Okaloosa County BOCC — August 18, 2015 — Okaloosa Follow-Up Letter and P&T — reading text

identify and prevent potential conflicts of interest. Page 12  OKALOOSA COUNTY BOARD OF COUNTY COMMISSIONERS AND OKALOOSA COUNTY CLERK OF THE CIRCUIT COURT Follow-Up on Report No. 2014-068 PRELIMINARY AND TENTATIVE AUDIT FINDINGS NOT AN AUDIT REPORT Results of Follow-Up Procedures The CCC’s actions corrected this finding. In July 2014, the CCC revised its Human Resource Policy Manual to require CCC employees to disclose, at least annually, potential conflicts of interest. The Manual requires that identified potential conflicts of interest be provided to the CCC’s Human Resource Department. If potential conflicts of interest are disclosed, CCC personnel indicated that the potential conflicts are provided to the Clerk for further action. In August 2014 and January 2015, two employees disclosed potential conflicts of interest to the CCC’s Human Resource Department, which were provided to the Clerk for consideration when making future purchasing decisions. ELECTRONIC COMMERCE Finding 20: E-payables and Electronic Funds Transfers Previously Reported The CCC had not adopted written policies and procedures, or established effective controls, over transactions involving electronic commerce. We recommended that the CCC adopt written policies and procedures addressing, and establish adequate controls over, electronic commerce transactions to ensure adequate integrity, security, confidentiality and auditability of such transactions. Results of Follow-Up Procedures The CCC’s actions corrected this finding. The CCC adopted policies in October 2013 and October 2014 that adequately addressed processes for electronic funds transfers and e-payables, respectively. INFORMATION TECHNOLOGY Finding 21: Access Controls Previously Reported The CCC had not established adequate controls over employee access privileges to data and information technology resources. We recommended that the CCC strengthen access control procedures to ensure that access privileges are only assigned to employees who require such access as part of their assigned job responsibilities. If incompatible access privileges must be granted to employees due to software limitations, the CCC should document and retain evidence that compensating controls, such as reviewing transaction edit reports for propriety, have been performed. Page 13  OKALOOSA COUNTY BOARD OF COUNTY COMMISSIONERS AND OKALOOSA COUNTY CLERK OF THE CIRCUIT COURT Follow-Up on Report No. 2014-068 PRELIMINARY AND TENTATIVE AUDIT FINDINGS NOT AN AUDIT REPORT Results of Follow-Up Procedures The CCC’s actions corrected this finding. In November 2013, the CCC adopted a policy that requires supervisory approval of the creation, modification, or deletion of employee access privileges and the periodic review of the propriety of employee access privileges. Additional policies and procedures requiring independent, documented reviews of journal entries and changes made to the payroll system and master vendor file were also adopted and implemented to help ensure their propriety. In April 2015, CCC personnel performed a review of employee access privileges and updated privileges as deemed appropriate. End of Preliminary and Tentative Audit Findings. Page 14