1. 1 © 2013 Protiviti Inc. All Rights Reserved. This document has been prepared for use by OOCEA’s management, audit committee, and board of directors. This report provides information about the condition of risks and internal controls at one point in time. Future events and changes may significantly and adversely impact these risks and controls in ways that this report did not and cannot anticipate. Orlando-Orange County Expressway Authority 2013 Procurement Audit – Phase II April 2013

2. 2 © 2013 Protiviti Inc. All Rights Reserved. This document has been prepared for use by OOCEA’s management, audit committee, and board of directors. This report provides information about the condition of risks and internal controls at one point in time. Future events and changes may significantly and adversely impact these risks and controls in ways that this report did not and cannot anticipate. DRAFT Table of Contents SectionPage(s) Executive Summary3 Summary of Observations/Opportunities4 Detailed Observations5-6 Appendix A – Status of Procurement: Phase I Recommendations8

3. 3 © 2013 Protiviti Inc. All Rights Reserved. This document has been prepared for use by OOCEA’s management, audit committee, and board of directors. This report provides information about the condition of risks and internal controls at one point in time. Future events and changes may significantly and adversely impact these risks and controls in ways that this report did not and cannot anticipate. DRAFT Executive Summary Overview During Phase I of the procurement audit performed August through November 2012, Internal Audit executed procedures to understand and analyze the process that is in place when awarding contracts with a value exceeding $50,000. Audit procedures included evaluating the Authority’s process for short-listing vendors, scoring proposals and making a contract award. Procedures were performed to compare the Authority’s procurement processes to industry leading practices as well as to the processes currently being followed at Orange County, the City of Orlando, the Florida Department of Transportation, and the Florida Turnpike Authority to the extent readily shared or accessible. During Phase II of this audit, Internal Audit selected five procurements, including the RFP, related contracts, and bid packages, with a combined contract value exceeding $17,000,000 from a population of large engineering, service, maintenance, operations, and construction projects for review. Objectives The objectives of Phase II of this audit were to test the procurement process and related internal controls to verify that key internal controls were operating per policy throughout the Authority’s process for bid authorization, bid advertisement and notification, scoring of proposal and awarding of contract. Additionally, Internal Audit verified that changes to the Authority’s procedures, as agreed-upon during Phase I of this review, were implemented according to the timeline outlined. Scope and Approach The scope of Phase II of this work included key process and control identification and testing of the procurement process for awarding bids for five large procurement contracts to verify compliance with the Procurement Procedures Manual. Testing focused on review of the related RFP, bid packages,and awarding criteria for each of the contracts selected for audit. Internal Audit also reviewed for any evidence of excessive vendor preference. The five contracts reviewed were executed during the period of June 30, 2012 through February 28, 2013 and were as follows: 1. CDM Smith, Inc. #000889 –Traffic & Earnings contract. This contract began in August 2012 and has a contract value of $2.3 million. 2. Shutts & Bowen #000930 – Right of Way Counsel service contract. This contract began in February 2013 and has a contract value of $2.5 million. 3.Southland Construction, Inc. #000886 – Construction of State Road 451 connection to Vick Road. This Contract began in November 2012 and has a contract value of $3 million. 4.SEMA Construction, Inc. #000927 – Construction of State Road 417/Boggy Creek interchange. This contract began in December 2012 and has a contract value of $9.7 million. 5.Arthur J. Gallagher Risk Management Services, Inc. #000868 – Contract for insurance broker services. This contract began in June 2012 and has a contract value of $150,000.

4. 4 © 2013 Protiviti Inc. All Rights Reserved. This document has been prepared for use by OOCEA’s management, audit committee, and board of directors. This report provides information about the condition of risks and internal controls at one point in time. Future events and changes may significantly and adversely impact these risks and controls in ways that this report did not and cannot anticipate. DRAFT Summary of Procedures Performed and Observations/Opportunities Overall, the results of this audit confirmed that numerous internal controls, specific to bid authorization, advertisement and notifications, and bid award and scoring processes are in place and operating effectively and as intended. In addition, Internal Audit identified two findings / opportunities that may further strengthen the overall control environment. The table below provides an overview of these findings. DescriptionObservation Reference 1. Process Improvement a. Public Meeting Notice Retention1 2. Procedure Compliance a. Scoring Documentation Improvement2 Process Total Controls Tested Number of Observations Bid Authorization40 Bid Advertisement and Notifications120 Bid Award and Scoring70 Total230

5. 5 © 2013 Protiviti Inc. All Rights Reserved. This document has been prepared for use by OOCEA’s management, audit committee, and board of directors. This report provides information about the condition of risks and internal controls at one point in time. Future events and changes may significantly and adversely impact these risks and controls in ways that this report did not and cannot anticipate. DRAFT Detailed Observations Observation 1 – Public Meeting Notice Retention Low Priority: Low According to general counsel, all meetings of the Authority's various Evaluation and Review Committees fall under the Sunshine Law, Section 286.011, Florida Statutes, which states the Authority must provide reasonable notice of all such meetings. The Authority currently posts meetings as required in the lobby of the Administration building and on the Authority's website. However, Internal Audit could not attest to the physical posting of these notices and found during review of the process that the notice is removed from the Authority's website once the meeting has occurred. As a result, the control was not testable by Internal Audit. Recommendation Audit recommends that the Procurement Department retain documentation of the upload of Public Meeting Notices to the Authority's website in order to create an audit trail of document compliance with Florida Statute Section 286.011. The Authority should consider retaining all previous Public Meeting Notices on the website in an Archive format or retain the Public Meeting Notice with other project documents on the Bid Results page of the website. Alternatively, the Authority should consider date and time stamping the Public Meeting Notice when posted in the administration lobby and retain the document in the contract file for future reference. Management Response The Authority concurs. Management Action Plan The Authority will date and time stamp the Public Meeting Notice when posted in the administration lobby and retain the document in the contract file for future reference. Action Plan Owner / Due Date Claude Miller, Director of Procurement/ Immediately.

6. 6 © 2013 Protiviti Inc. All Rights Reserved. This document has been prepared for use by OOCEA’s management, audit committee, and board of directors. This report provides information about the condition of risks and internal controls at one point in time. Future events and changes may significantly and adversely impact these risks and controls in ways that this report did not and cannot anticipate. DRAFT Detailed Observations Observation 2 – Scoring Documentation Improvement Low Priority: Low The Procurement Procedures Manual states "All individual evaluations shall be signed and dated by the Committee Member." During the review of the scoring sheets utilized in both the Competitive Sealed Proposal and Selection of Professional Consultants processes, Internal Audit noted that a date field was not present on any of the scoring sheets. Recommendation Although the date of completion was documented in Evaluation Committee meeting minutes, Internal Audit recommends that the Authority modify the scoring sheet templates to include a date field. This recommendation will improve the record of the timeline of completion of the individual scoring sheets. Management Response The Authority concurs. Management Action Plan The Authority will modify the scoring sheet templates to include a date field. Action Plan Owner / Due Date Claude Miller, Director of Procurement/ Immediately.

7. 7 © 2013 Protiviti Inc. All Rights Reserved. This document has been prepared for use by OOCEA’s management, audit committee, and board of directors. This report provides information about the condition of risks and internal controls at one point in time. Future events and changes may significantly and adversely impact these risks and controls in ways that this report did not and cannot anticipate. DRAFT Appendix A Status of Procurement: Phase I Recommendations

9. 9 © 2013 Protiviti Inc. All Rights Reserved. This document has been prepared for use by OOCEA’s management, audit committee, and board of directors. This report provides information about the condition of risks and internal controls at one point in time. Future events and changes may significantly and adversely impact these risks and controls in ways that this report did not and cannot anticipate. DRAFT