Audit Report on the Development and Implementation of the Police Department’s Domestic Violence Tracking System

EXECUTIVE SUMMARY

In 1994, the Mayor created the Commission to Combat Family Violenceto ensure that government agencies and other organizations work together to effectively address and respond to domestic violence. Currently, 75 of the City’s 76 police precincts have officers and investigators who deal specifically with domestic violence incidents and its prevention.

The NYPD hired Information Builders Inc. (IBI) in 1998 to upgrade its existing FoxPro application at a cost of $1,170,770. The FoxPro system handled 500,000 Domestic Violence cases, but FoxPro did not allow each precinct to view the cases of all other precincts. IBI upgraded FoxPro to a centralized database known as the Domestic Violence Tracking System (DVTS). DVTS is an online, Internet-accessed system that is designed to assist NYPD officers in effectively addressing and responding to domestic violence situations by capturing information from Domestic Violence Incident Reports.

Our audit objectives were to determine whether the NYPD followed a structured methodology when it upgraded its FoxPro application to create the DVTS system, whether DVTS allows for future enhancements and upgrades, and whether DVTS meets user needs and whether users are satisfied with the system.

Our fieldwork was conducted from March 2002 to June 2002. We reviewed and analyzed DVTS, including: task orders; project documentation; financial documentation; satisfaction reports and acceptance and completion documentation; user reports, user listings, and a user guide. In addition, we interviewed NYPD officials, verified whether the system met specifications, and conducted a user satisfaction survey.

We used the Comptroller’s Internal Control and Accountability Directive 18, Guidelines for the Management, Protection and Control of Agency Information and Information Processing Systems (Directive 18), as the criterion for this audit. As the City does not have a formal System Development Methodology, we also used the National Institute of Standards and Technology Special Publication #500-233, A Framework for the Development and Assurance of High Integrity Software (NIST), to assess whether a system development methodology had been followed.

The audit was conducted in accordance with generally accepted government auditing standards (GAGAS) and included tests of the records and other auditing procedures considered necessary. This audit was performed in accordance with the City Comptroller’s audit responsibilities as set forth in Chapter 5, § 93, of the New York City Charter.

DVTS allows for future enhancements and periodic upgrades. However, our user satisfaction survey indicated that approximately 80 percent of users who responded to our survey would like to see changes made to the system. In addition, all needed components of the system were not provided or developed. Further, the NYPD did not have an independent quality assurance individual throughout the development of DVTS. Finally, the NYPD does not ensure that inactive users are eliminated from the system, nor does it have a complete, formally approved Disaster Recovery Plan for DVTS.

The audit resulted in six recommendations, which are listed below.

The NYPD should:

• Ensure that IBI completes and meets all requirements according to contract terms. The NYPD should also ensure that tasks assigned to its project members are completed.
• Obtain a quality assurance individual to review future system changes and enhancements.
• Meet with system users to ensure that the problems identified in this report are resolved.
• Develop formal security policies and procedures for DVTS that comply with Directive 18.
• Eliminate inactive users, as required by Directive 18.
• Develop a formal Disaster Recovery Plan for DVTS and ensure that it is tested in accordance with Directive 18.

The matters covered in this report were discussed with officials from the NYPD during and at the conclusion of this audit. A preliminary draft was sent to NYPD officials and discussed at an exit conference held on June 18, 2002. On June 19, 2002, we submitted a draft report to NYPD officials with a request for comments. We received a written response from the NYPD on July 3, 2002. The NYPD agreed with the audit’s six recommendations, stating that it had already been addressing the matters contained in four recommendations before the audit began and that it would implement the two remaining recommendations.