TOPIC: Auditor Participation in Application Development OFFICE: Auditor STATE: MI DATE: 07/01/2014 QUESTION / ISSUE: The State of Michigan has contracted for the development of a new Enterprise Resource Planning system for accounting, purchasing, and other financial management activities. The Michigan Office of the Auditor General is considering conducting a preliminary review of project management and system development processes while the system is under development. If your office has conducted a review during the application development process, we would appreciate your feedback on the following questions: 1. What was your role in the application development process? 2. What was the scope of your review? 3. What type of procedures did you conduct? 4. Did you make recommendations to project management? 5. In what format did you communicate the results of your work? State Comments Delawar e I’ve been through a state ERP implementation twice in my career. Once in Pennsylvania (SAP) and once in Delaware (PeopleSoft). I would be happy to do a phone discussion with you guys if you want. I need to put my DE experience in context since I came to DE after much of the planning was done by the state. Further, when I first got here I was the only IT auditor. Hopefully you have some CISA’s on staff that have IT auditing experience. Georgia The Georgia Department of Audits and Accounts has conducted a limited review of Georgia’s current MMIS contract. This review was conducted in 2009 at the request of our lieutenant governor and was limited to the financial and performance review questions he posed. Attached is a copy of the questions posed by our lieutenant governor and a copy of the special review we performed to answer his questions. Our answers to your questions are as follows: 1. We did not play a role in the application development process for the MMIS contract. 2. The scope of our review was limited to providing a response to the lieutenant governor's specific questions as noted in the attachment. 3. We conducted financial and performance related procedures designed to specifically address the lieutenant governor’s questions. 4. No. 5. We communicated the results via a letter to the lieutenant governor. Auditor Participation in Application Development 1
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
TOPIC: Auditor Participation in Application DevelopmentOFFICE: Auditor STATE: MI DATE: 07/01/2014QUESTION / ISSUE: The State of Michigan has contracted for the development of a new Enterprise Resource Planning system for accounting, purchasing, and other financial management activities. The Michigan Office of the Auditor General is considering conducting a preliminary review of project management and system development processes while the system is under development. If your office has conducted a review during the application development process, we would appreciate your feedback on the following questions:
1. What was your role in the application development process?2. What was the scope of your review?3. What type of procedures did you conduct? 4. Did you make recommendations to project management?5. In what format did you communicate the results of your work?
State CommentsDelaware I’ve been through a state ERP implementation twice in my career. Once in Pennsylvania
(SAP) and once in Delaware (PeopleSoft). I would be happy to do a phone discussion with you guys if you want. I need to put my DE experience in context since I came to DE after much of the planning was done by the state. Further, when I first got here I was the only IT auditor. Hopefully you have some CISA’s on staff that have IT auditing experience.
Georgia The Georgia Department of Audits and Accounts has conducted a limited review of Georgia’s current MMIS contract. This review was conducted in 2009 at the request of our lieutenant governor and was limited to the financial and performance review questions he posed. Attached is a copy of the questions posed by our lieutenant governor and a copy of the special review we performed to answer his questions. Our answers to your questions are as follows:
1. We did not play a role in the application development process for the MMIS contract. 2. The scope of our review was limited to providing a response to the lieutenant
governor's specific questions as noted in the attachment. 3. We conducted financial and performance related procedures designed to specifically
address the lieutenant governor’s questions.4. No. 5. We communicated the results via a letter to the lieutenant governor.
Missouri When the statewide accounting system for Missouri was redesigned early in the previous decade, the state auditor's office (SAO) did not conduct a review of project management and system development but instead performed a type of quality control function. We considered this work necessary in order to gain an understanding of transaction processing in the system (how it would be able to accumulate and process data to be used by our auditors) and to learn controls in the system. We did review policy and procedure documents and provide general comments either inserted in the documents or sent by e-mail. We did not formally comment, such as in a report, to project management. We also tested certain controls, such as user security, in the test environment. Again, this work was not done for the purpose of commenting to management but to understand how user actions could be controlled and segregation of duties applied. This process allowed the SAO to have a thorough understanding of the system before the go-live date and, therefore, facilitated training our auditors.
Auditor Participation in Application Development 1
Related Documents
