2010-01-ES Executive Summary - Limited Scope Performance Audit of Department of Water Supply's Internal Controls for Cash Handling and Financial IT Systems

Home

financial, and water commitment system. DWS should also evaluate options for automating its business functions to improve posting between its utility billing and financial systems; tracking of water commitments and other revenue-generating transactions; and reporting on its manual receipt processes. IT Security Policy: DWS needs to develop and implement a formal written IT security policy. All employees with financial IT access should have individual logins and should not share passwords. IT settings should require password changes on a regular basis, and automatic lockouts after a specified period of nonuse. IT administrator access rights should be limited, and IT system changes should be accompanied by audit trails that are reviewed for proper authorization. All financial IT servers should be locked in an air-conditioned server room with restricted employee access. IT Recovery and Business Continuity Plans: DWS needs to develop and implement formal written back-up and retention policies for its financial IT systems. Back-up tapes should be stored off-site in a secure location outside the tsunami zone, and restoration from back-up tapes should be routinely tested to ensure that critical systems can be restored. DWS also needs to develop a concise business continuity plan to address continuation of operations in the aftermath of various business disruption and disaster scenarios. Segregation of Duties:The function of financial IT system administrator should be moved from the Waterworks Controller, who currently also serves as financial IT application administrator, to multiple employees in the Information Systems Branch. DWS RESPONSE The Department of Water Supply generally agreed with audit findings, stating that: “Overall, this report provides an excellent opportunity for us to update and improve controls in the department.” However, DWS cited current workloads and upgrade costs for improvement of financial management and billing procedures and systems as challenges to the early implementation of audit recommendations, which working conditions were acknowledged by auditors in the report. CONCLUSION The Water Board and its Manager are responsible for establishing a proper control environment within the Department of Water Supply that provides the discipline and structure required to properly account for customer monies and other cash assets. Fundamental to meeting this management responsibility is the establishment of a continuous review process that identifies new or changing financial and operational risks; updates internal control activities to minimize risks; and implements updated policies and procedures in a timely manner. Policies and procedures need to be clearly communicated, so employees understand their roles in the cash handling and financial control systems as well as the consequences for failed compliance. In addition, the Water Board and its Manager must provide the optimum combination of resources within its Finance Division – including personnel and automated financial IT systems – to ensure the completeness, accuracy, and timeliness of its financial information. It is imperative that County officials expand their operational missions of providing public services to include the safeguarding of public assets through effective risk management and internal control systems. Colleen M. Schrandt Legislative Auditor County of Hawai‘i June 2010 3