Coconino County management letter: year ended June 30,...

              I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
."' ..... 1;- •.•.• ,
CoconinoConnty
Management Letter .
Year Ended June 30, 2006
RECEI\/ ED
Sincerely,
Should you have any questions concerning its contents, please let us know.
In planning and conducting our single audit of Coconino County for the year ended June
30, 2006, we perfonned the following as required by Government Auditing Standards
( GAS) and Office ofManagement and Budget ( OMB) Circular A- 133:
Tel: ( 602) 264- 3077
Fax: ( 602) 265- 6241
4001 North 3rd Street
Suite 275
Phoenix, Al. 85012- 2086
Members of the Board:
December 4, 2007
Board of Supervisors
Coconino County
219 East Cherry Avenue
Flagstaff, AZ 86001
This letter is intended solely for the infonnation of the Coconino County Board of
Supervisors and is not intended to be and should not be used by anyone other than the
specified party. However, this letter is a matter of public record, and its distribution is
not limited.
All audit findings that are required to be reported by GAS and OMB Circular A- 133 have
been included in the County's Single Audit Reporting Package for the year ended June
30, 2006. In addition, our audit disclosed internal control weaknesses and instances of
noncompliance with laws and regulations that do not meet the reporting criteria.
Management should correct these deficiencies to ensure that it fulfills its responsibility to
establish and maintain adequate internal controls and comply with laws and regulations.
Our recommendations are described in the accompanying summary.
• Considered the County's internal controls over financial reporting,
• Tested its internal controls over major federal programs, and
• Tested its compliance with laws and regulations that could have a direct and material
effect on its financial statements and major federal programs.
In addition, as required by Arizona Revised Statues   41- 1279.21( A)( 1), we reviewed the
County's financial records to evaluate whether the County used Highway User Revenue
Fund monies and any other dedicated state transportation monies solely for authorized
transportation purposes for the year ended June 30, 2006. We noted no instances of
noncompliance during our review.
Fester~ h ~ c apman P. C.
certified
Public
Accountants
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
' I
: 1
, I
I
I
I
I
I
I
I
I
I
I : 1
: 1
II
, I
I
The County needs to document and test its disaster recovery plan
The County uses a computerized accounting system to process its financial transactions
and maintain its accounting records. Therefore, it is vital for the County to ensure that it
can continue to operate in the event of a system or equipment failure by developing,
implementing, and testing a disaster recovery plan. A properly designed disaster
recovery plan helps ensure that proper procedures are in place to provide for continuity of
operations and that electronic data files are not lost in the event of a disaster. However,
the County did not have a written disaster recovery plan for processing critical jobs or
written backup agreements for systems critical to the County's operations. Without such
plans or agreements, fmancial transactions might not be adequately processed if a disaster
occurred. In addition, the County did not monitor access to the computer room and did
not store its backup files in a secure off- site location.
To help ensure that the County can provide for the continuity of its operations and to help
prevent loss of data in the event of a major system or equipment failure, the County
should develop, document, and test a disaster recovery plan. The plan should list the
personnel assigned to disaster teams and each team member's emergency phone number;
operating procedures; arrangements for a designated physical facility; a risk analysis
identifying the critical applications, exposures, and an assessment of the impact on the
County; arrangements with vendors to support the needed hardware and software
requirements; and any necessary documents and forms. Further, this plan should be
stored off- site with the backup files and updated and tested on an annual basis.
To adequately control and safeguard computer hardware, files, and programs,
management should monitor access to the computer room and limit access to operators.
Access to the computer room can be limited and monitored by using combination entry
pads, card- key door locks, surveillance monitors, or intrusion detectors which generate
access reports.
The County should continue to improve its subrecipient monitoring
activities
During the fiscal year ended June 30, 2006, the County improved its monitoring
activities. However, the County did not obtain audit reports for two subrecipients who
were required to have audits conducted in accordance with OMB Circular A- 133 and did
not properly monitor these subrecipients to ensure that they were accurately reporting the
County grants on the subrecipients' Schedule of Expenditures of Federal Awards.
The County should continue to improve its monitoring of subrecipients activities to
ensure that established policies and procedures are being followed.
2
r-:=== c==---===----===---------------------------------===-------------------- --------- --------
COCONINO COUNTY ARIZONA
FINANCE DEPARTMENT
The County needs to document and test its disaster recovery plan.
Ms. Debbie Davenport
Auditor General
2910 N. 44th Street, Suite 410
Phoenix, Arizona 85018
Coconino County has chosen to respond to the Management Letter for the fiscal year
ended June 30, 2006. Our responses to the Management Letter are below:
The County does have a disaster recovery plan; however, it has not been documented.
The County will document, adopt and test a disaster recovery plan
219 East Cherry Avenue • Flagstaff, AZ 86001- 4695
928- 779- 6677 • Fax 928- 779- 6893
The County has taken steps to improve all aspects related to improving its management
of grants including the monitoring of subrecipients.
Sincerely,
Dear Ms. Davenport,
January 31, 2008
The County should continue to improve its subrecipient monitoring
activities.
~---,&
/ Michael Townsend
Chief Fiscal Officer
I Michael F. Townsend
Director
' I
i l
I
I
: 1
I
I
: 1
I
' I
I
I
I
I
II
I