Jail Management System - Maricopa County

JMS Environment
Because JMS is a mission critical application, MCSO has been assessing future system
requirements. MCSO IT reports several challenges with the current JMS environment.
Mainframe - The mainframe on which JMS is running is supported by the vendor through 2014.
The FY 2012 mainframe software license costs are $1.1 million, with an automatic annual 10
percent increase, and annual mainframe hardware costs are $95,000. MCSO intends to
renegotiate the contract during FY 2014. MCSO reports that for strategic purposes, MCSO may
replace the existing mainframe, but has not submitted a budget request.
Aging Workforce - JMS is a large and complex seventeen-year old system; its software is written
in COBOL, a programming language that is no longer being taught in many universities.
According to MCSO IT, as employees responsible for maintaining JMS retire, it may become
difficult and expensive to replace them, negatively affecting the long-term maintenance of the
system. The County’s Office of Management and Budget is completing a staffing study for
MCSO IT.
Scope and Methodology
Audit Objectives
The objectives of this audit were to determine that:
Approach
Effective general controls are in place to provide reasonable assurance that information
systems are secure and available to users.
Information technology general controls are overarching policies and procedures that
apply to the network and organization-wide information systems. Reviewing general
controls provides assurance that the controls are working as intended and that systems
are appropriately supporting operations.
Critical application controls are in place to provide reasonable assurance of the
confidentiality, integrity, and availability of data.
Application controls are specific to a single information system, such as JMS.
Application controls are activities designed to support operations, and ensure the
confidentiality, integrity and availability of application data.
To achieve the audit objectives, we:
Interviewed key employees from MCSO, the ICJIS agency, and the Office of Enterprise
Technology (OET)
Obtained and reviewed policies and procedures related to:
o IT governance
o Programs and data access (including application security, operating system
security, database security, user authentication, and segregation of duties)
Maricopa County Internal Audit 4 Jail Management System–May 2012