Follow-Up Audit of Sarasota County Area Transit (SCAT) Bus Operations Cash Handling, December 2017

13 | F o l l o w - u p o f S C A T B u s O p e r a t i o n s C a s h H a n d l i n g D e c e m b e r 2 0 1 7 2. Authorized vault access Current Status, Follow-Up Audit dated August 2017: A listing of all employees with authorized identification card access to the vault was obtained and compared to a listing of active SCAT employees obtained from Human Resources. All individuals with authorized identification card access to the vault were current and active employees. SCAT has created a log to track when employees are granted access to the vault with a manual key. During the review, it was noted that the employees being granted access were not signing the log. Original Audit Observation, Report dated November 2016: To support the departmental dual‐control requirement for cash‐handling activities, the system is set up to necessitate two authorized employees to swipe their identification cards in order to gain access to the vault. The auditor was provided with a system report listing persons with authorized identification card access as of July 29, 2016. Two temporary employees, who were terminated March 24, 2016 and February 2, 2016, were included on the July 29, 2016 system report. This was brought to the attention of the SCAT Fiscal Manager, who immediately took action to have access removed. When the automated card system is inoperable, a manual key system is in place. Management advised that although it takes only one person to access the vault with a key, no log is maintained of who was present and why it was necessary to access with a key. Original Recommendations, Report dated November 2016: To ensure the safeguarding of County assets, procedures should be developed and implemented for removal of card access to the vault immediately upon termination of the employee or when the employee no longer needs access to perform their job. A manual log of when the vault is opened a key should be maintained and include signatures of the two persons present, date and time, and the reason for key access. Management Action Plan: Management reviews and monitors a system generated report by General Services monthly, along with log for key access procedure in accordance with SOP # 212.