HomeMy WebLinkAbout2223-2 Personal Information Data Privacy Report (Final 2-14-23)Personal Information Data Privacy report #22/23-2 February 2023
Personal Information
Data Privacy –
Initial Assessment
To request this information in an alternate format, please call (541) 330-4674 or send email to internal.audit@deschutescounty.gov
Deschutes County,
Oregon
The Office of County Internal Audit
David Givans, CPA, CIA – County Internal Auditor
Aaron Kay – Performance Auditor
internal.audit@deschutescounty.gov
Audit committee:
Daryl Parrish, Chair - Public Member
Jodi Burch – Public Member
Joe Healy - Public Member
Scott Reich - Public Member
Summer Sears – Public Member
Stan Turel - Public Member
Patti Adair, County Commissioner
Charles Fadeley, Justice of the Peace
Lee Randall, Facilities Director
Take survey by
clicking HERE
Recommendations
4
Personal Information Data Privacy report #22/23-2 February 2023
TABLE OF
CONTENTS:
HIGHLIGHTS
1. BACKGROUND ON DATA PRIVACY
1.1. Background on the Audit ........................................................................... 1
1.2. Background on Personal Information Data Privacy ……………………….. 1-2
1.3. Background on Oregon Consumer Information Protection Act …….. 2-3
2. FINDINGS and OBSERVATIONS
2.1. Findings and Observations …………………………………………………………… 4-13
3. MANAGEMENT RESPONSES
3.1. County Administration ....................................................................... 14-15
3.2. Information Technology ………….………………………………………………… 15-17
3.3. Sheriff’s Office ………………………….……………………………………………….. 17-18
3.4. Finance Department …………………………………………………………………. 19-20
3.5. 9-1-1 County Service District …………..………………………………………… 20-21
3.6. Solid Waste Department ………………….……………………………………….. 21-22
3.7. Fair & Expo Department ………………………………………………………………… 22
3.8. Road Department …………………………….……………………………………………. 22
3.9. Justice Court ………………………………..………………………………………………… 23
A. APPENDIX A: OBJECTIVES, SCOPE, AND METHODOLOGY
i. Objectives and Scope .......................................................................... 23-24
ii. Methodology ............................................................................................. 24
Personal Information Data Privacy report #22/23-2 February 2023
HIGHLIGHTS
Why this audit was
performed:
An initial assessment of
handling of personal
information data
privacy.
What was
recommended:
Recommendations
include:
• assigning an employee
over the personal
information security
program to oversee
training and
compliance;
• deploying appropriate
technology for
communicating and
sharing PI;
• reducing the amount
of PI being collected or
retained; and
• updating policy GA-9
for legislative changes.
Personal Information Data Privacy - Initial Assessment
This initial assessment of personal information data privacy was to demonstrate a
commitment to and thoughtful protection of personal information (PI).
What was found
Overall, the County demonstrated a strong grasp of data privacy handling and only a couple
of areas resulted in recommendations. Staff in departments/offices handling personal
information exceed 99% of County staff. The County’s departments/offices that deal with
HIPAA or law enforcement were unilaterally found to have greater awareness and
procedures.
The audit identified the following areas for further improvement, including:
• additional administrative safeguards could help with personal information
awareness;
• department/office utilization of technology with personal information could be
strengthened;
• some departments/offices retain or collect personal information they do not need;
and
• county policy does not reflect update to statute.
Deschutes County Internal Audit
Personal Information Data Privacy report #22/23-2 February 2023
Page 1
1.1 BACKGROUND ON THE AUDIT
1.
Introduction
Audit Authority:
The Deschutes County Audit Committee authorized the review of personal information data privacy
in the Internal Audit Program Work Plan for 2022-2023. The scope of this audit is anticipated to
cover most County departments/offices. This is the first audit of this topic at the County. Audit
objectives, scope, and methodology can be found in Appendix A.
1.2 BACKGROUND ON PERSONAL INFORMATION DATA PRIVACY
Personal information (PI) is data that distinguishes an individual, such as full legal name, driver’s
license, or social security number. Additional risk comes with additional pieces of personal data.
Generally, one piece of personal information alone cannot be used to steal a person’s identity. It’s
the various pieces put together that risks compromise of an individual’s identity.
Governmental entities collect many types of personal information, related to and including:
• services to the public,
• vendor payments, and
• employee management.
This information ranges widely in sensitivity and use. When individuals provide information of any
kind to the County, they may wonder how the County will use that information and whether it will
be secure in the County’s possession. As identity theft and cyber-security threats have become all
too common, these concerns are quite valid.
A privacy assessment can pose a series of questions to help stakeholders identify and understand
any risks their systems may pose to the privacy of personal information. Performing this kind of
assessment demonstrates a commitment to and thoughtful analysis of protection of personal
information. It also allows a proper response should there be a privacy breach.
Personal Information Data Privacy report #22/23-2 February 2023
Page 2
This initial assessment was developed to gain an understanding of the County’s maturity in
addressing various privacy topics as well as compliance with Oregon laws. Assessment topics
covered in discussions with County departments/offices included:
a) identification of whether personal information is being collected;
b) collection and purpose of data;
c) access and use of data;
d) sharing and/or transfer of data;
e) providing consent (or declination of) rights and disclosure of data;
f) storage and disposal of data (physical and electronic); and
g) privacy analyses being performed.
1.3 BACKGROUND ON OREGON CONSUMER INFORMATION PROTECTION ACT
The County has acknowledged and developed a policy G-9: Consumer Identity Theft Protection in
response to the Oregon Consumer Information Protection Act (Act) (ORS 646A.600 et seq). The Act
provides clear direction and expectations to ensure the safety of sensitive personal information
data.
The Act applies to covered entities (such as Deschutes County) that may own, maintain, store,
manage, collect, process, acquire or otherwise process personal information in the course of
business.
In Oregon, personal information (PI) is defined by this law as including a consumer’s first name and
last name (or first initial and last name) in combination with one or more of the consumer’s:
• social security number;
• driver’s license number (or state ID card number);
• consumer medical and/or mental health history;
Personal Information Data Privacy report #22/23-2 February 2023
Page 3
• health insurance policy number with another unique identifier (i.e. date of birth);
• biometric measures (i.e. fingerprints) used to authenticate financial transactions;
• credit or debit card number with security code;
• passport number (or other US issued identification number);
• financial account number with password; and/or
• user name(s) for accessing consumer accounts.
Other fields deemed supporting for verification include:
• date of birth;
• maiden name; and/or
• mother’s maiden name.
The Act requires applicable entities to develop, implement, and maintain reasonable safeguards to
ensure the security, confidentiality, and integrity of personal information. Safeguarding also means
properly disposing of information. The Act outlines steps to help implement an information security
program to help minimize breach risks. Those include:
• assessing extent and risks of having personal information;
• protecting personal information;
• reducing personal information;
• training on personal information safeguards;
• detecting risks with personal information;
• preparing for breaches with personal information; and
• destroying personal information no longer needed.
A security program should include administrative, technical, and physical safeguards. A breach of
security is allowing unauthorized acquisition of computerized data that materially compromises the
security, confidentiality, or integrity of personal information being safeguarded. The Act stipulates
what should be done if a breach occurs.
Personal Information Data Privacy report #22/23-2 February 2023
Page 4
2.
Findings and
Observations
The audit included limited procedures to understand personal information data privacy at the
County. No significant deficiencies were found in this audit. A significant deficiency is defined as an
internal control deficiency that could adversely affect the entity’s ability to initiate, record, process,
and report financial data consistent with the assertions of management in the financial statements.
The findings noted were primarily compliance and efficiency matters.
Audit findings result from incidents of non-compliance with stated procedures and/or departures
from prudent operation. The findings are, by nature, subjective. The audit disclosed certain policies,
procedures and practices that could be improved. The audit was neither designed nor intended to
be a detailed study of every relevant system, procedure, or transaction. Accordingly, the
opportunities for improvement presented in the report may not be all-inclusive of areas where
improvement may be needed and does not replace efforts needed to design an effective system of
internal control.
Management has responsibility for the system of internal controls, including monitoring internal
controls on an ongoing basis to ensure any weaknesses or non-compliance are promptly identified
and corrected. Internal controls provide reasonable but not absolute assurance that an
organization’s goals and objectives will be achieved.
2.1 FINDINGS AND OBSERVATIONS
Collection of Personal Information
As one might expect, given the significant health and law enforcement services provided by the
County, there is a lot of personal information collected, stored, managed, and destroyed. Staff in
departments/offices handling personal information exceed 99% of County staff. The
departments/offices with HIPAA and law enforcement level requirements over personal information
exceed 78% of County staff. These requirements further strengthen adherence to best practices
Personal Information Data Privacy report #22/23-2 February 2023
Page 5
DIAGRAM I –
Prevalence of PI
fields in County
departments/offices
by area
(and FTE size).
Legend
HIPAA or Law
enforcement
level of PI
Regular PI
regarding handling of personal information and these departments/offices were found to be much
more attuned to the importance of protecting this information. Many of these departments/offices
receive routine external audits, training, and certifications that reinforce privacy.
* OTHER includes less frequent personal information such as: health insurance number, biometric info, credit card
information, and/or passport ID.
Personal Information Data Privacy report #22/23-2 February 2023
Page 6
ASSESSMENT
TABLE I
* See recommendation that follows being made to further strengthen this area.
Additional administrative safeguards could help with personal information
awareness.
A number of departments/offices struggle with training on privacy, especially if they don't
have additional security over PI or protected health information (PHI). This is further
exacerbated when there is not an assigned employee over the security program who can
assist with training.
The Oregon Consumer Information Protection Act (Act) sets expectations for a security
program that includes training as well as having employees identified as security officers.
Training includes aspects of security program practices and procedures with reasonable
regularity.
County Policy (GA-9) directs departments/offices to assign “an employee to coordinate the
security program, identifying internal and external risks, and training employees.”
Some County departments/offices have not formalized a response to the policy through
appointment of a point person and providing the specific training called for in the Act.
In the absence of proper training, there could be inconsistent implementation of policy.
Having responsibilities for HIPAA and/or law enforcement doesn’t assure the Act’s
Personal Information Data Privacy report #22/23-2 February 2023
Page 7
ASSESSMENT
TABLE II
requirements to protect personal information are covered.
It is recommended for the County departments/offices to assign an employee over each
department’s/office’s personal information security program who will also be responsible
for establishing appropriate training and compliance with County policy.
Access and use of personal information data
County departments/offices according to their operations and services have established systems
and access to protect their respective personal information. As an example: from discussions with
staff, they were not aware of any intrusions.
All County departments/offices receive this personal information to provide the services they do in
coordination with state and federal agencies. For some situations, services can only be provided
with consent and personal information provided. The County departments/offices have established
sufficient technology to collect and control the data.
Sharing and/or transfer of personal information data
The County departments/offices are deliberate with how they share or transfer personal
information data with other internal or external organizations.
Personal Information Data Privacy report #22/23-2 February 2023
Page 8
ASSESSMENT
TABLE III
* See recommendation that follows being made to further strengthen this area.
Department/office utilization of technology with personal information
could be strengthened.
Overall, the County has sufficient technology to employ safeguards over personal
information. There are some areas noted where the usage of technology could be improved
through:
• further restricting access to personal information on shared network drives. In
general, departments/offices should limit access to only appropriate staff.
• considering appropriate technology for communicating personal information
internally. In general, emails can be a riskier option for such communication. Though
the County use of the MS365 (government) platform provides sufficient technical
security for HIPAA and law enforcement, it may not protect for inadvertent emails to
the wrong party.
• considering additional technological options for customers, some customers without
being provided options might resort to sharing personal information by email or text.
The Oregon Consumer Information Protection Act (Act) calls for assessing, in light of current
technology, risks of information collection; storage; usage; retention; access and disposal; and
implementing reasonable methods to remedy or mitigate identified risks.
Departments/offices are not always identifying the risks and exploring technology options
with information technology staff (County or department/office) for responding to these risks.
Personal Information Data Privacy report #22/23-2 February 2023
Page 9
ASSESSMENT
TABLE IV
In the absence of appropriate solutions, customers and staff may rely on inappropriate
technology for communicating or sharing personal information.
It is recommended for departments/offices to consider the risks and develop and/or deploy
technology appropriate to the situation for communicating and sharing personal
information.
{Note: Preliminary discussions on technology offered up potential solutions that might include
using: restricted shared drives, FTP portals, OneDrive, web applications, and/or encrypted email.}
Consent rights and disclosure of personal information
Generally, outside of HIPAA, the Oregon Consumer Information Protection Act (Act) does not require
a person’s consent regarding personal information nor require informing the person on disclosure.
County departments/offices utilize appropriate approaches based on the services they provide.
Storage and disposal of personal information data (physical and electronic)
The County departments/offices provide sufficient safeguards over data, whether it be electronic or
in physical form. The County has retention schedules that dictate how long data is supposed to be
retained.
Personal Information Data Privacy report #22/23-2 February 2023
Page 10
ASSESSMENT
TABLE V
* See recommendation that follows being made to further strengthen this area.
Some departments/offices retain or collect personal information they do
not need.
Some departments/offices collect customer personal information fields included in forms
they do not need. In many cases they redact the information as it is received. In addition,
some departments/offices have older personal information from employee applications and
management of employees and keep those in personnel files held in the department/office.
Departments/offices appear to be providing sufficient security over the physical personnel
files, however with these files comes responsibility to address document retention and
associated risks of having such data.
The Human Resources Department has responsibility for personal information in personnel
files, and it could be an additional risk for departments/offices to continue to hold onto older
files with personal information. Best practices for personal information include reducing
exposure by not retaining personal information you no longer need.
Before the use and implementation of personal information policies, many County
departments/offices retained copies of their own staff’s personnel information or because of
requirements for the position require certain personal information. For example, many
departments/offices have employees driving on County business and need to oversee the
status of their driver’s licenses.
Personal Information Data Privacy report #22/23-2 February 2023
Page 11
ASSESSMENT
TABLE VI
Having duplicated or additional personal information in departments/offices could result in
additional risks and administrative burdens to departments/offices.
It is recommended County departments/offices consider whether they are following policies
and could reduce the amount of personal information they collect or retain and make
changes to associated processes.
Privacy analyses performed on personal information data
Many County departments/offices have the need and may utilize personal information in analyses.
Analyses help inform departments/offices on the services being performed. Staff performing
analyses make efforts to limit the amount of PI they utilize and make sure any personal information
is not inappropriately reported.
Other safeguards in Oregon Consumer Information Protection Act (Act)
There are a couple of other safeguards included in the Oregon Consumer Information Protection
Act (Act) that were also inquired about and not addressed in the above assessments. Those include:
Personal Information Data Privacy report #22/23-2 February 2023
Page 12
ASSESSMENT
TABLE VII
County Policy does not reflect update to statute.
County policy (GA-9) was developed with the initial Consumer Identity Theft Protection Act
(created in 2008). The policy has not been updated since the Act was modified in 2019 to be
the Oregon Consumer Information Protection Act.
In 2019, Oregon adopted SB 684 to update some of the provisions of the Consumer Identity
Theft Protection Act to now be known as the Oregon Consumer Information Protection Act.
The amended short title mirrors the national (and international) trend of expanding laws
beyond mere “identity theft protection” to focus on larger scale consumer privacy and data
rights. Key substantive changes in the revision include:
• revising the title of the Act;
• extending breach notification obligations to “vendors,” defined as entities who contract
Personal Information Data Privacy report #22/23-2 February 2023
Page 13
with a covered entity to “maintain, store, manage, process or otherwise access
personal information;”
• expanding the definition of “personal information” to include user names and
passwords or similar means to access an individual’s account (i.e. disclosure of
usernames and passwords alone is now sufficient to trigger breach notification
obligations); and
• expanding the definition of “breach of security” to cover personal information a person
“maintains or possesses.”
County Policy GA-9 (from 2008) for Consumer Identity Theft Protection refers to the older
statutory title, whereas it should be now known as the Oregon Consumer Information
Protection Act as well as address the changes as noted above.
It does not appear the County identified the policy for update from this legislative change.
In the absence of the updated language of the Act, there could be inconsistent adherence to
the underlying Act.
It is recommended the County update policy GA-9 to reflect the substantive changes from
the revised Oregon Consumer Information Protection Act.
Personal Information Data Privacy report #22/23-2 February 2023
Page 14
3. Management responses
3.1 County
Administration
Erik Kropp,
Deputy County
Administrator
Personal Information Data Privacy report #22/23-2 February 2023
Page 15
County
Administration
continued
3.2 Information
Technology
Whitney Hale,
Deputy County
Administrator
(Interim IT
Director)
Date: February 3, 2023
To: David Givans, County Internal Auditor
Personal Information Data Privacy report #22/23-2 February 2023
Page 16
Information
Technology
continued
From: Whitney Hale, Interim IT Director, Deputy County Administrator
Subject: Response to Data Privacy Audit
_____________________________________________________________________________________________________
Thank you for the detailed review of personal information data privacy. We recognize the
importance of protecting data privacy. The Information Technology Department will continue to
support departments, when requested, with tools to meet their business needs related to data.
Recommendation #1 - It is recommended for the County departments/offices to assign an
employee over each department’s/office’s personal information security program who will
also be responsible for establishing appropriate training and compliance with County policy.
IT will discuss how to best implement this recommendation internally.
Recommendation #2 - It is recommended for departments/offices to consider the risks and
develop and/or deploy technology appropriate to the situation for communicating and
sharing personal information.
IT supports this recommendation. We have successfully partnered with many departments on
safeguards related to personal information and have created documented processes that can be
shared and adapted for use by other teams.
Staff does want to share feedback on the recommendation that relates to restricting shared drives.
At times, adding additional security constraints to shared drives can interfere with staff’s day to day
tasks. Today, the County’s shared drives are secure at the business unit level. IT recommends that
they maintain this level of security and that, if needed, departments work with IT to develop
reporting so that managers can periodically monitor utilization of shared drives.
Personal Information Data Privacy report #22/23-2 February 2023
Page 17
Information
Technology
continued
3.3 Sheriff’s
Office
Zachary
Neemann,
Lieutenant
Recommendation #3 - It is recommended the County departments/offices consider whether
they are following policies and could reduce the amount of personal information they collect
or retain and make changes to associated processes.
We agree with this recommendation and can support departments / offices as requested with data
reviews.
Recommendation #4 - It is recommended the County update policy GA-9 to reflect the
substantive changes from the revised Oregon Consumer Information Protection Act.
IT agrees with this finding and will support Administration in any necessary Policy Updates, as
requested.
Personal Information Data Privacy report #22/23-2 February 2023
Page 18
Sheriff’s Office
continued
Personal Information Data Privacy report #22/23-2 February 2023
Page 19
3.4 Finance
Department
Robert Tintle,
CFO
Personal Information Data Privacy report #22/23-2 February 2023
Page 20
Finance
Department
continued
3.5 9-1-1
County Service
District,
Sara Crosswhite,
Director
Recommendation 1, assigning an employee over the personal information security program to
oversee training and compliance -
Agree with recommendation, but feel we need a bit more understanding of the Oregon Consumer
Information Protection Act, and once we have a review internally, we will understand what is needed
for the assigned employee as well as the training component. Our goal is to have this completed by
March 15, 2023.
Recommendation #2, departments/offices to consider the risks and develop and/or deploy
technology appropriate to the situation for communicating and sharing personal information.
Agree. The District currently has secure/share drives with our LE/DA/Fire departments where
information is shared if needed. Emails are not sent with personal information but our I.T. team will
be evaluating an option of encrypted email in certain circumstances.
Personal Information Data Privacy report #22/23-2 February 2023
Page 21
9-1-1 County
Service District
continued
3.6 Solid Waste
Department,
Sue Monette,
Management
Analyst
Recommendation #3, It is recommended the County department/offices consider whether they are
following policies and could reduce the amount of personal information they collect or retain and
make changes to associated processes.
Agreed. Personal information that is kept on site related to employment is in a secure file cabinet
and in a locked office. Documents that are stored here are related and necessary to Department of
Public Safety Standards and Training certifications for our staff. If staff is no longer with the District
those files are sent to archiving.
Recommendation #4, It is recommended the County update policy GA-9 to reflect the substantive
changes from the revised Oregon Consumer Information Protection Act.
Agreed. If there are revisions to the Oregon Consumer Information Protection Act that Departments
should be following it should be reflected in our policy.
Recommendation 1, assigning an employee over the personal information security program to
oversee training and compliance -
Current Practice: User security access to Solid Waste specific software programs are managed by the
Management Analyst. This person also maintains security over the
Department personnel records and ensures compliance with policies and procedures for other
records containing personal information in the department. The Operations Manager trains
employees on proper procedures for handling customer credit card information.
Recommendation #2, departments/offices to consider the risks and develop and/or deploy
technology appropriate to the situation for communicating and sharing personal information.
Current Practice: The Department of Solid Waste utilizes a secure FTP site and other tools as needed
when sharing personal information. Recently Implemented: Based upon feedback from the internal
audit on personal information data privacy meeting, the Department recently created a new
Personnel folder on the network drive, secured and accessible to only management, in order to
move to electronic storage of relevant/necessary personnel records.
Personal Information Data Privacy report #22/23-2 February 2023
Page 22
Solid Waste
Department,
continued
3.7 Fair & Expo
Department,
Geoff Hinds,
Director
3.8 Road
Department,
Keli Candella,
Administrative
Supervisor
Recommendation #3, It is recommended the County department/offices consider whether they are
following policies and could reduce the amount of personal information they collect or retain and
make changes to associated processes.
Recently Implemented: The Department of Solid Waste is implementing an archive policy to ensure
compliance with retention guidelines and has actively started reviewing saved records. Those needing
to be retained are scanned and then storage boxes marked with retention dates; others outside the
retention dates are being destroyed. In addition, records that are not necessary to Department
function that contain personal information maintained elsewhere, such as in Human Resources, are
being destroyed. Going forward, new hire forms electronically submitted to Human Resources will be
destroyed upon successful delivery.
Recommendation 1, assigning an employee over the personal information security program to
oversee training and compliance -
Fair & Expo will identify an employee to oversee the departments personal information security
program, and to identify and establish appropriate training and safeguards in compliance with
County policy and current best practice. Until or unless otherwise identified in the future, this person
shall be the Director, Fair & Expo.
Recommendation #2, departments/offices to consider the risks and develop and/or deploy
technology appropriate to the situation for communicating and sharing personal information.
Fair & Expo will work to continuously improve and utilize best practices and to identify and obtain
technology which can improve the safeguarding of shared personal information whenever available.
Recommendation 1, assigning an employee over the personal information security program to
oversee training and compliance
I will be the Department’s liaison and take on the department’s/office’s personal information security
program. Once the County has a policy and training in place, I will be responsible for training our
department personnel.
Personal Information Data Privacy report #22/23-2 February 2023
Page 23
3.9 Justice
Court,
Judge Charles
Fadeley
Justice Court agrees with the recommendation. Justice Court staff follows all County policies
concerning personal information security. Additionally, staff must be certified biannually in
information security best practices as a requirement to access CJIS and LEDS. Court Administrator
Jodi Stacy is the JC employee responsible for establishing appropriate training and compliance with
County policy.
i. OBJECTIVES and SCOPE
Appendix A:
Objective,
Scope, and
Methodology
“Audit
objectives” define
the goals of the
audit.
Objectives included:
1) Assess whether the County has adequate controls to protect personal information/data from
unauthorized access and use. This would include:
a) identification of whether personal information is being collected;
b) collection and purpose of data;
c) access and use of data;
d) sharing and/or transfer of data;
e) consent (or decline) rights and disclosure of data;
f) storage and disposal of data (physical and electronic); and
g) privacy analyses being performed.
2) Be aware of any issues with compliance with federal and state regulations and requirements, as may
be applicable.
Scope and timing:
The audit began in August 2022 and extended through December 2022. This audit includes County
operations thought to be collecting personal information. The scope of personal information
includes members of the public receiving County services; County employees and volunteers; and
County vendors. The scope did not go so far as protected health information. As an initial
Personal Information Data Privacy report #22/23-2 February 2023
Page 24
assessment, the inquiry did not go further than interviews and review of topics.
The scope of the audit did not include all aspects of the internal controls employed.
ii. METHOOLOGY
“Audit procedures
are created to
address the audit
objectives”
Audit procedures included:
• interviews and observation of selected departmental/office employees and other procedures
as deemed necessary;
• developing and utilizing privacy assessment tools to collect privacy information from
departments/offices (some of the tool developed was more reaching than the Oregon
Consumer [Identity Theft] Information Protection Act);
• analyzing results of collected information to identify gaps and needs;
• reviewing of legal and statutory frameworks around privacy to identify areas for assessment;
and
• reviewing County policy and practices around privacy.
We conducted this performance audit in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and conclusions based on our
audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives.
(2018 Revision of Government Auditing Standards, issued by the Comptroller General of the United States. GAO-21-368G)
The County Internal Auditor was created by the Deschutes County Code as an independent office
conducting performance audits to provide information and recommendations for improvement.
Personal Information Data Privacy report #22/23-2 February 2023
Page 25
{End of Report}
Please take a survey on this report by clicking on the attached link:
https://www.surveymonkey.com/r/PI_Data_Privacy
If you would like to receive future reports and information from Internal Audit or
know someone else who might like to receive our updates, sign up at http://bit.ly/DCInternalAudit.