The Department is statutorily authorized to provide data processing services for State agencies. The Department, State agencies, and users of the Central Computer Facility share the costs of those services. Funding for the Central Computer Facility (CCF) is provided through the Statistical Services Revolving Fund (SSRF) and the Communications Revolving Fund (CRF).

The Department reported that from July 1, 1999, through February 29, 2000, $55 million and $69 million were billed from the SSRF and CRF respectively.

Overall, we found the billing process to be extremely complex and manually intensive with an over-reliance on key staff members. Some of the specific issues we identified included:

• Of the 34 sources of monthly billing data for the SSRF, 23 are provided to billing staff in hardcopy form and manually entered into billing systems. Manual processes are needed for 15 percent ($8.3 million of the total $55 million) of the gross monthly billings.
• We noted incorrect amounts recorded in the credit log and no documentation of an independent review of the credit log.
• Two months’ billing for one of the four components of the Network Services were delayed for several months and estimated, due to a loss of data.
• One agency’s monthly billing was understated by $160,908, due to a manual data entry error, and corrected on a subsequent billing.
• The approved rate for payroll services was not increased in the Central Payroll System, resulting in an approximate loss of revenue of $14,000.

We recommend the Department institute measures to strengthen controls in the billing process to ensure its accuracy by reducing manual intervention and its reliance on key staff members.

Although the Department has procedures for controlling changes to software, we found that the process was manually intensive and not always observed. The procedures contain guidelines for approving changes, based on the priority category of the change, and require signatures at different points in the process. However, we identified numerous instances of noncompliance with the procedures and concluded that the current procedures do not agree with the change control practices.

The Department issued a request for proposal for fully automating the change control procedures on October 13, 1999. The Department should accelerate the selection and implementation of a comprehensive change management system.

Although the Department has made progress in addressing the disaster contingency needs of the State’s Central Computer Facility, the plans and operational provisions still need to be enhanced to provide assurance that all of the State’s critical applications and network operations can be recovered within required timeframes. The State is placing great reliance on the Department’s ability to provide data processing and network services in the event of a disaster. As such, a comprehensive and thoroughly tested disaster contingency plan and sufficient backup facilities are essential components of recovery efforts.

The Department should continue its efforts to ensure that the necessary components are available to provide for continuation of critical computer operations in the event of a disaster. In addition, the Department should continue to conduct comprehensive tests of the disaster recovery plan on an annual basis.

AUDITORS' OPINION

Procedures were generally sufficient to provide reasonable, but not absolute, assurance that relevant general and application control objectives were achieved.

                          WILLIAM G. HOLLAND, Auditor General