2013-COH - Single Audit of Federal Financial Assistance Programs

Home

County of Hawaii State of Hawaii Schedule of Findings and Questioned Costs Year Ended June 30, 2013 Criteria When IT is used to initiate, record, process, and report on transactions included in the financial statements, the systems and related processes should include internal controls to prevent or detect potential misstatements. Effect Internal controls in the following areas address the following risks: Physical and logical security Unauthorized access to these systems could result in either the destruction or theft of data, unauthorized or nonexistent transactions being made or transactions being inaccurately recorded. Cage management Unauthorized or untested changes promoted to the production environment could cause the systems to either process data differently than intended or unexpectedly compromise the integrity of the data maintained. IT Operations Lack of restoration testing could result in the inability to recover from data loss, corruption, or data integrity concerns. Causes The primary cause of the internal control deficiencies identified was due to the lack of IT policies and procedures which include internal controls to address the IT risks discussed above. Recommendation We recommend that the County perform the following: • Develop and implement IT policies and procedures to include internal control procedures addressing the IT risks above. • Indentify procedures to ensure that IT policies and procedures are consistently followed. • Implement change management detective controls. • Perform annual test restoration exercises. 22