State Auditor’s IT General Controls Audit Finds Cybersecurity Training Issue
ADP Board Meeting - July 29, 2026
Meeting Details: The Automatic Data Processing Board (ADP) held a Special Meeting beginning at 11:30 am on July 29, 2026 in the Geauga County Auditor’s Office Appraisal Conference Room at 231 Main St., Chardon, OH 44024. Virtual access was available via MS Teams, and the agenda was provided in advance. Members of the public may attend ADP meetings virtually via MS Teams by emailing an invitation request to Auditor’s Office Chief Operations Officer Pam McMahan at McMahan@geauga.oh.gov. This Observer attended via MS Teams.
Public Comment: ADP does not have a written public comment policy. In practice, public comment is solicited at the end of the meeting.
Board Attendance:
-
Auditor/Chief Administrator – Frank Antenucci for Charles Walder
-
Clerk of Courts – Sheila Bevington
-
County Commissioner – Ralph Spidalieri (absent)
-
County Engineer – Andy Haupt
-
Board of Elections – Tyler Plants and Scott Daisher for Nora McGinnis
-
County Prosecutor – Jim Flaiz
-
Recorder – Celesta Mullins (absent)
-
Sheriff – Scott Hildenbrand
-
Treasurer – Caroline Mansfield for Chris Hitchcock
-
Coroner – John Urbancic (absent)
-
Common Pleas Court Judge - Vacant
ADP Staff Attendance:
-
Karen Murphy - Director, CARE (virtual)
-
Ashley Serraglio - Senior Archives and Records Clerk (virtual)
-
Madeline Simmons (virtual)
-
Katelyn Cellitti, Operations Coordinator (virtual)
-
Robert Bushman (virtual)
Reviewer Note: ADP restructured into three groups in 2025: Department of Advanced Technology and Applications (DATA), Department of Advanced Research & Cybersecurity (DARC) and Department of County Archives and Records Enterprise (CARE). More information on this restructuring is available in the March 4, 2025 ADP Observer Report.
Other Government Representatives:
-
Pam McMahan - Chief Operations Officer, Auditor’s Office
-
Velta Moisio - IT Director, Court of Common Pleas (virtual)
-
Katie Taylor - Finance Director, Geauga County Public Health (virtual)
-
Adrian Gorton - Finance Manager, Geauga County (virtual)
-
Amy Bevan - County Administrator (virtual)
Others Present:
The meeting was called to order at 11:30 am by Mr. Antenucci.
Minutes: No minutes were presented for approval. Minutes, once approved and posted, are available here.
The Board took the following actions:
DISCUSSED - The Board discussed recent draft findings in the Ohio State Auditor’s 2025 audit of IT General Controls (ITGC) related to the County’s cybersecurity training program and the potential impact on future state audits. While the current audit issue appears to be treated as a control deficiency and not a significant deficiency or a material weakness, Mr. Antenucci explained that recent changes to state requirements will make cybersecurity training compliance more significant beginning with the 2026 audit cycle. The stated target provided by the State is 100% compliance with cybersecurity training. The County currently provides annual cybersecurity training to employees with network/domain access, but completion rates remain below the desired level. He reported that the County was roughly halfway through the current training cycle, with approximately 62% of required users having completed the training, raising concern that the County may not achieve an acceptable compliance rate by the deadline. Mr. Antenucci emphasized that the issue is not the availability of training but ensuring that employees actually complete it.
Observer Note: An ITGC audit evaluates access management, change control, IT operations, and security controls to ensure compliance with various standards. It validates both the design and operating effectiveness of IT controls.
A ‘material weakness’ is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. This definition is consistent with the PCAOB (Public Company Accounting Oversight Board) Auditing Standards, which apply to public companies but are also relevant to state auditors when evaluating financial reporting integrity.
The Board discussed possible ways to improve compliance, including providing regular reports identifying employees or departments that have not completed the training, extending the current deadline, and establishing an enforcement mechanism. Mr. Antenucci noted that other counties and public entities may suspend network or system access for employees who fail to complete required cybersecurity training, and that restricting access may be one of the few practical enforcement tools available. Board members generally agreed that completing the training is a reasonable requirement but wanted additional information before adopting a formal enforcement policy. The Board agreed to extend the training deadline from August 31, 2026 to September 30, 2026. The Board will monitor completion rates and consider stronger enforcement if necessary.
Public Comment - This Observer asked what consequences the County could face if a future audit resulted in a material weakness related to cybersecurity training. Mr. Antenucci explained that the State’s primary responsibility is to audit the County and report its findings, and they were uncertain whether a material weakness would result in a direct penalty. They noted, however, that a significant audit finding could negatively affect the County’s public reputation and potentially influence matters such as financial or bond ratings. Mr. Antenucci also indicated that the County has not received a material weakness related to IT general controls since he has held his position but he believed there had been some in the past.
The meeting was adjourned at approximately 11:44 pm.
Next Meeting - The next scheduled meeting of the ADP Board is a Regular Meeting on September 10, 2026 at 1:00 pm.
Minutes when posted are available here: Meeting Minutes | Geauga County Automatic Data Processing
Virtual Meeting Information - Contact Pamela McMahan at PMcMahan@geauga.oh.gov.
Observer: Carol Benton
Editor & Reviewer: Sarah McGlone
Submitted: August 7, 2026
The League of Women Voters of Geauga is a 501(c)(3) nonpartisan political organization that encourages informed and active participation in government, works to increase understanding of major public policy issues, and influences public policy through education and advocacy. They do not support or oppose individual candidates or parties. Learn more about the LWVG at www.lwvgeauga.org.