[read complete report - pdf]

Audit Objective

Determine whether the Board ensures that information technology (IT) assets are properly safeguarded and accessed for appropriate Town purposes.

Key Findings

The Board has not:

• Adopted an acceptable use policy; we found evidence of personal use on four of the six computers examined.
• Adopted a disaster recovery plan or formal backup procedures.

In addition, sensitive IT control weaknesses were communicated confidentially to Town officials.

Key Recommendations

• Adopt an acceptable use policy describing inappropriate and acceptable use.
• Develop, adopt and implement a disaster recovery plan and formalize backup procedures.

Town officials agreed with our recommendations and indicated they planned to initiate corrective action.