s 352.44 L72REDP 1996 Legislative Audit Division stateofMontana ReporttotheLegislature December1996 EDP Audlt RcpOlt STATE DCCU,M:N'TS COLLECTION F[B 2 1 1357 I.ICMTANASTATELtBRARY HELEN1A5.15MEO.r^etfhAMAAVE5.QG20 Department of Revenue Thisreportprovidesinformationregardinggeneralandapplicationcontrols overcomputerdataprocessingsystemsattheDepartmentofRevenue. It includesrecommendationsforimprovingcontrolswithintheelectronicdata processingenvironment. Therecommendationsaddress: * Generalandapplicationcontrolsapplicabletothedepartment's ComputerAssistedMassAppraisalSystem(CAMAS). > Applicationcontrolsoverdataprocessedbythedepartment's RevenueControlSystem,DelinquentAccountsReceivable,and IndividualIncomeTaxapplications. »- ElectronicaccesstoCAMAS. Thisauditdeterminedemployees changedpersonalpropertyinformationforpropertiestheemployees own,whichviolatesdepartmentpolicy. Directcomments/inquiriesto: LegislativeAuditDivision Room135,StateCapitol POBox201705 97DP-04 HelenaMT59620-1705 MONTANASTATELIBRARY 3 0864 0069 8090 7 EDPAUDITS ElectronicDataProcessing(EDP)auditsconductedbytheLegislativeAuditDivisionare designedtoassesscontrolsinanEDPenvironment. EDPcontrolsprovideassuranceoverthe accuracy,reliability,andintegrityoftheinformationprocessed. Fromtheauditwork,a determinationismadeastowhethercontrolsexistandareoperatingasdesigned. Inperforming theauditwork,theauditstaffusesauditstandardssetforthbytheUnitedStatesGeneral AccountingOffice. MembersoftheEDPauditstaffholddegreesindisciplinesappropriatetotheauditprocess. Areasofexpertiseincludebusinessandpublicadministration. EDPauditsareperformedasstand-aloneauditsofEDPcontrolsorinconjunctionwith financial-complianceand/orperformanceauditsconductedbythedivision. Theseauditsare doneundertheoversightoftheLegislativeAuditConmiitteewhichisabicameralandbipartisan standingcommitteeoftheMontanaLegislature. Thecommitteeconsistsofsixmembersofthe SenateandsixmembersoftheHouseofRepresentatives. MEMBERSOFTHELEGISLATIVEAUDITCOMMITTEE SenatorGregJergeson,ViceChairman RepresentativeErnestBergsagel,Chairman SenatorSueBartlett RepresentativeBeverlyBamhart SenatorReinyJabs RepresentativeA.R. "Toni"Hagener SenatorTomKeating RepresentativeBobKeenan SenatorKenMiller RepresentativeRobertPavlovich SenatorLindaNelson RepresentativeBruceSimon MONTANALEGISLATIVEBRANCH ^ LegislativeAuditor -fW^"^ ^^^"'^LegislativeAuditors: ScottA. Seacat ^^^ '^Sera'^onsandEDPAudit JLeoghanlNCoorutnhseeyl: I^^^H^^^^^^^SkW) ^'"F^i^n^a"n^ci8a"l"-'ComplianceAudit Nj^^^^^^^ PerformanceAudit LEGISLATIVEAUDITDIVISION December1996 TheLegislativeAuditCommittee oftheMontanaStateLegislature: ThisreportisourEDPauditofgeneralandapplicationcontrolsrelatingtothe DepartmentofRevenue.Theauditreviewedgeneralandapplicationcontrolsapplicable tothedepartment'sComputerAssistedMassAppraisalSystem(CAMAS). Theaudit alsoaddressedapplicationcontrolsoverthedepartment'sRevenueControlSystem (RCS),IndividualIncomeTaxSystem(ITT),andDelinquentAccountsReceivable System(DAR). Thisreportcontainsrecommendationsforimprovinggeneralcontrols withintheCAMASprocessingenvironment. Recommendationsalsoaddressprocessing controlsoverRCS,IIT,andDAR. Writtenresponsestoourauditrecommendationsare includedinthebackoftheauditreport. WethanktheDepartmentofRevenuefortheircooperationandassistancethroughout theaudit. RespectMlysubmitted. ScottA.Seacat LegislativeAuditor Room135,StateCapitolBuilding,POBox201705 Helena,MT59620-1705 Phone(406)444-3122 FAX (406)444-9784 Legislative Audit Division EDPAuditReport Department of Revenue MembersoftheauditstaffinvolvedinthisauditwereKenErdahl,Alan Lloyd,RichMcRae,ReneSilverthoraeandKentWilcox. TableofContents ListofTables iii AppointedandAdministrativeOfficials iv ReportSummary S-1 ChapterI-Introduction Introduction 1 andBackground OrganizationofReport 1 GeneralandApplicationControls 1 AuditObjectives 2 AuditScopeandMethodology 3 Compliance 4 DepartmentBackground 4 ChapterU-Revenue RevenueControlSystem 7 ControlandDelinquent ConclusionsOverRCS 7 AccountsReceivable Systems DelinquentAccountsReceivable 8 ConclusionsOverDAR 8 CaseNotesShouldbeUpdatedforAddressChanges 9 m Chapter -Individual Introduction 11 IncomeTaxSystem ElectronicFiling 12 ConclusionsOverITT 12 SystemEdits 13 ProcessingEditsShouldbeDocumented 14 IncomeTaxReturnAdjustmentsShouldbeSupported 15 IncomeTaxToleranceLevels 16 ChapterIV-Computer Introduction 19 AssistedMassAppraisal System GeneralControls 21 ConclusionsOverGeneralControls 21 FireDetectionControls 21 Pagei TableofContents Off-siteStorageofBackupData 22 OperatingSystemSoftwareControls 23 ApplicationControls 24 ConclusionsOverApplicationControls 24 ElectronicAccessControls 25 PasswordSecurityShouldbeImproved 25 ElectronicAccessShouldAgreewithEmployee JobDuties 26 ChangestoEmployee-OwnedPropertyAgainst DepartmentPolicy 27 InternalAuditFollow-upProceduresShouldbe Established 30 ChapterV-Department- Introduction 33 wideIssues ElectronicAccessIssues-RCS,DARandET 33 DisasterRecoveryPlansShouldbeCompleted 34 InternalEvaluationsofSecurity 36 Summary 37 AgencyResponse DepartmentofRevenue 41 Pageii ListofTables Table1 ChangestoEmployee-OwnedProperty 29 Pageiii TableofContents Off-siteStorageofBackupData 22 OperatingSystemSoftwareControls 23 ApplicationControls 24 ConclusionsOverApplicationControls 24 ElectronicAccessControls 25 PasswordSecurityShouldbeImproved 25 ElectronicAccessShouldAgreewithEmployee JobDuties 26 ChangestoEmployee-OwnedPropertyAgainst DepartmentPolicy 27 InternalAuditFollow-upProceduresShouldbe Established 30 ChapterV-Department- Introduction 33 wideIssues ElectronicAccessIssues-RCS,DARandET 33 DisasterRecoveryPlansShouldbeCompleted 34 InternalEvaluationsofSecurity 36 Summary 37 AgencyResponse DepartmentofRevenue 41 Pageii