Press Release  Auditor Bump Recommends Steps to Improve IT Practices at MassDOT Aeronautics Division

Boston — Auditor Suzanne M. Bump, in an audit released today, provided recommendations to the Massachusetts Department of Transportation (MassDOT) Aeronautics Division to improve its protocols related to IT project management, governance, and security.

The audit found that ineffective project management resulted in the Aeronautics Division abandoning a recently developed web-based application that facilitates the management of facility information, projects and grants and other activity data across the MassDOT system, because it did not meet the Divisions’ business needs. The Aeronautics Division spent over $650,000 developing the application. The audit pointed to a lack of expertise in IT project management as the cause of the deficiencies. In its response, the Division noted that it is in the process of developing a replacement software application, and using an experienced project manager and business analyst to guide the development.

“Technology plays a vital role in the work of government, but agencies often have difficulty getting systems to actually fit their needs. This audit showed that, like many state government agencies, the Massachusetts Department of Transportation’s Aeronautics Division is struggling to successfully integrate technology into its work,” Bump said of the audit. “I commend the Aeronautics Division for taking quick action to address the problems identified in this audit, and urge them to take steps to ensure additional tax dollars are not wasted.”

Additionally, the audit noted several IT security weaknesses in the Aeronautics Division. The audit found that no employee of the Division had received required security-awareness training. It also found many users of the application had security permissions that allowed them to access and alter information that they had no business need to alter. This could have resulted in inappropriate and unauthorized alteration of information.

Finally, the audit found deficiencies identified in a previous audit remain. The Aeronautics Division has not developed, documented, and tested a plan to ensure is operations could continue in the event of a business interruption.

The audit was conducted as part of Bump’s efforts to ensure state government entities keep pace with technological innovation.

The audit released to the public is abridged because of the sensitivity of the information contained in the full audit. Consistent with government auditing standards and the Massachusetts public records law, only the Aeronautics Division will receive a full, unabridged copy of the report.

The Aeronautics Division has jurisdiction over 36 of the Commonwealth’s 39 public-use airports.

The audit of the Massachusetts Department of Transportation Aeronautics Division—Information Technology is available here.

###