Cybersecurity frauds are targeting direct deposit payroll at local governments

A red fraud button on a computer keyboard.Local governments should ensure they protect against cybersecurity frauds in which an employee’s direct deposit payroll gets redirected to a fraudster’s bank account.

In this type of fraud, the fraudulent request to change the bank account uses the government’s change form that is emailed or mailed to payroll. In other cases, the fraudulent request is made in an email that looks like it is from the employee’s email account. The fraudulent bank accounts are frequently associated with out-of-state or internet banks.

We recommend that any request to change a direct deposit bank account include an in-person or verbal verification with the employee before the change is initiated.

We caution you to NOT use email to verify a change request; in some cases, the employee’s email account has been compromised and the fraudster intercepts and responds to the emailed verification.

If your government is a victim of this fraud, you are required to report it to the Office of the Washington State Auditor at

We also recommend reporting it to the FBI’s Internet Crime Complaint Center (IC3) at

A well-balanced, full-bodied Lean success in Washington wine country: process improvement success at Walla Walla Treasurer’s Office

Rows of Wine Grapes

Cab Franc Block 3, Rows of wine grapes at a vineyard in Walla Walla region of eastern Washington

Small governments, big focus

The Performance Center’s years of working with local governments all across Washington has given the Center an unprecedented understanding of the needs of local governments. Our targeted, customized approach to process improvement work not only helps local governments succeed in their chosen process, but gives them the depth of understanding they need to foster a Lean culture within. The work we did with the Walla Walla Treasurer’s Office outlines this kind of specialized assistance that makes the Center’s approach unique and effective.

The back story

County Treasurer Gordon Heimbigner was interested in making his office work more efficiently. Some of the processes they had, such as using manually created spreadsheets for journal entry and reporting, were time-intensive and cumbersome to the staff. Heimbigner (a former State Auditor’s Office employee) learned of the Lean services offered through the Performance Center through State Treasurer Duane Davidson, who encouraged him to contact the Performance Center to help facilitate the Lean process improvements and culture changes needed in Walla Walla.

The five-person team at the Walla Walla County Treasurer’s Office was open to change, and were already brainstorming creative ways to accommodate their increasing workload without extra help. They were excited at the prospect of getting expert help in making their workday run more smoothly and efficiently.

The work begins

Performance Center Lean Specialist Debra Hentz began her work with the County Treasurer by leading the group through a day of foundational Lean training, designed to give everyone a basic understanding and tools they would need to create success. From there, using the Performance Center’s model of customized process improvement services, Hentz determined the County Treasurer’s Office would most benefit from a three-day kaizen (or process improvement) event. Part of this customized approach and setting the foundation for success was to bring in other experts from the Performance Center, including a former auditor/financial management expert. This made sure the process improvements made would be in compliance with requirements as well as best practices in internal control principles.

The kaizen was aimed at mapping the County Treasurer’s Office cash receipting and journal entry processes to determine if they could be made more accurate or simple through the use of computer software rather than hand-created spreadsheets. Heimbigner hoped the kaizen would teach and empower his staff to use their new Lean skills in many different ways in their jobs.

Eye-opening revelations

The kaizen event revealed many areas that would improve efficiency. Staff realized they were collecting and recording more information than they needed. They also identified the opportunity to collaborate with and train other County departments on how to accurately enter information into the computer software system, which would free up Treasurer’s Office staff to better assist with more complex questions or issues.

Putting it all together

Mapping it out as a team gave the treasurer’s office some impressive results. What was once an 11-step process done by a single staff member was reduced to four steps. This freed up considerable time and helped ease the burden on the small staff. Through the collaboration and training with other County departments on recording their own data into the computer system, the kaizen was able to dramatically reduce the number of “human errors” which bogged down the process, resulting in employee-reported increased job satisfaction and positive working relationships for all involved. Office employees embraced a culture of process improvement, and now seek out opportunities to improve their everyday work environments.

Making a lasting change

Taking three days out of an already very busy workplace can seem scary; people ask “can we ’afford‘ to take this time?” But what people are really asking is:

  • Will there be meaningful change?
  • Will we waste our time just to have things go back to the old way, or maybe even a worse way?

The professionals at the Performance Center understand these concerns, and want to design a process improvement event around you and your unique needs. We are experts in helping local governments in Washington improve the way they work — from the operations they perform to the culture in the office environment. If you are interested in learning more about how the Performance Center can help you take the next step in creating a better government, email us at or call us at 360-725-5621.


Have an employee incentive-pay program? Keep these things in mind

Governments in Washington must exercise care Businessman putting money in someone's hand.when creating and implementing programs to compensate employees beyond their base salary.




This article offers items to consider specific to performance-based incentive pay. The following is intended for informational purposes only – always consult your government’s attorney for specific legal advice on these matters. Continue reading

Local government cybersecurity performance audits provide tailored solutions

Internet Security concept with lock and cloud symbolGovernment organizations have become increasingly dependent on computerized information systems to carry out their operations. These systems process, store and share sensitive and confidential information, including personal and financial data, in order to deliver services to residents. Risks to a local government’s information technology (IT) environment go beyond the activities of hackers stealing credit card information or Social Security numbers, or installing malware to disrupt communications. Errors or misuse of the system by employees or contractors can also jeopardize the operation of any entity that relies on computers and networks.

Research by Verizon Wireless in their 2017 Data Breach Investigation Report shows that the public sector reported the most cyber security incidents, and the third most confirmed data breach incidents, of any industry in 2016. A 2017 study by the Ponemon Institute, a research center that focuses on privacy, data protection and information security policy, found that governments pay an average of $110 per record lost in a data breach. To help Washington’s local governments protect their Information Technology (IT) systems, we are offer them the opportunity to participate in a performance audit designed to assess whether there are opportunities to improve the security of their IT systems. Skagit County chose to participate in this audit; you can read their report on our website. You can also watch one of our talented IT auditors presenting Skagit County the results of their audit.

Don’t miss this upcoming free webinar “Cybersecurity Essentials for Local Government Leaders!”

computer_equipment-224824333Presented by the Municipal Research and Services Center (MRSC) and sponsored by the State Auditor’s Office Performance Center, this webinar is for elected officials, managers, information technology and other staff working to keep electronic systems safe from outside interference. Share this information with your co-workers and elected officials in order to get the most out of this opportunity!

This free webinar will help public sector leaders understand what their organization’s greatest vulnerabilities are and the most important investments necessary to reduce risk. You’ll hear from firsthand experience—in agencies both small and midsized—how opportunistic cybercriminals take advantage of system vulnerabilities. You’ll also learn about cybersecurity training that each person with your organization should have and how to get it.

Could a major cybersecurity incident happen to your agency? If it did, how costly could it be? You can’t afford to miss this presentation occurring October 18th at 11am – Register at:

Recent GAO report underscores the need for cybersecurity auditing

GAOlogoThe federal counterpart to the Office of the Washington State Auditor, the Governmental Accountability Office (GAO) released a report on Tuesday demonstrating the vitally important role of cybersecurity auditing in the information age. Vulnerabilities in government systems can be exploited by criminals looking to harm the public, as detailed in the GAO’s audit findings.

The Office of the Washington State Auditor helps local governments protect themselves from cybersecurity threats through a variety of means, including conducting cybersecurity audits on both the local and state levels. SAO also provides local governments with the training and resources they need to better understand the ever-changing landscape of cybersecurity. Responding to the increased demand for cybersecurity resources by Washington’s local governments, SAO has begun developing a new suite of materials specifically designed to address local government concerns. By partnering with governments across Washington and providing them with our valuable audit services, we help protect Washingtonians from potential cyber harm.


How to build a “resilient cybersecurity culture” for your government

ransomwareGovernments are vulnerable to cybersecurity breeches. In this way, they don’t vary much from private-sector businesses, whose sometimes spectacular cybersecurity failings grab headlines. So, as a government with limited resources, how do you prepare for the inevitability of some bad actor trying to access sensitive information?

An August 2018 report out from the (ISC)2, a non-profit focused on “inspiring a safe and secure cyber world” details several key ways in which governments and private businesses alike can begin to build an internal culture focused on cybersecurity awareness. The major take-aways? Management understands the need for the importance of strong cybersecurity–97% of the cybersecurity professionals (ISC)2 polled indicated their managers understood why it was important. And while management may understand why it is important to focus on cybersecurity, they were less clear in their job descriptions to hire dedicated talent. 52% of cybersecurity professionals asked said job descriptions didn’t demonstrate an understanding of security.

The disconnect between management’s understanding of the threat cybersecurity breeches pose and the general understanding of the security environment could create opportunity for disarray in addressing threats. However, the (ISC)2 report goes on to say that to build a culture that effectively addresses cybersecurity concerns really centers on hiring and retaining talent, ensuring management is aware of the importance of cybersecurity, and aligning policies and strategy. Management’s concern and interest in building an effective shield against attack is enough, given the cybersecurity team is adequately staffed and their expertise is taken seriously.

If you are a local government who is struggling to keep up with the demands of ever-evolving cybersecurity issues, the Office of the Washington State Auditor has resources to help. Visit our website for resources and checklists designed to help you.

Know what to look for to prevent disbursement fraud

Fraudulent disbursements are the most A stack of cash is wrapped tightly in a chain that is secured by a padlock.common form of asset misappropriation. This type of disbursement occurs when an employee uses their position to make payment for an inappropriate purpose. They are on-book fraud schemes, which means that money in the form of checks leaves the entity fraudulently, but is recorded on the books and leaves an audit trail. In this way, entities can become victims of fraud, even when no cash is involved. Continue reading