Laserfiche WebLink
financial, and water commitment system. DWS should also evaluate options for automating its <br /> business functions to improve posting between its utility billing and financial systems; tracking of <br /> water commitments and other revenue - generating transactions; and reporting on its manual <br /> receipt processes. <br /> IT Security Policy: DWS needs to develop and implement a formal written IT security policy. All <br /> employees with financial IT access should have individual logins and should not share <br /> passwords. IT settings should require password changes on a regular basis, and automatic <br /> lockouts after a specified period of nonuse. IT administrator access rights should be limited, <br /> and IT system changes should be accompanied by audit trails that are reviewed for proper <br /> authorization. All financial IT servers should be locked in an air - conditioned server room with <br /> restricted employee access. <br /> IT Recovery and Business Continuity Plans: DWS needs to develop and implement formal <br /> written back -up and retention policies for its financial IT systems. Back -up tapes should be <br /> stored off -site in a secure location outside the tsunami zone, and restoration from back -up tapes <br /> should be routinely tested to ensure that critical systems can be restored. DWS also needs to <br /> develop a concise business continuity plan to address continuation of operations in the <br /> aftermath of various business disruption and disaster scenarios. <br /> Segregation of Duties: The function of financial IT system administrator should be moved from <br /> the Waterworks Controller, who currently also serves as financial IT application administrator, to <br /> multiple employees in the Information Systems Branch. <br /> DWS RESPONSE <br /> The Department of Water Supply generally agreed with audit findings, stating that: "Overall, this <br /> report provides an excellent opportunity for us to update and improve controls in the <br /> department." However, DWS cited current workloads and upgrade costs for improvement of <br /> financial management and billing procedures and systems as challenges to the early <br /> implementation of audit recommendations, which working conditions were acknowledged by <br /> auditors in the report. <br /> CONCLUSION <br /> The Water Board and its Manager are responsible for establishing a proper control environment <br /> within the Department of Water Supply that provides the discipline and structure required to <br /> properly account for customer monies and other cash assets. Fundamental to meeting this <br /> management responsibility is the establishment of a continuous review process that identifies <br /> new or changing financial and operational risks; updates internal control activities to minimize <br /> risks; and implements updated policies and procedures in a timely manner. Policies and <br /> procedures need to be clearly communicated, so employees understand their roles in the cash <br /> handling and financial control systems as well as the consequences for failed compliance. In <br /> addition, the Water Board and its Manager must provide the optimum combination of resources <br /> within its Finance Division — including personnel and automated financial IT systems — to ensure <br /> the completeness, accuracy, and timeliness of its financial information. It is imperative that <br /> County officials expand their operational missions of providing public services to include the <br /> safeguarding of public assets through effective risk management and internal control systems. <br /> Colleen M. Schrandt <br /> Legislative Auditor <br /> County of Hawaii <br /> June 2010 <br /> 3 <br />