HomeMy WebLinkAbout1415-11 Follow-up report on Selected Electronic Communications (email and texts) (Final 6-24-15)Follow-up report of Selected Electronic Communications (email and texts) #14/15-11 June 2015
FOLLOW-UP REPORT
Selected Electronic Communications (email and texts)
(Internal audit report #13/14-4 issued August 2014)
To request this information in an alternate format, please call (541) 330-4674 or send email to David.Givans@Deschutes.org
Deschutes County,
Oregon
David Givans, CPA, CIA, CGMA
Deschutes County Internal Auditor
PO Box 6005
1300 NW Wall St
Bend, OR 97708-6005
(541) 330-4674
David.Givans@Deschutes.og
Audit committee:
Shawn Armstrong, Chair - Public member
Chris Earnest - Public member
Lindsey Lombard – Public member
Gayle McConnell – Public member
Michael Shadrach - Public member
Jennifer Welander - Public member
Anthony DeBone, County Commissioner
Nancy Blankenship, County Clerk
Dan Despotopulos, Fair & Expo Director
Follow-up report of Selected Electronic Communications (email and texts) #14/15-11 June 2015
TABLE OF
CONTENTS:
1. INTRODUCTION
1.1. Background ………………………………………...………………................................... 1
1.2. Objectives & Scope ……………………………………..………………………….…….… 1
1.3. Methodology ……………………………………………………..…………………….……. 1
2. FOLLOW-UP RESULTS ……………….…...………………………….............................. 2
3. APPENDICES
3.1. Appendix I – County update on Records Retention Work Plan
(dated 6/19/15) .................................................................................................... 3-4
3.2. Appendix II –Updated Workplan for report 13/14-4
(Status updated as of June 2015) ....................................................................... 5-7
Follow-up report of Selected Electronic Communications (email and texts) #14/15-11 June 2015
Page 1
1. Introduction
1.1 BACKGROUND
Audit Authority:
The Deschutes County Audit Committee has suggested that follow-ups occur from nine months to one
year after the original report issuance. The Audit Committee’s would like to make sure departments
satisfactorily address recommendations.
1.2 OBJECTIVES and SCOPE
Objectives:
The objective was to follow-up on the outstanding audit recommendations.
Scope:
The follow-up included thirteen (13) recommendations from the internal audit report on Selected Electronic
Communications (email and texts) (#13/14-4 issued August 2014).
The follow-up reflects the status as of June 2015. The original internal audit report should be referenced for
the full text of recommendations and discussion.
1.3 METHODOLOGY
The follow-up report was developed from information provided by Tom Anderson, County Administrator; Erik
Kropp, Deputy County Administrator; and Joe Sadony, Information technology Director. In cases where
recommendations have not been implemented, comments were sought for the reasons why and the timing
for addressing these. The follow-up is, by nature, subjective. In determining the status of recommendations
that were followed up, we relied on assertions provided by those involved and did not attempt to
independently verify those assertions.
The County provided a memorandum detailing their anticipated activities addressing the recommendations.
This memo is included in the Appendix.
Since no substantive audit work was performed, Government Auditing Standards issued by the Comptroller
General of the United States were not followed.
DESCHUTES COUNTY
INTERNAL AUDIT
REPORT
DESCHUTES COUNTY
INTERNAL AUDIT
REPORT
DESCHUTES COUNTY
INTERNAL AUDIT
REPORT
Follow-up report of Selected Electronic Communications (email and texts) #14/15-11 June 2015
Page 2
2.
Follow-up
Results
Figure I -
How were
recommendations
implemented?
The follow-up included thirteen (13) recommendations. Management agreed with all of the
recommendations.
Figure I provides an overview of the implementation status of the recommendations. The details of the
updated workplan are provided in Appendix I and II.
With this follow-up, eight percent (8%) of the recommendations are completed and ninety-two percent (92%)
are still in progress. As indicated in the included memo, County management anticipates holding monthly
meetings through completion of these recommendations. It is understood addressing these
recommendations will take time as well as differing approaches by department.
Completed
8%
Underway
38%
Planned
54%
Follow-up report of Selected Electronic Communications (email and texts) #14/15-11 June 2015
Page 3
3. Appendices Appendix I – County memorandum for follow-up (dated 6/19/15)
Date: June 19, 2015
To: David Givans, Internal Auditor
From: Erik Kropp, Deputy County Administrator
Re: Update on Records Retention Work Plan
This memo will serve as an update on the work plan for the Records Retention audit. The following steps have been taken towards
implementing the audit recommendations:
1. Risk Management volunteered to be a test department on records retention. Risk Management staff reviewed the OARs to
identify records requiring retention and used a template provided by the Clerk’s Office to list the records and retention
requirements.
2. Information Technology has started implementing the new Outlook email version that includes changes to email storage.
3. The County Clerk’s Office hosted an information session for County staff and staff from other local governmental agencies to
learn about the Oregon Records Management Solution (ORMS). ORMS is a robust information management system. ORMS will
be one of the records management systems available to departments.
Next steps in implementing the audit recommendations include the following:
1. A monthly meeting of a steering committee who will implement the audit recommendations. The steering committee includes
Follow-up report of Selected Electronic Communications (email and texts) #14/15-11 June 2015
Page 4
Nancy Blankenship, Erik Kropp, Joe Sadony, and a representative from the Office of the Legal Counsel.
2. The steering committee is reviewing the draft Records Retention policy and is targeting September 15, 2015 as the date to
revise the draft policy and share with department heads. The revisions will include any changes in state law impacting records
retention.
3. After the draft policy is updated, the steering committee will meet with department management teams to discuss the policy
and provide the department tools and record management system options. Ultimately, it will be up to each individual department
to determine how best to implement a records management program that meets the requirements of the County policy, but
takes into account the unique business systems and operations of the individual department.
4. Once a department has identified how to best implement records retention within his/her department, the steering committee
will develop and implement training for the employees in the department.
c: Tom Anderson, County Administrator
Dave Doyle, Legal Counsel
Nancy Blankenship, County Clerk
Joe Sadony, IT Director
Follow-up report of Selected Electronic Communications (email and texts) #14/15-11 June 2015
Page 5
Appendix II –Updated Workplan for Report #13/14-4 (Status as of June 2015)
Rec # Recommendation Status
Estimated
Date Updated Follow-up Comments
1 It is recommended for the County Clerk and
County Management to implement a records
management program for electronic public
records consistent with the State’s
requirements.
Planned to be
determined
IT is in the process of implementing an update to
County email's vault program. Also, the County Clerk's
Office is hosting an information session on the Oregon
Records Management Solution (ORMS). Developed by
the Oregon Secretary of State's Office, ORMS is a
cloud-based records management system available to
Oregon cities and counties. After the information
session, staff will determine if ORMS is a viable option
for Deschutes County. Given that this objective will
apply to all departments, and the types of documents
will vary, until the systems are identified which will
serve as the platforms for all electronic storage,
estimated a final completion date is premature.
8 It is recommended the County consider
adding and/or utilizing electronic record
management systems to manage retention,
provide access and provide appropriate
destruction of records beyond their retention.
This is really the same as recommendation #1. As
technology is evolving, we will always be evaluating
new systems and tools to manage electronic records.
10 It is recommended for the County to address
the State Archivist recommendations for
electronic records management systems.
During the week of June 15, 2015, the County Clerk's
Office will host an information session on Oregon
Records Management Solution Presentation. The
session will be attended by staff from Administration,
Risk Management, and the Clerk's Office. Staff will
then evaluate the Oregon Records Management
Solution for use by County departments, should they
be interested.
Follow-up report of Selected Electronic Communications (email and texts) #14/15-11 June 2015
Page 6
Rec # Recommendation Status
Estimated
Date Updated Follow-up Comments
11 To the extent a system is in place, it is
recommended management develop an
approach to meeting document management
objectives.
This should be folded into the recommendation to
develop new systems to meet department storage
needs. It may work for some departments or records
but not others.
2 It is recommended the County and
Departments in consultation with the County
Clerk and County Legal Counsel consider how
it may best leverage available electronic
records management tools in a cost effective
manner to address common needs for
electronic document management.
Completed Ongoing This recommendation represents an ongoing, rather
than one-time task that will be done on a continuous
basis as new types of documents are identified and
storage tools developed.
{County is looking at lazerfiche and ORMS tools
currently}
3 It is recommended for the County to complete
the development of policies and procedures
over electronic public records. These should
address the areas in the draft policy requiring
further development as well as methods to
assess, monitor and enforce the policies and
procedures.
Underway Draft update
by 9/15/15
Risk Management volunteered to be a pilot project.
Based on lessons learned from Risk Management, the
draft Records Management Policy will be updated and
then distributed to departments for input.
7 It is recommended for Departments to
provide retention specific guidance to staff for
frequently encountered areas of retention.
This will be an element of the policy identified in
recommendation #3.
9 It is recommended for IT to assist in vetting
and supporting any electronic records
management systems contemplated.
This will be an element of the policy identified in
recommendation #3.
13 It is recommended for the County to address
texts, social media, website content and usage
of personal devices in its policy for public
records.
Proposed legislation may change state law related to
public records. Staff will continue to monitor proposed
state legislation. Any changes to state law in this area
would be incorporated into the County's records
retention policy.
Follow-up report of Selected Electronic Communications (email and texts) #14/15-11 June 2015
Page 7
Rec # Recommendation Status
Estimated
Date Updated Follow-up Comments
4 It is recommended for current Departmental
policies to be revisited and modified to be
consistent with the revised Countywide policies
and procedures for electronic public records.
Planned to be
determined
This will follow the development of countywide policies
and procedures identified in the previous
recommendation.
5 It is recommended the County provide sufficient
new-hire, initial and ongoing training on County
policies and procedures regarding public
records, retention categories and County
management of public records to adhere to
County and State requirements.
Planned to be
determined
Consultation is already provided by the Clerk's Office
and Legal. Additional training will be developed and
provided once the policies and procedures identified in
the previous two recommendations, as well as
systems to store records, have been more fully
developed.
6 It is recommended this training apply to all
County staff and non-County staff using County
systems unless management has developed
procedures to exempt them.
12 It is recommended for the IT department to
periodically monitor for non-working email
vaults.
Underway Fall 2015 An upgrade of the County's email system is underway.
As accounts are migrated, data that was in the "vault"
is moved to the new system. The new email archive is
mandatory in it application across all accounts. No
user account will be without a functioning archive.
{END OF REPORT}