A performance audit into the effectiveness of controls over computer systems used by ACT Government Agencies to ensure the accuracy and reliability of information included in their financial statements, has found the controls could be improved.
In his report, 2018-19 Financial Audits – Computer Information Systems Auditor-General, Michael Harris says that despite the shortcomings Agencies had made improvements in the general control environment over their computer information systems in the past few years.
“The controls over computer information systems used by agencies to prepare their financial statements were assessed as satisfactory,” Mr Harris said.
“Notwithstanding this, there are control weaknesses that Agencies need to address to further reduce the risk of errors and fraud in financial information,” he said.
“Progress has been made by Agencies to address long outstanding previously reported audit findings on their controls in recent years.”
Mr Harris said weakness in controls could lead to unauthorised access to sensitive information; cyber security attacks; loss of data; and the inability to promptly recover systems in the event of a major disruption or disaster.
“Agencies need to give a higher priority to promptly resolving identified weaknesses in these controls in the future to ensure that their computer information systems and data are not exposed to unnecessary risks for prolonged periods of time,” he said.
The Auditor–General made 12 recommendations for the Agencies to improve their controls over computer information systems, including managing inactive and generic user accounts that still had access to the ACT Government network; reconciliation of system changes; monitoring of audit logs; and the segregation of duties.
The Auditor-General’s 48-page report can be accessed at this PS News link.
