Automated Information Systems

Michigan Office of the
Auditor General
Thomas H. McTavish, C.P.A.
Auditor General

EXECUTIVE DIGEST #7959097
Automated Information Systems

INTRODUCTION
This report, issued in November 1997, contains the results of our performance audit of the Automated Information Systems, Department of Agriculture.

AUDIT PURPOSE
This performance audit was conducted as part of the constitutional responsibility of the Office of the Auditor General. Performance audits are conducted on a priority basis related to the potential for improving effectiveness and efficiency.

BACKGROUND
The Finance and Technology Division provides data processing services to the Department. These services include local area network (LAN) administration, system development, and microcomputer support.

The Food Licensing System, Food Service Licensing System, and Motor Fuel Licensing System are information processing systems that the Department uses to store and process information relating to the licensing of retail food establishments, food service establishments, and gasoline stations, respectively.

AUDIT OBJECTIVES, CONCLUSION, AND NOTEWORTHY ACCOMPLISHMENTS

Audit Objective: To assess the effectiveness of the Department's general controls over the management, development, and security of its automated information systems.

Conclusion: The Department's general controls were reasonably effective over the management, development, and security of its automated information systems. Our assessment did not disclose any material conditions , however, we noted reportable conditions involving user access controls, LAN access controls, LAN backup and recovery controls, system development and documentation controls, and data processing policies and procedures (Findings 1 through 5).

Audit Objective: To assess the effectiveness of the Department's internal control structure over its automated information systems.

Conclusion: The internal control structure over the Department's automated information systems was reasonably effective. Our assessment did not disclose any material conditions; however, we noted reportable conditions related to input and processing controls, system edits, and system audit trails (Findings 6 through 8).

Noteworthy Accomplishments: The Department is taking steps to evaluate the effectiveness and efficiency of its automated information systems. The Department has established an Information Technology Master Plan which includes the following objectives: (1) To develop a comprehensive corporate data base, (2) To integrate all Department data on a common platform using a common identifier, (3) To develop flexible information systems which access the corporate data base, and (4) To develop a comprehensive security system to safeguard the Department's information technology resources. The first phase of the Information Technology Master Plan is due in October 1997 and will define and prioritize the Department's information requirements.

AUDIT SCOPE AND METHODOLOGY
Our audit scope was to examine the program and other records of the Automated Information Systems. Our audit was conducted in accordance with Government Auditing Standards issued by the Comptroller General of the United States and, accordingly, included such tests of the records and such other auditing procedures as we considered necessary in the circumstances.

Our methodology included examination of the Department's information processing and other records for the period October 1, 1994 through May 31, 1997. Our methodology also included developing a preliminary assessment of the Finance and Technology Division and the automated information systems. We then analyzed the information and determined where to concentrate our detailed analysis and testing. We designed tests of the control structure and performed those tests to meet our audit objectives.

AGENCY RESPONSES
Our audit report contains 8 findings and 8 corresponding recommendations. The agency preliminary response indicated that it agreed with all of our recommendations.

Full Audit Report - #7959097 - Automated Information Systems

Documents prefaced by require the Adobe Acrobat Reader®, a free application available on the Adobe homepage.

This page was created on 3/12/98.


INTRODUCTION This report, issued in November 1997, contains the results of our performance audit of the Automated Information Systems, Department of Agriculture.

AUDIT PURPOSE This performance audit was conducted as part of the constitutional responsibility of the Office of the Auditor General. Performance audits are conducted on a priority basis related to the potential for improving effectiveness and efficiency.

BACKGROUND The Finance and Technology Division provides data processing services to the Department. These services include local area network (LAN) administration, system development, and microcomputer support. The Food Licensing System, Food Service Licensing System, and Motor Fuel Licensing System are information processing systems that the Department uses to store and process information relating to the licensing of retail food establishments, food service establishments, and gasoline stations, respectively.

AUDIT OBJECTIVES, CONCLUSION, AND NOTEWORTHY ACCOMPLISHMENTS Audit Objective: To assess the effectiveness of the Department's general controls over the management, development, and security of its automated information systems. Conclusion: The Department's general controls were reasonably effective over the management, development, and security of its automated information systems. Our assessment did not disclose any material conditions , however, we noted reportable conditions involving user access controls, LAN access controls, LAN backup and recovery controls, system development and documentation controls, and data processing policies and procedures (Findings 1 through 5). Audit Objective: To assess the effectiveness of the Department's internal control structure over its automated information systems. Conclusion: The internal control structure over the Department's automated information systems was reasonably effective. Our assessment did not disclose any material conditions; however, we noted reportable conditions related to input and processing controls, system edits, and system audit trails (Findings 6 through 8). Noteworthy Accomplishments: The Department is taking steps to evaluate the effectiveness and efficiency of its automated information systems. The Department has established an Information Technology Master Plan which includes the following objectives: (1) To develop a comprehensive corporate data base, (2) To integrate all Department data on a common platform using a common identifier, (3) To develop flexible information systems which access the corporate data base, and (4) To develop a comprehensive security system to safeguard the Department's information technology resources. The first phase of the Information Technology Master Plan is due in October 1997 and will define and prioritize the Department's information requirements.

AUDIT SCOPE AND METHODOLOGY Our audit scope was to examine the program and other records of the Automated Information Systems. Our audit was conducted in accordance with Government Auditing Standards issued by the Comptroller General of the United States and, accordingly, included such tests of the records and such other auditing procedures as we considered necessary in the circumstances. Our methodology included examination of the Department's information processing and other records for the period October 1, 1994 through May 31, 1997. Our methodology also included developing a preliminary assessment of the Finance and Technology Division and the automated information systems. We then analyzed the information and determined where to concentrate our detailed analysis and testing. We designed tests of the control structure and performed those tests to meet our audit objectives.

AGENCY RESPONSES Our audit report contains 8 findings and 8 corresponding recommendations. The agency preliminary response indicated that it agreed with all of our recommendations.