Supervisors hear management audit of San Francisco commodity purchasing; OCA agrees to address recommendations

The Government Audit and Oversight Committee of the San Francisco Board of Supervisors on March 23 heard a management audit of the city's commodity purchasing process that found 16 findings and 66 recommendations and estimated roughly $3.7 million in potential savings if improvements are implemented.

The audit presentation, led by Budget and Legislative Analyst staff Severn Campbell and Mark De La Rosa, covered citywide purchasing authorities and purchasing trends. De La Rosa said the city issued nearly 38,730 purchase orders in the 2008 fiscal year with a combined value of about $383'$384 million and more than 2,700 unique vendors. The report identified weaknesses in purchaser oversight, data reliability and specialized purchasing for IT, vehicles and the Department of Public Health (DPH).

"Our report contains 16 findings with 66 recommendations," De La Rosa said during the committee hearing, and added that implementing the recommendations "would result in approximately $3,700,000 in savings" based on estimated reductions from improved competitiveness.

The audit flagged gaps in the purchaser's oversight of term contracts and departmental purchasing, inconsistencies in the technology store's controls to verify contract prices, and weaknesses in vehicle replacement policy and vehicle procurement timelines (about 87 days for purchaser processing plus roughly 90 days for delivery). Campbell also said DPH purchases about $19 million through the Novation group purchasing organization but lacks consistent tracking to ensure discounts are obtained when it purchases outside Novation.

Naomi Kelly, the city purchaser and director of the Office of Contract Administration (OCA), agreed with many of the recommendations and described steps OCA has taken or plans to take. Kelly said 22 of the 42 recommendations directed at OCA are "either done or in progress," and listed priorities including increasing citywide term contracts, working with the Human Rights Commission on LBE availability, conducting joint post audits with the controller, documenting policies and procedures, and developing annual training.

"We will review how we set our performance measures and we will try and increase that," Kelly said, noting OCA currently manages about 140 citywide term contracts representing about $132 million in spending. She said the city's technology store has recorded roughly $148 million in spend, with about $76 million targeted to local business enterprises (LBEs) as prime contractors and about $11 million targeted to LBE subcontracting goals.

Kelly described formalizing the technology store's auditing practice, including random order reviews and verification of price lists, and cited a consolidated HP desktop purchase as an example of a citywide procurement yielding favorable discounts. On vehicles, Kelly acknowledged two instances where vendors failed to deliver and the city did not pursue penalties, saying one case was an exception and has since been corrected.

Supervisors pressed presenters on specific issues. Supervisor Carmen Chu asked about DPH's authority to purchase through Novation and how to ensure DPH obtains the best prices; Kelly replied OCA will work with DPH and that OCA has staff assigned to SF General and Laguna Honda to assist. Supervisors also questioned whether the controller's post-audit process could be rolled into regular year-end practice; Kelly said OCA will participate in the current fiscal year's post-audit and the partners plan a tiered assessment going forward.

Public commenters urged broader audits: one speaker urged an audit of the Muni railway and Transportation Agency, and others called for a management audit of DPH and San Francisco General Hospital citing past purchasing problems.

The Committee did not take a roll-call vote on policy changes at the hearing. At the conclusion of the item Supervisor Carmen Chu asked for a motion to file the audit; Chair Eric Marr moved and the item was filed for the March 23 Board agenda.

Next steps: the audit lists specific recommendations for OCA, the controller and departments; OCA officials said they will continue implementing recommendations and will work with the controller on joint post audits and with the Department of Technology on enterprise IT agreements.