Single Audit of Federal Financial Assistance Programs for Fiscal Year 2015 - 2016

Home

County of Hawaii, State of Hawaii SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Fiscal Year Ended June 30, 2016 SECTION II - FINANCIAL STATEMENT FINDINGS Ref. No. Internal Control Findings 2016-001 Physical Security - Significant Deficiency Criteria: Physical access to servers and other sensitive areas is appropriately restricted to authorized personnel. Devices are used to secure sensitive equipment and storage media from the risk of damage from fire. Condition: At June 30, 2016, the servers for the County's accounting system were located in a room at the Civil Defense Center (Center). We noted the following conditions: • The door to the room housing these servers is left open due to cooling concerns. Anyone with access to the Center could potentially access the server room. • A fire suppression system was not installed. Cause: The County has not formally documented policies and procedures over the physical security of IT systems at the Center nor effectively designed these controls. Effect: Unauthorized access to the server room could result in unauthorized use, modification, damage or loss of data. The absence of a fire suppression system could increase the likelihood of the loss or destruction of data due to fire. Identification as a Repeat Finding: See finding 2015-002 included in the Summary Schedule of Prior Audit Findings. Recommendation We recommend that the County develop formal policies over the physical security of IT systems at the Center and to implement them. The server room should be locked and access to keys or codes should be limited to authorized personnel. A fire suppression system should be installed to prevent or limit the loss of data from fire. Views of Responsible Officials and Planned Corrective Action The County agrees with certain parts of the finding and the recommendation. See Part IV Corrective Action Plan. SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS No matters reported. K4