2010-01-AU Limited Scope Performance Audit of Department of Water Supply's Internal Controls for Cash Handling and Financial IT Systems

Home

CHAPTER 4: CASH HANDLING SYSTEMS handling and financial IT system controls, including, but not limited to, the enforcement of Cash Can transfer procedures; prohibition against sharing of Iogins and passwords; and oversight and reconciliation of customer payment transactions by Finance Division managers. While the Finance Division's Revised Cashier Procedures dated January 14, 2010, includes the reconciliation of all reported cash transactions to the daily deposit by the Assistant Controller, they still do not ensure that reporting on all customer payment transactions at their first point of receipt is 100% complete, and this verification process is further complicated by the overlapping duties of various cash handling personnel and their multiple accesses to financial systems controls and authorizations as discussed above. RECOMMENDATION DWS management needs to complete a thorough process analysis of its Waimea and Kona District offices to assess the operational and financial risks related to the combined customer service and cashiering duties of its Customer Service Representatives and the cashiering duties assumed by its Meter Readers in the absence of Customer Service Representatives. DWS management also needs to complete a thorough process analysis of its Hilo office to assess the operational and financial risks related to the cashiering duties assumed by the Customer Service Supervisor and Assistant Supervisor in the absence of Cashiers. Based on these risk assessments, management must implement appropriate cost - effective preventive and detective controls, and /or develop improved control policies and procedures related to segregation of cash handling activities. If sufficient cost - effective controls cannot be implemented to reduce risk to acceptable levels within the current combined duties scenario, then management should at least designate or reallocate one position as primary Cashier in each of the Waimea and Kona District offices and require Finance Division managers to review transactional changes authorized by the Customer Service Supervisor and Assistant Supervisor. Criteria: Internal Control Criteria — Separation of Duties for Access Control Enforcement in Workflow Environments. "Separation of duty, as a security principle, has as its primary objective the prevention of fraud and errors. This objective is achieved by disseminating the tasks and associated privileges for a specific business process among multiple users... " 35