Final 2013-2014 Grand Jury Report*

Recommendations 26

• R1
  The Sutter County Grand Jury recommends that the IT Department request additional funding in order to comply with the 2012-2013 Audit Report. June 13, 2013 To the Honorable Grand Jury and Board of Supervisors County of Sutter, California In planning and performing our audit of the financial statement of the County of Sutter (the County), we considered the County's internal control in order to determine our auditing procedures for the purpose of expressing an opinion on the financial statements and not to provide assurance on internal control. We refer you to our Report on Internal Control Over Financial Reporting and on Compliance and Other Matters Based on an Audit of Financial Statements Performed in Accordance with Government Auditing Standards dated June 13, 2013, and our Report on Compliance and Requirements Applicable to Each Major and Nonmajor Program and Internal Control Over Compliance in Accordance with OMB Circular A-133 dated June 13, 2013. We did become aware of matters that are an opportunity for strengthening internal controls and operating efficiency. CohnReznick LLP offers the management report comments below for your review and consideration. We have already discussed these comments with various County personnel, and we will be pleased to discuss them in further detail at your convenience. This letter is intended solely for the use of the Honorable Grand Jury and Board of Supervisors and management of the County of Sutter and is not intended to be and should not be used by anyone other than these specified parties. Very truly yours, CohnReznick LLP Sutter County Prior Year Information Technology (IT) Observations Access Controls Status Based on inquiry with the IT department the access control observations and recommendations from the prior year are in process of implementation at June 30, 2012, however, they have not been fully implemented. Observation 1. Available security settings on the Windows servers do not require users to change their passwords periodically, and passwords are not required to be complex; other parameters, such as password history and minimum age are not consistent with current security practices. On the AS400, users are also not required to change their passwords periodically, passwords are not required to be complex, and password length of only one character is required. 2. Although Reznick Group was informed that IT disables user IDs whenever they are notified of an employee termination, there is not an established, consistently followed mechanism to ensure IT is notified immediately of all personnel terminations (employees, temporary workers, volunteers, contractors, etc.). Reznick Group observed that several terminated employees had access to the IFAS Financial application. 3. User's access rights for the servers (Windows, Unix, and AS400) and applications are not reviewed periodically. Risk 1. Passwords are the first line of defense to help protect unauthorized access to the County's servers, applications, and data. Without enforcing password changes, history, minimum age, and complexity, passwords can be more easily guessed and are more vulnerable to repeated password attempts from unauthorized individuals. The combination of these deficiencies increases the risk that passwords can be more easily compromised, resulting in unauthorized or inappropriate access to the County's computer resources and data. 2. Without a defined and consistently followed process to ensure computer access is revoked in a timely manner for terminated personnel, there is little or no assurance that terminated personnel do not have continuing access to the County's servers, applications, and data. 3. Without a periodic review of user's rights, there is an increased risk that a user might have access that is consistent with their current job responsibilities or that a terminated employee might continue to have server and application access.
• R2
  Add one Director of Development Services position, and authorize the position to be filled by appointment.
• R3
  Recommended Ordinance Amendments Recommended Department Organization Charts €¢ N39 1 s2420M THIEN Md, BE NZD Joyesedg suseysig JOVEMELSEAVIOIEM, ze és qaads WUIEW Md zz6b 6y 19% aeBeuew e299 1 4291 Buunozoy| $¢ 199 u ype, Bugunooay 9 OUd Ijuequnosoy 8 ONd iwweqnossy SeoiNosay JO}EM qwesea- 5 8z NID 721 JOON UTE +e NaD te Nao queseA-4 StNao quesen-f 9¢ NAD TOMO IIEW PEST Ad quese, utdns Laads qlein Md ¥— 1 JOH20AA IEW Md 9 1JRUOM JUTE Md v- dodinba Md Md Buy syo9A MNQNd) LNANLYVddd SHOES LNANdOTHAGG ve NBO Z o> MBpuYIAL Wed oor St NO ueiiuyse,, ooo ved as 26¢0 S6t0 6£ Old Z—ui desu! Buipying Oz6L ve OUd ay Od yotypacu6ug 6¢ dNS t 8z 199 livo or199 Z- llvo beuz 3199 Aieyo1985 eARn3ex3 Haads qUTEW Md ore by LOW quepusyupedns qwueW peoy yoenuoa Buy eiepossy Z-8¥ Od core osoud Bug IInd soles sauuelg queisissy’ 9¢ Ud ¢-soauiBug and ote - og 0261 ~ 0S’ 7S LOW SOM SGN soqDedIg yUES|S6y Ov Od si 6c uid Ly OUd pads UpreeH AUR 6-UiEIded any JOUURId JO}UIS yy SOW erdns crow ~s1N9 woreneg| pads wHesH Ot" Old souueig jed}ouud ug Bujsjiedns v2uz bore os seGeuew ace suopesod NH Jousbiowy bst0boeo Buluuelg hires Zoe 40)28)q Andeq Ss LOW SOW seBeuey wresH yg alta yejuewuosjaug bez es LOW Sad|AIOS JuaUdojenaq, Jo 10329119 E10S ‘bl ABW pepusunuossy INGANLYVdad SAOIANES TVYENAD 8% N3D OL - ueIpoysng, 6% N39 £—ueIpoIsnD "1g 4 N39 |4adaoyspunoig be NBO ueiporsn5 pee £- DVAH JOO, saoqmag Buypuing Z benz9 ve ie N39 i ore J94J0M PEOT Iesy SaT|AIVg [eNUID uerpoysng Adng seo}leg Bulpyng 9¢ N30 tsedg dup Wy OUd ujwpy swaishs z 6t Oud ysiadg dng ys, oyu by Oud Zi isieds dng yoo oyut —— Zp Oud Z—[UIUpY HOMION vy ONd Z— 1 UIPY ONION 6% 199 [81D wnoosy 6e dns sosyiodns, se2\ueg Bupying of 19D qWEISISSY EDO, $€ N39 2 yoew dinby Anco ossy 6t dns Aids JUIRW 10214 sozb ev LOW 49DO Ales UIP ooze = FZ6L yOZL = O0Lb wr OUd €- 1 ashjeuy wesbod LO 9b OUd In assjeuy wesBorg 8% dns toads yshjeuy swaysks bese ey LOW L140j904q ANdog ossp e022 SOZL £012 LObL L8sy syun jaBpng 40 38177 soz corn +S LOW 8€ Oud SadIAlag qsfreuy Jesauag 4039810 penuog wewansod SlOS ‘vl LBW. pepusumurosay Human Resources Department Report and Recommendations HUMAN RESOURCES DEPARTMENT Sutter County is An Equal Employment Opportunity Employer Phone (530) 822-7113 Fax (530) 822-7191 Karen A. Ropp, Human Resources Director kropp@co.sutter.ca.us Marco Sandoval, Risk Manager msandoval@co.sutter.ca.us May 14, 2013 TO: Honorable Board of Supervisors SUBJECT: Approval of a Reorganization of the Community Services, Public Works, and Information Technology Departments and Approval of Related Actions (provided as attachment to County Administrative Officer's [CAO's] Staff Report) Recommendations: It is recommended that the Board of Supervisors approve the following recommendations as set forth in the CAO's Staff Report of the recommended reorganization of the Public Works, Community Services and Information Technology Departments, to the new of Development Services Department and General Services Department, as described in the CAO's Staff Report, effective either June 28 or July 1, 2013, as applicable.
• R4
  Delete the Administrative Services Officer split-funded position (ADSOAM/ADSOAI).
• R5
  Delete one vacant Community Services Environmental Health Specialist I/II position (EHS1AC/EHS2AD)
• R6
  Delete one vacant Community Services Hazardous Materials Specialist position (HZMSAA)
• R7
  Adopt the attached job description for the Deputy Director of Planning and Building at salary range MGT49 ($7,906 - $9,629 mo.), and allocate the Deputy Director of Planning and Building classification to the Management Unit.
• R8
  Add one Deputy Director of Planning and Building position, and authorize this position be filled by open recruitment, job offer and pre-placement processing prior to July 1, 2013 and authorize filling the position effective July 1, 2013, if a candidate has been selected.
• R9
  Delete the Planning Manager position (PLMAAA).
• R10
  Delete one Principal Planner position (PRPLAF).
• R11
  Delete the Building Inspection Manager position (BIMAAA).
• R12
  Fund one Building Inspector II/III position (BIN2AC/BIN3AB) at the III level, step 6, immediately following approval, for the return of the incumbent currently in a temporary promotion in the Building Inspection Manager position.
• R13
  Reduce the Emergency Operations Manager position (EMOMAA) from 1.0 FTE to .50 FTE.
• R14
  Adopt the attached job description for the Director of General Services at salary range MGT51 ($8,736 - $10,622 mo.); and allocate the Director of General Services classification to the Management Unit.
• R15
  Add one Director of General Services position, and authorize this position to be filled by interim appointment for six (6) months, then filled by open recruitment.
• R16
  Delete the Public Works Director position (PWDIAA).
• R17
  Delete the Deputy Director of General Services position (DDGSAF).
• R18
  Delete one Senior Engineering Technician position (SRETAA)
• R19
  Delete one Executive Secretary II position (EXS2AE).
• R20
  Delete the Director of Information Technology position (DIITAA).
• R21
  Delete one vacant Public Works Engineering Technician II position (ENT2AA)
• R22
  Approve the title change of the Deputy Director of Public Works - Administration and Finance to the Deputy Director of Development Services - Administration and Finance, amend reporting structure and amend job description to add / delete divisions for which financial oversight is provided per the reorganization, etc.
• R23
  Approve the title change of the Assistant Director of Public Works to the Assistant Director of Development Services for Public Works, amend reporting structure and amend job description.
• R24
  Direct the Human Resources Department to transfer the remaining currently allocated positions not necessarily addressed specifically, but included on the new organization charts, from former departments to newly created departments: Public Works, except General Services Division to Development Services, Public Works General Services Division to new department of General Services, and from IT Department to General Services Department.
• R25
  Direct Human Resources to review and amend current job descriptions within the Information Technology, Public Works and Community Services Departments to reflect new reports to Department names of either Development Services or General Services and to bring those changes back to the Board of Supervisors at a future date for approval.
• R26
  Amend the position allocation schedules for the affected departments to reflect the above changes.