Summary of Report 16-025

TDCJ uses the Corrections Tracking System to manage criminal information for offenders sentenced to prison, jail, parole, and probation. However, the databases used to manage prison, jail, and parole records do not require records to include an incident number. Because that information field is not mandatory, records can be created with that required information missing. The state identification number and the incident number are unique identifiers that should be present on each criminal record, as required by Texas Code of Criminal Procedure, Section 60.052.

Jump to Chapter 1-B 

Auditors selected 25 of the 5,452 records that could not be matched between DPS’s Computerized Criminal History System and TDCJ’s Corrections Tracking System to determine why these records could not be matched. Auditors’ analysis indicated that all 25 records in the Corrections Tracking System had errors that prevented a match, such as incorrect state identification numbers, offense codes, incident numbers, and incident number suffixes.

Jump to Chapter 2-B 

In the 2011 audit of CJIS, the State Auditor’s Office reported that DPS had not entered into the Computerized Criminal History System records that reporting agencies had submitted in hard-copy form during a time period that covered approximately two months. On November 2015, auditors observed that DPS staff were entering criminal records submitted within the last 24 hours and no longer had a backlog as of that date.

However, DPS should continue monitoring the timely submission of certain disposition records and notify the appropriate commissioner court when the county reporting agencies do not comply with Texas Code of Criminal Procedure, Section 60.08(d).

Jump to Chapter 3 

Auditors identified a total of 19 user accounts that granted DPS programmers inappropriate administrative access to the servers, application, and production databases for the Computerized Criminal History System.

All seven changes that auditors tested for changes programmers made to the Computerized Criminal History System in fiscal year 2015 were properly approved, including two changes that were categorized as emergency changes. DPS also performed a post-implementation review to verify that there were no unexpected effects on the system due to the two emergency changes. However, a lack of segregation of duties among staff involved in the change management process increases the risk of unauthorized changes to the Computerized Criminal History System. Specifically:

•   Five (71.43 percent) of the 7 changes were released into production by the same programmer who created the change.

DPS had an adequate process to recover data from its local virtual tape library backup; however, as of December 2015, DPS reported that it had not performed and documented a full recovery test.

Furthermore, DPS did not have a documented process to recover data from its remote location. DPS policy requires it to review its offsite backup storage procedures annually.

Jump to Chapter 4-A 

TDCJ has improved the security of criminal records since the 2011 audit by limiting programmers’ ability to make modifications to its Corrections Tracking System. Specifically, TDCJ has limited access in its information technology division to four programmers who have read-only access. That is an improvement from the 11 programmers with access authority to update data and the database identified in the 2011 State Auditor’s Office audit of CJIS. However, the four programmers responsible for managing the Community Justice Assistance Division’s Intermediate System and support components have administrative access to that system.

All of the information technology systems that support the Corrections Tracking System are housed at the State Data Center. While TDCJ has written information technology policies and procedures, they do not delineate responsibilities between TDCJ employees and the State Data Center staff for changes to be made to the Corrections Tracking System.

In addition, TDCJ’s Community Justice Assistance Division has its own information technology policies and procedures that address specific areas applicable to the Intermediate System. Those policies and procedures do not clearly define the segregation of duties requirements between those responsible for making programming changes in the Intermediate System and those responsible for promoting those changes into production.

Jump to Chapter 4-B