Less Than Half of Recommendations Successfully Implemented

Published on April 07, 2022

View of Denver skyline from City Park.

Lea la nota de prensa en español

DENVER –The Denver Clerk and Recorder’s Office and Denver International Airport fully implemented only less than half of the recommendations they agreed to at the time of their two original audits. The remaining risks include personal information protection in public records, according to new follow-up reports published this month from Denver Auditor Timothy M. O’Brien, CPA.

Auditors completed follow-up work for two audits: Records Management in the Clerk and Recorder’s Office and Airport Capital Assets at Denver International Airport. 

Total Implementation Status for Two Follow-up Reports.

Total implementation status for two follow-up reports. Thirteen recommendations were fully implemented, eleven were partially implemented, ten were not implemented, and the agencies didn't agree with two recommendations.


RECORDS PROTECTION

In the first follow-up, auditors found the Clerk and Recorder’s Office has not taken all of the steps it planned to protect privacy and historical records.

“Protecting our residents’ personal information is a top priority for my office and for the City and County of Denver,” Auditor O’Brien said. “I continue to appreciate efforts to improve transparency of and accessibility to information through digitization of records in the Clerk and Recorder’s Office, but it needs to be done responsibly and safely on behalf of the people we serve.”

Although the Clerk and Recorder’s Office did successfully create a measurable and action-oriented strategic plan for records management, there are still specific steps that need to be completed to protect the security of personally identifiable information and historical documents.

In the May 2021 audit, the Clerk and Recorder’s Office told our team it is prioritizing digitization of records, but we recommended a more strategic approach and additional protections for members of the public who submit records with their personal information included.

The office contracted with a vendor to begin retroactively redacting certain personally identifiable information from millions of documents; however, the project had just started.

We confidentially communicated specific details about protecting personal information to the Clerk and Recorder’s Office, due to the sensitive nature of the information. This is a standard practice when working with sensitive information in our workpapers.

Denver residents and other individuals could be exposed to identity theft if their personally identifiable information is posted publicly in the online records database. Although state law does not specifically require the redaction of certain information and the office is not required to follow the mayor’s executive orders regarding data privacy, best practices still recommend this should be done.

“Managers made it clear they still intend to do this important work and I would encourage them to do so as soon as possible,” Auditor O’Brien said.

Additionally, over the past year, the Clerk and Recorder’s Office has not successfully improved how it identifies, retains, and stores historical documents.

The office has not created documented criteria for which records should be designated as historical and retained past standard retention policy requirements. Staff tried to implement this recommendation by creating a policy. But that policy does not document specific criteria and guidance for historical document retention.

Historical records have substantial value in telling the city’s story and should be kept indefinitely.

The Clerk and Recorder’s Office did create new policies and procedures to notify anyone who records a document that their document will be posted online and publicly accessible. And the new strategic plan includes regular monitoring of progress toward meeting goals and objectives.

“After a year of work, the Clerk and Recorder’s Office made a fine start by establishing a strategic plan, but there is still important work needed to protect the security of information and valuable historical documents,” Auditor O’Brien said.

The Clerk and Recorder’s Office fully implemented six recommendations, partially implemented four, and did not implement seven recommendations, but management says it still intends to work on the outstanding risks.

AIRPORT CAPITAL ASSETS

In this second follow-up report, auditors found Denver’s airport also made some progress since the December 2020 audit on how it tracks and maintains assets, but it still needs to hold its contractors accountable for necessary maintenance and management needs additional documented policies and procedures.

Airport capital assets include everything from escalators and trains to roads and land. They are tangible and intangible items used in operations with a value of at least $5,000. They are generally expected to last more than a year.

In 2020, we found backlogged preventive maintenance orders for assets, which could lead to greater risk of corrective repairs and higher costs for replacement or restoration. At the time of our audit, the airport had a backlog of 290 work orders for preventive maintenance on facilities and at least 6,900 deferred work orders.

Since then, the airport has not sufficiently enforced contractual terms related to penalties for contractors responsible for maintaining assets like passenger trains and moving walkways.

“I encouraged the airport to be more proactive and less reactionary with its approach to maintenance and asset management,” Auditor O’Brien said. “Airport management should be holding its contractors accountable for maintenance performance metrics as outlined in the contracts.”

We did find the airport started developing a comprehensive preventive maintenance program for its assets, but it will take at least five years to complete. Until then, the airport cannot assess appropriate staffing levels and budget needs for preventive maintenance.

The airport has more work to do to improve data integrity for tracking assets and management took steps to update its policies and procedures for contract monitoring. Those steps are still lacking in detail, however, and complete documentation is critical for ensuring continuity of operations in the event staff leave city employment.

The airport fully implemented seven of our recommendations, partially implemented seven, did not implement three, and disagreed with two recommendations.


Timothy O'Brien Official Headshot
AUDITOR TIMOTHY O'BRIEN, CPA
Denver's Auditor


Denver Auditor's Office
201 W. Colfax Ave. #705 Denver, CO 80202
Email: auditor@denvergov.org 
Call: 720-913-5000
Follow us on Facebook  Connect with us on Twitter
Read our Social Media Policy Here

Auditor´s Office Logos for Footer

Tagged as: