Legislative auditors find IT and asset-management gaps at Office of the State Auditor; state auditor outlines remediation plan

The Office of the Legislative Auditor (OLA) told the House State Government Finance Policy Committee on Feb. 20 that a performance audit of the Office of the State Auditor (OSA) found generally sound financial controls but multiple IT security and asset-management weaknesses that need remediation.

The OLA’s deputy legislative auditor for the financial audit division, Lori Lyson, and IT audit director Mark Matheson presented the audit, saying the financial controls “generally had really, strong internal controls and followed legal criteria,” while the information-technology review identified seven IT-related findings and two asset-management findings that require action.

The nut graf: The OSA conducts audits of other state and local entities and holds sensitive statewide data, including materials tied to the single audit process. Auditors told the committee that the office’s role and the sensitivity of some datasets make strengthening IT and asset controls important even though the OSA is a relatively small operation and not required to participate in the statewide Minnesota IT Services program.

Most significant findings

- Financial controls: The OLA reported that OSA generally complied with significant financial requirements. The audit noted two asset-management weaknesses: six of 70 acquisitions tested during the scope period lacked assigned asset numbers and were not recorded in the OSA’s capital asset system; and the office had not completed a full physical inventory during the audit period. The auditors said the most recent partially completed physical inventory dated…