1. To
the Honorable Mayor and City Council
City of Cupertino, California
In planning and performing our audit of the financial statements of City of Cupertino, California (“City”) as of and for the year ended June 30, 2022, in accordance with auditing standards generally accepted in the United States of America and Government Auditing Standards, we considered the City’s internal control over financial reporting (“internal control”) as a basis for designing our auditing procedures for the purpose of expressing our opinion on the financial statements, but not for the purpose of expressing an opinion on the effectiveness of the City’s internal control. Accordingly, we do not express an opinion on the effectiveness of the City’s internal control.
Our consideration of internal control was for the limited purpose described in the preceding paragraph and was not designed to identify all deficiencies in internal control that might be significant deficiencies or material weaknesses and therefore, there can be no assurance that all deficiencies, significant deficiencies, or material weaknesses have been identified. However, as discussed below, we identified certain matters that we wish to communicate to you. Matters communicated in this letter are classified as follows:
x Deficiency – A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect and correct misstatements on a timely basis.
Information Technology Controls Deficiency
Control Deficiency: While testing the City’s Information Technology (IT) internal control environment, we observed deficiencies as noted below.
Context: 1. The City’s New World System does not provide the ability to generate security logs for the City employees to review transaction activity. As such, IT management generates quarterly transaction logs of manually posted journal entries and the Finance department management reviews these logs as an additional control to ensure that segregation of duties was maintained in the entry and approval process. We selected Q2 and Q4 of the four quarters in the fiscal year and noted both logs were reviewed and approved. However, for Q4, the review was not performed by someone independent of the activity being reviewed and for Q2 and Q4 quarters selected, the details of the review were not documented.
2. Management implemented a review control for user access once per quarter for the New World System. We selected Q2 and Q4 user access reviews and confirmed that they were performed and completed timely. However, for the 2 quarters selected for testing, the reviewer completed the review but there was no independent secondary review for activity conducted by the initial reviewer.
3. Management could not identify documentation to support the creation of 1 of 14 New World SQL Admin profiles selected for testing (which represented the full population of profiles).
Management determined that while the account had a server admin role on the SQL server, the account had read only access to the database and could not add/modify/delete users or transaction data. The account was deleted in FY23.
Potential Effect: The City has implemented additional controls that that were deemed to be operating effectively to mitigate the impact of these exceptions.
However, if left uncorrected, there is a risk that unauthorized transactions or user profiles could be added to the City’s IT environment that would not be timely detected and remediated.
2. The purpose of this letter is solely to describe the scope of our testing of internal control over financial reporting and compliance, and the results of that testing, and not to provide an opinion on the effectiveness of the City’s internal control over financial reporting or on compliance. This letter is an integral part of an audit performed in accordance with Government Auditing Standards in considering the City’s internal control over financial reporting and compliance. Accordingly, this letter is not suitable for any other purpose.
Cro
we LLP
Costa Mesa, California
March 31, 2023
Information Technology Controls Deficiency
Recommendation: We are aware that the City is considering a potential new investment in an Enterprise Resource Planning system that could contain improvements in several areas, including the generation of certain security logs that could strengthen the City’s IT control environment. In the meantime, we recommend that the City consider its current staffing structure and assignment of review duties to ensure that the current control structure as designed has the correct level of segregation of duties. Additionally, we recommend that the City consider adding additional reviews to the SQL Admin profiles that are active to ensure that documentation is maintained to support that all accounts are for a valid business purpose.