Okaloosa County BOCC — November 16, 2013 — Carr, Riggs, & Ingram Internal Audit Report — reading text

detection method was the performance of internal audits. Internal audits that are conducted on regular basis also serve as a prevent control because those inclined to perpetrate a fraud see this as a risk for being caught. The BCC does not have an internal audit department. The Office of the Clerk of Court has an Internal Audit Director who is available for consultation with BCC departments and has performed inventory testing procedures at various BCC departments. In addition to performing these inventory counts, the Internal Audit Director stated that much of his time is also spent working on the grants schedule and performing monitoring reviews on grant subrecipients. Performing internal audits for BCC departments has not been a regular responsibility for this individual. A program to conduct both routine and surprise internal audits on a continuing basis should be implemented. See Appendix A for recommendations regarding an internal audit plan. At this time, the BCC has no fraud awareness training program. In addition, ethics training is limited to a discussion in the new employee orientation program and courses available to foremen, supervisors, and managers as part of the Training Zone program. Research conducted by the ACFE revealed that organizations that provide antifraud training programs to employees, managers, and executives experience smaller losses and shorter frauds compared to organizations without such training programs. Both fraud awareness and ethics training should be provided to BCC employees at all levels. In response to reports issued by the State of Florida Auditor General and Warren Averett O’Sullivan Creel, our firm was engaged to perform a fraud risk assessment for the BCC; however, fraud risk assessment should not be limited to a one-time event. Fraud risk assessment needs to be performed on a regularly scheduled basis and include those involved in BCC operations. A formal internal risk assessment program should be developed that includes guidelines for performing, documenting, and reporting risk assessment. See Appendix B for additional details in developing a fraud risk assessment program. There is no requirement for employees to take an annual vacation. This provides an opportunity for employees to perpetrate an asset misappropriation fraud scheme that could go undetected for an extended period of time. Policies related to annual leave time should be amended to require each employee to take an annual vacation that lasts at least one full week. In addition, the absent employee’s duties should be performed by another employee during this time. This is particularly important for employees involved in the processing of financial transactions or those who have control over assets that can be easily misappropriated (e.g. inventory). The requirement to use leave time on an annual basis can be both a fraud prevention and detection control, plus it encourages the practice of cross-training, improves employee morale, and prevents employee burnout. Approximately 217 credit cards have been issued to BCC employees for purposes of making small dollar purchases on behalf of the BCC. While there are restrictions regarding the use of these cards and guidelines related to the review, approval, and processing of credit card purchases, the high number of cards issued increases the risk for abusive purchases and makes the monitoring of credit card purchases more difficult and time consuming. To illustrate our point, we compared the credit card holder list dated July 8, 2013 to the names of Airport administrative employees (excluding police) listed on the Airport's website, noting that credit cards have been issued to 16 out of 21 employees. We also noted that several of these employees work in the same office. =3 The number of credit cards issued should be reduced, and a review of cards issued by department, location, and employee position needs to be performed to identify the best way to accomplish this goal. In addition, credit cards should not be issued to those with responsibility for reviewing and approving credit card transactions. The BCC has used the Voluntary Separation Incentive Program (“VSIP”) in the past to reduce the number of employee positions. While management generally considers the operating needs of the County when deciding to grant an application under the VSIP, it appears the impact on internal controls, particularly segregation of duties, may not always be considered. This comment serves as a reminder to officials and management that the impact on internal controls should always be considered when eliminating employee positions or making any organizational changes. The Finance Department has two accounts payable clerks who are responsible for maintaining vendor master files, processing vendor invoices, printing signed checks for payments to vendors, and reconciling vendor statements. The limited number of accounts payable staff involved in this key financial process minimizes the ability of the Finance Department to properly segregate duties in this function and effectively review purchases for impropriety without creating a backlog in the payment process. Despite some compensating controls, the lack of segregation of duties creates the risk of a fraudulent disbursement scheme being perpetrated within the Finance Department. The management of this department needs to reallocate responsibilities so that accounts payable duties are properly segregated. It may be necessary to add a position to this department in order to accomplish this. There are no established procedures for BCC departments to notify the Finance Department regarding the return of purchased materials to vendors. In the event a vendor fails to issue a credit memo for the returned materials, there is no control in place that enables the Finance Department to perform the necessary follow-up. Standard procedures applicable to all BCC departments regarding returned materials need to be developed and implemented. Okaloosa County uses multiple applications, operating systems, and hardware platforms and maintains in-house developed software. The complexity of the County's information technology (“IT”) systems is considered high; however, this is not unusual for a governmental entity the size of Okaloosa County. It should be noted that complexity is a main component of evaluating risk to the County; therefore, the inherent risk of IT to the County is high. The County has not performed a comprehensive IT risk assessment using best practices methodology (such as National Institute of Standards for Technology) of its IT resources and data. A detailed IT risk assessment provides a working tool requiring the identification of all threats to the confidentiality, availability, and integrity of County data. A. The lack of a detailed IT risk assessment often results in risks being misidentified or controls misapplied to properly mitigate risks. We recommend that the IT Department perform a comprehensive IT risk assessment to determine the risk and exposures of the County's data and systems. This assessment should be reviewed on a semi-annual basis or at the occurrence of a significant technology change. Network security, access controls, and physical access controls have been implemented by the County. While regular audits of financial processes are completed, the IT access, segregation, and monitoring controls are often not regularly tested for effectiveness. As with financial controls, IT controls can be circumvented and bypassed. Further, IT controls can become ineffective over time due to technology changes. From the documentation reviewed, the County's security controls are in the “repeatable” phase of control maturity (See Appendix C for Information Technology General Control! Maturity Evaluation Methodology.) The BCC should require the performance of annual audits of IT security controls for design, effectiveness, and improvement toward an “optimized” control maturity level. Maintenance and development of software present a high risk to the entities using internally developed applications, and the limited user testing capability and small deployment base for such applications differ vastly from commercial software. This is not to say internally developed systems are not a viable choice for use, but that it requires specific controls be in place to ensure processing integrity is maintained. These controls are referred to as the system development and life cycle (“SDLC”). The documentation reviewed shows the County has processes in place to control program development and change; however, SDLC controls have an inherently high risk because SDLC processes can be circumvented due to time constraints in scheduling, emergency change requirements, or through lack of segregation to the production environment. Circumvention of SDLC controls can lead to undetected errors in such items as calculations, data security, or misapplication of assets. These controls should be tested by sampling projects for proper completion of all SDLC steps including adequate user testing and proper approvals prior to promotion to production. We recommend you consider annual audits of these controls for design and effectiveness. The County has completed a continuance of operations plan; however, this plan has not been tested. A formalized assessment of mission-critical business processes and associated applications should be identified in the risk assessment process. A business impact analysis to identify minimal downtimes and prioritization of recovery will provide a clear method to planning and testing the disaster recovery plan. A disaster recovery and business continuation plan based on a business impact analysis should be developed that addresses the following: Hardware Software Programming Vendors WAN Alternate facilities Data recovery OoO000UCOUWUCOOUlCOO Scenario based testing should be completed annually. The disaster recovery process and testing should be evaluated as part of an annual audit. The total value of inventory reported in the September 30, 2012 financial statements of Okaloosa County was $2.5 million, with approximately 62% of this amount reported by the Water & Sewer Department. Due to the large quantities of inventory maintained by this department, there is an inherent risk for inventory theft. The department has installed security cameras at some of its outside inventory storage locations; however, no security cameras have been installed inside its primary inventory storage building. Adding security cameras to this location, along with periodic monitoring is recommended. We also noted that the Water & Sewer Department performs two complete physical inventory counts per year (one at mid-year and one at year-end). Our experience with other utility companies has shown that performing cycle counts throughout the year is an effective way to verify inventory levels and also acts as a fraud prevent control when performed by someone who is independent of regular warehouse duties. Cycle counts involve counting inventory on a much smaller scale, but more frequently (e.g. selecting 15 items for counting on a weekly basis). It would take the place of a complete inventory count at mid-year. The Airport manages 97 revenue contracts and leases, with many variables associated with these agreements. The Airport does not have a sophisticated software program for the tracking and billing of such agreements. Instead, Airport personnel have compiled a master list of contracts and leases in an Excel spreadsheet and use memorized transactions in its Quickbooks accounting software program as the primary tools for tracking and billing under leases and other agreements. Due to the high volume of agreements, the many variables involved in the calculation of revenues, and the lack of sufficient tools for tracking and billing, there is a risk that errors can occur in the amount billed,