Text · page 6 of 12
Of the 79 user accounts, we selected and reviewed all five Business Office employees’ user accounts permissions in the District’s financial application. We found that all five users had unnecessary permissions and one user had administrative access rights. By not properly restricting user permissions and access rights within the financial application, there is increased opportunities for users to make unauthorized or improper changes and modify the accounting records to conceal the transaction. Officials told us that due to the small size of the Business Office, users were cross-trained on other job functions and therefore required more permissions than necessary for their daily job responsibilities. However, officials could add and remove employees’ access rights as needed and could always enable certain permissions when necessary (e.g., during an employee’s extended absence) and mitigate risks. Because officials did not adequately secure access to the network and financial application, the District has a greater risk that its network resources and financial data could be changed intentionally or unintentionally or be used inappropriately. What Do We Recommend? District officials should: 1. Periodically review user accounts and ensure that unnecessary generic network user accounts are disabled, as required by its written procedures. 2. Review financial application user accounts and limit access rights and permissions based on a user’s job responsibilities and to properly segregate duties, as also required by its written procedures. 3. Assign the responsibilities of financial application administrator to the Director or other designated employee who is not involved in the District’s financial operations. 4 Of f ic e of t he New York State Comptroller