The Examination Of Information Technology Controls At The Sex Offender Registry Board

This is a Massachusetts State Auditor review of technology controls at the Sex Offender Registry Board, plus a check on whether older audit problems had been fixed.

“Our current audit was limited to a review of certain IT general controls over and within the SORB’s IT environment and a follow-up review to determine whether corrective actions had been taken to address the audit results and recommendations in our prior audit report, No. 2006-1408-3S.”

The audit checked whether SORB’s technology rules, safeguards, and procedures were strong enough to support its work.

“Our primary audit objective was to determine whether SORB’s IT-related internal control environment and documented policies and procedures provided reasonable assurance that control objectives would be achieved to support their business functions.”

SORB’s systems support public safety information about sex offenders, so weak technology planning could affect important services.

“These functions serve to provide the public with information to raise the level of safety in the community.”

For residents, the practical issue is whether the systems that help track and release sex offender information are reliable, secure, and available when needed.

“The SORB’s classification of a sex offender determines if and how information pertaining to an offender may be released to the public.”

Most reviewed controls were adequate, and prior audit issues were resolved, but SORB still needed a stronger tested plan for continuing operations during a serious IT outage.

“Although the SORB had developed certain controls regarding business continuity planning, we found that it needed to strengthen controls to provide reasonable assurance that normal business operations could be resumed in a timely manner should automated resources be unavailable for an extended period.”

SORB said it would work with state technology and public safety officials to improve disaster recovery and business continuity planning.

“The SORB will continue to work with the SCIO and OTIS to address these findings and establish agency processes and protocols that provide clear direction for staff to ensure the integrity of essential services and resources is maintained.”

The main risk was not day-to-day security, but whether SORB could recover fast enough if key systems went down for a long time.

“Depending on the nature and extent of a loss of IT systems or processing, the SORB could experience difficulties in regaining mission-critical and essential business processes within an acceptable period of time given the absence of a sufficiently comprehensive recovery and business continuity plan specific to the SORB.”

“Business continuity planning” means having practical plans so essential work can continue or restart after a disaster, outage, or loss of computer systems.

“The objective of business continuity planning is to help ensure the continuation of mission-critical and essential functions enabled by technology should a disaster cause significant disruption or loss of computer or network operations.”