Orange County NC Website
Browse       Search
AULDIN 15 <br /> & ENKINS <br /> Comments, Recommendations, ORANGE COUNTY <br /> and Other Issues (Continued) NORTH CAROLINA <br /> Recommendations and Comments in the Management Letter <br /> (1) The Information Technology environment is characterized by rapid change and there has been no shortage of headlines <br /> about cybersecurity attacks. While breaches of large organizations have been very high profile and have received a lot of <br /> press coverage, organizations of all sizes face the same types of threats and are experiencing similar breaches. Many <br /> organizations are still struggling to effectively address cybersecurity issues; however, they are no longer ignoring them. <br /> During the performance of our audit of the financial statements of the County, we noted that the organization is taking <br /> measures to prevent such an attack on the County, but is lacking some elements of a Cybersecurity Framework or <br /> Cybersecurity Risk Management Program (CRMP). A functioning CRMP will assist the County with comprehensively <br /> identifying cybersecurity weaknesses, potential threats and risks, and controls used to safeguard information and systems. <br /> We recommend that the entity investigate and consider implementation of a Cybersecurity Risk Management Program <br /> including: continued coverage of monitoring and testing of controls in place. <br /> (2) During the current year, the County entered into a debt transaction that refunded several notes and bonds payable. At the <br /> time of the transaction, the proceeds from the new debt were deposited with an escrow agent to retire the previously <br /> outstanding debt. While the net effect of the transactions was minimal (i.e., cash from the new debt relatively equaled the <br /> escrow agent deposits), generally accepted accounting principles (GAAP) require that the County's governmental funds <br /> reflect both the proceeds from the refunding debt as well as the payments made to the escrow agent to retire the refunded <br /> debt. As a result, audit adjustments were required to properly reflect the full transaction and correct the amounts reflected by <br /> the County on a "net" basis. Going forward, we recommend the County identify and categorize a debt transaction as either <br /> new money or as a refunding so that reviews of the accounting and reporting after the fact will more easily identify the proper <br /> accounting treatment to be applied to ensure amounts are presented in the County's financial statements in accordance with <br /> GAAP. <br /> 11 <br />