20161013AVU to Staff 4 Attachment B.pdf

Staff_PR_04 Attachment B Page 1 of 3
TO: Bruce Folsom~ Pat Lynch
Internal Audit Department
Audit Report
CC: Jason Thackston, Dennis Vermillion, Scott Morris, Tracy Van Orden
FROM: Lauren Pendergraft
DATE: July 19, 2013
SUBJECT: Demand Side Management Audit Follow Up Report
Background and Purpose
In response to the Washington Utilities and Transportation Commission's (WUTC) Order No. 7
in Dockets UE-100467 and UG-100468, A vista had a third party evaluator, Moss Adams,
perform a review of the processes and procedures of the Demand Side Management (DSM)
program. The Moss Adams Review was completed in 2011 with the conclusion that, overall, the
DSM programs are working as intended. The manual nature of the DSM process was noted and
areas were identified for improvement. The DSM Programs and Observations and
Recommendations Report was presented to the WUTC along with the Company's responses and
status updates related to the report's recommendations and findings.
The purpose of Internal Audit's review was to perform a follow up on the report issued by Moss
Adams in 2011 and ensure communicated action items filed have been properly implemented.
Scope and Procedures
As the DSM program is currently being reviewed by third parties, the scope of this review is
limited to the Company's responses and communicated action items included in the Moss Adams
report.
Inquiry of Implementation Team and Policy, Planning, and Analysis (PPA) staff and review of
applicable documentation were used to gather sufficient evidence to verify the Company's
response and status updates.
Observations and Recommendations
1) Several of the responses to Moss Adam's recommendations and observations are not
occurring as documented in the fi led report. In general, new processes and procedures have
been implemented to address the recommendations and risks presented by Moss Adams~
Staff_PR_04 Attachment B Page 2 of 3
however, they are not consistent with the Company's filed response and status updates.
While there are new manual controls, there have been no system or automated controls
implemented as indicated.
Recommendation: Update and document the current status of the recommendations to
reflect the current state of the DSM program. Additionally, best practice is to implement a
system that can ensure proper segregation of duties and implement system or automated
controls.
Management Response: As noted in the background section ofthls internal audit follow up
report, the Moss-Adams• review in 2011 concluded that overall the DSM programs were
working as intended. Residential rebate processing continues to be quite manual but
effective. Process improvements have been implemented to address the recommendations in
the review that allow for additional review, follow up on pending rebates and some
automation has been added for rebate submittals and coordination with accounts payable.
Automated controls are planned as part of the new customer care and billing system that will
replace the current CSS system. The DSM team has been working closely with Project
Compass on residential rebate processing tools that will include automation and segregation
of duties for processing, reviewing and approving rebates.
The current state of DSM continues to evolve as it works closely with external process
reviewers to further enhancements made as a result of the Moss-Adams review. The current
state continues to meet the spirit and intent of those initial recommendations and the
summary that was previously communicated externally. The current state continues to be
transparently communicated through advisory groups and commission staff audits including
a recent review by WUTC staff.
2) Specific observations of procedures that have been implemented, but are not operating
effectively were noted:
• Only 6 out of 18 projects greater than $50,000 were independently reviewed by the PP A
staff in 2012. (Note: Thls independent review process has changed in 2013 due to
structural limitations of the independent review process. A peer review before incentive
payment has been implemented with the independent review occurring as an audit after
incentive payment.)
Recommendation: Significant projects should still obtain an independent review prior
to incentive payout. The Implementation Team and PP A staff should determine the
thresholds for significant projects based on risk and dollar amount.
Management Response: As stated, this independent review process was changed in
2013 due to structural limitations of the independent review process. A peer review has
been implemented with the independent review occurring as an audit after incentive
payment. These actions, combined with more frequent randomly-selected reviews,
focuses on thresholds for significant projects.
• Review comments or questions noted by PP A staff are not always corrected or addressed.
_J\19 ..-11rillSTA
Staff_PR_04 Attachment B Page 3 of 3
Recommendation: Comments from both the peer review and independent review need
to be appropriately addressed and documented. If there is a disagreement in amount or
calculation, this should be noted \.\rith a justification for the amount. Review comments
should not be left open.
Management Response: We agree that comments or questions should be noted with
justifications and should not be left open.
• Post verification/installation verification (PV) on all non-residential projects is not
documented on a consistent basis.
Recommendation: Clearly define, document, and communicate to all Implementation
Team and PP A staff what projects require post verification or installation verification.
Implement a review control to ensure that post verification/installation verification is
occurring and properly documented within Saleslogix.
Management Response: A stand alone data extract from SalesJogix regarding post
verification of an installed measure is not currently sufficient to determine the PV date
because the date field was not consistently filled in. PV (installation verification)
information is typically found in the notes or attachments section, which is not included
in the data extract. A process improvement is being implemented to improve consistency
of the use of the PV date field for 2013 and beyond to supplement the installation
verification written information already included with the individual project.
3) The roles and responsibilities of the Implementation Team and PPA staff are not clearly
defined. Accountability and authority for process or procedural recommendations are not the
sole responsibility of one group.
Recommendation: Define and communicate the roles and responsibilities of the
Implementation Team and PPA staff to ensure acceptance of the purpose of each function.
Work with staff to establish clearly defined lines of authority.
Management Response: Granularity of functions is being addressed by DSM management
through RACI modeling to clearly establish defined lines of authority.
...,11•. . ..,-11rVISTA