Montana State University-Bozeman : EDP audit follow-up

24 Pages·1997·0.45 MB·English

by  Montana. Legislature. Legislative Audit Division

JO wxYXSxao _
Montana State
Uai'Tcrsity-'Bozanaa
Legislative Audit Division
State ofMontana
Report to the Legislature
EDP
May 1997 Audit FoUow-up
^RTE
DOCUMENTS
COLLECTION
-iUL 1 7 1897
MONTANA STATE LIBRARY
HELENA, MONTANA 59620
Montana State University-Bozeman
This report contains follow-up information on recommendations from an
electronic data processing audit ofMontana State University-Bozeman's
computer center (95DP-01). Our initial recommendations addressed
improving general controls over the university's electronic data processing
environment. Ofthe24 initial recommendations, 12 are implemented, 11
are partially implemented, and 1 is not implemented. Follow-up areas
include:
* Improving electronic access controls.
•• Improving physical security controls and establishing formal
contingency procedures.
•- Improving overall documentation ofcontrols and policies and
procedures.
n ntPM
IJ f
'tj.
'%::^' %.--s i
Direct comments/inquiries to:
LegislativeAudit Division
Room
135, State Capitol
PO Box 201705
97DP-03 HelenaMT 59620-1705
3 0864 0009 9678 8
EDP AUDITS
Electronic Data Processing (EDP) audits conducted by the Legislative Audit Division are
designed to assess controls in an EDP environment. EDP controls provide assurance over the
accuracy, reliability, and integrity ofthe information processed. From the audit work, a
determination is made as to whether controls exist and are operating as designed. In performing
the audit work, the audit staffuses audit standards set forth by the United States General
Accounting Office.
Members ofthe EDP audit staffhold degrees in disciplines appropriate to the audit process.
EDP audits are performed as stand-alone audits ofEDP controls or in conjunction with
financial-compliance and/or performance audits conductedby the office. These audits are done
under the oversight ofthe Legislative Audit Committee which is a bicameral and bipartisan
standing committee ofthe Montana Legislature. The committee consists ofsix members ofthe
Senate and six members ofthe House ofRepresentatives.
MEMBERS OFTHE LEGISLATIVEAUDIT COMMl'lTEE
LEGISLATIVE AUDIT DIVISION
ScottA. Seacat, LegislativeAuditor m ^^^M\ Deputy LegislativeAuditors:
John W. Northey, Legal Counsel y^^^^ffi] ^™ Pellegrini, PerformanceAudit
Tori Hunthausen, IT& Operations Manager vS^^^P^ James Gillett, Financial-ComplianceAudit
May 1997
The Legislative Audit Committee
ofthe Montana State Legislature:
This report is our follow-up review ofour EDP audit (95DP-01) ofMontana State
We
University-Bozeman's internal controls relating to its computer-based applications.
reviewed recommendations relating to the university's general controls. This report
contains implementation status ofprior recommendations proposed for improving EDP
controls at the department. Our prior recommendations included improving electronic
access security, establishing formal contingency procedures, and improving overall
documentation. Written comments fromthe departmentto our auditfollow-up review
are included inthe back ofthe audit report.
We thank departmentpersonnel for their cooperationand assistance throughout the
audit.
Respectively submitted.
^cott A. Seacat
Legislative Auditor
Room 135, StateCapitol Building POBox201705 Helena,MT59620-1705
Phone[phone] FAX[phone] E-Mail [email protected]

Legislative Audit Division
EDP Audit FoUow-up
Montana State University-Bozeman
Members ofthe audit staffinvolved inthis audit were Ken Erdahl and
AlanLloyd.

Table of Contents
Elected, Appointed and Administrative Officials
Chapter I Introduction
Introduction and
Background Background on Original Audit
Follow-up Scope
Follow-up Results
Chapter 11 Introduction
Recommendation Status
Electronic Access Controls 3
Technical Support StaffAccess Should be Limited 4
Access to SYSTEM Account Shouldbe Restricted 4
Access to the Audit Journal Shouldbe Restricted 5
Access to Critical Application Files Should
be Restricted 5
Programmer Access to Production Programs
Shouldbe Limited 6
Proxy Access Should be Restricted 6
Physical Security Controls and Other Issues 7
MSU
Should Improve Its Disaster Recovery Plan 7
General Documentation 8
Summary 8
University Response Montana State University-Bozeman 11
Pagei
Appointed and Administrative Officials
Board ofRegents ofHigher Marc Racicot, Governor*
Education
Nancy Keenan, Superintendent ofPublic Instruction*
Dr. Richard Crofts, Interim Commissioner ofHigher Education*
.
Chapter I - Introduction and Background
Introduction We performed a follow-up review ofour electronic data processing
audit (95DP-01) ofMontana State University-Bozeman's Information
Technology Center. The original report, issued in June 1995,
contained 24 recommendations for improving existing controls
within MSU-Bozeman's electronic data processing environment.
This report outlines the status ofthe recommendations partially or
not implemented.
Background on Original During our initial audit (95DP-01), we reviewed MSU-Bozeman's
Audit general controls as they related to the mainframe environment. We
interviewed personnel to update our understanding ofthe hardware
and software enviroimient at MSU-Bozeman. We also reviewed
available application documentation.
Follow-up Scope Our original audit generated 24 individual recommendations.
MSU-Bozeman concurred with 23 recommendations and partially
concurred with one recommendation. The objective ofour follow-
up work was to determine the implementation status ofthe original
audit recommendations. We reviewedagency documentation and
interviewed staffto evaluate implementation oftheseprior audit
recommendations
Follow-up Results
Table 1
Implementation Status ofRecommendations
Page 2