Summary

The State Board of Administration (SBA) utilizes an Eagle Investment Systems, LLC, software solution, Eagle-Straight-Through Accounting and Recordkeeping (Eagle STAR), as its investment accounting system.  PeopleSoft Financials is utilized to perform SBA’s overall financial accounting and reporting.

Our audit focused on evaluating selected information technology (IT) controls applicable to Eagle STAR and PeopleSoft Financials during the period August 2007 through October 2007 and selected SBA actions taken from July 1, 2006.  In addition, we determined the status of corrective actions regarding Finding Nos. 2 through 4 and selected deficiencies in Finding No. 5 disclosed in audit report No. 2005‑171.

The results of our audit are summarized below:

Finding No. 1:         SBA change management controls for Eagle STAR, PeopleSoft Financials, and supporting applications needed improvement.

Finding No. 2:        We noted instances of excessive or inappropriate system access privileges.  In addition, certain aspects of SBA practices for managing access privileges needed improvement. 

Finding No. 3:        We noted instances where SBA did not timely remove the access privileges of terminated employees. 

Finding No. 4:        SBA did not log modifications to PeopleSoft Financials access privileges.

Finding No. 5:        Certain security controls related to Eagle STAR, PeopleSoft Financials, and the supporting network environment at SBA, in addition to the matters discussed in Finding Nos. 2 through 4, needed improvement.  Specific details of these issues are not disclosed in this report to avoid any possibility of compromising SBA data and IT resources.

Finding No. 6:        SBA did not maintain current procedures pertaining to various functions within the Accounting Information Systems (AIS) Section of the Financial Operations Division of SBA. 

The Interim Executive Director's response is included at the end of this report as Appendix A.