View
0
Download
0
Category
Preview:
Citation preview
Inte
rnal
Aud
it R
epor
t
IT S
ecur
ity a
nd N
etw
ork
Infr
astr
uctu
re R
evie
w(1
0/10
) fol
low
up.
Rep
ort s
tatu
sFi
nal
Rep
ort d
ate
13th
July
201
2
Fina
ncia
l Per
iod
2012
/13
Pre
pare
d by
Mar
k G
ee, A
udito
r (H
aine
s W
atts
)
37
Exec
utiv
e Su
mm
ary
Obj
ectiv
e of
the
audi
tTh
e ov
eral
l obj
ectiv
e of
the
audi
t was
to p
rovi
de a
n op
inio
n on
the
prog
ress
for
impl
emen
ting
agre
ed a
ctio
ns fr
om th
eIT
Sec
urity
and
Net
wor
k In
fras
truc
ture
Rev
iew
(10/
10.)
Key
back
grou
nd in
form
atio
n
Four
fin
ding
s w
ere
mad
e in
the
Augu
st20
11 r
epor
t. F
or e
ach
ofth
efin
ding
s an
act
ion
was
agr
eed
toco
ntro
l and
/or
miti
gate
the
iden
tifie
d ris
k.Fo
r ea
ch o
bser
vatio
n re
spon
sibili
ty f
orac
tion
was
acce
pted
by
the
IT&
IS M
anag
er.
One
obs
erva
tion
was
act
ione
dim
med
iate
ly.
All
agre
ed a
ctio
ns w
ere
due
tobe
com
plet
edbe
twee
n Se
ptem
ber 2
011
and
Mar
ch 2
012.
Whe
re a
pplic
able
we
have
not
ed in
bra
cket
s with
in th
e ac
tion
plan
the
desig
n of
con
trol
s to
furt
her a
ddre
ss th
e ris
ks ra
ised
with
in th
e20
11 re
port
.
Our
opi
nion
Ove
rall,
Inte
rnal
Aud
it ca
n gi
ve s
igni
fican
t ass
uran
ceth
at a
ll ac
tions
agre
edas
a r
esul
t of
the
IT S
ecur
ity a
nd N
etw
ork
Infr
astr
uctu
reRe
view
(10/
10) h
ave
been
impl
emen
ted.
Deta
iled
findi
ngs
are
set o
ut in
the
Follo
w u
p st
atus
sec
tion
of th
isre
port
.
38
Pag
e3
of7
Act
ion
Plan
Expl
anat
ion
ofpr
iorit
y ra
tings
:
Prio
rity
Expl
anat
ion
Hig
h:
Act
ion
that
is c
onsi
dere
d im
pera
tive
to e
nsur
e th
at th
e or
gani
satio
n is
not
exp
osed
to h
igh
risks
. M
ajor
adv
erse
impa
ct o
nac
hiev
emen
t of o
rgan
isat
iona
l obj
ectiv
es if
not
ade
quat
ely
addr
esse
d.
Med
ium
:
Act
ion
that
is c
onsi
dere
d ne
cess
ary
to a
void
exp
osin
g th
e or
gani
satio
nto
sig
nific
ant r
isks
.
Low
:
Act
ion
that
is c
onsi
dere
d de
sira
ble
and
shou
ld re
sult
in e
nhan
ced
cont
rol o
r bet
ter v
alue
for m
oney
. M
inim
al a
dver
seim
pact
on
achi
evem
ent o
f the
orga
nisa
tion’
s ob
ject
ives
if n
ot a
dequ
atel
y ad
dres
sed.
39
Pag
e4
of7
Orig
inal
Agr
eed
Actio
nIm
plem
enta
tion
stat
usPr
iorit
y of
new
reco
mm
enda
tion
(if a
pplic
able
)
Curr
entM
anag
emen
t Act
ion
1Co
nsid
er re
stric
ting
user
logi
nsp
ecifi
ed lo
gin
hour
s for
a n
umbe
r of
user
gro
ups.
Impl
emen
ted
Cons
ider
atio
n w
as g
iven
by
the
IT a
nd IS
man
ager
.
It w
asde
term
ined
that
the
incr
ease
dco
ntro
l offe
red
by ti
me
rest
rictin
g us
erlo
gin
is no
tben
efic
ial a
s it i
s fel
t it c
ould
com
prom
ise th
e fir
eau
thor
ity’s
dut
y as
an e
mer
genc
y se
rvic
e.
(n/a
)N
one
2Am
end
acce
ss fo
r tho
se u
sers
with
inap
prop
riate
Win
dow
s Dom
ain
Adm
inist
rato
r acc
ess p
rivile
ges
iden
tifie
d du
ring
the
audi
t.
Impl
emen
ted
An e
xerc
ise w
as c
ompl
eted
imm
edia
tely
afte
r the
prio
r aud
it in
Aug
ust 2
011
toen
sure
that
onl
y ap
prop
riate
use
rs h
ave
acce
ss to
Win
dow
s Dom
ain
Adm
inist
rato
r acc
ess p
rivile
ges.
(We
note
d th
at tw
o re
port
s hav
e be
ende
signe
d w
hich
are
exe
cute
d an
dre
view
ed o
n a
mon
thly
basis
by
ITm
anag
emen
t to
ensu
re th
at a
nych
ange
s to
this
revi
ewed
list
of
adm
inist
rato
r use
rs is
app
ropr
iate
.)
(n/a
)N
one
40
Pag
e5
of7
Orig
inal
Agr
eed
Actio
nIm
plem
enta
tion
stat
usPr
iorit
y of
new
reco
mm
enda
tion
(if a
pplic
able
)
Curr
entM
anag
emen
t Act
ion
3U
nder
take
an
annu
al re
view
of u
ser
acce
ss ri
ghts
to c
onfir
m o
ngoi
ngap
prop
riate
ness
.
Impl
emen
ted
A sy
stem
of a
nnua
l rev
iew
s has
bee
nun
dert
aken
. Th
is pr
oces
s beg
an w
ith a
revi
ew o
f HR
syst
em u
sers
in A
ugus
t20
11.
The
next
revi
ew h
as b
een
sche
dule
d fo
r Jul
y/Au
gust
201
2.
(It w
as n
oted
that
an
upda
ted
proc
edur
eno
te fo
r use
r acc
ess m
anag
emen
t has
rece
ntly
bee
n im
plem
ente
d in
5th A
pril
2012
. Th
is in
clud
esfo
rmal
ass
ignm
ent
of re
spon
sibili
ty fo
r rev
iew
ing
user
acce
ss ri
ghts
.)
(n/a
)N
one
4U
nder
take
an
annu
al re
view
of a
cces
sto
the
serv
er ro
om to
con
firm
ong
oing
appr
opria
tene
ss.
Impl
emen
ted
Serv
er ro
om a
cces
s rig
hts a
re re
view
edea
ch ti
me
a ch
ange
requ
est i
s mad
e to
eith
er a
dd o
r rem
ove
acce
ss ri
ghts
for
an e
mpl
oyee
.
(n/a
)N
one
41
Pag
e6
of7
App
endi
x A
–D
efin
ition
of a
ssur
ance
opi
nion
s
Leve
l of
Ass
uran
ceD
efin
ition
Subs
tant
ial
Ther
e is
a s
ound
sys
tem
of i
nter
nal
cont
rol d
esig
ned
to a
chie
ve th
esy
stem
obj
ectiv
es.
Ade
quat
eW
hile
ther
e is
a b
asic
ally
sou
nd s
yste
mof
inte
rnal
con
trol d
esig
ned,
ther
e ar
ew
eakn
esse
s, w
hich
put
som
e of
the
syst
em o
bjec
tives
at r
isk.
Lim
ited
Wea
knes
ses
in th
e de
sign
of t
he s
yste
mof
inte
rnal
con
trols
are
suc
h as
to p
ut th
esy
stem
obj
ectiv
es a
t ris
k.
Non
eC
ontro
l des
ign
is g
ener
ally
wea
k le
avin
gth
e sy
stem
ope
n to
sig
nific
ant e
rror o
rab
use.
42
Pag
e7
of7
The
mat
ters
rais
ed in
this
repo
rt ar
e on
ly th
ose
that
cam
e to
our
atte
ntio
n du
ring
the
cour
se o
f the
aud
it w
ork
and
are
not n
eces
saril
y a
com
preh
ensi
ve s
tate
men
t of a
ll th
e w
eakn
esse
sth
at e
xist
or o
f all
the
impr
ovem
ents
that
may
be
requ
ired.
Whi
lst
ever
y ca
re h
as b
een
take
n to
ens
ure
that
the
info
rmat
ion
in t
his
repo
rt is
as
accu
rate
as
poss
ible
, it
is b
ased
on
the
info
rmat
ion
prov
ided
and
doc
umen
ts r
evie
wed
.
No
com
plet
e gu
aran
tee
or w
arra
nty
can
be g
iven
with
rega
rd to
the
advi
ce a
nd in
form
atio
n co
ntai
ned
with
in th
e re
port.
We
emph
asis
e th
at th
e re
spon
sibi
lity
to im
plem
ent a
sou
nd s
yste
mof
inte
rnal
con
trols
res
ts w
ith m
anag
emen
t and
that
our
wor
k sh
ould
not
be
take
n as
a s
ubst
itute
for
this
res
pons
ibili
ty. O
ur w
ork
has
been
con
side
red
to id
entif
y m
ater
ial i
rregu
larit
yw
hich
has
a re
ason
able
pos
sibi
lity
of d
isco
very
, how
ever
, thi
s do
es n
ot p
rovi
de a
bsol
ute
assu
ranc
e th
at m
ater
ial e
rror
, los
s or
fraud
do
not e
xist
.
This
repo
rt is
inte
nded
sol
ely
for t
he u
se o
f the
Aud
it, P
erfo
rman
ce a
nd S
crut
iny
Com
mitt
ee a
nd S
enio
r Man
agem
ent o
f the
Fire
Aut
horit
y.Th
e di
ssem
inat
ion,
dis
tribu
tion,
cop
ying
or
disc
losu
re o
f thi
s re
port
or it
s co
nten
ts is
pro
hibi
ted
unle
ss p
rior w
ritte
n pe
rmis
sion
is o
btai
ned
byH
W C
ontro
ls &
Ass
uran
ce L
LP.
No
resp
onsi
bilit
y to
any
third
par
ty is
acc
epte
d as
the
repo
rt ha
s no
t bee
n pr
epar
ed a
nd h
as n
ot b
een
inte
nded
for a
ny o
ther
pur
pose
.
© 2
012
HW
Con
trol
s an
d A
ssur
ance
LLP
.All
right
s re
serv
ed.
HW
Con
trols
& A
ssur
ance
LLP
Reg
iste
red
in E
ngla
nd &
Wal
es, N
o. O
C32
3078
Reg
iste
red
Offi
ce: 3
0 C
amp
Roa
d, F
arnb
orou
gh, H
amps
hire
GU
14 6
EW.
43
44
Recommended