2020 Management Letter - Laserfiche WebLink

Home

-2- FOLLOW-UP ON PRIOR YEAR FINDINGS AND RECOMMENDATIONS As a part of our audit of the City’s financial statements for the year ended December 31, 2020, we performed procedures to follow-up on the findings and recommendations that resulted from the prior year audit. The prior auditor reported the following findings that are no longer findings in the current year audit of the City: • The prior year audit reported that the City was not performing utility billing reconciliations to account for total billings and receipts into the City’s general ledger system. It also noted that the 4th quarter utility billing was not booked. This is not a finding in the current year. • The prior year audit reported there were several material audit adjustments that needed to be posted to the City’s general ledger in order to arrive at the correct year -end balances. There were no material adjustments made in the current year. OTHER OBSERVATIONS AND RECOMMENDATIONS Check Sequence During the audit of the current year, we noted during our testing that the Mayor was signing checks in advance in case she was absent or unavailable when checks need to be processed. We communicated to management of the City that this practice should be discontinued and the City Council should authorize another employee to sign checks in the Mayor’s absence. Electronic Funds Transfers Fraud As the use of electronic funds transfers and payment methods has become more prevalent, we have seen increases in both the incidences of fraud related to these transactions and the dollar amounts involved. Operational changes related to the COVID-19 pandemic, including greater reliance on technology and more employees working remotely, have tended to increase risk in this area. We urge cities to carefully review controls over these transactions, and consider best practices to address these risks, such as: • Ensuring segregation of duties over these transactions by involving more than one employee in the process. • Requiring multi-factor authentication of requests for electronic payments from new vendors or for changes in wiring instructions for existing vendors. It is recommended that changes for existing vendors be verified through trusted contact information used previously for that vendor, not as provided in the change request, to verify the accuracy of the change. • Educate employees on the controls in place to protect the organization’s financial assets and ensure management is supportive and accepting of the processes in place. Attempted fraudulent transactions are often initiated using the profile of a supervisor. Employees must be comfortable questioning unusual transactions or requests, and instructed not to circumvent internal control procedures regardless of whom they believe initiated the transaction. • Recommended cyber security measures, such as limiting network access and requiring robust passwords that are changed regularly, should be implemented and followed by all city employees, not just those directly involved with financial transactions. • Review insurance policies to understand the coverage provided for financial loss es due to cybersecurity risks and evaluate whether they provide adequate coverage based on management’s assessment of these risks.