Single Audit Report Fiscal Year Ended June 30, 2012 - State ...

State of GeorgiaFinancial Statement Findings and Questioned CostsFor the Fiscal Year Ended June 30, 2012Information:Cause:Effect:Recommendation:The following deficiencies were noted:• Developers have the ability to promote changes to the production environment. In addition, usershave the ability to promote changes to the production environment which is not commensuratewith their job responsibilities.• Sufficient evidence supporting authorization, testing, and approval of changes promoted toproduction was not maintained.• A process to subsequently monitor changes that have been promoted to production is not in placeto determine whether those changes were authorized, tested, and approved and have notcircumvented the standard change management process.• A formal process to periodically review user access to certain applications is not currently in placeto determine whether access continues to be appropriate.• Users have the ability to provision access to certain applications which is not commensurate withtheir job responsibilities.• Users have access to certain applications which is not commensurate with their jobresponsibilities.• Terminated employees had continued access to certain applications.• General security settings for certain applications and their supporting operating systems anddatabases are not configured to provide reasonable assurance that access is limited to authorizedindividuals.The Department did not adequately establish and implement policies and procedures to govern theintegrity and accuracy of the information used in the financial statement preparation process.Without proper controls in place, loss, manipulation, or corruption of financial data within thissignificant system could occur.Department of Labor should enhance change management and logical access policies and proceduresto include the following:• Inappropriate access to promote changes to the production environment should be removed. Ifthere is a business need for such access, mitigating controls, such as monitoring of changes,should be put in place to determine that only appropriate changes are promoted to the productionenvironment.• A defined change management process should be established to ensure changes are authorized,tested, and approved prior to migration.• A process to periodically review changes promoted to production should be put in place to detectchanges performed outside of the normal change management process.• A periodic review of application access should be established to determine that access continues tobe appropriate based on job responsibility.• Privileges which are not necessary for a particular job function should be removed. If there is abusiness need for such access, mitigating controls should be put in place to ensure noinappropriate activity is taking place.• A process should be established to determine that terminated users are removed in a timelymanner.• General security settings should be reconfigured to reduce the risk of unauthorized access.Finding Control Number: FS-440-12-03GENERAL LEDGERInadequate General LedgerCondition:The Department of Labor (Department) utilizes a secure, ongoing host-based application to processand account for transactions relating to the State of Georgia Unemployment Insurance Program,whereas the general ledger utilized by the Department to produce the financial statements for theUnemployment Compensation Fund is an Excel-based set of spreadsheets which are manually updatedon a daily basis from reports and information produced by the host application. This type of setup iscommonly referred to as “end-user computing.” The general ledger utilized by the Department isinadequate due to being basically a set of ongoing cash sheets.53