Summary

The Hillsborough County District School Board (District) utilizes enterprise resource planning (ERP) software from Lawson Software, Inc., to support various administrative functions.  Our audit focused on evaluating selected general information technology (IT) controls applicable to the Lawson ERP software and the surrounding infrastructure during the period July 2007 through February 2008 and selected actions taken from July 2006.  In addition, we determined the status of corrective actions taken regarding IT-related deficiencies disclosed in audit report Nos. 2006‑157 and 2006-178. 

The results of our audit are summarized below:

Finding No. 1:         The District’s entitywide security program needed improvement. 

Finding No. 2:         We noted deficiencies in the District’s management of access privileges. 

Finding No. 3:         Program change controls over the Lawson ERP software needed improvement. 

Finding No. 4:         The District had not tested its Disaster Recovery Plan at an off-site location.

Finding No. 5:    In addition to the matters discussed in Finding Nos. 1 and 2, certain security controls related to the Lawson ERP software and the supporting infrastructure needed improvement.  Specific details of these issues are not disclosed in this report to avoid the possibility of compromising the District’s data and IT resources.

The Superintendent's response is included at the end of this report as Appendix A.