Laserfiche WebLink
County of Hawaii <br />State of Hawaii <br />Schedule of Findings and Questioned Costs <br />Year Ended June 30, 2013 <br />Section II — Financial Statement Findings <br />Finding No. 2013-001: Information Technology (Significant Deficiency) <br />Condition <br />Information technology ("IT") is a strategic element of the operations of the County of Hawaii (the <br />"County") and the Department of Water Supply (the "Department"), a component unit of the County. <br />Because of the high volume of transactions at the County and the Department, the establishment of <br />internal controls over processes incorporating IT is critical to its operations. As part of our financial <br />statement audits for the year ended June 30, 2013, we performed IT general controls reviews of the <br />following systems operated by the County and the Department: <br />County <br />• Windows Domain <br />• Eden <br />• Integrated Assessment System <br />• Revenue Collection <br />Department <br />• Windows Domain <br />• Select Financial System <br />• Public Utility Billing System <br />• ARB N_Sight Mobile System <br />Our review resulted in several IT control deficiencies in the areas of physical and logical security, change <br />management, and IT operations as follows: <br />Physical and logical security <br />• Lack of formal security administration policies and procedures addressing: <br />o New, transferred and terminated user account administration <br />o Maintenance of audit evidence to support approval of employee access to the system <br />o Identification of terminated employees who continue to have access to the system <br />o Identification of employees whose access to system resources are not commensurate <br />with theirjob responsibilities <br />o Minimum password security settings <br />o Network security reviews <br />o Minimum environmental security requirements <br />o Physical access to the servers <br />• Weak password security settings or the lack of system functionality to enforce strong password <br />policies for certain applications. <br />• System databases are not appropriately restricted and monitored for unauthorized changes. <br />• Appropriate user access reviews are not performed for certain applications and security groups. <br />Change management <br />• Lack of a formalized change management process for certain applications and firewall configuration <br />settings. <br />• Lack of segregation of duties for developers and security administrators. <br />IT Operations <br />• Test restorations not performed. <br />21 <br />