The Internal Audit Department provides
a variety of information technology services to County
departments and agencies including audits and reviews of:
General computer controls – security planning and management,
access controls, application software development and change control,
operating system software, segregation of duties, and service continuity.
Application controls – data input, processing, and output.
Application development – request, requirements, planning,
design, development, and testing.
Additionally, we perform continuous auditing using CAATs (Computer
Assisted Audit Techniques). We utilize a proprietary, state-of-the-art
and industry recognized software product to help us
analyze patterns and exceptions in the County's financial
data.
IT STANDARDS & CRITERIA
Criteria used in evaluating information
technology applications and procedures is derived from:
FISCAM (Federal Information Systems Controls Audit Manual) by the
GAO
Industry best practices
IT SELF-ASSESSMENT
The Internal Audit Department has
prepared an IT self-assessment form. We encourage
County Departments' use of the form to help ensure an
adequate control system exists in their IT environment. If
you are with a County Department and would like to request
a copy, please contact us at 714.834.5475.
SECURITY & COMPLIANCE
As an employee of the County of Orange,
you can help keep our technology infrastructure secure
and compliant.
Activate the operating system screen saver password feature and lockout
your workstation when leaving it unattended.
Do not open e-mails and attachments from senders you do not recognize.
Comply with software licensing for all applications and do not
violate copyright laws (e.g., for software, music, video).
Use strong passwords for your user accounts and do not share passwords
with anyone or write passwords down.
Do not include all or part of your user ID in your password.
Use at least seven characters in your password.
Use at least three of the following four groups: upper and lower
case characters, numbers, and special characters (!,@,#,etc.).
IT managers and administrators should facilitate sound IT practices.
Enable virus scanning software on all workstations and servers and
ensure software patches and virus updates are installed on a regular
basis.
Assign access using the least privilege principle and only grant
access on a need to know and right to know basis.
Ensure key applications have end-user and I/T support documentation.
Perform a risk analysis of I/T operations and be familiar with
data sensitivity and impact of a security breach.
Update business continuity plans and ensure staff are familiar
with disaster work-around procedures.
Document development, testing, and approval of all application
changes.
Set operating and application security settings based upon the
risks associated with the data you control.
Enforce password history, maximum & minimum password age, and
minimum password length.
Set an appropriate account lockout duration & threshold and
reset period.
Enable system event auditing and frequently review system logs.
HOT-LINE
OC Fraud Hotline
Call us 24 hours a day, 7 days a week at 714.834.3608. Anonymous claims by phone or online are okay. IMPORTANT: Employees reporting fraud are protected under the Whistleblower Law - California Labor Code 1102-5.
Legal