Text · page 13 of 15
Read the whole document on one page (all 15 pages, each with its own heading)
Appendix B: Audit Methodology and Standards We conducted this audit pursuant to Article V, Section 1 of the State Constitution and the State Comptroller’s authority as set forth in Article 3 of the New York State General Municipal Law. To achieve the audit objective and obtain valid audit evidence, our audit procedures included the following: ll We interviewed City officials to gain an understanding of the City’s IT operations and reviewed City records for any IT-related policies and procedures. ll We ran a computerized audit script on March 31, 2021 on the domain controller2 and analyzed each report generated by the script to identify network user accounts and the related security settings applied to the accounts. ll We compared the 89 network user accounts identified by the scripts to a list of current employees to determine whether enabled network user accounts were assigned to current City employees. We interviewed City officials to determine the necessity of generic network user accounts and any user accounts not associated with a City employee. Our audit also examined the adequacy of certain IT controls. Because of the sensitivity of some of this information, we did not discuss the results in this report, but instead communicated them confidentially to City officials. We conducted this performance audit in accordance with GAGAS (generally accepted government auditing standards). Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. The Council has the responsibility to initiate corrective action. A written corrective action plan (CAP) that addresses the findings and recommendations in this report should be prepared and provided to our office within 90 days, pursuant to Section 35 of General Municipal Law. For more information on preparing and filing your CAP, please refer to our brochure, Responding to an OSC Audit Report, which you received with the draft audit report. We encourage the Council to make the CAP available for public review in the City Clerk’s office. 2 The domain controller is a server that controls or manages access to network resources. Of f ic e of t he New York State Comptroller 11