# Presentation: 505057

## INTERNATIONAL CONSORTIUM ON GOVERNMENTAL FINANCIAL MANAGEMENT

Information, Technology, Accountability

MARCH 22, 1999
Presented by Deputy Inspector General

**Information, Technology, Accountability**
**MARCH 22, 1999**
**Presented by Deputy Inspector General**

**Notes:**
1.  Welcome remarks.

2. Introduce self.

3. Purpose of presentation
- what USAID is and does
- what the OIG is and does
- how OIG audits computerized information

## 	       Conducting Audits and 

***Office of ***
***Inspector General***

**	****       ****Conducting Audits and **
**	****       ****Investigations in a **
**	****       ****Computer Environment?**

## USAID Is:

U.S. Government’s Principal Foreign Assistance Management Agency
94 Countries
2,200 Employees
$7 Billion (1999)

**U.S. Government’s Principal Foreign Assistance Management Agency**
**94 Countries**
**2,200 Employees**
**$7 Billion (1999)**

**Notes:**
1. Other U.S. agencies have role in foreign assistance (Agriculture, Treasury, Commerce.

2. Under general authority of U.S. State Department

3. Approx. 45 countries have full scale missions.  Many others have small missions, or no missions at all.

4. 2,169 Direct Hire = 1,048 Foreign Service + 1,121 Civil Service.  1,343 non-direct hire technical staff, split between field and Washington.  Total number of PSCs (including FSNs), unknown.

5. Organization size shrinking.  Since 1992, the Agency’s USDH workforce has declined 29.5 percent (not including OIG).  The total workforce (USDH and non-USDH) declined 33 percent over the same period.  Cost of doing business overseas excluding OIG took a larger cut in personnel (35 percent overseas vs. 27 percent in Washington).

6.  Program funding  fairly steady.

## USAID’s Mission:

- “**Contribute to U.S. national interests through the results it**
**  ****delivers by supporting the people of developing and**
**  ****transitional countries in their efforts to achieve enduring**
**  ****economic and social progress and to participate more fully**
**  ****in resolving the problems of their countries and the world**.”

**Notes:**
1. Definitions of developing and transitional based on World Bank criteria.  See World Bank World Development Reports.

2. Organization sees itself as providing assistance and advice, not all answers to development problems. Those must be answered by the  people of these countries.

3. USAID typically works in countries:
-committed to achieving sustainable development;
-committed to shedding economically repressive and ruinous totalitarian regimes;
-emerging from post-conflict situations;
-victimized by natural disasters.

## USAID’s Objectives:
Economic Growth & Agricultural Development
Democracy
Education & Training
Population & Health
Environment
Disaster Assistance

**Economic Growth & Agricultural Development**
**Democracy**
**Education & Training**
**Population & Health**
**Environment**
**Disaster Assistance**

**Notes:**
1. Economic growth:  private market expansion; food security; greater access to economic opportunity for the rural and urban poor.

2. Democracy:  rule of law; human rights; competitive political processes; civil society; government transparency.

3. Education:  access to quality basic education, esp. for females; contribution institutions of higher ed. make to sustainable development increased.

4. Population & Health:  unintended pregnancies reduced; child health nutrition improved; impact of HIV & other infectious diseases reduced.

5. Global climate change threat reduced; biological diversity conserved; pollution management; environmentally sound energy encouraged; natural resource management.

6. Crisis impact reduced; urgent crisis needs met; personal security & human rights reestablished.

## USAID’s Methods of Operation 
Grants
Contracts 
Delivers thru:
		- Recipient Governments
		- Private Voluntary Organizations
		- Non-governmental Organizations

**Grants**
**Contracts **
**Delivers thru:**
**	****	****- Recipient Governments**
**	****	****- Private Voluntary Organizations**
**	****	****- Non-governmental Organizations**
**	****	**

**Notes:**
1. Grant:  “A legal instrument used where the principal purpose is the transfer of money, property, services or anything of value to the recipient in order to accomplish a public purpose of support or stimulation authorized by Federal statute and where substantial involvement by USAID is not anticipated.” (ADS)

2. Contract:  “A mutually binding legal instrument where the principal purpose is the acquisition, by purchase, lease, or barter, of property or services for the direct benefit or use of the Federal Government, or in the case of a host country contract, the host government agency that is a principal signatory party to the instrument.” (ADS) 

3. USAID moving away from grants to recipient government agencies, toward funding through grants/contracts to private organizations.

## USAID’s Office of Inspector General (OIG) 

Auditors -126
Investigators - 30
Overseas Offices - 6

**Auditors -126**
**Investigators - 30**
**Overseas Offices - 6**

**Notes:**
1.  Audit FTE:  126

2. Investigations FTE:  30

3. Overseas offices:
- Budapest, Cairo, Dakar, Manila, Pretoria, San Salvador
- Office size: 8 auditors, 0-1-2 investigators

## Office Locations

**Office Locations**

**Washington, D.C.**

**Dakar**

**Cairo**

**San Salvador**

**Pretoria**

**Budapest**

**Manila**

## OIG’S MISSION

**“****To promote and preserve USAID’s effectiveness, integrity and efficiency.”**

## USAID’s Accountable Resources 

**Annual Program Funding--$7 billion**
**Available Funds (pipeline)--$9.7 billion**
**Annual Operating Funds--$485 million**
**Annual OIG funds--$30 million**

**USAID’s Accountable Resources **

**Notes:**
Pipeline = unliquidated obligations for project + nonproject assistance

## Challenges to Accountability

**Many Missions, Projects, Locations, and Delivery Vehicles**
**Cultural Differences**
**Accounting and Legal Frameworks**
**Increasing Reliance on Computers**

## Computer Challenges

**Today Most Records Are in the Computer**
**Some Authorizations do not Leave Paper Trails**
**Soon, Electronic Signatures Will Eliminate **
**  ****Most Paper Records**

**Notes:**
We need to be able to audit computerized data to ensure that the business operates efficiently and effectively and to prevent and detect fraud, waste, and abuse. 
It is unusual today to find agency records maintained on paper.  Almost every federal business function has been computerized to the extent that accounting and financial records are generally maintained on computers. 
For example, about 2 million U.S.Government employees used credit cards 49 million times last year to accumulate $12 billion in purchases and travel expenses.  This represents a 60% increase in one year. 
Although paper documents are often available to support what's in the computer, that is not always the case today.  For example, it is common practice today to have managers authorize advances or payments directly on the computer without keeping a paper record.  
Today, we cannot rely on computers for most legally binding transactions--like signing a contract--because we cannot be sure who authorized the transaction.  Because computers are not secure, courts will usually not accept a computer record as legally binding.  However, people are working on a way to make sure that each computer action can be traced back to an individual.  This is called an electronic signature.  In a few years, when electronic signatures are commonly used, there will not be any paper trail of authorizing documents.  

## Computers Make us Vulnerable in New Ways

**Mistakes Can be Repeated Thousands of Times Each Day**
**Controls May Not be As Effective as Manual Processes**
**Data and Money Subject to Remote Theft or Destruction**
**Operations More Vulnerable to Disruption**

**Notes:**
Risks and vulnerabilities
--Paper is eliminated
--Human participation is limited or non-existent with routine transactions
--financial and intangible losses such as unauthorized disclosure of competitive or sensitive information.  In many instances, the intangible losses may be more critical to the continued operation of the business than financial losses.  For example, a bank relies on its ability to maintain confidentiality in its dealings with its customers.  Any compromise of customer information will inevitably result in a loss of customer confidence and hence, direct financial losses through reduction of business.
--violation of regulations
--loss or reputation
--loss of resources
--system downtime
--Theft, modification or destruction of sensitive information

## Weak Systems Effect the U.S. Government’s Ability to: 

**Safeguard Assets from Fraud and Abuse**
**Protect Sensitive Information from Disclosure**
**Reliably Account for Resources**
**Comply With Laws and Regulations**
**Prevent Disruption of Critical Operations**

**Notes:**
FY 1997 Financial Statement Audit Report identified financial management system deficiencies as a primary reason the U.S. Government could not prepare audited financial statements.  

September 1998 GAO report found inadequate protection of:
1. federal assets from fraud and misuse
2. sensitive information from inappropriate disclosure
3. critical operations, including some affecting public safety, from disruption.
Many problems had gone uncorrected for years.

## Many Threats Exist

**Many Threats Exist**
**Inside From Current Employees and Contractors**
**Outside from **
**Ex-employees**
**Outside Contractors**
**Hackers**
**Organized Crime**
**Terrorists and Espionage**

## Computer Security:  Audits Found Problems With:

**Entity-wide security program (17 of 17)**
**Access controls (23 out of 23)**
**Application software (14 out of 18)**
**Segregation of duties (16 out of 17)**
**System software (9 out of 9)**
**Service continuity (20 out of 20) **

**Notes:**
Recent GAO audits report a Federal agency-wide shortfall in addressing the area of information systems security.  These GAO audit reports cite information security inadequacies and material weaknesses within 24 agencies.  
Weaknesses were reported in 6 general control areas. (security program, access controls, application software, segregation of duties, system software, and service continuity).  General controls are the policies, procedures, and technical controls that apply to all or a large segment of an entity’s information systems and help ensure their proper operation.
Foremost among the audit findings is the lack of management-endorsed, agency-wide plans and strategies for assuring the security and integrity of all information vital to an agency’s operations.
The full extent of control problems is unknown because all six of the general control areas were reviewed at only 9 of the 24 agencies.
NOTE:  The first number is the number of agencies with the general control weakness.  The second number represents the number of agencies where the control area was reviewed. 

## Computers Vulnerable to Attacks

**Attackers have:**
**shut down systems and networks **
**corrupted sensitive data**
**destroyed, modified, and stolen money, data, and software**
**installed malicious code**

**Notes:**
Attackers have:
--shut down systems and networks, thereby denying services to users who depend on automated systems to help meet critical missions.
--corrupted sensitive data
-- destroyed, modified, and stolen money, data, and software
-- installed unwanted files and "back doors" which circumvent normal system protection.
The National Security Agency has acknowledged that potential adversaries are developing a body of knowledge about U.S. agencies and about methods to attack systems.  According to NSA officials, these methods, which include sophisticated computer viruses and automated attack routines, could allow adversaries to launch untraceable attacks from anywhere in the world.  In some extreme scenarios, studies show that terrorist or other adversaries could seize control of information systems and seriously degrade the nation's ability to deploy and sustain military forces.  Officials estimate that more than 120 countries already have or are developing such computer attack capabilities. 

## Computer Vulnerable to Attacks (Cont.)

**Carnegie-Mellon University reports that from 1991 through 1994**
** ****500% increase in computer intrusions**
** ****700% increase in the number of sites affected**

## Types of Malicious Code

**Virus**
**Trojan Horse**
**Worm**
**Logic Bomb**
**Trap Door**

**Notes:**
Malicious threats can be intentionally designed to unleash computer viruses, trigger future attacks, or install software programs that compromise or damage information and systems. 
Virus is a program that is able to corrupt data, replicate itself, and infect other systems. Viruses can do anything from displaying a harmless greeting to destroying the functions of an entire global network.
The Caligula virus is the latest in information-stealing viruses that are increasingly complex and send personal data to a specific location on the Internet.  Caligula steals a user's privacy key ring and sends it to the hacker who created the virus.  Because the key ring is encrypted and is relatively impossible to break, the user's key isn't at risk, but it illustrates the capability of having one's personal files stolen off the computer.  It infects Microsoft Word documents, then checks to see if key is installed on the machine.  If it is, the user's private key ring--the encryption algorithm for securing encrypted data--is sent to the virus writers site. 
A Trojan Horse is a program that contains hidden computer functions that take over or modify the infected computer’s operations. The Trojan Horse itself is not a virus but a vehicle within which viruses can be concealed.  A Trojan horse does things that the program user did not intend.  It relies on users to install them, or they can be installed by intruders who have gained unauthorized access by other means.  Then, an intruder attempting to subvert a system using a Trojan horse relies on the user to run the Trojan horse to be successful.
Trojan Horse programs are becoming a greater threat.  These are programs that perform some desired function, but also carry a hidden and potentially damaging payload.  For instance, many users on the Internet are being tricked into executing  programs that contains  the  "Back Orifice" code developed by the 'Cult of the Dead Cow."  This is a program that gives a hacker full access to other programs and data on the victim machine.  Back orifice does this by logging keystrokes, restarting the machine, and capturing the screen saver password.  The hacker gains control and can send files to and from the victims machine, execute programs or even lock the victim out. Some anti-virus software is able to detect a "Back Orifice" infected file.  
Worms are programs to infiltrate legitimate programs and alter or destroy the data.  They differ from viruses in that they "wriggle" or "slither" through a computer's memory or disk, altering any data they encounter.  They are stand-alone processes, able to schedule their own execution, and do not need an external trigger.   
Trapdoors are hidden software that software developers introduce to enable them to reenter the system in the future.  They are a means to gain unauthorized access without being detected.
A Logic bomb is unauthorized software that creates havoc when a particular event occurs, e.g., the perpetrator's name is deleted from the payroll or a certain date occurs.

**   ****Weak Computer Security Results In:**
**Defense Department Faced About 250,000 Attacks in 1995.**
**Most Attacks Go Undetected**
**FBI estimates computer fraud cost $136 million in 1997**
**In One Case, 13,000 employees had access to sensitive                                                                                                      medical and personnel data**
**Stolen Personal Information Is Used to Steal Peoples Identity, Obtain Credit Cards and Drivers License  **

**Notes:**
Attacks on computer systems are a serious and growing threat.  The exact number of attacks cannot be readily determined because only a small portion is actually detected and reported.  For example, the Defense Department may have experienced as many as 250,000 attacks in 1995.  (The report was dated May 22, 1996).  Defense information shows that attacks are successful 65 percent of the time, and that the number of attacks is doubling each year, as Internet use increases along with the sophistication of "hackers" and their tools. "  Of the successful attacks only about 4 percent were detected by the target organizations. 
The Defense Department tested itself by launching 38,000 attacks and found the attacks succeeded 65% of the time.  Not only that, but 63% of the attacks went undetected.  
The Computer Security Institute(CSI) and the Federal Bureau of Investigation (FBI) reported financial losses from computer security breaches of $136,822,000 for 1998--a 36% increase in reported losses over the 1997 losses.  64 percent of the respondents (total respondents 520) reported computer security breaches within the last 12 months.(48% acknowledged unauthorized use) Of those who acknowledged unauthorized use 74% reported from one to five incidents originating outside the organization, and 70% reported from one to five incidents originating inside.
"In Seattle, two hackers pleaded guilty to penetrating the U.S. District Court System, an intrusion which gave them access to confidential or perhaps even sealed information.  In carrying out their attack, they used supercomputers at the Boeing Computer Center, also in Seattle, to crack the courthouse system's password file.  If Boeing had not reported the intrusion to law enforcement, the District Court system administration would never have known the system was compromised."

## Good Planning and Management are Key to Strong Systems!!

**Legislation=Best Practices:**
**Manage as a Strategic Investment **
**Improve Mission Results, Not Just Lower Costs**
**Manage Risks**
**Measure Progress Against Plan**
**Deal With Problems Decisively**

**Notes:**
Studies have shown that large systems usually fail due to management deficiencies rather than technical problems.  To put it another way, severe technical problems are usually the result of inadequate management attention.  

Recent legislation (Clinger/Cohen, CFO, and FFMIA) emphasizes the need to follow disciplined management practices when acquiring and operating information systems.  

The Administration has also emphasized the need to improve management practices and OMB has provided guidance to implement legislative mandates.

These audits require an understanding of information technology issues, but really focus on good management practices.  Subjects include agency process to 
	make investment decisions, 
	plan, 
	manage risks, 
	contract, and 
	develop system software.

## To Ensure Accountability, We Must be Able to:

**Audit Computerized Information**
**Audit System Development and Operations**
**Audit Security Issues**
**Investigate Information in Computers**

**Notes:**
Our audit efforts can be divided into four categories.  
First, how do we audit computerized agency data that is stored in electronic form?  

Second, how do we audit newly developed and existing systems?

Third, how do we audit computer security?

Fourth, how do we access electronic data for investigations?

## Auditing Computer Systems

**Computers Are Key to Improve Operations**
** ****Specialized Area Requires Specialized Training**
**CISA is baseline Auditor Qualification **
**Supplemented by Computer Specialists**

**Notes:**
Information systems today are a key driver in achieving agency mission objectives and ensuring that business processes operate efficiently.  

Auditors who have passed a test and gained experience to become Certified Information Systems Auditors (CISA) have the background needed to do most of this work.  

For some technical audits, the auditors get supplementary help from computer specialists.  

## Tools To Audit Computerized Data 

**For Simple Systems we use Auditors, Supplemented by Technical Staff Who**
**Use Commercial Database Software (Access) to Analyze Informal Databases**
**Use (Lotus Notes) for Narrative Information**

**Notes:**
To audit computerized data, we need to be able to retrieve the data in electronic form, determine whether the data is reliable, and analyze the data. 
Determining the reliability of the data is important, and required by GAO auditing standards, because if we analyze unreliable data we will reach unreliable conclusions.
For most smaller systems, we have trained auditors to extract and analyze data from databases with technical staff available to help if needed.  

## Tools (Cont.)

**Special Software to Help do  Sophisticated Analysis**
**Designed for Auditors--Simple and User Friendly**
**Can Compare Multiple Databases**
**Supports Audits and Investigations.  Can Identify**
**Ghost Employees**
**Duplicate Invoices**
**Payments to Employees**

**Notes:**
The U.S. General Accounting Office, (The supreme audit institution in the U.S.) and many OIG’s use automated data analysis tools to audit computerized information.

We now use a software package called IDEA, which was developed by the Auditor General of Canada in 1984.  Since 1986, the Canadian Institute of Chartered Accountants has marketed this tool commercially.  

Other commercially developed packages that are designed to assist auditors are also available.  

.  

## Tools (Cont.)

**Complex Computer Systems Require Technical Assistance**
**We Use a Technical Assistance Group To:**
**Retrieve Data**
**Help Auditors Analyze Data**
**Provide Training, and Technical Help**

**Notes:**
To audit data from complex financial management systems, we use a Technical Assistance Group (TAG), with two computer specialists who know enough about the financial management system to help auditors extract and analyze the data they need.  
The TAG group coordinates with USAID programmers and other personnel to download or retrieve data from complex systems.  OIG auditors and investigators then use the data to conduct more detailed analyses or to include the information in final audit reports.  
This aspect of the TAG group's work involves retrieving specific information from USAID computer systems, developing queries to analyzing the data, and creating databases or spreadsheets to display the data.  The TAG group also provides ADP support, software package evaluations, ADP training, and technical consulting to auditors and investigators. 
Example--In the mid-1990's when USAID decided to replace its accounting system, we not only audited the system development activities, but we also prepared to audit data in the system.  We had two computer specialists trained in the software language used--in this case Oracle--and the structure of the databases in the system.  When the system went on-line, we obtained direct read-only access to the data base, which allowed the computer specialists to write programs to extract and analyze financial data on USAID's activities.  We have used this capability to conduct our financial statement audits.  

**  ****Auditing System Development Practice**
**Use CISA Auditors and Technical Staff**
**Cover Requirements, Life Cycle Process,       ****	****	****Documentation, Testing, and Implementation**
**We Ask:  Are Sound Practices Applied to ****	****    Development?**

** ****Auditing Operational Systems**
**Accounting, Budget, Procurement, Performance Systems**
**Financial and CISA Auditor Background **
**Supported by Technical Staff **
**Accounting Standards, Internal Controls, and System Requirements **
**We Ask:  Do Systems Provide Reliable Data and Safeguard Resources?**

**Notes:**
We also audit systems in operation to determine how well they meet their mission requirements and whether they are operating efficiently. 
Focus is to determine whether the systems’ meet requirements identified by USAID, legislation, or OMB guidance.  
At USAID, our financial management system is critical to effective operations because it controls the budget process, awarding and monitoring contracts, accounting for funds entrusted to USAID, and measuring the results of our operations.   
In addition, financial systems are subject to new audit requirements with the passage of the Federal Financial Management Improvement Act (FFMIA).  FFMIA requires that agency systems meet federal accounting and system requirements and requires OIG's to audit the systems to determine whether they meet the requirements.  
In this area, we use auditors with a combination of information technology and financial audit experience.  Much of the work required to determine whether the system meets accounting requirements is a normal part of the financial audit, but analyzing other systems requirements can be technical.

## Auditing Computer Security

**Auditing Computer Security**
**The Major Threat to Resources and Sensitive Data**
**Work Closely With USAID Staff to**
**Help Improve Security Program Operations**
**Identify and Correct Vulnerabilities**
**Ensure Security is Built Into New Systems**

**Notes:**
Computer security covers both the physical security of the computer facility and technical (or logical) controls that are built into the computer software.  
Computer security has attracted a lot of attention from the Administration and GAO in the last year or so.  The Administration recognized computer security weaknesses as a threat to the reliability of federal data and resources.  GAO identified computer security as a high risk area government-wide because of the amount of money and other assets that are vulnerable to fraud or abuse.  
At USAID security is important because we operate around the world in support of U.S foreign policy initiatives.  USAID handles about $7 billion a year, most of which is processed in one way or another through our computers.  
Many computer security audits can be conducted by generalist auditors with specific training in computer controls.  Auditors who have met the test and experience requirements to be designated Certified Information System Auditors (CISA) have the skills to analyze the effectiveness of computer security controls.  These include general computer control audits.  General controls are a subset of internal controls that include the policies and procedures to ensure that computer processing facilities are protected from the loss, compromise, theft, or destruction of data, assets, and computer resources. 
Other Audits, such as penetration testing requires more specific technical skills.

## Investigating Computer Information

**U.S. Codes Do Apply to Computer Fraud**

## THE END

- THANK YOU

**Notes:**
1. Offer to answer questions.

2. Thank the assembled multitude for their attention.