Department Labor And: Auditor
Department Labor And: Auditor
Montana* 351 7232Legislature. L72Lied Office of the Legislative 1994 Audi tor EDP audit report
^ace
State of
Montana
June 1994
EDP
Audit Report
st;.tf
documents collect;^)
peri
SEP
-G
-
1994
Direct comments/inquiries to: Office of the Legislative Auditor Room 135, State Capitol
PO
Box 201705
Helena
MT
59620-1705
94DP-41
s3 5
E
Tl SinSlTlf
d :D,p
EDP AUDITS
Electronic Data Processing (EDP) audits conducted by the Office of the Legislative Auditor
are designed to assess controls in an
a determination
EDP
environment.
exist
EDP
made
as to
whether controls
performing the audit work, the audit staff General Accounting Office.
From the audit work, and are operating as designed. In uses audit standards set forth by the United States
Members of
the
EDP
Areas of expertise include business and public administration and computer science.
EDP
audits are performed as stand-alone audits of EDP controls or in conjunction with financial-compliance and/or performance audits conducted by the office. These audits are done under the oversight of the Legislative Audit Committee which is a bicameral and bipartisan standing committee of the Montana Legislature. The committee consists of four members of the Senate and four members of the House of Representatives.
STATE OF
MONTANA
PO BOX 201705
HELENA, MONTANA 59620-1705
406/444-3122
FAX 406/444-3036
LEGISLATIVE AUDITOR:
MARYBRYSON
Operations and
EDP
Audit
JAMES GILLETT
Financial-Compliance Audit
SCOTT
A.
SEACAT
LEGAL COUNSEL:
JOHN
W.
NORTHEY
June 1994
The
Legislative Audit
Committee
This report
is
applications.
We
UI
applications.
In addition,
we reviewed
systems.
EDP
controls at the
procedures.
We
"A
Scott A. Seacat
Legislative Auditor
Members of the audit staff involved Ken Erdahl, and Frieda Houser.
in this audit
Table of Contents
Appointed and Administrative Officials
Report Summary
Sii
Introduction
EDP
Background
Audit Objectives Audit Scope and Methodology Compliance
2
4
5
5
Chapter
Controls
II -
General
Introduction
Access Controls
6
7 8
Manner Use of Group User IDs Should be Limited Access Request Forms not Maintained ACF2 Reports Should be Reviewed
Internal Evaluations of Security
9
10
11
13
14
15
Contingency Planning
Introduction
17
Access to the
BeAR
System
is
18
Wage Input
not
Double-Checked
Accuracy
19
Unnecessary Reports Printed and Distributed System Documentation not Up-to-Date and Complete
20
21
Introduction
24
Benefits not Charged Back to
24 26
31
Changes
to
Agency Response
Page
Rod
Sager, Administrator,
Unemployment Insurance
Division
Wayne
Page
ii
Report
Summary
Introduction
This
is
Tax
applications.
systems.
General Controls
to protect
and
limit losses.
In our review of
be adequate, but
We
II
Access Controls
to
ensure
System and
an important role
in
leaving an audit
Programmer Access
Should be Restricted
The department's
In addition,
modify) privileges
we found
the contract
new UI Tax
of
the production programs and data entry screens for both the
UI
Tax and BeAR systems. Write access allows programmers access and make unauthorized program changes or delete
production programs and data.
If
to
unlogged, there
is
no record of
programmer
access.
'eS-1
Report
Summary
Industry standards state programmers do not need access to
programs and
files,
by department security
personnel.
restricted,
Terminated Employees'
Access not Deleted in a
We found
suspended
instances
Timely Manner
manner.
We
we found
still
instances
exists.
We found
files.
of an individual.
Some
UI
recommend
to
The sharing of
ability.
makes
the
it
difficult to
This
is
especially critical
when
to
production
files.
policies in place
Maintained
form be submitted
The form
to
is
meant
is
as
allowed
to the
many
of the
and of the ones we did find, many did not have the
Page S-2
Report
ACF2
Reports Should be
Summary
ACF2
Reviewed
UI programs and
violation report
In addition, the
lists all
department receives a
which
unauthorized users
files.
who attempted
security officer
to electronically access
agency
The agency
indicated he reviews the reports, but does not keep them for
future reference.
is
not
should review the reports, and the reports should be retained for
future reference.
Contingency Planning
Contingency planning
is
com-
contingency plan
should be regularly
updated
to reflect
We reviewed
it
if
contained the
minimum contingency
guidelines as stated in
the plan
is
section 1-0240.00,
MOM.
We
be improved by:
1.
2.
Making provisions
for
backup hardware.
for
3.
Documenting procedures
of a disaster.
manual operation
in the
event
4.
5.
Page S-3
Report
Summary
The UI Division operates a computerized application, the Benefit Automation Rewrite (BeAR) system that determines monetary and nonmonetary eligibility for unemployment benefit
recipients,
Benefit Automation
Rewrite
tests to
determine
if
the person
is
the
to
be distributed to a recipient
to the individuals
it
finding by
UI
personnel.
is
If
mailed
BeAR
system.
We
audited the
BeAR
system. Overall,
we concluded
controls
over the system are adequate to ensure the accuracy and integrity
of data on the system. However,
we
identified areas
where
BeAR
in
Chapter
III
of the report.
Access to the
BeAR
System
is
not Adequately
The BeAR system has an access security system separate from the mainframe ACF2 system. The access security system is
designed
to restrict access to the various
Controlled
screens designated in
all
of the lower
We found
to
being
to in
level.
where the department agreed there was a need reprogramming the access system, but stated the cost and personnel required in the programming prevented them from
following up on
it.
cost to
be
approximately $19,000.
Page S-4
Report
Summary
be
When
for
eligible for unemployment insurance, Combined Wage Claim (CWC). This type of claim uses the wages from Montana and the other state(s) to determine the amount of benefits the claimant is entitled to. The CWC information is input manually by UI Benefits
personnel.
We
identified instances
Unnecessary Reports
Printed and Distributed
by the
BeAR
Bureau.
We found
In addition,
Some of
meet
their needs
and
System Documentation
Not-to-Date and Complete
Documentation provides
their impact
on user groups.
We found
the system
is
incomplete.
In the
it
is
useful to
to
Page S-5
Report
Summary
UI Contributions
to participate in the
unemployment insurance program. Individual employers make contributions to the program based on the amount of wages paid, the amount of UI benefits claimed by employees, and relative unemployment history of the occupation. The UI Contributions
system, also
known
as the
UI Tax system,
is
also
IBM
3090
is
updated during a
We performed
where we
we concluded
UI Tax system. These issues are discussed Chapter IV and summarized in the following sections.
employer tax
is
rates,
determined
in
to
Employers
compared
amount of
BeAR
no mechanism
to allocate
CWC
Montana base
In order to
CWC
Changes
to
Employer Tax
There are 17 data input screens for the UI Tax system which
allow various data fields, such as name, address, employer
number, tax
Page S-6
rate
and employer
status to be updated.
The
Report
Summary
UI employees having
access to these
Department personnel indicated only three people ever have any need to change the tax rate. The department should
restrict access to the tax rate field to
prevent accidental or
Since the
UI Tax system
is
in the
change
personnel.
Page S-7
Chapter
Introduction
This
is
to the
Department of
systems.
In addition, this
Federal
funds are the source for $25.9 million of the division's revenue,
investment income.
EDP
An
(EDP) audit
In an
consists primarily of
Application Controls
the same.
EDP
auditing entails
performing
a general
Organizational - apply to the structuring and management of the data processing function. Specific types of organization controls include segregation of duties, assignment of responsibilities, rotation of duties, and supervision.
Procedural
the reliability of
operating standards and procedures which ensure computer processing results and protect against
processing errors.
Hardware and Software - controls within the operating system software and hardware which monitor and report system error
conditions.
Page
Chapter
I -
computer
physical site controls including security over facility, protection devices such as smoke
alarms and sprinkler systems, and contingency prevention and recovery plans.
Electronic Access - controls which allow or disallow user access to electronically stored information such as data files and application programs.
ability to control
EDP
given
Input
that
all
Ensure all data is properly encoded to machine form and entered data is approved.
-
Processing
Ensure
all
data input
is
is
processed as intended.
Output
to authorized individuals.
trail is also
them.
Background
DOLI
enforces state
state
management
disputes.
DOLI
Page 2
Chapter
I -
workers with benefits if they are temporarily unemployed through no fault of their own. There are seven types of UI benefits that can be paid to a qualified unemployed recipient: Regular UI Benefits - are benefits paid from employer contributions to the UI system. Benefit duration ranges from 8 to 26 weeks.
Extended UI Benefits (EB) - is a special program created by the federal government to extend UI benefits beyond the monetary and duration limits of a regular UI claim. EB becomes effective when the unemployment rate reaches a certain level, and lasts
for at least 13 weeks. (EB was not triggered during fiscal year 1993 or the first half of fiscal year 1994.) Disaster UI Benefits (DUA) - is a special program for unemployment caused by an event declared a disaster by the President of the United States. (No DUA was triggered in Montana during fiscal year 1993 or the first half of fiscal year
1994.)
Emergency UI Benefits (EUC) - is a special program enacted by the U.S. Congress to extend unemployment benefits beyond the
monetary and duration limits of the regular UI claim. (EUC benefits were distributed during fiscal year 1993 and the first
half of fiscal year 1994.)
UCFE UI Benefits - are benefits paid from base period wages from federal agency civilian employment.
UCX
UI Benefits
The shutdowns of the silver mine at Troy and the North American Free Trade Agreement are expected to increase the amount of
benefits paid
decline in the sales or production of a U.S. firm. a fairly inactive program in Montana until recently.
TRA
has been
from
this
program.
DOLI
subsystems
UI Division
employment
Page 3
Chapter
I -
and
determine
eligibility for
unemployment benefit
Benefits.
recipients.
These systems
also track
are:
- All employer contributions and quarterly wage information submitted by employers is entered to this system. The system also determines taxable rates for employers based on shared information from the Reserve Ratio System and the Benefit Automation Rewrite (BeAR) System.
BeAR
to
System
shares information with the tax system determine the amount, type, and duration of benefits to be distributed to a recipient and tracks the different types of benefits paid to individuals during a given period.
this system.
The system
The UI Division systems are batch entry and update systems which operate on the mainframe computer maintained by the
Department of Administration, Information Services Division
UI employees use mainframe terminals to perform programming and operations work. Eligibility technicians at local Job Service offices enter data into the UI Benefits system
(ISD).
is
input
UI
Division.
The department
and
relies
is
responsible for
to
system recovery
on ISD
provide
Audit Objectives
audit of the
DOLI were
to
determine:
its
2.
procedural, physical
3.
The adequacy of application controls over the Unemployment Insurance (UI) Benefits and UI Tax applications in
order to evaluate the adequacy and accuracy of data processed and maintained by these applications.
Page 4
Chapter
I -
in
We measured
by the American
Insti-
ing Office
We
to the
mainframe environment which processes the UI Benefits and UI Tax applications. We interviewed department personnel to gain
an understanding of the hardware and software environment
the
at
DOLL We
also
to
the
We conducted
1994.
We
reviewed:
1.
controls,
Input controls, such as input authorization, edits, access and error correction procedures.
2.
Processing controls, including reconciliation procedures, processing edits, and recalculation of various formulas.
3.
Output controls, such as report distribution procedures, and accuracy and validity of data on the reports.
also
We
determined
to
if
adequate
phases.
Compliance
We determined compliance
applicable to the
department
to
MCA. However,
is
as
we found
the department
not in
in section
2-15-
MCA.
Page 5
Chapter
II
General Controls
Introduction
state's
mainframe
computer
at the
within a computer environment which ensure computer processing activities are controlled.
We
and hardware and system software controls, and did additional testing of physical security, procedural, and electronic access
controls.
The
were
1.
to determine:
2.
The adequacy of procedural controls over system interfaces which ensure data is properly controlled and updated to the UI systems.
3.
The adequacy of
libraries,
UI system
programs,
and
rate tables.
4.
control standards for access systems and verify user access is authorized.
to the
UI
5.
Whether backup and disaster recovery procedures are established and reasonable to recover operations in the event of a
disaster.
to protect
and
limit losses.
In our review of
DOLTs
to
general control
be adequate, but
We
Access Controls
cation
tise in
programmers have the highest degree of technical experthe computer processing facility and, therefore, play an
However, managers
Page 6
Chapter
II
General Controls
leaving an audit
The
state of
assist in the
prevention or detection of
pulation of data
files,
The department's
to specific areas
which
limit access
of the system.
facilitates
on job requirements
to their
job.
We
improve
access controls.
following
Programmer Access
Should be Restricted
Access
to
production
files stored
on the mainframe
is
protected
to access
UI application
to
each system.
We
UI
We found
full
all
UI programmers
full access to all
via
ACF2.
In addition, the
programmers have
UI screens through
security systems.
by department personnel.
Access to production
to process or
files
should be limited
to those
authorized
In addition,
no one
Page 7
Chapter
II
General Controls
and data.
and
Access
to
production
files
production
files
particular job, and only for the time period needed to complete
the job.
alternative
files.
If
production recovery
At
minimum
Recommendation #1
We recommend
A.
Restrict
the department:
to read only access to except as documented, and
programmers
files,
production
B.
all
programmer access
to
production
Contract Programmers
Access Should be
Restricted
Department personnel
Page 8
Chapter
II -
General Controls
all
of the
production programs
creation of the
in
new
system.
is
being
need access
to either
is
As a
to log the
ACF2
anything questionable
is
identified.
Recommendation #2
We recommend
Terminated Employees'
Access not Deleted
in a
Timely Manner
employees' access
is
suspended
in a
timely manner.
We
also
We
files for
personnel
still
their
employment with
still
Of
the 15 people, 10
had access
at least
termination.
When
not
were used
to
who were
assigned the logon IDs had terminated their employment with the
department.
Page 9
Chapter
II
General Controls
In a prior audit report
we recommended
to
recommenda-
the responsibility
The UI
Bureau,
non-DOLI
agencies
We
in a
formal
Recommendation #3
We recommend
to allow
on and off each time. Individuals using these IDs have write
access to the
BeAR
system.
is
used by
testing
to all
ID
is
Page 10
Chapter
Electronic access guidelines
II -
General Controls
recommend
programs be limited
specific systems.
to those
In addition,
to
should be assigned
it
difficult to
This
is
especially critical
when
the
to
production
files.
change
to data
BeAR
system data
to
one
will
weigh the
risks of the
Recommendation #4
We recommend
policies
which
only.
Maintained
The department
assigns
employee's position
in the
employer
files,
information.
Page
Chapter
II -
General Controls
The department has
"request for access"
policies in place
form be submitted
The form
is
meant
is
as
file
for six
of them.
access was
the ones
authorized or
Of
we
did find,
many
Industry standards
recommend management
their duties.
performance of
Use of
risk of
UI
systems.
Department personnel stated the security function has been last few years, and therehas been difficult to maintain consistent enforcement of
To improve
we
determine
if
are reasonable.
Page 12
Chapter
II
General Controls
Recommendation #5
We recommend
A.
the department:
Enforce the current policies requiring access request forms for all access granted, and
Develop procedures for periodic review of access levels
for reasonableness.
B.
ACF2
Reports Should be
ACF2
Reviewed
department receives a
unauthorized users
files.
who attempted
security
agency
The department
ACF2
and
reports to monitor
to
who
accesses
is
which program
authorized.
the only
libraries
We determined the department's security officer individual who reviews ACF2 violation reports. In
is
to
inappropriate access.
The
files.
An
from
a user
ACF2
An
programmer
activity,
and
to
We
The
exist but
officials
Page 13
Chapter
II -
General Controls
have agreed
to
ACF2
reports
Recommendation #6
We recommend
A.
the department:
ACF2
B.
reports.
Retain the
ACF2
Internal Evaluations of
We
Security
tions of security in
MCA,
responsible for
all
department and
establish policies
and procedures
in
in state law,
these procedures include, but are not limited to, the following:
1.
2.
Develop and periodically update written policies and procedures which provide security over data and information
resources.
3.
eliminate, or recover
Implement appropriate cost-effective safeguards to reduce, from identified risks to data and
information resources.
Page 14
Chapter
4.
II -
General Controls
security
Perform periodic internal audits and evaluations of the program for data and information resources.
We
Recommendation #7
We recommend
policies
in
the department develop and implement and procedures for internal evaluations of security accordance with state law.
Contingency Planning
Contingency planning
is
com-
in readiness for
continto
personnel,
It
should
start
with
updated
to reflect
changes
in
Since the
files
UI systems are run on the state's mainframe computer, and programs are backed up regularly by the Department of
is
DOLI
offices.
We
it
to
determine
if
contained the
minimum contingency
guidelines as stated in
Page 15
Chapter
II -
General Controls
section 1-0240.00,
MOM.
Our review
is
We
be improved by:
1.
2.
Making provisions
for
backup hardware.
for
3.
Documenting procedures
of a disaster.
manual operation
in the
event
4.
5.
is
critical to the
operation of
UI
Division.
many
and began
to
document
constraints,
the plan was never completed and has not been updated.
exist
and be tested
to
We
MOM.
Recommendation #8
We recommend
A.
the department:
B.
Page 16
Chapter
III
Benefit Automation
Rewrite System
Introduction
The UI Division operates a computerized application, the Benefit Automation Rewrite (BeAR) system that determines monetary and nonmonetary eligibility for unemployment benefit
recipients,
tests to
determine
If the
if
the person
is
system indicates a
discrepancy,
it
will
further fact-finding by
UI personnel.
If
no problems are
is
produced electroni-
and
is
BeAR
system.
BeAR
system.
The system collects wage information for recipients from the UI Tax system for Montana employers and the
INTERNET
to
entered to
DOLI and
local
throughout the
state.
run.
During
wage master
files in the
BeAR
file.
We conducted
BeAR
system. Overall,
we concluded
we
identified areas
enhanced
to further
BeAR
system.
audit of the
BeAR
Page 17
Chapter
III
Benefit Automation
Rewrite System
Access to the
BeAR
As discussed
in
Chapter
II,
the
BeAR
The
designed
to
The screens are generated through individual computer programs, and range from initial claim information, input from the UI claim form, to inquiry
restrict access to the various "screens."
Information on the
number,
eligibility status,
screens, both
inquiry and input. There are presently seven levels of access and
access
is
instance, he
six
and would
have access
to
one through
five.
We reviewed
level five or
all
UI Division employees with the highest levels of and seven. Of the 17 tested, 10 needed only
lower access.
We
Job
Service personnel with level five access, and found they only
needed
duties.
In
addition,
we
UI Benefits Bureau
who had
found
8
to
personnel needing
UI
data.
screens, and the access not being reduced once the need
over.
Also, employees
level,
may need
way
Page 18
Chapter
III
Benefit Automation
Rewrite System
employees receive access
necessary for their job.
to several additional screens not
periodic
management review of
In addition, the
system security
basis.
to restrict access
on a per-screen
it.
In 1992,
department
Recommendation #9
We recommend
A.
the department:
Periodically review
individuals.
BeAR
to all
B.
Determine the
basis.
feasibility of
reprogramming the
Wage Input
not Double-
When
a claimant
in
another state
unemployment insurance, he/she can file a Combined Wage Claim (CWC). This type of claim uses the wages from Montana and the other state(s) to determine the amount of benefits the claimant is entitled to. The wage information from the other state(s) is received at the
UI Benefits Bureau
information, broken
via
INTERNET,
BeAR
system.
Page 19
Chapter
III
Benefit Automation
CWC
forms
to
determine
if
when he should
With over
all
have received $187 per week. Over the ten week period of
eligibility, the
total
of $130.
3,000
CWC
forms
amount of
Department personnel indicated they have identified other errors where a control of double-checking or verifying the input may
have prevented the errors. Personnel indicated with the
relatively
low number of
CWC
implemented such
a procedure.
Recommendation #10
We recommend
BeAR
system.
CWC
Unnecessary Reports
Printed and Distributed
We reviewed
list
BeAR
buted within the UI Benefits Bureau. The bureau uses a checkto aid in the distribution of the reports.
We found
the
names
on the checklist were not kept updated when changes were made
in staffing.
we reviewed, we
found 10 that are not used. Some of the reports are recycled
immediately, while others are retained and stored for extended
periods of time.
is
kept
not reviewed
why
the
Page 20
Chapter in
Benefit Automation
Rewrite System
employees could not explain where the information comes from
or what
it
might be used
for.
is
an unnecessary
still
produced.
BeAR
its
of the UI Bureau
useful then
was
may
not meet
meet
their
Recommendation #11
We recommend
A.
the department:
to reflect
B.
Reevaluate the reports presently generated and eliminate any unnecessary reports.
System Documentation
not Up-to-Date and
Documentation provides
developing an
Complete
provides:
1.
An
output.
Page 21
Chapter
III
Benefit Automation
Rewrite System
2.
source of information for systems analysts and programmers who are responsible for maintaining and revising existing systems and programs.
3.
4.
new
personnel.
5.
A means of communicating common information to other system analysts, programmers, and operators.
A
source of information about accounting controls.
in the
6.
7.
We
manuals
determine
is
if
BeAR
such
system and
files, etc.
We found some
as record definitions
and
INTERNET
code.
However, the
internal
BeAR
realize the
need
to
update the
In the event of
programmer turnover, gaining an understanding its files and programs would be difficult
The department should update the documentation so it is useful to programmers and users, and develop procedures to ensure the
documentation
ments.
is
Page 22
Chapter
III
Benefit Automation
Rewrite System
Recommendation #12
We recommend
A.
B.
the department:
Update the
BeAR
system documentation.
changes
tion.
Establish policies and procedures to ensure future to the system are included in the documenta-
Page 23
Chapter IV
Unemployment Insurance
Contributions System
Introduction
to participate in the
unemployment insurance program. Individual employers make contributions to the program based on the amount of wages paid,
the
unemployment
system, also
amount of UI benefits claimed by employees, and relative history of the occupation. The UI Contributions
known
as the
UI Tax system,
is
also
The system
IBM 3090
updated during a
We performed
where we tested input, processing, and output controls. Overall, we concluded the controls in place were adequate and the system
was operating effectively
to
following sections.
When an unemployment
claimant
is
insurance claim
is
Back
to
Employers
As discussed
in
chapter
III,
in
Montana and then move to another state can claim Unemployment Insurance benefits using the Montana wages in their base wage calculations. The benefits are paid by the state of residency, but Montana must then reimburse that state for its share of benefits paid. This is called a Combined Wage Claim
include two or
more
states.
Montana
Chapter IV
Unemployment Insurance
Contributions System
In order to be equitable in the calculation of employer tax rates, an employer's Unemployment Insurance tax rate is determined in
part
to their
1,
1981.
CWC
is
the
BeAR
system.
no mechanism
to allocate
CWC
benefits to the
In 1986, the department performed a Benefit Charging Study and estimated there were $2 million in CWC payments that were
Montana employers
in
in
Another study
As a result of CWC payments not being charged back, Montana employers who had claimants move to another state and use the
base wages earned in
UI
Montana may have been assessed a lower would have been charged if the CWC
benefits paid out were tracked by Montana. Because of the lower rates for individual employers, the statewide rate would be increased to compensate. In order to calculate the tax rate in a
fair
CWC
to the individual
Department
charged
employers is the cost to implement the necessary program changes. At the present time, UI programmers have not
to the
set this as a priority.
incorporate the
calculation
CWC
Page 25
Chapter IV
Unemployment Insurance
Contributions System
Recommendation #13
We recommend
programming changes
tax rate calculations.
CWC
There are
number, tax
screens, the
rate
and employer
status to be updated.
CH
Change Entry
to
Over 20 UI employees
change
have access
the tax rate.
all in
the tax rate and access could be restricted to those three people.
The
ability to
rate
authorized to
make
charged
to the
Discrepancy Report"
is
not
Since the
UI Tax system
is
ability to
change
rates
Authorized changes
file.
to the rates
In order to ensure
to a year.
Page 26
Chapter IV
Unemployment Insurance
Contributions System
Recommendation #14
We recommend
A.
the department:
to
Ensure only authorized personnel have access change employer tax rates.
B.
Page 27
Agency Response
Page 29
STATE OF MONTANA
(406)444-3555 FAX (406) 444-1394
HELENA. MONTANA
59624
IjDjf
June
6,
nr
Jjjj
1994
{JIJ.
JUN-6
1994
;[j
Scott A. Seacat Legislative Auditor Office of the Legislative Auditor State Capitol Helena, MT 59620
Dear Scott:
Attached is our response to the recommendations contained in the draft EDP Audit Report on the Unemployment Insurance Division applications, dated June 1994.
We appreciate the cooperative spirit of the audit staff in the discussion of concerns raised and possible solutions. Also, we especially appreciate the independent look at security aspects of this operation because it affords us the opportunity of identifying problems that are sometimes unseen by those closest to the problems.
Although, in some instances, the concerns are raised in the context of the audit of the Unemployment Insurance Division application controls, the issues raised will be addressed by this department, where appropriate, as department-wide issues to ensure the uniformity of policy and procedures.
The Unemployment Insurance Division staff and I will continue to be available to work with you and the Legislative Audit Committee to answer questions about the audit and our response.
'/'V
Quality
Works
MONTANA DEPARTMENT OF LABOR AND INDUSTRY Response to EDP Audit Report Dated June 1994
RECOMMENDATION #
1
AGENCY RESPONSE - Partially concur. We agree that access by U.I Division programmers to files of other divisions should be restricted, but do not agree that U.I. programmers be restricted Programmers routinely need to read only access to the U.I files. There are times more than just read access to production files. when a programmer is the only person around to execute a procedure for a user. The programmers primary job is to produce required data and/or reports under strict timelines for the Department's needs. Therefore, ACF2 rules are in place or will soon be in place to restrict U.I. programmers to U.I. files only. UI programmers will not be able to get into Job Service data sets In addition, we will implement a change to ACF2 and visa versa. rules to log the U.I. programmers when they update the U.I. production files.
B.
AGENCY RESPONSE - Concur. We will modify ACF2 rules to cause a log entry anytime a programmer updates a production program, thereby creating an audit trail as to who updated production The Information Services Bureau Chief has programs and when. implemented a routine review of the access log by a separate person (computer operator technician) from his office, with instructions that questionable entries be reported to the security officer.
RECOMMENDATION
# 2
We recommend the department restrict the contract programmers' access to the production programs
.
AGENCY RESPONSE - Concur. Contract programmers do require access to production programs (there are only two contract programmers working for the department at this time and they are doing work At the current time if one of the contract for the UI Division) programmers does access production programs or production data files, ACF rules are in place to log the occurrence and report it on the "Daily Access Log." We placed some additional restrictions on the contract programmers when the concern was brought to our attention by the EDP auditor.
.
Page 32
The contract programmers currently installing a new tax system for U.I. have full ACF access only to datasets specifically set up for their use in installing the new system (identified by the first two nodes F22.D250). They have read access to our current production datasets but are logged by the ACF rules if they try updating them. These log messages will appear on the daily ACF reports.
This read access is necessary to allow them to carry out the functions of their job. These include reading the old master file for conversion to the new format (which just recently was added to the scope of their responsibilities) pulling pieces out of the old system code and retooling them to the new system, and executing modules in the existing U.I. systems which will be retained for the new system.
,
In addition, it should be noted that, when entering into the contract, a large performance security was required of the contractors and they were required to carry $600,000 in liability The contract also contains language requiring the insurance. contractor to withhold information on individual claimants and employers.
RECOMMENDATION #
We recommend the department document the procedures for timely suspension of access to its computer systems and ensure the procedures are followed.
AGENCY RESPONSE - Concur. We strongly agree that access by terminated employees to department computer systems must be suspended in a timely manner upon termination. We also agree that procedures for suspending access of terminated employees need to be documented and strictly followed. Based on the concern raised, we are reviewing our policy and procedures to ensure that the appropriate steps are taken in a timely and efficient manner to protect the integrity of department systems. We expect to have documentation of policies and procedures complete by September 1, 1994. Our efforts in this regard shall ensure the maintenance of adequate documentation of the policy and related procedures and ongoing emphasis to management and security personnel of the importance of suspending access of Just prior to the audit, terminated employee on a timely basis. we changed internal controls to assure that suspension of access We to the benefits system and the tax system is coordinated. also instituted a new form to coordinate personnel changes with our budget officer since they are usually the first to receive relevant documentation.
Page 33
RECOMMENDATION
# 4
We recommend the department establish and implement policies which limit the use of group IDs to inquiry access only.
AGENCY RESPONSE - Concur. We agree that use of group I.D.'s should be limited to circumstances in which their use is necessary and we are in the process of reviewing their use in the department. We are cognizant of the risks involved in the use of a group I.D. number, but must also weigh the risk in relation to our ability to efficiently serve the customer.
For our review of group I.D. usage, we requested the list of group I.D. numbers identified by the auditor and are reviewing It has already become apparent the use of those I.D. numbers. that many of the identified I.D. numbers do not access U.I. files, but from a department perspective, we will still assess By September 1, 1994, we will document what the need for them. U.I. related group I.D.'s need to be retained and for what purpose. Others will be eliminated.
RECOMMENDATION
A.
# 5
Enforce the current policies requiring access request forms for all access granted.
AGENCY RESPONSE - Concur. Current policies have been enforced in However, the audit identified persons having recent years. access authorized prior to the implementation of current policies and their access authority was not documented by the then implemented access forms. The procedure for periodic review (below) will update the access documentation for those people.
B.
AGENCY RESPONSE - Concur. We are in the process of developing a procedure for periodic review of access levels. A form has been designed that will identify for each CE number, or position number, the degree of access needed, and this form will be used This procedure will as a reference in future periodic reviews. Our goal is to have forms be implemented in the near future. documenting the authorized level of access of all division employees within a year.
Page 34
RECOMMENDATION #
AGENCY RESPONSE - Concur. As mentioned for recommendation #1, we have established a routine review of the ACF reports by the computer operator technician who will report questionable log entries to the department security officer. The criteria for this review procedure has been developed and implemented by the Information Services Bureau Chief.
B.
AGENCY RESPONSE - Concur. The department security officer has established a policy that we maintain the daily ACF2 reports for one (1) year from the day they are printed.
Any questions that we have on these reports are noted on the report as to who we contacted concerning the "LOG" and/or "VIOLATION, " what the reason was for the "LOG" and/or "VIOLATION" and what we did about it to remedy the situation so it doesn't happen again.
RECOMMENDATION #
7
We recommend the department develop policies and procedures for internal evaluations of security in accordance with state law.
AGENCY RESPONSE - Concur. The absence of formal policies and procedures related to internal evaluation of automated systems security issues is a valid concern. It does not, however, reflect an accurate view of the current environment. Risk assessments performed for our federal counterpart review security issues of the U.I Division. Also, we believe that the security of U.I. programs and data is evaluated and maintained through various safeguards currently in place in the division (plus some to be added based upon recommendations above) but documentation is indeed lacking. There are a couple of reasons why this occurs. First, the development of such documentation is always cumbersome to prepare but is even more cumbersome to maintain, and this takes considerable resources which are spread thin already. Second, the changes in technology over even the shortest of time frames tends to make such documentation obsolete very quickly. While these are obvious excuses for a real concern, the department is committed to improving its documentation of the policies and procedures applied in maintaining the integrity of department systems, and will continue efforts to formalize an internal evaluation of security
,
Page 35
provisions. We have set a target of January 1, 1995, to document the existing policies and procedures and those which will be implemented by that date.
RECOMMENDATION
# 8
AGENCY RESPONSE - Concur. We are reviewing the extent to which Unemployment Insurance Division mainframe programs and data are included in the Department of Administration contingency plans. Specifically, we will identify which parts of the U.I. systems have been identified as critical applications in the context of Section 1-0240.00 of the Montana Operations Manual.
However, we agree that the documentation of contingency plans is inadequate, although The U.I. Division has periodically reviewed contingency measures as part of risk assessments that are performed under federal requirements. There are also some limited policy statements, in the department policy manual, related to use of computers, ownership of software, and documentation and backup of systems on personal computers. Overall, we agree that formal documentation of U.I. Division contingency plans is not adequate and this shortcoming will be addressed in the future as resources become available. The continued development of a contingency plan has been included in the list of projects to be defined and addressed by the Administrative Services Bureau.
B.
AGENCY RESPONSE - Concur. We will periodically review BeAR system access to keep access current.
Page 36
We agree that tighter security is desirable to control accidental access although there have been no incidents of intentional manipulations of data identified since the BeAR was implemented in August of 1985. The possibility of human error exists at any level of security but erroneous data entry due to unauthorized access has not been identified as an issue. We disagree with the exception to level 5 security being assigned to Job Service staff. Job Service began adjudicating certain non-monetary issues in 1989 in the interest of better customer service. The screens for non-monetary resolution require level 5 security.
Annual reviews were initiated to keep the internal user community current and security access at the appropriate level and we will make it a priority to maintain this process in the future. Over the past year we have made a change to our security policy to tighten system access. We have instituted a policy of positionspecific access, and have begun the documentation process. The documentation of each position is projected to be complete by October 1, 1994.
We agree that a periodic review of the BeAR access should be given on all individuals. Each year UI updates the information sharing agreements with the participating agencies. At that time, UI sends a list of all users that are authorized to use UI information from that agency. An on-site review would tighten that review and is part of this year's risk plan.
Determine the feasibility of reprogramming the security system to restrict access on a per-screen basis.
AGENCY RESPONSE - Partially Concur. We will continue to study the cost-benefit of reprogramming the security system to restrict access on a per-screen basis. It is not cost effective at this time since no abuse has been identified. The issue remains on our request for programming list and will be a part of any system rewrite in the future. RECOMMENDATION
#10
We recommend the department implement procedures to verify the accuracy of all CWC information input to the BeAR system.
AGENCY RESPONSE - Partially concur. We agree with the concern of possible human error when manually data entering wage amounts from IB-4 information transferred over the Internet System. We do not agree that this is a universal problem but an isolated incident.
Page 37
It is the normal procedure for staff to verify that total wages The monetary determination agree with the amount transferred. sent to the claimant advises them to verify the accuracy of the wage information as well because wages are often misreported by the employer and the agency has no way of identifying these types of errors. If there are wage discrepancies for any reason, the claimant would normally identify them. We believe very few errors go undetected.
To implement a double-checking procedure, we would have to hire another person, at least during heavy volume periods. While recent years have seen additional funding (contingency funds) available for increased volume (related to Emergency Unemployment it appears that these funds are Compensation Act in past winter) on the decrease.
,
This potential problem should be eliminated with the implementation of an automated interface between the IB-4 process and the wage file. We have been unable to dedicate agency staff to this interface, however we have accepted an offer of assistance from Martin-Marietta, the Internet contractor in Orlando, Florida, to install an interface used in several states, customized to Montana's requirements. They have several implementations scheduled and Montana is on the waiting list. They estimate that the interface will be installed in Montana within the next year.
RECOMMENDATION
#11
staffing.
AGENCY RESPONSE - Concur. We have had considerable turnover in the last few months and the list was not updated pending filling the vacant positions however as soon as staff becomes static, the list will be revised. Staff who distribute the reports know where the reports go based on duties assigned to the positions rather than names of person in the position. Reevaluate the reports presently generated and eliminate any unnecessary reports.
B.
AGENCY RESPONSE - Concur. We agree the reports should be reviewed periodically. We do review the printed reports regularly. We eliminate some reports that are not used or required and microfiche others when the information is required to be retained for any length of time.
Page 38
We believe this process is currently in place and has been since the automated system was implemented. We do not agree this is an exception.
We normally poll the staff both in Central Office and Job Service to ensure we do not eliminate a necessary report. We have recently eliminated several reports which possibly include some of the ones identified by the audit.
The check register is not immediately recycled, it remains in our Benefit Support Unit for a short period to ensure that any obvious errors are resolved before being destroyed. Discrepancies in summary information and system problems with checks are usually reviewed by the Bureau Information Systems Support Specialist, who was not contacted with this concern. The check register is available on microfiche for future reference. The support specialist would also be able to explain where information comes from in most instances and if not, obtain the information from the system programmers. Again, the appropriate staff person was not contacted with this concern. Also, one of the supervisors could have assisted auditors in tracking source information or direct them to appropriate staff. We will continue to review the reports for possible elimination based upon the cost to print and store. We will eliminate any of the ones identified as "not used" after verifying with all staff We will cease printing those that do not that they are obsolete. require a hard copy.
RECOMMENDATION
#12
AGENCY RESPONSE - Concur. We agree with this concern. We intend to update documentation and ensure future changes to the system Lack of documentation has are included in the documentation. been identified as an universal industry problem and this concern has been addressed in training sessions with programming staff.
It is possible that if additional automation funding is received We are we will be able to dedicate staff to this task. definitely concerned with the possibility of loss of expertise rendering the system ineffective and have been aware that this It should be noted that changes to system potential exists. programs are documented in the programs themselves. The concern is with the system's manuals which do not get routinely updated.
Page 39
B.
Establish policies and procedures to ensure future changes to the system are included in the documentation.
AGENCY RESPONSE - Concur. As indicated above, we are committed to ensuring that future system changes are adequately documented.
RECOMMENDATION
#13
We recommend the department develop a plan to implement programming changes to include CWC benefits in the UI tax rate calculations.
AGENCY RESPONSE - Partially Concur. We agree that the absence of the ability to charge back benefits to Montana employers on combined wage claims is an equity issue. We would like to program the BeAR system to accommodate the combined wage bill back. We do not agree that the cost involved in programming this process would be regained through the resultant increase in employers' contributions.
We do not believe that the charge backs would greatly affect most employers tax rates or that there is a measurable effect on the The estimated Trust Fund by not charging back these amounts. $2,000,000 in a 1985 study referred to the total amount paid out This did not reflect the historical on combined wage claims. percentage that is not chargeable due to separation issues as The amount would be considerably identified in the 1994 study. less with this consideration.
We do not have programmer resources at this time to implement this system change. The time estimate indicates it would take one dedicated programmer at least a year to complete the required programming. We have two trained BeAR programmers at this time who are utilized to capacity maintaining the current system and implementing state and federal requirements. They are also dedicating considerable time and effort to training new staff. We lack funding sources at this time to contract the programming If we are successful in obtaining to outside resources. additional automation funding this option is a possibility.
We will continue to evaluate the possibility of implementing combined wage charge backs in the interest of equitable treatment of employers based on available funding.
We have updated our request for programming (RFP) for this project and have added it to our outstanding list in the event monies are received.
Page 40
RECOMMENDATION
#14
Ensure only authorized personnel have access to change employer tax rates
.
In the new tax system, currently being AGENCY RESPONSE - Concur. developed, the ability to add rates to the system will be allowed In both instances, access to those screens on only two screens. will be strictly limited to persons who need access to perform In addition, other procedures test their specific job duties. Three Revenue Quality Control the accuracy of rates input. reviews are conducted annually that involve verification of accuracy of rate assignments. A sample of 60 new status determinations, 60 successor status determinations, and 60 experience rate assignment determinations are pulled and reviewed to ensure that employer tax rates are assigned according to law. These reviews have not identified a problem involving the assignment of employer tax rates.
B.
time.
AGENCY RESPONSE - Concur. A rate discrepancy list will be produced off the new tax computer system and will be retained for three years.
Page 41