The Legislative Audit Bureau makes 21 recommendations to State of Wisconsin Agencies.

We recommend the Wisconsin Department of Administration:  

1. report to the Joint Legislative Audit Committee by March 31, 2025; June 30, 2025; September 30, 2025; and December 30, 2025, on the status of its efforts to monitor agency compliance with the State of Wisconsin IT Security Policy Handbook and related standards; (p. 9)
2. ensure the errors noted are fully identified and corrected in STAR; (p. 34)
3. correct the errors on the Monthly Statement of Receipts and Disbursements by Fund, and communicate with affected participants in the State Investment Fund; (p. 34)
4. evaluate the effect of the error on the distribution of interest earnings of the State Investment Fund, correct the distribution of interest earnings to each statutory fund, and communicate with affected participants in the State Investment Fund; (p. 34)
5. assess the revised procedures for review of STAR configuration changes to ensure they will adequately address the risks with potential configuration errors; (p. 34)
6. update current procedures for the preparation of the monthly reconciliation of cash balances between the bank records and the State’s accounting records to ensure all bank accounts for which the Department of Administration is responsible are reconciled and that reconciliations are documented; (p. 34)
7. correct and document the process for supervisory review of the monthly reconciliation of cash balances between the bank records and the State’s accounting records, including a supervisory sign off and review date; (p. 34)
8. correct the presentation of General Fund fund balance as of June 30, 2024, to reflect the $135.4 million of CSLFRF interest earnings as Fund Balance—Unassigned; and (p. 38)
9. review its existing procedures for financial reporting to ensure amounts are appropriately classified within fund balance. (p. 38) 

We again recommend the Wisconsin Department of Administration:

10. record the interest earnings on CSLFRF funding as general purpose revenues subject to future appropriation; and (p. 16)
11.  continue to work with the State Controller’s Office to complete the updates to the Wisconsin Accounting Manual to provide guidance regarding how to record interest earnings on federal grant programs. (p. 16)

We recommend the Department of Administration, Division of Enterprise Technology:

12. complete access reviews for DOA and DOA-managed active directory accounts by December 30, 2024, in accordance with DOA procedures, including updating access based on the review and retaining documentation of the review and the updates made to access; (p. 25)
13. complete access reviews for mainframe accounts by June 30, 2025, in accordance with DOA procedures, including updating access based on the review and retaining documentation of the review and the updates made to access; (p. 25)
14. establish a detailed plan by December 30, 2024, on how it will complete access reviews for all other types of accounts in accordance with DOA procedures, including updating access based on the review and retaining documentation of the review and the updates made to access; (p. 25)
15. update existing access review procedures by December 30, 2024, to include a process for managing the intake of access reviews and an escalation process; (p. 25)
16. obtain and document by December 30, 2024, its review of the agency-specific exception documentation plans for the 73 controls that pose the highest risk if not implemented; and (p. 28)
17. develop and execute a strategy for identifying and reviewing agency-specific exception documentation for other controls. (p. 28)

We recommend the Wisconsin Department of Administration, Division of Enterprise Technology comply with its statutory responsibilities to provide oversight and monitoring of executive branch agency adherence to the State’s IT policies by:

18. documenting its assessment of agency-reported information by February 28, 2025, for controls that pose a higher risk if not implemented; and (p. 31)
19. documenting by April 30, 2025, its evaluation of the risks related to approved policy exceptions, vulnerability assessments, and penetration tests. (p. 31)

We recommend the Wisconsin Department of Transportation:

20. update its infrastructure analysis procedures to ensure that data used in its analysis of infrastructure projects are complete; and (p. 36)
21. update its procedures for preparing adjusting journal entries to accrue mass transit operating assistance payments. (p. 36)