Written by Official Response on Marion’s Financial and IT Problems
We’ve received an important email from the Ohio Auditor of State’s Special Investigations Unit (SIU) about the serious financial and computer system problems in the City of Marion. Our initial complaint to them, which you can see parts of in the attached emails, talked about issues that have been happening for a very long time—at least since 1983, based on the oldest official audit we have.
These decades long failures, documented by official Ohio Auditor of State Audits dating back to at least 1983, have enabled the Silent Sabotage of Marion’s financial systems and information technology systems. Our email to the Ohio Auditor of State was signed by all Marion Watch Core Team, and our opinion was validated by several IT experts, and those in the legal and financial sectors in Ohio and beyond.
The Ohio Auditor of State’s office has decided to move forward with a review of these concerns.
What We Complained About
Our initial complaint detailed several major, long-term issues:
- Financial Mess: We reported problems like significant errors in tax payments for over six months, a lot of penalties for filing things late, and big differences in how much cash the city reported having. This suggested that money was not being tracked correctly.
- Computer System Failures (IT): We provided proof that the city’s computer systems for financial data were severely broken.
- No Controls: Key security features, like those that prevent simple mistakes, were turned off.
- Easy Access: Unauthorized people, including those who were not supposed to be system administrators, had “unlimited administrative access” to sensitive financial systems. This has been confirmed by eye witnesses in both the current and former administrations.
- Sharing Passwords: Employees were allegedly sharing credentials (usernames and passwords), which makes it impossible to track who does what.
- “Permissions Wars”: We heard reports of system administrators changing one another’s permissions, making a mess of who could do what on the network.
- Disappearing Records: People reported that important records were “disappearing” from systems, which destroys the audit trail (the steps an auditor takes to track a transaction).
- New Software, New Problems: The security compromises seemed to have happened around the same time a new financial software program was installed. This raised concerns about how that new system was set up. This includes the missing reconcilation module, an imoprtant part of the software, that was missing from the initial installation in 2007-2008 and somehow continued until very recently.
- Long-Term Problem: We pointed out that these problems are not new. They are systemic vulnerabilities that have built up over time and need immediate, specialized attention, specifically, a deep forensic IT investigation to find the root cause.
The Auditor of State’s Decision
The Auditor’s office confirmed that they received our complaint and took the following steps:
- Referred to the Task Force: Our complaint was immediately sent to the Auditor of State’s Special Audit Task Force for a preliminary review.
- Assignment for Audit: The Special Investigations Unit decided to officially refer the matter to two important groups within the Auditor’s office:
- The Auditor of State’s Central Region.
- The Data & Information Technology Audit (Dita) team.
- Cybersecurity Help Recommended: The SIU also advised the City of Marion to look into the Ohio Persistent Cyber Improvement Program to help fix its computer security problems.
In short, the state has acknowledged the severity of the issues, especially with the computer systems, and has sent the matter to their specialized teams for a deeper look and audit.
We have urged the Auditor of State to do a complete review of the financial software settings and to fundamentally rebuild the internal controls in the City Auditor’s office to bring back public confidence. We now look forward to open and transparent communication with their office as they move forward with their investigation.
Marion Watch will be responding to this communication with more specific information and will continue to update the public in the interest of transparency, accountability, and truth.
