Holes in O.C.’s Coffers

Two computer technicians in Orange County’s treasurer-tax collector’s office have authority to wire billions of dollars in county taxpayer money anywhere in the world, according to a confidential audit report.

Although no cash is missing, the audit exposes a weakness in the county’s financial controls, several supervisors said Tuesday.

“You would think we had all the checks and balances needed in place,” said Supervisor Tom Wilson, noting that it had been more than 10 years since the county’s $1.64-billion financial collapse. “It appears we have a gap here.”

Peter Hughes, internal audit director, reported his findings at Tuesday’s board meeting, but did not make public a confidential supplement that detailed what Hughes called a “material weakness” in the treasurer’s office.

Treasurer-Tax Collector John M.W. Moorlach, who was appointed and then elected after predicting the county’s 1994 bankruptcy, said he was taking the audit seriously, but downplayed the apparent security gap.

He said the treasurer’s office had numerous layers of security, and the employees with access to the accounts were trustworthy.

According to a copy of the supplemental report obtained by The Times, a data systems manager and a systems programmer-analyst have authority to access, make online approval and release funds to “any destination and for any dollar amount up to the available balance in a bank account.”

Wells Fargo Bank notified the county that “there are no restrictions on the destination of the wire transfers of funds or the dollar amounts sent out of these accounts as long as the funds are available in the accounts,” the audit said. The county has $5.2 billion in its treasury accounts.

Hughes suggested at least 10 ways to correct the problem, which Moorlach has already started implementing.

Even though Moorlach has begun to close the loophole, Supervisor Lou Correa said, “Nobody seems to know how long we had the problem. And now we’re hearing it may take 90 days to fix this, and that doesn’t give me a great peace of mind.”

The audit also found that the treasurer’s computer operating system didn’t lock out users after a number of unsuccessful logon attempts, computers were not configured to log off automatically after a period of inactivity, and passwords needed to be lengthened for greater security.

But Moorlach said that if an employee stole funds, the theft would be discovered quickly.

“We have a lot of internal checks and control systems,” Moorlach said. “If there was a deviation of our cash balance, we would know it almost immediately.”

Moorlach said he and top staff members had taken steps to fix a loophole that he attributed mostly to a software problem with a data systems program used by thousands of commercial clients.

The problems will be solved, in part, when the office upgrades to the latest version of the software, SunGard Quantum Treasury System, Moorlach said.

“We’re writing to the software provider of the changes we need now,” Moorlach said, adding that the upgrades were not expected to be completed until late December.

The newer version would require, among other things, dual authorization for wire transfers, preventing one person from adding or making changes to critical information, Moorlach said.

Moorlach acknowledged that the audit found a security opening, but he said he trusted his employees, especially those with access to the county’s treasury accounts.

“Would two information technology people in my department do that? I doubt it,” Moorlach said. “We have had in the past a couple of employees who have embezzled, but our staff knows the penalties.... It could happen, but the potential of that happening is remote.”

In 1998, a clerk was arrested on suspicion of embezzling $15,795 in property tax payments. Two years later, another clerk was convicted of grand theft after sheriff’s investigators found the clerk had a $60,000 agency check and two property tax checks for $400.

Moorlach met with Supervisor Jim Silva recently to discuss the auditor’s report and what steps Moorlach had taken.

Supervisors instructed Hughes to report monthly about the treasurer’s progress.