11. For each material service organization (MSO) the entity uses to provide contracted program or support services, does management obtain an understanding of (i.e., review and/or monitor) the following items? (See definition on page 35.) The data management policies and processes related to financial management systems. Internal controls. Data confidentiality and security. Data backups. Recovery for client data or system applications. 12. Does management periodically test to make certain each MSO’s data management policies and processes are operating as required to provide contracted services? If yes, indicate date last test was performed. B. Data Backup 13. Has the entity identified important computer data files related to the organization’s records that are necessary to provide program services? 14. Does the entity have a procedure in place to perform regular computer file backups? 15. Does management periodically review or monitor the entity’s backup policies and processes to address new issues or changes in entity operations (e.g., updates to computer programs, new programs, discontinued programs, new reporting requirements)? If yes, indicate date last review was performed. 16. Does management periodically review to verify is performing back-up procedures? If yes, indicate date last review was performed. 17. Does the entity periodically test and restore the backup to ensure the backup files work? If yes, indicate date last test was performed. C. Disaster Recovery
11. For each material service organization (MSO) the entity uses to provide contracted program or support services, does management obtain an understanding of (i.e., review and/or monitor) the following items? (See definition on page 35.) The data management policies and processes related to financial management systems. Internal controls. Data confidentiality and security. Data backups. Recovery for client data or system applications. 12. Does management periodically test to make certain each MSO’s data management policies and processes are operating as required to provide contracted services? If yes, indicate date last test was performed. B. Data Backup 13. Has the entity identified important computer data files related to the organization’s records that are necessary to provide program services? 14. Does the entity have a procedure in place to perform regular computer file backups? 15. Does management periodically review or monitor the entity’s backup policies and processes to address new issues or changes in entity operations (e.g., updates to computer programs, new programs, discontinued programs, new reporting requirements)? If yes, indicate date last review was performed. 16. Does management periodically review to verify is performing back-up procedures? If yes, indicate date last review was performed. 17. Does the entity periodically test and restore the backup to ensure the backup files work? If yes, indicate date last test was performed. C. Disaster Recovery
E-OEL-2016-17-Internal-Control-Questionnaire-vF07-15-16-ATTACH.docx