[Office of Consumer Protection]

DEPARTMENT OF AUDITS AND ACCOUNTS
270 Washington St., S.W., Suite 1-156 Atlanta, Georgia 30334-8400
Greg S. Griffin
STATE AUDITOR (404) 656-2174
August 7, 2015
The Honorable Nathan Deal, Governor Members of the General Assembly The Honorable Samuel S. Olens, Attorney General,
Georgia Department of Law
Ladies and Gentlemen:
My office has conducted a performance audit of the Office of Consumer Protection. This audit was conducted under authority of Georgia Code 50-6-4. A copy of the audit is filed as a permanent record with the State Auditor and is available to the public.
As you are aware, the office is now the Consumer Protection Unit within the Department of Law. The results of the audit are included as an attachment to this letter in consideration of the fact that the unit's operations may be subject to change as a result of the transfer.
We appreciate the cooperation and assistance provided by the Consumer Protection Unit during the audit.
Respectfully submitted,
/s/ Greg S. Griffin
Greg S. Griffin State Auditor
GSG/st Attachment
Mission Statement The Department of Audits exists to provide decision-makers with credible management information to promote
improvements in accountability and stewardship in state and local government.

Georgia Department of Audits and Accounts, Performance Audit Division
Purpose of the Audit
This performance audit examines the Office of Consumer Protection (known as the Consumer Protection Unit within the Department of Law as of July 1, 2015) to determine whether it has processes in place to 1) ensure the effectiveness of criminal investigations and 2) ensure the effectiveness of civil investigations (including aspects of the complaint process). The scope of our review was limited to the Office of Consumer Protection's (OCP) enforcement efforts stemming from criminal and civil investigations. The methodology used to conduct this review is included in Appendix A.
A draft of this letter was provided to the former OCP and the Department of Law for review and comment. Their comments were included in a single response provided by the Department of Law. Pertinent responses were incorporated into the letter.
Summary
The Office of Consumer Protection (OCP) was created to administer the provisions of the Fair Business Practices Act (the Act) and other consumer protection laws. Enacted in 1975, the Act protects consumers and business enterprises from unfair or deceptive practices in the conduct of trade and commerce. The Act also outlines requirements for specific types of businesses, such as health spas and private child support collectors, to operate legally in the state.
Of its approximately 50 staff, about half are assigned to the Civil and Criminal Investigation Units. The majority of these individuals are trained legal and law enforcement professionals whose professional expertise is relied upon to carry out day-to-day investigative activities. Due to this expertise and its relatively small size, OCP operates fairly informally and many of its business processes are undocumented.
Due to the absence of more formalized management controls, we were unable to confirm that business processes related to civil and criminal investigations have resulted in the efficient and effective use of resources or desired outcomes. The establishment of additional management controls would allow OCP to ensure its activities are working effectively to achieve its strategic goals and objectives. Our primary findings are listed below:
Performance measures could be expanded to be more comprehensive in nature and fully cover all aspects of the investigative process.
OCP's existing information system is not effective for managing investigations.
OCP should work to improve management controls over both civil and criminal investigation processes.
OCP should document the basis for decisions related to penalty assessments to minimize risk.
Formal procedures are needed to ensure businesses comply with settlement agreements.

www.audits.ga.gov

Report No. 13-18

1

Findings and Recommendations
Performance measures could be expanded to be more comprehensive in nature and fully cover all aspects of the investigative process.

Currently, OCP lacks a comprehensive set of measures that allow it to fully evaluate the effectiveness and efficiency of civil and criminal investigative processes. Our review found that OCP tracks and reports two measures that demonstrate its progress in collecting restitution from offending businesses to satisfy the state's strategic planning requirements (see Exhibit 1). These measures, however, are limited to its civil enforcement activities. OCP does not track additional measures that cover both the civil and criminal aspects of its activities. Additional output and outcome measures would enhance OCP's knowledge of how its business processes are operating and the outcomes of its activities.

Exhibit 1 OCP Performance Measures, FY 2012-2014

Performance Measures
Average consumer savings and restitution per state dollar appropriated

FY 2012 $8.48

FY 2013

FY 2014

$5.49

$4.91

Total dollar value of savings and restitution

$35,123,557

$25,250,320

Source: Governor's Office of Planning and Budget, State of Georgia's Budget Report FY 2016

$24,203,687

We looked at other federal and state entities that conduct similar activities to identify examples of additional measures that would be suitable for tracking and evaluating workload and investigative results. For example, the Investigations Committee of the Council of Inspectors General on Integrity and Efficiency1 recommends a variety of measures management should have in place to guide its activities, measure its accomplishments, and respond to requests by appropriate external customers. Recommended measures include those that measure investigative workload and results of investigative activity. Exhibit 2 includes a listing of the various types of measures that could be considered.

1 The Council of Inspectors General on Integrity and Efficiency Investigations Committee contributes to improvements in program integrity, efficiency, and cost effectiveness government-wide by providing analysis of investigative issues common to Federal agencies.

www.audits.ga.gov

Report No. 13-18

2

Exhibit 2 Performance Measures Used by Other Entities with Investigative Functions

OUTPUT MEASURES Amount of product or services delivered

Number of complaints addressed Number of cases opened Number of cases closed Number of cases pending Number of referrals to other investigative agencies

OUTCOME MEASURES

Consequences of what

the program



did; something the



program wants



to maximize or minimize























Number of arrests Number of indictments Number of convictions Amount of restitution/penalties/fines paid Number of cases closed with actions Number of closed investigations per investigator Number of investigations opened per investigator Number of complaints investigated within 90 days Number of days to complete an investigation Average/median time (days) to complete an investigation Percent of investigations completed timely Average/median number of days to close cases Percent of cases closed within 90 days Percent of cases resolved within a year Percent of cases resulting in sanctions Percent of all cases successfully resolved through litigation, settlement, or issuance of default judgment Percent of cases investigated resulting in convictions Percent of cases successfully resolved through mediation

Source: PAD review of federal and state consumer protection and investigation agency documents

RECOMMENDATION
Additional internal performance measures, along with meaningful and realistic targets, would allow management to evaluate whether its activities lead to expected results and, if not, identify factors that potentially impact the agency's ability to achieve such results.
Agency Response: In its response, the Department of Law stated its agreement that "performance measures can be a useful tool for evaluating the effectiveness of any number of processes, including the investigative process." The department noted that "In addition to the two performance measures included in the FY16 Budget Report..., OCP has developed and tracked more than a dozen benchmarks and measurements that will assist [the department} in evaluating whether [its] goals...are being met in the future." The department added that "investigations, like prosecutions, are not always susceptible to objective measurement criteria" and that it "will...continue to gather critical data to assure that the mission of [OCP] is being fulfilled in an efficient and effective manner."
DOAA Response: As a point of clarification, we are aware that OCP tracks activities related to restitution, penalties, and caseload. However, these measures do not fully address the efficiency and effectiveness of its investigative processes.

www.audits.ga.gov

Report No. 13-18

3

OCP's existing information system is not effective for managing investigations.
While OCP collects a significant amount of information regarding its investigations, a lack of capability within its data system limits the usefulness of the data. Intranet Quorum (IQ), an off-the-shelf contact management system, was acquired by OCP in 2004 to manage information related to its consumer protection functions. IQ was customized to suit OCP's business processes related to its administration of the Georgia Lemon Law, other regulatory activities (e.g., Health Spas, Buying Services), and civil and criminal investigations. However, our review found the system still lacks sufficient capability to manage information collected on investigative cases from inception to conclusion and to assist staff in their casework. This is particularly the case for criminal investigations which would benefit from a system that can handle the variety of business functions associated with law enforcement, such as case management, field contacts, warrants and arrests, and evidence.
Our review identified the following limitations within the IQ data system:
Multiple records pertaining to the same criminal case. OCP compiles information on its criminal investigations by workflow (an activity) rather than by case. Workflow activities can include codefendants and additional violations. As a result, complex cases involving multiple people and/or violations could include multiple activities, making it difficult to track and monitor criminal investigations both collectively and individually and to quickly get information such as number of active cases/investigations and number of violations.
Manual records needed to supplement computer-processed information. Depending on the complexity, OCP may collect a tremendous amount of information over the lifespan of a case. However, by maintaining the information in both hardcopy and electronic files, OCP cannot make the best use of the information to make quick and informed decisions. For example, as described later in the report, the overall status of penalty payments cannot be readily assessed because the information is tracked using a variety of methods and is stored in both hardcopy files and the IQ system.
Use of text/memo fields to store large amounts of information. OCP stores a significant amount of information in memo fields. Presumably, these fields are used to capture data that cannot be included in regular data fields, such as notes and comments. However, some information stored in memo fields is important for tracking the status of cases, such as payments toward civil penalties and restitution. Maintaining this information in a memo field limits OCP's ability to extract it for tracking and analysis purposes.
RECOMMENDATION
Given the transfer of OCP to the Department of Law, it is possible that OCP's use of IQ may be replaced with another system. If not, IQ should be evaluated to determine the feasibility of addressing its limitations through modifications or the potential to replace it with a new case management system that would aid OCP in improving and automating key business processes.
Agency Response: In its response, the Department of Law "agrees the IQ system is not optimal and has limitations." The department stated that "OCP was in the process of evaluating over a dozen other case management systems when budget cutbacks made it impossible to purchase a replacement system." The department stated that it "intends to fully incorporate OCP into the department's IT system," with the expectation that its ability to manage and automate OCP's routine business practices would improve.

www.audits.ga.gov

Report No. 13-18

4

To ensure investigations are conducted effectively and efficiently, OCP should work to improve management controls over both its civil and criminal investigation processes.
The investigative process can be complex and each case is unique. In addition, OCP relies heavily on the expertise of its investigators and attorneys to guide their own individual investigations. While it has established formalized guidance for ensuring civil investigations meet the office's investigative standards, it has not done so for criminal investigations. OCP also generates a significant amount of data over the course of its investigations, but does not regularly analyze the data to detect operational issues or weaknesses in either criminal or civil investigations. While investigations may require flexibility and professional judgment, formalized investigative guidance and continuous evaluation of investigative outcomes would provide OCP with greater assurance that its resources are being used as efficiently and effectively as possible, desired results are being achieved, and problem areas are being identified.
We conducted a variety of analyses using data extracted from OCP's IQ system to evaluate processes and outcomes for civil and criminal investigation cases closed from fiscal year 2010 to 2014. The results from these analyses suggest the need for on-going internal review and evaluation to determine if these results are desirable.
Not all matters recommended for civil investigation ended with an enforcement action. Due to the way data is captured in the IQ system, it was difficult to isolate investigated cases from all other matters considered for investigation. However, of 1,289 closed civil matters, 938 made it past the preliminary investigation phase. Of these, 49% resulted in enforcement actions2. The remaining 51% of matters investigated were closed for a variety of reasons including OCP's lack of jurisdiction, finding no violation had occurred, or determining there was insufficient evidence to support that a violation had occurred. While it is reasonable to expect that some investigations would close prior to enforcement action, it is possible that its case selection and preliminary investigation processes could be impacting these results.
Not all criminal cases investigated resulted in an enforcement action. Our review of 230 closed criminal cases found that 48% resulted in an enforcement action. In most instances, these cases were successfully prosecuted. The remaining 52% of cases were closed for reasons similar to those noted for civil investigations, including inconclusive or insufficient evidence and OCP's lack of jurisdiction. It should also be noted that cases closed without enforcement action included 24 that were closed because they were not accepted for prosecution or they exceeded the statute of limitations (while in the possession of the prosecuting attorney's office). Similar to civil investigations, we were unable to identify an acceptable threshold for the number/percentage of cases ending with outcomes other than enforcement. Due to informal controls and guidance in case selection and investigation, it is possible that the number resulting in no enforcement action could be reduced.
Median time to close matters not fully investigated was nearly equivalent to that of fully investigated cases. Our review found that for both civil and criminal investigations, those resulting in no enforcement action took about as long or longer to close than some investigations resulting in enforcement actions. For example, as shown in Exhibit 3, civil investigations resulting in enforcement actions closed in 261 median days compared to the 318 median days it took to close cases found to have no violation. Similarly, criminal investigations that resulted in an enforcement action did so within 634 days while cases closed due to inconclusive/insufficient evidence closed in 656 median days. While OCP does not confine investigations to a pre-established timeframe, it is reasonable to

2 Enforcement actions include administrative orders, assurances of voluntary compliance, letters of understanding, and consent orders.

www.audits.ga.gov

Report No. 13-18

5

expect a desire to minimize the amount of time taken to get to a "no-go" decision so that resources can be used strategically.

Exhibit 3 Time to Close by Case Outcome (FY 2010-2014)
Civil

Criminal

Case Outcome Administrative Closure Business Action Business Status Change Enforcement Inconclusive/Insufficient No Violation Other1 Referral
Total

Number of Workflows
122 95 109 656 132 67 15 93 1,289

Median Days to Close 259 120 243 261 76 318 46 94 208

Number of Workflows
13 2 1 111 29 14 26 34 230

Median Days to Close 402 287 495 634 656 231 1,365 472 606

1 Other includes cases such as those in which prosecution was declined and statutes of limitation were exceeded. Source: PAD analysis of OCP data

There are a number of possible explanations for these results, some that may be inherent to the legal process that are beyond OCP's control while others may be caused by an absence of certain management controls in its investigations processes. For example, we know that whenever a subpoena or an investigative demand is issued to obtain evidence, the time to close an investigation is significantly increased. In addition, whether a case is accepted for prosecution could depend on the priority of the prosecutor and the location of victims. However, from a business process standpoint, case outcomes and the length of time to reach various outcomes may be influenced by factors such as case selection criteria, investigator and attorney caseloads, differences in how investigations are handled, and limited capabilities of its information system. Several of these are discussed in more detail below.
Civil case selection decisions. While OCP has developed a formal strategy to guide decisions about whether to recommend matters for civil investigation, it does not document the basis for the decision to investigate. Documenting the factors considered in the selection of each investigated matter would allow outcomes to be evaluated more constructively.
Criminal case selection criteria. Unlike civil investigations, the criteria for selecting criminal cases for investigation are not formally documented. Although OCP staff report considering such factors as number of victims or value of losses to consumers, there is no formalized list of criteria or documentation of the factors leading to investigations. As a result, OCP management cannot ensure that the criteria are maximizing the potential to select cases that will have a positive outcome.

www.audits.ga.gov

Report No. 13-18

6

Criminal investigation procedures/guidance. Criminal investigators are given a high degree of autonomy and work with very little management oversight. Without documented procedures that communicate to investigators OCP's expectations for how certain aspects of the investigative process are to be conducted, OCP has no assurance that investigations are being conducted using a similar set of standards and procedures. For example, OCP does not have written procedures that cover all aspects of the criminal investigation process. Standards developed by the Georgia Association of Chiefs of Police (GACP), for example, require law enforcement agencies to have written procedures for investigations as a way to encourage effective and efficient operation.
RECOMMENDATION
OCP should consider implementing additional management controls to ensure that it is maximizing the impact of its civil and criminal investigations. Specifically, the civil case selection process should be evaluated to ensure it is operating as intended and achieving desired results. Formalized criteria for deciding which cases to investigate criminally should be developed to ensure selected cases provide the greatest benefit to Georgia consumers. This would also mitigate risks associated with having knowledge of the case selection process limited to one or a few personnel. OCP should also consider developing more comprehensive procedures for criminal investigations to ensure the investigations are conducted properly, consistently, and efficiently.
Agency Response: In its response, the Department of Law stated that while it agrees "that management controls are always important in processing both civil and criminal investigations, [it] appreciate[s] the report's recognition that investigations require `flexibility and professional judgment' and that objective time- and outcome-based criteria are not always well suited for evaluating a legal process." It also notes the "department itself struggles to find fair and meaningful criteria to use in evaluating [its] handling of both civil and criminal matters."
The department indicated that "multiple layers of supervision were in fact built into [OCP's] procedures and practices." In addition, it explained the difficulty in determining "at the outset where an investigation is going to go" and noted that "many...investigations which did not result in an enforcement action were concluded early in the process." The department added that OCP "could have been more timely in formally `closing' those files administratively, but this would not have changed the basic result." Lastly, the department stated that its "prosecutors intend to work closely with criminal investigators in the handling of future criminal cases."

OCP should document the basis for decisions related to penalty assessments to minimize risk.
State law specifies maximum penalty amounts for certain types of consumer protection law violations. As a result, OCP has a great deal of flexibility in determining the total amount it assesses violators. Various factors are considered when determining the total penalty assessed, including the number and egregiousness of violations, number of consumers affected, business' ability to pay, and whether the current violation is a repeat offense. In addition, the final assessment may be the product of negotiations between OCP and the businesses. Our review found that OCP does not document the basis for the decisions related to civil penalty assessments. Without documentation of the basis for the civil penalty decision, we were unable to determine if OCP's civil penalty assessments are made in accordance with the

www.audits.ga.gov

Report No. 13-18

7

provisions of state law, are consistently applied, or serve as an effective deterrent for future offenses. In addition, the lack of documented decisions could expose OCP to potential accusations of unequal treatment or favoritism.
Our review of penalty assessments revealed variations in penalty amounts for certain types of offenses with no explanation for how the decision was reached. For example, we reviewed 118 cases closed from fiscal year 2010 to 2014 involving a single violation of deceptive advertising and found reported penalties ranging from $100 to $260,000. Although OCP could provide an explanation for the differences in the several cases we discussed, we could not confirm their statements without extensive review of each case file. Should there be turnover in OCP staffing, there would be little knowledge and understanding of how past decisions were made. To ensure some consistency, it is expected that past decisions would inform future decisions.
RECOMMENDATION
OCP should document the basis for the penalty amounts assessed violating businesses in its files. At a minimum, this would consist of a note added to the case file that addresses the factors that played a role in the decision.
Agency Response: In its response, the department indicated that OCP's Administrator "exercised his statutory discretion in assessing statutorily-defined civil penalties, basing them upon the facts and circumstances in each case" and "was guided by case law, which sets forth general factors to be considered in assessing civil penalties." It further stated that "those factors were considered in relation to the particular business at issue." The department noted that "it is appropriate that the civil penalty to be paid by a small-volume business with no previous history of violations differs from the penalty to be paid by a high-volume business with a history of repeated violations, even if both businesses committed the same type of deceptive practice."
DOAA Response: As a point of clarification, our recommendation is not directed at how civil penalties are derived. Rather, we are suggesting that OCP note which factors weighed most heavily in its decision as part of a case closing memo to support its decisions and to serve as a reference in future decisions.

Formal procedures to ensure businesses comply with settlement agreements are needed.
OCP does not have an effective and efficient process for monitoring compliance with settlement agreements. Settlement agreements may require businesses to pay civil penalties to OCP and/or restitution to victims of their unfair practices. Investigators have primary responsibility for monitoring business' compliance with settlement agreements. However, the manner in which monitoring activities occur and are documented varies from case to case. There is no standard way to document compliance with the terms of an agreement and payments made by the businesses. Instead, investigators devise their own methods of record keeping, much of which is manual and does not allow management to quickly determine the status of all cases being monitored for compliance with the terms of their agreement and that all amounts due have actually been paid.
Civil Penalty Payments. Depending on the circumstances, businesses may be allowed to make civil penalty payments on an installment basis. According to OCP estimates, they set up a penalty payment schedule in about 20% of the cases based on their assessment of a business' ability to pay the entire penalty amount at once. The assigned investigator is responsible for recording when payments are received,

www.audits.ga.gov

Report No. 13-18

8

generally through handwritten notes in the case files and notes recorded in the IQ database. Also, OCP's business office documents payments in the form of a memo to the State Accounting Office (for deposit into the general fund account of the State Treasury), and manually tracks balances using handwritten notes in the hardcopy case files. However, our review found that these methods do not provide adequate assurance that all amounts owed are paid and collected within the timeframes established by the agreements. For example, we reviewed nine closed cases that were subject to monitoring of penalty payments in fiscal years 2012 and 2013 and found an instance in which a case was closed prior to the entire penalty amount being paid.
Restitution Payments. When settlement agreements require restitution payments, businesses generally pay consumers directly and are required to submit documentation to OCP as evidence that payments were made. As part of the monitoring process, investigators review submitted documentation to verify the businesses actually paid. According to OCP officials, documentation could include cancelled checks or documentation of charge-backs to consumers' credit cards. In addition, investigators may call some consumers to ensure they have received their restitution payments (especially if a business claims that they have paid a consumer but the documentation of the payment has not yet been received by OCP). However, our review of 12 closed case files in fiscal years 2012 and 2013 found some that lacked proof of restitution payments or contained documentation that did not meet OCP's requirements. Based on this, it would be difficult to ensure restitution payments were in fact made.
RECOMMENDATION
OCP should establish a single method to formally document civil penalties imposed and track payments against those amounts. Ideally, such information would be tracked centrally and electronically to allow management and staff to readily retrieve reports relating to the overall status of payments and on individual cases. In addition, OCP should formally document its guidance for investigators regarding an acceptable level of restitution documentation businesses must provide. Case files should be periodically reviewed to ensure documentation requirements are consistently implemented among investigators.
Agency Response: In its response, the Department of Law stated "OCP reports that it has been diligent in monitoring compliance with settlement terms by the many hundreds of affected businesses included in the audit review period," adding that "this is indicated by the voluminous files maintained by OCP containing copies of checks, emails, phone calls, notes confirming consumer receipt of restitution payments, and any other pertinent documentation." The department also stated that "this admittedly `manual' monitoring process has been effective in ensuring that businesses, including the twelve businesses referred to in the finding, comply with their obligations. With regard to those businesses, proof of effective monitoring was simply overlooked during the audit review." The department noted that "OCP acknowledges that such documentation should have been retained in a more uniform manner and [OCP] will make efforts to improve that practice in the future."
DOAA Response: Subsequent to our review, OCP was able to locate additional documentation to confirm restitution payments to consumers had been made. These documents were not initially reviewed by the audit team because they were not maintained in a centralized location (e.g., case files) or in a consistent manner. As demonstrated, this manner of recordkeeping limits management's ability to quickly identify the overall status of restitution payments.

www.audits.ga.gov

Report No. 13-18

9

Appendix A: Objectives, Scope, and Methodology
Objectives This report examines the Office of Consumer Protection (known as the Consumer Protection Unit of the Department of Law as of July 1, 2015), and activities related to consumer protection investigations. Specifically, the audit sought to evaluate:
1. the effectiveness of the criminal investigation process; and 2. the effectiveness of the civil investigation process.
Scope This performance audit generally covered activity related to the Office of Consumer Protection's (OCP) investigation processes, including complaint handling, that occurred from fiscal year 2010-2014, with consideration of earlier or later periods when relevant. Information used in our audit was obtained by reviewing relevant laws, rules, and regulations, OCP's written policies and procedures, annual reports, strategic planning reports, and other agency documents. We also interviewed OCP officials and other staff about the case selection and investigation processes
Government auditing standards require that we also report the scope of our work on internal control that is significant within the context of the audit objectives. All of the work conducted for both objectives can be classified as an assessment of internal controls, or management controls, over investigations. The first objective addresses OCP controls over criminal investigations, while the second objective addresses the controls over civil investigations. Specific information related to our internal control work is described by objective in the methodology section below.
In addition, through interviews and tests of the data obtained, we assessed the controls over data used for this audit and determined that the data used were sufficiently reliable for our analyses.
Methodology The audit team used the following methodologies to complete the audit objectives:
Analyzed civil and criminal case data from OCP's IQ information system;
Reviewed a sample of hardcopy civil case files;
Reviewed policies and procedures manuals related to civil and criminal investigations;
Observed case selection and case status meetings and reviewed case status reports;
Reviewed documents to identify performance expectations and training requirements;
Reviewed investigation and consumer protection practices in 10 other states (Alabama, Florida, Kentucky, Louisiana, Maryland, Mississippi, North Carolina, South Carolina, Tennessee, and Virginia) and other state and federal agencies; and
Reviewed literature to identify appropriate criteria and expectations related to investigations in general.3

3 We reviewed law enforcement standards and guidelines published by the Georgia Association of Chiefs of Police and Commission on Accreditation for Law Enforcement Agencies, and reviewed guidance provided by the Council of the Inspectors General on Integrity and Efficiency.

www.audits.ga.gov

Report No. 13-18

10

To determine the effectiveness of OCP's criminal investigation process, we interviewed OCP staff about the case selection and investigation processes. We also discussed OCP's methods for monitoring status of investigations, observed a case status meeting, and reviewed reports that include time spent on individual cases. We analyzed data on cases closed between 2010 and 2014 to analyze case outcomes and timeliness of investigations.
To determine the effectiveness of OCP's civil investigation process, we interviewed OCP staff and observed case selection team meetings to understand how cases were evaluated and selected for investigation. We also interviewed OCP staff and reviewed the procedures manual to identify key aspects of the investigation process. We reviewed case monitoring reports prepared by civil attorneys as well as stage and exception reports to determine OCP's process for monitoring civil investigations. We obtained and analyzed data on civil investigations closed from fiscal year 2010 to 2014 to determine if there were trends in case outcomes and timeliness of investigations. We also analyzed data to identify cases that resulted in penalty payments and restitution to consumers.
To determine whether penalties imposed on businesses were adequately documented in the case files and paid in accordance with settlement agreements, we reviewed a non-statistically valid sample of nine cases closed in fiscal year 2012 and 2013. We reviewed the step notes in the IQ database for each case to determine how many payments were made and the amounts that were paid. Also, we reviewed hardcopy files to determine what the settlement agreement (Assurance of Voluntary Compliance or AVC) stipulated as far as the penalty amounts, looked for evidence of the payments being made by the businesses, determined if the documentation covers the full penalty amounts, determined whether or not the payments were made in a timely manner (using the payment schedules outlined in the AVCs), and determined if it appears that a civil penalty, or a portion of a civil penalty, was not imposed (hammer clause).
To determine whether restitution payments to consumers were paid in full, made on time, and adequately documented, we reviewed documentation on a non-statistically valid sample of 12 of 29 cases closed in fiscal year 2012 and 2013 that contained restitution requirements. We reviewed hardcopy files for each case to identify documentation related to restitution payments.
We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

www.audits.ga.gov

Report No. 13-18

11

The Performance Audit Division was established in 1971 to conduct in-depth reviews of state-funded programs. Our reviews determine if programs are meeting goals and objectives; measure program results and effectiveness; identify alternate methods to meet goals; evaluate efficiency of resource allocation; assess compliance with laws and regulations; and provide credible management information to decision-makers. For more information, contact
us at (404)656-2180 or visit our website at www.audits.ga.gov.