FAC Explorer

Finding 519728 (2024-001)

Significant Deficiency
Requirement
P
Questioned Costs
-
Year
2024
Accepted
2025-01-20
Audit: 338834
Organization: Beaver Water District (AR)
Auditor: Abacus CPAS LLC

AI Summary

  • Core Issue: The District experienced a failure of controls due to fraudulent vendor communications, resulting in unauthorized ACH payments.
  • Impacted Requirements: Existing controls for verifying vendor information and invoices were insufficient to prevent impersonation fraud.
  • Recommended Follow-Up: Increase insurance coverage, assess and strengthen expense controls, and evaluate IT security measures to prevent future fraud.

Finding Text

Condition – For the year ended September 30, 2024, the District had a failure of controls over the expense section from fraudulent vendor communications. The controls in place were followed and confirmed with the real vendor, which had confirmed the invoice had needed to be paid. The impersonator has intercepted communications inside the entity and posed as a known vendor. Criteria – Controls in place over expensing include staff submitting purchase orders to accounting department, which compare and match invoice and vendor information to confirm. Additional communication with vendor and comparing ACH or payment information is reviewed if necessary. Effects – The fraudulent vendor communications led to an ACH payment. When legal counsel and insurance company was contacted no claim could be submitted due to limited coverage, and the funds could not be tracked. The full amount was expensed. Recommendation – Abacus has recommended an increase in insurance coverage, and an evaluation of current expense controls. Additional controls to address phishing and vendor impersonation fraud. An evaluation of the IT environment and security is also recommended. Managements Response – Beaver Water District has committed to increase coverage and evaluate current controls. An additional evaluation of the IT environment and security.

Corrective Action Plan

A significant deficiency in internal control was noted in the Beaver Water District financial statement audit for the fiscal year ending September 30, 2024. This deficiency was described in the Management Comment Letter (MCL) as follows: "A failure of expense controls to prevent a fraudulent vendor payment occurring during the year. The controls did allow for the detection and correction of the fraudulent vendor payment. The potential future effects are continued targeting of phishing and other scams and additional losses related to those fraudulent payments." In response to this significant deficiency the Beaver Water District has implemented the following Corrective Action Plan: Corrective actions that have been taken by Beaver Water District include- Positive Pay, an automated cash-management service used by the bank holding our operating accounts will continue to be utilized indefinitely. Regarding vendor payments made via ACH, the District's Accounting Office will positively confirm the remittance account information, including payee, routing number and bank account number. An Evolve Cyber Liability Insurance Policy has been purchased by the District to limit potential liability related to fraud. This policy became effective January 1, 2025, at an annual premium of $12,527.84 and a deductible of $10,000.00. A Fraud Training course named "Social Engineering Red Flags, KnowBe4 Security Awareness Training" was completed in 2023 and will be repeated in 2025. The number of hours completed by each employee totaled 7.25 hours and included awareness and prevention of phishing and other scams. This course or one similar will be repeated on an annual basis. The person responsible for implementing these corrective actions is Adam Motherwell, the District's Chief Financial Officer.

Categories

Procurement, Suspension & Debarment

Other Findings in this Audit

  • 1096170 2024-001
    Significant Deficiency

Programs in Audit

ALN Program Name Expenditures
66.468 Drinking Water State Revolving Fund $23.45M