2010-01-ES Executive Summary - Limited Scope Performance Audit of Department of Water Supply's Internal Controls for Cash Handling and Financial IT Systems

Home

Sarbanes-Oxley (SOX)– Segregation of Duties Matrix. o Information System Audit and Control Association (ISACA) – IT Segregation of Duties o Matrix, and Security and Business Continuity Plans. Control Objectives for Information and related Technology (COBIT) Framework. o GENERAL FINDINGS In response to its discovery of employee theft, DWS proposed significant policy and process improvements to its cash handling activities, but has yet to fully implement all proposed controls. As a result, current cash handling practices (including security of cash assets; reconciliation of transactions; financial reporting and documentation; segregation of duties; and management oversight) are still insufficient to prevent and detect mishandling or misappropriations of customer payments in a timely manner. In addition, current financial IT systems controls (including protocols for security, access rights, back-up, and disaster recovery; automation of its operations; and integration of its financial systems and financial reporting capabilities) are also insufficient to prevent and detect potentially larger financial misappropriations or other fraudulent activities in a timely manner. CASH HANDLING – RECOMMENDATIONS Control Environment: DWS must assess all risks to its cash assets; identify preventive and detective controls relating to its cash handling processes; and develop and implement formal written policies and procedures to regularly monitor cash handling operations at all levels and in all functions within its Finance Division. Security of Customer Payments/Segregation of Duties: DWS needs to secure all customer payments in lockable cash boxes in secure locations to prevent or deter mishandling and misappropriation. Each employee with cash handling duties should be assigned a separate cash box and separate login or password to the Public Utility Billing System (PUBS). DWS also needs to reassess its combining of cashiering and customer service duties in District offices. Reconciliation of Transactions: DWS needs to provide audit trails for all PUBS transactions processed by each Cashier and review all transactional changes authorized by Supervisors. DWS needs to record and track customer payments from their first point of receipt (by payment type/number/amount) for independent reconciliation to customer payments posted to customer accounts and daily bank deposits (by payment type/number/amount). Financial Reporting: DWS needs to be able to track all water billing and other revenue- generating activities and transactions to ensure the completeness and accuracy of its financial data and the proper collection of all fees owed. DWS should also consider automating its manual receipt processes to gain further efficiencies. IT FINANCIAL SYSTEMS - RECOMMENDATIONS Control Environment: DWS should complete a thorough risk assessment of its financial IT systems and related processes; document any control deficiencies; and develop and implement formal written policies and procedures to regularly review and audit financial transactions and IT system changes at all levels and in all functions within its Finance Division and Information Systems Branch. IT System Integration: DWS has three financial IT systems – the Public Utility Billing System (PUBS), Select Financial System, and Water Commitment System – which are separately maintained and not integrated. If current inefficiencies cannot be remedied with integration and configuration changes, DWS should consider procurement of a new integrated utility billing, 2