Finding Text
Internal Controls over Electronic Financial Information
Criteria or Specific Requirement: 2 CFR part 200 (Uniform Guidance) requires grantees to have effective control over, and accountability for, all funds, property, and other assets.
Condition: Subsequent to the fiscal year end, HACAP experienced a security breach of their electronic financial information by an outside party which denied HACAP access to their computer servers. Although several attempts were made to recover the financial information, HAPCAP was unable to retrieve essential electronic financial information needed to complete the audit. With the inability to retrieve the information, HACAP had to recreate the financial information manually causing significant delays in reconciling accounts and completion of the audit.
Effect: As a result of the deficiencies in adequately safeguarding of electronic financial information and the inability to recreate the electronic financial information using back-ups systems, a material weakness in internal control over financial reporting exists.
Cause: HACAP's internal controls over their electronic financial information did not adequately safeguard their financial information and prevent access from outside parties. In addition, HACAP's back-ups of the electronic financial information were not effective in recreating the financial information necessary to complete the audit.
Repeat: No
Auditor's Recommendations: We recommend HACAP implement procedures to ensure electronic records are secured and adequately backed-up.
View of Responsible Officials: Management agrees with the finding and has developed a written corrective action plan.No findings related to the the financial statements.