Cash and Internal Controls Audits, District Attorney April 2021 Follow Up Cash Procedures and Internal Control Audit Report

COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER – TAX COLLECTOR District Attorney Cash Procedures & Internal Controls Follow-Up Audit April 2021 JAMES W. HAMILTON, CPA Auditor-Controller Treasurer-Tax Collector Page 1 of 4 COUNTY OF SAN LUIS OBISPO AUDITOR - CONTROLLER TREASURER - TAX COLLECTOR James W. Hamilton, CPA Auditor-Controller Treasurer-Tax Collector Lydia J. Corr, CPA Assistant Auditor-Controller Treasurer-Tax Collector TO: DAN DOW, DISTRICT ATTORNEY FROM: JAMES W. HAMILTON, CPA, AUDITOR-CONTROLLER-TREASURER-TAX COLLECTOR DATE: APRIL 27, 2021 SUBJECT: FOLLOW-UP TO RECOMMENDATIONS MADE IN THE DISTRICT ATTORNEY’S FY 2019- 20 CASH PROCEDURES AND INTERNAL CONTROLS AUDIT REPORT Our office previously issued a cash procedures and internal controls audit report of the District Attorney’s office in October 2019. We recently performed a follow-up audit to determine whether the recommendations made in our initial report were implemented. We conducted our follow-up audit in conformance with the International Standards for the Professional Practice of Internal Auditing. We determined one of the three recommendations were implemented. Detailed below are the findings and recommendations from the October 2019 audit report and the results from our follow- up. Your Department’s proposed corrective actions on the two remaining recommendations are also included. The Internal Audit Division will perform follow-up procedures within six months to verify appropriate actions have been taken to address the remaining recommendations. 1. Segregation of Cash Handling Duties (October 2019 Report Finding) In one of the District Attorney’s divisions, the cash custodians receive, record, deposit, and reconcile payments. The County’s Cash Handling Policy requires adequate separations of these duties to ensure that no one individual controls more than one key aspect of a cash transaction. Minimal fiscal staff within the division hindered the separation of cash handling responsibilities. However, when one individual performs more than one aspect of cash handling then the risk of misappropriation and mishandling of funds increases. Recommendation (October 2019 Report Recommendation) We recommend the department have a non-fiscal staff member who does not accept payments review the payment deposits prepared by the cash custodians. Follow-up Results The audit recommendation was not implemented. Two out of five sampled deposit permits did not document a review of the deposits. Department Response The District Attorney’s office has appropriate checks and balances implemented through segregation of cash handling duties in all cash handling divisions, however, needs to add an additional segregation of duties to Economic Crime unit’s cash handling procedure. This unit Page 2 of 4 consists of only 2.00 FTE. Due to limited number of staff, medical leaves, staffing assignment changes, and COVID-19 impacts, the unit had not successfully implemented the recommendations of the prior audit, as we discovered through communications on this follow up audit. The Economic Crime unit will update their procedures to reflect the recommended segregation of cash handling duties in order to implement more checks and balances. The procedure will be updated to include that the cash custodians will attach the appropriate and necessary backup documentation into the deposit permit in SAP. Then, a designated fiscal member in the Finance Division or Eco Crime unit, that did not accept any of the payments and did not create the deposit permit, will review the backup documentation that was scanned into SAP to verify that it matches the deposit in SAP, and then save-as-complete (SAC) the deposit permit. The Auditor-Controller-Treasurer-Tax Collector’s Department will then post the deposit permit. 2. Computers Periodically Unsecured (October 2019 Report Finding) At the time of the cash count, staff were not locking their computers when their workstations were unattended. Further, the computer’s automatic locking function did not activate until after one hour of inactivity. The County's Information Security Program Policies (Policy) require users log off the network when leaving their workstations for an extended amount of time, and automatic password-protected screensavers be activated when computers are inactive for 10 minutes. Staff had overlooked the Policy’s security requirements of their computers because the department maintains robust physical security around work areas. Despite the department’s strong work area security, the failure to lock computers when not in use could result in unauthorized access to computers and the unauthorized use, modification and/or destruction of data. Recommendation (October 2019 Report Recommendation) We recommend the District Attorney's office emphasize to staff the County’s Information Security Program Policy’s workstation security requirements and update the default computer setting to initiate a password-protected screensaver after 10 minutes of inactivity. Follow-up Results The audit recommendation was implemented. 3. Victim Witness Assistance Fund’s Payment Receipts Not Marked “Paid” (October 2019 Report Finding) None of the receipts submitted for reimbursement from the District Attorney’s Victim Witness Assistance petty cash fund were marked as “paid”. The Cash Handling Policy requires petty cash related receipts be marked as “paid” immediately after reimbursement is made. Staff inadvertently overlooked the Cash Handling Policy’s control for payment receipt documentation. Failure to mark receipts "paid" increases the risk of loss due to misappropriation of funds by reimbursing a receipt multiple times. Page 3 of 4 Recommendation (October 2019 Report Recommendation) We recommend the department update the Victim Witness Assistance Fund’s petty cash custodian procedure to align with Cash Handling Policy and all future receipts be marked “paid” immediately upon reimbursement. Follow-up Results The audit recommendation was not implemented. Four of the five receipts tested were not marked as “paid” immediately after reimbursement was made. Department Response After the cash custodian has completed the reimbursement, they will stamp the receipt immediately as ‘paid’, and initial the receipt. The back-up cash custodian will verify this by the close of the business day when the cash box is being reconciled. The procedure has been updated and implemented to include these recommendations of this audit and to align procedures with the Cash Handling Policy. Annually, or immediately upon appointment to a position with cash handling duties, staff are required to sign the Cash Handling Policy Acknowledgment Form via NeoGov E-Forms confirming that they have read and understand the Cash Handling Policy. The District Attorney financial team will conduct semi-annual reviews with the Victim Witness Director to confirm staff are correctly following the updated procedure and that new staff have been trained on this procedure. Thank you for the courteous attitude and the continued cooperation your staff provided. James Hamilton, CPA Auditor-Controller-Treasurer-Tax Collector Cc: Tiffany Johansing, Administrative Services Manager Page 4 of 4