The Orange County District School Board (District) maintains SAP America Public Sector, Inc. (SAP) enterprise resource planning (ERP) software that provides application processing for the District’s administrative systems, such as general ledger, accounts payable, purchasing, personnel, and payroll functions.  Our audit focused on evaluating selected general information technology (IT) controls during the period June 2004 through September 2004 and determining whether the District had corrected, or was in the process of correcting, IT-related deficiencies disclosed by the predecessor auditor in a management letter dated October 31, 2003.

As described below, we noted deficiencies in certain general IT controls related to the District’s functions and practices:

Finding No. 1:     A Districtwide security program had not been formally devised to ensure that exposures and vulnerabilities of IT resources had been sufficiently assessed by management and addressed through enforced user and system security controls.  Additionally, the District had not designated a chief security officer or similar function to provide for a unified security program over the District’s information resources. 

Finding No. 2:    The District lacked a formal Information Systems Development Methodology (ISDM), including written policies and procedures governing various IT functions. 

The Director's response to the audit findings and recommendations is included in the audit report on the Auditor General Web site.