Louisiana Citizens Property Insurance Corp., the state-run insurer of last resort for about 130,000 policyholders, failed to control access to its computer systems and may have violated state law by not having contracts in place when it hired two information technology consultants in 2008, according to a state audit.

The findings are contained in a 107-page audit of Citizens procedures and books for 2008 released on Monday. The audit is expected to be discussed at the Legislative Audit Advisory Council’s February meeting, said temporary Legislative Auditor Daryl Purpera.

The council is made up of House and Senate members who oversee enforcement and compliance of audits.

“This was in 2008 and now this is 2010,” Citizens President John Wortman said. He said many management changes have been instituted since auditors’ findings for 2008 were compiled.

Purpera and his staff of auditors said internal controls of Citizens information systems and accounting records “contained major inadequacies. . .(and) made it impractical to apply sufficient auditing procedures to enable us to express an opinion on the fair representation” of Citizens financial condition.

Wortman said things have improved since auditors looked at the books and practices of the company two years ago.

The audit said that Citizens granted employees, some non-employees and two fired employees “excessive, inappropriate access” to the computer program that could allow users to “make changes to critical data, exposing Citizens to potential error and fraud.” The systems tracked policies and claims-processing.

“It is opened up so much we don’t have reliance on the system,” Purpera said.

The audit said that as recently as May 2009, there were 137 “active user IDs” with access to Citizens policies and other key documents and 77 belonged to Citizens employees. Some belonged to contractors, former employees and some employees of the Property Insurance Association of Louisiana, an organization that managed Citizens until 2008.

“The risk of error or fraud increases” as more individuals have access to the system, the audit said.

Wortman said he has restricted access to the system and is in the process of getting a new computer system. He said that after the hurricanes in 2005, external consultants as well as Citizens employees had access to the systems to help reconcile bank accounts. He said there will be a systems administrator and written guidelines for access “by the first quarter of 2010.”

The audit also said that Citizens did not have contracts in place in 2008 for two providers of information technology companies hired at a combined cost of more than $3 million. The services were provided between January 2008 and May 2009.

“Without valid contracts, Citizens exposes itself to a lack of recourse if vendors do not perform or perform improperly and reduces vendor accountability,” the audit said. Signed contracts will be in place shortly or have already been signed, Wortman said.

The audit claimed Citizens did not follow state law to ensure that all applicants for the state-run coverage were eligible. The audit said that out of a sample of 35 applications for coverage, 34 applicants did not say if they had applied to traditional insurers and been rejected as state law requires.

Wortman said the existing computer policy management system does not have the ability to monitor if an applicant is eligible for Citizens coverage by being denied other coverage first, but a new program to be installed by the spring “will prohibit the issuance of new policies to property owners \that have not been denied coverage by another insurance company.”

The audit also said Citizens did not follow procedure in allowing private companies to take policies out of Citizens pool on a random, geographic basis.

Instead, the audit alleged, the company did not bundle the best and worse policies statewide but allowed the private companies to “selectively determine” which polices they wanted to take.

It said one of the companies was not qualified because it “was not admitted to write policies in Louisiana and a second company did not have the financial rating to do so.

Wortman admitted that the two questioned companies were allowed to participate but said he felt Citizens did not violate the law because there is a conflict in the statutes involved.

He said Citizens is working on a bill for the session to resolve the differences in the laws. The legislative session opens March 29.

Found here.