AUDIT OF RTC MORTGAGE TRUST 1995-SN1

March 14, 2001Audit Report No. 01-007Audit of the FDIC’s InformationTechnology Risk Management ProgramTABLE OF CONTENTSBACKGROUND 1OBJECTIVE, SCOPE, AND METHODOLOGY 3RESULTS OF AUDIT 4PROGRAM SUPPORT NEEDS TO BE ENHANCED 6SAQs AND RELATED PROCEDURES CAN BE ENHANCED 7ENHANCED PROCEDURES CAN PRODUCE MORE EFFECTIVE ISRs 9IMPROVED CONTRACTOR OVERSIGHT CAN ENHANCETHE ISR PROCESS 11CORRECTIVE ACTION PROGRAM NEEDS TO BE IMPLEMENTED 12INVOLVEMENT OF ISS DURING APPLICATION DEVELOPMENTIS CRITICAL TO AN EFFECTIVE IT RISK MANAGEMENT PROGRAM 13 CONCLUSION 14CORPORATION COMMENTS AND OIG EVALUATION 14FIGURESFigure 1: Risk Management Process for Applications 3APPENDIX I – CORPORATION COMMENTS 15APPENDIX II – MANAGEMENT RESPONSES TO RECOMMENDATIONS 18 Federal Deposit Insurance Corporation Office of Audits Washington, D.C. 20434 Office of Inspector GeneralDATE: March 14, 2001TO: Donald C. Demitros, Chief Information Officer andDirector, Division of Information Resources ManagementFROM: David H. LoewensteinAssistant Inspector GeneralSUBJECT: Audit of the FDIC’s Information Technology Risk Management Program(Audit Report Number 01-007)The FDIC’s Office of Inspector General (OIG) has completed an audit of the FDIC’s InformationTechnology Risk Management Program. The FDIC initiated this program in 1997 to comply withfederal ...