Office of the Jury Commissioner
November 20, 2012 · Read the full official report (PDF) ↗
Read the plain-English breakdown
This is a follow-up audit of the Massachusetts Office of the Jury Commissioner, covering July 1, 2010 through June 30, 2011.
“In accordance with Chapter 11, Section 12, of the Massachusetts General Laws, we performed a follow-up audit of prior audit results at the Office of the Jury Commissioner (OJC) for the period July 1, 2010 through June 30, 2011.”
Auditors checked whether the office had fixed earlier problems and reviewed controls over jury lists, data, consultants, and certain computer security areas.
“Our audit objectives were to (1) assess the adequacy of the OJC’s internal controls over the development of the Master Juror List, statistical data analysis, and selection and use of consultants for implementation of the jury management system and (2) follow up on the status of recommendations from our previous audit report (No. 2007-1216-3O), which covered the period July 1, 2005 through October 31, 2007).”
The office helps run the jury system for Massachusetts courts, including selecting, managing, and summoning jurors.
“The OJC is the judicial branch agency responsible for the random selection of potential jurors and the management and summonsing of all trial and grand jurors in the Commonwealth.”
If you are called for jury duty, this office’s systems affect notices, postponements, disqualifications, and other jury-service tasks.
“This website allows prospective jurors to confirm or postpone their service, request a hardship transfer or disqualification, complete a demographic survey, update their contact information, and complete and print confidential juror questionnaires.”
The office improved some past problem areas, but the Auditor still wanted stronger contractor oversight and better computer access controls.
“The OJC’s computer security controls need improvement.”
The Auditor recommended that court oversight officials and the Jury Commissioner’s office make an action plan, define needed services, and consider doing more work in-house or improving contract management.
“Specifically, the SJC, which has oversight of the OJC, and the AOTC, which provides funding for this project, should meet with OJC officials to develop an action plan on how to proceed.”
The concern was not just paperwork: weak account controls could leave jury-system information exposed to people who should no longer have access.
“The failure to deactivate user accounts in a timely manner may place the OJC at risk of unauthorized access or use of established privileges.”
A “time and materials” contract means the contractor is paid for hours and materials used, not for finishing clearly defined project milestones.
“A “time and materials” contract provides for payment based on payroll cost and materials used, whereas a “project” contract provides for payment based on the completion of certain tasks and established milestones.”
4 figure(s) pending source verification - not shown
What the Auditor checked
- Partially Assess the adequacy of the OJC’s internal controls over the development of the Master Juror List, statistical data analysis, and selection and use of consultants for implementation of the jury management system.
- Partially Follow up on the status of recommendations from the previous audit report.
What the Auditor found
Why it matters: The OJC could not ensure it received the best value, could not clearly support payments, and risked continued dependence on the contractor.
Standard: Operational Services Division guidance for statements of work, supporting documentation, competitive proposals, time-and-materials contracts, and transfer of intellectual property.
3 recommendations
- The SJC, AOTC, and OJC should meet to develop an action plan on how to proceed with the software contractor issue.agency: already implemented
- The OJC should determine what services it needs and what level of skills are necessary to perform the work.agency: already implemented
- If the OJC continues using a consultant, it should comply with OSD guidance, define services and plans, support billings, solicit competitive bids or proposals, and ensure transfer of intellectual property to the Commonwealth.agency: already implemented
Agency response & Auditor reply
Agency: "We are pleased to report that since the conclusion of the audit, the Chief Justice for the Trial Court and the Court Administrator have approved the OJC’s critical needs request to hire an IT specialist to assume these responsibilities."
Why it matters: Inactive accounts increased the risk of unauthorized access or disclosure of information in the NextGen application.
Standard: Sound access security practices and internal security policies.
1 recommendation
- The OJC should work with AOTC to ensure access privileges are terminated or modified when employment or job responsibilities change.agency: already implemented
Agency response & Auditor reply
Agency: "Shortly after the conclusion of the audit, the OJC established a procedure with AOTC Human Resources to notify the OJC on a monthly basis of all persons separating from Trial Court employment."
Why it matters: Weak password administration increased the risk of unauthorized access to sensitive data in mission-critical applications.
Standard: The Commonwealth’s Information Technology Division recommends password lengths of at least eight alphanumeric characters. ( Commonwealth’s Information Technology Division password recommendation )
2 recommendations
- AOTC should strengthen IT security policies and procedures for password administration, audit trails, monitoring, and unauthorized access procedures.agency: already implemented
- The OJC should consult with JSI about whether password configuration and unauthorized access procedure changes can be made to the NextGen application.agency: already implemented
Agency response & Auditor reply
Agency: "We are pleased to report that since the conclusion of the audit in September 2011, JSI has notified OJC and its other clients that it has developed password functionality that meets the OSA’s concerns with regard to length and composition of passwords, frequency of password changes, and the like."
Prior findings revisited
"The OJC resolved our prior audit finding where we recommended that it consider using multiple information sources (e.g., Registry of Motor Vehicles or Department of Revenue data) to compile its annual Master Jury List to increase the number of available jurors."
"The OJC resolved our prior report’s finding regarding improvements needed in juror utilization."
"The OJC resolved our prior report’s finding regarding necessary internal control improvements by developing and documenting a comprehensive Internal Control Plan that supports its policies, procedures, and business objectives and provides sufficient detail to address the risks internal control requirements specific to all OJC operations."