S Montana •

354.349 Legislative Audit

L72b<>d Division

1998 Big game drawing

system* Department
of Fish* Waldlife

and Parks

Legislative Audit Division

State of Montana

Report to the Legislature

January 1998 Performance Audit Follow-up

Big Game Drawing System

Department of Fish, Wildlife and Parks

The original audit report contained 16 recommendations to improve
drawing operations. Recommendations related to:

*- Improving compliance procedures.

> Bettering program administration.

*■ Strengthening general and application controls.

A*4

'i^^E

y'

nc

•^•*-

i % ^

l?Rtf^OCUMFNf« ".til LECTION

■gtJNTANA glAft uitJKARY
HELENA. MCJiMiAiMM o9620

97SP-77

Direct comments/inquiries to:
Legislative Audit Division
Room 135, State Capitol
PO Box 201705
Helena MT 59620-1705

HOV 7 2002

MONTANA STATE LIBRARY

3 0864 0010 3606 3

PERFORMANCE AUDITS

Performance audits conducted by the Legislative Audit Division are designed to assess state
government operations. From the audit work, a determination is made as to whether agencies
and programs are accomplishing their purposes, and whether they can do so with greater
efficiency and economy. In performing the audit work, the audit staff uses audit standards set
forth by the United States General Accounting Office.

Members of the performance audit staff hold degrees in disciplines appropriate to the audit
process. Areas of expertise include business and public administration, statistics, economics,
computer science, communications, and engineering.

Performance audits are performed at the request of the Legislative Audit Committee which is a
bicameral and bipartisan standing committee of the Montana Legislature. The committee
consists of six members of the Senate and six members of the House of Representatives.

MEMBERS OF THE LEGISLATIVE AUDIT COMMITTEE

Senator Linda Nelson, Chairman

Representative Bruce Simon, Vice Chairman

Senator Sue Banlett

Representative Beverly Barnhart

Senator Reiny Jabs

Representative Ernest Bergsagel

Senator Tom Keating

Representative A. R. "Toni" Hagener

Senator Ken Miller

Representative Bob Keenan

Senator Fred VanValkenburg

Representative Roben Pavlovich

LEGISLATIVE AUDIT DIVISION

Scott A. Seacat, Legislative Auditor /^^^^^\ Deputy Legislative Auditors:

John W. Northey, Legal Counsel ra^^^Sl ^™ Pellegrini, Performance Audit

Tori Hunthausen, IT & Operations Manager ^^^^^^ ^^"^^^ Gillett, Financial-Compliance Audit

Januaiy 1998

The Legislative Audit Committee
of the Montana State Legislature

This is our performance audit follow-up of the Big Game Drawing System administered
by the Department of Fish, Wildlife and Parks. While some recommendations are not
implemented, we found most are implemented or are being implemented. Summary
information from the original repon is included in Appendix A.

We wish to express our appreciation to the staff of the department for their cooperation
and assistance during our follow-up work.

Respectfully submitted.

Scott A. Seacat
Legislative Auditor

Room 135, State Capitol Building PO Box 201705 Helena, MT 59620-1705
Phone (406) 444-3 122 FAX (406) 444-9784 E-Mail lad@mt.gov

Digitized by the Internet Archive

in 2010 with funding from

Montana State Library

http://www.archive.org/details/biggamedrawingsy1998mont

Legislative Audit Division

Performance Audit Follow-up

Big Game Drawing System

Department Fish, Wildlife and Parks

Member of the audit staff involved in this audit was Mary Zednick.

Table of Contents

List of Tables ii

Administrative Officials iii

Introduction 1

Follow-up Results 1

Introduction 3

Procedures Which Ensure Sportsmen Compliance 3

Program Administration 4

Big Game Drawing Process 6

General Controls 7

Application Controls 9

Department of Fish, Wildlife and Parks 15

1995 Audit Report Summary S-1

Chapter I - Introduction

Chapter II - Implementa-
tion Status

Agency Response
Appendix A

Page i

List of Tables

Table 1 Recommendation Status Page 1

Page ii

Administrative Officials

Department of Fish,
Wildlife and Parks

Administration and
Finance Division

Licensing/Data Processing
Bureau

Pat Graham, Director
Dave Mott, Administrator
Barney Benkelman, Chief

Page iii

Chapter I - Introduction

Introduction

We conducted a follow-up review of the performance audit of the
Big Game Drawing System (94P-46). Our primary objective was to
determine the implementation status of recommendations made in the
October 1995 audit report. To meet our objective we performed the
following audit steps:

Follow-up Results

Reviewed available computer reports.
Interviewed department and program management and staff.
Reviewed Access Control Facility 2 (ACF2) rules.
Reviewed applicable computer coding.

The original audit report contained 16 recommendations to improve
the Big Game Drawing System operations. As table 1 shows, the
department fully implemented 9 of the recommendations contained
in our report.

Table 1

Recommendation Status

Implemented
Being Implemented
Partially Implemented
Not Implemented
Not Applicable
Total

9
3
1

2

16

Source: Compiled by the Legislative Audit Division.

Chapter II discusses the implementation status for each recommenda-
tion. The report summary from the original report is provided as
Appendix A. This summary outlines the original issues and audit
recommendations .

Page 1

Page 2

Introduction

Chapter II - Implementation Status

The following sections provide information on the implementation
status of the recommendations made in the original report. The
discussion is categorized into each area where recommendations
were made. These areas include:

Procedures Which
Ensure Sportsmen
Compliance

— Procedures which ensure sportsmen compliance.

— Program administration.

— General and application controls.

Recommendation #1

We recommend the Department of Fish, Wildlife and Parks
electronically compare the revoked privilege information on
LED's database to the Big Game Drawing System application
information prior to the drawings and hunting seasons.

Implementation Status

This recommendation is implemented. Programming was written
to compare the Law Enforcement Division's revoked privilege
information to the Big Game Drawing System database. (A person
whose license privileges are forfeited/revoked may not apply for a
hunting, fishing, or trapping license or permit during the period
when license privileges are revoked.) Information on the systems
was compared prior to the 1997 deer, elk and antelope drawings.
Birth dates, name, and addressees were compared. Results of the
comparison showed 43 people with revoked privileges applied for
special licenses/permits. LED staff verified the applicants'
privileges were revoked. The applicants were then removed from
the big game drawing database prior to the drawings.

Recommendation #2

We recommend the Department of Fish, Wildlife and Parks
modify procedures to produce a more effective means of
reviewing landowner preference claims.

Implementation Status

This recommendation is being implemented but there are no

established time frames for implementation. Law Enforcement

Page 3

Chapter II - Implementation Status

Division is polling the captains, sergeants, and game wardens to
determine what information is needed to allow wardens to verify the
applicant claiming landowner preference owns the land. The
appropriate game warden would investigate those applicants whose
ownership claim is questionable.

Once the poll is completed. Licensing staff will have to determine
how that information can be gathered and input to the big game
drawing database.

Program Administration RecQmnign(>ation <y3

We recommend the Department of Fish, Wildlife and Parks seek
legislative clarification with respect to the department's authority
to:

A. Conduct a landowner preference for deer and antelope
permits; and

B. Process applications of those seeking landowner preference
differently than those of the general public.

Implementation Status

This recommendation is not implemented. During the audit the
department did not entirely concur with the recommendation. In the
response to the original audit, department officials stated they
discussed landowner preference for deer and antelope when legisla-
tion for landowner preference for elk was introduced. The depart-
ment indicated both houses of the legislature intended for the deer
and antelope preference to continue. The department's response to
the original audit stated "The Department and FWP Commission will
further analyze the need for further legislative action."

Since issuance of the Big Game Drawing System audit report,
department officials considered the need to seek legislative clarifi-
cation. The Fish, Wildlife and Parks Commission and depanment
management were advised by department legal staff that the
commission and department have the authority to create preferences
by rule in the big game drawings and, therefore, legislative
clarification is not needed. We still believe the depanment adopted

Page 4

Chapter II - Implementation Status

the administrative rule for deer and antelope landowner preference
without a specific statutory basis.

At the time of the original audit, administrative rules stated the
department could accept corrections on applications of those seeking
landowner preference. These rules have not been changed. We still
believe the department needs statutory authority to process
landowners' applications differently than nonlandowners. Again,
department legal staff advised the commission and department
management the two groups have legal authority to determine by
rule, categories or types of errors the department will correct for
applicants in their big game drawing applications.

Recommendation #4

We recommend the Department of Fish, Wildlife and Parks

either:

A. Comply with the administrative rule prohibiting corrections
or changes to applications, or

B. Modify administrative rule to reflect current practices and
take measures to ensure consistency of its application
correction service.

Implementation Status

This recommendation is implemented. In March 1996, the
department modified the administrative rules to reflect the practice
of making some corrections to special license applications. A
procedure manual was developed detailing the kinds of corrections
which can be made. The corrections include:

1 . Adding hunter safety certification numbers.

2. Moving valid district choices up to replace invalid choices.

3. Eliminating species choices on those applications that are shon
money when the shortfall is the amount for that species.

4. Adjusting party applications to insure party consistency.

Page 5

Chapter II - Implementation Status

Big Game Drawing Recommendation #5

Process ^^ recommend the Department of Fish, Wildlife and Pariis

document procedures for the Big Game Drawing System process.

Implementation Status

This recommendation is being implemented. The department is in
the process of writing a procedures manual for the drawing processes
for nonresident combination licenses and special drawing licenses.
The manual currently includes procedures addressing:

— application dates and deadlines,

— batching and keying applications,
check and money handling,

edit correction,

— landowner verification,

— duplicate applications,
applications without sufficient funds,
party validation, and

— review of the seven year wait report.

Examples of forms used and reports generated are included in the
manual.

Recommendation #6

We recommend the Department of Fish, Wildlife and Parks
modify procedures so staff no longer handle applications twice
when checking for a certificate of competency for nonresidents
between the age of 12 and 18.

Implementation Status

This recommendation is implemented. If provided by the appli-
cant, licensing staff attach the nonresident hunter education certifi-
cate to the back of the application. The certificate number or issuing
state, if there is no number, is written on the front of the application
and keypunched into the system. An edit occurs when nothing is
entered for that field. Staff review the application to determine why
the field was empty and either correct the error by filling in the

Page 6

Chapter II - Implementation Status

appropriate number or state name, or the application is considered in
error and removed from the database.

Reeommendation #7

We recommend the Department of Fish, Wildlife and Parks:

A. Modify the Seven Year Restriction Report to include
additional applicant information; and

B. Pursue methods to simplify the review process required for
validating parties.

Implementation Status

This recommendation is implemented. The Seven Year Restriction

Report now includes the name and address of the person applying for

the moose, sheep or goat license in the current year and the name,

address and year of the matched person. Staff no longer have to

search through microfiche from previous years to find the matched

person.

An additional Party Validation Error Report was created which
groups records by batch and pany record. Staff now know which
batch to review when a party is in error.

General Controls Recommendation #8

We recommend the Department of Fish, Wildlife and Parks
establish, test and document a formal disaster recovery plan for
the Big Game Drawing System.

Implementation Status

This recommendation is not implemented. The Department of
Administration (Dof A) scheduled a test of the Big Game Drawing
System in May 1997 but Dof A did not test the system. FWP
planned to use the test to help design and document FWP's formal
disaster recovery plan. Since that time, FWP staff responsible for
establishing, testing and documenting a formal disaster recovery plan
left the department before working on a plan. Current staff have not
had time to implement this recommendation.

Page 7

Chapter II - Implementation Status

The automated licensing system (ALS) approved by the 1997
Legislature will eventually include the big game drawing. The
request for proposal for ALS development requires the contractor to
conduct at least aimual disaster recovery drills. In the interim,
department staff have been assigned continued examination and
coordination of disaster recovery work.

Recommendation #9

We recommend the Department of Fish, Wildlife and Parks
assign the duties of security officer to an employee who is not a
department mainframe applications programmer.

Implementation Status

This recommendation is implemented. The person now assigned

security officer duties is responsible for the department's network

operating systems. The person has limited access to the mainframe

computer and is only used as a mainframe programmer in case of an

emergency.

Recommendation #10

We recommend the Department of Fish, Wildlife and Parks

establish procedures:

A. For an independent review of ACF2 reports.

B. To ensure a timely, comprehensive review of ACT2 reports.

Implementation Status

This recommendation Is no longer applicable. Since issuance of
the original report, FWP separated the duties of the security officer
and mainframe programmers, removing an organizational risk. We
also re-evaluated the purpose of the second review and whether
reviewing ACF2 reports provides adequate control over security
officer activities. Our evaluation showed there is no effective way to
track security officer activities. ACF2 reports will not show if a
security officer changed a data set or program for personal gain.

Pages

Chapter II - Implementation Status

Since this issue applies to all agencies, the Legislative Audit Division
will explore this further in its annual Central Reviews audit. At that
time, procedures will be established for auditors to follow when
examining the risks associated with individual agency mainframe
computer applications and the location of security officer position
within each agency.

Recommendation #11

We recommend the Department of Fish, Wildlife and Parks log
access by department technical support staff and the bureau chief
to the on-line error correction and address change screens.

Implementation Status

This recommendation is implemented. Access by department
technical support staff and the bureau chief is now logged when they
use the on-line correction and address change screens.

Recommendation #12

We recommend the Department of Fish, Wildlife and Parks
develop formal policies and procedures for internal evaluations
of security in accordance with state law.

Implementation Status

This recommendation is being implemented. The bureau chief has
developed general categories for needed policies, such as docu-
mentation, software, hardware, asset management, and forms
management. Data processing staff have commented on those
categories and drafts are being written.

Application Controls Recommendation #13

We recommend the Department of Fish, Wildlife and Parks
rectify the problem of the coding not identifying invalid
prerequisite elk license numbers.

Page 9

Chapter II - Implementation Status

Implementation Status

This recommendation is implemented. Until the applicable coding
was found a supplementary program was written which checked for
the appropriate prerequisite elk license numbers. Prior to the 1997
deer, elk and antelope drawing the applicable coding was found and
modified so the main program now checks for appropriate numbers.

Recommendation #14

We recommend the Department of Fish, Wildlife and Parks
establish a formal system for logging permits and licenses in and
out of the cage and the use of the permits or licenses - printed,
voided, used as samples, etc.

Implementation Status

This recommendation is implemented. A notebook was created
containing a page for each type of drawing license/permit issued.
Each page shows the sequence numbers of the forms initially put into
the vault. The person taking the licenses/permits/ tags out of the
vault indicates on the page:

the date the forms were removed,
~ the quantity removed,

— the sequence number of the forms, and

- how the forms were used (printed for a drawing, voided, used
as samples, etc.).

Recommendation #15

We recommend the Department of Fish, Wildlife and Parks
update documentation of the Big Game Drawing System
computer application to reflect the current environment.

Implementation Status

This recommendation is partially implemented. Some changes
were made to program narratives to reflect the current environment,
but more changes are needed. For example, deer and elk narratives
still do not address landowner preference.

Page 10

Chapter II - Implementation Status

Recommendation ffU

We recommend the Department of Fish, Wildlife and Parks
develop a formal system to document, test/review and approve
enhancements to the Big Game Drawing System.

Implementation Status

This recommendation is implemented. Two procedures are used to
document changes to the Big Game Drawing System. Electronic
mail is used for requests with minor changes to the system (requests
for yearly table updates, mailing label printing, etc.). The request
and request's resolution, along with time and date information, are
printed and filed for reference.

An enhancement request form is used for larger enhancements
(legislative mandates, major program changes, etc). This form
requires:

1 . The signature of the person requesting the enhancement and
date requested.

2. The signature of the person completing the enhancement and the
date completed.

3. The signature of the person verifying the enhancement was
completed and the date verified.

Page 11

Page 12

Agency Response

Page 13

Page 14

Hetei

P. O. Box 200701
'na, MT 59620-0701
(406)444-3186
FAX:406-444-4952
Ref:PG0691.97
December 19. 1997
Jim Pelligrini

Deputy Legislative Auditor
Room 135

State Capitol Building
Helena, MT 59620

Dear Mr. Pelligrini:

Thank you for the thorough manner in which the Legislative Auditor's office conducted the original audit
of the Big Game Drawing System, as well as the subsequent follow-up. In addition, we wanted to express
appreciation for your recognition of our commitment to the implementation of your original
recommendations. For those recommendations which you have classified as implemented, in progress (13
of 16), FWP will continue to consider methods for improvement or pursue completion. This response will
focus on those recommendations that you have classified as not implemented.

Recommendation ff 3

We recommend the Department of Fish, Wildlife and Parks seek legislative clarification with respect to

the department's authority to:

L Conduct a landowner preference for deer and antelope permits, and

2. Process applications of those seeking landowner preference differendy than those of the

general public.

Agency Response

This is an issue on which our legal staffs disagree. However, the Fish, Wildlife and Parks Commission
directed the department to implement a comprehensive statewide preference system for the year 200 1 . This
action will require legislative action by the 1999 legislative session. The department will consider
clarifying the statutes to address this audit recommendation at that time.

Recommendation #8

We recommend the Department of Fish, Wildlife and Parks establish, test, and document a formal disaster

recovery plan for the Big Game Drawing System.

Agency Response

Since the original audit report, some preliminary work was done in conjunction with the Information
Services Division (ISD) at the Department of Administration. Any newly created plan for the existing
system would be "interim" because an automated licensing project is underway. This project will
eventually replace the Big Game drawing system. Included within the RFP is a requirement for disaster
recovery planning and testing on the part of the contractor.

Thank you for the opportunity to comment.

Sincerely,

^^AV^fS Vir^ VAr-^ Page 15

Patrick J. Graham
Director

Appendix A

1995 Audit Report Summary

Introduction

Sportsmen wishing to hunt in Montana receive big game hunting
licenses and permits through: 1) over-the-counter purchases, and 2)
special random drawings. Each year the Department of Fish,
Wildlife and Parks (FWP) conducts random drawings for hunting
licenses and permits for moose, sheep, mountain goat, deer, elk and
antelope. This performance audit examined the Big Game Drawing
System. The primary objective of this audit was to determine the
fairness of the big game permit and license drawing process.

Background

Permits and licenses issued through the Big Game Drawing System
must be used in conjunction with a valid resident conservation or
sportsman license, or nonresident conservation or combination
license. To obtain an elk permit through the annual drawing a
resident also needs a valid prerequisite elk license.

Applications Submitted to
FWP

In 1994 over 100,000 people submitted applications for moose,
sheep, goat, deer, elk and antelope licenses and permits.
Approximately 200,000 individual species applications were
submitted for 106,799 licenses or permits.

Applications Processed for
Inclusion in Computer
Database

Computer programs are used to conduct the big game drawings.
The Special Licensing Section, Licensing and Data Processing
Bureau, FWP processes applications for the big game drawings. A
number of manual edits are performed prior to inputting the
information into the computer. Before the database is updated, the
application information is processed through a number of drawing
system edits. If the errors cannot be corrected by section staff the
application information is put in a separate file and the applicant is
refunded a portion of the application fee. Those applications which
are corrected and/or error free are uploaded to the database.

Page S-1

1995 Audit Report Summary

Game Limits Placed on
Certain Applicants

Nonresidents are limited to, but not guaranteed, 10 percent of a
district quota. Up to 15 percent of elk, antelope, deer and deer B
permits in each hunting district are available for residents and
nonresidents claiming landowner preference.

Drawing Conducted

There are a series of four drawings for deer, elk and antelope
permits. The first drawing is for restricted landowner preference.
The second drawing is for the unrestricted landowner preference;
this drawing allows for nonresident landowner selection when all
resident landowners are selected. The restricted regular drawing
follows the two landowner drawings. The unrestricted regular is the
fourth drawing. In this drawing the 10 percent nonresident
restriction is lifted.

There are only two drawings for moose, sheep and goat since there
is no landowner preference for these species. The two drawings are
restricted regular and unrestricted regular.

Is The Drawing For
Licenses And Permits
Fair?

The drawing process has two items which intentionally affect the
"randomness" of the drawing; the landowner preference procedures
and the up to 10 percent nonresident restriction. These items are
based on legislative action and administrative rules.

The computer programs used to conduct the big game drawing
eliminate any "human bias" by relying on random events to select
successful applicants. These are:

1. The selection process, which also assigns drawing numbers to
each person applying for each species.

2. Actual drawing of applicants for licenses and permits using
random numbers.

Page S-2

1995 Audit Report Summary

Conclusion: Computerized
Big Game Drawing is Fair
and Random

The computerized drawing process is fair and random. The
computerized drawing ensures everyone has a unique drawing
number and has an equal chance of selection for a permit or license
within a district for a given choice. The use of database files,
assigning drawing numbers using the database, and the matching of
drawing numbers with randomly generated numbers provides for a
random drawing process.

Procedures Which
Ensure Sportsmen
Compliance

Montana laws, administrative rules and hunting regulations establish
many compliance requirements which relate to the random drawings
for big game hunting permits and licenses. Overall, the process the
department established for reviewing compliance assures sportsmen
adhere to those laws and rules. However, we did identify areas for
improvement related to hunters with revoked privileges and the
landowner preference drawing.

Hunters With Revoked
Privileges

Statutes prohibit a person whose license privileges are forfeited from
applying for a hunting license. Although the department established
a process for identifying persons with revoked privileges who apply
for special licenses or permits, this process could be improved. The
department could conduct an electronic comparison of the Big Game
Drawing System database and Law Enforcement Division database.
Conducting this comparison prior to the special drawings would
ensure permits are not awarded to persons with revoked privileges.

Landowner Preference
Drawing

Applicants must meet, and department staff must monitor, several
requirements related to eligibility for landowner preference.
Controls over landowner preference compliance could be improved.
Currently, compliance monitoring is a joint effort by Special
Licensing Section staff and the department's game wardens.
Discussion with game wardens indicated they are not always able to
complete their review of compliance with landowner preference
provisions. Part of this problem is due to the fact the depanment
must verify landownership rather than the applicant submitting
proof. This makes it a time consuming task. It would be beneficial
for the department to review procedures to determine the most
effective means of reviewing landowner preference claims.

Page S-3

1995 Audit Report Summary

Program Administration

During our review of the Big Game Drawing System, we conducted
a limited review of various aspects of program administration.
Several areas were identified pertaining to administration and
efficiency of operations which could be improved.

Legislative Clarification
Needed for Landowner
Preference

In 1987, the legislature established a preference for landowners in
the special elk permit drawing. This was the first time the
legislature specifically authorized landowner preference. In 1973,
the department created a preference for landowners in the drawings
for antelope, deer and deer B permits through administrative rule.
We believe the department has exceeded its statutory authority in
establishing a preference for landowners in the deer and antelope
drawings. In addition, the administrative rule used by the
department to establish landowner preference for deer and antelope
permits cites a code section which does not clearly grant the
department authority to adopt this rule. It appears the department
adopted an administrative rule without a specific statutory basis.

Other Administrative Rules
Treat Groups of Applicants
Differently

The department processes landowner applications differently than
those of the general public. Department staff review all applications
for errors or omissions. Landowners are then contacted and allowed
to correct their applications. The department established this process
through administrative rule. The general public is not given an
opportunity to correct any errors or omissions. We believe the
department needs statutory authority to process landowners'
applications differently than non-landowners. Nothing in the
sections of law establishing a landowner preference drawing allows
the department to establish different application processing
procedures for landowners.

Department Should Seek
Legislative Clarification

If the department wishes to continue granting preference for
landowners seeking deer and antelope permits, it should seek
legislative clarification of this authority. In addition, if the
department continues the practice of accepting corrections from
applicants seeking landowner preference, the department should seek
legislative clarification of this authority.

Page S-4

1995 Audit Report Summary

Correcting Big Game
Applications

The department established a procedure for correcting some errors
and omissions on applications for licenses and permits. This practice
is contrary to the department's administrative rules \vhich prohibit
corrections or changes to applications once the department receives
them. In addition, the correction service varies between staff
members and is affected by the amount of time available to perform
error correction.

The department should either comply with the administrative rule
prohibiting corrections or change the rule to reflect the department's
current practices. If the department is going to continue its practice
of correcting applications, the department needs to take measures to
ensure a consistent level of service is provided in correcting big
game applications.

Procedure Manual Needed

There is no comprehensive procedure manual relating to
administration and processing of the big game drawings.
Department operations could by enhanced by documenting
procedures for the Big Game Drawing System process.

Nonresident Youth
Applications Handled
Twice

Statutes establish requirements for issuing hunting permits and
licenses to persons between the ages of 12 and 18. Applicants who
fall into this age range must present a certificate of competency for
safe handling of firearms or a bow hunter education course. The
process the department uses to verify compliance with this
requirement could be more efficient. Modifying the application
would reduce the staff time involved in verifying compliance.

Edit Reports Could be
Modified

Department staff use a number of edit reports to monitor compliance
with various provisions governing the special hunting permits and
licenses drawing. Providing additional information on two reports
could make them more useful for department staff. These reports
are used to monitor compliance with: 1) the seven year wait in
applying for a moose, sheep or mountain goat permits, and 2)
applying for antelope or elk permits as a party.

Page S-5

1995 Audit Report Summary

General Controls

We examined computer comrols pertaining to physical security and
electronic access to the big game drawing computer application.
Although some controls need improvement, nothing came to our
attention indicating there were improprieties in the data.

Physical Security Controls

It is FWP's responsibility to ensure a viable and tested recovery plan
is in effect for its big game drawing computer application. FWP
does not have a formal disaster recovery plan. Without a formal
disaster recovery plan, FWP may be unable to process permits,
licenses and refunds resulting from the Big Game Drawing System
should the state's mainframe computer become inoperable.

A disaster recovery plan also ensures system documentation is stored
off-site in case of disaster. At the time of our audit hardcopy
documentation covering all aspects of the drawings were maintained
in a room at the main FWP building in Helena.

The Department of Fish, Wildlife and Parks should establish, test,
and document a formal disaster recovery plan for the Big Game
Drawing System.

Electronic Access Controls

Proper electronic access controls prevent and detect deliberate or
accidental errors caused by improper or unauthorized use or changes
of data and/or programs. FWP uses an access control software
called Access Control Facility-2 (ACF2).

Prior to final ization of the audit the department implemented two
recommendations. Through ACF2 rules, the depanment is now:

1. Controlling files to prevent unauthorized access by FWP
employees who are mainframe users.

2. Logging access to changes in production programs and data by
technical support staff.

Other access controls could be improved in the following areas:

1 . Separating duties of the security officer and programmer
functions.

Page S-6

1995 Audit Report Summary

3.

Establishing procedures for an independent and timely,
comprehensive review of ACF2 reports.

Logging access of department technical support staff and the
bureau chief to the on-line error correction and address change
screens.

4. Developing formal policies and procedures for internal
evaluations of security in accordance with state law.

Applications Controls

We examined input, processing and output controls over Big Game
Drawing System computer applications. System documentation and
enhancement requests were also reviewed. Overall, input,
processing and output controls were in place and functioning.
Although some controls need improvement, nothing came to our
attention indicating there were improprieties in the data.

Input Controls

Four of the five input control areas reviewed are in place and
functioning so as to provide assurance:

1 . Only properly authorized and approved information is input.

2. Conversion of data to the mainframe computer, and thus to a
machine-sensible form, is controlled.

3. Movement of data to the data entry vendor and the mainframe
is controlled.

4. Errors detected by the application system and the resubmission
of corrected transactions are reviewed and controlled.

We found edits which check for a correct prerequisite elk license
number were not functioning properly and need to be tested.

Processing Controls

The two processing control areas reviewed are in place and
functioning so as to provide assurance:

1 . All valid applications are processed and the same applications
are not processed more than once.

2. Unreasonable input is not processed.

Page S-7

1995 Audit Report Summary

Output Controls

The two output control areas reviewed are in place and functioning
so as to provide assurance:

1 . The correct number of applications were processed and all
permits or licenses were printed.

2. Output is distributed to successful applicants and district
offices.

Controls Over Permit and
License Stock

Big game drawing permit and license stock is maintained in a locked
cage in the main FWP building. One person controls the key to the
cage and a limited number of people are allowed to remove stock
from the cage. When stock is removed the permit or license
sequence numbers and reason for removal are recorded in a
stenographer book. At year's end notes in the book are typed and
eventually destroyed.

We compared the 1994 typed log to the number of successful
applicants in the big game drawings. The log indicated stock for 13
more antelope permits were printed than there were successful
applicants, and stock for five less deer B permits were printed than
successful applicants. The typed list did not show any stock used for
3,672 applicants recorded as successful for A-7 elk permits.

We believe a permanent log book maintained in the cage, and a
yearly reconciliation of stock used to the number of permits and
licenses printed would alleviate the types of problems noted above.

System Documentation

Documentation of a computer system should reflect the working
environment. Documentation for the Big Game Drawing System
was created about 1980. During our review of system narrative and
programming it was sometimes difficult to determine how the system
actually operated. Anyone else trying to learn the system would
have the same problems, especially if the current programmer is not
available to help answer questions and explain procedures. For
example, currently there is no documentation of the random number
generator subroutine used in the drawing.

Page S-8

1995 Audit Report Summary

We believe FWP should update documentation of the Big Game
Drawing System computer application to reflect the current
environment.

Enhancement Requests Changes are made to the Big Game Drawing System each year.

These system changes were not always documented well in the
program. These include changing sequence numbers of valid
licenses, some district information for specific species, valid
birthdates, etc. Changes in legislation also require changes in
program code. There is no formal system for changes to be
requested, made and verified. Notes and memos are routed to
programming staff who then make changes. There is no formal
system to ensure appropriate changes were made or made in a timely
manner.

Enhancements requests to a computer system should be formally
documented. Changes should be tested/reviewed and approved by
the requestor prior to being moved into production. Changes should
also be documented within the program and hardcopy
documentation.

Page S-9

l'^

-J