Condition The City does not have written policies for: – requiring password changes because software does not require the user to change log-ins/passwords periodically. Requiring independent review of payroll and utility rates. Computer usage and internet usage. Also, the computer systems do not lock out a user if the user enters the wrong password a specified number of times. Cause Management has not required written policies for the above computer based – controls. Effect Lack of written policies for computer based systems could result in a loss of – data or compromised data, resulting in unreliable financial information. Recommendation The City should develop written policies addressing the above – items in order to improve the City’s control over its computer systems. Passwords should be periodically changed, independent review should be performed on utility and payroll rates and the computer should lock out users who input their password incorrectly a specified number of times. Response The City will review current policies and procedures and adjust – accordingly. Conclusion Response accepted. – INSTANCES OF NON-COMPLIANCE: No matters were noted. Part III: Findings and Questioned Costs For Federal Awards: INSTANCES OF NON-COMPLIANCE: No matters were noted. INTERNAL CONTROL DEFICIENCIES: No material weaknesses in internal control over the major program were noted. Part IV: Other Findings Related to Required Statutory Reporting: IV-A-17 Certified Budget Disbursements during the year June 30, 2017 exceeded the – amount budgeted in the debt service function. Chapter 384.20 of the Code of Iowa states, in part, monies may not be expended or encumbered except under an “Public annual or continuing appropriation.”
Condition – The City does not have written policies for: requiring password changes because software does not require the user to change log-ins/passwords periodically. Requiring independent review of payroll and utility rates. Computer usage and internet usage. Also, the computer systems do not lock out a user if the user enters the wrong password a specified number of times. Cause – Management has not required written policies for the above computer based controls. Effect – Lack of written policies for computer based systems could result in a loss of data or compromised data, resulting in unreliable financial information. Recommendation – The City should develop written policies addressing the above items in order to improve the City’s control over its computer systems. Passwords should be periodically changed, independent review should be performed on utility and payroll rates and the computer should lock out users who input their password incorrectly a specified number of times. Response – The City will review current policies and procedures and adjust accordingly. Conclusion – Response accepted. INSTANCES OF NON-COMPLIANCE: No matters were noted. Part III: Findings and Questioned Costs For Federal Awards: INSTANCES OF NON-COMPLIANCE: No matters were noted. INTERNAL CONTROL DEFICIENCIES: No material weaknesses in internal control over the major program were noted. Part IV: Other Findings Related to Required Statutory Reporting: IV-A-17 Certified Budget – Disbursements during the year June 30, 2017 exceeded the amount budgeted in the debt service function. Chapter 384.20 of the Code of Iowa states, in part, “Public monies may not be expended or encumbered except under an annual or continuing appropriation.”
17AccuralCitySampleReport_CF464AD923D32.docx