On this page:

• I. Data in the System
• II. Access to the Data
• III. Attributes of the Data
• IV. Maintenance of Administrative Controls

I. Data in the System

1. Generally describe what data/information will be collected in the system.

   OIG AutoAudit is used by the EPA Office of Inspector General to house audit workpapers prepared for the EPA Financial Statement Audit and other financial audit initiatives. Audit workpapers usually do not contain privacy information, but files attached to them may contain data from EPA's People Plus Payroll system, EPA's Travel Manager system or other systems containing privacy data.

   The OIG has two versions of AutoAudit. One version tracks performance audits and EPA program evaluations and the other version tracks financial audits. EPA's Annual Financial Statement Audit and other financial audits are produced and stored on the financial Auto Audit version. This PIA specifically addresses the AutoAudit module that is used to house financial audit workpapers. The system is used by the Office of Audit, OIG and access is limited to auditors and other OIG staff with a specific need to create, access, update and approve workpapers during financial audit life cycles.

   Workpapers may contain a variety of information including:

   While it is rare that workpapers directly contain privacy data, there is a possibility that privacy data could be placed in a workpaper. It is more likely that data files attached to a workpaper or referenced by a workpaper will contain privacy data that should be protected. This is especially true during financial audits that involve payroll, travel, training, employee leave and other transactions dealing with "personal" transactions processed for business purposes. Privacy data is not used as search keys in this system.

   1. interviews with staff members in offices being audited
   2. documented evidence of specific administrative actions
   3. documents that support financial transaction processing

2. What are the sources and types of the information in the system?

   Workpapers are generated by auditors working on the financial audits. Documentation of management activities, financial transactions and other evidence are attached to workpapers as evidence of program activity. Documents resulting from interviews and analysis of processes are generated by the OIG auditors assigned to the project. Data files or sub sets of data are sometimes attached to workpapers as evidentiary material. The data files used for the financial statement audit and other audits are from EPA financial systems and may include part or in whole the following systems:

   The systems above are EPA systems that contain privacy information of a financial nature.

   • Integrated Financial Management System (IFMS)
   • People Plus and/or DFAS payroll transaction
   • Travel Manager System
   • Financial Data Warehouse
   • Personnel Systems
   • Other financial data systems that are deemed appropriate for audit and may contain privacy data.

3. How will the data be used by the Agency?

   The OIG uses this information to conduct required Federal financial audits including an annual financial statement audit to render an opinion as to EPA's financial condition. The EPA works closely with the OIG auditors to put together the financial statements and perform the necessary audits.

4. Why is the information being collected? (Purpose)

   The OIG collects this information to perform its financial audit responsibility as outlined in the 1987 Inspector General Act and as outlined in various Federal regulations, policies, procedures and circulars.

Top of Page

II. Access to the Data

1. Who will have access to the data/information in the system (internal and external parties)? If contractors, are the Federal Acquisition Regulations (FAR) clauses included in the contract (24.104 Contract clauses; 52.224-1 Privacy Act Notification; and 52.224-2 Privacy Act)?

   Only authorized OIG financial auditors, their managers and supervisors will have access to the AutoAudit workpapers and accompanying documents.

2. What controls are in place to prevent the misuse of data by those having authorized access?

   All OIG auditors and those staff working for the OIG have security clearances at least to the confidential level. In addition the OIG has adopted EPA's interim policy for access to Personal Identifiable Information (PII) that includes the requirement that the OIG's Senior Information Officer (SIO) grant authority for access to systems that contain privacy data.

3. Do other systems share data or have access to data/information in this system? If yes, explain who will be responsible for protecting the privacy rights of the individuals affected by the interface? (i.e., System Administrators, System Developers, System Managers)

   No. AutoAudit is for OIG audit purposes only. No workpapers or data is shared with other systems.

4. Will other agencies, state or local governments share data/information or have access to data in this system? (Includes any entity external to EPA.)

   No.

5. Do individuals have the opportunity to decline to provide information or to consent to particular uses of the information? If yes, how is notice given to the individual? (Privacy policies must clearly explain where the collection or sharing of certain information may be optional and provide users a mechanism to assert any preference to withhold information or prohibit secondary use.)

   No. OIG staff members are required to create workpapers to support audit findings and outcomes. The 1987 Inspector General Act as amended, requires that Federal Agencies and Departments give Inspectors General auditors access to documents and files that are required to complete audit requirements.

Top of Page

III. Attributes of the Data

1. Explain how the use of the data is both relevant and necessary to the purpose for which the system is being designed.

   The data in AutoAudit is used to support audit findings in the annual EPA Financial Statement Audit and other financial audits. AutoAudit is used as a tool for meeting all legally mandated reporting requirements to the U. S. Congress, White House and the Office of Management and Budget (OMB).

2. If data are being consolidated, what controls are in place to protect the data from unauthorized access or use? Explain.

   Data is not consolidated.

3. If processes are being consolidated, are the proper controls remaining in place to protect the data and prevent unauthorized access? Explain.

   Processes are not being consolidated.

4. How will data be retrieved? Can it be retrieved by personal identifier? If yes, explain. (A personal identifier is a name, Social Security Number, or other identifying symbol assigned to an individual, i.e. any identifier unique to an individual.)

   Data in AutoAudit is not retrieved by personal identifier data fields. This data may contain SSN and other personal identifiers but those data fields are not used as search keys to access or retrieve the data.

5. What achievements of goals for machine readability have been incorporated into this system? Where is the policy stated? (Machine readable technology enables visitors to easily identify privacy policies and make an informed choice about whether to conduct business with that site.)

   AutoAudit is not web enabled.

Top of Page

IV. Maintenance of Administrative Controls

1. Has a record control schedule been issued for the records in the system? If so, provide the schedule number. What are the retention periods for records in this system? What are the procedures for eliminating the records at the end of the retention period? (You may check with the record liaison officer (RLO) for your AA-ship, Tammy Boulware (Headquarters Records Officer) or Judy Hutt, Agency Privacy Act Officer, to determine if there is a retention schedule for the subject records.)

   Yes. EPA Records Schedule 700 EPA Audit Case Files

   See the following web link for the AutoAudit Record Control Schedule.

   http://www.epa.gov/records/policy/schedule/sched/700.htm

2. While the data are retained in the system, what are the requirements for determining if the data are still sufficiently accurate, relevant, timely, and complete to ensure fairness in making determinations?

   The AutoAudit workpapers are reviewed and approved by each OIG project manager and assignment manger for correctness, completion and accuracy. The Product Line Director performs a cursory review of indexed workpapers before the workpapers are referenced. Each workpaper requires that the approver state that they have reviewed the workpaper and the reviewer is required to sign off on the approval of the workpaper.

3. Will this system provide the capability to identify, locate, and monitor individuals? If yes, explain.

   Files attached to workpapers may contain privacy data. However, the system does not allow access to data using privacy data as keys for searches.

4. Does the system use any persistent tracking technologies?

   No, this system is not webbed based and does not use cookies or other persistent tracking technologies.

5. Under which System of Records (SOR) notice does the system operate? Provide the name of the system and its SOR number if applicable. For reference, please view this list of Agency SORs. (A SOR is any collection of records under the control of the Agency in which the data is retrieved by a personal identifier. The Privacy Act Officer will determine if a SOR is necessary for your system.)

   OIG AutoAudit - System of Record Notice: EPA-50.

Top of Page