Skip to Content

Login   Subscribe   Site Index   Contact Us   Google Translate™

NYS Comptroller

THOMAS P. DiNAPOLI

Audits of Local Governments and School Districts

Washington County – Information Technology (2012M-34)


Released: July 27, 2012 -- [read complete report - pdf]

Purpose of Audit

The purpose of our audit was to review the County's internal controls over its IT systems for the period January 1, 2010, to September 30, 2011.

Background

Washington County (County) is located in the eastern part of New York State and has a population of 62,000 residents. The County is governed by a Board of Supervisors (Board) which is comprised of the town supervisors for each of the County's 17 towns. The County has a centralized Information Technology (IT) Department that is responsible for providing County departments with the service of analyzing, planning, coordinating, developing, and implementing computer software and hardware; maintaining the County's network; and providing continued technical assistance. The IT Department also is responsible for adding, removing, and modifying network and application user rights at the formal request of department heads.

Key Findings

  • The IT Department has implemented forms for County department heads to request adding, modifying and deleting of user access rights. While we did not find any deficiencies with the timeliness of adding new users, we found that department heads do not always complete these forms when an employee's job changes or they leave County employment. Although the IT Department receives information from the Civil Service Department when an employee leaves County employment, the IT Department does not disable these accounts until instructed by the former employee's department head.
  • The County did not always modify access rights of employees who changed jobs and no longer needed access to the County's network.

Key Recommendations

  • Adopt a comprehensive computer policy that addresses establishing adequate controls over user access rights for current employees and deleting or invalidating user access rights of employees and contractors, in a timely manner.
  • Ensure that County department heads review employees' user access rights to determine whether they have access to only those application functions and sensitive data that are required to perform their job duties and report any changes in user access to the IT Department.

Local Government and School Accountability Contact Information:

Phone: (518) 474-4037; Email: localgov@osc.state.ny.us
Address: Office of the State Comptroller, Division of Local Government and School Accountability
110 State Street, 12th Floor; Albany, NY 12236