Independent audit returns clean opinion; auditor urges county to harden cybersecurity

John Hatterley, partner in charge of the Larson and Company audit, told Millard County commissioners that the firm issued an unmodified opinion on the county’s 2024 financial statements and its federal single audit. "It's an unmodified or an unqualified opinion — that's a clean opinion," Hatterley said.

Hatterley reviewed the audit's scope, noting the report addresses the county's financial statements, supplementary information and federal single audit for programs that exceeded the federal threshold. He said the county had no material weaknesses, significant deficiencies, or findings requiring modification of the audit report.

Hatterley also briefed the commission on internal controls and required supplementary information such as the management discussion and analysis and pension (URS) schedules. He told commissioners the audit process includes identifying negative financial trends and assessing risk for revenue losses tied to large taxpayers or grants.

In a separate but related portion of the presentation, Hatterley warned county leaders about a growing cybersecurity threat to local governments. He described phishing and "smishing" attacks and said attackers have increasingly targeted public agencies with ransomware, which can lock access to systems and demand payment. "If they hijack your data, they're gonna say, you pay us $200,000 or you're not getting your data back," Hatterley said, urging continuous, live backups and staff training to reduce exposure.

Hatterley offered to provide staff training; commissioners and county staff discussed existing technology vendors and the benefits of moving to .gov email addresses and stronger password requirements. Hatterley said some rural governments had been spared historically but now need to prioritize cyber protections.

At the conclusion of the presentation a commissioner moved to accept the audit report; the motion was seconded and approved by voice vote. No audit findings were recorded in the auditor's reports to the commission during the meeting.

Ending: The commission accepted Larson and Company's reports; staff were encouraged to pursue cybersecurity training and improved backup strategies per the auditor's recommendation.