After audit, Michigan child support system will review vendor access quarterly, require confidentiality agreements

Michigan Auditor General Doug Ringler found good news and bad news in a performance audit of the Child Support Disbursement Unit within the state Department of Health and Human Services. While the disbursement unit goes a great job of getting child support monies to parents who are due them, the vendor it hired could improve by tightening its confidentiality arrangements and limiting system access.

In 99% of payments sampled by the auditor, disbursements were timely, made within two days. Over a three-year timespan, between May 31, 2018, and June 1, 2021, Michigan’s child support system processed nearly 28 million payments, for $4.1 billion. That’s a lot of money, and it usually reaches the person it’s meant for in a timely fashion. Good.

Not so good news came when the auditor looked at who had access to the computer systems that process these payments. Confidentiality agreements were lacking for 14% of users sampled. And 18% of users sampled were assigned roles that were in conflict with one another.

And 14% of users sampled had system access beyond what was needed for their jobs. This violates the principle of least privilege, per the auditor. Under that principle, each user should have only the system access necessary to do the job.

Semiannual reviews were not conducted to ensure the principle of least privilege was upheld, the auditor found. The state requires semiannual reviews from contractors.

Michigan’s Office of Child Support described the lack of confidentiality agreements as an oversight, the audit reports, and said it relied on the vendor to ensure appropriate access. The audit recommends that the state, not the contractor, monitor these controls.

The Michigan Department of Health and Human Services, which oversees the child support system, agreed.