Auditor General Releases Spring 2009 Report

Provincial government computer systems, the information they hold, and the programs and services they support are all vulnerable because of "significant deficiencies" in IT security, Auditor General Jacques Lapointe said today, April 22.

The auditor general released his spring 2009 report to the legislature, which includes 21 recommendations to improve the security of government's IT systems and data and to make security a priority at the highest levels of government.

"At the time of our audit, the organizational structure of government's IT operations was confusing and onerous," said Mr. Lapointe. "There was an array of decentralized and centralized groups, positions, forums and committees. Our audit also found that planning is inadequate, policies and standards need strengthening, and security monitoring should to be more rigorous.

"As a result, government has a heightened exposure to security threats, such as viruses and unauthorized computer access; to inefficiencies created by redundant and piece-meal security measures; and to compromised security resulting from a lack of, or failure to comply with, standards."

He said changes in organizational structure and computer systems are required to ensure the security of sensitive and confidential information, including driver records, income assistance records, criminal records and financial information.

Mr. Lapointe also reported that an audit of commercial truck and passenger carrier safety programs found weaknesses which diminish their ability to improve highway safety.

He noted that the Transportation and Infrastructure Renewal Department's truck safety inspection and enforcement program does not meet the department's standards of performance. Weigh scales are not open long enough and are understaffed. And Service Nova Scotia and Municipal Relations' audit and enforcement program does not adequately monitor the province's higher risk commercial carriers.

"Due to the potential seriousness of accidents involving trucks and buses, it is important that the province's safety programs related to these vehicles be as effective as possible."

Mr. Lapointe found that audit committees across the provincial public sector need to be strengthened to improve control and public accountability. He advised government to provide guidance to agencies to move towards better governance and best practices. He also advised government to evaluate the need for a stronger internal audit function across government.

Mr. Lapointe was also critical of government for failing to act decisively on recommendations made in previous reports. In 2006, the auditor general made 146 recommendations to nine departments and all health authorities. In the two years since, government has only implemented 39 per cent of them.

"During my time as auditor general, the focus of our efforts has been, and will continue to be, on the significant operations of government; things that are of major importance to Nova Scotians; and the systems that are vital to the operation of those programs and services. In short, we focus on areas of high impact, where failures and weaknesses carry high risk."

Failure to address these weaknesses in a timely manner increases the risks of financial loss and ineffective delivery of important government services, he said.

The full report is available on the auditor general's website at www.oag-ns.ca or by contacting the office at 902-424-5907 or [email protected] .