Follow-Up Audit of Sarasota County Area Transit (SCAT) Bus Operations Cash Handling, December 2017

7 |  A u d i t o f S C A T B u s O p e r a t i o n s C a s h H a n d l i n g  N o v e m b e r 2 0 1 6 2. Authorized vault access  Observation  To support the departmental dual‐control requirement for cash‐handling activities, the system  is set up to necessitate two authorized employees to swipe their identification cards in order to  gain access to the vault.  The auditor was provided with a system report listing persons with  authorized identification card access as of July 29, 2016. Two temporary employees, who were  terminated March 24, 2016 and February 2, 2016, were included on the July 29, 2016 system  report. This was brought to the attention of the SCAT Fiscal Manager, who immediately took  action to have access removed.   When the automated card system is inoperable, a manual key system is in place. Management  advised that although it takes only one person to access the vault with a key, no log is  maintained of who was present and why it was necessary to access with a key.  Recommendation To ensure the safeguarding of County assets, procedures should be developed and  implemented for removal of card access to the vault immediately upon termination of the  employee or when the employee no longer needs access to perform their job.  A manual log of  when the vault is opened a key should be maintained and include signatures of the two persons  present, date and time, and the reason for key access.  Management Response  The County’s employment agency is responsible for collecting badges when temporary  assignments end, going forward they will also be responsible for informing Human Resources to  turn off badge access.  Additionally, the Fiscal Manager will email General Services to turn off  vault access and remove name from list.   An Excel spreadsheet has been created containing the following information:   Employee Name   Date and Time accessing vault   Reason for accessing vault   Signatures of personnel accessing vault (dual signatures required)  This manual log (spreadsheet) will be maintained and stored in the Maintenance Manager’s  office to be completed immediately after using key to access the vault.  Expected date of implementation is November 30, 2016.