Kansas City Area Transportation AuthorityLocal Government

Identifying Number: 2023-004 Finding: The single audit package was not submitted to the Federal Clearinghouse within the time required. The Single Audit package for the Authority’s year ended December 31, 2023, should have been submitted to the Federal Clearinghouse by September 30, 2024. The delay was caused by the Cyber Incident in January 2024 which delayed the release of year end reporting to the external auditor to May 2024. Staffing shortages at the Authority contributed to the late filing. A further delay was the result of the availability of the audit staff. Corrective Actions Taken or Planned: On February 7,2024, the Authority completed all industry standard, minimum cybersecurity remediation and compliance requirements following the incident, as set forth by the National Institute of Standards and Technology (NIST) Cyber Security Framework and Dell Technologies. All hyper-converged infrastructure, network firewall, and networked components have been examined through a rigorous network remediation and data validation process, in order to significantly reduce the risk of further malicious exposure of its data and equipment to any/all entities separate from the organization. The Kansas City Area Transportation Authority has moreover, taken measures to secure and improve the overall security posture during the remediation period for all workstations, servers, and networked infrastructure, with the addition of continuous monitoring and next generation antivirus systems with endpoint detection response capabilities, firewalled intrusion detection and prevention measures, as well as the development and implementation of continuous identity access management and data loss prevention features and processes. In April 2024, the American Public Transit Association (APTA) performed a financial peer review on the Authority. Among the recommendations as best practice by the peer group was the replacement of the long-standing audit firm with a new firm. The Request for Purchase (RFP) was conducted, and a new audit firm has been selected. Approval of the new Audit firm contract is scheduled for approval by the Board of Commissions on October 22, 2024. KCATA will work with the new audit firm to develop a schedule to publish financial statements by April or May of each year which was the historical schedule in place. Contact person responsible for corrective action: Andrew Morse, Comptroller