June 15, 2009 - District of Mission

188
District of Mission — 2008 Audit Results and Communication
Page 9
We recommend that a formal policy be implemented where the IT department reviews user privileges
for systems and MAIS every 6 months.
District's Response: Finance is more conversant than IT in terms of MA'S access, therefore has
historically taken on the role of MA'S access administration. All MAIS access is periodically
reviewed when setting up new employees, changing passwords or performing other administration.
There has not been a lot of employee movement to warrant a more formal approach for reviewing
MAIS access.
IT handles access privileges for our other systems. Access rights are generally established by group
and when a person enters or transfers from a group access rights change. Not a lot of employee
movement has occurred at the higher level access areas. We do not see the need for a more formal
approach within MA'S or our other systems at this time.
3. Generic IT user access
Currently a generic username and password is used for printing cheques. Although the username and
password are only known to three Finance staff, there is the issue that cheques printed cannot be
traced back to the individual person who printed the cheques. If unauthorized cheques are printed,
the District would not be able to trace the occurrence to a particular staff member and this reduces
accountability.
We recommend that individual usemames and passwords to be setup for each staff member that will
be doing cash disbursements. Therefore, each user will have their own username and password to
print cheques.
District's Response: The accounts payable final cheque register shows the individual person's name
who produced the cheques, as each person signs on to MAIS (from one terminal) with a distinct user
name and password when producing accounts payable cheques. The individual who prints the
cheques also signs off on a manual cheque voucher reconciliation form immediately after printing
cheques. This form, together with the final cheque register, are both signed off by the Director of
Finance or his designee.
There is currently a programming issue related to the formatting of accounts payable cheques,
therefore, the cheques are run on one terminal that has one common user name and password;
however, as noted above individual user names and passwords are required to access MAIS to
actually run accounts payable cheques. The Information Services department will be looking into this
formatting issue.
4. GST
In early 2004 GST legislation was changed to allow municipalities to claim a 100% rebate. Because
of this change many supplies made by municipalities became subject to GST, such as licenses for real
property. GST has not been collected on some licenses for real property from the time the legislation
was changed until 2008.
During the audit in 2008, it was found there was approximately $3,505 in amounts owing to CRA for
GST that should have been collected in previous years and in 2008. Although from a financial
statement audit standpoint the amount is not significant, under a CRA audit the District could be
assessed interest for the period from when the tax should have been remitted up to the point in time it
is included in a subsequent return.