Laserfiche WebLink
County of Hawaii <br />State of Hawaii <br />Schedule of Findings and Questioned Costs <br />Year Ended June 30, 2013 <br />Criteria <br />When IT is used to initiate, record, process, and report on transactions included in the financial <br />statements, the systems and related processes should include internal controls to prevent or detect <br />potential misstatements. <br />Effect <br />Internal controls in the following areas address the following risks: <br />Physical and logical security <br />Unauthorized access to these systems could result in either the destruction or theft of data, unauthorized <br />or nonexistent transactions being made or transactions being inaccurately recorded. <br />Change management <br />Unauthorized or untested changes promoted to the production environment could cause the systems <br />to either process data differently than intended or unexpectedly compromise the integrity of the data <br />maintained. <br />IT Operations <br />Lack of restoration testing could result in the inability to recover from data loss, corruption, or data <br />integrity concerns. <br />Causes <br />The primary cause of the internal control deficiencies identified was due to the lack of IT policies and <br />procedures which include internal controls to address the IT risks discussed above. <br />Recommendation <br />We recommend that the County perform the following: <br />• Develop and implement IT policies and procedures to include internal control procedures addressing <br />the IT risks above. <br />• Indentify procedures to ensure that IT policies and procedures are consistently followed. <br />• Implement change management detective controls. <br />• Perform annual test restoration exercises. <br />22 <br />