IT-Related Controls at the University of Massachusetts Amherst

This is a 2012 Massachusetts State Auditor report on information technology controls at UMass Amherst for July 1, 2009 through May 31, 2011.

“In accordance with Chapter 11, Section 12, of the Massachusetts General Laws, the Office of the State Auditor performed an information technology (IT) audit at UMA that covered the period July 1, 2009 through May 31, 2011.”

The auditor reviewed how UMass Amherst governed its IT, protected its critical SPIRE system, and handled related physical, environmental, security, and continuity controls.

“The audit scope included an examination of the IT governance at UMA and an evaluation of internal and general controls over the mission-critical SPIRE application system, including physical and environmental controls that directly affect UMA’s computing operations (excluding human resources and financial applications, which are hosted and operated by the UMass President’s Office in Shrewsbury).”

Weak IT oversight can lead to bad decisions, wasted money, failed systems, poor performance tracking, and legal or regulatory problems.

“Weak IT governance can result in IT strategic and tactical plans not aligning with UMA’s business requirements and business plans and can also lead to poor management decisions; inadequate cost determinations; uncontrolled expenditures; failed or subpar systems; lack of performance measurement; and noncompliance with laws, regulations, or contractual obligations.”

If you are a student, employee, applicant, or otherwise connected to the campus, SPIRE holds and supports important personal, academic, billing, registration, and campus-service information.

“SPIRE supports numerous administrative functions, including student course registration, academic records, advising, admissions, financial aid, student billing, admissions prospect communications, and federal reporting on foreign students and scholars.”

The main problem was not that everything was broken; it was that campus-wide IT management, planning, and recovery processes needed to be more formal, coordinated, and documented.

“However, as reported in the Audit Results section of this report, as of May 31, 2011, UMA needed to make improvements in the areas of IT governance, IT strategic planning, and business continuity and disaster recovery planning.”

The report recommended stronger IT governance, a formal IT strategic planning process, and detailed disaster recovery and business continuity plans, with testing and clear responsibilities.

“UMA should strengthen its disaster recovery and business continuity planning process by:”

“IT governance” means the way leaders make, monitor, and enforce decisions about technology so it supports the university’s goals and manages risk.

“IT governance is how management formally decides to employ IT in supervising, monitoring, and directing an organization and is vital to overall enterprise governance.”