UT Internal Audit Report

OFFICE OF INTERNAL AUDITS
THE UNIVERSITY OF TEXAS AT AUSTIN
P.O. Box 7938 · Austin, Texas 78713-7938
(512) 471-7117 · FAX (512) 471-8099

November 19, 2002

Dr. Larry R. Faulkner, President
University of Texas at Austin
Office of the President
P.O. Box T
Austin, Texas 78713

Dear Dr. Faulkner,

At the request of the Registrar’s Office, we recently assessed controls related to the UT Austin Internet Electronic Data Interchange (EDI) Service offered at no charge to other institutions. This service allows other institutions to register with the Registrar’s internet server to use our system as a “pass through” in transmitting transcripts, test scores and other academic records across the internet to other registered institutions. Based on discussions with staff, review of applicable documentation, and review and testing of software, system files and registration tables, we conclude that reasonable measures have been implemented to ensure the security and integrity of data entrusted to the University for electronic delivery to other institutions, with one exception. Specifically, encryption of student transcript and test score information is offered as an option to registered institutions. Our review of the registration table revealed that a large number of institutions do not use this option. The Registrar’s Office should continue to advise all participants of risks associated with transmitting student records in clear text, strongly encourage the use of encryption by receiving institutions, and develop a plan for converting receiving institutions to encrypted transmissions. We have communicated these recommendations to Registrar’s Office staff, and understand that a phased approach may be necessary because of limited technical support available at many participating institutions.

We appreciated the cooperation and assistance of Registrar’s Office personnel involved in this limited scope review. We hope that the information presented herein is beneficial.

Sincerely,
Lon S. Heuer, CPA, CIA
Director