Information Technology Management: Defense Information Systems Agency Controls of the Center for Computing Services Placed in Operation and Tests of Operating Effectiveness for the Period December 1, 2005, through July 31, 2006

摘要

This report is intended for the use of Defense Information Systems Agency (DISA) management, its user organizations, and the independent auditors of its user organizations. The DoD Office of Inspector General is implementing a long-range strategy to conduct audits of DoD financial statements. The Chief Financial Officers Act of 1990, as amended, mandates that agencies prepare and conduct audits of financial statements. The reliability of information processed at the DISA sites directly impacts the ability of DoD to produce reliable, and ultimately auditable, financial statements, which is key to achieving the goals of the Chief Financial Officers Act. This report focuses on the DISA Center for Computing Services (CS). CS provides computer processing for the entire range of combat support functions; including transportation, logistics, maintenance, munitions, engineering, acquisition, finance, medicine, and military personnel readiness. CS offers computing services on both CS- and customer-owned platforms including computer operations, data storage, systems administration, security management, capacity management, system engineering, web and portal hosting, architectural development, and performance monitoring. This examination assessed controls defined by DISA over the CS environment. The report provides an opinion on the fairness of presentation by DISA of its description of controls, the suitability of the design of controls, and the operating effectiveness of key controls that are relevant to audits of a user organization's financial statements. As a result, this examination may preclude the need for additional audits of general controls such as those that were previously performed by user organizations to plan or conduct financial statement and performance audits. This examination will also provide a separate audit report with recommendations to management for correction of identified internal control deficiencies.