Summary

Section 409.1671, Florida Statutes, provides that it is the intent of the Legislature that the Department of Children and Family Services (Department) outsource the provision of foster care and related services Statewide.  To meet the requirements of this statute, the Department has entered into contracts with 19 community-based care lead agencies (CBCs), each of which is responsible for the provision of services in one or more geographical areas of the State.  In providing foster care and related services, some of the CBCs have contracted with case management organizations (CMOs).

At the inception of each contract between the Department and a CBC, property was either transferred by the Department to the CBC or funds were provided by the Department to purchase start-up property.  The CBCs may also purchase property after start-up using subsequent contract payments. At the conclusion of the contract, the furniture and equipment transferred to the CBC or purchased through contract funds is to revert back to the custody and ownership of the Department.

Also, the contracts between the Department and the CBCs provided access to the Department’s Florida Safe Families Network (FSFN), a child welfare and client management information system.  The CBCs and the CMOs use FSFN to input case data and to manage child welfare services.  To access FSFN, the CBCs and CMOs connect to the State’s metropolitan area network (MAN) through a virtual private network (VPN), either directly or using connections from their networks. 

In conducting our audit, we performed audit fieldwork at the Department and at the following CBCs:  Family Services of Metro Orlando, Inc. (Metro Orlando), Family Support Services of North Florida, Inc. (Family Support Services), and Hillsborough Kids, Inc. (Hillsborough Kids).  The Department’s initial contracts for foster care and related services with the selected CBCs were executed in March 2004 for Metro Orlando, in July 2003 for Family Support Services, and in May 2001 for Hillsborough Kids.

This operational audit focused primarily on records and controls related to the initial transfer of property and on the accountability subsequently provided for tangible personal property during the period July 2006 through June 2007.  Our audit also addressed information technology (IT) security controls relating to FSFN during the period August 2007 through November 2007.  We also evaluated Department policies and procedures for monitoring CBC accountability over tangible personal property and IT security.  The results of our audit are summarized below:

TANGIBLE PERSONAL PROPERTY

Finding No. 1:     Lapses in property transfer procedures resulted in some unaccounted for property, the cost of which totaled approximately $181,500.

Finding No. 2:     CBC policies and procedures did not always ensure that purchased property items were timely recorded in CBC property records.

Finding No. 3:     CBC policies and procedures did not always ensure appropriate documentation was retained in support of property items deleted from the property records.

Finding No. 4:     CBC property records did not always contain information required by Department contracts and Federal regulations.

Finding No. 5:     The Department’s contract monitoring procedures could be enhanced to provide greater accountability over property transferred to CBCs and property purchased by CBCs through Department contracts.

Finding No. 6:     At the CBCs, incompatible duties related to the acquisition and accountability of information technology property had been assigned.

Finding No. 7:     Risk management policies and procedures of the CBCs did not ensure that insurance coverage was at appropriate levels to mitigate the risk of loss of furniture and equipment.

INFORMATION TECHNOLOGY SECURITY

Finding No. 8:     The Department had not established procedures for monitoring the IT functions of the CBCs.  In addition, the Department’s reporting of FSFN security activities needed improvement.

Finding No. 9:     Additional security controls protecting FSFN needed improvement.  Specific details of the needed improvements are not disclosed in this report to avoid the possibility of compromising Department and CBC security. 

Finding No. 10: Disaster recovery planning by the CBCs did not always include appropriate planning for the recovery of IT resources. 

Finding No. 11: Certain environmental controls protecting CBC IT resources needed improvement. 

Finding No. 12: Policies and procedures at Family Support Services were not current and lacked official adoption by the CBC.   

The Department and CBCs provided responses which are included at the end of this report as Appendix A.