Preliminary Follow-up: An Audit of Salt Lake County Criminal Justice Services: Data Access and Protections

AUDITOR'S LETTER

June 8, 2026

In accordance with Generally Accepted Government Auditing Standards and the established policies of the Auditor's Office, as authorized by Utah Code Title 17, Chapter 19a, "County Auditor," Part 2, "Powers and Duties," we maintain our responsibility to monitor and ensure that audit recommendations are addressed by county agencies through appropriate corrective action. This process is also instrumental in shaping future audits.

This is the preliminary follow-up report for An Audit of Salt Lake County Criminal Justice Services: Data Access and Protections originally issued in April 2025. The initial audit identified seven findings with 12 recommendations. The purpose of this follow-up review was to assess the status of corrective actions intended to strengthen compliance and safeguards over confidential data and systems.

Our follow-up work found that agency management implemented 11 of the 12 recommendations. Through updates to agency procedures, monitoring drug test result entries, strengthening system access based on business requirements, and improving documentation related to e-waste disposal, management has taken corrective actions to address risks identified in the original audit. These efforts have strengthened controls over confidential data and systems.

Additionally, one recommendation was closed because Criminal Justice Services employees relocated from office space shared with another agency, making the recommendation no longer applicable.

We conducted this audit in accordance with Generally Accepted Government Auditing Standards (GAGAS). Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on the audit objectives. We believe the evidence obtained meets these requirements.

The follow-up period for this audit covered October 15, 2025, through April 15, 2026. For testing related to the revocation of terminated employee access, the scope was extended through May 31, 2026. Our review focused on verifying the implementation status of recommendations from the April 2025 audit report through document review, analysis, and discussions with Criminal Justice Services management.

We extend our appreciation to the leaders and staff of Criminal Justice Services for their cooperation. The enclosed report summarizes the status of the recommendations reviewed in this preliminary follow-up.

Should you have any questions or wish to discuss the report further, please do not hesitate to contact me at 385-468-7200.

Chris Harding, CPA, CFE, CIA
Salt Lake County Auditor