2013-COH - Single Audit of Federal Financial Assistance Programs

Home

County of Hawaii State of Hawaii Schedule of Findings and Questioned Costs Year Ended June 30, 2013 Section II — Financial Statement Findings Finding No. 2013-001: Information Technology (Significant Deficiency) Condition Information technology ("IT") is a strategic element of the operations of the County of Hawaii (the "County") and the Department of Water Supply (the "Department"), a component unit of the County. Because of the high volume of transactions at the County and the Department, the establishment of internal controls over processes incorporating IT is critical to its operations. As part of our financial statement audits for the year ended June 30, 2013, we performed IT general controls reviews of the following systems operated by the County and the Department: Count • Windows Domain • Eden • Integrated Assessment System • Revenue Collection Department • Windows Domain • Select Financial System • Public Utility Billing System • ARB N_Sight Mobile System Our review resulted in several IT control deficiencies in the areas of physical and logical security, change management, and IT operations as follows: Physical and logical security • Lack of formal security administration policies and procedures addressing: o New, transferred and terminated user account administration o Maintenance of audit evidence to support approval of employee access to the system o Identification of terminated employees who continue to have access to the system o Identification of employees whose access to system resources are not commensurate with their job responsibilities o Minimum password security settings o Network security reviews o Minimum environmental security requirements o Physical access to the servers • Weak password security settings or the lack of system functionality to enforce strong password policies for certain applications. • System databases are not appropriately restricted and monitored for unauthorized changes. • Appropriate user access reviews are not performed for certain applications and security groups. Cage management • Lack of a formalized change management process for certain applications and firewall configuration settings. • Lack of segregation of duties for developers and security administrators. IT Operations • Test restorations not performed. 21