Summary

This operational audit focused on selected general and application controls related to the Applications Coordination Electronic Document Management System (Applications System) of the Office of Insurance Regulation (OIR) for the period March 2006 through February 2008 and selected actions through August 29, 2008.  Our audit disclosed:

Change Management

Finding No. 1:   OIR change management controls could be enhanced.  OIR staff were unable to provide documentation to evidence user acceptance testing and approval for all Applications System program changes.

Batch Processing Controls

Finding No. 2:   The OIR scanning and indexing process could be enhanced by implementing batch processing controls that ensure all documents received with an application package are processed.

User Access

Finding No. 3:   OIR security controls over user access to the Applications System need improvement.

The Commissioner’s response is included as Exhibit A