Summary

The Orange County District School Board (District) maintains SAP America Public Sector, Inc. (SAP) enterprise resource planning (ERP) software to support various administrative functions.  Our audit focused on evaluating selected information technology (IT) controls applicable to the SAP financials application and surrounding infrastructure during the period July 2006 through June 2007 and determining whether the District had corrected, or was in the process of correcting, IT-related deficiencies disclosed in audit report No. 2005-109 and by the predecessor auditor in its management letter dated October 20, 2006. 

As described below, we noted that improvements were needed in certain controls related to the District’s IT functions and practices.

Finding No. 1:         Improvements were needed in the District’s IT security management.

Finding No. 2:        Deficiencies were noted in the District’s disaster recovery plan and process.

Finding No. 3:        Improvements were needed in off-site backup procedures. 

The District General Counsel’s response is included at the end of this report as Appendix A.