Audit of the Merit Rating Board

This is a state performance audit of the Merit Rating Board, covering selected information technology operations from July 1, 2014 through June 30, 2016.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor (OSA) has conducted an audit to review and evaluate controls over selected information technology (IT) operations and activities of the Merit Rating Board (MRB) for the period July 1, 2014 through June 30, 2016.”

Auditors reviewed whether MRB had proper controls over important IT areas, including who can access systems, how changes are managed, how personal information is handled, and how operations would continue after a disruption.

“In this performance audit, we reviewed certain IT controls over MRB mission-critical applications related to logical access security; change management (monitoring, documenting, and approving modifications to an agency’s IT system); personally identifiable information (PII); and business continuity planning and disaster recovery (DR).”

MRB handles driving-record information used by insurers and public agencies, so weak controls could put personal data and key government services at risk.

“Its primary mission is to maintain and update driving records and report driving record information to Massachusetts auto insurers and other transportation and public-safety government agencies.”

For an ordinary Massachusetts driver, this matters because MRB systems include sensitive information like names, addresses, license numbers, birth dates, and driving records.

“This increases the risk of terminated employees improperly accessing and/or altering personal information in ALARS such as names, addresses, driver’s license numbers, dates of birth, and driving records.”

The main problem was not one single failure, but a pattern of missing or incomplete safeguards: access was not always removed promptly, personal data controls were incomplete, and continuity and recovery plans were not properly documented or tested.

“MRB lacked proper procedures for dealing with incidents that might compromise its ability to recover from disruptions to its operations or destruction of data that are vital to serving the citizens of the Commonwealth.”

The auditor recommended that MRB work with MassDOT to tighten access reviews, classify and inventory data, train new employees before system access, create a business continuity plan, test disaster recovery, and maintain offsite backups.

“MRB should work with MassDOT IT to develop, document, and implement a BCP that includes MRB operations.”

The audit is significant because the Auditor found weaknesses that could affect the confidentiality, accuracy, and availability of MRB information and systems.

“This increases the risk that the confidentiality, integrity, and availability of MRB information will be compromised.”

ALARS is the key computer system that stores and manages license, registration, driving-record, accident, citation, insurance-claim, and related information.

“According to the RMV’s Uninsured Motorist System User Manual, ALARS consists of multiple components, including licensing, registration, titles, suspensions, accident records, inspection maintenance, non-renewals, policies, and MRB information.”