Table Of Content

S Montana* 351«7232Leeislature« L72ip£ Legislative Audit 1996 EDP audit report inforraation processing Legislative Audit Division State ofMontana Report to the Legislature EDP October 1996 Audit Report STATE D06UMENTS eOLLECTION m - 6 1997 MONTANA STATg I.IBRARY 1515 g. 6th AVE. HELENA, MONTANA 59620 Information Processing FaciKty and Central Applications EachyeartheLegislativeAuditDivisionauditsthestate'scentralcomputer facilityandcentralizedcomputerapplications. Thisreportisusedby flnancial-complianceand performanceauditorsandcontainsour conclusionsand/orrecommendationsforimprovinggeneralcontrolsover themainframecomputer (Information ProcessingFacility) and application controlsoverthefollowingsystems: * StatePayroll System » StatewideBudgetingandAccountingSystem WarrantWriterSystem T\?^ L ilL:.^ Directcomments/inquiriesto: LegislativeAudit Division Room 135, StateCapitol PC Box201705 96DP-06 HelenaMT59620-1705 MONTANASTATELIBRARY 3 0864 0009 8024 6 EDPAUDITS ElectronicDataProcessing(EDP)auditsconductedbytheLegislativeAuditDivisionaredesigned to assess controls in an EDP environment. EDP controls provide assurance overthe accuracy, reliability, and integrity ofthe informationprocessed. Fromtheauditwork, a determination is madeastowhethercontrolsexistandareoperatingasdesigned. Inperformingtheauditwork,the auditstaffusesauditstandardssetforthbytheUnitedStatesGeneral AccountingOffice. MembersoftheEDPauditstaffholddegreesindisciplinesappropriatetotheauditprocess. Areas ofexpertiseincludebusinessandpublicadministration. EDPauditsareperformedasstand-aloneauditsofEDPcontrolsor inconjunctionwithfinancial- complianceand/orperformanceauditsconductedbytheoffice. Theseauditsaredoneunderthe oversight of the Legislative Audit Committee which is a bicameral and bipartisan standing committeeoftheMontanaLegislature. ThecommitteeconsistsofsixmembersoftheSenateand sixmembersoftheHouseofRepresentatives. MEMBERSOFTHELEGISLATIVEAUDITCOMMITTEE SenatorGregJergeson, ViceChainnan RepresentativeErnestBergsagel, Chairman SenatorSueBartlett RepresentativeBeverlyBamhart SenatorReinyJabs RepresentativeA. R. "Toni"Hagener SenatorTomKeating RepresentativeBobKeenan SenatorKenMiller RepresentativeRobertPavlovich SenatorLindaNelson RepresentativeBruceSimon MONTANA LEGISLATP/E BRANCH LegislativeAuditor DeputyLegislativeAuditors: ScottA. Seacat Mar)'Bryson OperationsandEDPAudit LegalCounsel: JamesGillett JohnNorthey Financial-ComplianceAudit JimPellegrini PerformanceAudit LEGISLATIVE AUDIT DIVISION October 1996 TheLegislativeAuditCommittee oftheMontana StateLegislature: ThisisourEDPauditofcontrolsrelatingtothestate'scentralizeddataprocessing systemsoperatedbythe DepartmentofAdministration. Wereviewedthedepartment's applicationcontrolsoverStatePayroll, StatewideBudgetingandAccountingSystem (SBAS), andtheWarrantWritersystem. Thisreportcontainsrecommendationsfor improvingcontrolsrelatedtotheSBASandWarrantWritersystems. Writtenresponses toourauditrecommendationsare includedinthebackofthereport. WethanktheDepartmentofAdministrationfortheircooperationandassistance throughouttheaudit. Respectfullysubmitted, ScottA. Seacat Legislative Auditor Room 135.StateCapitolBuilding.POBox201705 Helena,MT59620-1705 Phone(406)444-3122 FAX (406)444-9784 Legislative Audit Division EDP Audit Report Information Processing Facility and Central Applications Membersoftheauditstaffinvolved inthisauditwereBrendaBokovoy, PeteBrustkern, ReneeFoster, Victoria Hunthausen, EmlynNeuman- Javornik, AlanLloyd, RichMcRaeandReneSilverthorne. 1 Table ofContents AppointedandAdministrativeOfficials iii ReportSummary S-1 ChapterI- Introduction 1 Introduction OrganizationofReport 1 EDPAuditGeneral andApplicationControls 1 AuditObjectives 2 AuditScopeandMethodology 3 Compliance 4 PriorAuditRecommendations 4 ChapterII- Introduction 5 General Controls Conclusion: GeneralControlsProvideControlled ApplicationProcessing 5 Physical Security 5 DisasterRecovery -Background 6 OngoingRecoveryPlans 6 ChapterIII- Introduction 9 Application Controls StatewideBudgetingandAccounting System 9 Conclusion: SBASApplication Controls EffectiveandAdequateforFiscal Year1995-96 9 RemoveAccesstoSBAS Whenno LongerNeeded 10 DocumentDailyProceduresOverSBASOperations 10 StatePayroll System 1 Conclusion:StatePayrollApplication Controls EffectiveandAdequateforFiscal Year1995-96 12 WarrantWriterSystem 12 Conclusion: Warrant WriterApplication Controls EffectiveandAdequateforFiscal Year1995-96 12 Page i Table ofContents ChangeStateLawforReponingDebtWrite-Offs totheBudgetDirector 12 Prior AuditRecommendation 13 AutomatetheOffsetProcessforDirectDeposits 13 AgencyResponse DepartmentofAdministration 17 Pageii Appointed and Administrative Officials Departmentof LoisMenzies, Director Administration ConnieGriffith, Administrator AccountingandManagementSupportDivision Terry Atwood, Chief AccountingBureau TonyHerbert, Administrator InformationServicesDivision JeffBrandt, Chief Policy, Development, andCustomerRelationsBureau PaulRylander, Chief ComputerOperationsBureau MarkCress, Administrator Personnel Division JohnMcEwen, Chief ClassificationandPayBureau Donna F. Warner, Supervisor StatePayroll Pageiii