Northern Essex Community College

This is a Massachusetts State Auditor review of Northern Essex Community College’s information technology controls during the period from July 1, 2009 through May 31, 2011.

“In accordance with Chapter 11, Section 12, of the General Laws, we performed an IT general controls examination at NECC for the period July 1, 2009 through May 31, 2011.”

The Auditor examined whether the college’s IT policies, procedures, staff roles, security, equipment tracking, contracts, and recovery planning were strong enough to support the college’s work and protect its systems and data.

“The primary audit objective was to determine whether NECC’s IT-related internal control environment—including policies, procedures, practices, and organizational structure—provided reasonable assurance that control objectives would be achieved to support NECC’s business functions.”

The issues matter because weak IT controls can make it harder to prevent, detect, or fix problems that affect college systems, records, equipment, and operations.

“As a result, the current ICP does not provide adequate guidance to ensure that appropriate information technology (IT) controls are implemented and exercised so that operational objectives are met; risks are prevented or detected and corrected in a timely manner; and the integrity, security, and availability of its systems and records and effectively protected.”

For students, staff, taxpayers, and the public, the practical concern is whether college technology, records, and equipment are protected and whether the school can keep functioning after a major disruption.

“Business continuity planning helps ensure the timely recovery and continuation of mission-critical functions should a disaster cause significant disruption to computer operations.”

The Auditor found three areas needing improvement: the internal control plan, inventory controls over computer equipment, and disaster recovery and business continuity planning.

“Our audit determined that NECC did not have a comprehensive disaster recovery plan (DRP) and business continuity plan (BCP) to provide for the timely restoration of mission-critical and essential business functions should IT systems be rendered inoperable or inaccessible.”

The college said it would update its internal control plan, improve equipment inventory procedures, and create disaster recovery and business continuity plans, with target dates in 2011 and 2012.

“These plans will be properly vetted and receive Cabinet approval by June 2012.”

The report is significant because the college served thousands of students and relied on major computer systems for financial, administrative, student, human resources, and financial aid work.

“SunGard’s Banner application is used to process NECC’s financial management, administrative, and student information.”

An Internal Control Plan is the college’s written roadmap for managing risks and making sure policies, procedures, and safeguards are actually in place and followed.

“NECC’s Internal Control Officer should work with NECC’s various departments to identify and document operational and control objectives and risks and identify existing control policies, procedures, and management control practices.”