UNIVERSITY OF CALIFORNIA, SANTA CRUZ OFFICE OF INTERNAL AUDIT AND ADVISORY SERVICES

Transcription

1 UNIVERSITY OF CALIFORNIA, SANTA CRUZ OFFICE OF INTERNAL AUDIT AND ADVISORY SERVICES Ticket Office System and Internal Controls AUDIT NUMBER: SC End of Field Work: June 20, 2008 Final Report Date: June 30, 2008

2 TABLE OF CONTENTS I. INTRODUCTION A. Purpose... 2 B. Scope. 2 C. Background 2 D. Positives. 3 II. ISSUES A. Backup and Recovery Testing...3 B. Ticket Office Staff Access to Financial Information System...3 C. Ticket Office Screen Door Lock...4 D. Ticket Office Change Fund...5

3 I. INTRODUCTION A. Purpose The purpose of this audit was to evaluate the internal controls in the UCSC Ticket Office, City of Santa Cruz ticketing operations, and the Audience View Ticketing System. B. Scope The auditor interviewed staff from the Ticket Office, University Relations, Information Technology Services (ITS), and the City of Santa Cruz. We also: reviewed UCSC Ticket Office operating procedures B.4.1 through B.4.23 reviewed City of Santa Cruz Civic Auditorium and Finance Department procedures flow charted or reviewed flow charts for cash handling and operating procedures reviewed procedures for reconciling settlements between UCSC and the City of Santa Cruz for tickets sold for each others events reviewed system controls including backup and recovery procedures, user permissions, and general system security and management reviewed Payment Card Industry (PCI) standards compliance conducted security scans of the ticketing system and reviewed PCI mandated scans. C. Background In December 2006 UCSC and the City of Santa Cruz entered into an agreement (Agreement) to jointly acquire, maintain, and manage a shared ticketing software system to allow each entity to increase the scope and quality of ticketing services they provide. The software that was jointly selected for this purpose was the Audience View Ticketing application and web interface (AV). UCSC acted as the lead agency in acquiring the server hardware and administering the system and its security in the UCSC central Data Center. Both the City and UCSC Ticket Office managers can create AV user accounts for cashiers, but UCSC is responsible for rule group security and administrator level functions in the application. UCSC manages all web based ticket sales and makes payments to the City for their shows. The Agreement also defines joint-agency governance committee, referred to as the "Ticketing System Governance Committee comprised of three members appointed by the City and three members appointed by UCSC. The Ticketing System Governance Committee is also charged with responsibilities and duties for the joint acquisition, maintenance and operation of the shared ticketing software system. The agreement specifies that the City and UCSC shall each reconcile ticket sales sold in their respective ticketing offices (and web based sales for UCSC) for the other agency and make payment to the other agency for the ticket and service fee revenues from their shows. It was later determined that payments would be made on a weekly basis. The cross agency auditing responsibilities and procedures from the Agreement states: UCSC Internal Audit will assume primary responsibility for auditing the processes, finances, and computer systems maintained and used by UCSC 2

4 All audit reports generated by UCSC Internal Audit or by the City Finance Department shall be provided to the Ticketing System Governance Committee and be shared with the appropriate Audit staff in the other agency. Each agency shall assure report confidentiality is maintained and shall not re-distribute reports except to persons with a business need When feasible, UCSC Internal Audit and the City Finance Department may work cooperatively to audit the system, finances, and operations and may issue a joint agency audit report. The Ticket Office at UCSC is managed by the University Relations Division. The Ticket Office Manager reports to the Resource Planning and Management Budget Director in University Relations. The AV Ticketing System software and hardware is supported by the University s ITS Division. The Civic Auditorium Box Office is part of the City s Parks and Recreation Department. The City Finance Department provides IT support and facilitates payments to the University. D. Positives The Ticket Office at UCSC has well documented user friendly procedures for both generic operations and use of Audience View Ticketing System. They have also developed good internal controls and documented procedures for off site ticket sales in challenging locations such as the Rio Theater. The City of Santa Cruz Finance, Parks and Recreation, and Information Technology departments were all very cooperative and helpful in completing this review. We did not note any operational problems with City ticketing internal controls. During the audit the University ITS Division successfully implemented an application level firewall for the AV system to maintain full PCI compliance. Background checks were performed on all credit card processing cashiers and staff at both the City and University in compliance with PCI standards. The Ticket Office Manager and Assistant Manager have received basic training in using the University s Financial Information System (FIS) and have access to operating ledger and budget information. Our independent IT security scans did not reveal any system vulnerabilities in the AV system. II. ISSUES A. Backup and Recovery Testing The UCSC Data Center does not have a schedule to regularly test backup restoration for the AV application, data, or operating system. Full and incremental backups are performed by the Data Center, but a test restoration to the test server has not been performed since the last AV upgrade on March 31, While a test might not be needed for every minor upgrade, in our opinion the Data Center should have a planned schedule to periodically test restoration of this system from the back up media. Application or operating system upgrades should be evaluated on an individual basis to determine if additional restoration testing is needed to assure a backup can successfully be restored. During the audit ITS began developing a prioritization table for back up restoration testing that included AV in the top group of systems. RECOMMENDATIONS TO ITS: 1. Develop a plan to periodically test back up restoration for the Audience View system. (medium risk) 3

5 2. Evaluate any new upgrades to the AV system to determine if additional backup restoration testing is needed and take action accordingly. (medium risk) ITS MANAGEMENT RESPONSE: 1. Concur with the recommendation: ITS will develop a plan and initial testing of backup restoration for the Audience View system on a quarterly basis. The plan will be in place by August 1, Responsible Party: Scott Councilman 2. Concur with the recommendation: ITS will evaluate any upgrades to the AV system and determine if additional backup restoration testing is necessary and take action accordingly. Additional verbiage will be added to documented plan procedure Responsible Party: Scott Councilman Expected Implementation Date: August 30, 2008 B. Ticket Office Staff Access to Financial Information System Data The Ticket Office Manager and Assistant Manager who reconcile the tickets sold for City events do not have direct access FIS balance sheet accounts where money owed to the City and where gift certificate revenues are deposited. AV and daily deposit reports are used to prepare a spreadsheet to reconcile and determine the amount owed to the City. A payment request is submitted accordingly. We did not detect any errors or problems with the reconciliation or payments, but direct view only access to the balance sheet accounts in FIS would provide an additional level of reconciliation. General Accounting monitors all balance sheet accounts, but not on a weekly basis. Both the Ticket Office Manager and Assistant Manager have taken the basic FIS training, but need permission to view the balance sheet accounts. They may also require instruction from the General Accounting Department to effectively use and understand the system s balance sheet reports. RECOMMENDATION TO UNIVERSITY RELATIONS MANAGEMENT: Assure the Ticket Office Manager and Assistant Ticket Office Manager are provided the appropriate access and training to use the FIS balance sheet information and reports to reconcile this system to the AV and daily deposit information. (low risk) MANAGEMENT RESPONSE: Concur with Recommendation. The Ticket Office Manager, Assistant Manager and RPM Senior Budget Analyst have the necessary access to the TO balance sheet account. Responsible Party: Ticket Officer Manager Luisa Cardoza, Ticket Office Assistant Manager Jessie Bond, and RPM Senior Budget Analyst Jackie Bertuleit will take balance sheet training with Jane Kling in General Accounting. Expected Implementation Date: As soon as Accounting is through fiscal close and no later than September

6 C. Ticket Office Screen Door Lock The Ticket Office keeps their door open to provide ventilation, since it does not have any windows that can be opened or an air conditioning system. As a result of our last audit of the Ticket Office, Audit #03-07, issued January 2003 the Ticket Office had the University Lock Shop install a heavy duty locking screen door to provide physical security to an area where cash was being counted that was visible from outside the office. During the current audit we observed that there is gap on side of the screen door large enough that the latch bolt could easily be pushed in and the door opened without a key. To remedy this situation the Lock Shop installed a metal plate over the latch bolt, but the metal plate is held on with two standard Phillips screws. The threads in the door for one of the screws are stripped out and loose on the door. There is another solid door that is locked when no one is in the Ticket Office, but in our opinion it should be a fairly simply and low cost procedure to install screws that cannot be removed with a standard screw driver or pocket knife. RECOMMENDATION TO UNIVERSITY RELATIONS MANAGEMENT: Request the Lock Shop secure the protective plate over the Ticket Office screen door lock bolt so that it cannot be easily removed. (medium risk) MANAGEMENT RESPONSE: Concur with Recommendation. Responsible Party:Ticket Office Manager Luisa Cardoza Expected Implementation Date:September 2008 D. Ticket Office Change Fund The Ticket Office currently has a change fund of $1000 divided into 10 floats or individual cash drawers of $100 each. Sometimes a float will run out of change and they will have to take money from another float so that they can continue to make change. The 10 floats are setup to assure individual accountability of all the cashiers. When money is taken from one float and put into another, the transaction is well documented. In our opinion, an increase in the amount of the change fund to avoid this operation is justified. The Ticket Office already planned to request an increase in the amount of the change fund to resolve this problem and we are citing it to document Internal Audits concurrence with this request. RECOMMENDATION TO UNIVERSITY RELATIONS MANAGEMENT: Increase the Ticket Office change fund so that they have sufficient change in each sub fund (float) so that money does not need to be exchanged to make change. (medium risk) MANAGEMENT RESPONSE: Concur with Recommendation. Responsible Party: Ticket Office Manager Luisa Cardoza Expected Implementation Date: August 2008 *** 5