FINDINGS, CONCLUSIONS, AND
RECOMMENDATIONS
OVERSIGHT AND CONTROL OF INFORMATION SYSTEMS IS LACKING
The Department did not develop or institute policies, procedures, or guidelines to
effectively manage and control information systems.
We noted the following weaknesses:
- Policy and procedure manuals had not been updated since December, 1994, although the
Department's computing environment had changed dramatically.
- Computer-related practices instituted at the Central Office and the Veterans' Homes were
inconsistent and did not provide adequate control regarding disaster recovery plans and
computer security.
These weaknesses resulted from the lack of understanding of responsibilities and
reporting structure between the Central Office and the Homes. (Finding 98-1, pages 13 and
14)
We recommended the Department formalize the Central Office's responsibilities to
direct, provide guidance, and monitor the Veterans' Homes' and Field Offices'
computer-related issues by developing appropriate policies. Such policies should be
distributed Department-wide.
Department officials agreed with the recommendation, and stated a plan was under
development which would be implemented within the next year.
NONCOMPLIANCE WITH INTERNAL AUDIT LAWS AND REGULATIONS
The Department's internal audit program did not comply with the Fiscal Control and
Internal Auditing Act (Act) (30 ILCS 10/2001 et seq.).
Specifically, the two-year audit plans submitted to the director did not include all
major systems of internal accounting and administrative controls, there was no indication
that the two-year audit plan for FY97/98 was approved by the director, and a written
report was not submitted to the Director detailing how the audit plan for the prior year
was carried out. (Finding 98-2, pages 15 and 16)
Furthermore, we noted the internal audit reports and workpapers prepared by the
Department's Internal Audit unit were not in accordance with the professional standards of
the Institute of Internal Auditors. (Finding 98-3, pages 17 and 18)
We recommended the Department's internal audit program comply with the Fiscal Control
and Internal Auditing Act and that the resulting reports and audit workpapers be prepared
in accordance with the standards of the Institute of Internal Auditors.
The Department agreed with our recommendations. Department officials stated an audit
plan for FY99/00, which contains all required elements, has been submitted to the Director
for approval. Furthermore, a report detailing how the plan for FY98 was carried out was
also submitted to the Director.
OTHER FINDINGS
The remaining findings are less significant and the Department responded that
corrective action is in process. We will review the Department's progress towards the
implementation of our recommendations in our next audit.
Responses to the findings were provided by Mr. Don Bullerman, Chief Internal Auditor,
in a letter dated December 18, 1998.
AUDITORS' OPINION
We have stated the financial statements of the Department of Veterans' Affairs
as of and for the years June 30, 1998 and June 30, 1997 are fairly presented in all
material respects.
_____________________________________
WILLIAM G. HOLLAND, Auditor General
WGH:GSS:pp
AUDITORS ASSIGNED
This audit was performed by the Auditor General's staff. |
