The Duval County District School Board (District) maintains SAP enterprise resource planning (ERP) software that provides application processing for the District administrative systems, such as general ledger, accounts payable, human resources and payroll functions.  Our audit focused on evaluating selected information technology (IT) functions and determining the effectiveness of selected controls applicable to the District for the period October 2004 through January 2005, evaluating selected SAP activity logging configurations, and determining the status of selected prior audit deficiencies. 

As described below, we noted deficiencies in certain general controls related to the District’s functions and practices:

Finding No. 1:   The District had inadequate segregation of duties that permitted staff that develop applications to also have access to update production application data.  In addition, the General Director of the Applications Department also had unnecessary physical access to production computer equipment.

Finding No. 2:  A fire extinguisher located in the District’s server room had not been inspected in over a year.

Finding No. 3:  The District had not maintained a current disaster recovery plan.

Finding No. 4:  Not all back-up tapes for the SAP System were properly located at the off-site vault. Additionally, one back-up tape was not properly secured and two tapes were missing.

Finding No. 5:  Deficiencies were noted in the District’s IT security controls.  

The Superintendent's response to the audit findings and recommendations is included in the audit report on the Auditor General Web site.