We noted that printed reports containing business license data are placed in an unsecured area in MIS for retrieval. A designated staff person to retrieve each City department's reports has not been assigned. All sensitive documents should be secured by MIS staff and made available on a will-call basis to specified staff. All City department managers should be made aware of the sensitive nature of some reports and direct MIS accordingly. The MIS Department is not notified of employee transfers to other departments in the City.
Employee transfers affect user access to the various modules of the automated system.
By not notifying MIS of employee status changes, there is a risk that data could be altered or corrupted. Regular confirmation of user access should be a standard City policy. Additionally, a modified copy of Form CS-23 should be forwarded to the Director of MIS as part of a preventive control to ensure that user access is consistently maintained in a current condition. An e-mail message or memorandum requesting service is allowable. A policy to standardize requests for MIS services has not been implemented.