The University of South Florida utilized the PeopleSoft enterprise resource planning (ERP) application software for both its human resource management and financial management solutions.  The applications operated within a client-server Internet-based environment supported by the University’s Division of Information Technologies (ITD), organizationally placed under the Executive Vice-President and Chief Financial Officer (CFO).  In conjunction with Academic Computing Technologies (ACT), ITD operated the University’s backbone data network.  In addition to supporting University technology systems, ITD operated the Central Florida Regional Data Center, which provided services for other educational and governmental organizations.  ACT, organizationally placed under the University Provost, provided computing resources and services to the University community in direct support of instruction and research. 

Our audit focused on the University’s PeopleSoft Financial System, referred to as the Fundamental Accounting System (FAST), including an evaluation of selected general and application information technology (IT) controls applicable to FAST during the period July 2004 through October 2004.  We also evaluated University actions taken in response to selected IT-related deficiencies noted in audit report No. 2004-022.

As described below, we noted deficiencies in University management controls over selected IT functions and practices.

Finding No. 1:   The University did not have an adequate IT security management structure in place to formally develop and implement a security program for the University community. 

Finding No. 2:  Deficiencies were noted in the University’s procedures for restricting access to appropriate users. 

Finding No. 3:  Various other deficiencies were noted in general and application controls surrounding FAST.

The Executive Vice President/Chief Financial Officer's response to the audit findings and recommendations is included in the audit report on the Auditor General Web site.