GUILFORD COUNTY INTERNAL AUDIT DEPARTMENT

Kay Cashion, Audit Committee Chair

Danny Rogers, Sheriff
Clarence Grier, Deputy County Manager
Mark Payne, County Attorney
Karen Fishel, Human Resources Manager

March 13, 2019

Marty Lawing
Guilford County Manager

RE: 1819-ETH-010 Sheriff’s Office Documents

Mr. Lawing,

This report contains our findings and recommendations for the recently completed review of concerns
raised by Sheriff Rogers regarding the transition between Sheriffs. Specifically, we reviewed the
following concerns:

 Disposal of documentation needed by the new Administration

 Missing computer equipment
 Use of external electronic storage devices, and


Internal Audit primarily used inquiry and data analytics to reach our conclusions. Please see Appendix 1
for our conclusions and recommendations.

The review, this report and other matters related to this review should be treated as confidential and
only shared with the permission of the Internal Audit Department or you, the County Manager.

We wish to thank Sheriff Rogers and his staff for the cooperation and courtesies extended to us during
this review. Please feel free to contact me or Clarence Grier with any concerns, comments or questions
you might have.

Thank you,
Chad Muhlestein, CPA, CIA
Director of Internal Audit

March 13, 2019 Confidential 1

 GUILFORD COUNTY INTERNAL AUDIT DEPARTMENT

APPENDIX 1: FINDINGS AND RECOMMENDATIONS

The following findings and recommendations were discussed with you previously.

Concern #1: Disposal of Documentation needed by the New Administration

Vital documents needed by the new Sheriff’s administration were disposed of (shredded).

Review Work Performed and Findings

Internal Audit interviewed the following individuals:
 BJ Barnes (former Sheriff)
 D. Lemonds (assistant to Mr. Barnes)
 R. Powers (former Colonel)
 B. Stewart (assistant to Mr. Powers)
 C. Martin (former Captain)
 T. Roach (former HR Assistant)
 D. Giles (Officer with responsibility for cleaning the Otto Zenke Building)
 P. Williamson (Accounting Tech)

Internal Audit substantiated that documents were shredded; however, it appears that these
documents were personal in nature (e.g., applications for Sheriff Association membership) or
duplicates of official County documents held elsewhere (e.g., PA52 forms held in HR).

Shredding of documents was a common occurrence. The volume of shredded documents appears
to have not significantly increased during the transition per cleaning staff. Outdated annual texts
(e.g., NC Sheriffs’ Association Annual book) were disposed of and appear to have caused the initial
concern.

Internal Audit requested permission to inquire of personnel and administrative staff if vital
documents were missing, but no response to that request has been received.

Internal Audit Conclusion

Internal Audit cannot substantiate the concern that vital documents were disposed of (shredded).

Recommendations
Internal Audit noted that Trustees are used to clean the Otto Zenke Building. We believe this is a
high risk to the confidentiality of documents / information and we recommend that this practice be
discontinued.

Concern #2: Removal of Computers

Computers needed to run the Sheriff’s Office were removed.

March 13, 2019 Confidential 2

 GUILFORD COUNTY INTERNAL AUDIT DEPARTMENT

Review Work Performed

Internal Audit interviewed the following individuals:
 J. Vereen (Information Services Technician)
 M. Serafini (Information Services Technician)
 C. Martin (former Captain)

Internal Audit confirmed that computers for the new Administration’s Command Staff were
removed; these computers were secured within the Sheriff’s Offices. These computers were
removed to facilitate the installation of new / updated machines, per standard Sheriff’s Office
computer usage practices.

Internal Audit Conclusion

Internal Audit substantiated that computers for the new Administration’s Command Staff were
removed; however, Internal Audit found no mal-intent associated with the removal. All
information on these computers was and remains secured.

Recommendations
Internal Audit recommends that a comprehensive computer use policy for the Sheriff’s Office be
developed with the assistance of the County’s IT Department. This policy should include clear
guidelines on removal and replacement of computer equipment.

Concern #3: Use of Thumb Drives to take County Information

Thumb drives (external storage devices) were used by members of the departing Administration to
take County information with them.

Review Work Performed

Internal Audit interviewed the following individuals:
 BJ Barnes (former Sheriff)
 D. Lemonds (assistant to Mr. Barnes)
 R. Powers (former Colonel)
 B. Stewart (assistant to Mr. Powers)
 C. Martin (former Captain)
 T. Roach (former HR Assistant)
 P. Williamson (Accounting Tech)

Internal Audit confirmed that Mr. Barnes and Mr. Powers both used thumb drives to remove
personal information from their work (County) computers. Both indicated that only personal
information such as personal pictures were taken. Mr. Barnes stated that the thumb drive he used
was personally purchased by himself, this was corroborated by his former assistant, Ms. Lemonds.
Mr. Powers was less sure, but believed the thumb drive he used was a personal purchase (he had
co-mingled personal and County thumb drives during his employment).

March 13, 2019 Confidential 3

 GUILFORD COUNTY INTERNAL AUDIT DEPARTMENT

Internal Audit determined that 27 high capacity thumb drives were received in the Sheriff’s Office
during the transition period. The use and current location of these thumb drives could not be
determined by the Sheriff’s Office.

Internal Audit Conclusion

Internal Audit cannot substantiate the concern that County information was taken by members of
the departing Administration.

Recommendations
Internal Audit recommends the following:

 An inventory of external storage devices be made and these devices be secured; a periodic
inventory of these types of devices should be taken.
 A policy for approved use of these devices should be developed and shared.
 All such devices should be required to use encryption.

*Redacted portions indicated items protected under N.C.G.S. 153A-98 pertaining to personnel matters

Concern #4:

March 13, 2019 Confidential 4

 GUILFORD COUNTY INTERNAL AUDIT DEPARTMENT

March 13, 2019 Confidential 5