A follow-up audit has revealed ongoing misuse of taxpayer funds within Denver’s Technology Services department, stemming from inadequate policies and poor administration of its employee purchase card program.

Auditors from Denver Auditor Timothy O’Brien’s office found the department failed to enforce Executive Order 18, which clarifies the mission, role and authority of Technology Services and specifically prohibits technology purchases using city government purchase cards.

A 2023 audit, which reviewed departmental transactions and processes from Jan. 13, 2021, through Oct. 31, 2022, found that “city leaders and employees bypassed required approvals for purchase card use and expense reimbursements.”

Unclear policies between Technology Services and the Controller’s Office resulted in “conflicting guidance” for when and how purchasing cards and expense reimbursements were to be used.

Refusal by the Controller’s Office to update their guidelines, which, combined with Technology Services’ lack of a clear definition for “technology purchase,” leaves the city’s technology purchasing operations open to interpretation, according to a news release from O’Brien.

“Without a clear policy definition of what an allowable technology purchase is, it is possible a city employee may unwittingly violate Technology Services requirements,” O’Brien said. “If and when that does occur, it is concerningly unclear if an employee or an agency would be held responsible.”

Auditors said the department’s failure to implement recommendations risks city data security and wastes taxpayer dollars by foregoing potential bulk discounts.

Charged with the management and oversight of all physical and virtual technology that touches the city’s network — including places like the airport — Technology Services is a critical government component. But according to department officials, some city entities believe they are a separate network.

“When it comes to our independent agencies, there’s not a clear, defined kind of what we do and don’t support,” said Tamara Segura, a data protection officer. “So, often, we’ll support specific functions within that have components of technology, like PCI (payment card industry) compliance, although they’ll also have other operations within technology that are independent of our support; so, because of some of those gray lines, often the aspect of being on the network is questioned.”

The 2023 audit resulted in six recommendations: two have been fully implemented, three have been partially implemented and one remains to be addressed.

Since the audit, the quantity and dollar amount of possible technology purchase violations have decreased. However, more than $10,000 of possible violations per month continued through October 2024, according to auditors.

Technology Services has made strides in improving efficiencies, including implementing a new dashboard to help department leaders better visualize technology purchases made with purchase cards.

“These workflows are an important step for oversight,” Auditor O’Brien said. “However, if Technology Services does not document processes, roles, and responsibilities for managing the dashboard or for implementing the workflow, that knowledge could be lost if staff members leave city employment.”

Technology Services have also expanded employee training on approved technology purchasing methods, but have not monitored training completion or documented which employees had completed the training, the most recent audit found.

Auditors have the option to revisit areas of risk in future audits to ensure the city takes appropriate corrective action.