Lynn Housing Authority and Neighborhood Development

This is a Massachusetts State Auditor report on selected information technology controls at the Lynn Housing Authority and Neighborhood Development.

“In accordance with Chapter 11, Section 12, of the General Laws, we performed an audit of selected IT-related controls at LHAND for the period January 1, 2007 through December 31, 2010.”

Auditors checked whether LHAND’s computer policies, access controls, backup planning, and protection of personal information were strong enough to support its housing work.

“Our primary audit objective was to determine whether LHAND’s IT-related internal control environment and documented IT policies and procedures provided reasonable assurance that control objectives would be achieved to support LHAND’s business functions; adequate controls were in place to provide reasonable assurance that IT resources are safeguarded, properly accounted for, and available when required; adequate physical security controls were in place to restrict access to IT resources to only authorized; sufficient environmental protection controls were in place; adequate controls were in place to provide reasonable assurance that only authorized users were granted access to network resources, including the Visual HOMES/AccountMate application system and other business-related applications; and procedures were in place to prevent and detect unauthorized access to automated systems.”

LHAND handles housing programs and data for low- and moderate-income residents, so weak technology controls could affect services, records, and confidential information.

“LHAND’s primary mission is to assist low- and moderate-income families and individuals with safe, decent, adequate, and affordable housing.”

If you rely on LHAND or care about public housing services in Lynn, the report points to risks that could slow services after a technology failure or expose sensitive data if access controls are weak.

“As a result of its inadequate password administration policies, procedures, and control practices, LHAND cannot ensure that mission-critical systems and confidential data are safeguarded from access by unauthorized persons.”

LHAND had made progress since the earlier audit, especially on inventory records, but the Auditor still found gaps that needed fixing.

“Our follow-up review revealed that although LHAND had taken steps to address these issues, improvements were still necessary, as discussed below.”

The report recommends that LHAND finish and test disaster recovery plans, strengthen password policies, train employees, monitor compliance, and better document annual inventory checks.

“LHAND should take steps to ensure that adequate disaster recovery and business continuity plans are in place and tested to provide adequate assurance of their viability.”

This report is significant because LHAND manages public housing, rental vouchers, and systems tied to housing and financial operations, so basic IT weaknesses could affect important public services.

“At the time of our audit, LHAND administered 2,590 rental assistance vouchers through its rental assistance program.”

“Disaster recovery and business continuity” means having a tested plan to keep essential work going or restore it quickly if computer systems fail.

“The objective of business continuity planning is to help ensure the continuation of mission-critical and essential functions enabled by technology should a disaster cause significant disruption or loss of computer or network operations.”