Despite a 2010 audit raising red flags, the office of the State Auditor did not detect embezzlement of tens, or perhaps hundreds of thousands of dollars within the Utah Communications Authority (UCA).
In April, the independent state agency announced that a "trusted employee" and her daughter embezzled $1 million over a 10-year period with credit-card purchases for personal items and trips.
In a new audit released Tuesday, the state legislative auditor general said the UCA is ultimately responsible. It added, however, that the UCA board has made strides to ensure such theft does not happen again.
The legislative auditor general's report is critical of the state auditor for a lack of thorough review of UCA in its annual financial statements of 2010 and 2011.
In 2010, the state auditor discovered that some credit-card transactions were missing receipts and could not be verified.
"The Office of the State Auditor appropriately conducted the financial statement audit portion of their review, but this type of audit is frequently insufficient to detect fraud," according to the new audit. "[A] more in-depth review should have been conducted on the missing credit-card receipts, both the year they were discovered and the following year."
The state auditor's 2010 annual financial audit reported that 13 of 36 credit card purchases — 36 percent — on a randomly sampled monthly statement lacked receipts. Without receipts or greater probing, the new report said, the state auditors could not validate the purchases.
"The Office of the State Auditor's responsibilities beyond financial statement audits were not adequately fulfilled by the 2010 and 2011 audits," said the audit overseen by manager Tim Osterstock. "Exercising greater professional skepticism by recognizing its broader responsibility, accepting only original documentation, recognizing aggravating risk factors, and conducting a more thorough follow-up of the issue in 2011 could have detected the fraud five years earlier and prevented further occurrence of the same fraud."
The state auditor informed UCA management of the missing receipts in 2010, but did not follow up adequately in 2011, according to the new report.
"Given the severity of the missing receipts the year before, and the aggravating factors discussed above, the review in 2011 was insufficient," the new report said. "Had the review been more in depth, it is likely the fraud could have been identified at that point.
Auston Johnson, who was the state auditor at the time of the lapses cited in the new report, could not immediately be reached for comment Tuesday.
John Dougall, who was elected state auditor in 2012, said Tuesday that he has "rebooted" his oversight team to go beyond audit statements to more of a "policing" role. "We would be better able to detect [fraud] today," he said.
Still, the embezzlement at UCA continued through 2015, Dougall explained, because a private contractor performed the annual audit statements for the agency.
In the end, however, the Utah Communications Authority management is responsible for preventing and detecting fraud, the auditor general said.
In a previous performance audit, released after the April announcement of the fraud, the state auditor made 13 recommendations to improve the financial controls and oversight of UCA. They include appropriate separation of duties, closer oversight and controls of credit cards, audit committee oversight, and formal adoption of policies and procedures.
"We have been able to document that UCA has implemented, or is in the process of implementing, all of the State Auditor's recommendations," the legislative auditor general said.
A technician discovered a credit-card statement left on one of the agency's printers in January and turned it over to the UCA's bookkeeper, who noticed charges that had nothing to do with state business.
The former director, Steven Proctor, resigned in early April as the agency announced his former administrative assistant, Patricia Nelson, and her daughter, Crystal Evans, admitted in a civil lawsuit to charging personal expenses on the agency's credit cards and covering their tracks by manufacturing phony papers. There were no allegations of wrongdoing against Proctor.
Judge Paul Maughan, overseeing the civil litigation, has ordered Nelson and Evans to pay the agency a total of $2,328,000, which includes interest and punitive damages. A criminal investigation is said to be underway by police in West Valley City, the site of agency headquarters.
The UCA board continues to search for a new director. Jake Hunt, UCA's radio-division manager, has been acting as interim director.
The agency, overseen by a 25-member board, has little direct oversight by the state. It was created in 1997 under a different name and played a major role in coordinating emergency communications and inter-agency radio communications between northern Utah public safety agencies during the 2002 Winter Olympics. It has expanded to include 25 counties and 147 public safety agencies in recent years and now owns 20,000 radios.
csmart@sltrib.com