Office of Inspector General

Audit Report

QUALITY CONTROL REVIEW FOR 

CONTROLS OVER THE ENTERPRISE 

SERVICES CENTER

Department of Transportation 

Report Number: QC-2012-003

Date Issued: November 4, 2011
U.S. Department of

Memorandum

Transportation

Office of the Secretary

of Transportation

Office of Inspector General

Subject: ACTION: Quality Control Review of Controls 

Over the Enterprise Services Center 

Report Number QC-2012-003 

Date: November 4, 2011

From:

Louis C. King 

Assistant Inspector General for Financial and 

Information Technology Audits 

Reply to 

Attn. of: JA-20 

To: Assistant Secretary for Budget and Programs/Chief Financial Officer

The Department of Transportation's (DOT) Enterprise Services Center (ESC), 

located at the Federal Aviation Administration’s (FAA) Mike Monroney 

Aeronautical Center in Oklahoma City, operates under the direction of DOT's 

Chief Financial Officer, and provides financial management services to DOT and 

several Federal agencies.1

 

The Office of Management and Budget (OMB) requires ESC, as a management 

services provider, either to (1) provide ESC's user organizations with independent 

audit reports on the design and effectiveness of its internal controls, or (2) allow 

user auditors to perform tests of its controls.2

 

1 The National Endowment for the Arts, the Institute of Museum and Library Services, the Commodity Futures Trading 

Commission, Consumer Products Safety Commission, the National Credit Union Administration, and the 

Government Accountability Office.

To meet OMB's requirement, DOT's 

Office of Inspector General (OIG) contracted with Clifton Gunderson LLP to 

perform an examination of ESC's description of its system of controls and the 

suitability of the design and operating effectiveness of these controls for the period 

October 1, 2010, to June 30, 2011, and issue an independent service auditor's

report. We required the contractor to perform this attestation engagement in 

accordance with generally accepted Government auditing standards and the 

American Institute of Certified Public Accountants' Statement on Standards for 

Attestation Engagements Number 16, Reporting on Controls at a Service 

Organization. 

2 OMB Memorandum M-08-24. 
2

Clifton Gunderson LLP's examination covered both the Delphi Financial 

Management System3

In its examination, Clifton Gunderson LLP found that in all material respects:

and the Consolidated Automation System for Time and 

Labor Entry (CASTLE) hosted at ESC. CASTLE is used to support DOT 

operations only.

• ESC's description of controls fairly presents ESC's system that was 

designed and implemented throughout the period October 1, 2010, to June 

30, 2011.

• The controls were suitably designed to provide reasonable assurance that 

the controls' objectives would be achieved if the controls operated 

effectively throughout the period October 1, 2010, to June 30, 2011, and 

user entities applied the complementary user controls contemplated in the 

design of ESC's controls throughout the period October 1, 2010, to June 30, 

2011.

• The controls tested, together with the complementary user entities' controls, 

if operating effectively, were those necessary to provide reasonable 

assurance that the control objectives were achieved, operated effectively 

throughout the period October 1, 2010, to June 30, 2011.

We performed a quality control review (QCR) of Clifton Gunderson LLP's report 

and related documentation. Our QCR, as differentiated from an attestation 

engagement performed in accordance with generally accepted Government 

auditing standards, was not intended for us to express, and we do not express, an 

opinion on ESC's description of controls, the suitability of the design of these 

controls and the operating effectiveness of the controls tested. Clifton Gunderson 

LLP is responsible for its independent service auditor's report dated August 1, 

2011, and the conclusions expressed in that report. However, our QCR disclosed 

no instances where Clifton Gunderson LLP did not comply, in all material 

respects, with generally accepted Government auditing standards.

Clifton Gunderson performed additional testing and provided a follow-up letter to 

OIG dated September 30, 2011, reporting no significant changes to ESC’s control 

environment since June 30, 2011 (the effective date of their SSAE 16 report).

As part of this attestation engagement, Clifton Gunderson LLP made 

recommendations to improve ESC's operations. These recommendations are in this 

report’s Exhibit.

 3 The Delphi system includes ESC PRISM, a Federal acquisition system.
3

Actions Required on Clifton Gunderson's Recommendations 

In his response to OIG dated October 20, 2011, the Deputy Chief Financial Officer 

concurred with the recommendations and committed to the completion of

corrective actions (see Appendix in this report). In accordance with DOT Order 

8000.1C, the recommendations will remain open pending receipt of documentary 

evidence that these appropriate corrective actions are complete.

We appreciate the courtesies and cooperation of Department of Transportation 

representatives during this engagement. If you have any questions concerning this 

report, please call me at (202) 366-1407, or Nathan Custer, Program Director, at 

(202) 366-5540.

Attachments

#

cc: Chief Information Officer, DOT

Deputy Chief Financial Officer, DOT

Assistant Administrator for Financial Services/CFO, FAA

Assistant Administrator for Information Services/CIO, FAA

Assistant Administrator for Region/Center Operations, FAA

Director, Mike Monroney Aeronautical Center, FAA

Martin Gertel, M-1

Anthony Williams, AAE-001
4

Exhibit. Recommendations of Clifton Gunderson, LLP, Independent 

Auditor

EXHIBIT. RECOMMENDATIONS OF CLIFTON GUNDERSON, LLP, 

INDEPENDENT AUDITOR

Clifton Gunderson LLP made the following recommendations during its review of 

general, application, and operational controls over DOT's ESC during fiscal year 

2011. OIG agrees that DOT management should implement the following actions 

to enhance ESC controls.

Configuration Management

1

Develop and implement a repeatable System Development Life Cycle 

process for Delphi in accordance with NIST 800-64 and incorporate 

information security throughout the life cycle stages. Already in the fourth 

phase of this cycle (Operation), emphasis should now be placed on a) 

Maintenance: Modification of the existing platform by the addition of 

hardware and software) and b) Disposal: Orderly termination of the system, 

safeguarding vital system information, and migrating data processed by the 

system to a new system, or preserving it in accordance with applicable 

records management regulations and policies. 

2

Complete the implementation of Security Configuration Baselines in 

conformity with the United States Government Configuration Baseline 

(USGCB) initiative. 
5

Appendix. Agency Comments

APPENDIX. AGENCY COMMENTS

Memorandum

U.S. Department of 

Transportation 

Office of the Secretary

Of Transportation

Subject: Management Response to the SSAE-16 Audit Date: October 20, 2011 

 of ESC’s Services Information Security Controls 

From: David J. Rivait 

Deputy Chief Financial Officer

To: Louis C. King 

 Assistant Inspector General for Financial and Information 

 Technology Audits 

The Department provides diligent oversight as it works to ensure the quality, accuracy, and 

integrity of the services provided by the Enterprises Services Center (ESC). The Office of 

Inspector General’s (OIG) annual audit utilizing Statement of Standards for Attestation 

Engagements – 16 (SSAE-16), by its contractor, Clifton Gunderson, LLP (CG), is integral to 

these efforts. Once again this year the audit provided insights that enable us to further improve 

our already strong management and controls over financial systems in an ever-changing cyber 

security environment.

CG issued a unqualified opinion for the period October 1, 2010 to June 30, 2011. It found that, in 

all material respects, the ESC’s description of controls fairly presents the ESC system that was 

designed and implemented. Further, the controls were suitably designed to provide reasonable 

assurance that their objectives would be achieved if operated effectively throughout the period.

The Department concurs with CG’s recommendations and has identified corrective actions. 

Consistent with past practices, the Office of the Assistant Secretary for Budget and 

Performance/CFO and ESC worked with the auditors throughout this year’s SSAE-16 audit to 

identify and schedule corrective actions as audit findings were documented, to ensure timely and 

appropriate management action. These corrective action plans will be forwarded to you under 

separate cover prior to October 31, 2011. 

 

As a Federal Shared Service Provider (FSSP) designated by the Office of Management 

and Budget (OMB) to provide a state-of-the-art financial system and quality accounting services 

to other Federal agencies, ESC has demonstrated its strong commitment to ensuring that it’s 

Financial Management Services meet or exceed all information security requirements.
6

Appendix. Agency Comments

Thank you for your continuing support and assistance in this effort.

cc: Maria Dowds, Joann Adam, Robert Owens, Wendy Calvin, Marshal Gimpel, 

Mike Upton, Keith Burlison, Bo Peeler, Steve Aube, Janet Shell, and Kent Mitchell