Loading...
HomeMy WebLinkAbout2014-COH - Single Audit of Federal Financial Assistance ProgramsDru Mamo Kanuha Bonnie S. Nims, CGAP Chair & Presiding Officer oo��g ��'a Legislative Auditor Council District 7 Business Address °1 r` qT 1266 Kamehameha Avenue E OF'� Suite A-8 Gunt of pubju-11 Hilo, Hmvai'i 96720 OFFICE OF THE LEGISLATIVE AUDITOR 25 Aupuni Street Hilo, Hawaii 96720 * (808) 961-8386 * Fax (808) 961-8905 website: http://hawaiicountv.Qov e-mail: publiclaoaco.hawaii.hi.us Gi March 25, 2015 C n TO: Dru Kanuha, Chairman And Members of the County Council rn D� FROM: Bonnie S. Nims Legislative Auditor RE: Post -Audit Reports for Fiscal Year Ending June 30, 2014 This letter transmits for your review, deliberation, and acceptance, the Comprehensive Annual Financial Report for the Fiscal Year Ended June 30, 2014, as prepared by the County of Hawai `i Department of Finance and Single Audit of Federal Financial Assistance Program for the Fiscal Year Ended June 30, 2014, as prepared by external auditor, N&K CPAs Inc. Pursuant to the 2012 Hawaii County Charter, Section 10-13, Post -audit, which requires the county council to provide at least once every year for an independent audit of the accounts and other evidences of financial transactions of the county and of every county agency and executive agency and performed by a certified public accountant or firm of certified public accountants who have no personal interest, direct or indirect, in the fiscal affairs of the county or of any of its agencies or executive agencies. N&K CPAs Inc. will be present at the Hawaii County Council Finance Committee meeting on April 14, 2015 for a short presentation and to answer any questions you may have. Appropriate department head(s) or their representative(s) will also be asked to attend the meeting. In the meantime, please feel free to contact me at 961-8490 should you require further information. Enclosures cc w/o enclosures: N&K CPAs Inc. Department of Finance BSN/lhs Comm. No. 3 Ref. To: Hawaii County is an Equal Opportunity Provider and Employer Ref. Date MAR 2 5 2015 ;A: N&K CPAs, Inc. ACCOUNTANTS; CCNSUi CANTS To the Chair and Members of the County Council County of Hawai'i AMERICAN SAVINGS BANK TOWER 1001 BISHOP STREET, SUITE 1700 HONOLULU, HAWAII 96813-3696 T (808) 524-2255 F (808) 523-2090 We have audited the financial statements of the governmental activities, the business -type activities, the discretely presented component unit, each major fund, and the aggregate remaining fund information of the County of Hawaii, State of Hawaii (County), as of and for the fiscal year ended June 30, 2014. Professional standards require that we provide you with information about our responsibilities under generally accepted auditing standards, Government Auditing Standards and OMB Circular A-133, as well as certain information related to the planned scope and timing of our audit. We have communicated such information in our letter to you dated August 25, 2014. Professional standards also require that we communicate to you the following information related to our audit. Significant Audit Findings Qualitative Aspects of Accountinq Practices Management is responsible for the selection and use of appropriate accounting policies. The significant accounting policies used by the County are described in Note 1 to the financial statements. The County adopted the provisions of Government Accounting Standards Board (GASB) Statement No. 65 Items Previously Reported as Assets and Liabilities. We noted no transactions entered into by the governmental unit during the year for which there is a lack of authoritative guidance or consensus. All significant transactions have been recognized in the financial statements in the proper period. Accounting estimates are an integral part of the financial statements prepared by management and are based on management's knowledge and experience about past and current events and assumptions about future events. Certain accounting estimates are particularly sensitive because of their significance to the financial statements and because of the possibility that future events affecting them may differ significantly from those expected. The most sensitive estimates affecting the County's financial statements were: • Estimate of the useful lives of the County's capital assets used to compute depreciation expense • Estimate of the liability for postretirement benefits other than pensions • Estimate of the loss reserves for workers' compensation • Estimate of the landfill closure and postclosure cost liability Management's estimate of the depreciation recorded on capital assets is based in part on the estimated useful lives of those capital assets. We evaluated the key factors and assumptions used to develop the estimated useful lives used to depreciate the County's capital assets in determining that it is reasonable in relation to the financial statements taken as a whole. Management's estimate of the liability for postretirement benefits other than pensions was determined using an actuarial valuation study performed by a third -party specialist. We evaluated the N&K CPAs, Inc. A, CO,-,NTA^75 4 �cwSuLra,%T key factors and assumptions used to compute the liability for postretirement benefits other than pensions in determining that it is reasonable in relation to the financial statements taken as a whole. Management's estimate of the loss reserve for workers' compensation was determined by senior adjusters and adjusted as necessary based on historical costs for similar incidents. We evaluated the key factors and assumptions used to compute the loss reserve in determining that it is reasonable in relation to the financial statements taken as a whole. Management's estimate of the landfill closure and postclosure cost liability was determined by the County's engineers and the third party contractor. We evaluated the key factors and assumptions used to develop the liability in determining that it is reasonable in relation to the financial statements taken as a whole. The financial statement disclosures are neutral, consistent, and clear. Difficulties Encountered in Performing the Audit We encountered no significant difficulties in dealing with management in performing and completing our audit. Corrected and Uncorrected Misstatements Professional standards require us to accumulate all known and likely misstatements identified during the audit, other than those that are trivial, and communicate them to the appropriate level of management. Management has corrected all such misstatements. In addition, none of the misstatements detected as a result of audit procedures and corrected by management were material, either individually or in the aggregate, to each opinion unit's financial statements taken as a whole. Disagreements with Management For purposes of this letter, professional standards define a disagreement with management as a financial accounting, reporting, or auditing matter, whether or not resolved to our satisfaction, that could be significant to the financial statements or the auditors' report. We are pleased to report that no such disagreements arose during the course of our audit. Management Representations We have requested certain representations from management that are included in the management representation letter dated January 12, 2015. Management Consultations with Other Independent Accountants In some cases, management may decide to consult with other accountants about auditing and accounting matters, similar to obtaining a "second opinion" on certain situations. If a consultation involves application of an accounting principle to the governmental unit's financial statements or a determination of the type of auditors' opinion that may be expressed on those statements, our professional standards require the consulting accountant to check with us to determine that the consultant has all the relevant facts. To our knowledge, there were no such consultations with other accountants. Other Audit Findings or Issues We generally discuss a variety of matters, including the application of accounting principles and auditing standards, with management each year prior to retention as the governmental unit's auditors. However, these discussions occurred in the normal course of our professional relationship and our responses were not a condition to our retention. N&K CPAs, Inc. A,. ,E ti a ,T CONS'J[TXNTS Other Matters We applied certain limited procedures to Management's Discussion and Analysis (MD&A) and the Schedule of Funding Progress for the EUTF Health Plan, which are required supplementary information (RSI) that supplements the basic financial statements. Our procedures consisted of inquiries of management regarding the methods of preparing the information and comparing the information for consistency with management's responses to our inquiries, the basic financial statements, and other knowledge we obtained during our audit of the basic financial statements. We did not audit the RSI and do not express an opinion or provide any assurance on the RSI. We were engaged to report on Combining and Individual Nonmajor Fund Financial Statements and Fund Schedules as well as Schedules of Revenues, Expenditures, and Changes in Fund Balance — Budget and Actual, which accompany the financial statements but are not RSI. With respect to this supplementary information, we made certain inquiries of management and evaluated the form, content, and methods of preparing the information to determine that the information complies with accounting principles generally accepted in the United States of America, the method of preparing it has not changed from the prior period, and the information is appropriate and complete in relation to our audit of the financial statements. We compared and reconciled the supplementary information to the underlying accounting records used to prepare the financial statements or to the financial statements themselves. We were not engaged to report on the Statistics, which accompany the financial statements but are not RSI. We did not audit or perform other procedures on this other information and we do not express an opinion or provide any assurance on it. Restriction on Use This information is intended solely for the use of the Chair and Members of the County Council and management of the County of Hawaii and is not intended to be and should not be used by anyone other than these specified parties. l�(✓K CGAs, TNc. Honolulu, Hawaii January 12, 2015 COUNTY OF HAWAII STATE OF HAWAII SINGLE AUDIT OF FEDERAL FINANCIAL ASSISTANCE PROGRAMS Fiscal Year Ended June 30, 2014 AMERICAN SAVINGS BANK TOWER I 1001 BISHOP STREET, SUITE 17001 HONOLULU, HAWAII 96813-3696 T (808) 524-2255 F (808) 523-2090 1 nkcpa.com a N&K CPAs, Inc. ACCOUNTANTS I CONSULTANTS March 20, 2015 To the Chair and Members of the County Council County of Hawaii AMERICAN SAVINGS BANK TOWER 1001 BISHOP STREET, SUITE 1700 HONOLULU, HAWAII 96813-3696 T (808) 524-2255 F (808) 523-2090 We have completed our financial audit of the basic financial statements of the County of Hawaii, State of Hawaii (the County), as of and for the fiscal year ended June 30, 2014. Our report containing our opinions on those basic financial statements is included in the County's Comprehensive Annual Financial Report. We have also audited the County's compliance with requirements applicable to its major federal financial assistance programs. We submit herein our reports on the County's internal control over financial reporting and compliance, the County's compliance with requirements that could have a direct and material effect on each of its major federal programs, the County's schedule of expenditures of federal awards, and the schedule of findings and questioned costs. OBJECTIVES OF THE AUDIT The primary purpose of our audit was to form an opinion on the fairness of the presentation of the County's basic financial statements as of and for the fiscal year ended June 30, 2014, and to comply with the requirements of the Office of Management and Budget (OMB) Circular A-133, Audits of States, Local Governments, and Non -Profit Organizations, which establishes audit requirements for state and local governments that receive federal financial assistance. More specifically, the objectives of the audit were as follows: 1. To provide opinions on the fair presentation of the County's basic financial statements and the schedule of expenditures of federal awards as of and for the fiscal year ended June 30, 2014 in accordance with accounting principles generally accepted in the United states of America. 2. To determine whether expenditures and other disbursements have been made and all revenues and other receipts to which the County is entitled have been collected and accounted for in accordance with the laws, rules and regulations, administrative directives, policies and procedures of the County, the State of Hawaii and the federal government (where applicable). 3. To determine whether the County has established sufficient internal controls to properly manage federal financial assistance programs and to comply with the applicable laws, regulations, contracts, and grants. 4. To determine whether the County has complied with the laws, regulations, contracts, and grants that may have a direct and material effect on the financial statements and on each major federal financial assistance program. 2 N&K CPAs, Inc. ACCOUNTANTS I CONSULTANTS SCOPE OF THE AUDIT Our audit was performed in accordance with auditing standards generally accepted in the United States of America as prescribed by the American Institute of Certified Public Accountants; Government Auditing Standards, issued by the Comptroller General of the United States; and the provisions of OMB Circular A-133. The scope of our audit included an examination of the transactions and accounting records of the County for the fiscal year ended June 30, 2014. ORGANIZATION OF THE REPORT This report is presented in five parts as follows: • Part I - Our report on internal control over financial reporting and on compliance and other matters. • Part II - Our report on compliance with requirements that could have a direct and material effect on each major program and on internal control over compliance, and report on the schedule of expenditures of federal awards. • Part III - The schedule of findings and questioned costs. • Part IV - The summary schedule of prior audit findings. • Part V - The corrective action plan. We wish to express our sincere appreciation for the excellent cooperation and assistance extended by the staff of the County. Sincerely, N&K CPAs, INC. Chad Funasaki Principal 3 COUNTY OF HAWAII, STATE OF HAWAII TABLE OF CONTENTS Page PART I REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING AND ON COMPLIANCE AND OTHER MATTERS Report on Internal Control over Financial Reporting and on Compliance and Other Matters Based on an Audit of Financial Statements Performed in Accordance with Government Auditing Standards 6-7 PART II REPORT ON COMPLIANCE FOR EACH MAJOR FEDERAL PROGRAM; REPORT ON INTERNAL CONTROL OVER COMPLIANCE; AND REPORT ON THE SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS REQUIRED BY OMB CIRCULAR A-133 Report on Compliance on Each Major Federal Program; Report on Internal Control over Compliance; and Report on the Schedule of Expenditures of Federal Awards Required by OMB Circular A-1 33 9-11 Schedule of Expenditures of Federal Awards 12-20 Notes to Schedule of Expenditures of Federal Awards 21 -22 PART III SCHEDULE OF FINDINGS AND QUESTIONED COSTS 24-29 PART IV SUMMARY SCHEDULE OF PRIOR AUDIT FINDINGS Status Report 31 -32 PART V CORRECTIVE ACTION PLAN Response of County of Hawaii 34-36 M PART I REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING AND ON COMPLIANCE AND OTHER MATTERS ki ii4 ki N&K CPAs, Inc. ACCOUNTANTS I CONSULTANTS AMERICAN SAVINGS BANK TOWER 1001 BISHOP STREET, SUITE 1700 HONOLULU, HAWAII 96813-3696 T (808) 524-2255 F (808) 523-2090 REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING AND ON COMPLIANCE AND OTHER MATTERS BASED ON AN AUDIT OF FINANCIAL STATEMENTS PERFORMED IN ACCORDANCE WITH GOVERNMENT AUDITING STANDARDS INDEPENDENT AUDITOR'S REPORT To the Chair and Members of the County Council County of Hawaii We have audited, in accordance with the auditing standards generally accepted in the United States of America and the standards applicable to financial audits contained in Government Auditing Standards issued by the Comptroller General of the United States, the financial statements of the governmental activities, the business -type activities, the discretely presented component unit, each major fund, and the aggregate remaining fund information of the County of Hawai°i, State of Hawaii (the County), as of and for the fiscal year ended June 30, 2014, and the related notes to the financial statements, which collectively comprise the County's basic financial statements and have issued our report thereon dated January 12, 2015. Internal Control Over Financial Reporting In planning and performing our audit of the financial statements, we considered the County's internal control over financial reporting (internal control) to determine the audit procedures that are appropriate in the circumstances for the purpose of expressing our opinions on the financial statements, but not for the purpose of expressing an opinion on the effectiveness of the County's internal control. Accordingly, we do not express an opinion on the effectiveness of the County's internal control. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented, or detected and corrected on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. N&K CPAs, Inc. ACCOUNTANTS I CONSULTANTS Our consideration of internal control was for the limited purpose described in the first paragraph of this section and was not designed to identify all deficiencies in internal control that might be material weaknesses or significant deficiencies and therefore, material weaknesses or significant deficiencies may exist that were not identified. Given these limitations, during our audit we did not identify any deficiencies in internal control that we consider to be material weaknesses. We did identify certain deficiencies in internal control, described in the accompanying schedule of findings and questioned costs as items 2014-001 through 2014-003 that we consider to be significant deficiencies. Compliance and Other Matters As part of obtaining reasonable assurance about whether the County's financial statements are free from material misstatement, we performed tests of its compliance with certain provisions of laws, regulations, contracts, and grant agreements, noncompliance with which could have a direct and material effect on the determination of financial statement amounts. However, providing an opinion on compliance with those provisions was not an objective of our audit, and accordingly, we do not express such an opinion. The results of our tests disclosed no instances of noncompliance or other matters that are required to be reported under Government Auditing Standards. County's Response to Findings The County's response to the findings identified in our audit is described in Part V, Corrective Action Plan of this report. The County's response was not subjected to the auditing procedures applied in the audit of the financial statements and, accordingly, we express no opinion on it. Purpose of this Report The purpose of this report is solely to describe the scope of our testing of internal control and compliance and the results of that testing, and not to provide an opinion on the effectiveness of the entity's internal control or on compliance. This report is an integral part of an audit performed in accordance with Government Auditing Standards in considering the entity's internal control and compliance. Accordingly, this communication is not suitable for any other purpose. Honolulu, Hawaii January 12, 2015 7 PART II REPORT ON COMPLIANCE FOR EACH MAJOR FEDERAL PROGRAM; REPORT ON INTERNAL CONTROL OVER COMPLIANCE; AND REPORT ON THE SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS REQUIRED BY OMB CIRCULAR A-133 ki ii4 ki N&K CPAs, Inc. ACCOUNTANTS I CONSULTANTS AMERICAN SAVINGS BANK TOWER 1001 BISHOP STREET, SUITE 1700 HONOLULU, HAWAII 96813-3696 T (808) 524-2255 F (808) 523-2090 REPORT ON COMPLIANCE FOR EACH MAJOR FEDERAL PROGRAM; REPORT ON INTERNAL CONTROL OVER COMPLIANCE; AND REPORT ON THE SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS REQUIRED BY OMB CIRCULAR A-133 INDEPENDENT AUDITOR'S REPORT To the Chair and Members of the County Council County of Hawaii Report on Compliance for Each Major Federal Program We have audited the County of Hawaii, State of Hawai°i's (the County) compliance with the types of compliance requirements described in the OMB Circular A-133 Compliance Supplement that could have a direct and material effect on each of the County's major federal programs for the fiscal year ended June 30, 2014. The County's major federal programs are identified in the summary of auditor's results section of the accompanying schedule of findings and questioned costs. Management's Responsibility The County's management is responsible for compliance with the requirements of laws, regulations, contracts, and grants applicable to its federal programs. Auditor's Responsibility Our responsibility is to express an opinion on compliance for each of the County's major federal programs based on our audit of the types of compliance requirements referred to above. We conducted our audit of compliance in accordance with auditing standards generally accepted in the United States of America; the standards applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller General of the United States; and OMB Circular A-133, Audits of States, Local Governments, and Non -Profit Organizations. Those standards and OMB Circular A-133 require that we plan and perform the audit to obtain reasonable assurance about whether noncompliance with the types of compliance requirements referred to above that could have a direct and material effect on a major federal program occurred. An audit includes examining, on a test basis, evidence about the County's compliance with those requirements and performing such other procedures as we considered necessary in the circumstances. 9 N&K CPAs, Inc. ACCOUNTANTS I CONSULTANTS We believe that our audit provides a reasonable basis for our opinion on compliance for each major federal program. However, our audit does not provide a legal determination of the County's compliance. Opinion on Each Major Federal Program In our opinion, the County complied, in all material respects, with the compliance requirements referred to above that could have a direct and material effect on each of its major federal programs for the fiscal year ended June 30, 2014. Report on Internal Control Over Compliance Management of the County is responsible for establishing and maintaining effective internal control over compliance with the types of compliance requirements referred to above. In planning and performing our audit of compliance, we considered the County's internal control over compliance with the types of requirements that could have a direct and material effect on each major federal program to determine the auditing procedures that are appropriate in the circumstances for the purpose of expressing an opinion on compliance for each major federal program and to test and report on internal control over compliance in accordance with OMB Circular A-133, but not for the purpose of expressing an opinion on the effectiveness of internal control over compliance. Accordingly, we do not express an opinion on the effectiveness of the County's internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a type of compliance requirement of a federal program will not be prevented, or detected and corrected, on a timely basis. A significant deficiency in internal controls over compliance is a deficiency, or combination of deficiencies, in internal control over compliance with a type of compliance requirement of a federal program that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this section and was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. We did not identify any deficiencies in internal control over compliance that we consider to be material weaknesses. However, material weaknesses may exist that have not been identified. 10 N&K CPAs, Inc. ACCOUNTANTS I CONSULTANTS The purpose of this report on internal control over compliance is solely to describe the scope of our testing of internal control over compliance and the results of that testing based on the requirements of OMB Circular A-133. Accordingly, this report is not suitable for any other purpose. Report on Schedule of Expenditures of Federal Awards Required by OMB Circular A-133 We have audited the financial statements of the governmental activities, the business - type activities, the discretely presented component unit, each major fund, and the aggregate remaining fund information of the County as of and for the fiscal year ended June 30, 2014, and the related notes to the financial statements, which collectively comprise the County's basic financial statements. We issued our report thereon dated January 12, 2015, which contained unmodified opinions on those financial statements. Our audit was conducted for the purpose of forming opinions on the financial statements that collectively comprise the County's basic financial statements. The accompanying schedule of expenditures of federal awards is presented for purposes of additional analysis as required by OMB Circular A-133 and is not a required part of the basic financial statements. Such information is the responsibility of management and was derived from and relates directly to the underlying accounting and other records used to prepare the basic financial statements. The information has been subjected to the auditing procedures applied in the audit of the basic financial statements and certain additional procedures, including comparing and reconciling such information directly to the underlying accounting and other records used to prepare the basic financial statements or to the basic financial statements themselves, and other additional procedures in accordance with auditing standards generally accepted in the United States of America. In our opinion, the schedule of expenditures of federal awards is fairly stated in all material respects in relation to the basic financial statements as a whole. Honolulu, Hawaii March 20, 2015 11 County of Hawaii, State of Hawaii SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS Fiscal Year Ended June 30, 2014 CFDA Grant Federal Grantor/Pass-through Grantor/Title Number Project Number U.S. DEPARTMENT OF AGRICULTURE Food and Nutrition Service Passed through the State Department of Education: Summer Food Service Program for Children 10.559 N/A Rural Utilities Service Water and Waste Disposal Systems for Rural Communities 10.760 61-001-869653225 Rural Housing Service Community Facilities Loans and Grants 10.766 61-001-777827486 TOTAL U.S. DEPARTMENT OF AGRICULTURE U.S. DEPARTMENT OF COMMERCE National Oceanic and Atmospheric Administration Passed through the State Department of Business, Economic Development and Tourism: Coastal Zone Management Administration Awards: 11.419 TOTAL U.S. DEPARTMENT OF COMMERCE Federal Program Federal Award Amount Expenditures 59,174 $ 51,402 1,522,369 448,669 35,200 35,200 535,271 NA170Z2333 218,685 5,629 NA09NOS4190120 258,754 4,531 NA10NOS4190180 265,358 264 NA12NOS4190097 299,567 13,209 NA13NOS4190055 303,019 288,284 U.S. DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT Office of Housing Section 8 - Housing Assistance Payments Program - Special Allocations: 14.195 Kulaimano Elderly Housing HI 10 0002001 Community Planning and Development CDBG - State -Administered Small Cities Program Cluster Community Development Block Grant/State's Program and Non -Entitlement Grants in Hawai'i 12 14.228 B -11 -DH -15-0002 B -12 -DH -15-0002 B -13 -DH -15-0002 Program Income 311,917 254,457 127,119 2,532,287 553,884 2,520,236 2,520,236 2,627,655 129,536 $ 126,339 County of Hawaii, State of Hawaii SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (Continued) Fiscal Year Ended June 30, 2014 13 CFDA Grant Federal Program Federal Federal Grantor/Pass-through Grantor/Title Number Project Number Award Amount Expenditures Passed through the Hawaii Housing Finance and Development Corporation: Neighborhood Stabilization Program B -11 -DN -15-0001 4,275,000 $ 15,367 Subtotal CFDA 14.228 3,345,362 Passed through the Hawaii Housing Finance and Development Corporation: HOME Investment Partnerships Program 14.239 M11 -SG -150100 2,025,642 1,294,041 M12 -SG -150100 3,319,441 1,052,062 Program Income 25,830 Subtotal CFDA 14.239 2,371,933 Economic Development Initiative - Special Purpose Grant 14.251 B -06 -SP -HI -0273 198,000 166 Public and Indian Housing Section 8 - Housing Choice Vouchers 14.871 HI002VO 2012 14,511,613 1,036,859 H1002VO2013 12,289,176 5,502,609 H1002AF 2013 1,253,855 795,460 H1002VO2014 13,266,188 6,346,249 H1002AF 2014 1,259,839 228,171 Program Income 1,220,838 Section 8 - Housing Choice Vouchers Family Self Sufficiency Program H 100 FS F006 66,204 3,123 H 100 FS F007 66,204 5,544 H 100 FS F008 66,204 38,147 H 100 FS F009 65,090 19,208 Subtotal CFDA 14.871 15,196,208 TOTAL U.S. DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT 21,040,788 U.S. DEPARTMENT OF THE INTERIOR Payment in Lieu of Taxes 15.226 National Park In Lieu of Taxes N/A 317,970 317,970 U.S. Fish and Wildlife Service Wildlife In Lieu of Taxes 15.659 N/A 50,099 50,099 TOTAL U.S. DEPARTMENT OF THE INTERIOR $ 368,069 13 County of Hawaii, State of Hawaii SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (Continued) Fiscal Year Ended June 30, 2014 Passed through the State Department of the Attorney General: Part E- Development, Testing and Demonstrating Promising New Programs Office for Victims of Crime Passed through the State Department of the Attorney General: Crime Victim Assistance 16.541 MOA-JJIS-11-01 16.575 Subtotal CFDA 16.575 Bureau of Justice Assistance JAG Program Cluster Edward Byrne Memorial Justice Assistance Grant Program: 16.738 Justice Assistance Grant Passed through the State Department of Attorney General: Hawaii Narcotics Task Force Elder Abuse and Exploitation Program Subtotal CFDA 16.738 Violence Against Women Office Passed through the State Department of Attorney General: Violence Against Woman Formula Grants: STOP Violence Against Women STOP Violence Against Women Specialized Investigative Training Sexual Assault Forensic Examiners Standby Pay Basic Needs to Improve Forensic SAFE Coordinator Police Detectives Subtotal CFDA 16.588 14 16.588 10 -VA -04 11 -VA -04 2010 -DJ -BX -0336 2012 -DJ -BX -1226 10 -DJ -13 10 -DJ -01 12 -DJ -02 11 -WF -12 12 -WF -11 09 -WF -14 11 -WF -03 12 -CD -02 13 -CD -01 10 -WF -15 11 -DJ -10 25,000 25,000 366,664 359,721 193,772 240,249 434,021 123,121 87,724 88,650 16,714 75,000 17,139 188,086 77,866 42,210 34,746 52,061 52,353 17,869 52,061 26,048 26,830 52,068 65,200 234,189 52,061 8,685 17,779 32,207 22,510 5,965 25,985 19,248 $ 184,440 CFDA Grant Federal Program Federal Federal Grantor/Pass-through Grantor/Title Number Project Number Award Amount Expenditures U.S. DEPARTMENT OF JUSTICE Office of Juvenile Justice and Delinquency Prevention Passed through the State Department of Human Services: Juvenile Accountability Incentive Block Grant 16.523 2011 -JB -FX -0059 62,214 $ 62,214 Passed through the State Department of Human Services: Juvenile Justice and Delinquency Prevention - Allocation to States 16.540 2009 -JF -FX -8003 200,000 129,470 2009 -JF -FX -8003 200,000 102,561 Subtotal CFDA 16.540 232,031 Passed through the State Department of the Attorney General: Part E- Development, Testing and Demonstrating Promising New Programs Office for Victims of Crime Passed through the State Department of the Attorney General: Crime Victim Assistance 16.541 MOA-JJIS-11-01 16.575 Subtotal CFDA 16.575 Bureau of Justice Assistance JAG Program Cluster Edward Byrne Memorial Justice Assistance Grant Program: 16.738 Justice Assistance Grant Passed through the State Department of Attorney General: Hawaii Narcotics Task Force Elder Abuse and Exploitation Program Subtotal CFDA 16.738 Violence Against Women Office Passed through the State Department of Attorney General: Violence Against Woman Formula Grants: STOP Violence Against Women STOP Violence Against Women Specialized Investigative Training Sexual Assault Forensic Examiners Standby Pay Basic Needs to Improve Forensic SAFE Coordinator Police Detectives Subtotal CFDA 16.588 14 16.588 10 -VA -04 11 -VA -04 2010 -DJ -BX -0336 2012 -DJ -BX -1226 10 -DJ -13 10 -DJ -01 12 -DJ -02 11 -WF -12 12 -WF -11 09 -WF -14 11 -WF -03 12 -CD -02 13 -CD -01 10 -WF -15 11 -DJ -10 25,000 25,000 366,664 359,721 193,772 240,249 434,021 123,121 87,724 88,650 16,714 75,000 17,139 188,086 77,866 42,210 34,746 52,061 52,353 17,869 52,061 26,048 26,830 52,068 65,200 234,189 52,061 8,685 17,779 32,207 22,510 5,965 25,985 19,248 $ 184,440 County of Hawaii, State of Hawaii SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (Continued) Fiscal Year Ended June 30, 2014 CFDA Federal Grantor/Pass-through Grantor/Title Number Office of Community Oriented Policing Services Public Safety Partnership and Community Policing Grants: 16.710 COPS Drug Enforcement Administration Drug Forfeitures 2014 16.000 TOTAL U.S. DEPARTMENT OF JUSTICE U.S. DEPARTMENT OF LABOR Employment and Training Administration Passed through the State Department of Labor and Industrial Kelations: Senior Community Service Employment Program WIA Cluster WIA Adult Program Subtotal CFDA 17.258 WIA Youth Activities Subtotal CFDA 17.259 WIA Dislocated Workers Subtotal CFDA 17.278 Subtotal WIA Cluster TOTAL U.S. DEPARTMENT OF LABOR 15 Grant Federal Program Federal Project Number Award Amount Expenditures 346,499 17.258 AA -22391-12-55-A-15 2011 U LWX0013 1,392,336 $ 333,450 2014 6,951 6,951 AA -24088-13-55-A-15 1,512,296 17.235 AD -24145-13-55-A-15 356,724 346,499 17.258 AA -22391-12-55-A-15 615,333 115,508 AA -24088-13-55-A-15 527,223 297,334 412,842 17.259 AA -22391-12-55-A-15 517,032 156,765 AA -24088-13-55-A-15 496,689 298,836 455,601 17.278 AA -22391-12-55-A-15 488,867 113,358 AA -24088-13-55-A-15 352,914 260,664 374,022 1,242,465 $ 1,588,964 County of Hawaii, State of Hawaii SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (Continued) Fiscal Year Ended June 30, 2014 W. CFDA Grant Federal Program Federal Federal Grantor/Pass-through Grantor/Title Number Project Number Award Amount Expenditures U.S. DEPARTMENT OF TRANSPORTATION Federal Highway Administration Passed through the State Department of Transportation: Highway Planning and Construction: 20.205 Old Mamalahoa Hwy, Kaahakini Bridge Replacement BR -0100(44) 114,400 $ 842 Reeds Island Bridge Replacement on Kaiulani Street in Hilo BR -0100(47) 6,932,169 4,662,083 Bridge Inspection/Appraisals BR-NBIS(52) 80,000 7,008 BR-NBIS(55) 80,000 434 Mamalahoa Highway Earthquake Repairs MP4.4, MP8.9; Palani Road Pedestrian Overpass Repairs ER -15(9) 4,264,123 131 Mamalahoa Hwy, Widening, Mana Road NH -019-1(044) 696,000 9,836 Alii Drive ROW RS -0187(1) 3,127,200 69 Alii Drive ROW RS -0187(4) 6,564,594 30,355 Waimea Trails & Greenways STP -0100(51) 313,644 4,144 Kuakini Highway Improvements, Hualalai to Alii Highway STP -0110(2) 24,000 331 Alii Drive Culvert Replacement STP -0186(1) 430,885 71,453 Alii Drive Improvements, Hualalai to Walua STP -0186(2) 372,800 14,122 Kaiminani Drive Roadway Imp, Mamalahoa Hwy to Ahiahi St. STP -0198(1) 9,434,330 2,547,633 Kaiminani Drive Roadway Imp, Ahiahi St. to vicinity of Ane Keohokalole Hwy STP -0198(2) 16,126,147 5,244 Kamehameha Avenue Resurfacing, Wailoa Bridge to Ponohawai Street STP -1910(1) 12,842,182 1,585,367 Puainako Street Extension, Komohana St. to Country Club Rd. STP -2000(4) 26,886,000 565 Waianuenue Ave Imp, Rainbow Dr. to Akolea Rd. STP -2720(001) 280,000 2,142 Kawailani Street Improvements, Iwalani to Pohakulani Street STP -2760(2) 1,453,564 18,042 Manono St. Improv, Lanikaula to Kekuanaoa STP -2770(004) 496,000 127,388 ARRA - Ane Keohokalole Highway ARRA-1880 (1) 35,515,615 1,318,610 Subtotal CFDA 20.205 10,405,799 Federal Transit Administration Passed through the State Department of Transportation: Federal Transit - Capital Investment Grants 20.500 (5309 Capital Grant) HI -04-004 2,152,133 95,491 HI -04-007 1,000,000 860,000 Subtotal CFDA 20.500 955,491 Passed through the State Department of Transportation: Formula Grants for Rural Areas 20.509 HI -18-30 595,843 204,270 Rural Transit Assistance Program HI -18-27 20,940 6,315 HI -18-29 10,795 288 Subtotal CFDA 20.509 $ 210,873 W. County of Hawaii, State of Hawaii SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (Continued) Fiscal Year Ended June 30, 2014 CFDA Federal Grantor/Pass-through Grantor/Title Number National Highway Traffic Safety Administration Passed through the State Department of Transportation: State and Community Highway Safety: 20.600 Prosecutor's Training Roadblock Program Youth Deterrence Seatbelt Enforcement Click It or Ticket Speed Enforcement Aggressive Driving Project Traffic Investigation Program Data Grant Distracted Driving Subtotal CFDA 20.600 TOTAL U.S. DEPARTMENT OF TRANSPORTATION Grant Federal Program Federal Project Number Award Amount Expenditures AL13-02(03-S-01) 102,000 $ 60,809 AL14-02(03-S-01) 101,390 6,451 AL13-02(01-H-02) 168,425 48,096 AL14-02(01-H-02) 212,305 139,333 AL13-02(16-H-02) 22,956 10,322 Flex 2014 -Project 2 22,956 5,450 OP13-05(01-H-02) 72,000 2,611 OP14-05(01-H-02) 85,000 40,675 OP13-05(02-H-01) 18,935 11,940 OP14-05(02-H-01) 18,000 11,964 SC13-06(01-H-02) 101,041 16,494 SC14-06(01-H-02) 81,603 45,829 Flex 2013 -Project #2 48,112 13,326 Flex 2014 -Project #1 56,112 27,646 PT14-01(02-H-01) 84,000 937 TR13-03(05-H-01) 126,000 27,694 TR14-03(04-H-01) 134,500 4,423 DD13-10(02-H-01) 37,917 14,722 DD14-10(02-H-01) 50,000 23,326 U.S. ENVIRONMENTAL PROTECTION AGENCY Office of the Chief Financial Officer Congressionally Mandated Projects 66.202 Special Appropriation - Kau Cesspool Replacement Project XP -96942401-1 Office of Water Passed through the State Department of Health: Capitalization Grants for Clean Water State Revolving Funds 66.458 Kalanianaole Avenue Interceptor System Rehabilitation Phase 11 17 C150062 38 512,048 12,084,211 1,842,150 65,754 6,000,000 $ 3,006,331 County of Hawaii, State of Hawaii SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (Continued) Fiscal Year Ended June 30, 2014 Subtotal CFDA 66.468 TOTAL U.S. ENVIRONMENTAL PROTECTION AGENCY 5,695,122 U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES CFDA Grant Federal Program Federal Federal Grantor/Pass-through Grantor/Title Number Project Number Award Amount Expenditures Capitalization Grants for Drinking Water State Revolving Funds: 66.468 Kulaimano Production Well DW106-0001 1,344,599 $ 734,669 Kynnersley Reservoir Replacement DW129-0002 2,394,278 1,710,656 Source Water/Wellhead Protection ASO 12-116 200,000 42,438 Honokaa Sewer Connection Program FS99986507 143,930 78,459 16,735 FS99986508 106.070 56,815 Subtotal CFDA 66.468 TOTAL U.S. ENVIRONMENTAL PROTECTION AGENCY 5,695,122 U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES Administration for Community Living Passed through the State Executive Office on Aging: Special Programs for the Aging -Title III, Part D Disease Prevention and Health Promotion Services 93.043 3D-4-2011 16,766 1,336 3D-4-2012 16,735 16,735 3D-4-2013 15,701 5,500 Subtotal CFDA 93.043 23,571 Aging Cluster Special Programs for the Aging -Title III, Part B_Grants for Supportive Services and Senior Centers 93.044 313-4-2012 413,279 68,598 313-4-2013 337,661 262,195 313-4-2014 336,393 97,687 Subtotal CFDA 93.044 428,480 Special Programs for the Aging -Title III, Part C_Nutrition Services 93.045 3C1-4-2013 301,938 177,946 3C1-4-2014 319,970 85,640 3C2-4-2012 137,557 39,663 3C2-4-2013 186,153 73,557 Subtotal CFDA 93.045 376,806 Nutrition Services Incentive Program 93.053 N/A 89,959 45,165 N/A 89,423 67,067 Subtotal CFDA 93.053 112,232 Subtotal Aging Cluster $ 917,518 Em County of Hawaii, State of Hawaii SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (Continued) Fiscal Year Ended June 30, 2014 Subtotal CFDA 93.052 Administration for Children and Families Passed through the State Department of Health: Affordable Care Act Personal Responsibility Education Program Subtotal CFDA 93.092 TOTAL U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES U.S. CORPORATION FOR NATIONAL AND COMMUNITY SERVICE Retired and Senior Volunteer Program TOTAL U.S. CORPORATION FOR NATIONAL AND COMMUNITY SERVICE U.S. DEPARTMENT OF HOMELAND SECURITY Passed through the State Department of Defense: Disaster Grants - Public Assistance (Presidentially Declared Disasters): Kiholo Earthquake Emergency Management Performance Grants Assistance to Firefighters Grant: Operations and Safety Passed through the State Department of Defense: Homeland Security Grant Program State Homeland Security Program TOTAL U.S.DEPARTMENT OF HOMELAND SECURITY 19 3E-4-2013 136,778 33,531 142,403 93.092 1101 HIPREP 77,711 15,701 1201HIPREP 125,000 30,805 46,506 1,142,298 94.002 135RPH1001 140,508 66,513 66,513 97.036 CFDA Grant Federal Program Federal Federal Grantor/Pass-through Grantor/Title Number Project Number Award Amount Expenditures 265,000 156,838 Special Programs for the Aging _Title IV and Title II—Discretionary Projects 93.048 45,000 97.067 ADRC Expansion 90DR0036 58,285 $ 12,300 National Family Caregiver Support, Title III, Part E 93.052 3E-4-2012 136,502 108,872 Subtotal CFDA 93.052 Administration for Children and Families Passed through the State Department of Health: Affordable Care Act Personal Responsibility Education Program Subtotal CFDA 93.092 TOTAL U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES U.S. CORPORATION FOR NATIONAL AND COMMUNITY SERVICE Retired and Senior Volunteer Program TOTAL U.S. CORPORATION FOR NATIONAL AND COMMUNITY SERVICE U.S. DEPARTMENT OF HOMELAND SECURITY Passed through the State Department of Defense: Disaster Grants - Public Assistance (Presidentially Declared Disasters): Kiholo Earthquake Emergency Management Performance Grants Assistance to Firefighters Grant: Operations and Safety Passed through the State Department of Defense: Homeland Security Grant Program State Homeland Security Program TOTAL U.S.DEPARTMENT OF HOMELAND SECURITY 19 3E-4-2013 136,778 33,531 142,403 93.092 1101 HIPREP 77,711 15,701 1201HIPREP 125,000 30,805 46,506 1,142,298 94.002 135RPH1001 140,508 66,513 66,513 97.036 FEMA -1664 -DR -HI 4,205,763 64,128 97.042 EMW-2012-EP-00012 265,000 156,838 97.044 EMW-2012-FO-03923 46,984 45,000 97.067 2009 -SS -T9-0006 1,000,000 8,793 2010 -SS -TO -0006 931,487 917,749 2011 -SS -00129 600,000 285,511 EMW-2012-SS-00009 354,925 56,923 EMW-2013-SS-00003 370,000 1,084 1,270,060 $ 1,536,026 County of Hawaii, State of Hawaii SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (Continued) Fiscal Year Ended June 30, 2014 CFDA Federal Grantor/Pass-through Grantor/Title Number U.S. OFFICE OF NATIONAL DRUG CONTROL POLICY Hawai'i Impact TOTAL U.S. OFFICE OF NATIONAL DRUG CONTROL POLICY TOTAL EXPENDITURES OF FEDERAL AWARDS 20 07.000 Grant Federal Program Federal Project Number Award Amount Expenditures G12HI0004A 219,788 $ 210,702 G13HI0004A 88,339 41,223 251,925 $ 46,133,400 County of Hawaii, State of Hawaii NOTES TO SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS Fiscal Year Ended June 30, 2014 NOTE A - BASIS OF PRESENTATION The accompanying schedule of expenditures of federal awards includes the federal grant activities of the County and its discretely presented component unit, the Department of Water Supply (DWS) and is presented on the cash basis of accounting. The information in this schedule is presented in accordance with the requirements of OMB Circular A-133, Audits of States, Local Governments, and Non -Profit Organizations. Therefore, some amounts presented in this schedule may differ from amounts presented in, or used in the preparation of, the basic financial statements. NOTE B - SUBRECIPIENTS Of the federal expenditures presented in the schedule of expenditures of federal awards, the County provided federal awards to subrecipients as follows: Amount CFDA Provided to Federal Grantor/Program/Grant Number Subrecipients U.S. DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT Community Development Block Grant/State's Program and Non -Entitlement Grants in Hawaii 14.228 $ 842,099 HOME Investment Partnerships Program 14.239 62,200 TOTAL U.S. DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT 904,299 U.S. DEPARTMENT OF JUSTICE Office of Juvenile Justice and Delinquency Prevention Juvenile Accountability Incentive Block Grant 16.523 61,000 Juvenile Justice and Delinquency Prevention - Allocation to States 16.540 231,761 Crime Victim Assistance 16.575 116,764 TOTAL U.S. DEPARTMENT OF JUSTICE 409,525 U.S. DEPARTMENT OF LABOR WIA Adult Program 17.258 359,663 WIA Youth Activities 17.259 407,130 WIA Dislocated Workers 17.278 326,741 TOTAL U.S. DEPARTMENT OF LABOR 1,093,534 U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES Affordable Care Act Personal Responsibility Education Program 93.092 20,676 TOTAL U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES 20,676 TOTAL PROVIDED TO SUBRECIPIENTS $ 2,428,034 21 County of Hawaii, State of Hawaii NOTES TO SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS (Continued) Fiscal Year Ended June 30, 2014 NOTE C - OUTSTANDING LOAN BALANCES The State Revolving Fund Loans are for the construction of necessary water treatment works and for wastewater reclamation projects, as well as solid waste projects. County - As of June 30, 2014, the outstanding principal amounted to $22,928,638 that bears interest at 0.50 percent to 2.50 percent. The loans require semi-annual principal and interest payments and loan fees through fiscal year 2033. The County has 10 projects funded with these loans. DWS - As of June 30, 2014, the outstanding principal amounted to $13,658,717 that bears interest at 0.50 percent to 1.37 percent. The loans require semi-annual principal and interest payments and loan fees through fiscal year 2033. The DWS has 12 projects funded with these loans. 22 PART III SCHEDULE OF FINDINGS AND QUESTIONED COSTS 23 County of Hawaii, State of Hawaii SCHEDULE OF FINDINGS AND QUESTIONED COSTS Fiscal Year Ended June 30, 2014 SECTION I - SUMMARY OF AUDITOR'S RESULTS Financial Statements Type of auditor's report issued: Unmodified Internal control over financial reporting: Material weakness(es) identified? _ yes ✓ no Significant deficiency(ies) identified? ✓ yes _ none reported Noncompliance material to financial statements noted? _ yes ✓ no Federal Awards Internal control over major programs: Material weakness(es) identified? _ yes ✓ no Significant deficiency(ies) identified? _ yes ✓ none reported Type of auditor's report issued on compliance for major programs: Unmodified Any audit findings disclosed that are required to be reported in accordance with Section 510(a) of OMB Circular A-133? _ yes ✓ no Identification of major programs: CFDA Number Name of Federal Program or Cluster 14.228 Community Development Block Grants 14.239 HOME Investment Partnerships Program 14.871 Section 8 Housing Choice Vouchers 20.205 Highway Planning and Construction (Federal -Aid Highway Program) 66.458 Capitalization Grants for Clean Water State Revolving Funds 66.468 Capitalization Grants for Drinking Water State Revolving Funds Dollar threshold used to distinguish between Type A and Type B programs: $1,384,000 Auditee qualified as a low-risk auditee? ✓ yes _ no 24 County of Hawaii, State of Hawaii SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Fiscal Year Ended June 30, 2014 SECTION II - FINANCIAL STATEMENT FINDINGS Ref. No. Internal Control Findings 2014-001 Logical Access & Access Security - Significant Deficiency Condition: During our audit, we noted that the County had several internal control deficiencies related to logical access and access security including: • Inadequate password parameters and security settings for IAS and ReCo, combined with network domain password security settings pertaining to minimum password age and lockout parameters that could be further strengthened. • The County did not have any formally documented security administration policies and procedures. Criteria: Access to programs and data are appropriately controlled to prevent unauthorized use, modification, damage or loss of data. A control process exists and is followed to periodically review and confirm user access rights in a timely manner. Procedures exist and are followed to maintain the effectiveness of user authentication and access mechanisms such as password length, password history, and lockout for failed attempts. An information security policy exists and has been approved by an appropriate level of management. A framework of security standards has been developed that supports the objectives of the security policy. Cause: The County has not formally documented all of the Logical Access & Access Security controls nor effectively designed all of these controls. The IAS and ReCo systems do not have the functionality to support adequate password parameters and security settings. Effect: Unauthorized logical access to these systems could result in the destruction of data, unauthorized transactions being made, transactions being inaccurately recorded, or internal controls being circumvented. 25 County of Hawaii, State of Hawaii SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Fiscal Year Ended June 30, 2014 SECTION II - FINANCIAL STATEMENT FINDINGS (Continued) Ref. No. Internal Control Findings 2014-001 Logical Access & Access Security - Significant Deficiency (Continued) Recommendation We recommend that the County: 1. Strengthen password controls for the IAS and ReCo systems that include a combination of minimum length, complexity, expiration, history, and lockout policy and duration. As a compensating control to mitigate the lack of functionality in the IAS and ReCo systems, strengthen the domain password parameters and security settings to increase the minimum password age and lockout duration requirements. 2. Develop an information security policy, have the policy approved by the appropriate level of management and communicate the policy to employees. 26 County of Hawaii, State of Hawaii SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Fiscal Year Ended June 30, 2014 SECTION II - FINANCIAL STATEMENT FINDINGS (Continued) Ref. No. Internal Control Findings 2014-002 Physical Security - Significant Deficiency Condition: The servers for the Eden and IAS systems are located in a room at the Civil Defense Center (Center). During our visit to the Center, we noted the following conditions: Security over the servers is compromised as the door to the room housing these servers is left open due to cooling concerns. Anyone with access to the Civil Defense Center could potentially access the server room. A fire suppression system was not installed. Criteria: Physical access to servers and other sensitive areas is appropriately restricted to authorized personnel. Devices are used to secure sensitive equipment and storage media from the risk of damage from fire. Cause: The County has not formally documented policies and procedures over the physical security of IT systems at the Center nor effectively designed these controls. Effect: Unauthorized access to the server room could result in unauthorized use, modification, damage or loss of data. The absence of a five suppression system could increase the likelihood of the loss or destruction of data due to fire. Recommendation We recommend that the County develop formal policies over the physical security of IT systems at the Center and to implement them. The server room should be locked and access to keys or codes should be limited to authorized personnel. A fire suppression system should be installed to prevent or limit the loss of data from fire. 27 County of Hawaii, State of Hawaii SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Fiscal Year Ended June 30, 2014 SECTION II - FINANCIAL STATEMENT FINDINGS (Continued) Ref. No. Internal Control Findings 2014-003 Information Technology (IT) Governance - Significant Deficiency Condition: During our audit, we noted that the County does not have a formalized process to review IT plans and priorities and significant IT related projects and investments that support financial reporting. Criteria: A formal IT strategic planning and risk management process is in place to support financial reporting requirements: • A management steering committee is responsible for reviewing and approving IT plans and priorities. • An assessment of IT risks, including the risk of fraud, is performed regularly and any identified risks are appropriately addressed. Cause: The County has not formally documented IT Governance policies and procedures. Effect: The lack of formalized IT governance policies and procedures could limit the County's ability to respond to risks and changes in a timely manner that could adversely affect continuity and quality of service. Recommendation We recommend that the County formally establish an IT management steering committee that meets on a regular basis in order to evaluate IT risks and to ensure that identified risks are appropriately addressed on a timely basis. W County of Hawaii, State of Hawaii SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Fiscal Year Ended June 30, 2014 SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS None 29 PART IV SUMMARY SCHEDULE OF PRIOR AUDIT FINDINGS 30 County of Hawaii, State of Hawaii STATUS REPORT Fiscal Year Ended June 30, 2014 This section contains the current status of prior audit recommendations. The recommendations are referenced to the pages of the previous audit report for the fiscal year ended June 30, 2013, dated December 24, 2013. SECTION II - FINANCIAL STATEMENT FINDINGS Recommendations 2013- Information Technology (pages 21-22) 001 The County should develop and implement IT policies and procedures to include internal control procedures addressing IT risks. The County should also ensure that IT policies and procedures are consistently followed. In addition, the County should implement change management detective controls and perform annual test restoration exercises. 31 Status Partially Accomplished. Refer to findings 2014-001, 2014- 002, and 2014-003. County of Hawaii, State of Hawaii STATUS REPORT (Continued) Fiscal Year Ended June 30, 2014 SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS Ref. Questioned No. Internal Control over Compliance Findings Costs 2009-01 Activities Allowed and Unallowed - Calculation of Federal Expenditures Federal agency: U.S. Department of Homeland Security CFDA No.: 97.036 Program: Disaster Grants - Public Assistance (Presidentially Declared Disasters): Kiholo Earthquake Award Number and Award Year: FEMA -1664 -DR -HI 10/15/06-10/15/10 Per the prior auditor's testing of the activities allowed and unallowed compliance requirement, it was noted that the County overstated the federal share of eligible costs related to the Ikuo Hisaoka Gymnasium by $27,965. The amount the County reported was based on the actual expenditures, however, as the Ikuo Hisaoka Gymnasium was insured at the time of the loss, the expenditures should have been based on the insurance deductible in accordance with Title 44 Code of Federal Regulations (44 CFR 206.250(c)). $ 27,965 Status: Unresolved. We understand that the County has sought the assistance of the Hawaii State Civil Defense in determining the correct portion eligible for federal aid and is still awaiting a response. 32 ;7A :4 rV CORRECTIVE ACTION PLAN 33 CORRECTIVE ACTION PLAN Financial Statement Findings: 2014-001 Logical Access & Access Security - Significant Deficiency Recommendation: We recommend that the County: 1. Strengthen password controls for the IAS and ReCo systems that include a combination of minimum length, complexity, expiration, history, and lockout policy and duration. As a compensating control to mitigate the lack of functionality in the IAS and ReCo systems, strengthen the domain password parameters and security settings to increase the minimum password age and lockout duration requirements. 2. Develop an information security policy, have the policy approved by the appropriate level of management and communicate the policy to employees. County's Comment: 1) Inadequate password parameters and security settings for IAS and ReCo, password age and lockout parameters that could be further strengthened. o To our knowledge the complexity restrictions are a limitation of the existing IAS and ReCo software. However, ReCo is scheduled to get a more complex password control in April 2015 and the County will be upgrading to a cloud based system in June 2015 for IAS, which will address this issue. 2) The County did not have any formally documented security administration policies and procedures. o The County's Department of Information Technology is sending staff for training in the coming weeks on how to write and implement rules and procedures to address the current limited written policies and procedures. Anticipated Completion Date: Some items will be corrected by June 30, 2015 and others will be an ongoing effort as we strive to improve our internal controls over information technology. Contact People: Don Jacobs, Director of Information Technology Stan Sitko, Real Property Tax Administrator 34 CORRECTIVE ACTION PLAN Financial Statement Findings (Continued): 2014-002 Physical Security - Significant Deficiency Recommendation: We recommend that the County develop formal policies over the physical security of IT systems at the Center and to implement them. The server room should be locked and access to keys or codes should be limited to authorized personnel. A fire suppression system should be installed to prevent or limit the loss of data from fire. County's Comment: Although the specific room that houses the servers is left open, the general Civil Defense facility is restricted to authorized personnel. Unauthorized personnel must sign in before being allowed entry into Civil Defense. The County is also researching the effectiveness and cost of several other short- term and long-term solutions to restrict access further. Anticipated Completion Date: Some mitigating controls are currently in place but additional efforts will be ongoing as we strive to improve our internal controls over information technology. Contact Person: Don Jacobs, Director of Information Technology 35 CORRECTIVE ACTION PLAN Financial Statement Findings (Continued): 2014-003 Information Technology (IT) Governance - Significant Deficiency Recommendation: We recommend that the County formally establish an IT management steering committee that meets on a regular basis in order to evaluate IT risks and to ensure that identified risks are appropriately addressed on a timely basis. County's Comment: The IT Director is researching formalized policies and governance used at the State and other county levels to codify and deploy appropriate procedures. Additionally the IT department is now meeting quarterly with other county IT entities to discuss security concerns and how to monitor and manage them. Anticipated Completion Date: Efforts will be ongoing as we strive to improve our internal controls over information technology. Contact Person: Don Jacobs, Director of Information Technology 36