Looking for a Oregon Legal Forms And Templates? Download it for free!

Oregon Accounting Manual - Accounting And Financial Reporting - State Controller'S Division - 2010

Statewide Policy

OREGON ACCOUNTING MANUAL

SUBJECT:

Accounting and Financial Reporting

Number:

10.60.00.PO

State Controller’s Division

DIVISION:

Effective date: August 1, 2010

Chapter:

Internal Control

Part:

Information Technology

APPROVED: John Radford, State Controller

Signature on file at SCD

Authority

ORS 291.015

ORS 293.590

ORS 293.595

Management of Risks, Performance, and Controls in the Information Technology (IT) Environment

.101

Each

agency head

is responsible for establishing, maintaining, and improving internal controls

over the agency’s information technology (IT). An agency must ensure the adequacy of the

design, implementation, and operation of its IT controls to provide an acceptable level of

confidence in agency systems and assurance that:

a. Management’s IT goals and objectives are being accomplished effectively and

efficiently;

b. IT investments and investment strategies are well planned and adequately funded;

c. IT assets are safeguarded; and

management’s

direction,

d. IT

operational

and

investment

strategies

authorization, and security and control policies.

.102

In addition, agencies must comply with all statewide IT security policies and initiatives issued by

the Department of Administrative Services, Enterprise Information Strategy and Policy Division

(DAS-EISPD) and all applicable federal and state laws and regulations pertaining to the

confidentiality, integrity and availability of electronic data, including Oregon Laws 2007, Chapter

759.

.103

State agencies must provide adequate security and control training and other educational support

to employees involved in the design, development, implementation, maintenance, and

management of the IT infrastructure/function, as well as the storage and protection of the

underlying data. A variety of nationally and locally recognized associations and DAS-EISPD

provide training.

Review of IT Controls

Periodically, agency management must review and test the performance of the agency’s internal

.104

controls over information technologies.

.105

Agency management must prepare a report that identifies any significant or material weaknesses

in the agency’s IT controls and gives a status update on IT control weaknesses identified in earlier

reports or noted by internal or external auditors. This report should be available for use by the

10.60.00.PO.1

Oregon Accounting Manual - Accounting And Financial Reporting - State Controller'S Division - 2010

Related Articles

Related forms

Related Categories