Follow-Up Audit of Sarasota County Area Transit (SCAT) Bus Operations Cash Handling, December 2017

7 | F o l l o w - u p o f S C A T B u s O p e r a t i o n s C a s h H a n d l i n g D e c e m b e r 2 0 1 7 5. Monitoring reports that log vault access activity Current Status, Follow-Up Audit dated August 2017: During the review, it was stated by SCAT Management that the system generated logging reports were not received until March 2017 due to technical issues. Per Facilities Maintenance and Information Technology, the server housing the software that provides the data crashed in early spring of 2017. As a result, all logging reports prior to February 21, 2017 are unattainable. Backups of the data were not maintained. The logging reports from February 21, 2017 through June 5, 2017 were reviewed with the following items noted:  There were seven instances where the door to the vault was left open for longer than 10 minutes (one for 37 minutes and another for two hours). The Fiscal Manager advised that these occurrences were not investigated.  There were six instances where an unrecognized card was scanned at the vault. Per the Fiscal Manager, unrecognized cards are the primary reason these reports are reviewed. Supporting documentation indicating that the scans were investigated was provided for only one of these instances. Original Audit Observation, Report dated November 2016: The auditor was provided with a system generated logging report showing activity for accessing the vault. The report covered the period of January 1, 2016, to July 31, 2016. It was observed that eighty‐eight (88) days of logging activity was not included on the report. Facilities and Fleet Management, who are charged with badge access security, advised that they experienced server issues when they moved their office. It appears that the problem with the lack of logs was undetected until the report was requested, indicating that access activity is not regularly reviewed. The days where logging activity was not recorded include: January 12 (1 day) February 9 (1 day) March 23‐24 and 28‐29 (4 days) April 20‐26 and 28‐30 (10 days) May 1‐10 and 24‐30 (17 days) June 2‐5, 7‐20, and 24‐30 (25 days), and July 1‐7 and 9‐31 (30 days).