Summary: what we found in our audits
Systems
The Ministry should improve its general computer controls—see page 143.
Performance reporting
Our auditor’s reports for the Ministry and Department are unqualified—see page 144.
We found one exception when we completed specified auditing procedures on the Ministry’s performance measures—see page 144.
Other entities that report to the Minister
• Performance reporting
The financial statements of all Persons with Developmental Disabilities Boards (provincial and community) have unqualified auditor’s reports—see page 144.
Overview of the Ministry
The Ministry consists of the Department and the six Persons with Developmental Disabilities Community Boards (the Community Boards). Effective July 1, 2006, the Province of Alberta dissolved the Provincial Board and transferred its functions to the Ministry.
The Ministry is responsible for:
• providing services, programs and planning for seniors and the aging population
• providing supports, services and planning for persons with disabilities
Ministry received
$171 million The Ministry received $171 million in 2006–2007, $161 million of which came from transfers from the Government of Canada.
Volume 2—Audits and recommendations Seniors and Community Supports
In 2006–2007, the Ministry spent $1.6 billion, primarily as follows:
Ministry spent
$1.6 billion
(millions of dollars)
Senior services $ 355
Support for persons with disabilities 541
Community supports 506
For more information on the Ministry, visit its website at www.seniors.gov.ab.ca.
Scope: what we did in our audits
1. Performance reporting
We audited the financial statements of the Ministry and Department for the year ended March 31, 2007.
We completed specified auditing procedures on the performance measures in the Ministry’s 2006–2007 annual report.
2. Other entities that report to the Minister We audited the financial statements of the:
• Persons with Developmental Disabilities Provincial Board (April 1 to June 30, 2006.
• Persons with Developmental Disabilities Northwest Region Community Board
• Persons with Developmental Disabilities Northeast Region Community Board
• Persons with Developmental Disabilities Edmonton Region Community Board
• Persons with Developmental Disabilities Central Region Community Board
• Persons with Developmental Disabilities Calgary Region Community Board
• Persons with Developmental Disabilities South Region Community Board
Volume 2—Audits and recommendations Seniors and Community Supports
Our audit findings and recommendations
1. Systems
1.1 General computer controls Recommendation
We recommend that the Ministry of Seniors and Community Supports improve general computer controls by:
• identifying and protecting data based on its sensitivity,
• following change management procedures,
• reviewing database logs, and
• reviewing user access to applications.
Background
Our financial statement audit work included an examination of the Ministry’s general computer controls. Our audit focused on the network, facilities, hardware and software that are specific to the Ministry. Common government applications such as IMAGIS, EPS and ExClaim, the government network, and other shared services are included in the audit of Service Alberta.
84 control activities examined
We evaluated 84 general control activities for the Ministry. For each control activity, we assessed whether the control was effective or ineffective. To be assessed as effective, a control activity should be designed to mitigate an identified risk and have operated effectively throughout the year.
Criteria: the standards we used for our audit
The Ministry should have appropriate controls over its computer processing environment to ensure the security, integrity and availability of financial information being reported.
Our audit findings 17 controls
ineffective Of the 84 general control activities that we examined, we assessed 17 as ineffective. These control activities range from general security practices to establishing policies and procedures to manage IT risks faced by the Ministry.
Four of the ineffective controls relate to disaster recovery planning and another seven ineffective controls are the responsibility of Service Alberta as outlined in the shared services agreement.
The following control weaknesses and deviations were identified:
• Ministry data is not classified by sensitivity, however a security policy is being developed that will resolve this issue.
Weaknesses in security, access and change management
controls • The Ministry does not have a process to review users’ access to applications.
• Database and network logs are generated but are not being reviewed.
Volume 2—Audits and recommendations Seniors and Community Supports
• A change management process exists but is not followed consistently.
• A process for testing backup tapes does not exist.
Implications and risks if recommendation not implemented
Without appropriate IT controls that are documented and followed, the Ministry may not be able to rely on its data, applications, and systems to provide complete, accurate, and valid information that is appropriately safeguarded. Poor controls over computer systems can result in unauthorized individuals gaining access to confidential information and exploiting it for identity theft or other fraudulent activity.
2. Performance reporting 2.1 Financial statements
Unqualified
opinions Our auditor’s reports on the financial statements of the Ministry and Department are unqualified.
2.2 Performance measures
We found one exception when we completed specified auditing procedures on the Ministry’s performance measures. Data was not reported for the new measure titled, Eligibility Decision Time in Working Days for AISH
Applications. As a result, we were unable to complete our specified auditing procedures for this measure.
3. Other entities that report to the Minister 3.1 Financial statements
Unqualified
opinion The financial statements for the Persons with Developmental Disabilities Provincial Board and the six Community Boards received unqualified auditor’s reports.
Non-compliance
with legislation Our auditor’s report on the financial statements of the Calgary Region Community Board has an information paragraph reporting that expenses include payments by the Community Board for services to individuals whose disability did not meet the legal definition of a developmental disability. The Community Board provided services to individuals—and funding to
organizations—that fall outside of the parameters set by the Persons with Developmental Disabilities Community Governance Act.
Volume 2—Audits and recommendations Service Alberta