The grand jury said the county's IT department did not meet the requirement to provide protection and mitigate security risks.
A critical grand jury report prompted Riverside County CEO Jay Orr to defend himself and his staff as having the “utmost consideration of the public trust.”
Orr’s statements were contained
in a brief supplied Tuesday to the Board of Supervisors, which filed the
comments in a silent 5-0 vote, electing not to address the jury’s findings --
or the executive officer’s take on them.
The 19-member civil grand jury
in April submitted a negative evaluation of the IT department and its treatment
of a 2014 internal audit conducted by the county auditor-controller’s office.
The audit examined operations
related to IT’s Information Security Program, which focuses on protecting
hardware, including network servers connecting multiple agencies.
At the conclusion of the audit
last fall, county analysts determined that the IT department’s operating
structure “did not provide reasonable assurance that county operational and
reporting objectives related to assessing, accepting and mitigating information
security risks ... were met.”
Auditor-Controller Paul Angulo
noted that IT officials had verbally responded to the finding but “never
provided a written response,” as required under two separate board policies.
According to the grand jury
report, when jurors in January requested to see a copy of the IT department’s
written response to the audit, they received nothing back but were instead
informed that all future grand jury requests would need to be vetted by the
Office of County Counsel.
The grand jury pointed to two
provisions -- under California Penal Code sections 921 and 925 -- that
guarantee unfettered access to public records.
Jurors further found fault with
the interim head of the IT department, Chris Hans, and his boss, Orr, whom the
grand jury said was not enforcing county policies mandating written responses
to internal audits.
The jury submitted several
recommendations, to which Orr and his staff responded, per the board’s
direction.
As to jurors’ finding that the
Department of Information Technology did not reply in writing to the
auditor-controller in a timely manner, Orr and his staff attributed the delay
to lack of a “permanent director,” with a vacancy at the helm following the
resignation of former IT chief Kevin Crawford last August.
“The new director came aboard
on May 4, 2015, and issued the written response on May 27,” the Executive
Office wrote. “The submission was timely based upon the circumstances.”
Orr and his staff also took
issue with the jury’s determination that the CEO was failing to do his job in
enforcing board policies, as exemplified by the belated response to the audit.
“The grand jury has provided no
legitimate basis for such an overly broad assertion,” according to the
Executive Office. “They have based their conclusion on the late filing of one
department.
“There are approximately 42
agencies of the county that are subject to audit. The executive officer and his
staff take all of their responsibilities seriously and carry them out
judiciously, with the utmost consideration of the public trust.”
Orr lastly objected to the
jury’s perception of the county counsel’s request to vet document requests in
advance as “interference,” saying the conclusion was “misguided and contrary to
the county counsel’s ethical and statutory duties to its client.”
Temecula resident Paul Jacobs,
a self-identified public watchdog and longtime critic of the IT department,
denounced the Executive Office’s response to the grand jury as “defensive and
disrespectful” in tone.
“The jury did due diligence.
Their findings were accurate,” Jacobs told the board.
June
17, 2015
Lake
Elsinore-Wildomar Patch
By
Alexander Nguyen
No comments:
Post a Comment