Fayette County

Audit: finance control lax at Fayette jail

An internal city audit of purchasing at the Fayette County Detention Center raises questions about the jail's discretionary spending account, the facility's computer operating system and the Lexington company that developed it.

Jail officials paid Cottrell Consulting, a small software development company, more than $752,000 between 1999 and 2008 for software development work at the jail, including $451,476 that was paid out of a discretionary Phone Revenue Account, according to the audit.

The audit recommends closing that account, which previously operated at the discretion of the Community Corrections director and still has a balance of $1.24 million. The money would be transferred to the city's general fund.

The jail's contract with Cottrell Consulting wasn't approved by the mayor, as required by the city's charter, and sometimes did not go through the mandated competitive bidding process, the audit found.

It also questions whether such a small company should be responsible for maintaining a key computer management system, and suggests that a former jail official who had authority to approve Cottrell Consulting's work lacked sufficient expertise.

Among other things, the audit cited an incident in which confidential inmate information from a Florida jail was left on a detention center computer server, apparently through an "oversight" by Harold Cottrell, owner of the software firm.

Auditors recommended that no upgrades to the computer system be made until it is "thoroughly evaluated" by the city's Division of Computer Services. Any future upgrades should be reviewed and approved in advance by the computer services division, auditors said.

The audit, dated Wednesday, was conducted by the city's internal audit division. It was requested by Mayor Jim Newberry's administration as one of several steps to "tighten financial accountability across government," said Susan Straub, Newberry's spokeswoman.

Straub said the administration already has implemented some steps suggested in the audit and will implement or recommend more.

According to the audit's cover page, the inquiry grew out of concerns that computer technology purchases were being made at the jail "without any oversight from the Division of Computer Services."

The audit says that former Community Corrections Senior Administrative Officer Don Leach had been given authority to approve Cottrell Consulting's work. But auditors concluded that Leach, who recently retired, lacked "sufficient expertise in information technology system configuration" and other details related to software development and upgrades.

Auditors also said they could find no documentation to indicate whether the Urban County Government actually owns the software in the jail's computer management system, or whether the software is only licensed from Cottrell Consulting.

The auditors said Harold Cottrell told them that their software is not copyrighted and that there is no licensing agreement with the city. Nevertheless, the government's Department of Law should check to resolve any "ambiguities," auditors recommended.

The audit concluded that the purchase of computer information technology for the jail "needs enhanced oversight."