a formal database to

replace the spreadsheet.



Business Process

Investigate and evaluate fires for causes and possible trends

Weakness/Deficiency: The OFM investigates and evaluates fires for causes and

possible trends with the goal of preventing recurrences of similar incidents. Follow-

up on the implementation of corrective actions resulting from fire investigations was

not documented. OFM needs to document and track corrective actions related to the

prevention of fire incidents to ensure they are implemented.

_______________________________________________________________________





Corrective Action: The Safety Department will implement a process to track the

completion of recommendations and corrective actions resulting from fire

investigations. Estimated date of completion is 4th Quarter of 2014.



Business Process:

The OFM conducts emergency response outreach training and drills with local

agencies that respond to emergencies on LIRR equipment e.g., M3/M7/C3/Diesel

Locomotives and at LIRR properties e.g., Welfare Facilities and Sub-Station Buildings.

OFM invites local Fire, Police and EMS units to receive training on how to protect

them when working on LIRR property and with LIRR equipment; prepare for

coordinated operations during rail emergencies; and ensure the safety of

customers/employees/general public.

Weakness/Deficiency: The Safety Department did not document its invitations to

outside entities to participate in LIRR training sessions. Also, information regarding

fire drills by the LIRR held during 2013 was not documented. Proper documentation

needs to be maintained occurring.

Corrective Action: The OFM will implement a process to document invitations to

outside agencies for LIRR training and fire drills held in a given year. Estimated date

of completion is 4th Quarter of 2014.



Business Process

Train Fire Wardens in First Aid, CPR & Automated External Defibrillation (AED).

Weakness/Deficiency: The OFM recruits employees interested in volunteering as

Fire Wardens and receiving associated Life Safety training. However, testing revealed

that the OFM did not have a current list of Fire Wardens and thus no evidence of

verification of meetings regarding receiving Life Safety training. It is important that

the OFM maintains such a list to ensure all necessary Fire Wardens are in place and

made aware of their roles and responsibilities during an emergency.

_______________________________________________________________________





Corrective Action: The Safety Department will implement a process to maintain a

current list of LIRR Fire Wardens and document meetings regarding receiving Life

Safety training. Estimated date of completion is 4th Quarter of 2014.


Safety & Training Safety Performance and

Hazard Assessment

Business Process

Internal Safety Performance Reporting

Weakness/Deficiency: Safety provides required reporting based on its evaluation of

conditions in an effort to improve the safety of employees, customers and the general

public. Testing revealed FRA Form 97, to be provided at the request of the FRA for

rail accidents & incidents, was not prepared in 2013. Safety needs to be in compliance

by making this data available every year at the FRA’s request.

Corrective Action: FRA form 97 will be prepared for 2014 to be provided at the

request of the FRA. Estimated date of completion is 4th Quarter of 2014.


Safety & Training Safety Performance and

Hazard Assessment

Business Process

System Safety Program Plan (SSPP) Maintenance/Conformance Evaluations

Weakness/Deficiency: The Safety Department maintains the SSPP per the APTA

Manual for the Development of System Safety Program Plans for Commuter Railroads

and ensures the safety of Employees/Customers/General Public and compliance with

regulations. However, the annual audit to be performed by Safety of the SSPP to

ensure conformance with and provide required updates as per APTA Standards and

anticipated FRA Rail Safety Improvement Act of 2008 (RSIA) Regulations was not

performed.

Corrective Action: The Safety Department will implement a strategy to implement

the SSPP audit. Estimated date of completion is 2nd Quarter of 2015.

_______________________________________________________________________






Safety & Training Training & Development

Business Process

Ensure Safety Department Instructors are Qualified

Weakness/Deficiency: Corporate Training is responsible for ensuring that all

instructors are up to date in their certifications. The review revealed that

spreadsheets used to track current employee certifications contained outdated

information and included certifications not applicable to the classes being taught.

Corrective Action: Certifications will be checked quarterly with effective dates

revised to reflect current status. Estimated date of completion was June of 2014.


Maintenance of Equipment Quality Assurance & Control

Business Process

Quality Control (QC) Inspections of Periodic Inspections, RCM, Fleet Modifications,

etc. performed in Maintenance of Equipment repair shops

Weakness/Deficiency: Maintenance of Equipment Quality Control performs

Periodic Inspections, Running Repair, Reliability Centered Maintenance,

Modifications, etc. in the Car Shops, Support Shops and Yards to verify workmanship

and compliance to regulations, specifications and documentation. Testing of the QC

process related to Support Shop Rebuilds detected deficiencies in management

reporting of inspection results. Specifically, some data was not transferred from

check lists to summary reports, multiple recordkeeping errors were uncovered and

monthly rebuild report summaries were missing from September - December 2013.

Corrective Action: On May 1, 2014, the QC Manager re-instructed staff with regard

to in-house recordkeeping, filing and accurate data transfer procedures.


Maintenance of Equipment Corporate Administration

Business Process

Management of Compensatory (Comp) Time

_______________________________________________________________________





Weakness/Deficiency: LIRR corporate policy requires that compensatory time

worked be pre-approved. Testing revealed that some Comp Time forms were not

submitted to Central Manpower in a timely manner so they were not available for

review during testing.

Corrective Action: Central Manpower re-instructed staff and addressed the issue

with the group at a Quality Control meeting to ensure the timely record-keeping and

processing of Comp Time approval forms. MofE managers were also provided with

the Corporate Compensatory Time Policy.


Strategic Investments Corporate Administration

Business Process

Management of Compensatory (Comp) Time

Weakness/Deficiency: LIRR corporate policy requires that compensatory time

worked be pre-approved. Testing revealed that three (3) out of five (5) Comp Time

forms were not submitted for Comp Time worked.

Corrective Action: Going forward the secretary will remind staff that Comp Time

forms are required for each instance of Comp Time and will ensure all forms are

approved and filed. At year end, a departmental Comp Time report will be generated

from CTAMS and cross-referenced against Comp Time forms on file.

MTA Metro-North Railroad – Material Weakness/Substantial Deficiency


Administration Human Resources

Business Process

Avoidance of Nepotism

Weakness/Deficiency: As a result of an MTA OIG Report, MNR’s hiring process

and procedure was deemed deficient in that the influence of family members/relatives

in hiring decisions was able to occur in certain instances.

_______________________________________________________________________





Corrective Action: A new MTA All-Agency Anti-Nepotism Policy was issued in

September of 2013. As of December 2013, MNR HR has implemented a combination

of forms, conflict checks and justification memos to ensure that employees are

prevented from being involved in the hiring process of family members and relatives

and that successful candidates are hired solely on the basis of merit and qualifications.

A training program on the policy and new procedures has been developed and is

currently being delivered to employees who are involved in the hiring process.



Business Process

Dual Employment

Weakness/Deficiency: The results of a NYS OSC Audit in 2013 found that MTA

employees were not complying with the rules governing outside employment while

employed with an MTA Agency. Several MNR employees were identified in this

Audit as having been out of compliance and appropriate corrective actions and

discipline were taken with these employees. Communication and recordkeeping

improvements were also noted.

Corrective Action: A memo covering dual employment and other ethics and

conflicts of interest topics was distributed to all employees by the General Counsel in

January of 2014. The employee newsletter and other employee communication

channels have also been utilized to reinforce key dual employment messages.

Recordkeeping and process improvements are being implemented.



Business Process

Family and Medical Leave Case Management

Weakness/Deficiency: The results of an MTA Audit review of FMLA found that

controls over the FMLA process were not adequate and needed to be significantly

strengthened. Improvements were needed to streamline current practices, enhance

compliance with FMLA requirements, and improve recordkeeping.

_______________________________________________________________________





Corrective Action: A new FMLA Administrator has been designated and is

working on process and administrative improvements, including a new written

procedure. Human Resources and IT personnel are upgrading the interface between

timekeeping systems and BSC PeopleSoft systems which will improve FMLA

management and monitoring.



Business Process

Military Leave Management

Weakness/Deficiency: This item remains from the 2012-2013 review. The

results of an NYS OSC Audit issued in 2013 found that controls in place were not

consistently capturing relevant information for proper recordkeeping, accurate

payment and proper reconciliation. Communications between departments,

employees and Human Resources (HR) was found to be lacking as well. As a result of

staff turnover, and changes in internal processes, the corrective action still remains in

progress.

Corrective Action: A Human Resources Analyst was assigned to administer

Military Leave at MNR. The issues with the internal processes are still being

addressed. A comprehensive Policy and guidelines are still being developed with

MTA Headquarters, and other MTA agencies. This will clarify how reduced salary

payments are to be calculated, the proper documentation to be maintained to support

those calculations, and the proper documentation to be maintained in the employee’s

file. This also needs to address employees who fail to submit the necessary paper work

to support their military service.


Administration Occupational Health Services

Business Process

Safeguard Employee Medical Records

Weakness/Deficiency: Of the 86 files requested from the vendor for control

testing, 7 were unavailable. The vendor had no record for 5 of them and 2 were later

found to be in use within OHS.

_______________________________________________________________________





Corrective Action: OHS is reviewing the file management practices of the vendor

in order to determine the appropriate corrective action to take.



Business Processes

Provide Mandated Employee Training for Operations Services Employees

Provide Mandated Employee Training for Maintenance of Equipment Employees

Provide Mandated Employee Training for Maintenance of Way Employees

Weakness/Deficiency: In its Operation Deep Dive Review, the Federal Railroad

Administration (FRA) found that the overall training of Metro-North employees is

inconsistent and often fragmented. The FRA directed that Metro-North evaluate the

structure, organization, and responsibilities of the Training Department to ensure it

develops, implements, and leads an effective training program for all operating

departments.

Corrective Action: To reduce fragmentation and ensure a coordinated training

program across Metro-North, Training & Development will be responsible for

oversight of all training functions at the railroad. This will be accomplished in stages,

through a phased transition. As an immediate step, for training functions currently

handled by departments other than Training & Development, Metro-North is

establishing a strong matrix reporting relationship from the head of the training

function in each department to the Senior Director, Training & Development. Also,

Training, Operations, and Safety are developing a phased strategic plan for the

reorganization or restructuring of training functions at Metro-North as appropriate.



Business Processes




_______________________________________________________________________





Weakness/Deficiency: In its Operation Deep Dive Review, the Federal Railroad

Administration (FRA) found that Metro-North’s training records system, the MTA-

wide PeopleSoft Enterprise Learning Management (ELM) system administered jointly

by the Business Service Center (BSC), is burdensome and inefficient, and that its

ability to serve as an effective system of training records management is questionable.

The FRA directed that Metro-North evaluate the existing recordkeeping system and

take corrective action, as necessary, to ensure accurate records are created,

maintained, and readily accessible to appropriate employees.

Corrective Action: MTA Information Technology (IT) and the BSC are working

with Metro-North’s Operations, Engineering, System Safety and Training

Departments to develop and implement a solution that will provide the required

functionality for effective tracking and reporting of employee training and

certifications. The overall goals include ensuring effective and reliable reporting that

satisfies regulatory as well as operating requirements; facilitating the identification

and tracking of certification status, including projected expiration; easing general

access and use of critical information by managers and support staff across the

organization; and streamlining data entry and reporting processes.



Business Processes


Weakness/Deficiency: As part of its Operation Deep Dive Review, the Federal

Railroad Administration (FRA) recommended that Metro-North establish a

mentoring program to enhance the training of new train and engine service

employees.

Corrective Action: Metro-North Training and Development, in conjunction with

the Operations Services Department, has significantly enhanced the mentoring

program for Locomotive Engineer trainees and established a parallel mentoring

program for Conductor trainees. The labor agreements are now in place, and the

programs are being piloted.



_______________________________________________________________________





Business Processes


Weakness/Deficiency: In its Operation Deep Dive review, the Federal Railroad

Administration directed MNR to improve the quality and consistency of training for

employees who maintain rolling stock, as one of the directed actions for blue signal

protection for employees.

Corrective Action: Metro-North Training and Development, in conjunction with

Metro-North M of E, has already implemented initial improvements to blue signal

protection training delivered to all employees, and additional improvements will be

made on an ongoing basis. In addition, MNR Training and Development is

developing a new Supervising for Blue Signal Protection training program, focused on

those who supervise others in the implementation of blue signal protection.



Business Processes


Weakness/Deficiency: As part of its Operation Deep Dive Review, the Federal

Railroad Administration (FRA) directed that Metro-North improve the quality and

consistency of training for track inspectors and other engineering department

employees, as part of an overall Metro-North training program.

Corrective Action: Metro-North’s Training and Development and Maintenance

of Way Departments have partnered to bring a vendor on board to deliver track

inspection training and mentoring services. This training is currently underway.

Metro-North Training and Development is also working to increase in-house staffing

available to deliver training to Maintenance of Way employees.


Controller Passenger Revenue

Accounting

Business Process

Ticket Refund Management

_______________________________________________________________________





Weakness/Deficiency: A recent MTA Audit of ticket refunds found that the

process and controls are in need of improvement. Certain procedures were not

consistently being followed, and system reporting capabilities were hampered by

incomplete data input.

Corrective Action: Written procedures have been updated and reinstruction of

staff has taken place where needed. Passenger Revenue Accounting (PRA)

Management is working with IT to upgrade the Refund/Claims database in order to

streamline the process for reviewing and approving refunds.


Maintenance of Equipment M of E Administration

Business Process

Manage M of E Vendor Contracts

Weakness/Deficiency: As a result of service contract audit, MTA Audit found

that the procedures for processing and reviewing invoices needed to be strengthened

in the Maintenance of Equipment Department (M of E).

Corrective Action: M of E has developed new written procedures and is

establishing an invoice review process that requires users to verify that the services

and products charged for have been provided, and that the amounts charged are in

accordance with contract pricing.


Maintenance of Way Communications & Signals

Business Processes

Grade Crossing Inspection and Maintenance

Signal Inspection

Weakness/Deficiency: As a result of the Federal Railroad Administration’s (FRA)

Operation Deep Dive review, the recordkeeping system used by MNR for signal and

grade crossing tests and inspections was deemed deficient. The lack of an efficient

electronic system to capture and record signal and grade crossing test and inspection

information could lead to insufficient testing/inspections or tests not being performed

according to their assigned schedules.

_______________________________________________________________________





Corrective Action: The Communications and Signals Department is working

with several outside vendors on a pilot program to create an electronic system for

recording inspections, tests, and results. The first phase of work to be done by the

end of the year is to evaluate the vendors’ capabilities based on the identified needs

and requirements. The new system will enable improved scheduling and monitoring

of signal and grade crossing inspection and testing.


Maintenance of Way Grand Central Terminal

Business Process

GCT Inventory

Weakness/Deficiency: As a result of both MTA Audit and internal reviews, the

process for handling Grand Central Terminal (GCT) materials and inventory

continues to be deemed deficient. Controls are in need of strengthening in order to

ensure accountability and safeguarding of materials. A process and system for tagging,

tracking and monitoring of material that is being received, stored in inventory, and

used has not been fully developed and implemented.

Corrective Action: As of December 2013, a position was established to monitor

requisitions for new GCT material and help ensure that items that exist in inventory

are used first prior to additional material orders being placed. Organizational and

staffing changes have slowed down further progress on the larger process and system

changes that are needed.


Maintenance of Way Operating Capital

Business Process

Management and Monitoring of Diesel Fuel

Weakness/Deficiency: An audit of Metro-North’s Diesel Fuel management

revealed the possibility of discrepancies in delivery quantities and the amounts billed

for. Vendors in some cases did not provide information about delivery truck annual

inspections, or meter calibrations, and in some cases were lacking required safety

equipment. Fuel samples also indicated that some of the fuel was not in compliance

with all environmental specifications.

_______________________________________________________________________





Corrective Action: Metro-North is in the process of filling a management

position that will oversee energy management, including fuel. The new position and

group will strengthen the ability of MNR to monitor, assess, and ensure proper

accountability for diesel fuel. Metro-North is reviewing all requirements and will

update the contracts, and future RFP’s accordingly.


Maintenance of Way Operating Capital

Business Process

Management and Monitoring of Heating Fuel

Weakness/Deficiency: A 2013 audit of Metro-North’s Heating Fuel Contract

revealed that some vendors were not in compliance with the terms and conditions of

the contract. The audit noted the contract requires that vendors comply with all state

and federal environmental laws with fuel specifications and delivery of fuel. The

invoice billing and reconciliation process was insufficient and not in compliance with

MTA guidelines. Written procedures to ensure vendor compliance were found to be

lacking.

Corrective Action: Metro-North management will take steps to improve the

heating oil invoicing verification and reconciliation process. Environmental

specifications (ES-001) have been updated. Delivery of heating fuel guidelines, as well

as an updated list of delivery contacts will be on file and a part of a comprehensive

Strategic Energy Management Plan. The updated environmental requirements and

specifications will be included in future heating fuel bid documentation.


Maintenance of Way Track & Structures

Business Process

Equipment Run Track Inspection

_______________________________________________________________________





Weakness/Deficiency: As a result of several operational incidents and subsequent

external reviews in 2013-14 (National Transportation Safety Board, Transportation

Technology Center, Inc. (TTCI) and the Federal Railroad Administration’s (FRA)

Operation Deep Dive), MNR’s Equipment Run Track Inspection process and related

follow-up actions was deemed deficient. The level and type of equipment run

inspections was determined to be inadequate for the size and condition of MNR’s

territory.

Corrective Action: The Track Department is expanding the number of equipment

run inspections that will be performed, as well as adding additional types of

equipment run inspections, including machine vision inspections. MNR is in the

process of procuring an Autonomous Track Geometry Inspection System (ATGIS),

which will be mounted on passenger rail cars and provide continuous information

about the condition of the right-of-way. In addition, equipment run inspection

information is being recorded and tracked in a new database which is used to ensure

corrective actions are implemented and that sign-off by Supervisors has taken place

on all FRA inspections.



Business Process

Facility Inspection

Weakness/Deficiency: As a result of an MTA Audit of Facility Maintenance, the

need for a dedicated resource for Facility Inspections was identified.

Corrective Action: As the first step towards improvements to facility inspection

and maintenance, a dedicated position will assist the Department in prioritizing and

managing maintenance work and requests based on inspection results. In December

of 2013, a Facility Inspector was hired.



Business Process

Facility Maintenance and Repair

_______________________________________________________________________





Weakness/Deficiency: As a result of an MTA Audit of Facility Maintenance, a

number of deficiencies were identified in the following areas of Facility Maintenance

and Repair: maintenance requirements; time standards and the tracking of

maintenance completion; and effectiveness of the Asset Management System (AMS)

for monitoring cyclical as well as corrective maintenance requests and work

completed.

Corrective Action: Track and Structures Management will develop a Strategic

Cyclical Maintenance Program Plan to prioritize MNR facilities through a tiered

system based on their criticality to railroad operations. Improvements to maintenance

requirements, time standards, and the monitoring and tracking of maintenance

activities will focus on first tier facilities, and the hiring of a Facility Inspector

referenced above is a first step towards realizing these improvements. Enhancements

will also be made to AMS to increase its effectiveness as a monitoring tool which will

assist in the transition to the MTA-wide Enterprise Asset Management initiative over

the next several years.



Business Process

Track Maintenance and Repair




Operation Deep Dive), MNR’s process used for Track Maintenance and Repair and

related follow-up actions was deemed deficient. The process did not provide

management with an effective way to record scheduled/unscheduled maintenance

and repairs; ensure corrective actions had taken place; or identify and analyze trends.

Management and staffing concerns were also raised in the reviews and are being

addressed through a comprehensive reorganization of the Track Department.

Corrective Action: The Track Department is working with the IT Department to

develop an Interim Asset Management Solution which will be an electronic

management system focused on inspections, scheduled/unscheduled maintenance and

repairs and will include reporting capabilities to track the completion of activities in

the field.

_______________________________________________________________________







Business Process

Visual Track Inspection




Operation Deep Dive), MNR’s process used for Visual Track Inspection and related

follow-up actions was deemed deficient. The manual, paper-intensive process for

recording inspections and found defects made follow-up and close-out of required

actions difficult to track, and therefore, did not provide management with an

effective way to: prioritize defects; ensure corrective actions had taken place; or

identify and analyze trends. Management and staffing concerns were also raised in

the reviews and are being addressed through a comprehensive reorganization of the

Track Department.

Corrective Action: The Track Department is working with the IT Department to

develop an Interim Asset Management Solution which will be an electronic

management system focused on inspections, scheduled/unscheduled maintenance and

repairs and will include reporting capabilities to track the completion of activities in

the field.


Operations Operating Rules

Business Process

Administer the Drug and Alcohol Testing Program

Weakness/Deficiency: As a result of an MTA Audit, it was determined that the

frequency of the re-evaluation of covered positions and the random selection pool

needed to be increased. The audit also noted deficiencies with respect to

recordkeeping and that the records which ensure the appropriate testing rates are

being met should be clearly documented on an ongoing basis throughout the year.

_______________________________________________________________________





Corrective Action: Operating Rules in conjunction with Operations

Administration and the Safety Department has re-evaluated the covered positions. In

addition, improvements to documentation, including the documentation of monthly

progress towards meeting the required testing rates, is being implemented.


Operations Operating Rules

Business Process

Efficiency Testing Program

Weakness/Deficiency: As a result of the Federal Railroad Administration’s (FRA)

Operation Deep Dive review, deficiencies were noted with MNR’s federally mandated

Efficiency Testing Program, which ensure that covered employees are performing

their required functions as intended. The review identified four areas in need of

improvement: testing and monitoring, compliance with stop signals, training, and

recordkeeping.

Corrective Action: MNR made immediate changes to the Efficiency Testing

Program in order to bring the program into compliance. Training of testing officers

has been completed, and a strengthening of the General Road Foreman’s Office will

ensure the appropriate types and frequency of testing is taking place. In addition,

enhancements to program record keeping and analysis of test results are in

development.


Operations Operations Administration

Business Process

Monitoring of Fuel Cards and Fuel Usage

Weakness/Deficiency: As a result of both MTA Audit and internal reviews, the

controls over fuel card usage for non-revenue vehicles and fuel dispensed into cans

for gasoline-powered equipment were deemed deficient.

_______________________________________________________________________





Corrective Action: There has been a review of fuel cards and a reduction in the

overall number of cards along with adjustments to the limits on cards. The

implementation of Automated Vehicle Location Monitoring (AVLM) in all non-

revenue fleet vehicles will allow Operations management to more accurately monitor

fuel usage as AVLM data, fleet management data and fuel management system data

will be integrated. Exception reports will be developed and investigated in order to

increase the level of monitoring and accountability of fuel usage for non-revenue

vehicles and gasoline-powered equipment.


Operations Services Finance, Administration &

Crew Management

Business Process

Capital Support

Weakness/Deficiency: As a result of an Office of the State Comptroller Audit and

subsequent internal review, the process for recording and tracking Conductor Flag job

assignments and determining the length of a Conductor Flag’s job assignment on any

particular day was deemed deficient. The manual process lacked certain controls and

information about the jobs which could result in inaccurate payments to Conductor

Flag personnel.

Corrective Action: MNR is in the process of developing a software tool which

will track and record all aspects of Conductor Flag jobs from inception through

completion. This system, known as the Job Ordering Tracking System, will provide an

auditable electronic record of the job “design” (which will clearly state the scheduled

overtime requirements) as well as employee job assignments and deviations from the

scheduled assignments. It also provides an audit trail for any daily deviations that can

be referenced when OSD field supervisors determine the appropriate pay for the

Conductor Flag for that day. This system is expected to be completed by the end of

the year, and while it is being developed there is a temporary process in place for

documenting the job design which serves as pre-approval for the use of overtime.


Safety N/A

Business Process

System Safety Program Plan (SSPP)

_______________________________________________________________________






external reviews in 2013-14(National Transportation Safety Board (NTSB) and the

Federal Railroad Administration’s (FRA) Operation Deep Dive), it was determined

that MNR’s Safety and Security Department needed to be restructured. The FRA

review called for the evaluation of the structure, organization and responsibilities of

the Department.

Corrective Action: The evaluation of the Department has resulted in the redesign

of a new Office of System Safety (OSS), which is completely separate from the

Security functions. The expansion of the new OSS will address weaknesses identified

in the reviews, and new and/or redesigned and reorganized functional units

responsible for the following areas are being created: Risk Reduction; Field

Operations; Safety Support and Data Analysis; Investigations; and Fire Safety and

Emergency Management. Additional staff is currently being hired to ensure these

functions are appropriately resourced.

Fundamental to the new OSS’s work is the updating of the System Safety Program

Plan (SSPP) which establishes the core Safety programs, policies and initiatives which

will drive changes and improvements in the safety culture at MNR.

MTA New York City Transit – Material Weakness/Substantial Deficiency


Department of Subways Maintenance of Way/Track

Business Process

Track Cleaning

Weakness/Deficiency: The station track cleaning goal was not met in 2013

primarily due to a shift in manpower allocation to Intensive Track Bed Cleaning.

Additional sources of error are attributable to changing conditions during the year in

which certain sections of track required immediate attention and thereby took

priority over scheduled work. Fastrack work also resulted in schedule changes.

_______________________________________________________________________





Corrective Action: All track bed cleaning that was scheduled but not completed

in 2013 will be rescheduled and completed by the end of the second quarter of 2014.

In addition, management will review the schedule for 2014 and modify cleaning

goals/plan in accordance with current priorities including Fastrack.



Business Process

Safety Training and Use of Personal Protective Equipment

Weakness/Deficiency: Testing revealed that 532 Track employees did not

complete the required Right-to-Know Training and 638 Track employees did not

complete the required Safety Training.

Corrective Action: A memorandum will be drafted immediately by the Assistant

Chief, to be issued by the Chief by no later than 03/31/14, instructing all field

Supervisors to notify the Training Liaison/Scheduler immediately if/when an

operating employee misses a scheduled training date. This will allow for quicker

rescheduling of those employees who are past due for training and an improvement in

the compliance rate.



Business Process

Hearing Conservation Program (HCP)

Weakness/Deficiency: The lists that were submitted semi-annually to the Office

of System Safety were not updated to reflect current information regarding HCP

participants in 9 out of 13 (69%) instances. During 2013, 404 (29%) out of 1,410

(71%) Track Maintenance HCP participants did not receive the required annual

training and audiometric testing.

Corrective Action: Under the review and supervision of a Superintendent, semi-

annual submittals to the Office of System Safety will be fully updated. A new training

liaison has been assigned to assume the responsibilities related to the training and

testing of individuals in the HCP. Active employees who missed training and testing

in 2013 will be rescheduled to complete training and testing by 6/01/2014. Non-

active personnel will be trained and tested upon their return to paid status.

_______________________________________________________________________






Department of Subways Maintenance of

Way/Infrastructure

Business Process

Track Flagging

Weakness/Deficiency: An audit performed by OSS in 2013 showed that 6 (22%)

out of 27 job sites did not use proper flagging techniques.

Corrective Action: To reduce the error rate and better train the Night

Supervisors for 2014, Infrastructure Night Managers will make unannounced

documented Safety Flagging audits. During these audits, Managers will observe and

Instruct the night Supervisors on how to better implement a safety-compliant work

zone.



Way/Infrastructure

Business Process

Random Drug and Alcohol Testing

Weakness/Deficiency: All Infrastructure groups have their own log books,

leading to discrepancies in recordkeeping. The review showed that only 64 out of 162

Logbook Entries (40%) indicated the time of receipt of notification.

The review of the Random Testing Program Compliance Unit’s (RTPCU)

Infrastructure Report indicated a 75% compliance rate. Out of 320 random reviews

conducted, 81 G-46 issue times were missing.

Corrective Action: The deficiencies cited are primarily related to recordkeeping

issues (versus compliance with appropriately sending employees for testing according

to proper procedure). A Memorandum will be drafted by 03/31/14 for the Chief to

issue to all subdivision managerial and supervisory staff outlining the policies and

procedures associated with Random Drug and Alcohol Testing and the importance of

the following:

- Recording Time of Receipt of Notification in logbooks

- Retaining copies of signed “Random Testing Guidelines and

Acknowledgement Forms” in employee files.

- Providing a complete documentation to the RTPCU.

_______________________________________________________________________







Way/Electrical-Power

Business Process

Emergency Response

Weakness/Deficiency: A review of the 2013 Annual Inspection Report for

emergency generators revealed that 136 of 204 (67%) scheduled monthly inspections

were not completed as required.

Corrective Action: In 2014 there will be a Utility Crew created to improve the

monthly inspections and maintenance requirements.



Way/Electrical-Signals

Business Process

Safety Training and Use of Personal Protective Equipment (PPE)

Weakness/Deficiency: Five (5) unannounced field visits to Signals locations,

revealed that 2 locations did not have the “Check Safety” or contain the required

current signage, safety grams and notices. In 2013, 35% of required Signals employees

did not complete the Organic Solvents and Coats, Adhesives and Sealants training.

Corrective Action: All General Superintendents, Superintendents and

Supervisors will be reinstructed, via memo, to distribute safety material/posters in a

timely manner as well as monitor Signal Section Bulletin Boards as required.

The names of employees who are past due for “Organic Solvents” (Code SS36) and

“Coats, Adhesives and Sealants” (Code SS37) training will be provided to Signals

General Superintendents by 2/28/14. The target date for completion of past due

training is 12/31/14.

Signals will also send additional employees for PeopleSoft Training in order to

increase the number of personnel capable of entering completed Right-to-Know

Training Course information into the system.

_______________________________________________________________________







Way/Electrical-Signals

Business Process


Weakness/Deficiency: A review showed that 49 (28%) out of 177 employees in

the Signals HCP did not attend the Audiometric exams.

During the scope of the review, it was revealed that Division of Signals Supervisors

are not documenting their verbal instructions to employees regarding the quiet-time

requirement.

Corrective Action: Division of Signals Managers will create a database to track

and monitor to ensure 100% participation in the mandated Annual Training and

Audiometric Testing. Managers will be provided with the list of the past-due

employees by the IC Tester and instructed to schedule these employees for testing

and training immediately or upon the employees’ return to active service.

Supervisors will be required to documented on the G-46 and informing the employee

of the 14-hour Quiet-time.


Department of Subways Maintenance of Way/Elevators

and Escalators (E&E)

Business Process

Safety Training and Use of Personal Protective Equipment

Weakness/Deficiency: The review revealed that 43 E&E employees did not

complete the required Right-to-Know Training and 108 E&E employees did not

complete the required Safety Training.

Corrective Action: By 03/01/14, a memorandum will be sent out by the Chief to

instruct all field Supervisors to notify their respective Training Schedulers

immediately when one of their operating employees misses a scheduled training date.

_______________________________________________________________________






Department of Subways Maintenance of Way/Elevators

and Escalators (E&E)

Business Process

Procurement Cards

Weakness/Deficiency: The review revealed that 1 (20%) out of 5 cardholders

submitted Monthly Activity Forms and Statements without proper signatures, and

approvals. In addition, 13 (25%) of 53 Monthly Statements did not have complete sets

of supporting documentation, including receipts and forms.

The review also indicted that 1 (20%) out of 5 did not comply with the stated policy.

Corrective Action: The MOW Procurement Card Coordinator will re-issue the

MOW Centralized Policy for Expenditure Approval as well as a copy of Materiel

Department Procedures DPM-III-E. Also, effective for year 2014 purchases,

cardholders will receive all their original receipts and the centralized procurement

desk will hold copies only.


Department of Subways Division of Rapid Transit

Operations (RTO)

Business Process

Fire and Smoke Conditions/Fire Prevention

Weakness/Deficiency: Management’s review revealed 1,609 out of 2,521

employees were scheduled and attended Fire Prevention training. However 912

(36%) employees who should have been scheduled for training were not and did not

attend.

Corrective Action: Service Delivery/Rapid Transit Operations/Facilities and

Safety Management will support continued aggressive hiring which will allow the

scheduling of Fire Prevention Training/Refresher for one-third of the hourly and

supervisory employees each year.


Department of Subways Division of Rapid Transit

Operations (RTO)

_______________________________________________________________________





Business Process

Fire and Smoke Conditions/Emergency Response and Evacuation

Weakness/Deficiency: The Management review indicated that 2,521 employees

were to be scheduled for Fire Prevention Training but only 1,609 employees were

actually scheduled and attended, while 912 (36%) employees were not scheduled. In

addition, multiple forms were being used for the inspection of crew quarters resulting

in a lack of control over inspections. Also, 2 out of 24 Lines had not posted the Fire

Evacuation plans.

Corrective Action: Service Delivery/Rapid Transit Operations/Facilities and

Safety Management will hire additional staff which will allow Scheduling of fire

prevention training/refresher to selected hourly and supervisory employees each year.

Service Delivery/Rapid Transit Operations/Facilities and Safety Management will

utilize one standard form for the Weekly Crew Quarters Inspection Form. Locations

will be re-visited to ensure that Emergency Action Plans have been posted.


Department of Subways Division of Stations

Environment

Business Process

Fire and Smoke Conditions/Fire Prevention

Weakness/Deficiency: Management’s review of 862 Fire Prevention and

Evacuation training records concluded that 100 (11.6%) employees did not attend Fire

Prevention and Evacuation training when scheduled.

Corrective Action: Conduct an internal campaign utilizing mass calls, bulletins

and posters to reinforce the importance of attend training. Management will also

partner with the union to inform employees of the importance of attend training

classes and the possible ramifications of failing to comply.



Environment

Business Process

Fire and Smoke Conditions/Emergency Response and Evacuation

_______________________________________________________________________





Weakness/Deficiency: The review of 1 Fire Prevention Training Report

concluded that 100 (11.6%) out of 862 employees, 88 assigned to Station Operations

and 12 Terminal Operations did not attend the Fire Prevention Refresher training.

Corrective Action: Conduct an internal campaign utilizing mass calls, bulletins,

and posters to reinforce the importance of training. Also, management will partner

with the union to inform employees of the importance of attending training classes

and the possible ramifications of failing to comply.



Environment

Business Process

Hearing Conservation Program-Scheduling

Weakness/Deficiency: The review of the Hearing Conservation Training Records

revealed that 293 employees were scheduled for the Specialty Cleaning training, and

22 (7.5%) did not attend. For Terminal Cleaners, the records indicate 49 employees

were scheduled and 9 (18%) did not attend.

No disciplinary action was taken with employees that failed to attend training or

audiometric testing, as is required.


and posters to reinforce the importance of training. Partner with the union to inform

employees of the importance of attending training classes and the possible

ramifications of failing to comply. Interview employees who do not comply

concerning the importance of monitoring employees exposed to workplace noise level

that can lead to hearing loss.



Environment

Business Process

Safety Training

_______________________________________________________________________





Weakness/Deficiency: The Safety Training Records review revealed that 383 of

1,671 (23%) employees did not attend Asbestos Training. In addition, 2,372 of 11,423

(21%) employees did not attend Right-to-Know modules 1, 2 and 3 training.

There was no disciplinary action was taken for not complying with Safety Training

mandates.

Corrective Action: Station Environment will conduct an internal campaign

utilizing mass calls, bulletins, and posters to reinforce the importance of training.

Stations will also partner with the union to inform employees of the importance of

attending training classes and the ramifications of failing to comply.


Department of Subways Division of Service Delivery-


Business Process


Weakness/Deficiency: Management’s review and monitoring of employee

attendance records for compliance with Hearing Conservation Training and Hearing

Conservation Testing for employees revealed the following which did not comply

with training mandates:

- Hearing Conservation Training: 22 (7.5%) employees assigned to

Specialty Cleaning and 9 (18%) of Terminal Cleaners did not attend training

when scheduled.

- Audiometric Testing: 39 (9.3%) employees assigned to Specialty

Cleaning and 2 (4.0%) of Terminal Cleaners did not attend audiometric

training.

- No disciplinary action was taken with Station and Terminal Cleaners that did

not comply with training and Audiometric Testing.

Corrective Action: Stations Environment will conduct an internal campaign

utilizing mass calls, bulletins, and posters to reinforce the importance of training;

partner with the union to inform employees of the importance of attending training

classes and the possible ramifications of failing to comply; and, interview employees

who do not comply concerning the importance of monitoring employees exposed to

workplace noise level that can lead to hearing loss.

_______________________________________________________________________






Department of Subways Division of Service Delivery-


Business Process

Scheduling/Safety Training

Weakness/Deficiency: The review of 2,120 employee training records by

Management indicated that 194 (9.1%) employees were not in compliance with

mandated training.


and posters to reinforce the importance of training; partner with the union to inform

their employees of the importance of attending training classes and the ramifications

of failing to comply.


Department of Subways Division of Staten Island

Railway

Business Process

Payroll, Timekeeping & Attendance (various departments)

Weakness/Deficiency: The SIR Finance department did not reconcile the

paycheck disbursements register, the BSC upload (excel spreadsheet) and the source

documents (exception claim forms and punch cards).

The findings indicate that hours recorded on 7% of the paychecks on the SIR Daily

Summary Sheet exceeded the hours recorded on the Punch Cards/Daily Roster

Sheet/Exception Claim Forms.

The review also found that 17 out of 359 (5%) employees Punch Cards, Daily Roster

Sheets and documents supporting explanations for employee’s absences could not be

located and there was no procedure in place for reconciling the actual attendance

records with scheduled hours.

_______________________________________________________________________





Corrective Action: SIR Finance Department will perform monthly

reconciliations between the paycheck disbursements Register and the BSC upload

spreadsheet, and on a periodic basis reconcile the source documents (exception claim

forms and punch cards) to be BSC upload spreadsheet. In addition, it will investigate

the overtime variance and seek a recovery of the overpayment. Additionally, they

will formally re-instruct timekeeping personnel to maintain all source documentation

supporting timekeeping and overtime activity.



Railway

Business Process

Protection of Social Security Numbers: Employee Accident/Injury Report

Weakness/Deficiency: Due to office renovation/relocation, files that contain

social security numbers were temporarily stored in a non-restricted access area.

Corrective Action: The SIR contract for the new leased area includes the

installation of cameras throughout the facility, electronic door swipes and an alarm

system in the secure areas designated for employee document storage.

Once SIR management was apprised of the situation involving the non-compliance

with restricted access to the files containing employees’ social security numbers, the

following measures were implemented immediately:

- All employees files were transferred to locked storage cabinets

- SIR employees moved into the new work area and non-employees

(contractors) were disallowed access to the file storage.

- SIR management will move files to a secured off-site storage facility or to a

NYCT secured location in the event that a similar situation arises.

Lastly, Staten Island Railway will evaluate its internal documentation retention policy

by 06/01/14 to determine compliance with NYCT’s document-retention policy. Once

completed, all files and documents that exceed the retention period will be sent to the

Livonia Storage Facility by 12/31/2014.



Railway

_______________________________________________________________________





Business Process

Protection of Social Security Numbers/ Personnel and Related Employee Records

Weakness/Deficiency: The inspection of the file storage area revealed that due to

the office renovation/relocation, SIR temporarily stored files containing social

security numbers in areas with non-restricted access. The review further revealed

that there is no written procedure outlining locked storage of the facility, the file

cabinets and alarm system. Also the review indicated that SIR kept reports and

documents longer than the required retention requirement period.

Corrective Action: Cameras will be installed throughout the new facility in

addition to electronic door swipes and an alarms system in the areas designated for

employee document storage.

SIR management immediately transferred all employees’ files to a secured area with

locked storage cabinets to address the non- compliance with restricted access to the

employees confidential files. Non-employees are no longer permitted to access to the

file storage rooms.


Department of Buses N/A

Business Process

Depot Maintenance/Vehicle Accountability

Weakness/Deficiency: The lack of oversight by management in 8 of 21 depots

resulted in reconciliation sheets not being reviewed and approved. In addition, the

Facility Rotation sheets were not attached to the yard package during the first two

quarters of testing and vehicle accountability sheets were not signed by the

supervisor.

Corrective Action: All depot supervision and management were reinstructed on

the vehicle accountability policy.

All Yard Dispatchers, vacation relief and extra list personnel were re-instructed on

Vehicle Accountability procedures after the audit results for the first three quarters.

Rotation sheets are now used to ensure vehicle accountability sheets are accurate. The

supervisor who failed to sign the vehicle accountability sheet was re-instructed by the

General Superintendent of Transportation.

_______________________________________________________________________







Business Process

Fuel Administration/Daily Fuel Reconciliation

Weakness/Deficiency: The review of 24 Daily Summary Reports found 9 samples

that were not reviewed or approved by Management, 3 of which were not completed

properly as required. In addition, the lack of oversight by depot personnel and depot

management resulted in the improper preparation of fuel tracking forms.

Lack of supervisory oversight resulting in information not being documented,

completed and reviewed as required.

Corrective Action: Depot personnel were re-instructed on the proper form and

approval requirements.

The General Superintendent (GS) of Maintenance will ensure that the Line

Supervisor documents the reasons why any information is missing or not completely

correctly. The GS will also ensure that SPEAR is routinely checked for information

that initially was not available. All information obtained and documented will be

reviewed and signed off by the GS.



Business Process

Fuel Administration/ Fuel Sampling

Weakness/Deficiency: During the first quarter of 2013, three diesel fuel sample

manifests were not signed by the appropriate level of management in 3 of 20 depots,

due to non-compliance with policy.

Corrective Action: Line Supervisors were re-instructed to verify that all

documentation for diesel fuel samples be reviewed and signed-off by management.



_______________________________________________________________________





Business Process

Fuel Administration/ Fuel Delivery Procedures

Weakness/Deficiency: In the first and second quarter of the year, the review

revealed a total of six Diesel Fuel Delivery Checklists that were not fully completed

during the time of delivery in 7 of 15 depots.

Corrective Action: All depot Line Supervisors were re-instructed on the Diesel

Fuel Delivery Policy for the proper completion of diesel fuel delivery

documentations.



Business Process

Environmental Compliance/Spill Containment Reporting

Weakness/Deficiency: A review of the Depot’s Spill Form/Log revealed that one

spill occurred during the 2013 operating year. However, the Command Center was

not notified, as is required. Fuel procedures stipulate that all spills are to be reported

to the Command Center.

Corrective Action: General Superintendent of Maintenance was re-instructed on

the proper procedures for reporting and documenting spills that occur in the depot.


Department of the Executive Vice President Division of

Telecommunications &

Information Services (“TIS”)

Business Process

Coordinate Disaster Recovery (DR) drills

Weakness/Deficiency: A review of the DR plan status for all critical systems was

conducted between January and October 2013 and revealed the following:

- There were 162 applications which are categorized as critical with a recovery

time objective of 24 hours or less. Of this total, 55 applications (34%) do not

have a DR plan.

_______________________________________________________________________




-


Corrective Action: The NYCT DR unit in coordination with Contract

Management will review Problem logs and perform detailed root cause analyses in

order to implement appropriate remedial measures. As a part of the contract

agreement, revised DR plan will be tested in the re-drill scheduled for March 11,

2014.


Department of the Executive Vice President Division of TIS

Business Process

Manage the Unisys Contract for SLA 3.2.2 Asset Tracking (hardware) –

Contract # 03A8602-2

Weakness/Deficiency: Due to manpower shortages in Contract Services and

Account Management (CSAM), the Vendor’s operational data reports have not yet

been reviewed and transmitted to NYCT Materiel Division, Technology Contract

Management.

Corrective Action: By the end of 1st Quarter 2014, CSAM will review the SLA

3.2.2 reports so they can be transmitted to NYCT Materiel Division, Technology

Contract Management.



Business Process

Manage the Unisys Contract for SLA 3.2.5 Asset Tracking (software) –





Management.

Corrective Action: CSAM will review the reports by the end of 1st Quarter 2014

so they can be transmitted to NYCT Materiel Division, Technology Contract

Management.

_______________________________________________________________________







Business Process

Manage the Unisys Contract for SLA 4.2.4 – Timely Completion of Service Requests –





Management.

Corrective Action: CSAM will review the reports by the end of 1st Quarter 2014

so that they can be transmitted to NYCT Materiel Division, Technology Contract

Management.


Office of System Safety N/A

Business Process

Hearing Conservation Program – (HCP) Reporting

Weakness/Deficiency: The Department of Buses (DOB) submittal contained

omissions (i.e., entries were not made in the appropriate fields/and or missing data).

The DOB’s Bronx, Brooklyn, Manhattan, Queens , Staten Island Divisions and Central

Maintenance Facility, and SIR submittals indicated noncompliance due to lack of

adequate employee participation in HCP training and/or audiometric testing.

Corrective Action: OSS met with DOB’s Vice President and HC Representative

to discuss the deficiencies. OSS sent memos to the Department Heads outlining

deficiencies.

_______________________________________________________________________




Part 4. The Internal Control Program Details 2013-14

MTA Headquarters

Annual “Risk Assessments” were conducted by all departments where major business

activities were risk ranked and controls over those risks identified. Cycle testing is

used where all “high risk” items are reviewed annually and medium to low risk

ranked items are reviewed on a cycle of once every three years to once every five

years depending on rank level. In each previous cycle risks were adjusted up or down

to reflect changed conditions.

The vulnerability assessments from the prior year were sent to all departments and

reviewed with their Internal Control Coordinators.

As to items to be tested, each department with the assistance of the Internal Control

coordinator and the Internal Control Officer determined what the standards will be

for testing in their department. These standards must be consistent with the training

and re-training which the coordinators received from the Internal Control Officer on

testing.

Most test results were reviewed with department management. All test results were

reviewed by the Internal Control Officer. Items for which corrective actions were

required were noted and monitored. If any substantive issues were found they were

raised to the attention of senior management.

MTAHQ management is required to respond to each audit recommendation with a

corrective action plan detailing steps that have or will be taken to address the

recommendation. Since 2009 Corporate Compliance has monitored all outstanding

audits and reports to the MTA Audit Committee all audit recommendations that have

exceeded their planned implementation date by six months or more.

Quarterly requests to appropriate individuals for updates on the status of corrective

actions are performed.

Audit recommendations, corrective action plans and the vulnerability assessments are

stored electronically. MTA has begun to move the information to its new GRC

platform which will reduce paper, allow easier follow up via e-mails, maintain a

historical record, and allow easier transfer of information. Corrective actions that

have exceeded their implementation generate an email to both the individual

responsible for implementation and to Corporate Compliance.

_______________________________________________________________________




MTA Headquarters

During 2013-2014 MTAHQ instituted a number of initiatives to sustain the

effectiveness of the internal control program. MTAHQ provided extensive training to

staff on how to utilize the GRC applications. Corporate Compliance continued a

project to map all regulatory disclosure requirements with their corresponding

business processes in GRC.

MTA Bus Company

The Chief Officer, Internal Studies and Operation Improvement is responsible for the

overall internal control program. The Director, Internal Controls manages the

program on a day-to-day basis. The Director is assisted by an Analyst. The Director

coordinates the internal control program with liaisons in each department. The

Director provides annual training to the liaisons and ongoing assistance and

mentoring through the year. Automated records of all aspects of the program are

maintained. In recent years, the Director has re-engineered many of the program

steps to provide increased structure and consistency. The Director will continue to

evaluate the program for further opportunities for economies and efficiencies.

MTA Bridges and Tunnels

The MTA Chief Compliance Officer disseminates information related to activities of

the Office of the State Comptroller with respect to internal controls at the quarterly

ICO meetings. Information regarding any significant changes is then provided to

applicable staff at all levels.

All information on vulnerability self-assessments, internal control testing, and

corrective action plans is captured and documented centrally and entered into one

PC-based tracking system. A component of this system documents the corrective

actions planned or taken. The documentation of corrective action plans are

periodically reviewed by the ICO for appropriateness as well as for open items. Based

on this review, the ICO requires DICCs to follow up with departmental management

to ensure that corrective action was taken as reported, and if not resolved, continue to

report changes in the status of these actions until they are resolved.

_______________________________________________________________________





All departments establish a detailed risk-based testing plan that closely links control

testing frequency to the relative risk defined in each department's vulnerability

assessment. This allows managers to better plan for and allocate resources for testing.

Using this plan, each department establishes goals for testing with the ICO at the

beginning of the year. Subsequent progress against those goals is reported monthly by

the ICO to the President.

Once activity managers perform control testing, the results of such testing are

reported to the ICO, after the respective DICC and Department Head have reviewed

the tests and signed off on the document. These enhancements have continued to

increase both the number and quality of internal control testing performed and

reported on each year.

In addition, MTA B&T has implemented, on its Intranet site, a section dedicated to

the B&T Internal Control Program. This section includes an Intranet based training

program for employees to obtain, on-line, basic awareness of internal control

concepts. It also contains B&T and MTA All-Agency Policies, internal control related

forms, and other information on the Internal Control Act, and internal control

standards and techniques.

In December 2013, a detailed classroom-based course on implementing the B&T

Internal Control Program and compliance with the Internal Control Act was provided

to selected managers.

In 2014, the effectiveness of departmental compliance with the B&T Internal Control

Program will be further reviewed, including evaluations of the adequacy of

vulnerability assessments and quality of internal control testing performed. Effective

the end of 2014, the B&T Internal Control Program will be interfaced into the

Compliance Management Software System (GRC).

_______________________________________________________________________




MTA Capital Construction

The Internal Control Program at MTACC is coordinated by the Director of Internal

Controls with assistance from the ICC. The program is ongoing and includes a

periodic review and self-assessment of MTACC’s functions and the processes used to

assure that objectives are achieved. Program areas and departments are required to

establish a detailed risk-based testing plan that closely links control testing frequency

to the relative risk defined in each area’s vulnerability assessment. This plan allows

managers to allocate resources for testing. Using this plan, each area establishes goals

for testing with the ICC/ICO. The results of testing are reported to the ICO. Based on

the results of the tests a corrective action implementation plan is proposed for the

subsequent certification period.

Projects currently managed by MTACC, with an estimated value of over $16, billion,

are funded in part through the FTA and are therefore subject to additional scrutiny.

Supplemental testing of project management controls for these projects are performed

by an independent engineering firm(s) hired by the FTA. Their recommendations are

incorporated into MTACC’s testing program.

MTACC capital project and program management activities are performed in

accordance with uniform methods, standards, procedures and guidelines (established

by MTACC, NYCT Capital Program Management and MTA Headquarters), to assure

that project management activities are performed efficiently and in a manner that

best serves the interests of MTACC.

MTACC’s system of internal control is based on New York State laws, including

standards developed by the State Comptroller such as: Standards for Internal Control

in New York State Government.

The Standards for Internal Controls in New York State Government and MTA

Agency Wide Enterprise Risk Management and Internal Control Guidelines, are the

source for MTACC’s training on internal controls. MTACC’s training program also

refers to applicable provisions of the Public Officers Law, including rules on ethics

and conflicts of interests. Included in the training materials is the Managers Guide

for testing compliance with internal control requirements. Where applicable, we

incorporate recommendations made by the New York State Internal Control Task

Force report.

Key features of the MTACC internal control program include:

Identifying, reviewing, and testing controls used to manage risk.

Developing and implementing corrective action plans where applicable.

_______________________________________________________________________





Documenting control reviews, procedures, policies, and standards of operation for

key business activities.

Disseminating appropriate internal control information to employees, including

relevant departmental procedures.

The ultimate objective of the program is to provide reasonable assurance that

MTACC’s operations are functioning effectively and efficiently, and that

department goals are being achieved.

Information is communicated (for all projects) between and among all levels at

MTACC to help the Agency achieve its objectives in areas such as project

management, quality assurance, financial reporting and compliance. Operations are

monitored in two ways: through ongoing or continuous monitoring of activities and

through regular evaluations. The information received as a result of this monitoring

process is communicated to appropriate management.

The ongoing or continuous evaluations are performed by the respective Program

Managers, Project Managers, Design / Construction Manager, Construction

Coordinators, Field Engineers and field personnel at site locations. These individuals

are responsible for verifying and documenting that the contractor is completing the

project according to contract specifications. For example, production meetings are

scheduled on a regular basis to discuss items such as drawings, materials, fabrication,

acceptance testing and other issues relating to the production schedules.

More specifically; weekly staff meetings are held with all direct reports and bi-weekly

meetings are held with all Project Management Teams. On a monthly basis MTACC

reports to the MTA Board of Directors at their Capital Program Oversight Committee

and Finance Committee meetings. On a bi-monthly basis a project status meeting is

held with the MTA/MTACC Security Team. There is also a quarterly oversight

meeting with the FTA. Other meetings are scheduled as needed.

Annual Risk “Vulnerability” Assessments are conducted by all departments to ensure

that their activities are still relevant. The risk assessments require the departments to

identify major business activities, to determine the ranking, and to develop the

related controls and tests to manage and mitigate the identified risk. The ICC and

Business Process Owners are responsible for reviewing prior year vulnerability

assessments with their departments and coordinating their business process testing.

Testing standards and results are reviewed by the ICO to ensure compliance with

standards.

_______________________________________________________________________





The ICO updates and provides awareness training to the ICC and MTACC Executives

on good internal control practices. Additionally, the ICO provides guidance to the

ICC, departments and business process owners on assessing risks, mitigating controls,

and remediating control deficiencies. This includes ongoing feedback on MTACC’s

internal control process is reviewed annual to ensure the adequacy of the program.

Adjustments are made to the program based on the review.

MTA Long Island Rail Road

The Internal Control Program is overseen by the ICO, who delegates administration

of the Program to the BPMCC’s DCAs under the supervision of the Director, BPMCC.

The DCAs work closely with the MOCAs throughout the year ensuring that the

elements of The Act are adhered to and the LIRR’s Program is functioning as

intended.

In 2013, the DCAs met with the various departments to ensure the activities on their

Vulnerability Assessments reflected their current processes. Also, the DCAs

participated in four (4) corporate training classes to provide employee awareness of

the internal control process.

In January 2014, the ICO, Director of BPMCC and the DCAs met with the MOCAs

and Department Heads to kick off the Program for the current year by reviewing the

goals and procedures related to the Program. The new 2013 COSO framework was

also discussed at the meeting and attendees were given the opportunity to ask

questions about the implementation of the new framework. Additionally, the DCAs

informed the attendees about the new Governance Risk Compliance (GRC) database

which will be used in the near future. BPMCC chose selected departments to

participate in a pilot of GRC to ensure familiarity with the system. To date, all LIRR

VAs have been entered into GRC with the goal of implementing the database and its

components by the next reporting period.

MTA Metro-North Railroad

Metro-North’s Corporate Compliance unit is comprised of two positions: a Deputy

Director for Corporate Compliance & Strategic Development, who is the ICO, and a

Manager of Corporate Compliance. Together, they are responsible for managing

Metro-North’s Internal Control Program. They are assisted by Internal Control

_______________________________________________________________________





Coordinators, who serve as the Departmental contacts for ensuring the completion of

internal control reviews. The Corporate Compliance unit is also responsible for

maintaining and updating Metro-North’s corporate policies and procedures. The

Deputy Director is a member of MTA’s Enterprise Risk Management Committee, and

works directly with the MTA’s Chief Compliance Officer on MTA all-agency internal

control and policy matters. Finally, the unit serves Metro-North in a business

improvement capacity through internal process reviews and audit liaison work with

MTA Audit Services and external auditors.

The major accomplishment of the Internal Control Program this year is the transition

to utilizing GRCM for all internal control reviews.

Departments have assessed their major functions with a focus on identifying and

assessing the most significant business processes which are critical to achieving their

objectives as a Department. By using new guidance on risk assessments and ratings,

Departments are all utilizing a consistent approach to rating risk which is based on a

comprehensive assessment of the significance of impact and likelihood of occurrence

of the risk. Testing is the other area where improvements have been made, in part

based the new GRCM’s system capabilities. Testing instructions and results are more

clearly defined and reported in GRCM, and the ability to upload relevant testing

documentation provides additional assurances that tests are being performed

properly.

2013-14 presented a number of operational and safety challenges based on three

major train derailment incidents and two employee fatalities and their ongoing

investigations. A key step towards improving Metro-North’s safety culture was

establishing a significant shift in the functional responsibilities of the Safety

Department. The Safety and Security Department has been split into two separate

departments with distinct functional areas of responsibility. The new Office of System

Safety (OSS) includes units focused in the following areas: Risk Reduction; Field

Operations; Safety Support and Data Analysis; Investigations; and Fire Safety and

Emergency Management. These units will be reviewing significant business processes,

risks, and controls in the 4th Quarter of 2014. The new Security Department is being

organized to effectively focus on all security operations and strategy, company-wide,

and will do a similar review.

_______________________________________________________________________





In addition to enhancing the staff and skills within the new Department, the OSS will

be actively supported by a more effective collaboration with all other departments on

the railroad. This deeper collaboration between the Safety organization and all aspects

of Metro-North not only will enable more effective and systemic oversight of safety

across Metro-North, but will foster greater ownership of the overall Priority One

Program by employees at all levels of the organization.

Planned enhancements for the internal control program in 2015 will focus on

increasing the use and functionality of GRCM by connecting related corporate

policies/procedures and audit recommendations with internal control reviews of

significant business processes. Additional training sessions are also planned for late

2014 and early 2015.

MTA New York City Transit

NYCT is the largest mass transportation system in the U.S. It provides subway, rail,

bus, and paratransit services to the five boroughs of New York City. NYCT endeavors

to provide customers with safe, convenient, comfortable, and reliable train and bus

service by the efficient and effective utilization of human, physical, and financial

resources. In pursuit of these goals, management and staff in the various operating

and administrative functions understand the importance of working together and

utilizing the available resources to ensure that customers receive the best possible

service. The President, Executive Staff, and Senior Management supported by

professional, technical, operational and administrative personnel, unite to form a

team that achieves these objectives.

Because of the complexity of its business, NYCT must comply with a variety of

Federal, State, and Local laws. In addition, it is subject to rigorous scrutiny and

oversight by regulatory agencies such as the NTSB, FTA, OSHA, and the New York

State Department of Labor. NYCT is also guided by internal policies and procedures

that outline and provide detailed instructions on how to perform major tasks within

the organization.

The Internal Control Process at NYCT is specified by Internal Control

Policy/Instruction (P/I) 1.8.1. This P/I incorporates directives from the Internal

Control Act, and State Comptroller’s Office and sets forth the requirements for each

department to establish and maintain a system of internal controls. The NYCT

_______________________________________________________________________





program is predicated on vulnerability assessments and the ranking of activities based

on the level of risk assigned to each one. Departments must identify all major

activities, determine the level of risk and develop a system of controls to manage and

mitigate the risk. The next step is to perform a self-assessment of existing internal

controls for selected high-risk activities. Testing of controls is required to determine

whether they are functioning as intended, and the adequacy of those controls. If

weaknesses are detected, the department must submit an action plan and timetable

for addressing and resolving the deficiencies. The implementation of each corrective

action is reviewed and monitored by the Office of the Controller.

Follow-up on corrective actions taken to eliminate weaknesses is performed by

departmental personnel. The results of the departments’ review are monitored by the

Office of the Controller. A schedule of control weaknesses, corrective actions, and

dates of completion is prepared. The Office of the Controller corresponds with each

Internal Control Manager to ensure that all action items are completed satisfactorily

and timely, if cost beneficial. The status of weaknesses and related resolutions is

tracked via electronic systems.

NYCT has been proactive in coordinating and integrating the requirements of the

State Comptroller’s Standards for Internal Controls in New York State Government

that support a good internal control system. This is reflected by the fact that the

current Policy/Instruction (P/I) on Internal Control Policy cites the Office of the State

Comptroller as a major source of the information contained therein. The P/I refers to,

and in some cases incorporates excerpts from, the standards that are enumerated in

the State Comptroller’s guidance.

These references include, but are not limited to, the definition and purpose of internal

control, the specific techniques that provide the greatest assurance of a strong system

of control and the five components of an internal control program.

The Internal Control P/I also contains instruction regarding the ongoing evaluation of

activities, risks and controls and the periodic testing of controls to ensure that they

are functioning as intended; strategic planning to focus on the long range goals of the

organization in an effort to achieve its mission; and the role of the Internal Audit

function to perform independent reviews of the internal control program to assess its

effectiveness and recommend changes, if necessary.

_______________________________________________________________________





This information has been widely distributed throughout the organization and has

become a part of the annual training effort. By recognizing and incorporating these

important concepts from the Standards for Internal Controls in New York State,

NYCT continues to enhance the quality and effectiveness of its internal control

program.

NYCT has developed a multi-faceted approach to effectively communicate

information within the organization. Formal memoranda from Senior Management

are distributed through a number of media channels to apprise staff of important

issues and changes that will be taking place. The specific means of communication

include distributions with paychecks, mass e-mail, posting on the intranet and via

interoffice mail. These methods are also used to distribute policies, procedures,

directives and brochures that deal with a variety of topics. Formal meetings and

training seminars are convened to provide guidance, instruction and feedback on

specific subjects on internal control. There are also financial and management reports

that provide insight into the results of operations and audit reports that indicate the

compliance of the organization with the applicable laws, rules, regulation, policies

and procedures that govern the numerous activities that are undertaken by NYCT.

When taken in the aggregate, these methods of communication provide NYCT

personnel with an effective network which ensures that vital information is conveyed

in a timely manner to all of those involved in the agency’s key processes.

_______________________________________________________________________




Section C. Requirement: Make Available To Each Officer and Employee A Clear and

Concise Statement of The Generally Applicable Management Policies and

Standards

Standard: The Annual Internal Control statement should set the tone at the top. It

should emphasize the importance of effective internal controls and the responsibility

of each officer and employee for effective internal controls. Managerial policies and

procedures for the performance of specific functions are articulated in administrative

manuals, employee handbooks, job descriptions and applicable policy and procedure

manuals. While it is not necessary for all employees to possess all manuals, employees

should be provided with, or have access to, applicable policies and procedures for

their position.

MTA Headquarters

The MTA Policies and Procedures have been integrated into our GRC platform. MTA

All-Agency and MTAHQ policies are now stored in a central repository which allows

employees to obtain the most recent version of any policy directly from a web based

search. In addition, The MTA Code of Ethics is available on the MTA’s Intranet and

the internet sites.

Corporate Compliance continues to manage enterprise policy directives and MTAHQ

policies and procedures. In addition certain enterprise policy directives are posted on

MTA’s Internet page under governance/compliance.

In addition, corporate compliance has begun a process of policy lifecycle management

whereby each policy based upon its significance is assigned a specific review cycle.

MTA Bus Company

Internal controls are discussed and emphasized at senior staff meetings. Policies and

procedures are available on-line for access to all employees, and where required,

posted in locations.

_______________________________________________________________________





An annual letter from the President is sent to all employees to reaffirm B&T’s policy

in compliance with the New York State Governmental Accountability, Audit and

Internal Control Act. It reemphasizes the importance of effective internal controls to

the agency and the responsibility of each employee for the maintenance of effective

internal controls.

Attached to the President’s letter is an internally generated brochure “Internal

Controls and You”, which defines what internal controls are, what is required by the

Internal Control Act, how the Internal Control Act is carried out at B&T, what are

the employee’s responsibilities for internal controls and also gives an updated listing,

by department, of the Departmental Internal Control Coordinators as well as their

telephone numbers.

An annual internal control training course was provided to selected managers in

December 2013 to allow them to attain a more comprehensive understanding of

internal control concepts.


Employee conduct is governed by the MTA All-Agency policies including the Code of

Ethics, applicable provisions of the Public Officers Law including rules on ethics and

conflicts of interests. A copy of the MTA-All Agency Code of Ethics and the Public

Officers Law is provided to all employees at the time of their employment. A

memorandum from the MTACC’s President is emailed to all employees reaffirming

everyone’s responsibility for maintaining an effective system of internal controls as

prescribed by management and statutory requirements. Included in the email

distribution is a pamphlet to help employees understand their roles and meet their

operation goals.

MTACC conducts its business primarily by reference to written policies, such as a

plan of organization, the formal delegation of responsibilities, and program area

procedures. Copies of MTACC’s policies are maintained within each program area or

department. Additionally, MTACC has made available on the intranet all of its

policies and procedures to all employees.

_______________________________________________________________________





There are various control techniques which support the Internal Control Program

and enable each department and process to effectively monitor their internal control

system. Some examples which support the control evaluation process include

documentation and recordkeeping, authorization of transactions, segregation of

duties, supervision and security of information and data. Policies and procedures, logs

and records, supervision and structure based on corporate organization charts and the

various levels of data security.


LIRR makes available to all employees, via the Intranet, Corporate Policy &

Procedure BPM-003 Management Control Review, in compliance with the Act. This

policy emphasizes the importance of Internal Controls and the responsibility of all

employees to ensure that effective controls are maintained in the performance of

their daily activities. In addition, the MCR Handbook is available to all employees

that have access to the Intranet. For employees that do not have access to the

Intranet, a physical copy of the Handbook can be obtained by contacting BPMCC.

At the department level, Standard Operating Procedures and corporate policies are

developed and made available to staff, as applicable. A process is also in place to

ensure that policies and procedures are reviewed and updated on a regular basis. In

2013, 21 corporate policies were reviewed and updated as appropriate. In addition,

two new corporate policies were developed. New processes or the implementation of

new systems have accounted for the creation of new policies as well as the updating

of existing policies and procedures. HR maintains supplemental documentation,

which further supports internal control efforts, i.e., organization charts and job

descriptions.


An annual memorandum from the President to all Metro-North employees

communicates the importance of internal controls at Metro-North. All new

employees also receive this memo with their orientation packets. The memo refers

employees to the Metropolitan Transportation Authority’s Enterprise Risk

Management and Internal Control Guidelines, which serves as Metro-North’s internal

control policy. The memo clarifies responsibilities and describes the need for every

employee to comply with and enforce policies and procedures in order to ensure

Metro-North’s operation is both responsible and successful.

_______________________________________________________________________





The Corporate Compliance unit works with Department Heads, Internal Control

Coordinators, and managers, to continuously improve departmental compliance and

educate employees about internal controls. This is done through a combination of

formal training and Departmental and individual meetings and reviews.

In an effort to provide more information and guidance to Metro-North staff about

internal controls and the processes used to complete internal control reviews, there is

a Metro-North intranet page devoted to internal controls

(http://www.mnr.org/intranet/internalcontrols/ICS.cfm). Included on this page are

active links to: the GRCM system and the GRCM manual, which is a step-by-step

guide to using GRCM to perform internal control reviews; the MTA Board

Guidelines; the annual memo from the President; new guidance on performing risk

assessments and assigning risk ratings; testing result forms for use by internal control

testers; the NYS Division of Budget’s Managers Guide for Testing; the Executive

Summary of the COSO Internal Control – Integrated Framework; and finally, contact

information for the ICO and Manager of Corporate Compliance.

In addition to specific guidance, manuals and procedures provided to managers and

employees in their respective Departments at Metro-North (primarily located on

Metro-North’s intranet), all Metro-North employees are expected to be familiar with

and adhere to the MTA All-Agency Code of Ethics, which is also available on the

intranet.


The Officers, Managers and Employees of NYCT are routinely notified of the policies

and standards with which they are expected to comply. The President and Senior

Management issue bulletins and other correspondence that provide clear instructions

and guidance on a variety of topics.

These high level publications are provided to employees as reminders of existing

policies or as instruction on new activities and initiatives. They contain general

information in the areas of operations, administration, finance and internal controls.

NYCT stresses the theme that internal control is everyone’s business. This principle is

the focal point of the NYCT brochure and the Presidential memos on internal

http://www.mnr.org/intranet/internalcontrols/ICS.cfm

_______________________________________________________________________





controls, which are distributed to all employees on a regular basis. By incorporating

the tenets of internal control into every task that is performed, NYCT has created an

environment that provides reasonable assurance that its resources are protected

against fraud, waste and mismanagement and that its activities are performed in an

effective and efficient manner. In addition to the general guidance provided by

management, NYCT maintains policies, procedures, handbooks and management

directives for all major activities. These manuals are available on-line. They are

reviewed, updated, and distributed to the appropriate areas of responsibility on a

regular basis.

_______________________________________________________________________




Section D. Requirement: Designate An Internal Control Officer (ICO), Who Shall Report

To The Chairman of The MTA, To Implement and Review The Internal

Control Responsibilities Established Pursuant To Act and Internal Control

Standards

Standard: The ICO works with appropriate personnel within the MTA to coordinate

the internal control activities and to help ensure that the internal control program

meets the requirements. Although the ICO evaluates the adequacy of the internal

control reviews performed by authority staff, program and line managers are

primarily responsible for conducting reviews to assure adherence to controls and

analyzing and improving control systems. The ICO should be an individual with

sufficient authority to act on behalf of the Chairman in implementing and reviewing

the agency’s internal control program. This individual should have a broad

knowledge of MTA’s operations, personnel and policy objectives.

Metropolitan Transportation Authority

Pursuant to Public Authorities Law Section 2931, the MTA Board designated its Chief

Compliance Officer as the MTA’s Internal Control Officer (“ICO”) with

responsibilities for overseeing MTA’s Corporate Compliance efforts, which include

corporate governance, internal controls, ethics and compliance.

The MTA’s Chief Compliance Officer has reporting responsibilities to MTA’s

Chairman and the MTA Board. Pursuant to the Audit Committee’s Charter, the Chief

Compliance Officer has an affirmative reporting obligation to the MTA Board on the

internal control program through the Audit Committee. The Chief Compliance

Officer has several years of experience in the area of finance and financial institution

regulation. Before coming to the MTA, he spent 10 years at the United States

Securities and Exchange Commission and 6 years with the New York City

Department of Finance.

MTA Headquarters

The MTAHQ Internal Control Officer has over 35 years of experience in Human

Resources of which 18 were with the MTA in Compensation. Most of the jobs

descriptions in HQ were written and evaluated by this individual. Thus, the scope of

HQ operations and the history of various departments are well known to the Internal

Control Officer.

_______________________________________________________________________




MTA Headquarters

Additionally, the incumbent holds two advance degrees, a MBA in Organizational

Development and a Post Masters Certificate in Marketing.

The ICO works with appropriate personnel within the authority to coordinate the

internal control activities and to help ensure that the internal control program meets

the requirements established by BPRM Item B-350. Although the ICO evaluates the

adequacy of the internal control reviews performed by Agency or authority staff,

program and line managers are primarily responsible for conducting reviews to assure

adherence to controls and analyzing and improving control systems.

MTA Bus Company

Robert Picarelli, Chief Officer, Internal Investigations & System Security, is

designated as the Internal Control Officer (ICO) for MTA Bus. Robert Picarelli has

been the ICO for NYCT Bus since the inception of the Internal Control program at

NYCT Bus, and also coordinates external audits of the MTA’s bus operations.

Accordingly, audit findings and recommendations are integrated into the internal

control program as required across the operations.


The B&T Internal Control Officer (ICO) was appointed by the President to administer

and assure implementation of the B&T Internal Control Program. The ICO working

with MTA Audit Services and the Independent Auditors, directs and continually

evaluates and assesses B&T’s system of internal controls. Together, they help B&T

management maintain B&T’s system of controls in a complete and current condition,

and ensure that all employees are adequately trained in the requirements of their jobs

and the principles of internal control. The ICO is also supported by Departmental

Internal Control Coordinators within various B&T departments who provide

additional administration of the B&T Internal Control Program.

_______________________________________________________________________





The Internal Control Officer (ICO) reports to MTACC President through the

organization’s Chief Financial Officer. Oversight for the Program is provided by

MTA’s Chief Compliance Officer. Additionally, the ICO interfaces directly with

MTACC’s Staff, Program Executives, Department Heads and Audit Services for

adherence and improving MTACC controls and systems. Besides oversight

responsibility over the Internal Controls program, he serves as a liaison between

Departments, Audit Services and other external auditors in bridging implementation

of corrective action plans recommended by auditors. The ICO, with the assistance of

the Internal Control Coordinators, directs and continually evaluates and accesses

MTACC’s system of internal control.

The ICO has over 19 years of internal audit, internal controls and operational risk

management experience in a broad range of industries. Before joining the MTACC,

he was the head of internal controls for a multi-billion dollar division of a global

corporation. He holds certification in risk management assurance, internal controls

and fraud examination with a Masters in Public Administration in Financial

Management.

MTACC’s ICO is a member of the ERM Committee representing MTACC. The ERM

Committee is chaired by the Chief Compliance Officer and meets periodically to

review and suggest improvements to the ERM program.


LIRR’s ICO is the Vice President of Management and Finance, who reports directly to

the President. Under his/her direct leadership the DCAs administer the program,

providing training, guidance, and instruction to the MOCAs. The ICO has tasked the

BPMCC Department with the coordination and monitoring of audits performed by

MTA Audit Services, MTA Office of the Inspector General, New York State

Comptroller and other external audits - an objective of which is to apply audit

findings to department business activities to determine if additional controls need to

be created or existing controls need to be enhanced. The objective is to ensure that

business activities are governed by policy and procedure thus providing congruence

with the control technique of documentation and recordkeeping. Finally, the ICO

provides periodic updates to fellow Senior Staff members on the status of the MCR

Program and reinforces the need for their continued support of the program.

_______________________________________________________________________





Metro-North’s Internal Control Officer reports directly to the Chief of Staff of the

President of Metro-North. The ICO’s organizational title is Deputy Director,

Corporate Compliance and Strategic Development. The scope of his duties includes

serving as Metro-North’s Audit liaison to ensure the linking of audit findings and

recommendations with internal controls. He is also directly involved in various

organizational process review and improvement efforts which support and reinforce

the Internal Control Program and vice versa. He has been working with and for large

public sector transportation agencies in the areas of planning, policy, management

and operations for 15 years and holds a Masters of Urban Planning from New York

University.

The annual Internal Control memorandum from the President to all employees

communicates who the ICO is (including contact information) and reinforces the

importance of and responsibility for internal controls at Metro-North. The ICO

administers the Internal Control Program and monitors compliance with the

program.


The President has designated an Internal Control Officer (ICO) to implement, oversee

and review the internal control program and its responsibilities within NYCT. The

ICO reports to the Executive Vice President while interfacing with the President,

Senior Management, MTA Headquarters, and New York State on the status and

progress of the program. Additionally, the ICO prepares NYCT’s annual Internal

Control Summary and Certification for the MTA and State and keeps the departments

and divisions apprised of their responsibility to comply with the P/I and the

provisions of the Internal Control Act. Another important function of the ICO is to

ensure that management and staff receive the appropriate level of IC training and the

information necessary to execute the requirements of the IC program.

NYCT’s ICO is the Controller who presides over all accounting and financial matters

within the organization. As such, he is well versed in all aspects of internal control

relating to operations and administration due to the high level of interaction with

Senior Management in NYCT, and the MTA. The ICO is assisted by an Internal

Control Coordinator (ICC) and other members of staff within the Office of the

Controller, who manage the day to day implementation of the IC program.

_______________________________________________________________________





The functions performed by dedicated staff include providing training to internal

control personnel, reviewing and commenting on the quality of items that are

submitted, providing feedback to the Department/Division Heads in cases of

significant non-compliance with the Act and receiving, reviewing, interpreting and

distributing all correspondence from the MTA and State.

The appointment of the ICO was communicated to all employees via the intranet and

to internal control personnel during training sessions.

_______________________________________________________________________




Section E. Requirement: Implement Education and Training Efforts To Ensure That

Officers and Employees Have Achieved Adequate Awareness and

Understanding Of Internal Control Standards and, As Appropriate, Evaluation

Techniques

Standard: Authorities should identify staff requiring internal control training and the

depth and content of that training. Such education and training should be on-going

with specific courses directed at line staff, middle managers and executive

management. For organizations that have established internal audit functions,

training and education should be offered on the appropriate role of the internal

auditor within the organization’s internal control system.

MTA Headquarters

All Coordinators have yearly training on Internal Controls and their role in the

program. Employees have access to information on the program via e-mails and “open

house” information sessions.

All Senior Managers receive yearly training on Internal Controls and their role in the

program.

One day per month, MTA Today is dedicated to compliance and ethics issues

providing our employees with entertaining video regarding relevant topics such as

gifts and conflict of interests. In addition, we are circulating, “Tone from the Top”

and “Ethikos” magazine to senior staff.

MTA Bus

The Assistant Chief Officer conducts an annual internal control educational/ training

session with all department liaisons and meets individually with smaller groups as

needed. The Assistant Chief Officer also mentors liaisons throughout the year.


All employees receive exposure to B&T’s and MTA’s all-agency policies on the

Intranet. Copies of the Authority’s internal control awareness brochure Internal

Controls and You is distributed to employees periodically at ethics training sessions

and other Agency forums.

_______________________________________________________________________





An Intranet-based, interactive internal control awareness course was implemented

and is updated annually when necessary. This tool serves as an additional vehicle for

a broad range of employees to receive basic training in internal control concepts. A

more detailed updated classroom-based training program, with specific instructions

on implementation of the Internal Control Program and compliance with the Internal

Control Act, was provided to selected managers in December 2013.

The ICO also meets with all DICCs on a quarterly basis to review progress towards

implementing various Internal Control Program initiatives and provides them with

additional control information, and reviews ways to improve the Internal Control

Program.


To make certain that MTACC executives and employees continue to maintain a

satisfactory awareness and understanding of internal control standards and

framework, Internal Control Training & Educational Program was developed for ICC

and Executives.

As previously mentioned, a memorandum from the MTACC President stressing the

importance of having an effective and efficient Internal Control Program; including

management’s responsibility for ensuring effective Management Control Reviews,

and the MTACC’s obligation to comply with the requirements of the New York State

Governmental Accountability, Audit and Internal Control Act was sent to all

employees on May 8, 2013.

Attached to this memorandum is a pamphlet entitled Internal Controls and You. The

objective of the pamphlet is to provide employees with a basic understanding of

internal controls and demonstrate how controls help meet MTACC’s operational

goals.

All new employees subject to financial disclosure requirement of the Code of Ethics

are required to take ethics training within 90 days of employment. Additionally, the

MTACC President and his direct reports are required to take an annual ethics training

while all other employees subject to financial disclosure requirement are required to

take a refresher ethics training course on a two year cycle. The ICO in conjunction

with Human Resources coordinate scheduling employees to ensure that they attend

the ethics training.

_______________________________________________________________________





MTACC’s ICO serves on the ERM Committee. Recommendations for improvements

arising from the Committee are shared with the MTACC’s ICC. In 2014-2015, ICO

will conduct GRC training for all department heads, ICC and internal control testers

on the utilizing the platform for documenting internal controls results.


The BPMCC Department, under the supervision of the ICO, provided the following

to promote internal control education and foster management control awareness at

the LIRR:

In 2013 the LIRR conducted four “Business Administration & Processes”

classes that are part of the Management Education Core Curriculum Program.

The classes included a two-hour session on the “Management Control Review

Program & Managing Internal Controls”. The format was based on the COSO

model and the basic components of internal control i.e., control environment,

risk assessment, control activities, information and communication, and

monitoring.

As part of their orientation, all new employees are provided with information

on internal controls and its importance at the LIRR. Employees are also

encouraged to reach out to their MOCAs and/or DCAs with any questions or

concerns.

DCAs are committed to providing training, guidance and instruction to the

MOCAs. Throughout the year, the importance of effective and efficient

controls is stressed. On an as needed basis, including when a department has a

new MOCA, the DCAs meet with the MOCAs to review, clarify and help

with the completion of control evaluations or with updating of the

Vulnerability Assessment when there are any changes in the procedures or

processes.

In August 2013, BPMCC provided a department specific training session to

Department of Program Management (DPM). Also various meetings were

held with other departments including the Office of Management and Budget

and Human Resources to review their existing VAs and ensure that any new

activities or changes to their processes were being addressed and that controls

reflect current processes.

_______________________________________________________________________





In 2013, the DCAs trained new MOCAs in Service Planning and Department

of Program Management, Quality Management Group and the Labor

Relations Department. Additionally, VAs were revamped and various new

ones were developed and tested, including DPM, the Controller’s Office, Law,

Market Development, Public Affairs, Safety & Training, Labor Relations and

Service Planning.

A Management Control Review Handbook is available on the Intranet. This

handbook provides managers with the guidance and tools needed to perform

their internal control responsibilities under the MCR Program.

All LIRR employees received a pamphlet entitled “Management Control

Responsibility at the LIRR” with a synopsis of the definitions related to

internal controls, a description of the internal control program and a listing of

MOCAs and DCAs. The pamphlet was accompanied by a memo from the

LIRR President reminding employees of the structure and affirming the

importance of the internal control program.


In 2013, training sessions on GRCM were held for Internal Control Coordinators,

who act as the Departmental point person for ensuring the completion of internal

control reviews. These train-the-trainer sessions provide Coordinators with the

information and skills they need to assist Testers, Business Process Owners (BPOs)

and Department Heads utilize GRCM. As with any new application, the ICO and

Manager of Corporate Compliance are providing ongoing assistance to GRCM users at

all levels. A detailed manual is also posted on Metro-North’s Internal Control intranet

page, and one-on-one instruction is available on-request. For 2014, additional GRCM

training is planned for the 4th Quarter.

Throughout 2013 and 2014 multiple meetings were held with individual Departments

as part of the revised Vulnerability Assessment process. These sessions provided an

opportunity to educate managers and their staff on the purpose and importance of

internal controls as well as additional guidance on risk assessments and testing

requirements.

_______________________________________________________________________





Education and training regarding internal control is provided to all departmental

personnel that are involved in the internal control process. The Office of the

Controller conducts a mandatory annual training seminar for Internal Control

Managers and their support staff that provides a general framework of the internal

control process and detailed instructions on the various components of which it is

comprised. Information is provided on the identification and listing of major

activities, the evaluation and ranking of risks for each activity via the vulnerability

assessment, the development of controls to counteract the risks, the testing of controls

on a regular basis, reporting of weaknesses found, and implementing corrective

actions to eliminate any deficiencies that are identified. In addition, all IC Testers,

Activity Managers and Division/Subdivision Heads receive comprehensive training

each year.

The additional training is a result of the implementation of the recommendation from

the Internal Control Task Force requiring employees to be grouped and trained by

function. It also ensures that NYCT is in compliance with this important aspect of the

Act. Throughout the year, upon request, individual departmental personnel receive

additional training in closed group sessions that are tailored for the specific needs of

each department.

The format utilized by the Office of the Controller is based on the COSO model and

the five basic components of internal control that it stresses, as listed below:

Control environment

Risk assessment

Control activities

Information and communication

Monitoring

In addition, it conforms to the standards provided by the NYS Comptroller’s Office

and the MTA Agency-Wide Enterprise Risk Management and Internal Control

Guidelines. In support of the training effort, a guide was developed to interpret and

clarify the tenets of the COSO model and present a detailed step-by-step description

of the IC process. Starting in 2014, NYCT’s Internal Control Program will adhere to

the provisions of the updated COSO Internal Control Framework.

_______________________________________________________________________





Internal control education is further achieved through letters and other

correspondence from the President, Senior Management and the ICO’s Office that are

distributed to NYCT employees to emphasize the requirements of the Act. An

Internal Control Brochure, detailing NYCT’s commitment to the Internal Control

Program, was placed on the TENS website and is available for viewing by employees.

The following is a sample of the correspondence or announcements that were either

posted on the NYCT Intranet, or distributed to employees directly in an effort to

heighten awareness on the following internal control related subjects:

Internal Control Issues (i.e. Security, Data Protection, etc.)

Equal Employment Opportunity Policy

Respect for Fellow Employees

Workplace Violence

Sexual and Other Discriminatory Harassment

Respectful Workplace Policy

Drug and Alcohol Policy Statement

Domestic Violence Awareness

Metropolitan Transportation Authority ERM/Internal Control ...

Documents

Transcript of Metropolitan Transportation Authority ERM/Internal Control ...