Michigan Office of the
Auditor General
Thomas H. McTavish, C.P.A.
Auditor General
 OAG Seal

[Up] [Left] [Next]

EXECUTIVE DIGEST #3159494

Information Services Center and the Automated Payment Systems

INTRODUCTION This report contains the results of our financial related audit of the Information Services Center (ISC) and the Automated Payment Systems, Department of Education, for the period October 1, 1991 through August 31, 1994.
AUDIT PURPOSE This financial related audit was conducted as part of the constitutional responsibility of the Office of the Auditor General. Financial related audits are conducted at various intervals to permit the Auditor General to express an opinion on the State's financial statements. Also, this audit complements the departmentwide financial audit.
BACKGROUND ISC is responsible for providing information processing services to the Department of Education. ISC designed, developed, and operated the Scholarship and Grant System and the Food and Nutrition System for the department. The Scholarship and Grant System processed awards for students and made payments directly to State colleges and universities. The Food and Nutrition System processed payments to schools and child care providers for the School Lunch and Breakfast, National School Lunch, Child Care Food, and Commodity Supplemental Food Programs.

For fiscal year 1993-94, ISC had gross appropriations of approximately $4 million. During fiscal year 1992-93, the department administered approximately $78 million and $159 million, respectively, in payments for the Scholarship and Grant Program and the Food and Nutrition Program and approximately $3.9 billion for all programs. Of the $3.9 billion, approximately $3.1 billion was for the School Aid Program, which was recently converted to a network-based system. The number of employees at ISC dropped from 48 in March 1994 to 37 in March 1995 and was 41 as of August 31, 1994. The reduction in the number of employees has prevented ISC from making significant system improvements. ISC is also under consideration for consolidation with other data centers that use the same mainframe hardware.

Executive Order 1995-3 transferred the Scholarship and Grant Unit from the Department of Education to the Department of Treasury with an effective date of April 8, 1995.
AUDIT OBJECTIVES AND CONCLUSIONS Audit Objective: To assess the effectiveness of the department's internal control structure over ISC in providing reliable and secure information.

Conclusion: The department's internal control structure over ISC had limited effectiveness in providing reliable and secure information. We noted the following material weaknesses:

  • The department eliminated its security officer position and had not established a comprehensive information processing security program (Finding 1).

  • The department's internal control procedures did not prevent unauthorized access to and use of the automated information systems (Finding 2).

  • The department's internal control procedures did not ensure the detection of unauthorized computer activities (Finding 3).

  • The department had not established internal control procedures to prevent unauthorized computer program changes and to ensure accountability for program changes (Finding 4).
The department agreed with Findings 1 through 4 and will comply with the corresponding recommendations.

We also noted other reportable conditions, including the lack of system development documentation procedures and the lack of a disaster recovery plan (Findings 5 and 6).

Audit Objective: To assess the effectiveness of the internal control structure of the selected automated payment systems in complying with statutory requirements and in identifying and processing only authorized data promptly, accurately, and completely.

Conclusion: We determined that the internal control structure effectively provided management with reasonable assurance that the selected automated payment systems complied with statutory requirements and identified and processed only authorized data promptly, accurately, and completely. Our review did not disclose any material weaknesses; however, we noted other reportable conditions involving the completeness and accuracy of information, system processing controls, and system access controls (Findings 7 through 9).

AUDIT SCOPE Our audit scope was to examine the information processing and other records of the Information Services Center and the Automated Payment Systems for the period October 1, 1991 through August 31, 1994. Our audit was conducted in accordance with Government Auditing Standards issued by the Comptroller General of the United States and, accordingly, included such tests of the records and such other auditing procedures as we considered necessary in the circumstances.
AGENCY RESPONSES AND PRIOR AUDIT FOLLOW-UP Our audit report includes 9 findings and 21 corresponding recommendations. The agency preliminary response for our audit indicated that the agency agreed with all our recommendations.

The department had complied with 16 of the 34 prior audit recommendations included within the scope of our current audit.

[Up] [Left] [Next]

This page was created on 3-20-97.