Metropolitan Transportation Authority
ERM/Internal Control Summary Report
2013 – 2014
SubmittedBy
MTACorporateCompliance
2Broadway,16thFloor
NewYork,NewYork10004
TableofContents
Page
Section A. Requirement: Establish and Maintain Guidelines for a System of Internal Controls 1
Section B. Requirement: Establish and Maintain a System of Internal Controls and a Program
of Internal Control Review 3
Part 1. Process Used To Review Internal Controls 3
Part 2. Significant Business Processes Identified During the 2013-14Review Process 4
Part 3. Material Weakness or Significant Deficiencies Revealed During the
2013-14 Review Process _____________________45
Part 4. The Internal Control Program Details 2013-14 89
Section C. Requirement: Make Available to Each Officer and Employee a Clear and Concise Statement
of the Generally Applicable Management Policies and Standards __________________ 99
Section D. Requirement: Designate an Internal Control Officer (ICO), Who Shall Report to the
Chairman of the MTA, to Implement and Review the Internal Control Responsibilities
Established Pursuant to The Act and Internal Standards _____________________104
Section E. Requirement: Implement Education and Training Efforts to Ensure that Officers and
Employees Have Achieved Adequate Awareness and Understanding of Internal Control
Standards and, as Appropriate, Evaluation Techniques _____________________109
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 1 of 114
Date September 16, 2014
Completed by Phone
Lamond W. Kearse, Chief Compliance Officer (646) 252-1330
MTAHQ Michael Amrick (212) 878-7422
New York City Transit William Vazoulas (646) 252-6610
Long Island Rail Road Mark Young (718) 558-7777
Metro-North Railroad Nathan Gilbertson (212) 340-2197
Bridges and Tunnels James Elkin (646) 252-7150
Capital Construction Daniel Worrell (646) 252-1303
MTA Bus Company Robert Picarelli (718) 696-3614
_______________________________________________________________________
Section A. Requirement: Establish and Maintain Guidelines for a System of Internal
Controls
Standard: Internal control guidelines communicate an Organization’s management
and programmatic objectives to its employees and provide the methods and
procedures used to assess the effectiveness of its internal controls in supporting those
objectives. Internal control guidelines should state the Board’s support of internal
controls to provide staff with an understanding of the benefits of effective controls;
identify primary responsibilities and the objectives; explain how internal controls are
organized and managed; define responsibilities of management and staff; acknowledge
that internal controls adhere to accepted standards; and describe the process for
evaluating internal controls.
The Metropolitan Transportation Authority, a public benefit corporation of the State
of New York, has the responsibility for developing and implementing a unified mass
transportation policy for The City of New York and Dutchess, Nassau, Orange,
Putnam, Rockland, Suffolk and Westchester counties.
In November 2011, the Metropolitan Transportation Authority Board adopted
Enterprise Risk Management and Internal Control Guidelines (“ERM Guidelines”).
These guidelines replaced MTA All Agency Policy Directive 11-008 entitled
Accountability & Internal Control issued June 8, 1990. The purpose of the ERM
Guidelines is to establish an effective system of internal controls for the Metropolitan
Transportation Authority and each of its subsidiary and affiliated agencies (“MTA”)
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 2 of 114
which complies with the requirements of the New York State Government
Accountability, Audit and Internal Control Act of 1999, Public Authorities Law
Sections 2930 through 2932 (“the Act”), the Standards for Internal Control in New
York State published by the Office of the State Comptroller, Guidelines issued by the
Independent Authority Budget Office (“IABO”), and the Commission of Sponsoring
Organizations of the Treadway Commission standards (“COSO”).
The ERM Guidelines establish the MTA Board’s support of internal controls and its
commitment to provide staff with an understanding of the benefits of effective
controls. It also identifies the Authority’s primary responsibilities and the objectives
of internal controls; explains how internal controls are organized and managed;
defines responsibilities of management, supervisors and staff; acknowledges that
MTA’s internal controls adhere to accepted standards; and describes the
organization’s process for evaluating internal controls.
In 2004, the MTA Board established the position of Chief Compliance Officer. The
Chief Compliance Officer serves as the Chief Risk Officer known as the Internal
Control Officer (“ICO”) for the MTA and its Affiliated and Subsidiary Agencies. In
addition, each Agency appoints an Authority Internal Control Officer for their
Agency (“AICO”) who is a direct report to the Agency President or their designee.
The guidelines also establish an Enterprise Risk Management Committee. The
Committee meets at least quarterly to review and suggest improvements to the
program. AICO’s or their designees serve on the Committee, which is chaired by the
Chief Compliance Officer.
MTA’s Enterprise Risk Management/Internal Control Program is compliant with the
Act, the Standards for Internal Control in New York State published by the Office of
the State Comptroller, IABO guidelines, and COSO standards. MTA’s Enterprise Risk
Management/internal control program is modeled after current best practices of
integrating corporate governance, internal controls, compliance and ethics.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 3 of 114
Section B. Requirement: Establish and Maintain a System of Internal Controls and a
Program of Internal Control Review
Standards: The program of internal control review shall be a structured, continuing
and well documented system designed to identify internal control weaknesses,
identify actions that are needed to correct these weaknesses, monitor the
implementation of necessary corrective actions and periodically assess the adequacy
of the internal controls. The procedures for evaluating the adequacy of that system
also vary, but at a minimum should: Identify and clearly document the primary
operating responsibilities; define the objectives of these functions so they are easily
understood by staff accountable for carrying out the functions; identify/document the
policies and procedures used to execute functions; identify the major functions of
each assessable unit; develop a process or cycle to assess risk and test controls for
major functions; assess the risks and consequences associated with controls failing to
promote the objectives of major functions; test controls to ensure they are working as
intended; and institute a centrally monitored process to document, monitor and
report deficiencies and corrective actions.
Part 1. Process Used To Review Internal Controls
Metropolitan Transportation Authority-Enterprise
The Enterprise Risk Management/Internal Control Program is based on vulnerability
(Risk) assessments and the ranking of business processes based on the level of risk
assigned to each one. The MTA identifies all major business processes, determines the
level of risk and develops a system of controls to manage and mitigate those risks.
Self-assessments and testing of existing controls is required to determine whether
they are functioning as intended and the adequacy of those controls. If weaknesses
are detected, a corrective action plan is created with a timetable for addressing and
resolving the deficiencies.
The primary control techniques, which support the control evaluation process, are
documentation and recordkeeping, authorization of transactions, segregation of
duties, supervision and security of information and data. Policies and procedures, logs
and records, supervision and structure based on corporate organization charts and the
various levels of data security are examples of the control techniques which support
the Internal Control Program and enable each department to effectively monitor
their internal control system.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 4 of 114
MTA is utilizing a Governance, Risk and Compliance system to manage the MTA’s
Internal Control, Compliance and Governance programs.
This application, in the broadest sense, is designed to add greater accountability and
transparency to the MTA’s Compliance/Internal Control efforts. The applications
allow the MTA to, among other things:
monitor compliance with MTA and Agency policies and procedure,
monitor compliance with multiple regulatory requirements,
align internal controls with policies and regulations,
replace labor-intensive vulnerability assessments with automated GRC
process management,
monitor internal controls not just by Agency but as part of an integrated
business processes across Agencies,
track and document risks and internal controls related to those business
processes,
track corrective action plans and audit recommendations, and
evaluate, test and report on the status of internal controls.
MTA utilizes a risk-based approach for continuous internal control monitoring and
testing, based upon annually reviewed vulnerability assessments. These assessments
assist Agencies in identifying key vulnerabilities and controls in place throughout the
Authority.
Part 2. Significant Business Processes Identified During the 2013-14
Review Process
MTA Headquarters – Significant Business Processes
Department Subdivision Business Process Reviewed
Administration Operation Support Emergency Preparedness
for Natural Disasters
No
Budget Budget Budget and Financial
Statement Preparation
No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 5 of 114
MTA Headquarters – Significant Business Processes
Department Subdivision Business Process Reviewed
Business Service
Center
Finance
Accounts Payable Yes
Payroll Administration –
Run Payroll
Yes
Travel and Business
Expense Reimbursement
No
Human Resources
Administration Items No
Benefits No
HRIS Yes
IT Coordinate Disaster
Recovery Test
No
Procurement
Issue Various Reports on
Procurement Activities
No
Tracking No
Capital Program
Management
Capital Program Budget
and Grants Management
Preparation ARRA 1512
Report
Yes
Comptroller Comptroller Financial Statements Yes
Corporate Affairs
and Communications
Arts for Transit and
Facilities Design
Coordination No
New York Transit
Museum
Operate the New York
Transit Museum
No
Policies and Procedures Community Affairs Yes
Corporate
Compliance
Ethics Program Code of Ethics Yes
Ethics Training Yes
Regulatory Reporting Preparation Annual
Report
Yes
Compliance Whistleblower Protection Yes
Internal Control System Internal Control Program Yes
Department of
Diversity and Civil
Rights
Certification Unit
Determine Eligibility of
New Applicants for DBE
Certification
Yes
Contract Compliance
Unit
Contract Integrity
Monitoring
No
Contract Integrity
Monitoring Review of
Monthly Participation
Report Submissions
Yes
Field Visits No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 6 of 114
MTA Headquarters – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of
Diversity and Civil
Rights
EEO Investigations Investigations No
Outreach Outreach Program No
Mentoring Mentoring Program No
Enterprise
Information
Technology Group
Enterprise Security Data Protection Yes
Information Services Information Services No
Facilities Operations
Office Services and
Building Services and
Administrative Services
Building Security No
General Counsel
Legal
Contracts and
Procurements
Yes
Environmental Yes
Litigation Yes
Legal Library Administration of the Law
Library
No
Human Resources
Benefits Benefit Policy and
Research
No
Deferred Compensation Communications Yes
Offer Deferred Yes
Defined Benefit Pensions Defined Pensions No
Recruitment Staffing and Employee
Relations
Yes
Risk and Insurance
Management
Claims Claims Management No
Risk Assessment and
Coverage
Insurance Coverage Yes
Risk Control and
Reporting
OCIP Yes
Treasury Treasury Cash and Investments No
MTA Bus Company – Significant Business Processes
Department Subdivision Business Process Reviewed
Depot Operations
Maintenance Operations Fuel Administration Yes
Transportation Pre-Trip Inspection Yes
Administration Random Drug Testing Yes
Security Daily Facility Inspection Yes
Facilities Environmental/Compliance SPCC Inspection Report Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 7 of 114
MTA Bus Company – Significant Business Processes
Department Subdivision Business Process Reviewed
Central Maintenance
Administration Random Drug Testing Yes
Safety Facility & Safety Yes
Maintenance Maintenance Program
Work
Yes
Paratransit Transportation Vehicle Accountability Yes
Security CCTV Yes
Facility/Property Access Yes
Safety & Training Transportation Accident Performance
Monitoring Program
Yes
Procurement Contract Administration Managing Contract
Dollars
Yes
MTA Bridges and Tunnels – Significant Business Processes
Department Subdivision Business Process Reviewed
Engineering &
Construction
Planning
Develop Plans and Goals
to Support the
Presidential Policy
“Engineering &
Construction
Department Mission
and Functions”
Yes
Design
Design and Review
Architectural
Engineering Projects
Yes
Program/Project
Management
Plan, Budget and
Schedule Capital and
Operating Projects
Yes
Perform Construction
Safety Oversight and
Monitor Work Injuries
Yes
Quality Assurance
Maintain Quality
Assurance Over Project
Development, Design
and Management
Activities for all
Construction Work
Yes
Finance Accounting Financial Statement
Preparation
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 8 of 114
MTA Bridges and Tunnels – Significant Business Processes
Department Subdivision Business Process Reviewed
Finance Payroll
Ensure Proper
Preservation of Payroll
Records
Yes
Maintain Proper
Control and Security
Over Payroll Records
Yes
Health & Safety
Provide Statistical
Analysis of Employee
and Customer Lost Time
for Safety Program
Management
Yes
Oversight of all
Hazardous Material
Abatements
Yes
Review All Contracts,
Construction Design
Plans and Specifications,
Contractor and
Consultant Safety Plans
for Environmental,
Health and Safety
Concerns
Yes
Provide Technical
Oversight and Guidance
for all Safety Training
Courses
Yes
Prepare and Submit
Compliance Reports
with Environmental and
Occupational Safety and
Health Regulations
Yes
Internal Security
Security Operations
Manage Armed Security
Operations
Yes
Coordinate the Securing
of Sensitive Documents
Yes
Electronic Security Support
Maintain and Manage
Electronic Security
Systems
Yes
Special Investigations
Perform Integrity
Testing of Revenue
Stream
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 9 of 114
MTA Bridges and Tunnels – Significant Business Processes
Department Subdivision Business Process Reviewed
Internal Security Special Investigation
Perform Security
Inspections in ISD Areas
Yes
Perform Safety Audits at
Toll Collection Facilities
Yes
Information
Technology
Conduct Annual
Disaster Recovery Tests
of Critical Applications
Yes
Manage Consultant
Design, Development
and Maintenance of ITS
Products
Yes
Perform Safety Audit
Trails
Yes
Labor Relations
Represent Agency at
Public Employment
Relations Board
Yes
Represent Agency in
Interest and Rights
Arbitrations
Yes
Legal
Administer Agency’s
Worker’s Compensation
Program
Yes
Administer Agency’s
Property Damage
Program
Yes
Manage Employment
Actions
Yes
Operations
Facilities
Ensure Toll Collection
Functions are
Performed in
Coordination with
Directives
Yes
Ensure Customer and
Employee Safety
Yes
Maintain Adequate
Level of Security at
Critical Areas Against
Potential Threats,
Vandalism, Theft and
Acts of Terrorism
Yes
Administration Provide Firearms
Training
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 10 of 114
MTA Bridges and Tunnels – Significant Business Processes
Department Subdivision Business Process Reviewed
Operations Administration
Provide Respiratory
Protection Equipment
Training
Yes
Planning and Budget Operating
Manage And Maintain
the Hyperion Budget
System (BSCFIN &
BSCENC)
Yes
Conduct Safety Audits of
Office Conditions in
Compliance with the
All-Agency Safety
Initiative
Procurement
Develop and Prepare
RFP’s and RFQ’s
Yes
Ensure Awards are Made
to Responsible Bidders
Who are Technically,
Financially and Ethically
Able to Meet Contract
Requirements
Yes
Bid Admin/Vendor
Relations
Yes
Revenue
Management
E-ZPass Contract
Compliance
Monitor Video Tolling
and Reload Cards
Yes
Monitor DMV
Validation
Yes
E-ZPass Project
Management
Monitor Manual Toll
Processing
Yes
Revenue Audit
Perform Manual Audits
to Identify and
Document Cash
Shortages in a Timely
Manner
Yes
Compile Traffic and
Revenue Information for
Monthly Management
Reporting
Yes
Revenue Operations
Count Cash Held at
Facilities
Yes
Review Daily Operations
at the Revenue
Processing Center
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 11 of 114
MTA Bridges and Tunnels – Significant Business Processes
Department Subdivision Business Process Reviewed
Revenue
Management
Revenue Operations
Maintain and manage
armored carrier
operations
Yes
Revenue Systems
Maintenance
Perform monthly
reconciliations of non-
revenue tags
Yes
General Conduct employee
safety audits
Yes
Staff Services
Human Resources
Review and maintain
personnel records
Yes
Monitor medical leave
absence/family medical
leave
Yes
Administration
Coordinate/manage
mail, courier and
messenger services for
all facilities
Yes
MTA Capital Construction – Significant Business Processes
Department Subdivision Business Process Reviewed
Capital Security
ProgramSecurity
Program Security No
Chief Engineer Engineering
Code Compliance No
Design Integration No
System Integration No
Government &
Community Affairs
Community Affairs Community Outreach No
Governmental Affairs Government Outreach No
Finance Budget &
Administration
Finance
Accts
Payable/Disbursement
No
Accounts Receivable No
Budget & Forecasting No
Expense Review No
Financial Reporting No
Grant Management Grant Management No
General Counsel,
Procurement &
Human Resources
General Counsel
General Counsel No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 12 of 114
MTA Capital Construction – Significant Business Processes
Department Subdivision Business Process Reviewed
General Counsel,
Procurement &
Human Resources
Procurement &
Administration
Procurement Yes
Human Resources
Payroll Yes
New Hire /Changes /
Terminations
Yes
Information
TechnologyInformation Technology
Systems' Access & User
Rights
No
Planning and
Development &
Chief Architect
Sustainability &
Environmental Services
Sustainability &
Environmental Services
Yes
Program Controls &
Quality Assurance
Claims Management &
Scheduling
Scheduling Design &
Construction
No
Estimating & Cost Controls Cost Estimating No
Program Controls Policies & Procedures No
Quality Quality Assurance Yes
Risk Management &
Budget Controls
Risk Management /
Liability Protection
No
Project and
Construction
Management
7 Line Extension Project Construction
Management
Yes
East Side Access Project Construction
Management
No
Fulton Street Transit
Center
Project Construction
Management
Yes
Second Avenue Subway Project Construction
Management
Yes
Safety Safety Safety & Site Security No
Strategic Initiatives
& Communications
Strategic Initiatives &
Communications
Communications Policy Yes
MTA Long Island Rail Road – Significant Business Processes
Department Subdivision Business Process Reviewed
All All
Management
Compensatory Time
Yes
Overtime Yes
Procurement Card Yes
Employee Accident
Reporting
Yes
Employee Accident
Counseling
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 13 of 114
MTA Long Island Rail Road – Significant Business Processes
Department Subdivision Business Process Reviewed
All All Train Accident Report Yes
Budget Submission Yes
Information
TechnologyN/A
Manage System Security No
Plan Disaster Recovery No
Administration of
Systems Development
Yes
Department of
Program
Management
Project Planning &
Controls
Productivity Tracking No
Design Management Consultants Contracts Yes
Best Value Analysis No
Construction Management
Force Account
Construction
No
Managing Change
Requests
No
Central Administration
Invoice Processing (3rd
Party Contracts)
No
Invoice Processing
(Force Account)
No
M/W/DBE Compliance
Reporting
Yes
Code Compliance
Process
No
Law Department
Torts & Administration
Monitoring – Outside
Counsel
Yes
Approve & Voucher
Payments
No
Procurement
Draft/Revise
Procurement
Contract/Agreements
Yes
Advise/Assist Vendor
Responsibility
Determinations
Yes
Advise & Assist – Bid
Protest
Yes
Liaison with Other
Agencies
No
Negotiate Disputes &
Settlements with
Vendors
No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 14 of 114
MTA Long Island Rail Road – Significant Business Processes
Department Subdivision Business Process Reviewed
Law Department
Claims
Lawsuits – Support
Attorney in Trial
Preparation
Yes
Federal Employees
Liability Act (FELA)
Claims
No
Property Damage No
Insurance Cases No
Payment/Security –
Settlements
No
Subpoena Checks No
Calculate Liens & Lost
Wages
No
Collect Debt No
General Law Oversight – FRA
Violations
No
Engineering
Signals & Communications
Equipment/Tool
Inventory
Yes
FRA Signal Appliance
Testing
No
Highway Crossing
Inspections
No
Planning & Administration Track Geometry
Measurement TC-82
Yes
Facility Management Contract Compliance Yes
Maintenance of Way FRA Inspections Yes
Office of Security Pass Office
Pass Issuance,
Destruction and
Property Access
Yes
Pass Issuance to
Employees
Yes
Issuance of
Transportation Pass and
ID only to Contractors
Yes
Employee Status
Changes (Terminations,
Retirements, etc.)
Yes
Recovery & Destruction
of Invalid/Expired
Employee, Contractor
Passes and Voided Stock
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 15 of 114
MTA Long Island Rail Road – Significant Business Processes
Department Subdivision Business Process Reviewed
Office of Security
Pass Office
Review and Approval of
Medical Certification
Forms Submitted by
Applicants Requesting
Permanent
Transportation Pass
Yes
Vehicle Fleet Operations
Accident Reporting
Motor Vehicle
Yes
Annual Driver
Qualifications
Yes
President’s Office N/A Correspondence
Handling
Yes
Office of
Management BudgetN/A
Operating Budget –
Budget Submission
Yes
Development of
Monthly Financial
Package
Yes
Human Resources
Employment
Respond to Report of
Medical Condition by
Employer
Yes
Update Job Description
and Physical Agility
Screening (PAS)
Yes
HR Planning & Admin
Services
New Hire Plan Yes
Employee Services
FMLA Compliance Yes
Administer Alcohol and
Substance Testing
Program
Yes
DA/DS Compliance Yes
Administer Sick Leave Yes
Transportation Safety
Compliance with
Federal Mandates &
Safety for Hours of
Service
Yes
Compliance with
Federal Mandates &
Safety – Random Drug
Testing
Yes
Engineer Certification No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 16 of 114
MTA Long Island Rail Road – Significant Business Processes
Department Subdivision Business Process Reviewed
Transportation
Safety Safety Inspections &
Safety Discussions
No
Train Movement
Tower Inspections Yes
Train Dispatchers Yes
Monitor TIMACS &
OTP Reporting
Yes
On-Board Fare
Collection
Yes
Train Consist
Compliance
No
Safety Observations –
Workplace Safety
No
Safety Observations –
Train Operations
No
Internal Administration
Requisitions No
Agency
Reimbursements –
Capital Projects
No
Administer Flagging
Needs
No
Identifying Needs for
Certain Essential
Personnel
No
Addressing Customer
Complaints
No
Customer Services,
Marketing & Public
Affairs
Customer Services
Administration of CAP
Database
Yes
CAP Activation -
Planned & Unplanned
(Emergency) Events
Yes
Time & Attendance Yes
TOM Reporting of Cash
Receipts by Ticket
Clerks
Yes
TVM Reporting of Cash
Receipts
Yes
Maintaining &
Distributing Ticket
Stock
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 17 of 114
MTA Long Island Rail Road – Significant Business Processes
Department Subdivision Business Process Reviewed
Customer Services,
Marketing & Public
Affairs
Customer Services
Discipline Represented
Employees and monitor
absence control policy -
Notices & Trials
No
Employee Probation
Evaluation Records
No
Recording of
Ronkonkoma Garage
Monthly & Daily Sales
No
Ronkonkoma Garage -
Refund Transactions
No
Recording of
Ronkonkoma Garage
Monthly & Daily
Deposit
No
Managing Penn Station
Cleaning Contract with
Fed Cap a Subsidiary of
NYSID
No
TOM Reporting of Cash
Receipts by Ticket
Clerks
No
TVM Reporting of
Ticket Sales
No
Penn Ticket Remittance
Operation
No
Maintaining &
Distributing Ticket
Stock
No
Special Services - Sell To
Customers
No
Audit Sales and
Inventory Activity
No
Monthly Expense &
Revenue Reporting
No
Maintain and Track
Purchase Orders
No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 18 of 114
MTA Long Island Rail Road – Significant Business Processes
Department Subdivision Business Process Reviewed
Procurement &
Logistics
Contracts Emergency
Procurements
No
Stores
Material Handling –
Receipt of Materials
No
Procurement – Property
Management
No
Controller
Accounting
Calculation of Overhead
Rates
No
Verification of Trackage
Fees Payable from
NYAR
No
Verification of Royalty
and Switch Fees Payable
from NYAR
No
Treasury
Cash Management &
Banking: Deposits
Yes
Cash Management &
Banking: Wire Transfers
Yes
Payroll
Processing of Weekly
Time and Labor
Information
Yes
Revenue Information &
Control
Tariff Table No
Ticket Stock No
Maintenance of
Equipment
RCM Administration RCM Management &
Review
Yes
Fleet Support Shops
Support Shop Rebuild
Program
Yes
MU Periodic
Inspections
No
MU Heavy Repairs,
Overhauls and Fleet
Modifications
No
Fleet Operations
MU-2B Inspection No
MU Class I Brake Test No
MU Toilet Servicing No
MU EIC (Extraordinary
Interior Cleaning)
Yes
Diesel Shops and Yards
Locomotive Daily
Inspection
Yes
Diesel Coach (C3)
Periodic Inspection
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 19 of 114
MTA Long Island Rail Road – Significant Business Processes
Department Subdivision Business Process Reviewed
Maintenance of
Equipment
Diesel Shops and Yards
Diesel Locomotive
Periodic Inspection
Yes
Running Repairs of
Diesel Locomotive and
Coach Equipment
Yes
Reliability-Centered
Maintenance, Fleet
Modifications and
Heavy Repairs
Yes
DH Coach EIC Cleaning No
Diesel Hauled Coach
Toilet Servicing
No
Quality Assurance &
Control
QC Inspections of
Periodic Inspections,
RCM, Fleet
Modifications, etc. done
in MofE repair shops.
Yes
QC inspection of Fleets:
Extraordinary Interior
Cleaning (EIC), Lay-Up
Cleaning (LUC) and
Turn Around Cleaning
Yes
MU and DH Fleets:
Toilet Inspection
No
DM Locomotive Shoe
Beam Cleaning
Inspections
Yes
In-Service HVAC
Temperature Survey
No
Perform Surveys as
Requested by
Management,
Performance
Improvement Teams
(PIT) / Task Forces or
Engineering
Yes
MOfE Administration
Recovery information
and report coordination
Yes
Fleet Analysis and
Document Control
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 20 of 114
MTA Long Island Rail Road – Significant Business Processes
Department Subdivision Business Process Reviewed
Safety & Training
Occupational &
Environmental Safety
Petroleum Bulk Storage
Tank Management
Program
Yes
Fire Marshal
Investigate & Evaluate
Fires for Causes and
Possible Trends
Yes
Training & Development
Produce and Deliver
Mandated Training
Yes
Ensure the Instructors
are Qualified
Yes
Ethics Training Yes
Service Planning Scheduling
Produce Equipment
Manipulation Schedule
No
Produce Employee &
Public Timetables
No
Produce Crew
Assignment Books
No
MTA Metro-North Railroad – Significant Business Processes
Department Subdivision Business Process Reviewed
Administration
Human Resources
ADA Compliance No
Avoidance of Nepotism Yes
Dual Employment Yes
Family and Medical
Leave Case Management
Yes
Military Leave
Management
Yes
Selections Testing No
Short Term Disability
Leave
No
Occupational Health
Services
Manage the Take Care
Health Contract
Yes
Pre-Placement/Periodic
and Mandated Medical
Exams
Yes
Provide Return to Duty
Examinations
Yes
Safeguard Employee
Medical Records
Yes
Training
Provide Mandated
Training for Operations
Services Employees
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 21 of 114
MTA Metro-North Railroad – Significant Business Processes
Department Subdivision Business Process Reviewed
Administration Training
Provide Mandated
Training for
Maintenance of
Equipment Employees
Yes
Provide Mandated
Training for
Maintenance of Way
Employees
Yes
Budget
Preparation and
Monitoring of the MNR
Financial Plan
No
Business
Development,
Facilities and
Marketing
Destination Services
Trackside Commissary
Operations and Sales
Yes
Capital Programs
Construction Management
Capital Project
Emergency Response
Compliance
Yes
Capital Project Quality
Compliance
Yes
Capital Project Safety
Compliance
Yes
Capital Project Security
Compliance
Yes
Program Management
Capital Project
Management - Bridges,
Tunnels and Track
Yes
Capital Project
Management - Power
Yes
Capital Project
Management - Rolling
Stock
Yes
Capital Project
Management - Shops,
Yards, Environmental,
and Special
Yes
Project Controls and
Technical Services
Capital Project Status
Reporting
No
Chief of StaffCorporate Compliance &
Strategic Development
Business Continuity
Plan
No
Manage the Internal
Control Program
No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 22 of 114
MTA Metro-North Railroad – Significant Business Processes
Department Subdivision Business Process Reviewed
Controller
General and Subsidy
Accounting
Capitalization of Fixed
Assets
Yes
FTA-NTD Regulatory
Reporting Requirements
Yes
Passenger Revenue
Accounting
Mail & Ride Ticket
Program Management
Yes
Operations Revenue
Reporting
Yes
Ticket Refund
Management
Yes
Ticket Revenue
Management
No
Ticket Stock Manage Yes
Payroll and Timekeeping
Leave Balance Payouts
T&E
Yes
Leave Balance Payouts
OT&E
Yes
Time and Labor Payroll
Close Process
Yes
Treasury Daily Cash Management Yes
Customer Service
and Stations
CS&S Administration
Parking Facilities
Management
Yes
Manage CS&S Vendor
Contracts
No
Service Quality
Inspection Program
No
Station and Customer
Inform/Distribution
No
Timetables and
Schedules
No
Ticket Sales and Service
Manage Ticket Sales
(Stations and TRO)
No
Manage Ticket Sales
(TVM)
Yes
Diversity and EEO EEO Office
Investigate
Discrimination
Complaints
Yes
Mandatory EEO
Reporting
Yes
Information
TechnologyIT Infrastructure
Confidentiality,
Integrity, and
Availability of Data
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 23 of 114
MTA Metro-North Railroad – Significant Business Processes
Department Subdivision Business Process Reviewed
Information
Technology
IT Infrastructure
Protect Customer
Cardholder Data
Yes
Restoration of Critical
IT Services
Yes
Program Management
Office
Manage IT Related
Projects
No
Legal
Claims Services Claims Management No
Environmental Compliance
and Services
Handling Hazardous
Waste
No
Prepare Annual
Environmental Audit
No
Wastewater Testing and
Permits Renewal
No
Maintenance of
Equipment
ACMO
Identification and
Repair of In-Service
Rolling Stock Failures
No
Maintain Rolling Stock No
Perform Calendar Day
Mechanical Inspections
- H&H
No
Perform Calendar Day
Mechanical Inspections
- NHL
No
Perform Maintenance
Per MNR RCM
Requirements
No
Perform Periodic Safety
Inspections H&H
No
Perform Periodic Safety
Inspections NHL
No
Repair Rolling Stock No
M of E Administration
Manage M of E Vendor
Contracts
Yes
M of E Timekeeping Yes
Maintenance of Way Communications & Signals
Grade Crossing
Inspection &
Maintenance
Yes
Maintenance & Repair
Customer Information
Systems at Stations
No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 24 of 114
MTA Metro-North Railroad – Significant Business Processes
Department Subdivision Business Process Reviewed
Maintenance of Way
Communications & Signals
Maintenance and Repair
Security Systems
No
Monitoring Employee
Hours of Service Regs
No
Signal Inspection Yes
Signal Maintenance and
Repair
Yes
Grand Central Terminal GCT Inventory Yes
M of W Administration
M of W Timekeeping Yes
Manage M of W Vendor
Contracts
No
Operating Capital
Manage Force Account
Projects
No
Management Monitor of
Diesel Fuel
Yes
Management and
Monitoring of Heating
Fuel
Yes
Power
Catenary Inspection and
Maintenance
No
Circuit Breaker
Inspection and
Maintenance - H & H
No
Circuit Breaker
Inspection and
Maintenance - NHL
No
Third Rail Inspection
and Maintenance
No
Third Rail Repair No
Track and Structures
Annual Bridge
Inspection
Yes
Bridge Maintenance and
Repair
Yes
Equipment Run Track
Inspection
Yes
Facility Inspection Yes
Facility Maintenance
and Repair
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 25 of 114
MTA Metro-North Railroad – Significant Business Processes
Department Subdivision Business Process Reviewed
Maintenance of Way Track and Structures
Inspection,
Maintenance, and
Repair of Work
Equipment
No
Load Rating Bridge
Inspection
Yes
Station Inspection No
Station Maintenance
and Repair
No
Track Maintenance and
Repair
Yes
Visual Track Inspection Yes
Operations
Operating Rules
Administer the Drug
and Alcohol Testing
Program
Yes
Efficiency Testing
Program
Yes
Operations Administration
Monitoring of Fuel
Cards and Fuel Usage
Yes
Non-Revenue Vehicle
Management and
Monitoring
No
Operations Services
Field Operations
Field Incident
Management
No
Field Safety
Management
No
Finance, Administration
And Crew Management
Availability Monitoring
- CMC
Yes
Capital Support Yes
T&E Employee Hours of
Service (HOS)
Monitoring
No
Speed Compliance
Monitoring
No
Train Staffing - CMC No
T&E Employee Claims
Quality Control-CMC
No
T&E Timekeeping No
Operations Control Center
Job Training-OCC Yes
Track Outage
Scheduling-OCC
No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 26 of 114
MTA Metro-North Railroad – Significant Business Processes
Department Subdivision Business Process Reviewed
Operations Services Operations Control Center
Train Dispatching &
Incident Management-
OCC
No
PlanningOperations Planning and
Analysis
Monitoring and
Reporting Ridership
No
New Fare Payment
Systems
No
Schedule Development
and Implementation
No
Procurement and
Material
Management
Material Management
Asset Disposition No
Maintain Warehouse
and Inventory Security
Yes
Perform Inventory
Cycle Counts
Yes
Non-Operations
Competitive
Procurements-
Capital/Non-Operations
Yes
Contract Administration
- Capital/Non-
Operations
No
Emergency
Procurements -
Capital/Non-Operations
Yes
Non-Competitive
Procurements -
Capital/Non-Operations
Yes
Operations
Competitive
Procurements -
Operations
Yes
Contract Administration
- Operations
No
Emergency
Procurements -
Operations
Yes
Non- Competitive
Procurements -
Operations
Yes
P&MM Administration
Procurement Card
Management and
Monitoring
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 27 of 114
MTA Metro-North Railroad – Significant Business Processes
Department Subdivision Business Process Reviewed
Safety
Fire Brigade and
Emergency Medical
Services
Yes
System Safety Program
Plan (SSPP)
Yes
Mandated Safety
Reporting-(FRA, FTA,
MTA)
Yes
Security
Security Command
Center and Security
Systems Administration
No
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of
Subways
Maintenance of
Way/Electronic
Maintenance Division
Maintain and Monitor
AFC Equipment
Yes
Maintain and Monitor
VHF Subways Radio
Communication
Systems
No
Maintain and Monitor
Electronic Equipment
for Bus Radio
Communications
Systems
No
Inspect Fire and Hazard
Alarms in Bus and
Depot Facilities
Including Detection
Depot Gas Systems
Yes
Inspect Fire and Hazard
Alarms/Suppression
Systems in the Subway,
Including Stations,
Crew Facilities, and
Booth Halon Systems
Yes
Inspect Subway
Emergency Alarms and
Telephones
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 28 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of
Subways
Maintenance of
Way/Electronic
Maintenance Division
Maintain and Monitor
Electronic Equipment
for Communications
Infrastructure
Yes
Repair Electronic
Modules
Yes
Maintain and Monitor
CCTV/Monitoring
Devices
Yes
Safety Training and Use
of Personal Protective
Equipment
Yes
Maintain and Monitor
EMD Access &
Intrusion Systems
Yes
Procurement Card
Administration
No
Hearing Conservation
Program
Yes
Random Drug and
Alcohol Testing
No
Maintenance of
Way/Administration
Central Payroll,
Timekeeping and Check
Distribution
Yes
Central Material
Control-Inventory
Management
Yes
Protection of Social
Security Numbers
Yes
Maintenance of Way/Track
Track Maintenance Yes
Third Rail Maintenance Yes
Track Flagging Yes
Track Inspection Yes
Safety Training and Use
of Personal Protective
Equipment
Yes
Hearing Conservation
Program
Yes
Procurement Card
Administration
No
Random Drug and
Alcohol Testing
No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 29 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of
Subways
Maintenance of
Way/Infrastructure
Structures Maintenance
Work
No
Infrastructure Capital
Construction Projects
No
Inspection and Routine
Maintenance of Fixed
Assets and Equipment
Yes
Track Flagging Yes
Lead Particulate
Management
Yes
Asbestos Handling No
Safety Training Use of
Personal Protective
Equip
Yes
Prevention of
Unauthorized Access to
Areas Within the
System
Yes
Hearing Conservation
Program
Yes
Procurement Card
Administration
No
Random Drug and
Alcohol Testing
Yes
Maintenance of
Way/Electrical/Power
Substation Equipment
Maintenance and Repair
Yes
Power System
Operation Procedure
Yes
Power System
Equipment Testing and
Inspection –
Substations
Yes
Power System
Equipment Testing and
Inspections –
Emergency Alarm
Panels
Yes
Power System
Equipment Testing and
Inspections –
Supervisory Control
Data Acquisition System
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 30 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of
Subways
Maintenance of
Way/Electrical/Power
Emergency Response Yes
Safety Program Plan
Implementation
Yes
Access and Protection
to Power Substations
and Prevention of
Unauthorized Access
Yes
Access and Protection
to Cable Vaults and
Prevention of
Unauthorized Access
Yes
Revenue Meter
Readings
Yes
Hearing Conservation
Program
Yes
Procurement Card
Administration
No
Protection of Social
Security Numbers
Yes
Random Drug and
Alcohol Testing
Yes
Maintenance of Way/
Electrical/Signals
Signal Equipment
Maint/Work Order
Repair
Yes
Equipment Testing and
Inspections
Yes
Emergency Response Yes
Track Flagging Yes
Access and Protection of
Signal Rooms
Yes
Safety Training and Use
of Personal Protective
Equipment
Yes
Protection of Social
Security Numbers
Yes
Hearing Conservation
Program
Yes
Procurement Card
Administration
No
Random Drug and
Alcohol Testing
No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 31 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of
Subways
Maintenance of Way/
Elevators and Escalators
Safety Training and Use
of Personal Protective
Equipment
Yes
Procurement Card
Administration
Yes
Maintenance of Way/Ops
Support/Ops Training
Deliver Track Safety
Training to Contractors
Yes
Division of Operations
Support
Protection of Social
Security Numbers
Yes
Timekeeping Activities No
Material Controls: Tools
and Equipment
Yes
Lost Property No
Procurement Card
Administration
Yes
Random Drug and
Alcohol Testing
Yes
Division of Rapid Transit
Operations
Communications:
Proper Handling of
Emergencies
Yes
Communications:
Inclement Weather
(Severe Rain and/or
Snowstorms)
No
Track Safety Task Force
Recommendation #16
Yes
Hearing Conservation
Scheduling
Yes
Hearing Conservation
Compliance
Yes
Procurement Card
Administration
Yes
Injury on Duty
Prevention
Yes
Injury on Duty
Procedures
No
Track Flagging Yes
Random Drug and
Alcohol Testing
Yes
Unsafe Acts by
Customers
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 32 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of
Subways
Division of Rapid Transit
Operations
Side Door Drags Yes
Doors Open
Outside/Wrong Side
Yes
Use of Personal
Protective Equipment
Yes
Bulletins and Notices No
Safeguarding Authority
Assets
No
Division of Station
Environment
Procurement Card
Administration
Yes
Station Maintenance
Operations
Yes
Station Cleaning
Operations
No
Vehicular Inspections
and Operations
No
Use of Personal
Protective Equipment
Yes
Injury on Duty
Prevention
Yes
Injury on Duty
Procedures
No
Hearing Conservation
Scheduling
Yes
Division of Station
Environment
Hearing Conservation
Compliance
Yes
Safety Training Yes
Track Flagging Yes
Fare Media Sales –
Revenue Accountability
Yes
Fare Media Sales –
Station Agent Safety
and Security
Yes
Division of Station
Environment
Random Drug and
Alcohol Testing
Yes
Operations Support/Safety
Unit
Hearing Conservation
Program
Yes
Scheduling of Safety
Training
Yes
Scheduling of Medical
Examinations
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 33 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of
Subways
Operations Support/Safety
Unit
Track Flagging Yes
Random Drug and
Alcohol Testing
Yes
Protection of Social
Security Numbers
Yes
Efficiency Test Program Yes
Division of Car Equipment
Procurement Card Use /
Payment Reconciliation
Yes
Business Travel No
Material Forecasting for
SMS
Yes
Yard Safety Procedure No
Shop Safety Procedures No
Protection of Social
Security Numbers
Yes
Hearing Conservation
Program
Yes
Random Drug and
Alcohol Testing
Yes
Staten Island Railway
Employee and Customer
Safety
No
Payroll, Timekeeping
and Attendance -
Various Department
Yes
Signal Inspection No
Track and Switch
Inspection
Yes
Protection of Social
Security Numbers -
Employee
Accident/Injury Reports
Yes
Protection of Social
Security Numbers -
Personnel and Related
Employee Records
Yes
Hearing Conservation
Program
Yes
Department of
Security
Access to Loading Docks
& Receiving Areas -
Livingston Plaza
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 34 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of
Security
Challenging for Pass ID
Policy and ProcedureYes
Visitors Policy and
Procedure - Jay St. and
Livingston Plaza
Yes
Protection of Social
Security NumbersYes
Verifying Employee
Drivers LicensesYes
Electronic Access
Control FunctionalityYes
Readiness of NYCT
Weapons of Mass
Destruction HazMat
Team
Yes
WMD Detection
Equipment
Functionality
Yes
Safeguarding Agency
AssetsNo
Department of Buses
Random Drug Testing No
Fuel Reconciliation Yes
Fuel Sampling Yes
Fuel Delivery Yes
Pre-Trip Inspection No
Bus Accident
Procedures
Yes
Bus Operator
Observations
Yes
Central Maintenance
Facility Inspections
No
Central Maintenance
Facility Safety
Inspections
No
Scheduled Program
Maintenance
No
Daily Security
Inspection
Yes
Manage Contract
Dollars
No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 35 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of Buses
Paratransit – Vehicle
Accountability
Yes
Material Purchases No
Material Purchases
Authorization
No
Project Management
Review & Approval
No
Spill Prevention Control
Countermeasure (SPCC)
Policy & Procedures
Yes
SPCC Inspections No
Spill Containment
Reporting
Yes
Department of
Capital Program
Management
Contractor Payments
Verification
No
Additional Work
Orders(AWO’s)
Verifications
Yes
National Environmental
Policy Act Review of
Projects for Federal
Funding
Yes
Estimating/Cost Control
Compliance
Yes
Schedule Control
Compliance
No
Department of the
Executive Vice
President
Office of the Controller
MaBSTOA Pension
Death Benefit Payments
No
Protecting Social
Security Numbers
No
Administration and
Recording of MaBSTOA
Employee Pension
Loans
No
Preparation of Bidder
Evaluations
Yes
Control Letters of
Credit
No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 36 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of the
Executive Vice
President
Office of the Controller
Control and Coordinate
the Recording, Analysis
and Disbursing of Third
Party Contract
Payments and
Documentation
No
Receipt, Recording, and
Timely Billing of all
Force Account
Expenditures
Yes
Process Release of
Retainage
Yes
Process Final Payments Yes
Quarterly Forecast of
Actual to Budget
Expenses
No
Reconciliation of PSR
Authorized Positions to
Active Employee Listing
Yes
Oversee the Internal
Control Program
Yes
Oversee the Controlling
and Safeguarding of
NYCT Furniture and
Equipment
No
Review Authority-Wide
Policy/Instructions (P/I)
Yes
Protection of Social
Security Numbers
Yes
Office of Management and
Budget
Report Ridership
Statistics
Yes
Quarterly Hiring Plan No
Monthly Reports to the
MTA Board
Yes
Personnel Strength
Report
Yes
Protecting Social
Security Numbers and
Other Sensitive
Information
Yes
Procurement Card
Administration
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 37 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of the
Executive Vice
President
Division of Operations
Planning
Ensuring that NYCDOT
Bills for Bus Stop
Changes are in
Accordance with
NYCT’s Bus Stop
Contract, are Accurate,
and Adhere to the
Budget
No
Division of Supply Logistics
Vendor Receipts Yes
Issuance of Material to
End Users
Yes
Receipt and Issuance of
Tools
Yes
Control of High
Pilferage Items
No
Receipt and Issuance of
Gas and Diesel Fuel
Yes
Division of Materiel
Material Information
Reporting
Yes
Distribution of Sensitive
Procurement
Documents
Yes
Monitor Vendor On-
Time Performance
No
Maintain an Effective
Staff Summary Process
Yes
Award of Contractual
Options and
Modifications
Yes
Protection of Social
Security Numbers and
Other Sensitive
Information
No
Procurement Card
Administration
No
Division of Revenue
Control
Transport and Secure
MetroCard Vending
Machine (MVM)
Revenue
Yes
Process MVM Revenue Yes
Transport and Secure
Subway Booth Revenue
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 38 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of the
Executive Vice
President
Division of Revenue
Control
Process Subway Booth
Revenue
Yes
Oversee the Operation
and Maintenance of
Security
Equipment/Systems at
Revenue Control
Facilities
Yes
Provide Oversight
Contracted Armed
Security Services for
Protection of Revenue,
Fare Media, &
Employees
Yes
Hearing Conservation
Program
Yes
Procurement Card
Administration
No
Safeguard/Control
Debit/Credit Card Info
No
Division of Technology &
Information Services
Develop/Maintain the
Automated Fare Control
Application
No
Maintain the AFC
Store/Forward Sys
Reporting
Station/Depot/Bus Data
Farecard Sales and
Usage
Yes
Develop and Maintain
the Capital Accounting
and Payments System
No
Develop and Maintain
the MABSTOA Pension
Payroll
Yes
Develop and Maintain
the MABSTOA
Miscellaneous Payment
System
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 39 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of the
Executive Vice
President
Division of Technology &
Information Services
Develop, Maintain and
Monitor the Unified
Timekeeping System
(UTS) Application
No
Manage the
Implementation and
Testing of the Public
Address/Customer
Information System
(PA/CIS) Phase II
Project for 156 Stations
on the IRT Division
No
Maintain the Unified
General Order System
(UGOS)
Yes
Maintain the Automatic
Train Supervision,
Subdivision A (ATS-A)
System
No
System Maintenance of
the 63rd Street
Queensborough
Connection
No
Monitor the
Implementation,
Testing and
Commissioning of the
Communication Base
Train Control (CBCT)
System
Yes
Maintain the Paratransit
Dispatch and
Scheduling System,
(ADEPT)
Yes
Maintain the Fire Safety
System Application
Yes
Maintain Code
Repository and Migrate
Application Changes via
SCLM (Software
Configuration Library
Management)
No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 40 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of the
Executive Vice
President
Division of Technology &
Information Services
Maintain Code
Repository/Migrate
Application Changes via
Harvest Labor Deviation
System, Payroll,
KRONOS, RRS, UTS,
CMS Apps.
Yes
Verification and
Approval of IBM
Invoices for Payment
Yes
Production of Payroll
and Pension Checks
No
Protect Info & Sensitive
Data – Data Loss
Prevention
No
Security Monitoring and
Mainframe Applications
Yes
Provide Disaster
Recovery NYCT Virtual
Server Environment 2
Broadway Livingston
Plaza Data Centers
Yes
Protect Sensitive and
Confidential Data
Yes
Manage the UNISYS
Contract for SLA 3.2.2
Asset Tracking
(Hardware) – Contract #
03A8602-2
Yes
Manage the UNISYS
Contract for SLA 3.2.5
Asset Tracking
(Software) – Contract #
03A8602-2
Yes
Manage the UNISYS
Contract for SLA 4.2.4 -
Timely Completion of
Service Requests –
Contract# 03A8602-2
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 41 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of the
Executive Vice
President
Division of Technology &
Information Services
Manage the UNISYS
Contract for SLA 4.3.1 –
Timely Resolution of
Severity Level 1
Problems – Contract #
036A8602-2
No
Manage the UNISYS
Contract for SLA 4.3.2 -
Timely Resolution of
Severity Level 2
Problems – Contract #
036A8602-2
No
Manage the UNISYS
Contract for SLA 4.3.3 -
Timely Resolution of
Severity Level 3
Problems – Contract #
036A8602-2
No
Verification and
Approval of UNISYS
Invoices for Payment on
Contract# 03A8602-2
No
Division of Human
Resources
Administer
Procurement Card
Usage
Yes
Maintain Protection of
Social Security Numbers
Yes
Administer MaBSTOA
Pension Payments
Yes
Hearing Conservation
Program
Yes
Drug and Alcohol
Testing
Yes
Work Life Services No
Infectious Waste
Disposal
No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 42 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Office of Equal
Employment
Opportunity
Investigate Complaints
of Employment
Discrimination Filed by
Employees and Job
Applicants –Pre-
complaint and/or Intake
Process
Yes
Investigate Complaints
of Discrimination Filed
by Customers –Pre-
complaint and/or Intake
Process
No
Prepare Letters from the
President Concerning
NYCT’s EEO, Sexual
and the Other
Discriminatory
Harassment and Respect
in Workplace Policies
Yes
Protect and Safeguard
Social Security Numbers
Yes
Prepare/Submit Biennial
EEO - 4 Reports to the
Equal Employment
Opportunity
Commission on Gender,
Race, Ethnic
Demographics of
NYCT’s Workforce
Yes
Eliminate the Hard-
Copy Distribution of
Documents and Reports
in Favor of Electronic
Distributions
Yes
Monitor all Applications
for Dual Employment
for Compliance with
NYC Transit Policy
Yes
Safeguard NYC Transit
Assets
No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 43 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Department of Labor
Relations
Protection of Social
Security Numbers
Yes
Use of Procurement
Card
No
Department of
Corporate
Communications
Protection of Social
Security Numbers
No
Office of System
Safety (OSS)
Site Evaluations of Large
Quantity Generators of
Hazardous Waste
Yes
Policy/Instruction
Compliance Oversight
Yes
Contract Management/
Administration
Yes
Job Task Evaluations Yes
Chemical Product
Evaluations
Yes
Hearing Conservation
Program - Data Analysis
Yes
Hearing Conservation
Program – Reporting
Yes
Hearing Conservation
Program – Audits
Yes
Hearing Conservation
Program - P/I
Maintenance
Yes
Mercury Bulb Recycling
Contract Management/
Administration
No
Safeguarding Authority
Assets
No
NYS Department of
Labor (DOL) SH-900
Summary Report
Yes
NYS Department of
Labor (DOL) SH-900
Log Report
Yes
Protection of Social
Security Numbers
Yes
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 44 of 114
MTA New York City Transit – Significant Business Processes
Department Subdivision Business Process Reviewed
Office of System
Safety (OSS)
Dual Employment No
Procurement Card
Administration
No
OSS Managed Asbestos
Abatement
Yes
CPM Managed Asbestos
Abatement
No
Investigate Collisions
and Derailments
Yes
Investigate Fatal
Employee Accidents
Yes
Investigate “Near Miss”
Incidents
Yes
Investigate Multiple
Injury Bus Collisions
Yes
Investigate Fatal
Accidents
Yes
Investigate Mechanical
Failures and Bus Fires
Yes
Witness the Acceptance
Testing of Fire
Detection and
Suppression Systems
Yes
Perform Fire and Life
Safety Oversight of
Operating Procedures
and Policies
Yes
Joint OSS/TWU Track
Safety Inspections
No
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 45 of 114
Part 3. Material Weakness or Significant Deficiencies
Revealed During the 2013-14 Review Process
MTA – Enterprise
Subsidiary Subdivision
Enterprise N/A
Business Process
WAR Certificate
Weakness/Deficiency: Within HQ’s Capital Budgeting system (Impact), the Centrak
module which identifies the current WAR funding on Capital Projects, was not in
agreement with the PACMAN module, which interfaces with the BSC PeopleSoft
system that processes Capital Payments, which caused the WAR Certificates to go
into suspense because of the differences. Without the appropriate changes being
made to the contracts in PeopleSoft, there is a risk that improper payments can be
made where funding is not budgeted because of excess balances in PeopleSoft. In
addition, in the long term the contracts could not be closed out as needed, because
they were in suspense.
Corrective Action: The current Capital Budget and Payment process needs to be
reengineered to ensure critical controls over Capital funds are working efficiently and
effectively. While the backlog of WAR’s in response has been successfully reduced.
A review of this process is needed so that it can be re-engineered to achieve
efficiencies, and reduce the potential for future errors.
MTA – Headquarters – Material Weakness/Substantial Deficiency
There were no material weakness or significant deficiencies revealed during the 2013-
14 review process.
MTA Bus Company – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
MTA Bus Company Bus Operations
Business Process
Fuel Administration/Fuel Reconciliation
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 46 of 114
MTA Bus Company – Material Weakness/Substantial Deficiency
Weakness/Deficiency: Several locations identified variances between allowable and
actual limits which were not properly reconciled.
Corrective Action: Revised the Policy. Trained employees in revised policy.
Required reconciliations to be properly performed at the depot level and that
variances outside prescribed limits are reported to the division.
MTA Bridges and Tunnels – Material Weakness/Substantial Deficiency
MTA Bridges and Tunnels conducted 146 internal control reviews in 2013, including
a number of safety audits in accordance with the All-Agency Safety Initiative. There
were no significant deficiencies revealed during the 2013-14 review process.
MTA Capital Construction– Material Weakness/Substantial Deficiency
There were no material weakness or significant deficiencies revealed during the 2013-
14 review process.
MTA Long Island Rail Road – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Engineering Department Administration
Business Process
Accident Reporting and Counseling
Weakness/Deficiency: All AR1s, except three were entered timely into the Accident
Control System (ACS) within 48 hours. Seventy-seven out of 80 AR-20/21s took an
average of less than 17 days for final copies to be signed off by the Chief Engineer and
forwarded to the LIRR Claims Bureau & System Safety. Three AR-20/21’s took 155,
56 & 55 days to enter due to an expansion of investigation scope. Seven AR20/21s
took 30 days or more to finalize because the scope of the investigation was increased,
thereby delaying processing. Overall, the AR-20/21 reporting timeline has decreased
between 2013 (18 days) and 2014 (17 days) as investigating supervisors continue to
improve efforts in obtaining information, performing safety counseling, determining
root cause, and following up with effective and practical remedial/preventive actions.
Submission of AR30’s continues to improve also. Several departments are providing
safety counseling to employees after each accident, including Motor Vehicle
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 47 of 114
MTA Long Island Rail Road – Material Weakness/Substantial Deficiency
Accidents (MVA’s). Additionally, MV-104s are regularly completed & submitted
within 24 hours of the MVA.
Corrective Action: Engineering Administration continues to monitor, instruct and
remind personnel on the importance of submitting documentation properly,
completely and on a timely basis. The Chief Engineer has notified all departments
that they need to shorten the time it takes to complete and submit AR20/21s.
Departments have again been reminded to report all injuries immediately even if
there is confusion over sick vs. accident classification.
Subsidiary Subdivision
Law Administration
Business Process
Administration and Management – Management Comp Time
Weakness/Deficiency: The department tested the controls for monitoring
compliance using May 6 and May 19, 2013 to verify whether compensatory time was
earned, charged, and approved according to policy. CTAMS was used to verify that
compensatory time was recorded, charged, or expired. Testing revealed that not all
2013 documentation supporting compensatory time authorization was available as the
department did not maintain the documentation.
Corrective Action:
The activity manager has been instructed, and agreed, to maintain all documentation
related to approvals and usage of compensatory time for five years.
Subsidiary Subdivision
Transportation Administration
Business Process
Time and Attendance
Weakness/Deficiency: Yardmaster employees often work overtime at the beginning
or end of their shifts. In order to be paid, they are required to complete a Yardmaster
Time Slip, which should identify overtime hours worked, describe tasks performed
and indicate overtime approval. In order to test the controls, 39 time slips submitted
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 48 of 114
MTA Long Island Rail Road – Material Weakness/Substantial Deficiency
during May through August 2013 were reviewed. This review revealed that five
employees were paid overtime without the supervisor’s approval. For two of the five
employees, the time slip simply referred to an agreement as a justification for the
overtime.
Corrective Action: Transportation agrees that all Yardmaster Time Slips should be
approved by a manager and will re-instruct them to sign and print their names on the
forms. Additionally, the department will develop an “authorization sheet” listing
authorized managers who may sign the slips. Payroll Dispatchers will refer to the
listing to verify authorization. Employees will be notified of the revised procedure
via email and a Policy & Procedure will be implemented by the end of the 3rd Quarter
2014. With the introduction of paperless time slips, scheduled for roll out by the 1st
Quarter 2015, this issue will be addressed.
For those yardmaster employees earning overtime during training, the department
will perform random audits, starting at the end of the 3rd Quarter 2014, to ensure
claims are paid accurately. In addition, as previously mentioned, with the roll-out of
paperless time slips, the Manager-Equipment & Energy will be the authorizing
manager and will be responsible for ensuring the time slips are accurate.
Subsidiary Subdivision
Office of Security Vehicle Fleet Operations
Business Process
Vehicle Fleet Maintenance
Weakness/Deficiency: An MTA Audit found that user departments were not
responding to VFO notifications of overdue inspections. Further four trailers assigned
to the Track Department could not be accounted for during the performance of the
audit.
Corrective Action: LIRR Management will install a GPS system to track the
movement of trailers. Additionally, the VFO has implemented a process to ensure
that the report from Automotive Resources Inc. (ARI) properly recognizes inspection
codes to accurately reflect vehicles due for inspection. This will also enhance the
controls over the VFO’s inspection notification process.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 49 of 114
MTA Long Island Rail Road – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Office of Security Vehicle Fleet Operations
Business Process
Vehicle Invoice Processing
Weakness/Deficiency: An MTA Audit found that the VFO was not reconciling the
monthly invoices against ARI purchase orders and Maximo work orders to avoid
possible duplications or overcharges of repairs. MTA Audit recommended that the
VFO perform a reconciliation of ARI monthly billing Invoices and match the work
orders generated in the Maximo Inventory System to ARI purchase orders appearing
on the monthly invoice.
Corrective Action: In the 2nd Quarter 2013, the VFO department implemented the
recommendation by activating “Require Client Authorization when purchase orders
exceed limit” features of ARI application. This enhances the controls over
authorizations.
Subsidiary Subdivision
Department of Program Management Central Administration
Business Process
Commissioning, Acceptance and Maintenance Plan (CAMP)
Weakness/Deficiency: An MTA Audit found that four of 27 projects reviewed had
not complied with the CAMP procedure as required. The CAMP procedure is a
quality-focused plan to ensure that the major project assets fulfill their intended
purposes and that the commissioning, maintenance, acceptance and warranty
requirements of facilities, equipment and systems are consistent with the needs of the
LIRR. MTA.
Audit recommended that Capital Program procedures be amended to include criteria
conditions and approval procedures for granting construction projects full exemption
or waivers from CAMP. It was also recommended that program managers be
instructed to use the Components and Systems Turn Over (CSTO) document when
CAMPs are required.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 50 of 114
MTA Long Island Rail Road – Material Weakness/Substantial Deficiency
Corrective Action: By the 3rd Quarter of 2014, Department of Program Management
will include requirements for allowing CAMP waivers to Capital Program Procedures
645. Additionally, management will instruct program managers to use CSTO forms
when CAMPs are required.
Subsidiary Subdivision
Department of Program Management Project Planning &Controls
Business Process
Project Plan Implementation: Develop, Assemble and Revise a Project Plan for
approval
Weakness/Deficiency: Some of DPM’s active projects did not have an updated Risk
Assessment Plan filed with the Central Administration group, as required.
Corrective Action: It is recommended that going forward, the Tracking Log be
modified to include the Chief Program Officer‘s sign-off dates and the Plan’s revision
number. Also on a Quarterly basis, if Risk Plan updates are not submitted by the
Project Manager, DPM Central Administration will be required to send a notification
to the Assistant Chief Program Officer with a copy to the Chief Program Officer.
Subsidiary Subdivision
Human Resources Employee Services
Business Process
Alcohol and Drug Testing Program
Weakness/Deficiency: An MTA Audit performed during 2013 found that while
drug and alcohol testing was performed randomly and spread throughout the year,
none of the tests were performed on weekends or major holidays as federal
regulations required that tests be performed in a non-predictable manner. Therefore
MTA Audit recommended that Human Resources work with the operating
departments to ensure that random drug and alcohol testing is performed as
scheduled on Saturdays, Sundays and holidays.
Corrective Action: Management agreed with the recommendation. In the 2nd
Quarter of 2014, Employee Services met with management in Transportation Services
to discuss how the department can support random testing on Sundays and holidays,
and to reinforce the need to spread testing throughout the week.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 51 of 114
MTA Long Island Rail Road – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Human Resources Employee Services
Business Process
Alcohol & Drug Testing Program
Weakness/Deficiency: MTA Audit Services noted that Federal Motor Carrier Safety
Administration (FMCSA) random drug and alcohol tests within Engineering are
routinely scheduled at the beginning of employee work shifts. Therefore, they
recommended that Engineering perform random FMCSA drug and alcohol tests at
different intervals (such as the middle and end of employee work shifts) in order to
provide a measure of deterrence throughout an employee's work day.
Corrective Action: Recommendation was implemented. Starting June 2014, random
drug and alcohol tests were scheduled at different intervals, including mid-shift and
end-of-shift testing.
Subsidiary Subdivision
Human Resources Employee Services
Business Process
Alcohol & Drug Testing Program
Weakness/Deficiency: A review revealed that two Transportation employees
selected in November 2013 for FRA random testing were not tested due to
insufficient manpower available to cover the selected train crew (both of whom
worked the overnight third trick). Therefore, MTA Audit Services recommended
that Human Resources Employee Services work with Transportation Services to
explore options and corrective actions to ensure that Transportation employees are
randomly tested within the selection cycle.
Corrective Action: In the 2nd Quarter of 2014, Employee Services met with
management in Transportation Services to discuss the issues cited in the audit report
and to reinforce the need to send employees for random testing as scheduled within a
selection cycle. Additionally, going forward, Employee Services will request that
Transportation Services document the specific circumstances if a test is not performed
on the scheduled date, and that they ensure that subsequent attempts are made
until the test is completed.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 52 of 114
MTA Long Island Rail Road – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Human Resources Employee Services
Business Process
Alcohol & Drug Testing Program
Weakness/Deficiency: MTA Audit Services reviewed a random sample of 50
Alcohol Testing Forms (25 for each random program) for completeness and found
that 6% (three forms) were missing required information. Specifically, two forms
did not contain the signature ("certification") of the employee. One form was not
signed by the Breath Alcohol Technician and did not indicate the technician's name.
Therefore, they recommended that Human Resources Employee Services reinstruct
the Breath Alcohol Technician regarding the findings noted in the audit, and that it
also takes other required actions as defined in DOT regulation 49 CFR Part 40. In
addition, Human Resources Employee Services should implement controls going
forward to ensure the completeness of DOT Alcohol Testing Forms.
Corrective Action: Management agreed with the recommendation. In the 2nd
Quarter of 2014, the Breath Alcohol Technician was reinstructed on the importance
of accurate completion of Federal testing forms. Additionally, action was taken by
Employee Services to correct the cited forms, in accordance with DOT Regulation
Section 40.271 b(I ); in order to avoid having to cancel the tests.
Subsidiary Subdivision
Safety & Training Occupational &
Environmental Safety
Business Process
State Agency Environmental Audits
Weakness/Deficiency: LIRR is charged with adhering to requirements established by
the State Agency Environmental Audit (SAEA) Program (Program). The Program
provides the basis for conducting annual environmental audits of its facilities, projects
and operations and reporting the results to the New York State Department of
Environmental Conservation (DEC). The Safety Department conducts annual
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 53 of 114
MTA Long Island Rail Road – Material Weakness/Substantial Deficiency
meetings with the departments to plan the Program for the coming year, however
opening and closing meetings are not documented via minutes. The meetings should
be documented so all parties are aware and in agreement with steps to be taken to
implement the Program. Also, SAEA files contained questionnaires that were missing
responses to non-LIRR related questions.
Corrective Action: The Safety Department began documenting opening and closing
SAEA meetings via minutes. It also instructed project managers not to leave any
questions on the questionnaire unanswered. Both corrective actions were
implemented May 2014.
Subsidiary Subdivision
Safety & Training Occupational &
Environmental Safety
Business Process
Petroleum Bulk Storage Tank Management Program
Weakness/Deficiency: All five Underground Storage Tank (UST) tightness reports
were missing the tank's Petroleum Bulk Storage (PBS) number making it difficult to
associate the results of reports to the correct tanks.
Corrective Action: Safety re-instructed the vendor to fill out reports completely by
including the PBS number. This was completed May 2014.
Subsidiary Subdivision
Safety & Training Safety Operations
Business Process
Maintenance of Personal Protective Equipment (PPE) Approved Product List (APL)
Weakness/Deficiency: The Safety Department reviews and approves all PPE on the
Approved Product List (APL) and ensures that it meets current standards and is
included in the PPE catalog. However, this process is not sufficiently documented.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 54 of 114
MTA Long Island Rail Road – Material Weakness/Substantial Deficiency
Corrective Action: The Safety Department will revise this process to ensure that
review and approval of PPE is documented. Estimated date of completion is 1st
Quarter of 2015.
Subsidiary Subdivision
Safety & Training Safety Operations
Business Process
Internal and External Outreach Programs
Weakness/Deficiency: The Safety Department is responsible for implementing
various targeted outreach programs. For example, the T.R.A.C.K.S Program (Together
Railroads and Communities Keeping Safe) is a joint venture between Corporate Safety
and the MTA PD reaching out to schools, camps, day care facilities and community
groups stressing the importance of safety at grade crossings and the dangers of being
on or near the tracks. Operation Lifesaver is a joint venture between the Safety
Department and the MTA PD, in conjunction with LIRR’s Transportation Services
Department, the Public Transportation Safety Board (PTSB), and the Federal Rail
Administration (FRA). In 2013 over 7,000 pamphlets were distributed to pedestrians
and motor vehicle users and 16 system-wide events were held to educate the public
on the laws aimed at preventing pedestrians and motor vehicles from going around
lowered gates at railroad crossings. Internally, the ROWTF (Right-of-Way Task
Force) is a joint operation/partnership between the Safety Department and MTA PD
to review trend analysis and conduct real time patrols to identify potential security
breaches, homeless conditions, illegal dumping, encroachments, and trespass
conditions on LIRR property. Identified conditions are abated through coordinated
oversight of clean ups, enforcement, community education, and Right of Way
hardening (fencing). The Safety Department periodically reviews its Outreach
presentations and also establishes future goals for the Program, but documentation of
these reviews and projected goals was missing. Documentation should be
maintained to track the progress and success of the presentations for future reference
as well to monitor that goals set for the Program are reached.
Corrective Action: The Safety Department will revise this process to ensure the
review of Outreach presentations and establishment of Program goals is documented.
Estimated date of completion is 1st Quarter of 2015.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 55 of 114
MTA Long Island Rail Road – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Safety & Training Fire Marshal
Business Process
Corporate Fire/Life Safety Compliance Investigations & Audits
Weakness/Deficiency: The Office of the Fire Marshal (OFM) performs inspections to
ensure that the LIRR is in compliance with applicable codes, regulations and
corporate policies. Any deficiencies are recorded on the Office’s internal Fire
Inspection Corrective Action Form FM2. The FM2 form is then provided to user
department representatives responsible for taking corrective action. The OFM uses
an Annual Inspection Tracking Spreadsheet, which is populated based on the FM2
and used as the repository of all property inspections, deficiencies, and corrections.
According to the review, some information captured on the inspection forms FM2
was not entered on to the tracking spreadsheet. The spreadsheet needs to be
complete since it is the tool that OFM uses to ensure all deficiencies are addressed and
corrective actions are implemented.
Corrective Action: Effective immediately, the OFM will ensure all information from
FM2's is entered on to the tracking spreadsheet. In addition, the OFM is working
collaboratively with IT and MNR to procure a software solution to improve the
inspection and documentation process which would include a formal database to
replace the spreadsheet.
Subsidiary Subdivision
Safety & Training Fire Marshal
Business Process
Investigate and evaluate fires for causes and possible trends
Weakness/Deficiency: The OFM investigates and evaluates fires for causes and
possible trends with the goal of preventing recurrences of similar incidents. Follow-
up on the implementation of corrective actions resulting from fire investigations was
not documented. OFM needs to document and track corrective actions related to the
prevention of fire incidents to ensure they are implemented.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 56 of 114
MTA Long Island Rail Road – Material Weakness/Substantial Deficiency
Corrective Action: The Safety Department will implement a process to track the
completion of recommendations and corrective actions resulting from fire
investigations. Estimated date of completion is 4th Quarter of 2014.
Subsidiary Subdivision
Safety & Training Fire Marshal
Business Process:
The OFM conducts emergency response outreach training and drills with local
agencies that respond to emergencies on LIRR equipment e.g., M3/M7/C3/Diesel
Locomotives and at LIRR properties e.g., Welfare Facilities and Sub-Station Buildings.
OFM invites local Fire, Police and EMS units to receive training on how to protect
them when working on LIRR property and with LIRR equipment; prepare for
coordinated operations during rail emergencies; and ensure the safety of
customers/employees/general public.
Weakness/Deficiency: The Safety Department did not document its invitations to
outside entities to participate in LIRR training sessions. Also, information regarding
fire drills by the LIRR held during 2013 was not documented. Proper documentation
needs to be maintained occurring.
Corrective Action: The OFM will implement a process to document invitations to
outside agencies for LIRR training and fire drills held in a given year. Estimated date
of completion is 4th Quarter of 2014.
Subsidiary Subdivision
Safety & Training Fire Marshal
Business Process
Train Fire Wardens in First Aid, CPR & Automated External Defibrillation (AED).
Weakness/Deficiency: The OFM recruits employees interested in volunteering as
Fire Wardens and receiving associated Life Safety training. However, testing revealed
that the OFM did not have a current list of Fire Wardens and thus no evidence of
verification of meetings regarding receiving Life Safety training. It is important that
the OFM maintains such a list to ensure all necessary Fire Wardens are in place and
made aware of their roles and responsibilities during an emergency.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 57 of 114
MTA Long Island Rail Road – Material Weakness/Substantial Deficiency
Corrective Action: The Safety Department will implement a process to maintain a
current list of LIRR Fire Wardens and document meetings regarding receiving Life
Safety training. Estimated date of completion is 4th Quarter of 2014.
Subsidiary Subdivision
Safety & Training Safety Performance and
Hazard Assessment
Business Process
Internal Safety Performance Reporting
Weakness/Deficiency: Safety provides required reporting based on its evaluation of
conditions in an effort to improve the safety of employees, customers and the general
public. Testing revealed FRA Form 97, to be provided at the request of the FRA for
rail accidents & incidents, was not prepared in 2013. Safety needs to be in compliance
by making this data available every year at the FRA’s request.
Corrective Action: FRA form 97 will be prepared for 2014 to be provided at the
request of the FRA. Estimated date of completion is 4th Quarter of 2014.
Subsidiary Subdivision
Safety & Training Safety Performance and
Hazard Assessment
Business Process
System Safety Program Plan (SSPP) Maintenance/Conformance Evaluations
Weakness/Deficiency: The Safety Department maintains the SSPP per the APTA
Manual for the Development of System Safety Program Plans for Commuter Railroads
and ensures the safety of Employees/Customers/General Public and compliance with
regulations. However, the annual audit to be performed by Safety of the SSPP to
ensure conformance with and provide required updates as per APTA Standards and
anticipated FRA Rail Safety Improvement Act of 2008 (RSIA) Regulations was not
performed.
Corrective Action: The Safety Department will implement a strategy to implement
the SSPP audit. Estimated date of completion is 2nd Quarter of 2015.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 58 of 114
MTA Long Island Rail Road – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Safety & Training Training & Development
Business Process
Ensure Safety Department Instructors are Qualified
Weakness/Deficiency: Corporate Training is responsible for ensuring that all
instructors are up to date in their certifications. The review revealed that
spreadsheets used to track current employee certifications contained outdated
information and included certifications not applicable to the classes being taught.
Corrective Action: Certifications will be checked quarterly with effective dates
revised to reflect current status. Estimated date of completion was June of 2014.
Subsidiary Subdivision
Maintenance of Equipment Quality Assurance & Control
Business Process
Quality Control (QC) Inspections of Periodic Inspections, RCM, Fleet Modifications,
etc. performed in Maintenance of Equipment repair shops
Weakness/Deficiency: Maintenance of Equipment Quality Control performs
Periodic Inspections, Running Repair, Reliability Centered Maintenance,
Modifications, etc. in the Car Shops, Support Shops and Yards to verify workmanship
and compliance to regulations, specifications and documentation. Testing of the QC
process related to Support Shop Rebuilds detected deficiencies in management
reporting of inspection results. Specifically, some data was not transferred from
check lists to summary reports, multiple recordkeeping errors were uncovered and
monthly rebuild report summaries were missing from September - December 2013.
Corrective Action: On May 1, 2014, the QC Manager re-instructed staff with regard
to in-house recordkeeping, filing and accurate data transfer procedures.
Subsidiary Subdivision
Maintenance of Equipment Corporate Administration
Business Process
Management of Compensatory (Comp) Time
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 59 of 114
MTA Long Island Rail Road – Material Weakness/Substantial Deficiency
Weakness/Deficiency: LIRR corporate policy requires that compensatory time
worked be pre-approved. Testing revealed that some Comp Time forms were not
submitted to Central Manpower in a timely manner so they were not available for
review during testing.
Corrective Action: Central Manpower re-instructed staff and addressed the issue
with the group at a Quality Control meeting to ensure the timely record-keeping and
processing of Comp Time approval forms. MofE managers were also provided with
the Corporate Compensatory Time Policy.
Subsidiary Subdivision
Strategic Investments Corporate Administration
Business Process
Management of Compensatory (Comp) Time
Weakness/Deficiency: LIRR corporate policy requires that compensatory time
worked be pre-approved. Testing revealed that three (3) out of five (5) Comp Time
forms were not submitted for Comp Time worked.
Corrective Action: Going forward the secretary will remind staff that Comp Time
forms are required for each instance of Comp Time and will ensure all forms are
approved and filed. At year end, a departmental Comp Time report will be generated
from CTAMS and cross-referenced against Comp Time forms on file.
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Administration Human Resources
Business Process
Avoidance of Nepotism
Weakness/Deficiency: As a result of an MTA OIG Report, MNR’s hiring process
and procedure was deemed deficient in that the influence of family members/relatives
in hiring decisions was able to occur in certain instances.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 60 of 114
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Corrective Action: A new MTA All-Agency Anti-Nepotism Policy was issued in
September of 2013. As of December 2013, MNR HR has implemented a combination
of forms, conflict checks and justification memos to ensure that employees are
prevented from being involved in the hiring process of family members and relatives
and that successful candidates are hired solely on the basis of merit and qualifications.
A training program on the policy and new procedures has been developed and is
currently being delivered to employees who are involved in the hiring process.
Subsidiary Subdivision
Administration Human Resources
Business Process
Dual Employment
Weakness/Deficiency: The results of a NYS OSC Audit in 2013 found that MTA
employees were not complying with the rules governing outside employment while
employed with an MTA Agency. Several MNR employees were identified in this
Audit as having been out of compliance and appropriate corrective actions and
discipline were taken with these employees. Communication and recordkeeping
improvements were also noted.
Corrective Action: A memo covering dual employment and other ethics and
conflicts of interest topics was distributed to all employees by the General Counsel in
January of 2014. The employee newsletter and other employee communication
channels have also been utilized to reinforce key dual employment messages.
Recordkeeping and process improvements are being implemented.
Subsidiary Subdivision
Administration Human Resources
Business Process
Family and Medical Leave Case Management
Weakness/Deficiency: The results of an MTA Audit review of FMLA found that
controls over the FMLA process were not adequate and needed to be significantly
strengthened. Improvements were needed to streamline current practices, enhance
compliance with FMLA requirements, and improve recordkeeping.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 61 of 114
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Corrective Action: A new FMLA Administrator has been designated and is
working on process and administrative improvements, including a new written
procedure. Human Resources and IT personnel are upgrading the interface between
timekeeping systems and BSC PeopleSoft systems which will improve FMLA
management and monitoring.
Subsidiary Subdivision
Administration Human Resources
Business Process
Military Leave Management
Weakness/Deficiency: This item remains from the 2012-2013 review. The
results of an NYS OSC Audit issued in 2013 found that controls in place were not
consistently capturing relevant information for proper recordkeeping, accurate
payment and proper reconciliation. Communications between departments,
employees and Human Resources (HR) was found to be lacking as well. As a result of
staff turnover, and changes in internal processes, the corrective action still remains in
progress.
Corrective Action: A Human Resources Analyst was assigned to administer
Military Leave at MNR. The issues with the internal processes are still being
addressed. A comprehensive Policy and guidelines are still being developed with
MTA Headquarters, and other MTA agencies. This will clarify how reduced salary
payments are to be calculated, the proper documentation to be maintained to support
those calculations, and the proper documentation to be maintained in the employee’s
file. This also needs to address employees who fail to submit the necessary paper work
to support their military service.
Subsidiary Subdivision
Administration Occupational Health Services
Business Process
Safeguard Employee Medical Records
Weakness/Deficiency: Of the 86 files requested from the vendor for control
testing, 7 were unavailable. The vendor had no record for 5 of them and 2 were later
found to be in use within OHS.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 62 of 114
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Corrective Action: OHS is reviewing the file management practices of the vendor
in order to determine the appropriate corrective action to take.
Subsidiary Subdivision
Administration Training
Business Processes
Provide Mandated Employee Training for Operations Services Employees
Provide Mandated Employee Training for Maintenance of Equipment Employees
Provide Mandated Employee Training for Maintenance of Way Employees
Weakness/Deficiency: In its Operation Deep Dive Review, the Federal Railroad
Administration (FRA) found that the overall training of Metro-North employees is
inconsistent and often fragmented. The FRA directed that Metro-North evaluate the
structure, organization, and responsibilities of the Training Department to ensure it
develops, implements, and leads an effective training program for all operating
departments.
Corrective Action: To reduce fragmentation and ensure a coordinated training
program across Metro-North, Training & Development will be responsible for
oversight of all training functions at the railroad. This will be accomplished in stages,
through a phased transition. As an immediate step, for training functions currently
handled by departments other than Training & Development, Metro-North is
establishing a strong matrix reporting relationship from the head of the training
function in each department to the Senior Director, Training & Development. Also,
Training, Operations, and Safety are developing a phased strategic plan for the
reorganization or restructuring of training functions at Metro-North as appropriate.
Subsidiary Subdivision
Administration Training
Business Processes
Provide Mandated Employee Training for Operations Services Employees
Provide Mandated Employee Training for Maintenance of Equipment Employees
Provide Mandated Employee Training for Maintenance of Way Employees
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 63 of 114
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Weakness/Deficiency: In its Operation Deep Dive Review, the Federal Railroad
Administration (FRA) found that Metro-North’s training records system, the MTA-
wide PeopleSoft Enterprise Learning Management (ELM) system administered jointly
by the Business Service Center (BSC), is burdensome and inefficient, and that its
ability to serve as an effective system of training records management is questionable.
The FRA directed that Metro-North evaluate the existing recordkeeping system and
take corrective action, as necessary, to ensure accurate records are created,
maintained, and readily accessible to appropriate employees.
Corrective Action: MTA Information Technology (IT) and the BSC are working
with Metro-North’s Operations, Engineering, System Safety and Training
Departments to develop and implement a solution that will provide the required
functionality for effective tracking and reporting of employee training and
certifications. The overall goals include ensuring effective and reliable reporting that
satisfies regulatory as well as operating requirements; facilitating the identification
and tracking of certification status, including projected expiration; easing general
access and use of critical information by managers and support staff across the
organization; and streamlining data entry and reporting processes.
Subsidiary Subdivision
Administration Training
Business Processes
Provide Mandated Employee Training for Operations Services Employees
Weakness/Deficiency: As part of its Operation Deep Dive Review, the Federal
Railroad Administration (FRA) recommended that Metro-North establish a
mentoring program to enhance the training of new train and engine service
employees.
Corrective Action: Metro-North Training and Development, in conjunction with
the Operations Services Department, has significantly enhanced the mentoring
program for Locomotive Engineer trainees and established a parallel mentoring
program for Conductor trainees. The labor agreements are now in place, and the
programs are being piloted.
Subsidiary Subdivision
Administration Training
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 64 of 114
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Business Processes
Provide Mandated Employee Training for Maintenance of Equipment Employees
Weakness/Deficiency: In its Operation Deep Dive review, the Federal Railroad
Administration directed MNR to improve the quality and consistency of training for
employees who maintain rolling stock, as one of the directed actions for blue signal
protection for employees.
Corrective Action: Metro-North Training and Development, in conjunction with
Metro-North M of E, has already implemented initial improvements to blue signal
protection training delivered to all employees, and additional improvements will be
made on an ongoing basis. In addition, MNR Training and Development is
developing a new Supervising for Blue Signal Protection training program, focused on
those who supervise others in the implementation of blue signal protection.
Subsidiary Subdivision
Administration Training
Business Processes
Provide Mandated Employee Training for Maintenance of Way Employees
Weakness/Deficiency: As part of its Operation Deep Dive Review, the Federal
Railroad Administration (FRA) directed that Metro-North improve the quality and
consistency of training for track inspectors and other engineering department
employees, as part of an overall Metro-North training program.
Corrective Action: Metro-North’s Training and Development and Maintenance
of Way Departments have partnered to bring a vendor on board to deliver track
inspection training and mentoring services. This training is currently underway.
Metro-North Training and Development is also working to increase in-house staffing
available to deliver training to Maintenance of Way employees.
Subsidiary Subdivision
Controller Passenger Revenue
Accounting
Business Process
Ticket Refund Management
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 65 of 114
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Weakness/Deficiency: A recent MTA Audit of ticket refunds found that the
process and controls are in need of improvement. Certain procedures were not
consistently being followed, and system reporting capabilities were hampered by
incomplete data input.
Corrective Action: Written procedures have been updated and reinstruction of
staff has taken place where needed. Passenger Revenue Accounting (PRA)
Management is working with IT to upgrade the Refund/Claims database in order to
streamline the process for reviewing and approving refunds.
Subsidiary Subdivision
Maintenance of Equipment M of E Administration
Business Process
Manage M of E Vendor Contracts
Weakness/Deficiency: As a result of service contract audit, MTA Audit found
that the procedures for processing and reviewing invoices needed to be strengthened
in the Maintenance of Equipment Department (M of E).
Corrective Action: M of E has developed new written procedures and is
establishing an invoice review process that requires users to verify that the services
and products charged for have been provided, and that the amounts charged are in
accordance with contract pricing.
Subsidiary Subdivision
Maintenance of Way Communications & Signals
Business Processes
Grade Crossing Inspection and Maintenance
Signal Inspection
Weakness/Deficiency: As a result of the Federal Railroad Administration’s (FRA)
Operation Deep Dive review, the recordkeeping system used by MNR for signal and
grade crossing tests and inspections was deemed deficient. The lack of an efficient
electronic system to capture and record signal and grade crossing test and inspection
information could lead to insufficient testing/inspections or tests not being performed
according to their assigned schedules.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 66 of 114
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Corrective Action: The Communications and Signals Department is working
with several outside vendors on a pilot program to create an electronic system for
recording inspections, tests, and results. The first phase of work to be done by the
end of the year is to evaluate the vendors’ capabilities based on the identified needs
and requirements. The new system will enable improved scheduling and monitoring
of signal and grade crossing inspection and testing.
Subsidiary Subdivision
Maintenance of Way Grand Central Terminal
Business Process
GCT Inventory
Weakness/Deficiency: As a result of both MTA Audit and internal reviews, the
process for handling Grand Central Terminal (GCT) materials and inventory
continues to be deemed deficient. Controls are in need of strengthening in order to
ensure accountability and safeguarding of materials. A process and system for tagging,
tracking and monitoring of material that is being received, stored in inventory, and
used has not been fully developed and implemented.
Corrective Action: As of December 2013, a position was established to monitor
requisitions for new GCT material and help ensure that items that exist in inventory
are used first prior to additional material orders being placed. Organizational and
staffing changes have slowed down further progress on the larger process and system
changes that are needed.
Subsidiary Subdivision
Maintenance of Way Operating Capital
Business Process
Management and Monitoring of Diesel Fuel
Weakness/Deficiency: An audit of Metro-North’s Diesel Fuel management
revealed the possibility of discrepancies in delivery quantities and the amounts billed
for. Vendors in some cases did not provide information about delivery truck annual
inspections, or meter calibrations, and in some cases were lacking required safety
equipment. Fuel samples also indicated that some of the fuel was not in compliance
with all environmental specifications.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 67 of 114
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Corrective Action: Metro-North is in the process of filling a management
position that will oversee energy management, including fuel. The new position and
group will strengthen the ability of MNR to monitor, assess, and ensure proper
accountability for diesel fuel. Metro-North is reviewing all requirements and will
update the contracts, and future RFP’s accordingly.
Subsidiary Subdivision
Maintenance of Way Operating Capital
Business Process
Management and Monitoring of Heating Fuel
Weakness/Deficiency: A 2013 audit of Metro-North’s Heating Fuel Contract
revealed that some vendors were not in compliance with the terms and conditions of
the contract. The audit noted the contract requires that vendors comply with all state
and federal environmental laws with fuel specifications and delivery of fuel. The
invoice billing and reconciliation process was insufficient and not in compliance with
MTA guidelines. Written procedures to ensure vendor compliance were found to be
lacking.
Corrective Action: Metro-North management will take steps to improve the
heating oil invoicing verification and reconciliation process. Environmental
specifications (ES-001) have been updated. Delivery of heating fuel guidelines, as well
as an updated list of delivery contacts will be on file and a part of a comprehensive
Strategic Energy Management Plan. The updated environmental requirements and
specifications will be included in future heating fuel bid documentation.
Subsidiary Subdivision
Maintenance of Way Track & Structures
Business Process
Equipment Run Track Inspection
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 68 of 114
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Weakness/Deficiency: As a result of several operational incidents and subsequent
external reviews in 2013-14 (National Transportation Safety Board, Transportation
Technology Center, Inc. (TTCI) and the Federal Railroad Administration’s (FRA)
Operation Deep Dive), MNR’s Equipment Run Track Inspection process and related
follow-up actions was deemed deficient. The level and type of equipment run
inspections was determined to be inadequate for the size and condition of MNR’s
territory.
Corrective Action: The Track Department is expanding the number of equipment
run inspections that will be performed, as well as adding additional types of
equipment run inspections, including machine vision inspections. MNR is in the
process of procuring an Autonomous Track Geometry Inspection System (ATGIS),
which will be mounted on passenger rail cars and provide continuous information
about the condition of the right-of-way. In addition, equipment run inspection
information is being recorded and tracked in a new database which is used to ensure
corrective actions are implemented and that sign-off by Supervisors has taken place
on all FRA inspections.
Subsidiary Subdivision
Maintenance of Way Track & Structures
Business Process
Facility Inspection
Weakness/Deficiency: As a result of an MTA Audit of Facility Maintenance, the
need for a dedicated resource for Facility Inspections was identified.
Corrective Action: As the first step towards improvements to facility inspection
and maintenance, a dedicated position will assist the Department in prioritizing and
managing maintenance work and requests based on inspection results. In December
of 2013, a Facility Inspector was hired.
Subsidiary Subdivision
Maintenance of Way Track & Structures
Business Process
Facility Maintenance and Repair
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 69 of 114
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Weakness/Deficiency: As a result of an MTA Audit of Facility Maintenance, a
number of deficiencies were identified in the following areas of Facility Maintenance
and Repair: maintenance requirements; time standards and the tracking of
maintenance completion; and effectiveness of the Asset Management System (AMS)
for monitoring cyclical as well as corrective maintenance requests and work
completed.
Corrective Action: Track and Structures Management will develop a Strategic
Cyclical Maintenance Program Plan to prioritize MNR facilities through a tiered
system based on their criticality to railroad operations. Improvements to maintenance
requirements, time standards, and the monitoring and tracking of maintenance
activities will focus on first tier facilities, and the hiring of a Facility Inspector
referenced above is a first step towards realizing these improvements. Enhancements
will also be made to AMS to increase its effectiveness as a monitoring tool which will
assist in the transition to the MTA-wide Enterprise Asset Management initiative over
the next several years.
Subsidiary Subdivision
Maintenance of Way Track & Structures
Business Process
Track Maintenance and Repair
Weakness/Deficiency: As a result of several operational incidents and subsequent
external reviews in 2013-14 (National Transportation Safety Board, Transportation
Technology Center, Inc. (TTCI) and the Federal Railroad Administration’s (FRA)
Operation Deep Dive), MNR’s process used for Track Maintenance and Repair and
related follow-up actions was deemed deficient. The process did not provide
management with an effective way to record scheduled/unscheduled maintenance
and repairs; ensure corrective actions had taken place; or identify and analyze trends.
Management and staffing concerns were also raised in the reviews and are being
addressed through a comprehensive reorganization of the Track Department.
Corrective Action: The Track Department is working with the IT Department to
develop an Interim Asset Management Solution which will be an electronic
management system focused on inspections, scheduled/unscheduled maintenance and
repairs and will include reporting capabilities to track the completion of activities in
the field.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 70 of 114
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Maintenance of Way Track & Structures
Business Process
Visual Track Inspection
Weakness/Deficiency: As a result of several operational incidents and subsequent
external reviews in 2013-14 (National Transportation Safety Board, Transportation
Technology Center, Inc. (TTCI) and the Federal Railroad Administration’s (FRA)
Operation Deep Dive), MNR’s process used for Visual Track Inspection and related
follow-up actions was deemed deficient. The manual, paper-intensive process for
recording inspections and found defects made follow-up and close-out of required
actions difficult to track, and therefore, did not provide management with an
effective way to: prioritize defects; ensure corrective actions had taken place; or
identify and analyze trends. Management and staffing concerns were also raised in
the reviews and are being addressed through a comprehensive reorganization of the
Track Department.
Corrective Action: The Track Department is working with the IT Department to
develop an Interim Asset Management Solution which will be an electronic
management system focused on inspections, scheduled/unscheduled maintenance and
repairs and will include reporting capabilities to track the completion of activities in
the field.
Subsidiary Subdivision
Operations Operating Rules
Business Process
Administer the Drug and Alcohol Testing Program
Weakness/Deficiency: As a result of an MTA Audit, it was determined that the
frequency of the re-evaluation of covered positions and the random selection pool
needed to be increased. The audit also noted deficiencies with respect to
recordkeeping and that the records which ensure the appropriate testing rates are
being met should be clearly documented on an ongoing basis throughout the year.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 71 of 114
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Corrective Action: Operating Rules in conjunction with Operations
Administration and the Safety Department has re-evaluated the covered positions. In
addition, improvements to documentation, including the documentation of monthly
progress towards meeting the required testing rates, is being implemented.
Subsidiary Subdivision
Operations Operating Rules
Business Process
Efficiency Testing Program
Weakness/Deficiency: As a result of the Federal Railroad Administration’s (FRA)
Operation Deep Dive review, deficiencies were noted with MNR’s federally mandated
Efficiency Testing Program, which ensure that covered employees are performing
their required functions as intended. The review identified four areas in need of
improvement: testing and monitoring, compliance with stop signals, training, and
recordkeeping.
Corrective Action: MNR made immediate changes to the Efficiency Testing
Program in order to bring the program into compliance. Training of testing officers
has been completed, and a strengthening of the General Road Foreman’s Office will
ensure the appropriate types and frequency of testing is taking place. In addition,
enhancements to program record keeping and analysis of test results are in
development.
Subsidiary Subdivision
Operations Operations Administration
Business Process
Monitoring of Fuel Cards and Fuel Usage
Weakness/Deficiency: As a result of both MTA Audit and internal reviews, the
controls over fuel card usage for non-revenue vehicles and fuel dispensed into cans
for gasoline-powered equipment were deemed deficient.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 72 of 114
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Corrective Action: There has been a review of fuel cards and a reduction in the
overall number of cards along with adjustments to the limits on cards. The
implementation of Automated Vehicle Location Monitoring (AVLM) in all non-
revenue fleet vehicles will allow Operations management to more accurately monitor
fuel usage as AVLM data, fleet management data and fuel management system data
will be integrated. Exception reports will be developed and investigated in order to
increase the level of monitoring and accountability of fuel usage for non-revenue
vehicles and gasoline-powered equipment.
Subsidiary Subdivision
Operations Services Finance, Administration &
Crew Management
Business Process
Capital Support
Weakness/Deficiency: As a result of an Office of the State Comptroller Audit and
subsequent internal review, the process for recording and tracking Conductor Flag job
assignments and determining the length of a Conductor Flag’s job assignment on any
particular day was deemed deficient. The manual process lacked certain controls and
information about the jobs which could result in inaccurate payments to Conductor
Flag personnel.
Corrective Action: MNR is in the process of developing a software tool which
will track and record all aspects of Conductor Flag jobs from inception through
completion. This system, known as the Job Ordering Tracking System, will provide an
auditable electronic record of the job “design” (which will clearly state the scheduled
overtime requirements) as well as employee job assignments and deviations from the
scheduled assignments. It also provides an audit trail for any daily deviations that can
be referenced when OSD field supervisors determine the appropriate pay for the
Conductor Flag for that day. This system is expected to be completed by the end of
the year, and while it is being developed there is a temporary process in place for
documenting the job design which serves as pre-approval for the use of overtime.
Subsidiary Subdivision
Safety N/A
Business Process
System Safety Program Plan (SSPP)
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 73 of 114
MTA Metro-North Railroad – Material Weakness/Substantial Deficiency
Weakness/Deficiency: As a result of several operational incidents and subsequent
external reviews in 2013-14(National Transportation Safety Board (NTSB) and the
Federal Railroad Administration’s (FRA) Operation Deep Dive), it was determined
that MNR’s Safety and Security Department needed to be restructured. The FRA
review called for the evaluation of the structure, organization and responsibilities of
the Department.
Corrective Action: The evaluation of the Department has resulted in the redesign
of a new Office of System Safety (OSS), which is completely separate from the
Security functions. The expansion of the new OSS will address weaknesses identified
in the reviews, and new and/or redesigned and reorganized functional units
responsible for the following areas are being created: Risk Reduction; Field
Operations; Safety Support and Data Analysis; Investigations; and Fire Safety and
Emergency Management. Additional staff is currently being hired to ensure these
functions are appropriately resourced.
Fundamental to the new OSS’s work is the updating of the System Safety Program
Plan (SSPP) which establishes the core Safety programs, policies and initiatives which
will drive changes and improvements in the safety culture at MNR.
MTA New York City Transit – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Department of Subways Maintenance of Way/Track
Business Process
Track Cleaning
Weakness/Deficiency: The station track cleaning goal was not met in 2013
primarily due to a shift in manpower allocation to Intensive Track Bed Cleaning.
Additional sources of error are attributable to changing conditions during the year in
which certain sections of track required immediate attention and thereby took
priority over scheduled work. Fastrack work also resulted in schedule changes.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 74 of 114
MTA New York City Transit – Material Weakness/Substantial Deficiency
Corrective Action: All track bed cleaning that was scheduled but not completed
in 2013 will be rescheduled and completed by the end of the second quarter of 2014.
In addition, management will review the schedule for 2014 and modify cleaning
goals/plan in accordance with current priorities including Fastrack.
Subsidiary Subdivision
Department of Subways Maintenance of Way/Track
Business Process
Safety Training and Use of Personal Protective Equipment
Weakness/Deficiency: Testing revealed that 532 Track employees did not
complete the required Right-to-Know Training and 638 Track employees did not
complete the required Safety Training.
Corrective Action: A memorandum will be drafted immediately by the Assistant
Chief, to be issued by the Chief by no later than 03/31/14, instructing all field
Supervisors to notify the Training Liaison/Scheduler immediately if/when an
operating employee misses a scheduled training date. This will allow for quicker
rescheduling of those employees who are past due for training and an improvement in
the compliance rate.
Subsidiary Subdivision
Department of Subways Maintenance of Way/Track
Business Process
Hearing Conservation Program (HCP)
Weakness/Deficiency: The lists that were submitted semi-annually to the Office
of System Safety were not updated to reflect current information regarding HCP
participants in 9 out of 13 (69%) instances. During 2013, 404 (29%) out of 1,410
(71%) Track Maintenance HCP participants did not receive the required annual
training and audiometric testing.
Corrective Action: Under the review and supervision of a Superintendent, semi-
annual submittals to the Office of System Safety will be fully updated. A new training
liaison has been assigned to assume the responsibilities related to the training and
testing of individuals in the HCP. Active employees who missed training and testing
in 2013 will be rescheduled to complete training and testing by 6/01/2014. Non-
active personnel will be trained and tested upon their return to paid status.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 75 of 114
MTA New York City Transit – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Department of Subways Maintenance of
Way/Infrastructure
Business Process
Track Flagging
Weakness/Deficiency: An audit performed by OSS in 2013 showed that 6 (22%)
out of 27 job sites did not use proper flagging techniques.
Corrective Action: To reduce the error rate and better train the Night
Supervisors for 2014, Infrastructure Night Managers will make unannounced
documented Safety Flagging audits. During these audits, Managers will observe and
Instruct the night Supervisors on how to better implement a safety-compliant work
zone.
Subsidiary Subdivision
Department of Subways Maintenance of
Way/Infrastructure
Business Process
Random Drug and Alcohol Testing
Weakness/Deficiency: All Infrastructure groups have their own log books,
leading to discrepancies in recordkeeping. The review showed that only 64 out of 162
Logbook Entries (40%) indicated the time of receipt of notification.
The review of the Random Testing Program Compliance Unit’s (RTPCU)
Infrastructure Report indicated a 75% compliance rate. Out of 320 random reviews
conducted, 81 G-46 issue times were missing.
Corrective Action: The deficiencies cited are primarily related to recordkeeping
issues (versus compliance with appropriately sending employees for testing according
to proper procedure). A Memorandum will be drafted by 03/31/14 for the Chief to
issue to all subdivision managerial and supervisory staff outlining the policies and
procedures associated with Random Drug and Alcohol Testing and the importance of
the following:
- Recording Time of Receipt of Notification in logbooks
- Retaining copies of signed “Random Testing Guidelines and
Acknowledgement Forms” in employee files.
- Providing a complete documentation to the RTPCU.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 76 of 114
MTA New York City Transit – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Department of Subways Maintenance of
Way/Electrical-Power
Business Process
Emergency Response
Weakness/Deficiency: A review of the 2013 Annual Inspection Report for
emergency generators revealed that 136 of 204 (67%) scheduled monthly inspections
were not completed as required.
Corrective Action: In 2014 there will be a Utility Crew created to improve the
monthly inspections and maintenance requirements.
Subsidiary Subdivision
Department of Subways Maintenance of
Way/Electrical-Signals
Business Process
Safety Training and Use of Personal Protective Equipment (PPE)
Weakness/Deficiency: Five (5) unannounced field visits to Signals locations,
revealed that 2 locations did not have the “Check Safety” or contain the required
current signage, safety grams and notices. In 2013, 35% of required Signals employees
did not complete the Organic Solvents and Coats, Adhesives and Sealants training.
Corrective Action: All General Superintendents, Superintendents and
Supervisors will be reinstructed, via memo, to distribute safety material/posters in a
timely manner as well as monitor Signal Section Bulletin Boards as required.
The names of employees who are past due for “Organic Solvents” (Code SS36) and
“Coats, Adhesives and Sealants” (Code SS37) training will be provided to Signals
General Superintendents by 2/28/14. The target date for completion of past due
training is 12/31/14.
Signals will also send additional employees for PeopleSoft Training in order to
increase the number of personnel capable of entering completed Right-to-Know
Training Course information into the system.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 77 of 114
MTA New York City Transit – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Department of Subways Maintenance of
Way/Electrical-Signals
Business Process
Hearing Conservation Program (HCP)
Weakness/Deficiency: A review showed that 49 (28%) out of 177 employees in
the Signals HCP did not attend the Audiometric exams.
During the scope of the review, it was revealed that Division of Signals Supervisors
are not documenting their verbal instructions to employees regarding the quiet-time
requirement.
Corrective Action: Division of Signals Managers will create a database to track
and monitor to ensure 100% participation in the mandated Annual Training and
Audiometric Testing. Managers will be provided with the list of the past-due
employees by the IC Tester and instructed to schedule these employees for testing
and training immediately or upon the employees’ return to active service.
Supervisors will be required to documented on the G-46 and informing the employee
of the 14-hour Quiet-time.
Subsidiary Subdivision
Department of Subways Maintenance of Way/Elevators
and Escalators (E&E)
Business Process
Safety Training and Use of Personal Protective Equipment
Weakness/Deficiency: The review revealed that 43 E&E employees did not
complete the required Right-to-Know Training and 108 E&E employees did not
complete the required Safety Training.
Corrective Action: By 03/01/14, a memorandum will be sent out by the Chief to
instruct all field Supervisors to notify their respective Training Schedulers
immediately when one of their operating employees misses a scheduled training date.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 78 of 114
MTA New York City Transit – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Department of Subways Maintenance of Way/Elevators
and Escalators (E&E)
Business Process
Procurement Cards
Weakness/Deficiency: The review revealed that 1 (20%) out of 5 cardholders
submitted Monthly Activity Forms and Statements without proper signatures, and
approvals. In addition, 13 (25%) of 53 Monthly Statements did not have complete sets
of supporting documentation, including receipts and forms.
The review also indicted that 1 (20%) out of 5 did not comply with the stated policy.
Corrective Action: The MOW Procurement Card Coordinator will re-issue the
MOW Centralized Policy for Expenditure Approval as well as a copy of Materiel
Department Procedures DPM-III-E. Also, effective for year 2014 purchases,
cardholders will receive all their original receipts and the centralized procurement
desk will hold copies only.
Subsidiary Subdivision
Department of Subways Division of Rapid Transit
Operations (RTO)
Business Process
Fire and Smoke Conditions/Fire Prevention
Weakness/Deficiency: Management’s review revealed 1,609 out of 2,521
employees were scheduled and attended Fire Prevention training. However 912
(36%) employees who should have been scheduled for training were not and did not
attend.
Corrective Action: Service Delivery/Rapid Transit Operations/Facilities and
Safety Management will support continued aggressive hiring which will allow the
scheduling of Fire Prevention Training/Refresher for one-third of the hourly and
supervisory employees each year.
Subsidiary Subdivision
Department of Subways Division of Rapid Transit
Operations (RTO)
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 79 of 114
MTA New York City Transit – Material Weakness/Substantial Deficiency
Business Process
Fire and Smoke Conditions/Emergency Response and Evacuation
Weakness/Deficiency: The Management review indicated that 2,521 employees
were to be scheduled for Fire Prevention Training but only 1,609 employees were
actually scheduled and attended, while 912 (36%) employees were not scheduled. In
addition, multiple forms were being used for the inspection of crew quarters resulting
in a lack of control over inspections. Also, 2 out of 24 Lines had not posted the Fire
Evacuation plans.
Corrective Action: Service Delivery/Rapid Transit Operations/Facilities and
Safety Management will hire additional staff which will allow Scheduling of fire
prevention training/refresher to selected hourly and supervisory employees each year.
Service Delivery/Rapid Transit Operations/Facilities and Safety Management will
utilize one standard form for the Weekly Crew Quarters Inspection Form. Locations
will be re-visited to ensure that Emergency Action Plans have been posted.
Subsidiary Subdivision
Department of Subways Division of Stations
Environment
Business Process
Fire and Smoke Conditions/Fire Prevention
Weakness/Deficiency: Management’s review of 862 Fire Prevention and
Evacuation training records concluded that 100 (11.6%) employees did not attend Fire
Prevention and Evacuation training when scheduled.
Corrective Action: Conduct an internal campaign utilizing mass calls, bulletins
and posters to reinforce the importance of attend training. Management will also
partner with the union to inform employees of the importance of attend training
classes and the possible ramifications of failing to comply.
Subsidiary Subdivision
Department of Subways Division of Stations
Environment
Business Process
Fire and Smoke Conditions/Emergency Response and Evacuation
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 80 of 114
MTA New York City Transit – Material Weakness/Substantial Deficiency
Weakness/Deficiency: The review of 1 Fire Prevention Training Report
concluded that 100 (11.6%) out of 862 employees, 88 assigned to Station Operations
and 12 Terminal Operations did not attend the Fire Prevention Refresher training.
Corrective Action: Conduct an internal campaign utilizing mass calls, bulletins,
and posters to reinforce the importance of training. Also, management will partner
with the union to inform employees of the importance of attending training classes
and the possible ramifications of failing to comply.
Subsidiary Subdivision
Department of Subways Division of Stations
Environment
Business Process
Hearing Conservation Program-Scheduling
Weakness/Deficiency: The review of the Hearing Conservation Training Records
revealed that 293 employees were scheduled for the Specialty Cleaning training, and
22 (7.5%) did not attend. For Terminal Cleaners, the records indicate 49 employees
were scheduled and 9 (18%) did not attend.
No disciplinary action was taken with employees that failed to attend training or
audiometric testing, as is required.
Corrective Action: Conduct an internal campaign utilizing mass calls, bulletins,
and posters to reinforce the importance of training. Partner with the union to inform
employees of the importance of attending training classes and the possible
ramifications of failing to comply. Interview employees who do not comply
concerning the importance of monitoring employees exposed to workplace noise level
that can lead to hearing loss.
Subsidiary Subdivision
Department of Subways Division of Stations
Environment
Business Process
Safety Training
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 81 of 114
MTA New York City Transit – Material Weakness/Substantial Deficiency
Weakness/Deficiency: The Safety Training Records review revealed that 383 of
1,671 (23%) employees did not attend Asbestos Training. In addition, 2,372 of 11,423
(21%) employees did not attend Right-to-Know modules 1, 2 and 3 training.
There was no disciplinary action was taken for not complying with Safety Training
mandates.
Corrective Action: Station Environment will conduct an internal campaign
utilizing mass calls, bulletins, and posters to reinforce the importance of training.
Stations will also partner with the union to inform employees of the importance of
attending training classes and the ramifications of failing to comply.
Subsidiary Subdivision
Department of Subways Division of Service Delivery-
Operations Support/Safety
Business Process
Hearing Conservation Program (HCP)
Weakness/Deficiency: Management’s review and monitoring of employee
attendance records for compliance with Hearing Conservation Training and Hearing
Conservation Testing for employees revealed the following which did not comply
with training mandates:
- Hearing Conservation Training: 22 (7.5%) employees assigned to
Specialty Cleaning and 9 (18%) of Terminal Cleaners did not attend training
when scheduled.
- Audiometric Testing: 39 (9.3%) employees assigned to Specialty
Cleaning and 2 (4.0%) of Terminal Cleaners did not attend audiometric
training.
- No disciplinary action was taken with Station and Terminal Cleaners that did
not comply with training and Audiometric Testing.
Corrective Action: Stations Environment will conduct an internal campaign
utilizing mass calls, bulletins, and posters to reinforce the importance of training;
partner with the union to inform employees of the importance of attending training
classes and the possible ramifications of failing to comply; and, interview employees
who do not comply concerning the importance of monitoring employees exposed to
workplace noise level that can lead to hearing loss.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 82 of 114
MTA New York City Transit – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Department of Subways Division of Service Delivery-
Operations Support/Safety
Business Process
Scheduling/Safety Training
Weakness/Deficiency: The review of 2,120 employee training records by
Management indicated that 194 (9.1%) employees were not in compliance with
mandated training.
Corrective Action: Conduct an internal campaign utilizing mass calls, bulletins,
and posters to reinforce the importance of training; partner with the union to inform
their employees of the importance of attending training classes and the ramifications
of failing to comply.
Subsidiary Subdivision
Department of Subways Division of Staten Island
Railway
Business Process
Payroll, Timekeeping & Attendance (various departments)
Weakness/Deficiency: The SIR Finance department did not reconcile the
paycheck disbursements register, the BSC upload (excel spreadsheet) and the source
documents (exception claim forms and punch cards).
The findings indicate that hours recorded on 7% of the paychecks on the SIR Daily
Summary Sheet exceeded the hours recorded on the Punch Cards/Daily Roster
Sheet/Exception Claim Forms.
The review also found that 17 out of 359 (5%) employees Punch Cards, Daily Roster
Sheets and documents supporting explanations for employee’s absences could not be
located and there was no procedure in place for reconciling the actual attendance
records with scheduled hours.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 83 of 114
MTA New York City Transit – Material Weakness/Substantial Deficiency
Corrective Action: SIR Finance Department will perform monthly
reconciliations between the paycheck disbursements Register and the BSC upload
spreadsheet, and on a periodic basis reconcile the source documents (exception claim
forms and punch cards) to be BSC upload spreadsheet. In addition, it will investigate
the overtime variance and seek a recovery of the overpayment. Additionally, they
will formally re-instruct timekeeping personnel to maintain all source documentation
supporting timekeeping and overtime activity.
Subsidiary Subdivision
Department of Subways Division of Staten Island
Railway
Business Process
Protection of Social Security Numbers: Employee Accident/Injury Report
Weakness/Deficiency: Due to office renovation/relocation, files that contain
social security numbers were temporarily stored in a non-restricted access area.
Corrective Action: The SIR contract for the new leased area includes the
installation of cameras throughout the facility, electronic door swipes and an alarm
system in the secure areas designated for employee document storage.
Once SIR management was apprised of the situation involving the non-compliance
with restricted access to the files containing employees’ social security numbers, the
following measures were implemented immediately:
- All employees files were transferred to locked storage cabinets
- SIR employees moved into the new work area and non-employees
(contractors) were disallowed access to the file storage.
- SIR management will move files to a secured off-site storage facility or to a
NYCT secured location in the event that a similar situation arises.
Lastly, Staten Island Railway will evaluate its internal documentation retention policy
by 06/01/14 to determine compliance with NYCT’s document-retention policy. Once
completed, all files and documents that exceed the retention period will be sent to the
Livonia Storage Facility by 12/31/2014.
Subsidiary Subdivision
Department of Subways Division of Staten Island
Railway
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 84 of 114
MTA New York City Transit – Material Weakness/Substantial Deficiency
Business Process
Protection of Social Security Numbers/ Personnel and Related Employee Records
Weakness/Deficiency: The inspection of the file storage area revealed that due to
the office renovation/relocation, SIR temporarily stored files containing social
security numbers in areas with non-restricted access. The review further revealed
that there is no written procedure outlining locked storage of the facility, the file
cabinets and alarm system. Also the review indicated that SIR kept reports and
documents longer than the required retention requirement period.
Corrective Action: Cameras will be installed throughout the new facility in
addition to electronic door swipes and an alarms system in the areas designated for
employee document storage.
SIR management immediately transferred all employees’ files to a secured area with
locked storage cabinets to address the non- compliance with restricted access to the
employees confidential files. Non-employees are no longer permitted to access to the
file storage rooms.
Subsidiary Subdivision
Department of Buses N/A
Business Process
Depot Maintenance/Vehicle Accountability
Weakness/Deficiency: The lack of oversight by management in 8 of 21 depots
resulted in reconciliation sheets not being reviewed and approved. In addition, the
Facility Rotation sheets were not attached to the yard package during the first two
quarters of testing and vehicle accountability sheets were not signed by the
supervisor.
Corrective Action: All depot supervision and management were reinstructed on
the vehicle accountability policy.
All Yard Dispatchers, vacation relief and extra list personnel were re-instructed on
Vehicle Accountability procedures after the audit results for the first three quarters.
Rotation sheets are now used to ensure vehicle accountability sheets are accurate. The
supervisor who failed to sign the vehicle accountability sheet was re-instructed by the
General Superintendent of Transportation.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 85 of 114
MTA New York City Transit – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Department of Buses N/A
Business Process
Fuel Administration/Daily Fuel Reconciliation
Weakness/Deficiency: The review of 24 Daily Summary Reports found 9 samples
that were not reviewed or approved by Management, 3 of which were not completed
properly as required. In addition, the lack of oversight by depot personnel and depot
management resulted in the improper preparation of fuel tracking forms.
Lack of supervisory oversight resulting in information not being documented,
completed and reviewed as required.
Corrective Action: Depot personnel were re-instructed on the proper form and
approval requirements.
The General Superintendent (GS) of Maintenance will ensure that the Line
Supervisor documents the reasons why any information is missing or not completely
correctly. The GS will also ensure that SPEAR is routinely checked for information
that initially was not available. All information obtained and documented will be
reviewed and signed off by the GS.
Subsidiary Subdivision
Department of Buses N/A
Business Process
Fuel Administration/ Fuel Sampling
Weakness/Deficiency: During the first quarter of 2013, three diesel fuel sample
manifests were not signed by the appropriate level of management in 3 of 20 depots,
due to non-compliance with policy.
Corrective Action: Line Supervisors were re-instructed to verify that all
documentation for diesel fuel samples be reviewed and signed-off by management.
Subsidiary Subdivision
Department of Buses N/A
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 86 of 114
MTA New York City Transit – Material Weakness/Substantial Deficiency
Business Process
Fuel Administration/ Fuel Delivery Procedures
Weakness/Deficiency: In the first and second quarter of the year, the review
revealed a total of six Diesel Fuel Delivery Checklists that were not fully completed
during the time of delivery in 7 of 15 depots.
Corrective Action: All depot Line Supervisors were re-instructed on the Diesel
Fuel Delivery Policy for the proper completion of diesel fuel delivery
documentations.
Subsidiary Subdivision
Department of Buses N/A
Business Process
Environmental Compliance/Spill Containment Reporting
Weakness/Deficiency: A review of the Depot’s Spill Form/Log revealed that one
spill occurred during the 2013 operating year. However, the Command Center was
not notified, as is required. Fuel procedures stipulate that all spills are to be reported
to the Command Center.
Corrective Action: General Superintendent of Maintenance was re-instructed on
the proper procedures for reporting and documenting spills that occur in the depot.
Subsidiary Subdivision
Department of the Executive Vice President Division of
Telecommunications &
Information Services (“TIS”)
Business Process
Coordinate Disaster Recovery (DR) drills
Weakness/Deficiency: A review of the DR plan status for all critical systems was
conducted between January and October 2013 and revealed the following:
- There were 162 applications which are categorized as critical with a recovery
time objective of 24 hours or less. Of this total, 55 applications (34%) do not
have a DR plan.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 87 of 114
-
MTA New York City Transit – Material Weakness/Substantial Deficiency
Corrective Action: The NYCT DR unit in coordination with Contract
Management will review Problem logs and perform detailed root cause analyses in
order to implement appropriate remedial measures. As a part of the contract
agreement, revised DR plan will be tested in the re-drill scheduled for March 11,
2014.
Subsidiary Subdivision
Department of the Executive Vice President Division of TIS
Business Process
Manage the Unisys Contract for SLA 3.2.2 Asset Tracking (hardware) –
Contract # 03A8602-2
Weakness/Deficiency: Due to manpower shortages in Contract Services and
Account Management (CSAM), the Vendor’s operational data reports have not yet
been reviewed and transmitted to NYCT Materiel Division, Technology Contract
Management.
Corrective Action: By the end of 1st Quarter 2014, CSAM will review the SLA
3.2.2 reports so they can be transmitted to NYCT Materiel Division, Technology
Contract Management.
Subsidiary Subdivision
Department of the Executive Vice President Division of TIS
Business Process
Manage the Unisys Contract for SLA 3.2.5 Asset Tracking (software) –
Contract # 03A8602-2
Weakness/Deficiency: Due to manpower shortages in Contract Services and
Account Management (CSAM), the Vendor’s operational data reports have not yet
been reviewed and transmitted to NYCT Materiel Division, Technology Contract
Management.
Corrective Action: CSAM will review the reports by the end of 1st Quarter 2014
so they can be transmitted to NYCT Materiel Division, Technology Contract
Management.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 88 of 114
MTA New York City Transit – Material Weakness/Substantial Deficiency
Subsidiary Subdivision
Department of the Executive Vice President Division of TIS
Business Process
Manage the Unisys Contract for SLA 4.2.4 – Timely Completion of Service Requests –
Contract # 03A8602-2
Weakness/Deficiency: Due to manpower shortages in Contract Services and
Account Management (CSAM), the Vendor’s operational data reports have not yet
been reviewed and transmitted to NYCT Materiel Division, Technology Contract
Management.
Corrective Action: CSAM will review the reports by the end of 1st Quarter 2014
so that they can be transmitted to NYCT Materiel Division, Technology Contract
Management.
Subsidiary Subdivision
Office of System Safety N/A
Business Process
Hearing Conservation Program – (HCP) Reporting
Weakness/Deficiency: The Department of Buses (DOB) submittal contained
omissions (i.e., entries were not made in the appropriate fields/and or missing data).
The DOB’s Bronx, Brooklyn, Manhattan, Queens , Staten Island Divisions and Central
Maintenance Facility, and SIR submittals indicated noncompliance due to lack of
adequate employee participation in HCP training and/or audiometric testing.
Corrective Action: OSS met with DOB’s Vice President and HC Representative
to discuss the deficiencies. OSS sent memos to the Department Heads outlining
deficiencies.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 89 of 114
Part 4. The Internal Control Program Details 2013-14
MTA Headquarters
Annual “Risk Assessments” were conducted by all departments where major business
activities were risk ranked and controls over those risks identified. Cycle testing is
used where all “high risk” items are reviewed annually and medium to low risk
ranked items are reviewed on a cycle of once every three years to once every five
years depending on rank level. In each previous cycle risks were adjusted up or down
to reflect changed conditions.
The vulnerability assessments from the prior year were sent to all departments and
reviewed with their Internal Control Coordinators.
As to items to be tested, each department with the assistance of the Internal Control
coordinator and the Internal Control Officer determined what the standards will be
for testing in their department. These standards must be consistent with the training
and re-training which the coordinators received from the Internal Control Officer on
testing.
Most test results were reviewed with department management. All test results were
reviewed by the Internal Control Officer. Items for which corrective actions were
required were noted and monitored. If any substantive issues were found they were
raised to the attention of senior management.
MTAHQ management is required to respond to each audit recommendation with a
corrective action plan detailing steps that have or will be taken to address the
recommendation. Since 2009 Corporate Compliance has monitored all outstanding
audits and reports to the MTA Audit Committee all audit recommendations that have
exceeded their planned implementation date by six months or more.
Quarterly requests to appropriate individuals for updates on the status of corrective
actions are performed.
Audit recommendations, corrective action plans and the vulnerability assessments are
stored electronically. MTA has begun to move the information to its new GRC
platform which will reduce paper, allow easier follow up via e-mails, maintain a
historical record, and allow easier transfer of information. Corrective actions that
have exceeded their implementation generate an email to both the individual
responsible for implementation and to Corporate Compliance.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 90 of 114
MTA Headquarters
During 2013-2014 MTAHQ instituted a number of initiatives to sustain the
effectiveness of the internal control program. MTAHQ provided extensive training to
staff on how to utilize the GRC applications. Corporate Compliance continued a
project to map all regulatory disclosure requirements with their corresponding
business processes in GRC.
MTA Bus Company
The Chief Officer, Internal Studies and Operation Improvement is responsible for the
overall internal control program. The Director, Internal Controls manages the
program on a day-to-day basis. The Director is assisted by an Analyst. The Director
coordinates the internal control program with liaisons in each department. The
Director provides annual training to the liaisons and ongoing assistance and
mentoring through the year. Automated records of all aspects of the program are
maintained. In recent years, the Director has re-engineered many of the program
steps to provide increased structure and consistency. The Director will continue to
evaluate the program for further opportunities for economies and efficiencies.
MTA Bridges and Tunnels
The MTA Chief Compliance Officer disseminates information related to activities of
the Office of the State Comptroller with respect to internal controls at the quarterly
ICO meetings. Information regarding any significant changes is then provided to
applicable staff at all levels.
All information on vulnerability self-assessments, internal control testing, and
corrective action plans is captured and documented centrally and entered into one
PC-based tracking system. A component of this system documents the corrective
actions planned or taken. The documentation of corrective action plans are
periodically reviewed by the ICO for appropriateness as well as for open items. Based
on this review, the ICO requires DICCs to follow up with departmental management
to ensure that corrective action was taken as reported, and if not resolved, continue to
report changes in the status of these actions until they are resolved.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 91 of 114
MTA Bridges and Tunnels
All departments establish a detailed risk-based testing plan that closely links control
testing frequency to the relative risk defined in each department's vulnerability
assessment. This allows managers to better plan for and allocate resources for testing.
Using this plan, each department establishes goals for testing with the ICO at the
beginning of the year. Subsequent progress against those goals is reported monthly by
the ICO to the President.
Once activity managers perform control testing, the results of such testing are
reported to the ICO, after the respective DICC and Department Head have reviewed
the tests and signed off on the document. These enhancements have continued to
increase both the number and quality of internal control testing performed and
reported on each year.
In addition, MTA B&T has implemented, on its Intranet site, a section dedicated to
the B&T Internal Control Program. This section includes an Intranet based training
program for employees to obtain, on-line, basic awareness of internal control
concepts. It also contains B&T and MTA All-Agency Policies, internal control related
forms, and other information on the Internal Control Act, and internal control
standards and techniques.
In December 2013, a detailed classroom-based course on implementing the B&T
Internal Control Program and compliance with the Internal Control Act was provided
to selected managers.
In 2014, the effectiveness of departmental compliance with the B&T Internal Control
Program will be further reviewed, including evaluations of the adequacy of
vulnerability assessments and quality of internal control testing performed. Effective
the end of 2014, the B&T Internal Control Program will be interfaced into the
Compliance Management Software System (GRC).
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 92 of 114
MTA Capital Construction
The Internal Control Program at MTACC is coordinated by the Director of Internal
Controls with assistance from the ICC. The program is ongoing and includes a
periodic review and self-assessment of MTACC’s functions and the processes used to
assure that objectives are achieved. Program areas and departments are required to
establish a detailed risk-based testing plan that closely links control testing frequency
to the relative risk defined in each area’s vulnerability assessment. This plan allows
managers to allocate resources for testing. Using this plan, each area establishes goals
for testing with the ICC/ICO. The results of testing are reported to the ICO. Based on
the results of the tests a corrective action implementation plan is proposed for the
subsequent certification period.
Projects currently managed by MTACC, with an estimated value of over $16, billion,
are funded in part through the FTA and are therefore subject to additional scrutiny.
Supplemental testing of project management controls for these projects are performed
by an independent engineering firm(s) hired by the FTA. Their recommendations are
incorporated into MTACC’s testing program.
MTACC capital project and program management activities are performed in
accordance with uniform methods, standards, procedures and guidelines (established
by MTACC, NYCT Capital Program Management and MTA Headquarters), to assure
that project management activities are performed efficiently and in a manner that
best serves the interests of MTACC.
MTACC’s system of internal control is based on New York State laws, including
standards developed by the State Comptroller such as: Standards for Internal Control
in New York State Government.
The Standards for Internal Controls in New York State Government and MTA
Agency Wide Enterprise Risk Management and Internal Control Guidelines, are the
source for MTACC’s training on internal controls. MTACC’s training program also
refers to applicable provisions of the Public Officers Law, including rules on ethics
and conflicts of interests. Included in the training materials is the Managers Guide
for testing compliance with internal control requirements. Where applicable, we
incorporate recommendations made by the New York State Internal Control Task
Force report.
Key features of the MTACC internal control program include:
Identifying, reviewing, and testing controls used to manage risk.
Developing and implementing corrective action plans where applicable.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 93 of 114
MTA Capital Construction
Documenting control reviews, procedures, policies, and standards of operation for
key business activities.
Disseminating appropriate internal control information to employees, including
relevant departmental procedures.
The ultimate objective of the program is to provide reasonable assurance that
MTACC’s operations are functioning effectively and efficiently, and that
department goals are being achieved.
Information is communicated (for all projects) between and among all levels at
MTACC to help the Agency achieve its objectives in areas such as project
management, quality assurance, financial reporting and compliance. Operations are
monitored in two ways: through ongoing or continuous monitoring of activities and
through regular evaluations. The information received as a result of this monitoring
process is communicated to appropriate management.
The ongoing or continuous evaluations are performed by the respective Program
Managers, Project Managers, Design / Construction Manager, Construction
Coordinators, Field Engineers and field personnel at site locations. These individuals
are responsible for verifying and documenting that the contractor is completing the
project according to contract specifications. For example, production meetings are
scheduled on a regular basis to discuss items such as drawings, materials, fabrication,
acceptance testing and other issues relating to the production schedules.
More specifically; weekly staff meetings are held with all direct reports and bi-weekly
meetings are held with all Project Management Teams. On a monthly basis MTACC
reports to the MTA Board of Directors at their Capital Program Oversight Committee
and Finance Committee meetings. On a bi-monthly basis a project status meeting is
held with the MTA/MTACC Security Team. There is also a quarterly oversight
meeting with the FTA. Other meetings are scheduled as needed.
Annual Risk “Vulnerability” Assessments are conducted by all departments to ensure
that their activities are still relevant. The risk assessments require the departments to
identify major business activities, to determine the ranking, and to develop the
related controls and tests to manage and mitigate the identified risk. The ICC and
Business Process Owners are responsible for reviewing prior year vulnerability
assessments with their departments and coordinating their business process testing.
Testing standards and results are reviewed by the ICO to ensure compliance with
standards.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 94 of 114
MTA Capital Construction
The ICO updates and provides awareness training to the ICC and MTACC Executives
on good internal control practices. Additionally, the ICO provides guidance to the
ICC, departments and business process owners on assessing risks, mitigating controls,
and remediating control deficiencies. This includes ongoing feedback on MTACC’s
internal control process is reviewed annual to ensure the adequacy of the program.
Adjustments are made to the program based on the review.
MTA Long Island Rail Road
The Internal Control Program is overseen by the ICO, who delegates administration
of the Program to the BPMCC’s DCAs under the supervision of the Director, BPMCC.
The DCAs work closely with the MOCAs throughout the year ensuring that the
elements of The Act are adhered to and the LIRR’s Program is functioning as
intended.
In 2013, the DCAs met with the various departments to ensure the activities on their
Vulnerability Assessments reflected their current processes. Also, the DCAs
participated in four (4) corporate training classes to provide employee awareness of
the internal control process.
In January 2014, the ICO, Director of BPMCC and the DCAs met with the MOCAs
and Department Heads to kick off the Program for the current year by reviewing the
goals and procedures related to the Program. The new 2013 COSO framework was
also discussed at the meeting and attendees were given the opportunity to ask
questions about the implementation of the new framework. Additionally, the DCAs
informed the attendees about the new Governance Risk Compliance (GRC) database
which will be used in the near future. BPMCC chose selected departments to
participate in a pilot of GRC to ensure familiarity with the system. To date, all LIRR
VAs have been entered into GRC with the goal of implementing the database and its
components by the next reporting period.
MTA Metro-North Railroad
Metro-North’s Corporate Compliance unit is comprised of two positions: a Deputy
Director for Corporate Compliance & Strategic Development, who is the ICO, and a
Manager of Corporate Compliance. Together, they are responsible for managing
Metro-North’s Internal Control Program. They are assisted by Internal Control
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 95 of 114
MTA Metro-North Railroad
Coordinators, who serve as the Departmental contacts for ensuring the completion of
internal control reviews. The Corporate Compliance unit is also responsible for
maintaining and updating Metro-North’s corporate policies and procedures. The
Deputy Director is a member of MTA’s Enterprise Risk Management Committee, and
works directly with the MTA’s Chief Compliance Officer on MTA all-agency internal
control and policy matters. Finally, the unit serves Metro-North in a business
improvement capacity through internal process reviews and audit liaison work with
MTA Audit Services and external auditors.
The major accomplishment of the Internal Control Program this year is the transition
to utilizing GRCM for all internal control reviews.
Departments have assessed their major functions with a focus on identifying and
assessing the most significant business processes which are critical to achieving their
objectives as a Department. By using new guidance on risk assessments and ratings,
Departments are all utilizing a consistent approach to rating risk which is based on a
comprehensive assessment of the significance of impact and likelihood of occurrence
of the risk. Testing is the other area where improvements have been made, in part
based the new GRCM’s system capabilities. Testing instructions and results are more
clearly defined and reported in GRCM, and the ability to upload relevant testing
documentation provides additional assurances that tests are being performed
properly.
2013-14 presented a number of operational and safety challenges based on three
major train derailment incidents and two employee fatalities and their ongoing
investigations. A key step towards improving Metro-North’s safety culture was
establishing a significant shift in the functional responsibilities of the Safety
Department. The Safety and Security Department has been split into two separate
departments with distinct functional areas of responsibility. The new Office of System
Safety (OSS) includes units focused in the following areas: Risk Reduction; Field
Operations; Safety Support and Data Analysis; Investigations; and Fire Safety and
Emergency Management. These units will be reviewing significant business processes,
risks, and controls in the 4th Quarter of 2014. The new Security Department is being
organized to effectively focus on all security operations and strategy, company-wide,
and will do a similar review.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 96 of 114
MTA Metro-North Railroad
In addition to enhancing the staff and skills within the new Department, the OSS will
be actively supported by a more effective collaboration with all other departments on
the railroad. This deeper collaboration between the Safety organization and all aspects
of Metro-North not only will enable more effective and systemic oversight of safety
across Metro-North, but will foster greater ownership of the overall Priority One
Program by employees at all levels of the organization.
Planned enhancements for the internal control program in 2015 will focus on
increasing the use and functionality of GRCM by connecting related corporate
policies/procedures and audit recommendations with internal control reviews of
significant business processes. Additional training sessions are also planned for late
2014 and early 2015.
MTA New York City Transit
NYCT is the largest mass transportation system in the U.S. It provides subway, rail,
bus, and paratransit services to the five boroughs of New York City. NYCT endeavors
to provide customers with safe, convenient, comfortable, and reliable train and bus
service by the efficient and effective utilization of human, physical, and financial
resources. In pursuit of these goals, management and staff in the various operating
and administrative functions understand the importance of working together and
utilizing the available resources to ensure that customers receive the best possible
service. The President, Executive Staff, and Senior Management supported by
professional, technical, operational and administrative personnel, unite to form a
team that achieves these objectives.
Because of the complexity of its business, NYCT must comply with a variety of
Federal, State, and Local laws. In addition, it is subject to rigorous scrutiny and
oversight by regulatory agencies such as the NTSB, FTA, OSHA, and the New York
State Department of Labor. NYCT is also guided by internal policies and procedures
that outline and provide detailed instructions on how to perform major tasks within
the organization.
The Internal Control Process at NYCT is specified by Internal Control
Policy/Instruction (P/I) 1.8.1. This P/I incorporates directives from the Internal
Control Act, and State Comptroller’s Office and sets forth the requirements for each
department to establish and maintain a system of internal controls. The NYCT
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 97 of 114
MTA New York City Transit
program is predicated on vulnerability assessments and the ranking of activities based
on the level of risk assigned to each one. Departments must identify all major
activities, determine the level of risk and develop a system of controls to manage and
mitigate the risk. The next step is to perform a self-assessment of existing internal
controls for selected high-risk activities. Testing of controls is required to determine
whether they are functioning as intended, and the adequacy of those controls. If
weaknesses are detected, the department must submit an action plan and timetable
for addressing and resolving the deficiencies. The implementation of each corrective
action is reviewed and monitored by the Office of the Controller.
Follow-up on corrective actions taken to eliminate weaknesses is performed by
departmental personnel. The results of the departments’ review are monitored by the
Office of the Controller. A schedule of control weaknesses, corrective actions, and
dates of completion is prepared. The Office of the Controller corresponds with each
Internal Control Manager to ensure that all action items are completed satisfactorily
and timely, if cost beneficial. The status of weaknesses and related resolutions is
tracked via electronic systems.
NYCT has been proactive in coordinating and integrating the requirements of the
State Comptroller’s Standards for Internal Controls in New York State Government
that support a good internal control system. This is reflected by the fact that the
current Policy/Instruction (P/I) on Internal Control Policy cites the Office of the State
Comptroller as a major source of the information contained therein. The P/I refers to,
and in some cases incorporates excerpts from, the standards that are enumerated in
the State Comptroller’s guidance.
These references include, but are not limited to, the definition and purpose of internal
control, the specific techniques that provide the greatest assurance of a strong system
of control and the five components of an internal control program.
The Internal Control P/I also contains instruction regarding the ongoing evaluation of
activities, risks and controls and the periodic testing of controls to ensure that they
are functioning as intended; strategic planning to focus on the long range goals of the
organization in an effort to achieve its mission; and the role of the Internal Audit
function to perform independent reviews of the internal control program to assess its
effectiveness and recommend changes, if necessary.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 98 of 114
MTA New York City Transit
This information has been widely distributed throughout the organization and has
become a part of the annual training effort. By recognizing and incorporating these
important concepts from the Standards for Internal Controls in New York State,
NYCT continues to enhance the quality and effectiveness of its internal control
program.
NYCT has developed a multi-faceted approach to effectively communicate
information within the organization. Formal memoranda from Senior Management
are distributed through a number of media channels to apprise staff of important
issues and changes that will be taking place. The specific means of communication
include distributions with paychecks, mass e-mail, posting on the intranet and via
interoffice mail. These methods are also used to distribute policies, procedures,
directives and brochures that deal with a variety of topics. Formal meetings and
training seminars are convened to provide guidance, instruction and feedback on
specific subjects on internal control. There are also financial and management reports
that provide insight into the results of operations and audit reports that indicate the
compliance of the organization with the applicable laws, rules, regulation, policies
and procedures that govern the numerous activities that are undertaken by NYCT.
When taken in the aggregate, these methods of communication provide NYCT
personnel with an effective network which ensures that vital information is conveyed
in a timely manner to all of those involved in the agency’s key processes.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 99 of 114
Section C. Requirement: Make Available To Each Officer and Employee A Clear and
Concise Statement of The Generally Applicable Management Policies and
Standards
Standard: The Annual Internal Control statement should set the tone at the top. It
should emphasize the importance of effective internal controls and the responsibility
of each officer and employee for effective internal controls. Managerial policies and
procedures for the performance of specific functions are articulated in administrative
manuals, employee handbooks, job descriptions and applicable policy and procedure
manuals. While it is not necessary for all employees to possess all manuals, employees
should be provided with, or have access to, applicable policies and procedures for
their position.
MTA Headquarters
The MTA Policies and Procedures have been integrated into our GRC platform. MTA
All-Agency and MTAHQ policies are now stored in a central repository which allows
employees to obtain the most recent version of any policy directly from a web based
search. In addition, The MTA Code of Ethics is available on the MTA’s Intranet and
the internet sites.
Corporate Compliance continues to manage enterprise policy directives and MTAHQ
policies and procedures. In addition certain enterprise policy directives are posted on
MTA’s Internet page under governance/compliance.
In addition, corporate compliance has begun a process of policy lifecycle management
whereby each policy based upon its significance is assigned a specific review cycle.
MTA Bus Company
Internal controls are discussed and emphasized at senior staff meetings. Policies and
procedures are available on-line for access to all employees, and where required,
posted in locations.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 100 of 114
MTA Bridges and Tunnels
An annual letter from the President is sent to all employees to reaffirm B&T’s policy
in compliance with the New York State Governmental Accountability, Audit and
Internal Control Act. It reemphasizes the importance of effective internal controls to
the agency and the responsibility of each employee for the maintenance of effective
internal controls.
Attached to the President’s letter is an internally generated brochure “Internal
Controls and You”, which defines what internal controls are, what is required by the
Internal Control Act, how the Internal Control Act is carried out at B&T, what are
the employee’s responsibilities for internal controls and also gives an updated listing,
by department, of the Departmental Internal Control Coordinators as well as their
telephone numbers.
An annual internal control training course was provided to selected managers in
December 2013 to allow them to attain a more comprehensive understanding of
internal control concepts.
MTA Capital Construction
Employee conduct is governed by the MTA All-Agency policies including the Code of
Ethics, applicable provisions of the Public Officers Law including rules on ethics and
conflicts of interests. A copy of the MTA-All Agency Code of Ethics and the Public
Officers Law is provided to all employees at the time of their employment. A
memorandum from the MTACC’s President is emailed to all employees reaffirming
everyone’s responsibility for maintaining an effective system of internal controls as
prescribed by management and statutory requirements. Included in the email
distribution is a pamphlet to help employees understand their roles and meet their
operation goals.
MTACC conducts its business primarily by reference to written policies, such as a
plan of organization, the formal delegation of responsibilities, and program area
procedures. Copies of MTACC’s policies are maintained within each program area or
department. Additionally, MTACC has made available on the intranet all of its
policies and procedures to all employees.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 101 of 114
MTA Capital Construction
There are various control techniques which support the Internal Control Program
and enable each department and process to effectively monitor their internal control
system. Some examples which support the control evaluation process include
documentation and recordkeeping, authorization of transactions, segregation of
duties, supervision and security of information and data. Policies and procedures, logs
and records, supervision and structure based on corporate organization charts and the
various levels of data security.
MTA Long Island Rail Road
LIRR makes available to all employees, via the Intranet, Corporate Policy &
Procedure BPM-003 Management Control Review, in compliance with the Act. This
policy emphasizes the importance of Internal Controls and the responsibility of all
employees to ensure that effective controls are maintained in the performance of
their daily activities. In addition, the MCR Handbook is available to all employees
that have access to the Intranet. For employees that do not have access to the
Intranet, a physical copy of the Handbook can be obtained by contacting BPMCC.
At the department level, Standard Operating Procedures and corporate policies are
developed and made available to staff, as applicable. A process is also in place to
ensure that policies and procedures are reviewed and updated on a regular basis. In
2013, 21 corporate policies were reviewed and updated as appropriate. In addition,
two new corporate policies were developed. New processes or the implementation of
new systems have accounted for the creation of new policies as well as the updating
of existing policies and procedures. HR maintains supplemental documentation,
which further supports internal control efforts, i.e., organization charts and job
descriptions.
MTA Metro-North Railroad
An annual memorandum from the President to all Metro-North employees
communicates the importance of internal controls at Metro-North. All new
employees also receive this memo with their orientation packets. The memo refers
employees to the Metropolitan Transportation Authority’s Enterprise Risk
Management and Internal Control Guidelines, which serves as Metro-North’s internal
control policy. The memo clarifies responsibilities and describes the need for every
employee to comply with and enforce policies and procedures in order to ensure
Metro-North’s operation is both responsible and successful.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 102 of 114
MTA Metro-North Railroad
The Corporate Compliance unit works with Department Heads, Internal Control
Coordinators, and managers, to continuously improve departmental compliance and
educate employees about internal controls. This is done through a combination of
formal training and Departmental and individual meetings and reviews.
In an effort to provide more information and guidance to Metro-North staff about
internal controls and the processes used to complete internal control reviews, there is
a Metro-North intranet page devoted to internal controls
(http://www.mnr.org/intranet/internalcontrols/ICS.cfm). Included on this page are
active links to: the GRCM system and the GRCM manual, which is a step-by-step
guide to using GRCM to perform internal control reviews; the MTA Board
Guidelines; the annual memo from the President; new guidance on performing risk
assessments and assigning risk ratings; testing result forms for use by internal control
testers; the NYS Division of Budget’s Managers Guide for Testing; the Executive
Summary of the COSO Internal Control – Integrated Framework; and finally, contact
information for the ICO and Manager of Corporate Compliance.
In addition to specific guidance, manuals and procedures provided to managers and
employees in their respective Departments at Metro-North (primarily located on
Metro-North’s intranet), all Metro-North employees are expected to be familiar with
and adhere to the MTA All-Agency Code of Ethics, which is also available on the
intranet.
MTA New York City Transit
The Officers, Managers and Employees of NYCT are routinely notified of the policies
and standards with which they are expected to comply. The President and Senior
Management issue bulletins and other correspondence that provide clear instructions
and guidance on a variety of topics.
These high level publications are provided to employees as reminders of existing
policies or as instruction on new activities and initiatives. They contain general
information in the areas of operations, administration, finance and internal controls.
NYCT stresses the theme that internal control is everyone’s business. This principle is
the focal point of the NYCT brochure and the Presidential memos on internal
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 103 of 114
MTA New York City Transit
controls, which are distributed to all employees on a regular basis. By incorporating
the tenets of internal control into every task that is performed, NYCT has created an
environment that provides reasonable assurance that its resources are protected
against fraud, waste and mismanagement and that its activities are performed in an
effective and efficient manner. In addition to the general guidance provided by
management, NYCT maintains policies, procedures, handbooks and management
directives for all major activities. These manuals are available on-line. They are
reviewed, updated, and distributed to the appropriate areas of responsibility on a
regular basis.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 104 of 114
Section D. Requirement: Designate An Internal Control Officer (ICO), Who Shall Report
To The Chairman of The MTA, To Implement and Review The Internal
Control Responsibilities Established Pursuant To Act and Internal Control
Standards
Standard: The ICO works with appropriate personnel within the MTA to coordinate
the internal control activities and to help ensure that the internal control program
meets the requirements. Although the ICO evaluates the adequacy of the internal
control reviews performed by authority staff, program and line managers are
primarily responsible for conducting reviews to assure adherence to controls and
analyzing and improving control systems. The ICO should be an individual with
sufficient authority to act on behalf of the Chairman in implementing and reviewing
the agency’s internal control program. This individual should have a broad
knowledge of MTA’s operations, personnel and policy objectives.
Metropolitan Transportation Authority
Pursuant to Public Authorities Law Section 2931, the MTA Board designated its Chief
Compliance Officer as the MTA’s Internal Control Officer (“ICO”) with
responsibilities for overseeing MTA’s Corporate Compliance efforts, which include
corporate governance, internal controls, ethics and compliance.
The MTA’s Chief Compliance Officer has reporting responsibilities to MTA’s
Chairman and the MTA Board. Pursuant to the Audit Committee’s Charter, the Chief
Compliance Officer has an affirmative reporting obligation to the MTA Board on the
internal control program through the Audit Committee. The Chief Compliance
Officer has several years of experience in the area of finance and financial institution
regulation. Before coming to the MTA, he spent 10 years at the United States
Securities and Exchange Commission and 6 years with the New York City
Department of Finance.
MTA Headquarters
The MTAHQ Internal Control Officer has over 35 years of experience in Human
Resources of which 18 were with the MTA in Compensation. Most of the jobs
descriptions in HQ were written and evaluated by this individual. Thus, the scope of
HQ operations and the history of various departments are well known to the Internal
Control Officer.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 105 of 114
MTA Headquarters
Additionally, the incumbent holds two advance degrees, a MBA in Organizational
Development and a Post Masters Certificate in Marketing.
The ICO works with appropriate personnel within the authority to coordinate the
internal control activities and to help ensure that the internal control program meets
the requirements established by BPRM Item B-350. Although the ICO evaluates the
adequacy of the internal control reviews performed by Agency or authority staff,
program and line managers are primarily responsible for conducting reviews to assure
adherence to controls and analyzing and improving control systems.
MTA Bus Company
Robert Picarelli, Chief Officer, Internal Investigations & System Security, is
designated as the Internal Control Officer (ICO) for MTA Bus. Robert Picarelli has
been the ICO for NYCT Bus since the inception of the Internal Control program at
NYCT Bus, and also coordinates external audits of the MTA’s bus operations.
Accordingly, audit findings and recommendations are integrated into the internal
control program as required across the operations.
MTA Bridges and Tunnels
The B&T Internal Control Officer (ICO) was appointed by the President to administer
and assure implementation of the B&T Internal Control Program. The ICO working
with MTA Audit Services and the Independent Auditors, directs and continually
evaluates and assesses B&T’s system of internal controls. Together, they help B&T
management maintain B&T’s system of controls in a complete and current condition,
and ensure that all employees are adequately trained in the requirements of their jobs
and the principles of internal control. The ICO is also supported by Departmental
Internal Control Coordinators within various B&T departments who provide
additional administration of the B&T Internal Control Program.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 106 of 114
MTA Capital Construction
The Internal Control Officer (ICO) reports to MTACC President through the
organization’s Chief Financial Officer. Oversight for the Program is provided by
MTA’s Chief Compliance Officer. Additionally, the ICO interfaces directly with
MTACC’s Staff, Program Executives, Department Heads and Audit Services for
adherence and improving MTACC controls and systems. Besides oversight
responsibility over the Internal Controls program, he serves as a liaison between
Departments, Audit Services and other external auditors in bridging implementation
of corrective action plans recommended by auditors. The ICO, with the assistance of
the Internal Control Coordinators, directs and continually evaluates and accesses
MTACC’s system of internal control.
The ICO has over 19 years of internal audit, internal controls and operational risk
management experience in a broad range of industries. Before joining the MTACC,
he was the head of internal controls for a multi-billion dollar division of a global
corporation. He holds certification in risk management assurance, internal controls
and fraud examination with a Masters in Public Administration in Financial
Management.
MTACC’s ICO is a member of the ERM Committee representing MTACC. The ERM
Committee is chaired by the Chief Compliance Officer and meets periodically to
review and suggest improvements to the ERM program.
MTA Long Island Rail Road
LIRR’s ICO is the Vice President of Management and Finance, who reports directly to
the President. Under his/her direct leadership the DCAs administer the program,
providing training, guidance, and instruction to the MOCAs. The ICO has tasked the
BPMCC Department with the coordination and monitoring of audits performed by
MTA Audit Services, MTA Office of the Inspector General, New York State
Comptroller and other external audits - an objective of which is to apply audit
findings to department business activities to determine if additional controls need to
be created or existing controls need to be enhanced. The objective is to ensure that
business activities are governed by policy and procedure thus providing congruence
with the control technique of documentation and recordkeeping. Finally, the ICO
provides periodic updates to fellow Senior Staff members on the status of the MCR
Program and reinforces the need for their continued support of the program.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 107 of 114
MTA Metro-North Railroad
Metro-North’s Internal Control Officer reports directly to the Chief of Staff of the
President of Metro-North. The ICO’s organizational title is Deputy Director,
Corporate Compliance and Strategic Development. The scope of his duties includes
serving as Metro-North’s Audit liaison to ensure the linking of audit findings and
recommendations with internal controls. He is also directly involved in various
organizational process review and improvement efforts which support and reinforce
the Internal Control Program and vice versa. He has been working with and for large
public sector transportation agencies in the areas of planning, policy, management
and operations for 15 years and holds a Masters of Urban Planning from New York
University.
The annual Internal Control memorandum from the President to all employees
communicates who the ICO is (including contact information) and reinforces the
importance of and responsibility for internal controls at Metro-North. The ICO
administers the Internal Control Program and monitors compliance with the
program.
MTA New York City Transit
The President has designated an Internal Control Officer (ICO) to implement, oversee
and review the internal control program and its responsibilities within NYCT. The
ICO reports to the Executive Vice President while interfacing with the President,
Senior Management, MTA Headquarters, and New York State on the status and
progress of the program. Additionally, the ICO prepares NYCT’s annual Internal
Control Summary and Certification for the MTA and State and keeps the departments
and divisions apprised of their responsibility to comply with the P/I and the
provisions of the Internal Control Act. Another important function of the ICO is to
ensure that management and staff receive the appropriate level of IC training and the
information necessary to execute the requirements of the IC program.
NYCT’s ICO is the Controller who presides over all accounting and financial matters
within the organization. As such, he is well versed in all aspects of internal control
relating to operations and administration due to the high level of interaction with
Senior Management in NYCT, and the MTA. The ICO is assisted by an Internal
Control Coordinator (ICC) and other members of staff within the Office of the
Controller, who manage the day to day implementation of the IC program.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 108 of 114
MTA New York City Transit
The functions performed by dedicated staff include providing training to internal
control personnel, reviewing and commenting on the quality of items that are
submitted, providing feedback to the Department/Division Heads in cases of
significant non-compliance with the Act and receiving, reviewing, interpreting and
distributing all correspondence from the MTA and State.
The appointment of the ICO was communicated to all employees via the intranet and
to internal control personnel during training sessions.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 109 of 114
Section E. Requirement: Implement Education and Training Efforts To Ensure That
Officers and Employees Have Achieved Adequate Awareness and
Understanding Of Internal Control Standards and, As Appropriate, Evaluation
Techniques
Standard: Authorities should identify staff requiring internal control training and the
depth and content of that training. Such education and training should be on-going
with specific courses directed at line staff, middle managers and executive
management. For organizations that have established internal audit functions,
training and education should be offered on the appropriate role of the internal
auditor within the organization’s internal control system.
MTA Headquarters
All Coordinators have yearly training on Internal Controls and their role in the
program. Employees have access to information on the program via e-mails and “open
house” information sessions.
All Senior Managers receive yearly training on Internal Controls and their role in the
program.
One day per month, MTA Today is dedicated to compliance and ethics issues
providing our employees with entertaining video regarding relevant topics such as
gifts and conflict of interests. In addition, we are circulating, “Tone from the Top”
and “Ethikos” magazine to senior staff.
MTA Bus
The Assistant Chief Officer conducts an annual internal control educational/ training
session with all department liaisons and meets individually with smaller groups as
needed. The Assistant Chief Officer also mentors liaisons throughout the year.
MTA Bridges and Tunnels
All employees receive exposure to B&T’s and MTA’s all-agency policies on the
Intranet. Copies of the Authority’s internal control awareness brochure Internal
Controls and You is distributed to employees periodically at ethics training sessions
and other Agency forums.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 110 of 114
MTA Bridges and Tunnels
An Intranet-based, interactive internal control awareness course was implemented
and is updated annually when necessary. This tool serves as an additional vehicle for
a broad range of employees to receive basic training in internal control concepts. A
more detailed updated classroom-based training program, with specific instructions
on implementation of the Internal Control Program and compliance with the Internal
Control Act, was provided to selected managers in December 2013.
The ICO also meets with all DICCs on a quarterly basis to review progress towards
implementing various Internal Control Program initiatives and provides them with
additional control information, and reviews ways to improve the Internal Control
Program.
MTA Capital Construction
To make certain that MTACC executives and employees continue to maintain a
satisfactory awareness and understanding of internal control standards and
framework, Internal Control Training & Educational Program was developed for ICC
and Executives.
As previously mentioned, a memorandum from the MTACC President stressing the
importance of having an effective and efficient Internal Control Program; including
management’s responsibility for ensuring effective Management Control Reviews,
and the MTACC’s obligation to comply with the requirements of the New York State
Governmental Accountability, Audit and Internal Control Act was sent to all
employees on May 8, 2013.
Attached to this memorandum is a pamphlet entitled Internal Controls and You. The
objective of the pamphlet is to provide employees with a basic understanding of
internal controls and demonstrate how controls help meet MTACC’s operational
goals.
All new employees subject to financial disclosure requirement of the Code of Ethics
are required to take ethics training within 90 days of employment. Additionally, the
MTACC President and his direct reports are required to take an annual ethics training
while all other employees subject to financial disclosure requirement are required to
take a refresher ethics training course on a two year cycle. The ICO in conjunction
with Human Resources coordinate scheduling employees to ensure that they attend
the ethics training.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 111 of 114
MTA Capital Construction
MTACC’s ICO serves on the ERM Committee. Recommendations for improvements
arising from the Committee are shared with the MTACC’s ICC. In 2014-2015, ICO
will conduct GRC training for all department heads, ICC and internal control testers
on the utilizing the platform for documenting internal controls results.
MTA Long Island Rail Road
The BPMCC Department, under the supervision of the ICO, provided the following
to promote internal control education and foster management control awareness at
the LIRR:
In 2013 the LIRR conducted four “Business Administration & Processes”
classes that are part of the Management Education Core Curriculum Program.
The classes included a two-hour session on the “Management Control Review
Program & Managing Internal Controls”. The format was based on the COSO
model and the basic components of internal control i.e., control environment,
risk assessment, control activities, information and communication, and
monitoring.
As part of their orientation, all new employees are provided with information
on internal controls and its importance at the LIRR. Employees are also
encouraged to reach out to their MOCAs and/or DCAs with any questions or
concerns.
DCAs are committed to providing training, guidance and instruction to the
MOCAs. Throughout the year, the importance of effective and efficient
controls is stressed. On an as needed basis, including when a department has a
new MOCA, the DCAs meet with the MOCAs to review, clarify and help
with the completion of control evaluations or with updating of the
Vulnerability Assessment when there are any changes in the procedures or
processes.
In August 2013, BPMCC provided a department specific training session to
Department of Program Management (DPM). Also various meetings were
held with other departments including the Office of Management and Budget
and Human Resources to review their existing VAs and ensure that any new
activities or changes to their processes were being addressed and that controls
reflect current processes.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 112 of 114
MTA Long Island Rail Road
In 2013, the DCAs trained new MOCAs in Service Planning and Department
of Program Management, Quality Management Group and the Labor
Relations Department. Additionally, VAs were revamped and various new
ones were developed and tested, including DPM, the Controller’s Office, Law,
Market Development, Public Affairs, Safety & Training, Labor Relations and
Service Planning.
A Management Control Review Handbook is available on the Intranet. This
handbook provides managers with the guidance and tools needed to perform
their internal control responsibilities under the MCR Program.
All LIRR employees received a pamphlet entitled “Management Control
Responsibility at the LIRR” with a synopsis of the definitions related to
internal controls, a description of the internal control program and a listing of
MOCAs and DCAs. The pamphlet was accompanied by a memo from the
LIRR President reminding employees of the structure and affirming the
importance of the internal control program.
MTA Metro-North Railroad
In 2013, training sessions on GRCM were held for Internal Control Coordinators,
who act as the Departmental point person for ensuring the completion of internal
control reviews. These train-the-trainer sessions provide Coordinators with the
information and skills they need to assist Testers, Business Process Owners (BPOs)
and Department Heads utilize GRCM. As with any new application, the ICO and
Manager of Corporate Compliance are providing ongoing assistance to GRCM users at
all levels. A detailed manual is also posted on Metro-North’s Internal Control intranet
page, and one-on-one instruction is available on-request. For 2014, additional GRCM
training is planned for the 4th Quarter.
Throughout 2013 and 2014 multiple meetings were held with individual Departments
as part of the revised Vulnerability Assessment process. These sessions provided an
opportunity to educate managers and their staff on the purpose and importance of
internal controls as well as additional guidance on risk assessments and testing
requirements.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 113 of 114
MTA New York City Transit
Education and training regarding internal control is provided to all departmental
personnel that are involved in the internal control process. The Office of the
Controller conducts a mandatory annual training seminar for Internal Control
Managers and their support staff that provides a general framework of the internal
control process and detailed instructions on the various components of which it is
comprised. Information is provided on the identification and listing of major
activities, the evaluation and ranking of risks for each activity via the vulnerability
assessment, the development of controls to counteract the risks, the testing of controls
on a regular basis, reporting of weaknesses found, and implementing corrective
actions to eliminate any deficiencies that are identified. In addition, all IC Testers,
Activity Managers and Division/Subdivision Heads receive comprehensive training
each year.
The additional training is a result of the implementation of the recommendation from
the Internal Control Task Force requiring employees to be grouped and trained by
function. It also ensures that NYCT is in compliance with this important aspect of the
Act. Throughout the year, upon request, individual departmental personnel receive
additional training in closed group sessions that are tailored for the specific needs of
each department.
The format utilized by the Office of the Controller is based on the COSO model and
the five basic components of internal control that it stresses, as listed below:
Control environment
Risk assessment
Control activities
Information and communication
Monitoring
In addition, it conforms to the standards provided by the NYS Comptroller’s Office
and the MTA Agency-Wide Enterprise Risk Management and Internal Control
Guidelines. In support of the training effort, a guide was developed to interpret and
clarify the tenets of the COSO model and present a detailed step-by-step description
of the IC process. Starting in 2014, NYCT’s Internal Control Program will adhere to
the provisions of the updated COSO Internal Control Framework.
_______________________________________________________________________
METROPOLITAN TRANSPORTATION AUTHORITY
2013-14 INTERNAL CONTROL SUMMARY REPORT
2013-2014 Internal Control Summary Report Page 114 of 114
MTA New York City Transit
Internal control education is further achieved through letters and other
correspondence from the President, Senior Management and the ICO’s Office that are
distributed to NYCT employees to emphasize the requirements of the Act. An
Internal Control Brochure, detailing NYCT’s commitment to the Internal Control
Program, was placed on the TENS website and is available for viewing by employees.
The following is a sample of the correspondence or announcements that were either
posted on the NYCT Intranet, or distributed to employees directly in an effort to
heighten awareness on the following internal control related subjects:
Internal Control Issues (i.e. Security, Data Protection, etc.)
Equal Employment Opportunity Policy
Respect for Fellow Employees
Workplace Violence
Sexual and Other Discriminatory Harassment
Respectful Workplace Policy
Drug and Alcohol Policy Statement
Domestic Violence Awareness