Office of the Legislative Auditor - Financial Audit Division

The Minnesota Teachers Retirement Association (TRA) did not have adequate security controls to protect the integrity and confidentiality of its computer systems and data.

This report contains eight findings relating to internal control weaknesses.

• TRA did not have a comprehensive security management program.

• TRA did not adequately filter network traffic to protect its computers and data.

• TRA did not enforce strong account and password controls.

• TRA did not adequately restrict access to some computer systems and data.

• TRA had not developed a continuity of operations plan.

We assessed the TRA’s security controls as of May 2007.

Background:

The Minnesota Teachers Retirement Association administers retirement benefits for Minnesota public school educators.  Educators and their employers contribute to TRA during their working years and obtain benefits upon retirement, disability, or termination of employment.

TRA’s members include teachers and administrators employed in Minnesota’s public elementary and secondary schools, charter schools, the Minnesota State Colleges and Universities system, and all other state educational institutions, with the exception of teachers employed by the cities of Saint Paul and Duluth and the University of Minnesota.  As of June 30, 2006, over 550 employers, 79,000 active members, and 44,000 retirees and beneficiaries participated in the retirement plan, which had $17.8 billion in net assets.  Fiscal year 2006 retirement contributions and payments to beneficiaries were $356 million and $1.2 billion, respectively.