State Retirement Agency

Transcription

1 Audit Report State Retirement Agency April 2006 OFFICE OF LEGISLATIVE AUDITS DEPARTMENT OF LEGISLATIVE SERVICES MARYLAND GENERAL ASSEMBLY

2 This report and any related follow-up correspondence are available to the public through the Office of Legislative Audits at 301 West Preston Street, Room 1202, Baltimore, Maryland The Office may be contacted by telephone at , , or Electronic copies of our audit reports can be viewed or downloaded from our website at Alternate formats may be requested through the Maryland Relay Service at The Department of Legislative Services Office of the Executive Director, 90 State Circle, Annapolis, Maryland can also assist you in obtaining copies of our reports and related correspondence. The Department may be contacted by telephone at or

3 April 27, 2006 Senator Nathaniel J. McFadden, Co-Chair, Joint Audit Committee Delegate Charles E. Barkley, Co-Chair, Joint Audit Committee Members of Joint Audit Committee Annapolis, Maryland Ladies and Gentlemen: We have audited the State Retirement Agency for the period beginning July 1, 2002 and ending November 30, Our audit disclosed that the Agency s information system security reporting and review processes were inadequate. Respectfully submitted, Bruce A. Myers, CPA Legislative Auditor

4 2

5 Table of Contents Background Information 4 Agency Responsibilities 4 Financial Statements Audits 4 Select System Financial Information 5 Postretirement Health Benefits Trust Fund 5 Computer System Contract in Dispute 5 Termination of External Fund Manager Services 6 Current Status of Finding From Preceding Audit Report 6 Findings and Recommendations 7 Information Systems Security and Control Finding 1 Security Review Processes and Related Security 7 Reporting Were Inadequate Audit Scope, Objectives, and Methodology 8 Agency Response Appendix 3

6 Agency Responsibilities Background Information The State Retirement Agency provides administrative support services and investment functions for the State Retirement and Pension System of Maryland, an agent multiple-employer public employee retirement system. The System was established by the State Personnel and Pensions Article of the Annotated Code of Maryland and comprises the following individual systems: Teachers Retirement and Pension Systems, Employees Retirement and Pension Systems, State Police Retirement System, Judges Retirement System, Law Enforcement Officers Pension System and the Local Fire and Police System. Responsibility for the administration and operation of the System is vested in a 14-member Board of Trustees. According to the State s records, total Agency operating expenditures were approximately $24.7 million during fiscal year Financial Statements Audits On October 17, 2005, an independent certified public accounting firm reported the result of their audit of the financial statements of the System for fiscal year The firm expressed an opinion that the System s financial statements presented fairly, in all material respects, the plan net assets of the System as of June 30, 2005, and the changes in plan net assets for the year then ended, in conformity with accounting principles generally accepted in the United States of America. For fiscal years 2004 and 2003, the audits of the System s financial statements were conducted by our Office. In the related audit reports, we stated that the System s financial statements presented fairly, in all material respects, the plan net assets of the System as of June 30, 2004, and 2003, and the changes in plan net assets for the years then ended, in conformity with accounting principles generally accepted in the United States of America. 4

7 Select System Financial Information Fiscal Year Total Contributions Net Investment Income Benefit Payments Total Net Assets at June 30 Unfunded Actuarial Accrued Liability 2005 $879.5 million $2.7 billion $1.7 billion $32.1 billion $4.6 billion 2004 $836.2 million $4.2 billion $1.6 billion $30.2 billion $2.8 billion 2003 $814.4 million $756.7 million $1.5 billion $26.7 billion $2.3 billion Source: Audited System financial statements. Note, the Unfunded Actuarial Accrued Liability is the amount by which the Actuarial Accrued Liability exceeds the Actuarial Value of Assets as determined by the System s actuary. As of June 30, 2005, the System had approximately 100,000 retirees and beneficiaries and 188,000 active participants. Postretirement Health Benefits Trust Fund Chapter 466, Laws of Maryland, 2004, effective July 1, 2004 created the Postretirement Health Benefits Trust Fund. The law provides that the Board of Trustees for the State Retirement and Pension System is to be the trustees of the Fund and grants the Board full power to invest and manage the assets of the Fund to achieve the Fund s statutory purpose, which is to assist the State in financing its subsidy for retiree health insurance. Beginning in fiscal year 2008, any subsidy received by the State that is provided to employers as a result of the Federal Medicare Prescription Drug Improvement and Modernization Act of 2003, or similar federal subsidy received as a result of the State s prescription drug program, shall be deposited into the Fund. No payments can be made from the Fund until fiscal year 2018, at which time the Board will annually transfer to the General Fund certain amounts as specified in the law for assisting in the payment of the State s postretirement health insurance subsidy. Beginning in fiscal year 2010, the Board is to publish an annual report, which includes certain financial information regarding the Fund such as transactions processed in the preceding year and the amount of accumulated assets in the Fund. Computer System Contract in Dispute In our preceding fiscal/compliance audit report, we commented that in May 1998 the Agency entered into a contract with a vendor for the design, development and installation of an integrated data processing and electronic document management system. The total contract (including change orders) was not to exceed $37.3 million. 5

8 We also commented that, as of April 2002, payments totaling $27.3 million had been made under the contract, but the original October 2000 scheduled completion date had been delayed due to a dispute with the contractor regarding the adequacy of contract deliverables. Finally, our report stated that the Agency referred this matter to the Office of the Attorney General to determine the legal options available to the Agency. In a settlement agreement, which was approved by the Board of Public Works on June 4, 2003, the Agency and the contractor agreed to terminate the contract and settle all claims and disputes between them. In doing so, the Agency agreed to pay the contractor $3.5 million. This amount included payments being withheld by the Agency as retainage for work that had been performed and accepted by the Agency, as well as a one-time charge for settlement of all claims and disputes between the parties. Termination of External Fund Manager Services In our preceding fiscal/compliance audit report, we stated that, on January 15, 2002, the Board of Trustees terminated its agreement with one of its external fund managers. We also commented that we were advised by the Agency that certain federal and State regulatory and investigative agencies had requested various documents related to the Agency s relationship and transactions with this fund manager, and that the Agency complied with those requests. Finally, we stated that, as of December 19, 2002, the Office of the Attorney General was reviewing this matter to determine the legal options available to the Agency. In June 2003, federal authorities indicted this individual on various charges, including wire, mail, and investment advisory fraud. In November 2004, this person was found guilty of several of these charges, sentenced to prison and ordered to pay restitution. Current Status of Finding From Preceding Audit Report Our audit included a review to determine the current status of the one finding contained in our preceding fiscal/compliance audit report dated February 20, We determined that the Agency satisfactorily addressed this finding. 6

9 Findings and Recommendations Information Systems Security and Control Background The Agency s information system included an internal computer network with Internet connectivity. The Agency s information system also supported retirement and pension contributions and benefits processing by use of applications executed on the Comptroller of the Treasury s Annapolis Data Center. The system is secured using the Center s security software product to control access to data and program files and individual online transactions. Finding 1 Security review processes and related security reporting were inadequate. Analysis Security review processes and related security reporting were inadequate. Specifically, our review disclosed the following conditions: The security reports of changes made to critical production data files were not properly reviewed and investigated. Although a cursory review was performed, an adequate review and investigation of logged activity to critical data files was generally not performed. Accordingly, improper changes made to critical production data files might not be detected. The security officers, who established security access rules and modified user accounts, also initially and directly received and reviewed the related daily security reports. As a result, the security officers could initiate unauthorized changes to access rules and user accounts and conceal any unauthorized activity (for example, rule modifications). Recommendation 1 We recommend that procedures be established to provide adequate controls over the information technology security reviews and reports. We made detailed recommendations which if implemented should provide for the necessary controls. 7

10 Audit Scope, Objectives, and Methodology We have audited the State Retirement Agency for the period beginning July 1, 2002 and ending November 30, The audit was conducted in accordance with generally accepted government auditing standards. As prescribed by the State Government Article, Section of the Annotated Code of Maryland, the objectives of this audit were to examine the Agency s financial transactions, records and internal control, and to evaluate its compliance with applicable State laws, rules, and regulations. We also determined the current status of the finding contained in our preceding audit report. In planning and conducting our audit, we focused on the major financial-related areas of operations based on assessments of materiality and risk. Our audit procedures included inquiries of appropriate personnel, inspections of documents and records, and observations of the Agency s operations. We also tested transactions and performed other auditing procedures that we considered necessary to achieve our objectives. The Agency s management is responsible for establishing and maintaining effective internal control. Internal control is a process designed to provide reasonable assurance that objectives pertaining to the reliability of financial records, effectiveness and efficiency of operations including safeguarding of assets, and compliance with applicable laws, rules and regulations are achieved. Because of inherent limitations in internal control, errors or fraud may nevertheless occur and not be detected. Also, projections of any evaluation of internal control to future periods are subject to the risk that conditions may change or compliance with policies and procedures may deteriorate. Our reports are designed to assist the Maryland General Assembly in exercising its legislative oversight function and to provide constructive recommendations for improving State operations. As a result, our reports generally do not address activities we reviewed that are functioning properly. This report includes a finding relating to a condition that we consider to be a significant deficiency in the design or operation of internal control that could adversely affect the Agency s ability to maintain reliable financial records, operate effectively and efficiently, and/or comply with applicable laws, rules, and 8

11 regulations. Our audit did not disclose any significant instances of noncompliance with applicable laws, rules or regulations. Other less significant findings were communicated to the Agency that did not warrant inclusion in this report. The Agency s response to our finding and recommendation is included as an appendix to this report. As prescribed in the State Government Article, Section of the Annotated Code of Maryland, we will advise the Agency regarding the results of our review of its response. 9

12

13

14 AUDIT TEAM Paul R. Denz, CPA Audit Manager Stephen P. Jersey, CPA, CISA A. Jerome Sokol, CPA Information Systems Audit Managers Bekana Edossa, CPA, CFE Senior Auditor Omar A. Gonzalez, CPA Information Systems Senior Auditor Menachem M. Katz, CPA Lauren C. Reese Staff Auditors Veronica Arze Amanda L. Trythall Information Systems Staff Auditors