BCC: Stormwater DAVID Contract Attestation – Date March 24, 2020
Summary
The Pasco County Department of Inspector General conducted Audit Report No. 2020-02 of the BCC Stormwater Management Division's use of the Driver and Vehicle Information Database (DAVID) system. The audit period covered October 28, 2018 through October 28, 2019, and was initiated in response to an attestation request from the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) under MOU Contract #HSMV-0319-17.
The IG concluded that internal controls over DAVID information were overall adequate and the Division was in compliance with the MOU, authorizing it to execute the attestation statement. However, six audit comments were identified representing opportunities to strengthen the control environment, all of which had been or were being corrected by management during the course of the audit.
All six findings were acknowledged by management with agreed corrective action plans, primarily involving updates to the Stormwater Management Enforcement Policies and Procedures for DAVID Access, with a target implementation date of January 24, 2020.
6 findings
- Finding 1mediumdata access
DAVID workstation not secure from unauthorized access or view
The cubicle used to access the DAVID system was not secure from unauthorized view and access. Other Stormwater Inspectors who were not authorized DAVID users shared the cubicle workspace, and the cubicle had no door. DAVID users stated they attempted to access the system only when unauthorized inspectors were absent, but this was not a reliable control. This arrangement violated MOU Section V, Subsection G, which required DAVID information to be protected from unauthorized persons viewing, retrieving, or printing it.
Recommendation: Provide DAVID users with a secure location to access the system and enter protected information. If not feasible, implement compensating controls to ensure secure access when other employees are present.Management response: Agreed. A temporary preventive action plan will be established to restrict unauthorized personnel access to the area when the DAVID system is in use. A permanent solution is anticipated upon relocation to new facilities (01/04/2023). Stephen Honaker is responsible. Target implementation: Immediately. - Finding 2mediumpolicy
Authorization and Acknowledgement Forms not maintained or current
Completed Access Authorization Request and Acknowledgement of Penalties for Misuse forms were not current and could not be located. Original forms from 2016 were missing and had to be re-executed on November 18, 2019. Acknowledgement of Penalties for Misuse forms dated May 28, 2017 lacked supervisor signatures, a deficiency previously identified in audit #2016-05. Additionally, the acknowledgment form for the Auditor III who was granted DAVID access was not on file with the Division.
Recommendation: Maintain current Acknowledgment of Penalties and Misuse forms with proper approval signatures for all DAVID users including auditors. Revise the SOP to require periodic maintenance of these forms. Encrypt and store PDFs in the protected Enforcement folder and document storage procedures in the policies.Management response: Agreed. The Pasco County Stormwater Management Enforcement Policies and Procedures for DAVID Access has been updated, specifically Section 1 (Initial DAVID Setup). Stephen Honaker and Jaime Morales were responsible. Target implementation: January 24, 2020. - Finding 3mediumdata access
Review of POC DAVID activity not independent or documented
The Assistant Director of Public Works stated he conducted monthly reviews of the Point of Contact's (POC) DAVID activity, but these reviews were not documented. Furthermore, the user activity reports reviewed were generated by the POC from the DAVID system, meaning the review was not independent. As a result, the IG could not verify that reviews were actually performed or that the information was complete and accurate.
Recommendation: The Assistant Director of Public Works should independently run the POC's User Activity Report from the DAVID system during monthly and quarterly reviews. Request read-only access for monitoring purposes. Create documented step-by-step procedures for conducting and documenting quarterly reviews, ensuring records are maintained for two years per MOU requirements.Management response: Agreed. New functions and responsibilities for the Assistant Director of Public Works have been incorporated into the Stormwater DAVID Enforcement Policies and Procedures, including Sections 5a and 5b (DAVID Monitoring). The ADPW will independently access, confirm, digitally sign, and password-encrypt monthly monitoring reports saved in the protected Enforcement Folder. Stephen Honaker and Jaime Morales were responsible. Target implementation: January 24, 2020. - Finding 4mediumpolicy
DAVID Access Standard Operating Procedures not up-to-date
The DAVID Access SOPs had not been updated since April 20, 2016, and contained numerous deficiencies across multiple areas: incorrect titles for responsible personnel; missing requirements for authorization forms; outdated or absent procedures for user activation, deactivation, and monitoring; SOP attachments with incorrect information or no longer in use; procedures that did not match actual operating practices; missing guidance for securely inputting DAVID data into citations and storing documentation; and absence of MOU-required misuse reporting details and agency head certification requirements.
Recommendation: Update all policies, procedures, and attachments to reflect clear and current processes for all DAVID-related activities performed by Stormwater employees, addressing all identified gaps and inconsistencies noted in sub-items (a) through (g).Management response: Agreed. Multiple sections of the Pasco County Stormwater Management Enforcement Policies and Procedures for DAVID Access have been updated and all attachments corrected. Stephen Honaker and Jaime Morales were responsible. Target implementation: January 24, 2020. - Finding 5mediumpolicy
FLHSMV not timely notified of agency head change
The FLHSMV was not notified of the change of agency head within the required 10 calendar days as mandated by MOU Section IV, Statement of Work, Subsection B(10). The former County Administrator retired and was replaced on May 1, 2017, but the FLHSMV was not notified until February 26, 2019 — nearly two years after the change occurred.
Recommendation: Establish procedures for regularly reviewing the MOU and comparing its requirements to the DAVID Access SOP. Revise the SOP to explicitly instruct Stormwater staff to follow the MOU notification requirement in Section IV, Subsection B(10).Management response: Agreed. Section 10 (Information Update) has been added to the Stormwater DAVID Enforcement Policies and Procedures to require updating DAVID system information within 10 calendar days of any change. Stephen Honaker and Jaime Morales were responsible. Target implementation: January 24, 2020. - Finding 6lowpolicy
POC Quarterly Monitoring Logs contained incorrect and duplicative information
The POC Quarterly Monitoring Logs contained incorrect information and appeared to duplicate the Quarterly Quality Control Review Report required by the MOU. Specific issues included: the log referenced supervisor field logs that Stormwater did not actually use; the log referred to an incorrect search code; and the log indicated that signed authorization forms for all users were verified quarterly, even though the POC could not locate those forms when requested.
Recommendation: Evaluate whether the POC Quarterly Audit Log is necessary and consider discontinuing it to prevent duplication. If retained, revise it to reflect current Stormwater operations and create a procedure requiring supporting documentation to be attached, such as the User by Agency Report and authorization forms.Management response: Agreed. Section 5 (DAVID Monitoring) of the Stormwater Management Enforcement Policies and Procedures has been created to address these issues, and all attachments have been corrected. Stephen Honaker and Jaime Morales were responsible. Target implementation: January 24, 2020.