Office of the Legislative Auditor - Financial Audit Division

The Department of Finance generally had adequate controls to protect the integrity and confidentiality of its data in the information warehouse.  However, the department had some security weaknesses.

• The department had few written policies, standards, and procedures for securing the information warehouse.
• The department did not always enforce strong password controls.
• The department did not develop comprehensive security monitoring procedures.

We assessed the department’s controls to protect the integrity and confidentiality of its information warehouse data as of August 2007.

Background:

The Department of Finance manages the state’s information warehouse.  The warehouse is a very large data repository containing over one billion rows of current and historical accounting, procurement, payroll, and personnel data.  State agencies use this data to monitor their operations, perform financial analysis, and compile data for internal and external reports.  In addition, the Department of Finance uses the warehouse to help prepare the state’s Comprehensive Annual Financial Report.  The warehouse has over 2,000 users.