Loading...
HomeMy WebLinkAboutF0110 Clerk Integrated Flw-up (Published 3-19-25)To request this information in an alternate format, please call (541) 330- 4674 or send email to internal.audit@Deschutes.org Clerk’s Office Integrated Audit Follow-up: stronger information security controls, but cash handling and procurement risks persist. March 2025 Our 2024 integrated audit of the Clerk’s Office found areas for improvement related to cash handling, purchasing, information systems, purchasing cards, and performance measurement. Nine months later, the Office implemented information system controls, secured the purchasing card, and committed to improved measures. However, the Office still had not conducted a fraud assessment to identify and resolve risky cash handling practices or corrected discrepancies with County procurement rules. Deschutes County Office of the Internal Auditor Page 1 of 6 Audit Follow-up Report: March 2025 Clerk’s Office Integrated Audit Recommendation Status Key: We estimated that the same staffer entered and checked documents 33 percent of the time, overriding segregations of duties intended to check for mistakes. Clerk’s Office staff estimated an even lower rate. Given uncertainty about how often the control was overridden due to limited staffing, we recommended the Clerk’s Office analyze how often and when staff need to review a document they recorded and then decide whether recording and reviewing duties should be segregated. The Clerk’s Office found that it was possible to use software controls to segregate recording and reviewing without negatively impacting customer service. Staff disabled segregation of duties settings in document recording software, increasing the risk of mistakes and errors. We recommended that if the Clerk’s Office decided record and review duties should be segregated, it should re-enable controls in the information system to enforce segregation. The Clerk’s Office enabled software controls to segregate recording and reviewing roles to ensure no single person could record and verify their own work. 9 Resolved 4 In Process 0 Accept Risk Management addressed risk. Auditors will no longer monitor. Recommendations are in progress. Auditors will continue to monitor. Management accepted the risk of not implementing the recommendation. Additional segregation of duties control did not negatively impact customer service. Segregation of recording and reviewing duties decreased risk of errors. Deschutes County Office of the Internal Auditor Page 2 of 6 Audit Follow-up Report: March 2025 Clerk’s Office Integrated Audit Management said they disabled settings to prevent staff from voiding their own receipts because low staffing levels required it. However, we found that voids were rare with no voided receipts on 70 percent of days. We recommended the Clerk’s Office document workflow impacts of requiring supervisor approval of voided receipts including how often they happen and how long the process takes and then decide whether voids should require supervisor authorization. The Office reactivated settings requiring supervisor approval on voided receipts. This ensured an additional layer of oversight and accountability, preventing unauthorized voids and helping to maintain accurate financial records. Management disabled settings in the information system that prevented staff from voiding their own receipts, introducing an opportunity for staff to steal from customers. Staff said there were compensating controls in place, but these were not documented or tested. We recommended that if the Office decided that voids should require supervisor authorization, it should use controls in the information system to enforce authorization. And If the Office decided not to require authorization, it should document compensating controls and formally accept the risks. The Office re-activated settings requiring supervisor approval on voided receipts, ensuring an additional layer of oversight and accountability, preventing unauthorized voids and helping to maintain accurate financial records. Management chose to implement new controls on voided receipts. Management replaced undocumented controls with software controls on voided receipts. Deschutes County Office of the Internal Auditor Page 3 of 6 Audit Follow-up Report: March 2025 Clerk’s Office Integrated Audit Clerk’s Office staff said they needed a shared information system account and password for times when another staffer needed to use a workstation that was already in use. They said that it took too long to log into a separate account. However, management had not documented how often it happened and how necessary it was. We recommended that the Clerk's Office review how staff used the generic account including how often it was used. Instead of performing this analysis, the Office stopped using a generic username and password for computer access. Clerk’s Office staff said they needed a shared account and password for times when another staffer needed to use a workstation because it took too long to log into a separate account. They also said that if there were inappropriate transactions, they could be tied to a specific person using the workstation and login information with information from other systems used to conduct transactions. However, management had not documented risk tolerance for this activity or these compensating controls. We recommended that if the Office continued to use the generic account, it should formally accept and document the risks associated with its use. The Office stopped using a generic username and password for computer access. Management stopped using a generic password in lieu of analyzing how often it was needed. Staff no longer sharing passwords. Deschutes County Office of the Internal Auditor Page 4 of 6 Audit Follow-up Report: March 2025 Clerk’s Office Integrated Audit The Office’s purchasing card was unsecured during business hours, creating potential for staff to make disallowed or personal purchases without identification. We recommended that the Clerks' Office assign someone to keep the payment card secured. Management secured the purchasing card under lock and key except when in use. The Clerk’s Office had performance measures, but they didn’t provide clear information about how well the Office functioned. We recommended that the Office improve performance reporting. The Office updated measures to reflect the correct status and stated that moving forward, it would continue to assess metrics to ensure they offered meaningful insights and aligned with County goals. The Office also committed to integrating historical context and clearer data points, such as staff to voter registration ratios and cost per ballot tallied, to provide a more comprehensive picture of the work being done by the Office. At the time of the audit the Clerk’s Office still had not requested a change to County Code to move responsibility for Weed Control program requirements to the Road Department, though it was recommended in an audit three years earlier. We recommended that the Clerk's Office request that the Board of County Commissioners amend County Code to give responsibility to Purchasing card secured. Commitment to improved performance reporting. County Code clarified to assign Weed Control program requirements to Road Department. Deschutes County Office of the Internal Auditor Page 5 of 6 Audit Follow-up Report: March 2025 Clerk’s Office Integrated Audit distribute copies of the code chapter about weed control to the Road Department. The code was amended in June 2024. The Clerk’s Office had some risky financial practices in place but had not conducted a fraud assessment to formally document acceptance of associated risks. We recommended that the Clerk’s Office conduct a fraud risk assessment and document outcomes. The Office agreed with the auditors’ comments and committed to explore conducting a fraud risk assessment by April 2025. At the time of the March 2025 update, the Office had not reported any progress. No fraud was uncovered, but the Clerk’s Office had incomplete documentation for mitigating cash handling risks. We recommended that the Clerk’s Office document and implement procedures to address fraud risks identified in the risk assessment. The Office agreed with the auditors’ comments and committed to explore conducting a fraud risk assessment by April 2025. At the time of the March 2025 update, the Office had not reported any progress. The Clerk’s Office inconsistently complied with County rules for procurement. We recommended that the Clerk’s Office consult with the new procurement staffer about procurement Fraud risk assessment still pending. No progress reported on procedures to resolve risky cash handling practices. Preliminary conversations with Procurement Manager, but no changes yet. Deschutes County Office of the Internal Auditor Page 6 of 6 Audit Follow-up Report: March 2025 Clerk’s Office Integrated Audit requirements. The Office planned to have the recommendation implemented by December 2024 but had not completed it at the time of the March 2025 update. The Office said it engaged in discussions with the County Procurement Manager, who expressed a willingness to collaborate and provide support. The Office said Procurement Manager assistance would help ensure that the office adheres to and complies with relevant county procurement rules. A review of Clerk’s Office payments to its highest paid vendors revealed discrepancies with County rules. In some cases, either there was no contract, there was no signature when the amount was above the threshold of $50,000, there was no competitive procurement process, or a combination of the factors applied. We recommended that the Clerk’s Office conduct competitive procurements, put contracts in place, and get Administrator sign- off related to services identified in the audit. The Office planned to have the recommendation implemented by December 2024 but had not completed it at the time of the March 2025 update. The Office said it engaged in discussions with the County Procurement Manager, who expressed a willingness to collaborate and provide support. The Office said Procurement Manager assistance would help ensure that the office adheres to and complies with relevant county procurement rules. Next Steps: We will continue to report on the status of in process audit recommendations in our Global Follow-up Report at the end of each calendar year. Discrepancies with County procurement rules not yet resolved. Deschutes County Office of the Internal Auditor Audit Follow-up Report: Clerk’s Office Integrated Audit The mission of the Office of Internal Audit is to improve the performance of Deschutes County government and to provide accountability to residents. We examine and evaluate the effectiveness, efficiency, and equity of operations through an objective, disciplined, and systematic approach. The Office of Internal Audit: Audit committee: Elizabeth Pape – County Internal Auditor Daryl Parrish, Chair - Public member Phil Anderson – Public member Jodi Burch – Public member Phone: 541-330-4674 Joe Healy - Public member Email: internal.audit@deschutes.org Summer Sears – Public member Web: www.deschutes.org/auditor Kristin Toney - Public member Patti Adair, County Commissioner Charles Fadeley, Justice of the Peace Lee Randall, Facilities Director If you would like to receive future reports and information from Internal Audit or know someone else who might like to receive our updates, sign up at http://bit.ly/DCInternalAudit.