Committee defers second request for forensic audit after breach
A request for a forensic audit to uncover more information about the county courthouse computer breach that was reported by county officials in August has been put on the table for the second time.
The Anderson County Finance Committee met Thursday, March 9, for its monthly meeting and discussed a second request from County Mayor Terry Frank.
Frank told the Committee she wished to renew her motion for the county to research pricing for differing levels of a forensic examination.
“Annual audits generally focus on rule compliance and do not test for fraud. In light of the breach, I think a level of forensic audit to test for fraud should be one of the top priority steps taken by Anderson County to mitigate our ‘computer systems going forward,’ as General Clark stated,” wrote Frank in a memo to the Committee prior to the meeting.
A forensic audit is an examination and evaluation of a firm’s financial information for use as evidence in court.
Finance Director Natalie Erb provided the Committee with an overview of the maintenance of the IT system in the county’s accounting office.
Erb said she had a meeting with Local Government, a company that provides computer services for municipalities in Tennessee, and learned that the county currently uses two software applications: NextGen and Zortec.
The county has used NextGen for approximately 10 years as the application for the general ledger that come through it, Erb said.
Zortec is used by the county for payroll and accounts payable, Erb said.
“Right now Zortec runs payroll and accounts payable. All the disbursement checks, payroll checks — everything is run through Zortec,” she said.
Frank told Committee members she had read District Attorney David Clark’s letter response to the Finance Committee requesting more information on the breach investigation and said she did not see anywhere in Clark’s letter “a concern that conducting a forensic audit would interfere with the ongoing investigation.”
Frank renewed her motion to request a forensic audit, explaining she thought it should be the county’s priority to issue an RFP — request for proposal (a type of bidding solicitation a company or organization uses to announce that funding is available for a particular program or project) — so they could get an outside company to evaluate the internal controls of the courthouse IT system for evidence of financial fraud or mismanagement.
What the forensic auditors would do, explained Frank, is look specifically “at things in our internal controls. Things like, are there any weaknesses in our internal controls?”
The forensic audit would entail “an internal control component,” said Erb, and would include auditors checking to see, “our internal controls — if they are where they should be — and then they would most likely test a series of transactions looking for where a problem may have occurred.
“When they see a weakness in internal control then they would go after transactions to see if certain transactions may have been compromised,” continued Erb.
Finance Committee member Dr. Tim Parrott, Director of Anderson County Schools, made a motion to ask Erb to do an RFP to see what the cost would be for a forensic examination.
“The scope of the audit is going to drive how much the cost is going to be,” advised Erb, “with this level of review I’d imagine it’s going to be very expensive.”
Finance Committee Chair Myron Iwanski suggested the Committee proceed with caution on this matter and first check with DA Clark on whether he thinks this is a wise decision to make.
“We don’t need conflict with multiple entities doing this review. It has some merit, but we have to be careful. (We) Need time to do it properly and talk to the DA and others before we go into this,” cautioned Iwanski.
“I make a motion that we defer this for 30 days until our DA can come back and tell us, yes, you can proceed, or no, you do not proceed. We need to get a reply from the DA first on whether we can proceed with the forensic audit or if it would compromise the current, ongoing criminal investigation,” said Committee member Phil Warfield.
The Finance Committee voted unanimously on Warfield’s motion, and will be sending a letter to DA Clark in the following days requesting his advice on whether or not to conduct a forensic audit.