Audit of USAID User Profiles for Applications Hosted by the National Finance Center

The audit aimed to determine whether USAID implemented selected controls over security profiles for users who access applications hosted by the National Finance Center on a need-to-know basis in accordance with the principle of least privilege. USAID entered into an agreement with the U.S. Department of Agriculture's National Finance Center in October 2000 for NFC to perform payroll and reporting services. NFC serves more than 170 agencies and provides payroll services to over 650,000 federal employees. The services provided by NFC to USAID include payroll processing, payroll accounting, salary payment processing services, payroll policy support services, tax reporting services, reporting services, shared service coordination with the Office of Personnel Management, information technology services, and information technology security services. To process its payroll, USAID has several applications that electronically submit payroll and personnel data to NFC's PowerTerm InterConnect application. These applications include Human Resource Connect and WebTA, which contain sensitive personally identifiable information, including Social Security numbers and employee banking information. The Office of Human Resources at USAID has staff and contractors who have access to PowerTerm and the Entry, Processing, Inquiry, and Correction (EPIC) system. The audit concluded that USAID had not implemented selected controls over security profiles for users who access applications hosted by NFC on a need-to-know basis in accordance with the principle of least privilege. The Office of Inspector General made six recommendations to help USAID strengthen its administration over the Agency's access to NFC's payroll applications. USAID made management decisions on all recommendations, indicating that the Agency will take steps to address the identified issues.