2013-COH - Single Audit of Federal Financial Assistance Programs

Home

CORRECTIVE ACTION PLAN Financial Statement Findings: Finding 2013-001 Information Technology (Significant Deficiency) Recommendation: We recommend that the County and/or the Department perform the following: • Develop or update IT policies and procedures to include internal control procedures addressing the IT risks above. • Identify procedures to ensure that IT policies and procedures are consistently followed. • Implement change management detective controls. • Perform annual test restoration exercises. General Comment: Not all the comments applied to both entities which have separate IT environments and staff. We have broken out the response into two pieces and have done our best to respond fully to the comment. We acknowledge the importance of good internal controls especially in the area of information technology. Water Department's Comment: The Department has addressed the IT related concerns as follows: 1) Physical Security —The Department migrated its billing and accounting applications to a new server located in a secured office. Backups are performed daily with off-site storage updated weekly. 2) Logical Security —The Department strengthened password settings for those systems that allowed it by requiring users to change passwords every 90 days. In addition, unique user ID's were issued to all ARB users. 3) Change Management —The Department implemented a reporting system to monitor all access to the financial server by outside parties. 4) Restoration Testing —The Department is unable to conduct restoration tests due to the absence of hardware on which to restore our applications and because recovery of the system also requires coordination and the associated costs of the Department's software provider to reestablish licensing. County's Comment: The County has deployed "Tripwire", a change management software package used to monitor and alert on access and changes to the Eden and IAS applications. Test restoration is performed on a regular basis for the Eden application, as part of the normal testing of updates to the system, prior to deploying those updates to the production system. As of January 2014, the Department's new management staff was finally in place and a review of the existing policies and procedures has begun to ensure that that they are current and to better address internal control procedures. Anticipated Completion Date: Some items have already been implemented, others will be implemented by June 30, 2014 and for a few items this will be an ongoing effort as we strive to improve our internal controls over information technology. Contact People: Rick Sumada, Waterworks Controller Department of Water Supply Don Jacobs, Director of Information Technology County of Hawaii Page 1