10.07.2015 Views

Single Audit Report Fiscal Year Ended June 30, 2012 - State ...

Single Audit Report Fiscal Year Ended June 30, 2012 - State ...

Single Audit Report Fiscal Year Ended June 30, 2012 - State ...

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

<strong>State</strong> of Georgia<strong>Audit</strong>ee’s Corrective Action PlansFor the <strong>Fiscal</strong> <strong>Year</strong> <strong>Ended</strong> <strong>June</strong> <strong>30</strong>, <strong>2012</strong>Finding Control Number: FS-440-12-01ACCOUNTING CONTROLS (OVERALL)Inadequate Supporting Documentation for Adjusting Journal EntriesWe concur with this finding with the following explanation:The auditor provided the Department 5 journal entries as the basis for this finding. The amount disclosed is in the finding wasmerely the absolute value of the debits and credits made in the five entries combined and does not represent the net effect ofamounts being adjusted by the Department . The FARS system uses many offsetting contra accounts which, if not excluded,indicate a larger adjustment than is actually being made.Additionally, the entries questioned were not provided to the Department prior to receipt of this finding, which resulted in theDepartment having no time to respond these matters prior to receipt of the finding in a published document. After review ofthe finding as presented, the Department does not disagree that better documentation could be provided to support theseentries. Had the auditors communicated with Department personnel as questions arose during the audit engagement, theDepartment sincerely believes some or all of the instances noted may have been immediately resolved. For example, in onecase, a spreadsheet was on file in the budget office that provided further documentation for one of the questioned entries thatallocated pooled costs to other program fund ledgers. In another case, an entry was made to reclassify costs among the sameprogram within in the same period of availability among multiple budgeted fund sources of that program. Had the auditorrealized that fact, the basis for that entry would have been clear.The Department will continue to enhance internal control procedures to ensure journal entries are better documented goingforward.Contact Person: John T. Williams, Accounting DirectorTelephone: 404-232-3575 Fax: 404-232-3578 E-mail: JohnT.Williams@dol.state.ga.usFinding Control Number: FS-440-12-02ACCOUNTING CONTROLS (OVERALL)Ineffective Change Management and Logical Access ControlsWe concur, in part, with this finding with the following explanation:In concurring in part, with this finding, the Department wishes to make the following points:1. The Department agrees that the objective of the change management process is to minimize service downtime andmitigate the risk of inappropriate changes by ensuring that requests for changes are recorded, evaluated, authorized,prioritized, planned, tested, implemented, documented and reviewed in a controlled and consistent manner. We alsoagree that change management is a necessary process within IT governance.2. Certain weaknesses may exist, however mitigating controls in place resulted in the immediate resolution of theincident cited in #FS-440-11-6 (prior year).3. No incidents have been reported during this period showed that either inappropriate access and/or changes occurred.4. The Department agrees that certain enhancements will further improve our current process.5. The Department’s strategic direction is to transition critical business systems operating in the legacy mainframeenvironment to a distributed environment to address budgetary constraints.Therefore the investment of additional automated mainframe tools and staffing at this time is not prudent.The Department currently has a formal Change Management process in place. Our current Change Management Processincludes monitoring requests for the following: receipt and validation, testing and approval, scheduling and update (ifapproved), validation of change after update, periodic assessments to determine that no unauthorized changes have beenpromoted to production and segregation of access between development and production environments. In August, <strong>2012</strong>, the320

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!