2010-01-AU Limited Scope Performance Audit of Department of Water Supply's Internal Controls for Cash Handling and Financial IT Systems

Home

CHAPTER 4: CASH HANDLING SYSTEMS RECOMMENDATION DWS financial IT systems personnel need to develop and implement policies that address adequate physical and application access controls, including transactional level passwords to provide individual audit trails and an automatic lockout mechanism for each Cashier's terminal in order to protect Cashiers as well as hold them accountable for discrepancies in customer payments. DWS management needs to ensure support of and adherence to physical and application access control policies by providing employees with regular training and monitoring control activities. DWS management must also periodically review, assess, and evaluate control processes, policies, and procedures for their continued relevance, effectiveness, and efficiency in safeguarding assets. Criteria. Internal Control Criteria — Information System Audit and Control Association (ISACA) Security Policy. "The main goal of a corporate security policy is to protect data by defining procedures, guidelines and practices for configuring and managing security in the corporate environment. It is imperative that the policy defines the organization's philosophy and requirements for securing information assets. It is also important that the policy outlines how it will apply to corporate employees, processes and environments. Consequences for failed compliance must also be addressed." FINDING Control procedures relating to computer passwords and logins are not consistently formalized in writing or enforced in all offices of the Customer Service Branch. Finance Division managers have not adequately monitored or enforced the use of individual passwords or logins, and Customer Service Branch personnel have even acknowledged the sharing of passwords at one of the District offices. Auditors were told that passwords are being shared for certain logins at one District office, with the District supervisor and staff sharing the password to the Public Utility Billing System (PUBS) in the event personnel are out sick or on vacation. This practice is contrary to the purpose of passwords or logins; that is, the ability to secure system access and provide an audit trail of all activities conducted under assigned passwords or logins. Individual passwords and logins are a fundamental part of data security, monitoring, and control, and are basic to protecting data integrity by reducing the risks of unauthorized access and unauthorized transactions. RECOMMENDATION DWS management needs to enforce standard IT policy against the sharing of passwords and logins, and enforce standard accounting practices for using audit trails to scrutinize system entries when financial discrepancies are detected. In so doing, 33