AGREEMENT NO. 2022-14A
FIRST AMENDMENT TO PROFESSIONAL SERVICES AGREEMENT
This Amendment to Agreement No. 2022-14 (Amendment) is entered into between the City of Camarillo, a California general law city and municipal corporation (City), and CliftonLarsonAllen, a LLP (Consultant), collectively referred to as the Parties. The effective date of this Amendment is September 22, 2022.
RECITALS
A. On February 23, 2022, the City Council approved Professional Services Agreement No. 2022-14 with CliftonLarsonAllen, a LLP for financial and auditing services in the amount of $227,000 with a 10% contingency for three (3) fiscal years with a two (2) year extension option, effective February 23, 2022 (Agreement).
B. The parties desire to expand the scope of work in accordance with Section 3.2 of the Agreement.
C. All capitalized terms not defined in this Amendment have the meaning set forth in the Agreement.
Section 1. Amendment. The Agreement is amended for the Consultant to provide professional information technology assessment and consulting services to the City.
Section 2. Compensation and Payment. This Amendment is for a not-to-exceed amount of $22,500, for a total agreement amount of $249,500.
Section 3. Continuation of Terms of Agreement. Except as expressly modified by the terms and provisions of this document, the remaining terms and provisions of the Agreement remain in full force and effect.
THE AUTHORIZED REPRESENTATIVES of the Parties have caused this Amendment, Agreement No. 2022-14, to be executed as of the Effective Date.
CITY OF CAMARILLO
Greg Ramirez, City Manager
ATTEST:
Kristy Buxkemper, City Clerk
CONSULTANT
CliftonLarsonAllen, a LLP
Robert J. Callanan, CPA – Principal
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
September 6, 2022
Proposal to provide professional information technology assessment and consulting services to:
City of Camarillo
Camarillo, California
Prepared by:
Jim Kreiser, Principal
[email protected]
717-857-2613
CLAconnect.com
WEALTH ADVISORY
OUTSOURCING
AUDIT, TAX, AND
CONSULTING
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
CliftonLarsonAllen LLP
220 South Sixth Street, Suite 300
Minneapolis, MN 55402-1436
612-376-4500 | fax 612-376-4850
CLAconnect.com
September 6, 2022
Mark Uribe, Director of Finance
City of Camarillo, California
601 Carmen Dr #6034
Camarillo, CA 93010
Dear Mr. Uribe,
Thank you for inviting us to propose our services to you. We gladly welcome the opportunity to share our approach to helping the City of Camarillo, California (the City) meet its need regarding information technology (IT) risk and IT management services, as well as describe our work regarding IT to support the financial audit services. We would also like to share additional details on IT services that may help the City to gain insight into the effectiveness of the City’s IT environment and also assist you with specific IT related objectives that the City is facing.
We are confident our proposal not only addresses your need for IT audit services, but also demonstrates our strong capabilities in serving clients in your industry, developed during our more than 50-year history of working with organizations like the City.
CLA is focused on delivering an exceptional level of knowledge, insight, and industry experience. As our clients’ most trusted business advisor, we:
• Take a genuine interest in your opportunities and challenges • Proactively work with you to develop strategies based on a deep understanding of your business and industry
• Address your organization’s financial challenges through our national and global resources • Continually strive to better your organization, your industry, the communities in which we work and live, the IT audit profession, and ourselves
We are eager to work with you and welcome the chance to present our proposal to the City’s management team. If you have any questions about our offerings, please do not hesitate to contact me.
Sincerely,
CliftonLarsonAllen LLP
Jim Kreiser
Principal
717-857-2613
[email protected]
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
©2022 CliftonLarsonAllen LLP | 2
Table of Contents
Table of Contents ___________________________________________________________________ 2 Services Description _________________________________________________________________ 3 Value-Added Finanical Audit Support __________________________________________________ 3 Further IT General Controls Assessment _______________________________________________ 4 Additional IT Assessments Services ___________________________________________________ 4 IT Strategy and Mission Development _________________________________________________ 5 ERP System Requirement Development ________________________________________________ 5 Engagement Team Experience _________________________________________________________ 6 Roles and responsibilities ___________________________________________________________ 7 Professional Fees and Expenditures ____________________________________________________ 9 Appendix _________________________________________________________________________ 10 Engagement team biographies ______________________________________________________ 10
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
©2022 CliftonLarsonAllen LLP | 3
Services Description
Value-Added Finanical Audit Support
The objective of the Value-Added Financial Audit Support review is to conclude whether the City’s IT related controls are properly designed and operating effectively to support financial reporting. As a result of the review, we will identify relevant risks to the financial approach and potential opportunities for enhanced controls. We will communicate our relevant findings and recommendations within the scope of our financial audit, and may include management letter comments or discussions with IT management.
Our IT professional(s) will meet with IT management charged with governance to gain an adequate understanding of the IT environment including: financially significant systems and applications, policies and procedures and the processes in place around IT organization and security, logical access, change management, backups and recovery.
After our discussions with IT management and review of the Information Security Policies and Procedures we will request the following documentation to review and provide recommendations upon:
• IT Organization and Security
o Review the Organizational Chart for the IT Department for an understanding of hierarchy of command within IT Department and determine that key functions are designated and appropriately segregated.
o Review IT Security policies to determine that they are revised periodically to conform and adhere with current practices and include standards for key IT functions such as, system access, change management, incident response, backup and recovery, data management, IT Asset Management, physical access, minimum security baseline standards, and vendor management. o Review SSAE 18 (SOC) Reports and documentation of management review for hosted applications to determine that they are reviewed for control deficiencies and related CUECs. o Review reports of hardware and software inventory to determine that IT asset inventories are tracked and maintained.
o Network access and administration of users (end-user support procedures – including help desk, setup, etc.)
o Assess network (i.e. Windows) configurations for authentication, as well as password and account settings.
o Review existing vulnerability or penetration testing results, as well as related action plans.
Determine any remediations in place or in process.
Further IT General Controls Assessment
Our team is also able to perform additional assessment of IT General Controls related to system access, change operations, and backups. This assessment is designed to assist management with a broader understanding of IT operational controls related to additional aspects of financial reporting, City operations, IT compliance, etc.
These procedures would include:
• System Access Management
o Review Access Management policies and procedures to determine that processes are in place around provisioning and de-provisioning of user access, password standards, and user access reviews.
o Review Password and lockout configurations for in scope applications to determine that they are in line with policies.
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
©2022 CliftonLarsonAllen LLP | 4
o Review the process for provisioning system access to determine users are appropriately reviewed and approved by personnel before being granted access. o Review the process for deprovisioning user access to determine that access is removed for terminated individuals in a timely manner.
o Review the listings of privileged users in scope systems to determine that they appear appropriate based on job function.
o Inspect evidence of user access reviews performed over the primary financial applications during the audit period to determine that management review users access for appropriateness.
• Change Management
o Review policy and procedures related to application and system updates, changes, and patching. o Inspect evidence of change testing, including UAT, for key application and system updates. o Assess the process for any programming and programmer guidelines and standards, including separation of programmer access from operations.
o Determine change processes through batch or manual updates. Identify how changes are approved, and monitored for accuracy.
• Backup and Recovery
o Review Backup and Recovery policies and procedures to determine that backup frequencies, schedules, and locations are documented
o Review the current backup schedule for production servers to determine that they are in line with policies
o Review the Disaster Recovery and Business Continuity Plans to determine that a plan is in place in the event of a disaster to recover system data timely and continue operations Additional IT Security Assessments Services
CLA specializes in information security assessments and consulting services. Focusing on information security can be an advantage in the government sector and minimize potential legal and reputational risks to the organization. Making information security a priority within the organization also demonstrates to employees that management understands the importance of protecting its most valuable asset – sensitive information. As a result, CLA provides several security-focused consulting services that can be customized to your specific requirements. CLA has significant experience and expertise related to each of the described services and will identify exposures and risks that will assist each organization in implementing the proper controls and procedures to mitigate or eliminate the various risks.
• Vulnerability Management Review
o Review Penetration Tests to determine that they were completed for the entity within the period under review and for any critical to high-risk vulnerabilities, and that they inquire of client/obtain documentation to determine that remediation plans are in place for said critical to high risk vulnerabilities
o Review Vulnerability assessments to determine that they were completed for the entity within the period under review and for any critical to high-risk vulnerabilities, and that they inquire of client/obtain documentation to determine that remediation plans are in place for said critical to high risk vulnerabilities
o Review the vulnerability tracking process to determine that security threats and incidents are identified and monitored using a proper software, and that individuals are assigned to address and resolved the incidents
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
©2022 CliftonLarsonAllen LLP | 5
o Review anti-virus solutions to determine that the tools/consoles used for Anti-Virus within IT Environment has frequent scans in accordance with their policy. o Review Incident Response Plan to determine that incident response process is tested on a periodic basis, and that the incident response plan addresses responsibilities, initial response, containment, evidence preservation, investigation, information correlation and recovery. o Review Incident tracking to determine that documentation of incidents are retained in ticketing system, and that they include details of how the incident was identified/reported, risk assessment of the incident, and any remediation or follow up actions taken to resolve it
• Boundary Defense Review
o Review IDP and IPS monitoring tools and alerting to determine if proper tools are in place to monitor suspicious inbound and outbound traffic
o Review SIEM Solutions and activity logging to determine that a proper data platform is in place to log the log the network activity and integrate with other security tools to log activity into a centralized location.
o Review email and web content filtering and DLP processes to determine that appropriate security controls were in place for blocking unauthorized content and that security parameters are in place around email content.
o Review the process for evaluating firewall rules to determine that the rule sets appear appropriately configured to allow secure inbound and outbound traffic, and that access is appropriately given based on job function
o Review VPN setting and remote access to determine that remote authentication to the network and/or financial applications are in place, and that remote users need to utilize these tools for authentication of network and or financial applications. • Data Management Review
o Review the Data Classification standards to determine that it is periodically reviewed and that the policy identifies categories such as Administrative Data, PHI Data, Financial Data, Non-Public Data, Public Data, etc.
o Review the Hardware and Software inventory to determine if there are any unsupported servers or operating systems.
o Review the Asset and Data Disposal process to determine that it is periodically reviewed, and that equipment is recycled using a licensed disposal facility o Review the Data Retention to determine that it is periodically reviewed and that the policies identify retention periods for key information
o Review the Data Encryption standards to determine that sensitive data is encrypted while at rest and in transit, and that recipient of sensitive data is required to log into the secure reader through the use of a verification code prior to the access.
IT Strategy and Mission Development (Optional)
An IT strategy enables business outcomes, and creates a strategic roadmap for using information technology, digital assets, and technical knowledge to create organizational value. The goal of strategic technology planning is to create a technology plan that is dynamic and flexible, allowing the planning process to be repeated and expanded upon on a periodic basis. The IT plan, or mission, also directs and guides the manner in which IT will support operational and business objectives. The plan and mission of IT should include alignment with City objectives and initiatives and should outline and highlight the various levels of support, service, and direction that IT will utilize to drive innovation and backing to the City.
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
©2022 CliftonLarsonAllen LLP | 6
We understand from discussions with management that the City would benefit from guidance and direction to establish an IT Strategic Plan (Master Plan). Given CLA’s depth and breadth of IT consulting and audit work with various governmental entities, we have examples, knowledge/experience, and leading practice insights to assist the City in their implementation of a strategic plan.
This service provides the organization the opportunity to formalize procedures and methods for making decisions related to the implementation and utilization of technology including determination of priorities and the decision to “buy, build, or partner.”
The result of this service would be a document that outlines the technology initiatives necessary to support the business goals and objectives for the next 12, 24 and 36 months, including identification of the various business partners that will assist the organization in achieving success. We would be able to provide such insight, outline, and support for the City or a system integrator/consultant to implement and approve a formal plan with action items and roadmap related to infrastructure, service structure, system selection, end-user support, security initiatives, system security/defense, and application management and administration.
Enterprise Resource Planning (ERP) System Requirement Development (Optional) A consolidated financial solution can present opportunities and risks within an organization and its operations; but, with a solid project to assess the implementation and controls within the financial solution, the organization can maximize the opportunities and reduce the risk.
As part of government solutions IT team, we have included key IT Team resources that have experience with assess general information technology and applications controls. Our team is familiar with the large and mid-size ERP system. We have assisted clients with system design implementations in the government, manufacturing, and entertainment industries, specifically working with implementation of continuous control monitoring tools.
Our IT Team is accustomed to working with complex integrated IT environments and providing a great depth and breadth of exposure to server, mainframe, desktop, database, and ERP systems and environments. For example, many of our clients utilize ERP systems that are all database driven, including SAP, Oracle, PeopleSoft, JD Edwards, and Dynamic systems, etc. We understand the controls within these systems and how to obtain information from the systems to support the audit work. We have specifically reviewed the following ERP control areas at similar organizations:
• Segregation of Duties – Leveraging industry and profession, we have assisted organizations to define key business, financial and information technology segregation of duties that should be maintained to reduce risk to the organizations. Using this information we have built customized rule sets to analyze individual user application permission to identify accounts that pose a risk to the integrity of the financial and operational transactions processed within the organization. This information along with input from management was used to either a.) modify user access to remove the segregation of duties risk or b.) identify appropriate mitigating controls to reduce the posed risk. We have help organizations develop processes to periodically reassess segregation of duties risk in a resource sensitive manner • Continuous Control Monitoring – To address necessary segregation of duties situations as identified above or to monitor sensitive transactions, we have assisted organizations with the design of continuous control monitoring procedures. These have included recommendations and plans to implement:
o Workflows: System designed steps to ensure that transactions are reviewed before transactions are processed and posted.
o Exception Reports: System alerts and reports for transactions that meet pre-defined criteria (i.e. time of processing, over certain dollar value).
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
©2022 CliftonLarsonAllen LLP | 7
• Elevated Privileged Management – To reduce the risk of those with consistent elevated privileges, we have assisted organizations with the implementation of the temporary elevated privilege systems.
Based on the systems and technologies available within the organizations, both manual and automated systems can be developed. Additionally, as part of this process we have help define the monitoring procedures to validate that elevation of privileges was used appropriately.
Furthermore, we are able to take a fresh look at all of the City’s IT systems using a risk-based approach starting with the mission-critical systems that provide information for the City’s financial reports and management decisions. As discussed with management, we can’t conduct vendor selection or system design due to our role as an independent auditor. However, we are able to bring the experience and perspective as noted above. We would assist the City to identify their business needs, their reporting requirements, functional requirements from an ERP/financial system, and provide management with value and recommendations related to various administration, cost, and support models for coordination with an application integrator or consultant to conduct vendor selection, implementation, and technical design features.
Engagement Team Experience
Roles and responsibilities
An experienced engagement team has been aligned to provide the most value to your organization. The team members dedicate their time to assisting organizations and have performed numerous engagements of this nature and will commit the resources necessary to provide top quality service throughout the engagement. Our extensive IT audit and regulatory compliance experience allows us to provide you with valuable guidance and in depth testing regardless of the size or complexity of your organization.
Following are our proposed management team members:
Team Member Title Role
Jim Kreiser Principal Jim will have overall engagement responsibility including planning the engagement, developing the audit approach, supervising staff, and maintaining client contact throughout the engagement and throughout the year. Jim is responsible for total client satisfaction through the deployment of all required resources and continuous communication with management and the engagement team.
Joel Eshleman Manager Joel has conducted several ERP implementation and control assessments.
He would serve as project and subject matter lead over ERP system requirements services. He was formerly certified in SAP GRC and has worked with Jim and others with large governments, as well as publicly traded entities, regarding ERP controls, security, role mapping, and more.
Brian Boguski Director Brian will act as the lead director on the engagement. In this role, Brian will assist the engagement principal with developing the audit approach, supervising staff. He will perform a technical assistance of all work performed and is responsible for the review of all related deliverables and reports.
The most important
resource any business has is
people — the right people.
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
©2022 CliftonLarsonAllen LLP | 8
Matt Rever Manager Matt will act as the lead manager on the engagement. In this role, Matt will assist the engagement principal with planning the engagement and performing complex audit areas. He will perform a technical review of all work performed and is responsible for the review of all related deliverables and reports
Additional CLA resources will be identified upon designation of project timeframes and may be subject to change based on availability. CLA will provide biographies in advance for the City approval prior to execution.
Detailed biographies are available in the Appendix of this proposal.
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
©2022 CliftonLarsonAllen LLP | 9
Professional Fees and Expenditures
Professional fees. Our professional fees are based on the timely delivery of services provided, the experience of personnel assigned to the engagement, and our commitment to meeting your deadlines.
CLA understands the importance of providing our clients with value-added solutions. We propose to provide routine, proactive meetings – as part of our fee – that will allow us to review and discuss with you the impact of new accounting issues, as well as any other business issues you are facing and how they should be handled. This level and frequency of interaction will no doubt enable CLA to help you tackle challenges as they come up, and take full advantage of every opportunity that presents itself.
CLA will work with the City and provide specific project estimates based on the following general estimates and understanding. For each of the accretive service offerings above, we will coordinate more specific and refined professional fee/cost estimates. These will be based on further definition and the City’s scope, size and complexity as defined herein. However, CLA will work closely with the City leadership to develop and finalize an IT assessment and service plan that meets the needs of the City.
Professional Services Rate
Value-Added Financial Audit Support No Cost - Included in Financial Audit Services
Further IT General Controls Assessment $2,000
Additional IT Assessment Services $20,500
Additionally, as CLA continues to invest in technology, improve our client experience with technology and innovation, and the ability to securely transmit and store client data, we will assess a 5% technology surcharge in addition to our professional service fees.
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
©2022 CliftonLarsonAllen LLP | 10
Appendix
Engagement team biographies
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
©2022 CliftonLarsonAllen LLP | 11
James P. Kreiser, CISA, CRMA, CFSA
CliftonLarsonAllen LLP
IT Principal
Profile
Jim is a Principal in the CliftonLarsonAllen LLP (CLA) Specialized Advisory Services group. He has 20 years of professional services experience in providing consulting and advisory services. Jim spent 10 years of his experience working at a Big 4 firm in their Business Risk and Technical Risk Services groups. His experience also includes internal audit roles at CitiBank, AMP, and Capital BlueCross. Jim has held roles of Chief Risk Officer, General Auditor, and others. His focus has primarily been in the governmental sector, healthcare, and financial institutions. At CLA, Jim has focused on clients particularly on consulting, internal audit, and third-party reporting services.
Technical Experience
Jim’s experience includes managing and leading projects, which include engagements related to outsourced and co-sourced internal auditing, IT audit, third-party reviews and performance audits, enterprise risk management processes, IT security and auditing services, SSAE 16 reporting (SOC 1 and SOC2), operational improvements, process solutions and implementation for those solutions across the organization.
His primary focus for the firm is in the Public Sector Group (State and Local Government, Higher Education, and Non-Profit organizations).
His service expertise is Business Risk, IT, and Internal Audit services. Specific experience includes, but is not limited to, the following:
• Internal audit outsourcing and co-sourcing, including information technology, financial, performance audits, and operational audits.
• IT Security and Risk Consulting
o Enterprise-wide risk assessments.
o IIA Quality Assurance Reviews (QAR)
o Vendor Management and Implementation Assessment
o Compliance related activities and benchmarking
o Presentations and Training; including speaking at various conferences/professional organizations on IT controls, Security, ERM, and third-party reporting, and risk management.
Education/Professional Involvement
• Bachelor of science from Carnegie Mellon University, Pittsburgh, Pennsylvania o Bachelor of science of Managerial Economics
o Bachelor of science of Philosophy
• Certified Information Systems Auditor
• Certified in Risk Management Assurance
• Certified Financial Services Auditor
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
©2022 CliftonLarsonAllen LLP | 12
Joel Eshleman, CPA, CISA, CIA
CLA (CliftonLarsonAllen LLP)
Manager 717-857-2611
Plymouth Meeting, Pennsylvania [email protected] Profile
Joel is manager within the Specialty Advisory Services group and has more than 20 years of experience and is a leader of System and Organization Control (SOC) Reporting service line. His experience includes 13 years with CliftonLarsonAllen and five years with a Big 4 firm performing information technology, business process and control, and third-party reporting reviews. Joel also provides leadership and performance of information technology audit and attestations to our assurance clients. These information technology audits, include review of complex ERPs such has SAP, PeopleSoft and Oracle. Within the Scope of these ERP engagements, Joel has assisted with the implementation and analysis of segregation of duty analysis, remediation, and mitigation within the SAP GRC tools and has assisted with the implementation of access request management and emergency access management.
Technical expertise
• Leads the operational needs of the SSAE 18 service line by providing:
o Guidance on interruption of the standards;
o Establishing practices for planning, risk assessment, performance, and report; o Monitoring standards for updates and changes; and
o Training internal and external practitioner and users of SOC reports. • Has significant experience in effectively coordinating and directing complex projects ensuring completion with strict regard for client specifications, time and budgetary constraints and the development of numerous risk services offerings including:
o SSAE18 assurance engagements
o ERP controls assessments and utilizations
o Developed procedures for the evaluation of information technology controls in support of a financial audit and service organization reporting
o Served as the project manager for information technology (IT) control audits, service organization audits, business advisory projects, internal audit projects, and data analytics o Current state assessments, including inefficiency and process improvement identification o Future state design and process reengineering and implementation o Application of Control Objectives for Information and Related Technology (COBIT) guidelines as published by the Information Systems Audit and Control Association (ISACA)
Education/professional involvement
• Bachelor of Science, Accounting, York College of Pennsylvania
Professional Certifications
• Certified Public Account (CPA)
• Certified Information Security Auditor (CISA)
• Certified Internal Auditor (CIA).
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
©2022 CliftonLarsonAllen LLP | 13
Brian Boguski, CISA
CLA (CliftonLarsonAllen LLP)
Director 215-643-3900
Plymouth Meeting, PA [email protected]
Profile
Brian Boguski is a Director within the Specialized Advisory Services group at CLA, specializing in SOX controls testing, SOC engagements, Information Technology risk evaluation and remediation, and IT audit. Brian has served clients in both external and internal audit capacities, with extensive experience evaluating business processes and compensating controls.
Brian has provided these services across multiple industries including insurance, chemicals, cloud technologies, telecommunications, textiles, and agriculture sciences.
Technical experience
Brian has over 20 years of experience in various IT environments and technologies, with 10 years of experience providing security delivery, consulting, and advisory services across multiple disciplines. Prior to joining CLA, Brian led and performed IT Risk Advisory engagements for Ernst & Young, as well as led IT Internal Audit projects for Marsh McLennan. Brian’s focus has been primarily working in IT control assessments, IT general controls review and testing, cybersecurity, SOC 1 and SOC 2, as well as risk assessments.
Brian is also highly knowledgeable in network topologies, change management processes, logical access and physical security, business continuity and disaster recovery procedures as well as intrusion detection, governance, and policy compliance for various service organizations.
Some of Brian’s key efforts and contributions include:
• Knowledge of technical risks, threats and compliance leveraged to implement essential controls to startup company applications, as well as first-ever audits of regularly used tools/applications. • Demonstrated experience in delivering solutions and strategies to clients, best practice controls and remediation of observations, as well as bolstering IT security posturing. • Reviewing and evaluating cybersecurity regulations and best practices, informing businesses regarding updated requirements, and developing new procedures to ensure compliance.
Education and professional involvement
• Bachelor of Science in Computer Information Systems from Columbia College of Missouri • Associates Degree in Computer Information Systems from Community College of the Air Force • Certified Information Systems Auditor (CISA)
• Member of the Information Systems Audit and Control Association (ISACA) • Lean/Six Sigma/Agile Frameworks (2016)
• CompTIA Net+ and Security+ (2011)
Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94
©2022 CliftonLarsonAllen LLP | 14
Matthew Rever, CISA, MIS
CLA (CliftonLarsonAllen LLP)
Manager 410-453-5582
Baltimore, Maryland [email protected]
Profile
Matthew is an accomplished senior associate in the CLA (CliftonLarsonAllen LLP) Business Risk and IT Services group. He has over five years of professional services experience with assurance, consulting, and advisory engagements. In addition to his technical experience, he has over three years of supervisory experience on his engagements. His primary focus for the firm is in the Public Sector Group: State and Local Government, Government Pensions, Higher Education, Healthcare and Non-Profit organizations.
Technical experience
Matthew’s experience is in the areas of Internal Audit and Compliance, SSAE18 reporting (SOC1 and SOC2), IT/application control assessments, risk assessment, IT general controls review, business process improvement, IIA quality assurance reviews, and consulting.
Matthew has experience in IT audit and compliance, with an emphasis on Public Sector Groups, including Healthcare. He has managed all phases of internal IT audit engagements, which have included our risk based planning methodology; evaluating business processes, compliance requirements, and IT general controls; and reporting to executive management. He has significant experience performing internal IT audit projects related to comprehensive IT risk assessments, system conversions and system upgrades, business continuity and disaster recovery planning, vulnerability assessments, logical access and security, system and application patch management, and backup and recovery processes.
Key Relevant Clients
• Children’s Hospital of Omaha
• Brooklyn Hospital Center
• New York City Deferred Compensation Plan and Managed Benefit Fund
Education and professional involvement
• Certified Information Systems Auditor
• Member of the Information Systems Audit and Control Association (ISACA) • Bachelor of science in accounting from Elizabethtown College • Master in information systems from University of Maryland Baltimore County Doc ID: 8dd0d1519c2aef0597721da7469f4aff8fcb2a94