Board Orders Response to Grand Jury Report Regarding Audit

The Board of Supervisors this week directed staff to respond to a grand jury report that cites deficiencies in how various administrators handled an audit of the Riverside County Department of Information Technology and its security protocols.

In a 5-0 vote on Tuesday, the board instructed the Executive Office to submit answers to the 19-member civil grand jury’s findings in a five-page report critical of apparent inattentiveness by the IT department and its treatment of a 2014 internal audit conducted by the county auditor-controller’s office.

County CEO Jay Orr assured the board that a response will be issued within the next 60 days.

The audit examined operations related to IT’s Information Security Program, which focuses on protecting hardware, including network servers connecting multiple agencies.

At the conclusion of the audit last fall, county analysts determined that the IT department’s operating structure “did not provide reasonable assurance that county operational and reporting objectives related to assessing, accepting and mitigating information security risks ... were met.”

Auditor-Controller Paul Angulo noted that IT officials had verbally responded to the finding but “never provided a written response,” as required under two separate Board of Supervisors’ policies.

According to the grand jury report, when jurors in January requested to see a copy of the IT department’s written response to the audit, they received nothing back but were instead informed that all future grand jury requests would need to be vetted by the Office of County Counsel.

The grand jury pointed to two provisions -- under California Penal Code sections 921 and 925 -- that guarantee unfettered access to public records.

Jurors found fault with the interim head of the IT department, Chris Hans, and his boss, county CEO Jay Orr, whom the grand jury said was not enforcing county policies mandating written responses to internal audits. There was also concern expressed about an apparent hesitancy on the part of the auditor-controller’s office to regularly provide copies of internal audits to the grand jury.

Jurors made the following recommendations:

-- the IT department immediately comply with county policy and file a written response to the audit;

-- the CEO enforce county policy;

-- County Counsel Greg Priamos “recognize the grand jury as an independent body, which operates autonomously”; and

-- the auditor-controller’s office provide copies of all internal audit reports to the grand jury.

The IT department’s new chief, Steve Reneker, is slated to take the helm next month. The agency has been in a state of flux since 2012, when the board authorized a sweeping consolidation of more than 30 agencies’ Internet-based and data storage operations into a single unified structure.

Former IT Director Kevin Crawford resigned last August.