Laserfiche WebLink
o Sarbanes -Oxley (SOX) — Segregation of Duties Matrix. <br /> o Information System Audit and Control Association (ISACA) — IT Segregation of Duties <br /> Matrix, and Security and Business Continuity Plans. <br /> o Control Objectives for Information and related Technology (COBIT) Framework. <br /> GENERAL FINDINGS <br /> In response to its discovery of employee theft, DWS proposed significant policy and process <br /> improvements to its cash handling activities, but has yet to fully implement all proposed controls. <br /> As a result, current cash handling practices (including security of cash assets; reconciliation of <br /> transactions; financial reporting and documentation; segregation of duties; and management <br /> oversight) are still insufficient to prevent and detect mishandling or misappropriations of <br /> customer payments in a timely manner. In addition, current financial IT systems controls <br /> (including protocols for security, access rights, back -up, and disaster recovery; automation of its <br /> operations; and integration of its financial systems and financial reporting capabilities) are also <br /> insufficient to prevent and detect potentially larger financial misappropriations or other <br /> fraudulent activities in a timely manner. <br /> CASH HANDLING — RECOMMENDATIONS <br /> Control Environment: DWS must assess all risks to its cash assets; identify preventive and <br /> detective controls relating to its cash handling processes; and develop and implement formal <br /> written policies and procedures to regularly monitor cash handling operations at all levels and in <br /> all functions within its Finance Division. <br /> Security of Customer Payments /Segregation of Duties: DWS needs to secure all customer <br /> payments in lockable cash boxes in secure locations to prevent or deter mishandling and <br /> misappropriation. Each employee with cash handling duties should be assigned a separate <br /> cash box and separate login or password to the Public Utility Billing System (PUBS). DWS also <br /> needs to reassess its combining of cashiering and customer service duties in District offices. <br /> Reconciliation of Transactions: DWS needs to provide audit trails for all PUBS transactions <br /> processed by each Cashier and review all transactional changes authorized by Supervisors. <br /> DWS needs to record and track customer payments from their first point of receipt (by payment <br /> type /number /amount) for independent reconciliation to customer payments posted to customer <br /> accounts and daily bank deposits (by payment type /number /amount). <br /> Financial Reporting: DWS needs to be able to track all water billing and other revenue - <br /> generating activities and transactions to ensure the completeness and accuracy of its financial <br /> data and the proper collection of all fees owed. DWS should also consider automating its <br /> manual receipt processes to gain further efficiencies. <br /> IT FINANCIAL SYSTEMS - RECOMMENDATIONS <br /> Control Environment: DWS should complete a thorough risk assessment of its financial IT <br /> systems and related processes; document any control deficiencies; and develop and implement <br /> formal written policies and procedures to regularly review and audit financial transactions and IT <br /> system changes at all levels and in all functions within its Finance Division and Information <br /> Systems Branch. <br /> IT System Integration: DWS has three financial IT systems — the Public Utility Billing System <br /> (PUBS), Select Financial System, and Water Commitment System — which are separately <br /> maintained and not integrated. If current inefficiencies cannot be remedied with integration and <br /> configuration changes, DWS should consider procurement of a new integrated utility billing, <br /> 2 <br />