3.4 Controls Over Microcomputer Hardware and Software

Transcription

1 Introduction Government has made a significant investment in microcomputer hardware and software in recent years and relies heavily on information technology to deliver programs, manage resources and account for what it does. Figure 1 shows information technology expenditures by department for the year Figure 1 Consolidated Revenue Fund Information Technology Expenditure Breakdown by Department and Category 31 March 1998 ($ 000 s) ended 31 March 1998 totalling $27.1 million, of which $9.8 million relates to hardware and software. Given the significant investment made by Government and the importance of the information maintained on the microcomputers, it is important for departments to have systems in place to manage and control their microcomputer inventory. This is especially important since microcomputers are movable capital assets that are susceptible to loss or theft. Department Hardware Software Subtotal Processing Professional Services Other Total 1998 Total 1997 General Government Sector Consolidated Fund Services $ 1 $ 2 $ 3 $ - $ - $ - $ 3 $ - Executive Council 2, ,302 1,137 3, ,811 5,123 Finance ,238 - Government Services and Lands 1, , ,358 1,721 Legislature Public Service Commission Works, Services and Transportation ,540 1,438 3,900 1,036 4,936 2,066 5,034 1,053 13,089 8,392 Resource Sector Development and Rural Renewal Environment and Labour Fisheries and Aquaculture Forest Resources and Agrifoods ,232 1,375 Industry, Tradeand Technology Mines and Energy Tourism, Culture and Recreation , , , ,216 3,626 Social Sector Education ,880 1,159 Health , ,513 1,573 Human Resources and Employment 1, ,469 2, ,899 2,901 Justice ,424 1,885 Municipal and Provincial Affairs , , ,391 3,798 3, ,774 7,906 Total $7,724 $2,060 $9,784 $6,237 $9,292 $1,766 $27,079 $19,924 Source: Consolidated Revenue Fund financial statements and the Financial Management Information System Auditor General of Newfoundland 31

2 To provide guidance and assistance to departments in the acquisition and use of computer hardware and software, the Treasury Board Secretariat, in 1991, reissued its information technology policy and procedures which are included in Volume II of the Province s Management Manual. The manual indicates that departments are responsible for among other things: maintaining an inventory of all hardware and software; communicating Government s policy against the illegal copying of software to all users; and periodically reviewing software installed on all computer equipment to ensure that only authorized software is being used. Scope and Objective We completed our review of controls over microcomputer hardware and software in three Government departments in September The departments of Municipal and Provincial Affairs, Justice, and Human Resources and Employment were selected for review. The period covered under our review was from 1 April 1997 to 31 March Our objective was to make a general assessment of controls over microcomputer hardware, software and peripherals in Government. This assessment included determining: whether the departments maintain adequate physical and accounting controls over microcomputer hardware, software and peripherals; and whether the departments documented policies and procedures were clearly defined and communicated to staff. Conclusions Government has made a significant investment in computer hardware and software in recent years. In , Government departments spent $6.3 million on computer hardware and software. In , expenditures had increased to $9.8 million. Given the significant cost of these purchases, we reviewed 3 of the 18 Government departments to determine whether computer hardware and software were adequately safeguarded and controlled. These 3 departments accounted for $1.9 million of the $6.3 million in expenditures in and $2.8 million of the $9.8 million in The departments reviewed were the departments of Municipal and Provincial Affairs, Justice, and Human Resources and Employment. Our review indicated that controls over computer hardware and software in the three departments reviewed are not adequate. Specifically: The Department of Municipal and Provincial Affairs does not maintain an inventory of its computer hardware and software. For the Department of Justice and the Department of Human Resources and Employment, which did maintain an inventory of computer hardware and software, we determined that their systems were not accurate. For example, we identified 323 items of computer hardware and 176 pieces of software at the Department of Human Resources and Employment that were not in the inventory records. There were 45 pieces of software at the Department of Justice that were not in the inventory records. We also found 113 items of computer hardware which were included in inventory but which could not be located by the Department of Human Resources and Employment. We identified 10 pieces of software which were not present at the assigned location at the Department of Justice. 32 Auditor General of Newfoundland

3 There were 38 instances of software on computers for which the departments could not provide proof of ownership. In addition, there was one instance identified in the Department of Municipal and Provincial Affairs where the same copy of software, authorized for single use only, was found on 4 microcomputers reviewed. There were 8 instances where microcomputer equipment purchased by the Department of Municipal and Provincial Affairs could not be located. Government does not know the cost of their current investment in computer hardware and software. Similarly, the three departments reviewed do not know their current investment in computer hardware and software. Policies over the safeguarding and control of computer hardware and software need to be improved and communicated to staff. For example, two of the three departments reviewed did not have a policy prohibiting the use of unauthorized software. Departments do not routinely check their computers to ensure that only authorized software is being used. Findings and Recommendations Inventory Records in each of the two departments which had a microcomputer inventory system, we chose 15 employees at random, identified the microcomputer and software that each employee was using, and checked to determine whether these items were recorded in the inventory system; in addition, for those same 15 employees identified in each of the two departments and for 15 employees chosen at random at the Department of Municipal and Provincial Affairs, we checked to determine whether each department could demonstrate proof of ownership for the software that each employee was using; we selected 15 items from the microcomputer inventory system in each of the two departments which had an inventory system to determine whether these items were at the department. we selected a sample of 15 computer hardware and software purchases between 1 April 1996 and 30 November 1997 for each of the three departments to determine whether the department could account for the asset; and we performed a general review of the inventory records maintained by the departments. The results of our testing are outlined in Figure 2. The Department of Justice and the Department of Human Resources and Employment currently have computer inventory systems in place. However, there is no computer inventory system maintained by the Department of Municipal and Provincial Affairs. To determine the reliability of the computer inventory systems, whether software on the computers was legally owned by Government, and whether computers and software purchased could be accounted for, we performed the following procedures: Auditor General of Newfoundland 33

4 Figure 2 Inventory Records Results of Testing Finding Municipal and Provincial Affairs Justice Human Resources and Employment Total Copies ofsoftware authorized forsingle use but found on additional microcomputers Instances of software on microcomputers without proof of ownership: (1) Business type (2) Other (including entertainment) Instances where software recorded in the inventory system was not found on the microcomputers indicated Instances where hardware in the inventory system could not be located at the depart ment system system Instances where hardware was identified as unaccounted for in the inventory system system Instances where purchases of hardware could not be located at the department Instances of software on microcomputers but not recorded in the inventory system Instances where hardware was at the department but not recorded in the inventory system system system In addition to the above, during a review of assets stored at a leased warehouse, officials of the Department of Human Resources and Employment provided a manual listing of 310 computer hardware assets including computers, monitors and keyboards which, although received during February and March 1998, were not recorded in inventory as of 17 April During , the Department of Justice switched from an in-house designed computer inventory system to an off the shelf software package. Departmental officials indicated that the primary focus of the previous system was recording microcomputer hardware whereas the current system records both microcomputer hardware and software. During our review, it was determined that 34 Auditor General of Newfoundland

5 adjustments were still being made for inventory on hand at 31 March 1998 based upon submissions from regional offices. In one instance identified during testing, the sample item selected, a software package, was not recorded in inventory. Upon further review, it was determined that no software had been recorded in inventory for that particular branch office. An independent review of regional office inventories by the Department of Justice is necessary to confirm the details which have been provided and recorded. Based upon our review of the records contained in the inventory system at the Department of Human Resources and Employment, a total of 1,971 pieces of computer hardware and software were identified which, although designated as having been issued, did not have the staff assignment field completed. Although the office at which the records are located was indicated, significant difficulties can result in locating assets when no assignment to an individual staff member is indicated. Recommendations Departments should ensure that all microcomputer hardware and software is recorded in the inventory system. authorized for single use only, was found on four microcomputers reviewed. As indicated in Figure 3, physical and accounting controls over microcomputers and software at the three departments we reviewed were not adequate. Furthermore, departments do not routinely check their computers to ensure that only authorized software is being used. Recommendation Departments should ensure there is proper authority for all computer software on microcomputers. Control Procedures It is important to ensure that there are adequate physical and accounting controls over microcomputers and software of the various Government departments. An adequate system of controls would include: policies relating to the control of computer hardware and software; Departments should ensure that all computer hardware and software recorded in the inventory system is accurate and can be accounted for. a system in place to identify specific assets, the individual to which they are assigned, and location; Authorization The unauthorized use of software is a criminal offence and penalties can be imposed upon Government if employees are found to be illegally copying software or using software which was illegally copied elsewhere. As indicated in Figure 2, we identified 38 instances where the departments could not provide proof that they owned the software being used on its computers. Our review indicated that of the 38 instances, 17 appeared to be business type software while the remaining 21 were related to other types of software including entertainment. In addition, there was one instance noted at the Department of Municipal and Provincial Affairs where the same copy of software, periodic verification of the inventory records by a physical count; and adequate procedures to record transfers, additions and disposal of computer hardware and software. The results of our review of controls in the departments of Municipal and Provincial Affairs, Justice and Human Resources and Employment are outlined in Figure 3. Auditor General of Newfoundland 35

6 Figure 3 Control Procedures Review of Controls Finding (1) Results of testing disclosed weaknesses in these systems. (2) The department indicated that staff were notified; however, no evidence to support this could be provided. Although the Department of Municipal and Provincial Affairs did not have an inventory control system in place at the time of our review, some preliminary work for the St. John s Headquarters had been completed and the Department planned to have a system in place before the end of the fiscal year. Recommendation Departments should ensure that there are adequate physical and accounting controls over microcomputer hardware and software. Departments Response Municipal and Provincial Affairs Justice Human Resources and Employment Inventory control system in place No Yes (1) Yes (1) Documented procedures for the maintenance of the inventory control system system No Yes Policies for the use of microcomputers No No Yes Policies on the use of unauthorized software No (2) No (2) Yes Centralized control over software No No Yes Department of Human Resources and Employment The Department of Human Resources and Employment concurs with the importance of maintaining adequate controls over microcomputer hardware, software, and peripherals in order to safeguard government s investment in information technology. The Department has been making significant progress in this area in the past three years with the implementation of a computerized inventory system and procedures for the tracking of our approximate 6,700 items of computer items in fifty locations across the province. We concur that additional improvements can still be made and will continue to address deficiencies in this area. In regard to particular findings, the Department has the following comments: 1. Of the 323 items (4.8% of total) of computer hardware referred to in the conclusion of the report, 310 of these were recorded manually initially but were keyed into our inventory system over time. The remainder have also been recorded in our system since the audit. 2. In respect to the 176 items of computer software identified on departmental equipment and not recorded in our computer inventory system, our procedure has been to purchase and record software in bulk manually in our files. Only specialized software are recorded specifically in our inventory system. We will review our procedure in this area items of computer hardware identified as unaccounted for in our inventory system have been reduced to 73 items. Of these, only 15 were microcomputers with the remainder being hardware components. This category in our system is for recording assets which typically have been transferred to another office and the record of the transfer was not put into our system. The Department will initiate inventory checks to identify the current location of this equipment, will update our records, and will improve our transfer procedures. 4. A total of 1,971 pieces of computer hardware and software in our inventory system, while recorded by office location, did not have the staff assignment field completed. Our policy has been to track equipment by office location with the staff assignment information being optional. We will review this policy. 36 Auditor General of Newfoundland

7 While the Department s policy has been to not permit unauthorized software on departmental microcomputers, we will implement a procedure to monitor staff microcomputers at random for unauthorized software. Department of Municipal and Provincial Affairs 1. As correctly pointed out in the report, Municipal and Provincial Affairs was in the process of doing a departmental inventory of hardware and software at the time of the investigation. The hardware inventory is complete, and the software inventory is continuing. This is also helping with the department s Year 2000 compliance efforts. 2. A database has been developed for software inventory control which records the user, the licence number, the date purchased, the PO Number, and the Vendor. This will enable the Department to control unauthorized installation of software. 3. The Information Technology Division of Municipal and Provincial Affairs was formed two years ago to service Municipal and Provincial Affairs, Government Services and Lands, and Development and Rural Renewal. Consequently, there was much movement of people and resources including the computer hardware and software inventory. However, documentation to support the inventory did not flow with the equipment and software. 4. The Information Technology Division is also beginning to adopt policies to deal with Inventory issues including personal software on government computers, unauthorized installations of software, etc. Department of Justice The Department of Justice is pleased with its progress in this area, and will continue to improve and maintain controls. Auditor General of Newfoundland 37