The University of Florida (University) utilized the Oracle-PeopleSoft (PeopleSoft) Financials and Human Resources Management System (HRMS) application suites as its enterprise resource planning (ERP) solution.  The applications operated within an Internet-based environment as part of a group of integrated systems referred to collectively by the University as the myUFL systems.  The myUFL systems were built, deployed, and maintained by UF Bridges, a University division reporting to the Vice President of Finance and Administration.  The University’s Office of Information Technology, Computing and Network Services (CNS) provided large-scale centralized computing services for the University, the University of North Florida, and other State educational institutions and agencies in northern Florida.

Our audit focused on evaluating selected information technology (IT) controls applicable to the PeopleSoft Financials System, as implemented and administered by the University, and selected internal controls related to the University’s overall IT environment, for the period July 2005 through December 2005.

As described below, we noted that improvements were needed in certain controls related to the University’s IT functions and practices.

Finding No. 1:    There was a need for improved University level governance of the myUFL systems and the enterprise data contained therein.

Finding No. 2:    Improvements were needed in segregating and limiting UF Bridges staff access within PeopleSoft Financials. 

Finding No. 3:    Deficiencies were noted in general and application controls surrounding the myUFL systems.

Finding No. 4:    Improvements were needed in limiting access to the data center and to core network rooms located throughout the University.   

The University's response is included at the end of this report as Appendix A.