AG 2009 11 16 - Laserfiche WebLink

Home Browse Search

Board of County Commissioners Cabarrus County Page 2 Information Security Manual for NC Division of Social Services and County Departments of Social Services 4.1 Workstation Security • Personal computers and computer terminals should not be left logged on when unattended or not in use. If computers or computer terminals are left logged on when unattended or not in use then they should be protected from unauthorized access by physical, technical, or administrative controls such as passwords, time driven screensavers, controlled workstation access, operational procedures, etc. The agency security officer or designee will conduct audits regarding compliance with this standard as part of the required audit process included in the Information Security Manual. Finding 2009-2: Criteria: Management should have a system in place to reduce the likelihood of errors in financial reporting. Condition: While documenting internal controls relating to the general ledger/journal entries, we noted that all finance employees have the ability to post journal entries in the financial accounting system. Furthermore, there is no formal review process in place for journal entries posted to the system. Recommendation: In order to ensure adequate segregation of duties and to reduce the likelihood of journal entries being posted and not detected in a timely manner, management should restrict journal entry access to those employees for whom it is required. Also, a formal journal entry review process should be implemented. Management's Response/Corrective Action: In response to this finding, all Finance staff members' access to Munis, the computer financial software, will be reviewed and restrictions put in place. Journal entry posting has been restricted to two Accountant positions and one Payroll Technician position within the department. All journal entries will be reviewed the Assistant Finance Director, or the Accounting Supervisor, prior to posting. The daily deposit journal entries do not require approval and will be entered as part of the deposit process by the Deposit Accounting Technician. The Finance Director will act as the backup for posting journal entries. Finding 2009-3: Criteria: Management should have a system in place to reduce the likelihood of errors in financial reporting. Condition: While performing procedures related to internal controls over data processing, we noted that access to modules of the financial software need to be strengthened. This access does not allow duties to be fully segregated and weakens internal controls. Recommendation: Employees should only have access rights to modules that they need to perform their daily functions. Read-only access can be granted for other modules as necessary. The access rights should be changed as job duties change. Management's Response/Corrective Action: In response to this finding, as stated above in finding 2009-2, all Finance staff members' access to Munis, the computer financial software, will be reviewed and restrictions put in place to enhance the segregation of duties. Not only will computer access be restricted, duties will be redistributed to strengthen internal controls within the department. G-8 Attachment number 1 Page 256