FOLLOW-UP REVIEW Internal Controls Over Drivers' Records Driver Services Division Department of Motor Vehicle Safety Performance Audit Operations Division Russell W. Hinton, State Auditor Department of Audits and Accounts 254 Washington St. Atlanta, GA 30334 This is a Follow- up Review of the Performance Audit of Internal Controls Over Drivers' Records that was released by the Performance Audit Operations Division in August 2000. Background The Driver Services Division of the Department of Motor Vehicle Safety (DMVS) is responsible for maintaining and updating the driving records of the approximately 5.6 million citizens who have a Georgia driver's license. When a person is convicted of a traffic violation (other than for such minor offenses as parking violations), courts are required to send a copy of the citation to DMVS where it is entered on the driver's record. As specified in state law, courts receive $0.25 for every citation they submit. Courts are also required to notify DMVS when a person is convicted of a traffic offense, such as hit-and-run or driving under the influence, that requires mandatory suspension/revocation of the person's driver's license. Licenses are also subject to mandatory suspension by DMVS when a person accumulates 15 or more points within a 24-month period. (Points are given for such offenses as reckless driving and exceeding the speed limit by more than 14 miles per hour.) In addition to entering the suspension/revocation on the driver's record, the Division is responsible for notifying the driver of the terms of the suspension/revocation. Drivers may have their license reinstated by the Division by fulfilling certain statutory requirements (such as completing a DUI Alcohol Risk Reduction Program). It should be noted that the Department of Public Safety (DPS) was responsible for the state's drivers' records system during the time the performance audit was being conducted. Prior to the release of the audit report, however, legislation was enacted that transferred the responsibility for drivers' records to the newly created Department of Motor Vehicle Safety. As specified in the legislation, DMVS became fully operational on July 1, 2001. Synopsis of the Performance Audit The primary objective of the August 2000 audit was to determine if the Department of Public Safety had implemented adequate internal controls to ensure that drivers' records were secure and accurate. As a result of the audit, it was determined that substantial improvements were needed in DPS's internal control procedures. The audit recommended that ac- Department of Motor Vehicle Safety: Internal Controls Over Drivers' Records Page 1 tion be taken to: ensure an appropriate separation of duties so that the possibility for improper or unau- thorized changes is minimized; restrict the number of persons with access to making changes to citations and license sus- pensions on the drivers' records system; centralize the processing of citations to ensure that all citations are placed on drivers' records; utilize available resources to encourage courts to transmit citations electronically; reconcile fees collected with changes made to the drivers' records system; immediately revoke access to the drivers' records system when employees are reassigned or terminated; and, develop formal policies and procedures that address the maintenance of drivers' records. Status of Findings and Recommendations Finding (as reported in 2000): Management cannot provide reasonable assurance that drivers' records are accurate and properly safeguarded from unauthorized changes. Current Status: Since becoming responsible for maintaining citizens' driving records, the Department of Motor Vehicle Safety has implemented substantial changes to improve the accuracy and integrity of the computerized records system. As recommended in the 2000 performance audit report, DMVS has implemented procedures to ensure that employee access to the system is limited based on the employee's job duties. The new computer system implemented by DMVS also enables management personnel to monitor changes made to a driver's record and track each of the changes back to the individual who made the change. These and other improvements implemented by DMVS are described in more detail in the Current Status segments of this report. Finding (as reported in 2000): The Department should develop a system of checks and balances to ensure that changes made in the drivers' records system are properly reviewed and authorized. Current Status : A new computer system was implemented in April 2001 that provides additional levels of security over drivers' records. The new system enables DMVS to limit employees' access to certain types of records and to limit the types of transactions employees can perform. For example, an employee who is authorized to reinstate a person's driver's license (after it has been suspended) does not have the ability to delete the citation (or citations) that produced the license suspension. The Department has also implemented a check and balance system for deleting citations from a driver's record. Finding (as reported in 2000): Action should be taken to restrict the number of people with access to changes regarding citations and suspended licenses. Current Status: As previously noted, the new drivers' records system limits each employee's access to the system based on the employee's job duties. Interviews with Department personnel also indicated that they have taken steps to clean up the number of persons who are authorized to access the system. Department of Motor Vehicle Safety: Internal Controls Over Drivers' Records Page 2 Finding (as reported in 2000): Action should be taken to centralize the processing of citations to ensure that all citations are placed on drivers' records. Current Status: In its written response, DMVS indicated that its Operations Division and Information Technology Division have taken steps to streamline the process of entering citations on drivers' records and provide increased accountability. The Information Technology Division indicated that it plans to outsource the processes of entering citations on drivers' records and of imaging the citations. As noted by DMVS personnel, however, the best way of ensuring that all citations are placed on drivers' records would be to have all of the citations submitted electronically (as discussed below). Finding (as reported in 2000): The Department should make more effective use of available resources to encourage courts to transmit citations electronically. Current Status: In its written response, DMVS noted that it continues to encourage courts to transmit citations electronically. During the 2002 Session of the General Assembly, legislation was introduced (but not passed) that would have authorized courts to receive $0.50 for every citation submitted electronically and $0.10 for every citation submitted on paper. Finding (as reported in 2000): Action should be taken to reconcile fees collected with the drivers' records system. Current Status : The Department is currently working to develop the necessary procedures and controls to reconcile the fees collected with transactions involving drivers' records. The Department has also indicated that the new digitized license system with its point-of-sale component, scheduled for implementation in July 2003, will (in conjunction with the recent changes in the driver's records system) greatly facilitate fee reconciliation. Finding (as reported in 2000): The Department should ensure that employees' access to the drivers' records system is updated when employees are reassigned or terminated. Current Status: The Department has implemented procedures to ensure that employees' access to drivers' records is revised as necessary when they are reassigned or terminated. As part of the exit process, employees who are terminated must obtain an authorized signature from the Information Technology Division indicating that all access to the drivers' records database has been deleted. Supervisors of employees who transfer within DMVS are required to submit a form to the Information Technology Division to have the employees' access to the database deleted. A new request for access to the system must be submitted if access is required for the employee's new position within the Department. Finding (as reported in 2000): The Division should develop formal policies and procedures that address the maintenance of drivers' records. Current Status: Department personnel have indicated that formal policies and procedures regarding the drivers' records system are being developed. For additional information or to request a copy of the Performance Audit, contact Paul E. Bernard, Director, Performance Audit Operations Division, at 404-651-8855. Or see our website: www2.state.ga.us/Departments/AUDIT/pao/pao_main.htm Department of Motor Vehicle Safety: Internal Controls Over Drivers' Records Page 3