Summary

The St. Johns County District School Board (District) utilizes Oracle-based applications and databases to manage its financial resources.  Our audit focused on evaluating selected information technology (IT) controls applicable to the Oracle financials application and surrounding infrastructure during the period July 2005 through June 2006 and selected actions taken through November 2006. 

As described below, we noted that improvements were needed in certain controls related to the District’s IT functions and practices.

Finding No. 1:         User access capabilities in the Oracle application were, in some instances, inappropriate, excessive, unsupported by written authorization, or inconsistent with what was authorized in writing. 

Finding No. 2:        The District’s Information Technology Procedures Handbook lacked certain important security policies and procedures.

Finding No. 3:        Improvements were needed in certain security controls protecting the Oracle financials application and surrounding IT infrastructure. 

The Superintendent's response is included at the end of this report as Appendix A.