John Keel, CPA
State Auditor

An Audit Report on

The Criminal Justice Information System at
the Department of Public Safety and
the Texas Department of Criminal Justice
September 2011
Report No. 12-002

An Audit Report on

The Criminal Justice Information System
at the Department of Public Safety and
the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011

Overall Conclusion
The Department of Public Safety (DPS) and the
Texas Department of Criminal Justice (TDCJ)
have improved the quality of data in the
Criminal Justice Information System (CJIS) since
the State Auditor’s Office’s February 2006 audit
of CJIS. 1 However, DPS should make additional
improvements to the completeness of its
criminal history records.
This audit focused on DPS’s Computerized
Criminal History System and TDCJ’s Corrections
Tracking System, which are two components of
CJIS (see text box for details).

Background Information
The Criminal Justice Information
System (CJIS) includes information
systems at two state agencies:

 The Department of Public Safety

(DPS) maintains the Computerized
Criminal History System, a database
of criminal records in Texas that
includes:

 Arrest records that police

departments, sheriff’s offices,
and other law enforcement
agencies submit when an
individual is arrested.

 Prosecutor records that district

DPS’s Computerized Criminal History System

and county attorney offices
submit. Those records include
offenses and charges that each
attorney is pursuing for each
defendant.

As of January 2011, prosecutor offices and
 Records that county, district, and
other courts submit. Those
courts had submitted disposition records to the
records include conviction
Computerized Criminal History System for 73.68
decisions and sentencing
percent of arrests made in 2009. That is an
information.
improvement from the 71.00 percent submission
 The Texas Department of Criminal
Justice (TDCJ) maintains the
rate the State Auditor’s Office audit reported in
Corrections Tracking System, a
2
February 2006. However, the 73.68 percent
collection of databases with records
on offenders in state jail, in prison,
submission rate indicates that data in DPS’s
on parole, on probation, and in
Computerized Criminal History System is not
other offender programs.
complete, and users may not receive a reliable
Texas Code of Criminal Procedure,
result from criminal history background checks
Chapter 60, established CJIS and
defines the types of information that it
that are conducted based on the data in that
contains.
system. DPS also should improve the timeliness
Source: DPS, TDCJ, and the Texas Code
and accuracy of the data in its Computerized
of Criminal Procedure.
Criminal History System. It is important to note
that DPS does not have authorization to take
administrative action to penalize criminal
justice agencies that do not submit criminal records.

1

See An Audit Report on the Criminal Justice Information System, State Auditor’s Office Report No. 06-022, February 2006.

2

Auditors’ calculation of the submission rate did not include the submission of juvenile arrests or dispositions; the submission
rate for that information averaged 82.71 percent in January 2011.
This audit was conducted in accordance with Texas Code of Criminal Procedure, Article 60.02.
For more information regarding this report, please contact Nicole Guerrero, Audit Manager, or John Keel, State Auditor, at (512) 9369500.

An Audit Report on
The Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002

A significant number of prosecutor and court records are not reported to DPS,
which impairs the quality of information that DPS uses to conduct criminal history
background checks. For example, 1,634 (7.65 percent) of 21,351 offenders whom
TDCJ admitted to jail, prison, or probation in November 2010 did not have
corresponding prosecutor and court records in DPS’s Computerized Criminal History
System. In addition, information that DPS provides as part of its criminal history
background checks does not include probation records.
DPS also should strengthen controls to ensure that only authorized users can access
and modify records in its Computerized Criminal History System.
TDCJ’s Corrections Tracking System
While TDCJ has made improvements to its records of offenders on probation, more
improvements are needed to ensure that data in TDCJ’s Corrections Tracking
System is complete, accurate, and up to date. Specifically, some records do not
have a state identification number or an arrest incident number as required by the
Texas Code of Criminal Procedure, Section 60.052. Additionally, users at local
probation departments in 120 (47.24 percent) of the 254 counties in Texas do not
view arrest records associated with the notifications that TDCJ sends to them when
an offender on probation or parole is arrested.
TDCJ also should strengthen controls to ensure that only authorized users can
access and modify records in the Corrections Tracking System.
Auditors communicated other, less significant issues to DPS and TDCJ management
separately in writing.

Summary of Management’s Response
DPS and TDCJ agreed with the recommendations in this report.

Summary of Objective, Scope, and Methodology
The audit objective was to determine whether controls over CJIS provide
reasonable assurance that data in the system is complete, accurate, and up to
date.
The audit scope included data in CJIS from September 1, 2009, through November
30, 2010, as well as system controls. The period of review for access and general
controls of the Computerized Criminal History System at DPS and the Corrections
Tracking System at TDCJ was from March 2011 through July 2011.
The audit methodology consisted of reviewing the process for collecting criminal
records at DPS and TDCJ; analyzing performance reports that DPS uses to

ii

An Audit Report on
The Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002

determine the completeness of criminal records; analyzing error reports,
correction logs, and compliance reports from key systems at both DPS and TDCJ;
reviewing the flash notice system; assessing the CJIS information technology
control environment and relevant subsystems; and visiting users at criminal justice
agencies that submit data to CJIS. Auditors determined that the completeness and
accuracy of data in CJIS should be improved before users can more fully rely on
CJIS data when conducting criminal history background checks. Appendix 1 of this
report presents detailed information on the methodology that auditors used to
assess the reliability of information in CJIS.

iii

Contents
Detailed Results
Chapter 1

DPS and TDCJ Should Improve the Completeness of Their
Portions of the Criminal Justice Information System ............ 1
Chapter 2

TDCJ and DPS Should Improve the Distribution and
Timeliness of Criminal History Information...................... 10
Chapter 3

DPS and TDCJ Should Improve the Accuracy of Criminal
History Information That Criminal Justice Agencies
Submit................................................................. 14
Chapter 4

DPS and TDCJ Should Strengthen Certain Information
Technology Controls ................................................ 18

Appendices
Appendix 1

Objective, Scope, and Methodology .............................. 25
Appendix 2

Criminal Justice Agencies That Auditors Visited ................ 29
Appendix 3

Counties That Did Not Submit Dispositions Associated
with Fiscal Year 2009 Arrests ...................................... 30
Appendix 4

Counties That Did Not Submit Dispositions for TDCJ
Admissions in November 2010 ..................................... 38
Appendix 5

Counties Whose Probation Office Records Lacked
Offenders’ State Identification Numbers ........................ 39
Appendix 6

Counties That Did Not View Arrest Records Associated
with Flash Notices ................................................... 40
Appendix 7

Related State Auditor’s Office Work ............................. 44

Detailed Results
Chapter 1

DPS and TDCJ Should Improve the Completeness of Their Portions of
the Criminal Justice Information System
The Department of Public Safety (DPS) should continue to work with
criminal justice agencies to submit more criminal records to its Computerized
Criminal History System (DPS’s portion of the Criminal Justice Information
System or CJIS) so that users can more fully rely on the results of criminal
history background searches conducted in that system.
The Texas Department of Criminal Justice (TDCJ) has implemented controls
that help it to ensure that it collects records for all offenders in its Corrections
Tracking System (TDCJ’s portion of CJIS), but it should implement
additional controls to ensure that it collects the state identification number and
arrest incident number for all criminal records.
Chapter 1-A

Disposition Records
After police departments,
sheriff’s offices, and other law
enforcement agencies submit
arrest records to DPS’s
Computerized Criminal History
System, prosecutor offices and
courts are required to submit
additional records to finalize
each criminal record. DPS refers
to those records as
“dispositions,” and examples
include:






Rejection of a case.
Prosecution of a case.
Conviction of an offender.
Sentencing of an offender.

Texas Code of Criminal
Procedure, Section 60.01, also
defines “disposition” as an action
that results in the termination,
transfer to another jurisdiction,
or indeterminate suspension of
the prosecution of a criminal
charge.
Source: DPS and the Texas Code
of Criminal Procedure.

DPS Should Encourage Criminal Justice Agencies to Submit
Criminal Records to the Computerized Criminal History System,
and It Should Include Probation Information in Its Criminal History
Background Checks
DPS has increased the number of disposition records it matches to arrest
records to ensure that more information in its Computerized Criminal History
System is complete. (See text box for additional details on disposition
records.) It has done this by requesting that more criminal justice agencies
submit criminal records to its Computerized Criminal History System. A
total of 4,272 criminal justice agencies submitted criminal records to the
Computerized Criminal History System from September 1, 2009, through
November 30, 2010 (see Table 1).
Table 1

Criminal Justice Agencies That Submitted Information to the
Computerized Criminal History System
Type of Criminal Justice Agency

Number

Police Departments, Sheriff’s Offices, and Other Law Enforcement Agencies

2,309

District and County Attorney Offices

507

District and County Courts

1,456
Total

4,272

Source: State Auditor’s Office analysis of criminal justice agencies that provided records to DPS
from September 1, 2009, through November 30, 2010.

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 1

The number and type of criminal justice agencies that submit criminal records
to DPS’s Computerized Criminal History System indicate that the system
generally functions as intended. However, despite DPS’s efforts, many
criminal justice agencies are still not submitting criminal records to the
Computerized Criminal History System. Specifically, as of January 2011,
prosecutor offices and courts had submitted disposition records to the
Computerized Criminal History System for 73.68 percent of arrests made in
2009. This is an improvement from the 71.00 percent submission rate the
State Auditor’s Office reported in February 2006 (for arrests made in 2003). 3
Texas Code of Criminal Procedure, Section 60.05, requires DPS to collect
information relating to prosecutions and dispositions of cases for each felony
or misdemeanor not punishable by fine alone. In addition, Texas Code of
Criminal Procedure, Section 60.10, required plans for improving
Computerized Criminal History System data from each county that reported
dispositions for less than 90.00 percent of arrest charges. See Appendix 3 for
a list of counties and the percent of dispositions that each county submitted to
the Computerized Criminal History System.
DPS maintains a compliance report that details the number and percent of
matching arrests and dispositions by county so that prosecutor offices and
courts can review their performance and correct any errors. DPS also has a
team of field representatives that review criminal justice agencies that do not
submit all disposition records or submit a large number of erroneous records.
According to DPS, those controls have improved the completeness of data in
the Computerized Criminal History System.
It is important to note, however, that DPS cannot control whether prosecutor
offices and courts submit all records because the Texas Code of Criminal
Procedure does not provide DPS with the ability to penalize prosecutor offices
and courts for not submitting information. Texas Code of Criminal
Procedure, Section 60.08(d), requires courts and prosecutor office to submit
information within 30 days of receiving it. Auditors visited the Houston
District Attorney’s Office, the Tarrant County Criminal District Attorney’s
Office, and the Harris County District Clerk’s Office, which provided the
following reasons for not always submitting records as required:

3



Information systems at prosecutor offices and courts may not receive
rejection or error notifications when submissions of information to the
Computerized Criminal History System are unsuccessful.



Prosecutor offices and courts cannot submit records that lack state
identification numbers or arrest incident numbers to the Computerized
Criminal History System. DPS requires that information because it uses

See An Audit Report on the Criminal Justice Information System, State Auditor’s Office Report No. 06-022, February 2006.
An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 2

the state identification number and the arrest incident number to uniquely
identify a particular person and a particular offense.


After prosecutor offices and courts submit information, they must correct
errors or supply missing information manually via fax.

Despite DPS’s efforts to collect more criminal records, the number of
prosecutor offices and courts that do not submit criminal records makes the
Computerized Criminal History System incomplete as the single source of
criminal background check information. Auditors reviewed the records of
21,351 offenders in jail, in prison, or on probation who were convicted of
crimes and began serving sentences in November 2010 and determined that
the Computerized Criminal History System did not include prosecutor office
or court records for 1,634 offenders (7.65 percent). The Computerized
Criminal History System did not include any sentencing information for those
offenders, even though they were admitted into jail, prison, or probation. See
Appendix 4 for a list of 10 counties that did not submit disposition records for
the largest numbers of offenders whom TDCJ admitted in November 2010.
DPS should improve the Computerized Criminal History System by incorporating TDCJ’s
information on all offenders. DPS should improve the completeness of criminal

history data in the Computerized Criminal History System by obtaining data
from TDCJ for offenders who were convicted and are serving sentences, but
for whom the Computerized Criminal History System lacks court records.
As of May 2011, DPS was obtaining information from TDCJ on the location
of offenders who were in jail, in prison, or on parole, and reporting that
information with the results of its criminal history background checks.
However, DPS did not obtain information for offenders who were serving
probation. On August 31, 2010, TDCJ reported that local probation offices
supervised 419,920 offenders in its probation programs. Because DPS
collects prosecutor office and court records for 73.68 percent of arrest records
in the Computerized Criminal History System, it should obtain additional
information for all offenders on probation to ensure that all available
conviction information is recorded in the Computerized Criminal History
System.
For offenders for whom the Computerized Criminal History System lacks
prosecutor or court records, having information on those offenders’ locations
in the TDCJ system helps to clarify their criminal histories. However, the
information that DPS collects does not always have the specific arrest incident
number or offense code for which an offender was convicted. Additionally,
for offenders with multiple arrests and convictions, the location information
that DPS collects may not be adequate to determine the exact number or
severity of offenses that an offender committed.

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 3

Criminal justice agencies that submit criminal records to the Computerized Criminal
History System do not always submit complete information. The Computerized

Criminal History System lacks arrest records to match with at least 65,424
prosecutor office or court records collected between September 1, 2009, and
November 30, 2010. DPS could not match those records because law
enforcement agencies had not submitted arrest records appropriately or
because the prosecutor offices and courts submitted erroneous data that
prevented DPS from matching records. For felonies and misdemeanors that
are not punishable by fine alone, Texas Code of Criminal Procedure, Section
60.08(d), requires law enforcement agencies to submit arrest records within 7
days of the arrest.
If an individual’s arrest, prosecution, or court records are not submitted to the
Computerized Criminal History System, that individual will have an
incomplete criminal history. Potential employers, criminal justice agencies, or
authorized individuals who may query any of those individuals’ criminal
histories would not be able to determine whether an arrest resulted in a
conviction without contacting the appropriate prosecutor’s office or court
clerk to request hard copies of prosecutor and court records.
Recommendations

DPS should:




Continue its efforts to improve the accuracy of the data in the
Computerized Criminal History System, including:


Continuing to monitor prosecutor offices and courts to encourage them
to submit plans for improving Computerized Criminal History System
data as required by Texas Code of Criminal Procedure, Section 60.10.



Consider working with TDCJ to reconcile court records in the
Computerized Criminal History System to locate and identify missing
offender records in TDCJ’s Corrections Tracking System.

Collect data for offenders in TDCJ’s probation programs in the
Computerized Criminal History System, and include that data in the
results of criminal history background checks.

Management’s Response from DPS

DPS appreciates the acknowledgement that data accuracy has improved. We
agree with the recommendations and will continue to:


Provide training by CJIS representatives on the requirements of Chapter
60 CCP.
An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 4



Conduct countywide meetings to foster local communication and the
development of data improvement plans.



Promote automated reporting solutions.



Monitor prosecutor offices and courts and encourage them to work with
arresting agencies on developing a data improvement plan.



Encourage counties that have submitted plans to follow through on their
plans.

Additionally, we will work with TDCJ to identify opportunities to reconcile
missing sentencing information.
Responsible Party: Deputy Assistant Director, Crime Records Service
Target Implementation Date: March 2012

Chapter 1-B

TDCJ Should Continue to Improve the Completeness of Criminal
Records in Its Corrections Tracking System
TDCJ has implemented additional controls since the February 2006 State
Auditor’s Office audit of CJIS, and those controls have improved the
completeness of data in its Corrections Tracking System. The Corrections
Tracking System includes several different components that
TDCJ’s Corrections
contain
criminal records for different TDCJ programs. Since
Tracking System
the February 2006 audit, TDCJ has implemented the
TDCJ’s Corrections Tracking System
Intermediate System (ISYS) to obtain information on offenders
includes several different
components:
in its probation programs to collect more state identification
 The State Ready System, which
numbers. (See text box for more information on the
contains information on offenders
Corrections Tracking System.)
in prisons.
 The State Jail System, which

contains information on offenders
in state jails.

TDCJ’s processes for collecting offender information ensure
that the Corrections Tracking System consistently collects
 The Offender Information
criminal records for the offenders TDCJ supervises. However,
Management System, which
contains information on offenders
auditors determined that TDCJ does not always receive arrest
on parole.
incident numbers. The arrest incident number is a field within a
 The Intermediate System (ISYS),
probation record that DPS uses to uniquely identify an arrest
which contains information on
offenders serving probation.
and related charges; that number is used throughout the judicial
Source: State Auditor’s Office
process to track a specific offense and is transmitted to TDCJ
interviews with TDCJ.
along with an offender’s other criminal records. Auditors
reviewed Corrections Tracking System records for offenders who began
serving sentences in November 2010 and determined that:

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 5



For offenders placed in jail or prison, 1,333 (19.29 percent) of 6,912
records lacked an arrest incident number.



For offenders on probation, 1,267 (7.02 percent) of 18,044 probation
records did not specify an arrest incident number.

Texas Code of Criminal Procedure, Section 60.052, states that information in
the Corrections Tracking System must include the offender’s arrest incident
number. If an arrest incident number is not recorded in the Corrections
Tracking System, TDCJ may need to obtain and review hard copies of court
records to determine the specific charges for which an offender was convicted.
TDCJ has made progress in its efforts to obtain state identification numbers from local
probation offices. TDCJ submits the state identification numbers of

probationers to DPS each day to determine whether probationers were
arrested. (See Chapter 2 for additional details on arrest notifications for
offenders on probation.) Figure 1 shows the trend in the number of active and
inactive probation records in ISYS that lack a state identification number.
Figure 1

Number of Active and Inactive Probation Records in ISYS
That Lack a State Identification Number
By Fiscal Year

14,000
12,000
10,000
8,000
6,000
4,000
2,000

o
FY05

FY06

FY07

FYOB

FY09

FY10

FY11
(through

3/11/111
Source: State Audtior’s Office analysis of records in ISYS at TDCJ.

Local probation offices have improved the number of records that include a state
identification number, but additional improvements are needed. Despite the

decrease in probation records that lack a state identification number, local
probation offices still do not always submit that information. Auditors
reviewed the records of the 18,044 offenders who were placed on probation
An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 6

during November 2010 and determined that 557 (3.09 percent) lacked a state
identification number. See Appendix 5 for a list of counties whose records
listed probationers without state identification numbers.
Local law enforcement offices and probation offices are responsible for
obtaining the state identification number and entering it into ISYS. Auditors
visited Harris County’s local probation office and verified that 4 (13.33
percent) of 30 randomly selected probation records at that office did not have
a state identification number. When probationers are not assigned a state
identification number, their probation officers will not receive flash notices
that inform them if probationers are arrested.
According to local probation offices, many probation records also lack a state
identification number, even though the offender is no longer supervised under
a TDCJ probation program. Harris County’s local probation office had a total
of 19,545 probation records without a state identification number (40.96
percent of 47,716 records that TDCJ identified in the state from January 24,
2005, through March 11, 2011). When auditors visited this probation office, it
reported that it had only 914 probation records for probationers who were
under active supervision and for which ISYS lacked a state identification
number. The reduced number of active probation records indicates that Harris
County’s local probation office has significantly improved the completeness
of state identification numbers in its records. (See Appendix 2 for a list of all
criminal justice agencies that auditors visited.) Table 2 presents details on the
number and status of probationers at the local probation office auditors
visited.
Table 2

Offenders on Probation at Harris County’s Local Probation Office
Type of Record

Time Period

Number of Probationers

Active and inactive probationers
for which ISYS lacked a state
identification number

January 24, 2005, through March
11, 2011

Active probationers for which
ISYS lacked a state identification
number

May 2011

914

Inactive probationers for which
ISYS had a state identification
number

May 2011

3,327

19,545

Source: TDCJ and probation office reports of offenders without a state identification number in ISYS.

Local probation offices can update probation records only if the offender is
actively monitored. Probation officers stop actively monitoring an offender
when a probationary period ends, when a probationer absconds, or when an
offender’s probation is otherwise terminated. If a state identification number

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 7

is acquired after an offender’s probationary term ends, that number cannot be
electronically uploaded to ISYS and must be updated manually.
Texas Code of Criminal Procedure, Section 60.052, states that information in
the Corrections Tracking System must include the offender’s state
identification number. Additionally, Texas Government Code, Section
509.012, gives TDCJ the ability to reduce the funding it provides to a local
probation office that is not in substantial compliance with TDCJ’s standards
or requirements.
Recommendations

TDCJ should:


Encourage local probation offices to collect state identification numbers
and arrest incident numbers for all offenders, and to submit those numbers
to ISYS in a timely manner. If it identifies local probation offices that do
not consistently submit either of these numbers, TDCJ should consider
reducing the funds it provides to those offices under Texas Government
Code, Section 509.012.



For offenders who are no longer under probation, develop a process
through which local probation departments can submit missing state
identification numbers.

Management’s Response from TDCJ

Concur.
The Texas Department of Criminal Justice-Community Justice Assistance
Division (TDCJ-CJAD) will utilize ongoing webinar presentations, live
presentations at probation advisory committee meetings, statewide email
reminders and individual department meetings to re-emphasize to community
supervision and corrections departments (CSCDs) to collect state
identification numbers (SIDs) and arrest incident numbers for submission into
ISYS in a timely manner.
Additionally, the TDCJ-CJAD, through policy will require CSCDs, pursuant
to Texas Code of Criminal Procedure, Section 60.052, to collect state
identification numbers and arrest incident numbers for offenders placed on
community supervision and to submit them to ISYS in a timely manner. These
communications and policy change will be used in considering whether to
reduce funding to CSCDs that are not in substantial compliance with the
TDCJ's requirements.

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 8

There is currently a process in place by which CSCDs can submit SIDs on
offenders no longer under community supervision through submission of a
demographics transaction. However, the CSCDs have typically restricted use
of the demographic transaction for offenders that completed community
supervision without a SID and were subsequently arrested in another
jurisdiction. The TDCJ-CJAD will utilize the communication systems
described above to ensure CSCDs are instructed to use the demographic
transaction process for all instances that an offender’s SID number is not
known, and utilize the periodic monitoring process recommended in Chapter
3-B to help ensure missing SID numbers are provided.
Target Date: February 29, 2012

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 9

Chapter 2

TDCJ and DPS Should Improve the Distribution and Timeliness of
Criminal History Information
Flash Notices
TDCJ provides information to DPS
about which individuals with criminal
records in the Corrections Tracking
System are on probation, are
incarcerated, and are on parole.
Information for those individuals is
flagged in DPS’s Computerized
Criminal History System so that, if
those individuals are arrested again,
their probation or parole officers will
be notified of the arrest. The
notifications that TDCJ sends in
these cases are called “flash
notices.”
DPS is responsible for adding and
removing flags for individuals on
probation and parole based on the
information TDCJ provides. The flags
reside in the Computerized Criminal
History System that DPS maintains.
Source: State Auditor’s Office
interviews with TDCJ employees.

Community Supervision and
Corrections Departments
The Texas Department of Criminal
Justice - Community Justice
Assistance Division (TDCJ-CJAD)
administers community supervision,
or adult probation, in Texas. TDCJCJAD does not work directly with
offenders. Instead, it works with
the local Community Supervision and
Corrections Departments (CSCDs),
which supervise the offenders.
There are 121 CSCDs, organized
within judicial districts that serve
254 counties in Texas.

TDCJ and DPS have improved the distribution and timeliness
of criminal history information since the State Auditor’s
Office’s February 2006 audit. The process for identifying
offenders to flag in DPS’s Computerized Criminal History
System for “flash notices” (see text box for additional details)
and the process for distributing information about subsequent
arrests of persons under supervision is working as intended in
accordance with Texas Code of Criminal Procedure, Section
60.18.
However, TDCJ should ensure that Community Supervision
and Corrections Departments (CSCDs, see text box for
additional information) view arrest records associated with flash
notices in a timely manner. In addition, DPS should take
additional measures to ensure that criminal justice agencies
submit information into the Computerized Criminal History
System in a more timely manner, and it should enter into the
Computerized Criminal History System information that it
receives in hard-copy form in a more timely manner.
TDCJ should monitor CSCDs to ensure that they view arrest records
associated with flash notices in a more timely manner. Auditors

reviewed a list of CSCDs that serve the 254 counties within
Texas. Based on analysis of active and inactive user accounts,
as of May 2011, users representing 120 (47.24 percent) of the
254 counties in Texas had not viewed arrest records associated
with flash notices for at least 90 days. That included 56 (41.48
percent) of 135 total users in the 254 counties who had not
accessed their accounts within a 6-month period. See Appendix
6 for a list of counties that did not view arrest records
associated with flash notices.

Source: State Auditor’s Office
interviews with TDCJ employees.

A designated flash coordinator is responsible for distributing
flash notices to the probation offices within each county that a
CSCD serves. However, the Bexar County CSCD had not viewed arrest
records associated with flash notices in more than one year and, instead,
indicated that it relied on that county’s system to provide arrest notifications
that occurred only within that county. As of May 5, 2011, Bexar County’s
CSCD did not have a flash coordinator because it was not aware of the flash
notice process.

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 10

The Texas Department of Criminal Justice - Community Justice Assistance
Division (TDCJ-CJAD) does not actively monitor the frequency with which
flash coordinators at CSCDs view arrest records associated with flash notices,
and it also did not identify prolonged periods of inactivity during which some
flash coordinators’ access to flash notices was disabled. As a result, TDCJCJAD cannot ensure that all CSCDs have designated an individual to receive
flash notice messages.
Unlike TDCJ’s Parole Division, which is under TDCJ’s direct control, CSCDs
work for the judicial district that they serve (although CSCDs receive funding
from TDCJ-CJAD). This hinders TDCJ-CJAD’s ability to require CSCDs to
view arrest records associated with flash notice messages in a timely manner.
The February 2006 State Auditor’s Office audit reported that, in some cases,
that information on individuals who are placed on or removed from probation
may not be correctly identified in the Corrections Tracking System for up to a
month; this limited probation officers’ ability to be notified of an arrest in a
timely manner. However, TDCJ-CJAD has improved the submission rate of
probation records to the Corrections Tracking System by implementing an
Intermediate System (ISYS). As a result of the implementation of ISYS, from
September 2009 through February 2011, the majority of counties in Texas
submit probation records to the Corrections Tracking System more frequently
than every two weeks.
Criminal Justice Agency
Reporting Requirements
Texas Code of Criminal Procedure,
Section 60.08(d), specifies that
“Except as otherwise required by
applicable state laws or
regulations, information or data
required by this chapter to be
reported to the Texas Department
of Criminal Justice or the
Department of Public Safety shall
be reported promptly but not later
than the 30th day after the date on
which the information or data is
received by the agency responsible
for reporting it except in the case
of an arrest. An offender’s arrest
shall be reported to the
Department of Public Safety not
later than the seventh day after
the date of the arrest.”

The flash notice process is an important means of communicating the
subsequent arrest of offenders under supervision, particularly for
offenders who are arrested in a county that differs from the county in
which their probation office is located. Without flash notices, when
probationers are arrested in counties other than the county in which their
probation office is located, Bexar County’s probation office indicated it
would not be aware of these arrests and would not be able to make
appropriate and timely assessments about probationers who may be
absconders.
DPS should improve the timeliness with which criminal justice agencies submit
information to the Computerized Criminal History System. Auditors compared

the submission of criminal records to DPS’s Computerized Criminal
History System between September 1, 2009, and November 30, 2010,
with timeliness requirements from the Texas Code of Criminal
Procedure, Section 60.08 (see text box for more information) and
determined that:



939,802 (84.25 percent) of 1,115,469 arrest records were submitted within
7 days as required.



734,138 (76.48 percent) of 959,892 court records were submitted within
30 days as required.
An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 11



47,051 (63.61 percent) of 73,967 records for criminal charges that
prosecutors dismissed were submitted within 30 days as required.

As of March 2011, DPS had not entered into the Computerized Criminal
History System records that criminal justice agencies had submitted in hardcopy form during a time period that covered approximately two months. To
submit those records, criminal justice agencies mail hard copies of records to
DPS; DPS staff then enter the records into the Computerized Criminal History
System. Auditors observed this process in March 2011, when DPS staff were
entering criminal records submitted in January 2011.
Criminal justices agencies also submit information electronically, and DPS
estimates that approximately 80.00 percent of submissions are electronic.
Table 3 shows the number of electronic and hard-copy records that criminal
justice agencies submitted between September 2009 and November 2010.
Table 3

Electronic and Hard-copy Submissions of Criminal Justice Agency Records
September 2009 – November 2010
Type of Record
Arrest

Total Records
1,115,469

Electronic
Unknown

Hard-copy
a

Unknown

a

Prosecutor Dismissal of Charges

157,963

137,471

20,492

Court

959,892

831,509

128,383

a

DPS is not able to distinguish between electronic and hard-copy arrest records. DPS asserts that all arrest
records are considered electronic because all arrest records are submitted from the Automated Fingerprint
Identification System (AFIS) to the Computerized Criminal History System electronically.

Source: Auditor analysis of records in the Computerized Criminal History System for September 1, 2009, through
November 30, 2010.

As stated in Chapter 1-A of this report, the Texas Code of Criminal Procedure
does not provide DPS with authorization to take administrative action to
penalize criminal justice agencies for not submitting records in a timely
manner. DPS also asserted that staffing and budget issues contributed to the
two-month backlog in entering records submitted in hard-copy form. When
criminal justice agencies do not submit records in a timely manner and there
are processing delays in entering records received in hard-copy form, this
hinders the ability of employers, state licensing agencies, and law enforcement
agencies to obtain accurate information about an individual’s criminal history.
Recommendations

TDCJ should monitor CSCDs to ensure that they view arrest records
associated with flash notices in a timely manner.

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 12

DPS should:


Monitor the submission of information to the Computerized Criminal
History System to help ensure that it receives that information within the
time frames required by Texas Code of Criminal Procedure, Section
60.08.



Submit arrest and disposition monitoring reports to the appropriate
commissioner court when a criminal justice agency does not comply with
Texas Code of Criminal Procedure, Chapter 60.



Enter information into the Computerized Criminal History System in a
timely manner.

Management’s Response from TDCJ

Concur.
The TDCJ-CJAD will monitor local CSCD flash notice activity and regularly
notify departments that fail to timely view flash notices. Additionally, the
division though annual Chiefs Conferences and contact using Go-to-Meeting
and webinars will reiterate the importance to public safety of CSCD timely
responding to subsequent offender arrests.
Target Date: October 1, 2011
Management’s Response from DPS

DPS agrees with the recommendations and will:


Add the timeliness of submissions to the current review of information
submitted to Computerized Criminal History System.



Disseminate the compliance report to all Texas Commissioners’ Courts.

It is worth noting that the majority of CCH data is reported in an electronic
fashion and is posted when received. Crime Records Services has eliminated
the paper record backlog identified by the State Auditors Office and is
committed to entering records received on paper into the Computerized
Criminal History System within 30 days of receipt.
Responsible Party: Deputy Assistant Director, Crime Records Service
Target Implementation Date: October 2012

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 13

Chapter 3

DPS and TDCJ Should Improve the Accuracy of Criminal History
Information That Criminal Justice Agencies Submit
Auditors identified a limited number of inaccurate records in DPS’s
Computerized Criminal History System. In addition, a weakness in TDCJ’s
monitoring of the accuracy of probation records in ISYS prevents TDCJ from
determining whether those records are accurate.
Chapter 3-A

DPS Should Improve the Accuracy of Criminal History Information
That Criminal Justice Agencies Submit
Auditors reviewed the accuracy of criminal records that criminal justice
agencies submitted to DPS’s Computerized Criminal History System and
identified a limited number of inaccurate records that could negatively affect
the results of criminal history background checks.
Court and prosecutor offices. Auditors visited one court and two prosecutor
offices, and determined that they generally submitted accurate records to the
Computerized Criminal History System. Specifically:



Auditors did not identify any inaccurate criminal history information at the
Harris County District Clerk’s Office or at the Houston District Attorney’s
Office. Auditors randomly selected 30 records at each location and
matched each field from those records to the information in DPS’s
Computerized Criminal History System.



Auditors identified only one error at the Tarrant County Criminal District
Attorney’s Office. That office erroneously categorized a class A
misdemeanor as a class B misdemeanor in DPS’s Computerized Criminal
History System. Auditors verified that 10 other fields in that prosecutor
office’s records— including the state identification number, the arrest
incident number, name, and the offense code—matched the information in
DPS’s Computerized Criminal History System.

Law enforcement agencies. Auditors also visited four law enforcement agencies
and identified certain inaccuracies in the information they had submitted to
DPS’s Computerized Criminal History System. (See Appendix 2 for a list of
all criminal justice agencies that auditors visited.) However, those law
enforcement agencies accurately submitted the majority of the information
that the Texas Code of Criminal Procedure requires them to submit, including
the state identification number, the arrest incident number, and the name of
the arrested individual.

All four law enforcement agencies submitted inaccurate disposition codes for
some arrested individuals. Arrest records for 53 (59.55 percent) of 89 records
An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 14

tested incorrectly showed that the individual was held in the custody of the
law enforcement agency when the individual had actually been released. The
disposition code specifies the short-term status of an arrested individual, such
as held in custody or released on recognizance.
In conducting tests at the four law enforcement agencies visited, auditors also
determined that two other law enforcement agencies not visited had submitted
information to DPS’s Computerized Criminal History System that contained
erroneous agency identification numbers. This occurred because they had
submitted inaccurate out-of-county arrest information to DPS’s Computerized
Criminal History System. This indicates that law enforcement agencies
statewide may experience problems in submitting accurate out-of-county
arrest information.
DPS’s monitoring of the accuracy of information.

DPS maintains electronic logs of
erroneous arrest records that criminal justice agencies submit to the
Computerized Criminal History System. Auditors reviewed the logs for
records submitted from September 1, 2009, through November 30, 2010, and
determined that DPS identified 22,064 erroneous records, which represented
1.83 percent of the 1,202,920 arrest records submitted to DPS during that time
period. Automated controls in the Computerized Criminal History System log
those errors for the criminal justice agencies to correct and resubmit.
As part of its monitoring process, DPS also examines some information that
criminal justice agencies submit to the Computerized Criminal History
System. If DPS data entry operators identify erroneous information, they can
modify or delete those erroneous data elements rather than rejecting the entire
submission of information. The data elements that DPS data entry operators
can modify or delete includes Texas driver’s license number, citizenship
status, address, license plate, and Social Security number. While none of
those elements is required by the Texas Code of Criminal Procedure, the
practice of modifying or deleting information could impact the completeness
of those data elements that DPS modifies or deletes in the Computerized
Criminal History System. Texas Code of Criminal Procedure, Section
60.02(c), requires DPS to maintain an accurate repository of criminal history
records, and the weaknesses discussed above limit DPS’s ability to ensure the
accuracy of the information.
Recommendations

DPS should:


Continue to provide training to law enforcement agencies on arrest record
requirements, including DPS’s processes for submitting accurate
information for out-of-county arrests.
An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 15



Periodically review criminal records in the Computerized Criminal
History System for common data entry errors, and follow up with criminal
justice agencies that submitted erroneous records.

Management’s Response from DPS

DPS agrees with the recommendation and will:


Continue to provide training to law enforcement agencies on arrest record
requirements.



Develop a plan to more aggressively address error issues with submitting
agencies.

Responsible Party: Deputy Assistant Director, Crime Records Service
Target Implementation Date: January 2012

Chapter 3-B

TDCJ Should Improve Its Monitoring of Probation Information That
Local Probation Offices Submit
TDCJ has improved the quality of its probation information by implementing
ISYS, which interfaces with case management systems at local probation
offices and enables local probation offices to submit records and updates to
records directly to TDCJ. However, TDCJ should improve the accuracy of
ISYS by tracking the resolution of erroneous information that local probation
departments submit.
TDCJ maintains a log of errors in probation information that local probation
departments submit, but it does not track those errors to verify whether they
are corrected. Specifically, TDCJ maintains an electronic log of erroneous
records for each local probation office that submits information to ISYS. This
automated control helps to identify potentially inaccurate information;
however, after TDCJ identifies errors, it does not verify that the erroneous
information is corrected. Instead, TDCJ relies on the 121 local probation
offices to access the error logs and correct the errors. It does not have a formal
process to ensure that all identified errors are consistently corrected.
Auditors reviewed the error logs for the five largest local probation offices.
TDCJ identified errors in 415,453 (22.60 percent) of the 1,838,576 probation
records those local probation offices submitted from September 1, 2009,
through February 28, 2011. In April 2011, TDCJ asserted that it was not able
to determine how many of those errors remained and how many had been
corrected. Texas Code of Criminal Procedure, Section 60.02(c), requires
An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 16

TDCJ to maintain an accurate repository of criminal history records, and
TDCJ cannot ensure that all probation records are accurate until it determines
whether probation offices have corrected all known errors.
It is important to note that auditors visited two local probation departments
and did not identify any errors in the 60 probation files tested. Auditors also
observed that each of those local probation offices actively corrected errors
that TDCJ identified in the information that those local probation offices
submitted. Therefore, both local probation offices were taking action to
correct the errors that TDCJ identified. However, it will not be possible to
determine the accuracy of probation records that all 121 local probation
offices have submitted until TDCJ implements a process to ensure that all
known errors have been corrected.
Recommendation

TDCJ should develop and implement a process to periodically monitor the
number of erroneous records that local probation departments have corrected
in ISYS and the number of erroneous records they have not yet corrected.
Management’s Response from TDCJ

Concur.
The TDCJ-CJAD will send email notifications to CSCD directors who’s
CSCDs have a higher rate of missing SIDs and/or TRNs than the state
average and monitor the progress of the error corrections. In addition, the
TDCJ-CJAD will continue to educate the 121 CSCDs on the importance of
reviewing CSTS/ISYS error reports and making needed corrections.
Target Date: November 30, 2011

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 17

Chapter 4

DPS and TDCJ Should Strengthen Certain Information Technology
Controls
DPS should strengthen certain information technology controls in its
Computerized Criminal History System, and TDCJ should strengthen certain
information technology controls in its Corrections Tracking System to ensure
that CJIS records in those systems are protected from unauthorized changes
and are available for criminal history background checks.
Chapter 4-A

DPS Should Strengthen Certain Information Technology Policies
and Controls in the Computerized Criminal History System
DPS should strengthen user access controls.

Auditors reviewed access to the
Computerized Criminal History System at DPS and identified control
weaknesses that increase the risk of unauthorized modification or deletion of
criminal records. Those weaknesses included the following:


DPS should further restrict access to update crime records in the
Computerized Criminal History System. Specifically:


Twenty-six staff had administrative access that enabled them to
modify criminal records, security configurations, and application
functionality for the Computerized Criminal History System.
However, only one of those individuals required the ability to modify
security configurations to perform the individual’s job duties.



Two individuals with data entry roles still had access to the
Computerized Criminal History System, even though DPS no longer
employed them. In addition, two individuals changed positions at DPS
but maintained the ability to update criminal records.



DPS inappropriately granted eight programmers administrative access that
enables them to modify the production databases that store Computerized
Criminal History System data. Programmers make changes to those
databases on a weekly basis, but the duties associated with making those
changes are not segregated to reduce the risk that unauthorized changes
could be made to criminal records.



DPS did not appropriately manage access to criminal records stored on an
external Web site that is used to perform criminal history background
checks. Job responsibilities changed for 3 (10.00 percent) of 30 randomly
selected users that auditors sampled and those users no longer required the
ability to conduct criminal history background checks; however, they still
had access to do so.

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 18



DPS granted access to nine staff that would allow them to modify or
delete audit trails in the Computerized Criminal History System.
Modifying or deleting audit trails would limit DPS’s ability to identify
specifically who made changes to the system.

When users have inappropriate access to the Computerized Criminal History
System, this increases the risk of fraud and unauthorized modification of
criminal records. It is important to note that auditors did not detect any
instances of fraud, and DPS maintains audit trails for changes to the
Computerized Criminal History System. However, DPS may not be able to
detect an unauthorized modification to that system if audit trails are also
modified. Title 1, Texas Administrative Code, Section 202.25 (6)(C), requires
all state agencies to approve security changes through a change control
process.
Auditors reviewed documentation for 10 changes that programmers made to
the Computerized Criminal History System from February 1, 2011, to March
31, 2011, and determined that DPS reviewed and approved all 10 changes
prior to implementation. However, a risk still exists that programmers could
make unauthorized and undocumented changes to the Computerized Criminal
History System. In addition, although security officials at DPS asserted that
they review logs of suspicious attempts to access the Computerized Criminal
History System, DPS does not have a formal process for monitoring security
events related to those attempts. As a result, DPS may not be able to detect
unauthorized changes to the Computerized Criminal History System.
The weaknesses described above also indicate that DPS should enhance its
policies for updating and modifying its systems to ensure that it segregates the
duties of making changes to the Computerized Criminal History System and
placing those changes in the production environment.
DPS should require users to undergo fingerprint-based criminal history background
searches before it allows them to conduct criminal history background checks for other
individuals. In February 2006, the State Auditor’s Office recommended that

DPS perform fingerprint-based criminal history background checks on users
who conduct criminal history background checks for other individuals. 4
However, DPS did not implement that recommendation. DPS does not
require users who access its Computerized Criminal History System Web site
to receive fingerprint-based checks.
DPS should strengthen backup and disaster recovery controls.

DPS should test its
backup and recovery operations for the Computerized Criminal History
System database and its disaster recovery plan for its Automated Fingerprint
Identification System (AFIS), both of which are critical components of the
Computerized Criminal History System. DPS has developed a disaster
4

See An Audit Report on the Criminal Justice Information System, State Auditor’s Office Report No. 06-022, February 2006.
An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 19

recovery plan for AFIS, but it has not tested that plan as required by Title 1,
Texas Administrative Code, Section 202.24(a)(4)(D). DPS uses AFIS to
match fingerprints to identify each individual for whom a criminal record is
submitted.
If an unexpected disaster occurred, users may not be able to access the
Computerized Criminal History System to submit criminal records or obtain
criminal history background checks.
Recommendations

DPS should:




Comply with all applicable sections of Title 1 of the Texas Administrative
Code when administering the Computerized Criminal History System,
including:


Reviewing the access of all users with special access to the
Computerized Criminal History System, and revoking all access that is
not necessary for users to complete their job responsibilities.



Developing and implementing a process to deactivate or revise user
access to the Computerized Criminal History System in a timely
manner when users’ job responsibilities change.



Segregating the duties of developing and installing all changes to the
Computerized Criminal History System, operating systems, and
databases.



Developing policies and procedures for monitoring attempts to access
the Computerized Criminal History System and related resources.



Testing the backup and recovery capabilities of the Computerized
Criminal History System and AFIS to ensure that it can recover those
systems.

Perform fingerprint-based criminal history background checks on all
individuals who request access to nonpublic criminal history information.

Management’s Response from DPS

DPS agrees with the recommendations and will:


Review the access of all users with special access and revoke all access
that is not necessary.



Institute a periodic review of access roles.
An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 20

Responsible Party: Deputy Assistant Director, Crime Records Service
Target Implementation Date: November 2011


Implement a process to deactivate or revise user access to the
Computerized Criminal History System in a timely manner when users’
job responsibilities change.

Responsible Party: Human Resources Director and Manager, Information
Technology Division
Target Implementation Date: January 2012


Segregate the duties of developing and installing all changes to the
Computerized Criminal History System, operating systems, and databases.
Where segregation is not feasible in order to accomplish deployments, we
will review current authorizations and limit privileges to only those
required.

Responsible Party: Manager of Law Enforcement Support, Information
Technology Division
Target Implementation Date: November 2011


Develop policies and procedures for monitoring attempts to access the
Computerized Criminal History System and related resources.

Responsible Party: Assistant Director, Information Technology Division
Target Implementation Date: November 2011


Currently there is no statutory authority to perform fingerprint based
CHRI checks on individuals that do not have terminal access to CHRI.
When statutory authority is granted, DPS will perform fingerprint-based
criminal history background checks on all individuals who request access
to nonpublic criminal history information.

Responsible Party: Deputy Assistant Director, Crime Records Service
Target Implementation Date: Pending Statutory Authority


Test the backup and recovery capabilities of the Computerized Criminal
History System and AFIS to ensure that it can recover those systems.

Responsible Party: Assistant Director, Information Technology Division
Target Implementation Date: June 2014

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 21

Chapter 4-B

TDCJ Should Strengthen Specific Information Technology Controls
in the Corrections Tracking System
TDCJ should improve segregation of duties.

TDCJ should improve the security of
criminal records by limiting programmers’ ability to modify the Corrections
Tracking System and ISYS (the system in which TDCJ collects information
on offenders in its probation programs, see Chapter 1 for additional details).
Specifically:


TDCJ does not properly restrict programmers’ access to the Corrections
Tracking System. As a result, certain programmers can directly update
criminal records in the Corrections Tracking System. It is important to
prevent or restrict programmers’ access to production data. Title 1, Texas
Administrative Code, Section 202.25 (6)(C), requires all state agencies to
approve security changes through a change control process.



TDCJ does not properly restrict two programmers’ access to ISYS. As a
result, those programmers can directly modify probation records and
database configurations in ISYS.

Auditors tested all 17 documented changes that employees made to TDCJ
systems from May 10, 2010, through May 9, 2011, and determined that all of
those changes were authorized. However, without proper segregation of
duties, a risk still exists that unauthorized changes would not be detected or
prevented.
TDCJ should enhance its policies for updating and modifying systems that contain CJIS
data. Since the State Auditor’s Office’s February 2006 audit, TDCJ has been

involved in the data center consolidation project with the Department of
Information Resources (DIR) and DIR’s contractor. 5 However, TDCJ should
modify its change management policies to formalize the roles and
responsibilities of DIR’s contractor. Having a formal process would help
TDCJ ensure that changes to the Corrections Tracking System are properly
controlled and authorized. Title 1, Texas Administrative Code, Section
202.20, requires all state agencies to modify data in an authorized manner. In
addition, Title 28, Code of Federal Regulations, Section 20.21(f)(3)(i),
requires computer operations that support CJIS to follow procedures
developed or approved by the participating criminal justice agency.
TDCJ should improve security by configuring certain security options. TDCJ has not
configured its mainframe security system to protect key database files that
store some criminal data for the Corrections Tracking System, although it has
configured the mainframe security system to protect many other system

5

See An Audit Report on the Department of Information Resources and State Data Center Consolidation, State Auditor’s Office
Report No. 09-051, August 2009.
An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 22

resources, such as data files, user accounts, and key configurations. If an
unprotected database file was deleted, TDCJ could risk losing criminal data
and disrupting the availability of the Corrections Tracking System. Title 28,
Code of Federal Regulations, Section 20.21(f)(3)(i)(b), requires CJIS to
prohibit destruction of records from any unintended terminal.
TDCJ also should activate audit trails that log key data for certain tables and
applications in the Corrections Tracking System database. Both TDCJ staff
and state data center contractor staff can make changes to data. Therefore,
activating audit trails would enable TDCJ to monitor critical data for
unauthorized changes and help to enhance the quality of CJIS data. Title 1,
Texas Administrative Code, Section 202.25 (5)(B), requires state agencies to
maintain appropriate audit trails to protect mission-critical information.
Recommendations

TDCJ should:


Segregate the duties of making and deploying all changes to the
Corrections Tracking System, operating systems, and databases to help
ensure compliance with Title 1, Texas Administrative Code, Section
202.25 (6)(C).



Establish policies and procedures that differentiate between changes that it
is responsible for making to its automated systems and changes that
contractors are responsible for making to help ensure compliance with
Title 1, Texas Administrative Code, Section 202.20 (5).



Configure its mainframe security software to secure all critical
components of the Corrections Tracking System and database.



Use a risk-based process to activate and monitor audit trails for all changes
to criminal records in the Corrections Tracking System to help ensure
compliance with Title 1, Texas Administrative Code, Section 202.25
(5)(B).

Management’s Response from TDCJ

Concur.
The TDCJ will add additional segregation of duties to limit programmers'
ability to modify the Corrections Tracking System in accordance with Title 1,
Texas Administrative Code, Section 202.25(6)(c).

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 23

The TDCJ will modify change management policies to formalize roles and
responsibilities of contractors in accordance with Title 1, Texas
Administrative Code, Section 202.20.
The TDCJ will make the recommended adjustments and/or configuration
changes to help reduce risk of losing criminal data and/or disrupting the
availability of the Corrections Tracking System in accordance with Title 28,
Code of Federal Regulations, Section 20.21 (f)(3)(i)(b). The TDCJ also
intends to maintain sufficient active audit trails to log key data to monitor
critical data for unauthorized changes in accordance with Title 1, Texas
Administrative Code, Section 202.25(5)(B).
Target Date: March 31, 2012

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 24

Appendices
Appendix 1

Objective, Scope, and Methodology
Objective
The objective of this audit was to determine whether controls over the
Criminal Justice Information System (CJIS) provide reasonable assurance that
data in the system is complete, accurate, and up to date.
Scope
The scope of this audit covered data in CJIS from September 1, 2009, through
November 30, 2010, as well as system controls. The period of review for
access and general controls of the Computerized Criminal History System at
the Department of Public Safety (DPS) and the Corrections Tracking System
at the Texas Department of Criminal Justice (TDCJ) was from March 2011
through July 2011.
Methodology
The audit methodology included reviewing the process for collecting criminal
records at DPS and TDCJ; analyzing performance reports that DPS uses to
determine completeness of criminal records; analyzing error reports,
correction logs, and compliance reports from key systems at both DPS and
TDCJ; reviewing the flash notice system; assessing the CJIS information
technology control environment and relevant subsystems; and visiting
criminal justice agencies that submit data to CJIS. Auditors determined that
the completeness and accuracy of data in CJIS should be improved before
users can more fully rely on CJIS data for conducting criminal history
background checks.
Auditors assessed the reliability of data in the systems that comprise CJIS,
including the Computerized Criminal History system at DPS and the
Corrections Tracking System at TDCJ. To assess the reliability of those
systems, auditors conducted interviews, visited criminal justice agencies,
tested source documentation for key data elements, reviewed access controls,
reviewed processes used to modify and update computer data (change
management), and performed analysis of key data fields. The results of those
tests indicated that CJIS data was not reliable because courts and prosecutor
offices do not submit all criminal records to DPS. State agencies, law
enforcement officers, and employers that use the Computerized Criminal
History System to conduct criminal history background checks may not
receive complete information because a significant number of court records
and prosecutor records are never submitted for inclusion in that system. See
An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 25

Chapter 1-A of this report for details and recommendations on incomplete
criminal records in the Computerized Criminal History System.
Information collected and reviewed included the following:


DPS’s Report on Criminal History Background Checks, January 2009.



DPS’s Criminal Justice Information System User Guide.



DPS change management policies.



Disaster recovery plan for DPS’s Automated Fingerprint Identification
System.



Access lists for users who could update the Computerized Criminal
History System.



DPS’s Report Examining Compliance To The Texas Computerized
Criminal History System.



Records submitted to the Computerized Criminal History System from
September 2009 through November 2010.



TDCJ information security program information.



TDCJ change management policies.



Access lists for users who could update the Corrections Tracking System
and TDCJ’s Intermediate System (ISYS).



Transaction and error logs from ISYS.



Corrections Tracking System records for offenders admitted to jail, prison,
or probation in November 2010.



ISYS records without a state identification number from January 2005
through March 2011.

Procedures and tests conducted included the following:


Analyzed the criminal justice processes related to CJIS data.



Reviewed access configurations for DPS’s Computerized Criminal
History System, database, and Web site.



Tested DPS’s processes for modifying the Computerized Criminal History
System.

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 26



Visited four law enforcement agencies, two prosecutor offices, and one
court and tested the accuracy of criminal records submitted by each of
those entities.



Calculated the percent of arrest records that prosecutor offices or courts
disposed.



Reconciled TDCJ offender data with DPS arrest, prosecution, and court
records.



Calculated the average time criminal justice agencies take to submit
records to DPS.



Reviewed the process by which DPS and TDCJ exchange information to
create flash notices for arrested offenders.



Attended training for ISYS.



Reviewed access configurations for TDCJ’s Corrections Tracking System
and database.



Reviewed access configurations for ISYS and database.



Tested TDCJ’s processes for modifying information resources.



Visited two local probation offices and tested the accuracy of probation
records submitted by each.



Analyzed the completeness of state identification numbers for probation
records in ISYS.

Criteria used included the following:


Texas Code of Criminal Procedure, Chapter 60.



Title 1, Texas Administrative Code, Chapter 202.



Title 37, Texas Administrative Code, Chapter 27.



Texas Government Code, Chapter 411.



Texas Government Code, Chapter 509.



Title 28, Code of Federal Regulations, Chapter 20.

Project Information
Audit fieldwork was conducted from March 2011 through July 2011. We
conducted this performance audit in accordance with generally accepted
government auditing standards. Those standards require that we plan and
An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 27

perform the audit to obtain sufficient, appropriate evidence to provide a
reasonable basis for our findings and conclusions based on our audit
objectives. We believe that the evidence obtained provides a reasonable basis
for our findings and conclusions based on our audit objectives.
The following members of the State Auditor’s staff performed the audit:


Kels Farmer, MBA, CISA (Project Manager)



Anton Dutchover, BBA (Assistant Project Manager)



Jeff Grymkoski



Karen S. Mullen, CGAP



Alyassia Taylor, MBA, CGAP



Adam Wright, CFE, CGAP, CIA



Michael Yokie, CISA



Dana Musgrave, MBA (Quality Control Reviewer)



Nicole M. Guerrero, MBA, CIA, CGAP, CICA (Audit Manager)

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 28

Appendix 2

Criminal Justice Agencies That Auditors Visited
Table 4 lists the nine criminal justice agencies that auditors visited while
conducting this audit.
Table 4

Criminal Justice Agencies That Auditors Visited
Agency Name

Agency Type

Bexar County Community Supervision and Corrections Department

Local Probation Office

Garland Police Department

Law Enforcement Agency

Harris County Community Supervision and Corrections Department

Local Probation Office

Harris County District Clerk’s Office

Court Office

Harris County Sheriff’s Office

Law Enforcement Agency

Houston District Attorney’s Office

Prosecutor’s Office

Houston Police Department

Law Enforcement Agency

Kerr County Sheriff’s Office

Law Enforcement Agency

Tarrant County Criminal District Attorney’s Office

Prosecutor’s Office

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 29

Appendix 3

Counties That Did Not Submit Dispositions Associated with Fiscal Year
2009 Arrests
The Department of Public Safety (DPS) produces a report that details, by
county, the number and percent of matching arrests and dispositions so that
prosecutor offices and courts can review their performance and correct any
errors. Texas Code of Criminal Procedure, Section 60.06, requires district
courts, county courts, district attorney offices, and prosecutor offices to
submit all criminal records to DPS. Table 5 lists the number of arrests each
county reported from September 1, 2008, through August 31, 2009, and the
number of prosecutor and court records associated with each arrest that had
been submitted to DPS as of January 2011.
Table 5

Adult Arrest Records Submitted to DPS from September 1, 2008, to August 31, 2009
And Associated Prosecutor or Court Office Records Submitted to DPS as of January 2011

County
Anderson County

Total Arrests
Submitted to DPS

Percent of Arrests
for Which
Disposition Records
Were Submitted to
DPS

Total Dispositions
Submitted to DPS

2,028

709

34.96%

Andrews County

893

741

82.98%

Angelina County

2,610

2,059

78.89%

Aransas County

740

593

80.14%

Archer County

232

167

71.98%

89

48

53.93%

1,486

864

58.14%

Austin County

899

689

76.64%

Bailey County

147

117

79.59%

Bandera County

552

468

84.78%

Bastrop County

1,809

1,223

67.61%

139

99

71.22%

Bee County

1,275

653

51.22%

Bell County

9,370

7,485

79.88%

Armstrong County
Atascosa County

Baylor County

Bexar County

49,613

37,562

75.71%

Blanco County

238

86

36.13%

Borden County

14

6

42.86%

Bosque County

475

336

70.74%

Bowie County

3,456

1,750

50.64%

Brazoria County

9,087

7,601

83.65%

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 30

Adult Arrest Records Submitted to DPS from September 1, 2008, to August 31, 2009
And Associated Prosecutor or Court Office Records Submitted to DPS as of January 2011

County
Brazos County
Brewster County

Total Arrests
Submitted to DPS

Percent of Arrests
for Which
Disposition Records
Were Submitted to
DPS

Total Dispositions
Submitted to DPS

6,675

5,442

81.53%

542

270

49.82%

Briscoe County

38

30

78.95%

Brooks County

1,136

155

13.64%

Brown County

1,888

1,450

76.80%

547

368

67.28%

Burnet County

1,580

1,008

63.80%

Caldwell County

1,494

1,206

80.72%

Calhoun County

941

659

70.03%

Callahan County

360

308

85.56%

Cameron County

11,730

4,469

38.10%

Camp County

666

497

74.62%

Carson County

430

267

62.09%

Cass County

936

513

54.81%

Castro County

159

66

41.51%

Chambers County

1,535

1,006

65.54%

Cherokee County

1,907

1,331

69.80%

Childress County

355

260

73.24%

Clay County

Burleson County

340

242

71.18%

Cochran County

47

21

44.68%

Coke County

92

72

78.26%

235

135

57.45%

11,720

9,216

78.63%

Coleman County
Collin County
Collingsworth County

130

44

33.85%

Colorado County

908

868

95.59%

3,068

1,678

54.69%

516

412

79.84%

Concho County

96

40

41.67%

Cooke County

885

673

76.05%

Comal County
Comanche County

Coryell County

1,968

1,403

71.29%

Cottle County

42

21

50.00%

Crane County

116

91

78.45%

Crockett County

292

221

75.68%

Crosby County

179

135

75.42%

Culberson County

122

4

3.28%

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 31

Adult Arrest Records Submitted to DPS from September 1, 2008, to August 31, 2009
And Associated Prosecutor or Court Office Records Submitted to DPS as of January 2011

County
Dallam County
Dallas County

Total Arrests
Submitted to DPS

Percent of Arrests
for Which
Disposition Records
Were Submitted to
DPS

Total Dispositions
Submitted to DPS

280

192

68.57%

67,269

49,227

73.18%

Dawson County

302

67

22.19%

Deaf Smith County

898

746

83.07%

Delta County

172

129

75.00%

Denton County

12,890

10,046

77.94%

Dewitt County

698

591

84.67%

Dickens County

54

46

85.19%

Dimmit County

415

104

25.06%

Donley County

153

97

63.40%

1,033

553

53.53%

640

543

84.84%

5,686

4,398

77.35%

45

7

15.56%

20,666

14,867

71.94%

Ellis County

3,578

2,898

80.99%

Erath County

1,041

873

83.86%

539

482

89.42%

Duval County
Eastland County
Ector County
Edwards County
El Paso County

Falls County
Fannin County

965

729

75.54%

Fayette County

601

498

82.86%

Fisher County

83

65

78.31%

Floyd County

77

48

62.34%

Foard County

17

1

5.88%

Fort Bend County

10,201

7,299

71.55%

Franklin County

347

189

54.47%

Freestone County

621

419

67.47%

Frio County

679

308

45.36%

Gaines County

685

582

84.96%

12,830

11,312

88.17%

Garza County

176

118

67.05%

Gillespie County

676

574

84.91%

Glasscock County

10

4

40.00%

Goliad County

258

238

92.25%

Gonzales County

895

602

67.26%

1,135

638

56.21%

Galveston County

Gray County

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 32

Adult Arrest Records Submitted to DPS from September 1, 2008, to August 31, 2009
And Associated Prosecutor or Court Office Records Submitted to DPS as of January 2011

County

Total Arrests
Submitted to DPS

Percent of Arrests
for Which
Disposition Records
Were Submitted to
DPS

Total Dispositions
Submitted to DPS

Grayson County

3,864

2,704

Gregg County

5,796

4,248

73.29%

708

296

41.81%

Guadalupe County

2,862

2,166

75.68%

Hale County

1,215

503

41.40%

Hall County

88

38

43.18%

261

174

66.67%

Grimes County

Hamilton County

69.98%

Hansford County

54

42

77.78%

Hardeman County

196

138

70.41%

2,109

1,403

66.52%

103,200

100,286

97.18%

2,130

1,675

78.64%

Hardin County
Harris County
Harrison County
Hartley County

133

92

69.17%

Haskell County

158

132

83.54%

5,303

3,760

70.90%

115

72

62.61%

3,117

2,148

68.91%

21,382

14,570

68.14%

1,574

696

44.22%

839

478

56.97%

Hood County

1,697

1,488

87.68%

Hopkins County

1,493

1,227

82.18%

Houston County

709

512

72.21%

Howard County

1,512

1,247

82.47%

290

4

1.38%

3,046

2,381

78.17%

820

416

50.73%

Irion County

31

26

83.87%

Jack County

171

126

73.68%

Hays County
Hemphill County
Henderson County
Hidalgo County
Hill County
Hockley County

Hudspeth County
Hunt County
Hutchinson County

Jackson County

854

699

81.85%

1,572

888

56.49%

Jeff Davis County

2

1

50.00%

Jefferson County

8,910

6,644

74.57%

Jim Hogg County

309

132

42.72%

Jim Wells County

1,310

555

42.37%

Jasper County

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 33

Adult Arrest Records Submitted to DPS from September 1, 2008, to August 31, 2009
And Associated Prosecutor or Court Office Records Submitted to DPS as of January 2011

County
Johnson County

Total Arrests
Submitted to DPS

Percent of Arrests
for Which
Disposition Records
Were Submitted to
DPS

Total Dispositions
Submitted to DPS

3,529

2,996

84.90%

Jones County

408

326

79.90%

Karnes County

328

192

58.54%

3,078

2,263

73.52%

Kendall County

422

256

60.66%

Kenedy County

385

265

68.83%

Kent County

16

12

75.00%

Kerr County

2,317

1,974

85.20%

287

208

72.47%

King County

42

30

71.43%

Kinney County

89

41

46.07%

1,744

1,234

70.76%

Knox County

107

68

63.55%

La Salle County

376

55

14.63%

1,900

1,819

95.74%

Lamb County

283

225

79.51%

Lampasas County

661

589

89.11%

Lavaca County

517

415

80.27%

Kaufman County

Kimble County

Kleberg County

Lamar County

Lee County

716

489

68.30%

Leon County

460

319

69.35%

2,092

1,631

77.96%

Limestone County

937

702

74.92%

Lipscomb County

49

44

89.80%

Live Oak County

481

344

71.52%

Llano County

705

268

38.01%

9

1

11.11%

11,668

9,526

81.64%

Lynn County

305

196

64.26%

Madison County

467

390

83.51%

Marion County

580

542

93.45%

Martin County

99

38

38.38%

Mason County

76

71

93.42%

Matagorda County

1,690

1,424

84.26%

Maverick County

1,249

268

21.46%

277

201

72.56%

Liberty County

Loving County
Lubbock County

McCulloch County

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 34

Adult Arrest Records Submitted to DPS from September 1, 2008, to August 31, 2009
And Associated Prosecutor or Court Office Records Submitted to DPS as of January 2011

County
McLennan County
McMullen County

Total Arrests
Submitted to DPS

Percent of Arrests
for Which
Disposition Records
Were Submitted to
DPS

Total Dispositions
Submitted to DPS

10,223

8,596

84.08%

16

13

81.25%

Medina County

1,585

850

53.63%

Menard County

167

158

94.61%

Midland County

5,343

4,149

77.65%

Milam County

1,006

852

84.69%

96

82

85.42%

Mitchell County

288

184

63.89%

Montague County

700

270

38.57%

12,740

7,191

56.44%

Moore County

1,046

926

88.53%

Morris County

649

525

80.89%

Mills County

Montgomery County

Motley County

13

10

76.92%

Nacogdoches County

2,979

2,017

67.71%

Navarro County

2,112

1,661

78.65%

Newton County

553

361

65.28%

Nolan County

797

609

76.41%

13,292

10,725

80.69%

Ochiltree County

544

423

77.76%

Oldham County

143

58

40.56%

Orange County

2,899

1,918

66.16%

Palo Pinto County

1,149

827

71.98%

Panola County

1,001

531

53.05%

Parker County

Nueces County

2,910

2,311

79.42%

Parmer County

331

251

75.83%

Pecos County

601

225

37.44%

Polk County

1,739

1,230

70.73%

Potter County

5,692

4,774

83.87%

5

1

20.00%

Presidio County
Rains County

395

319

80.76%

Randall County

2,843

2,356

82.87%

Reagan County

137

77

56.20%

Real County

111

45

40.54%

Red River County

461

297

64.43%

Reeves County

511

249

48.73%

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 35

Adult Arrest Records Submitted to DPS from September 1, 2008, to August 31, 2009
And Associated Prosecutor or Court Office Records Submitted to DPS as of January 2011

County
Refugio County
Roberts County

Total Arrests
Submitted to DPS

Percent of Arrests
for Which
Disposition Records
Were Submitted to
DPS

Total Dispositions
Submitted to DPS

467

352

75.37%

10

3

30.00%

817

666

81.52%

2,306

1,953

84.69%

458

278

60.70%

1,148

795

69.25%

Sabine County

265

204

76.98%

San Augustine County

441

157

35.60%

San Jacinto County

635

419

65.98%

San Patricio County

3,037

2,550

83.96%

San Saba County

227

120

52.86%

Schleicher County

138

92

66.67%

Scurry County

727

616

84.73%

Shackelford County

125

99

79.20%

1,198

783

65.36%

25

14

56.00%

6,224

5,555

89.25%

153

117

76.47%

Robertson County
Rockwall County
Runnels County
Rusk County

Shelby County
Sherman County
Smith County
Somervell County
Starr County

1,902

284

14.93%

Stephens County

449

297

66.15%

Sterling County

80

69

86.25%

Stonewall County

49

37

75.51%

161

103

63.98%

Sutton County
Swisher County

164

25

15.24%

Tarrant County

46,129

29,977

64.99%

Taylor County

5,778

4,812

83.28%

Terrell County

15

4

26.67%

481

224

46.57%

34

22

64.71%

Terry County
Throckmorton County
Titus County

1,331

649

48.76%

Tom Green County

4,697

3,826

81.46%

Travis County

40,323

19,507

48.38%

Trinity County

274

95

34.67%

Tyler County

640

478

74.69%

Unknown or Out of State

611

215

35.19%

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 36

Adult Arrest Records Submitted to DPS from September 1, 2008, to August 31, 2009
And Associated Prosecutor or Court Office Records Submitted to DPS as of January 2011

County
Upshur County
Upton County

Total Arrests
Submitted to DPS

Percent of Arrests
for Which
Disposition Records
Were Submitted to
DPS

Total Dispositions
Submitted to DPS

1,150

889

77.30%

124

64

51.61%

1,307

610

46.67%

Val Verde County

929

460

49.52%

Van Zandt County

1,285

691

53.77%

Victoria County

3,941

3,073

77.98%

Walker County

2,066

1,362

65.92%

Waller County

1,379

772

55.98%

542

500

92.25%

1,496

1,246

83.29%

10,433

2,828

27.11%

2,010

1,637

81.44%

Uvalde County

Ward County
Washington County
Webb County
Wharton County
Wheeler County

175

110

62.86%

5,886

4,194

71.25%

Wilbarger County

724

601

83.01%

Willacy County

641

334

52.11%

10,037

8,758

87.26%

932

634

68.03%

Wichita County

Williamson County
Wilson County
Winkler County

269

201

74.72%

Wise County

2,140

1,872

87.48%

Wood County

1,160

843

72.67%

Yoakum County

240

169

70.42%

Young County

784

608

77.55%

Zapata County

614

6

0.98%

Zavala County

213

15

7.04%

Source: State Auditor’s Office analysis of DPS reports on court and prosecutor offices’ submission of
disposition records.

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 37

Appendix 4

Counties That Did Not Submit Dispositions for TDCJ Admissions in
November 2010
Auditors reviewed the records of 21,351 offenders in jail, in prison, or on
probation who were convicted of crimes and began serving sentences in
November 2010. The Department of Public Safety’s Computerized Criminal
History System did not include prosecutor office or court records for 1,634
(7.65 percent) of those 21,351 offenders. Table 6 lists the 10 counties with
the largest numbers of offenders without court or prosecutor office records in
the Computerized Criminal History System.
Table 6

Ten Counties with the Largest Number of Offenders for Whom
The Computerized Criminal Justice System Did Not Include Prosecutor Office or Court Records
November 2010
Number of Offenders Without Court or
Prosecutor Office Records in the
Computerized Criminal History System as a
Percent of Offenders Admitted to Jail,
Prison, or Probation

Number of Offenders Without Court or
Prosecutor Office Records in the
Computerized Criminal History System

County
Dallas County

215

1.01%

Travis County

137

0.64%

Cameron County

136

0.64%

Hidalgo County

110

0.52%

Bexar County

85

0.40%

Tarrant County

66

0.31%

McLennan County

39

0.18%

Fort Bend County

38

0.18%

Caldwell County

31

0.15%

Jefferson County

29

0.14%

Source: State Auditor’s Office analysis of offenders that the Texas Department of Criminal Justice admitted to jail, prison, or
probation in November 2010 and records in the Department of Public Safety’s Computerized Criminal History System for
September 1, 2009, through November 30, 2010.

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 38

Appendix 5

Counties Whose Probation Office Records Lacked Offenders’ State
Identification Numbers
As discussed in Chapter 1-B, local probation offices do not always submit a
state identification number to the Texas Department of Criminal Justice’s
Intermediate System (ISYS), which is a component of the Corrections
Tracking System. Texas Code of Criminal Procedure, Section 60.052, states
that information in the Corrections Tracking System must include the
offender’s state identification number.
Table 7 lists the 10 counties with the largest number of probation records that
did not have state identification numbers in ISYS in March 2011.
Table 7

Ten Counties with the Largest Number of Active and Inactive Probation Records in
March 2011 That Did Not Have Offenders’ State Identification Numbers in ISYS

County

Number of Probation
Records with No State
Identification Number

Percent of Total Probation
Records with No State
Identification Number

Harris County

19,545

40.96%

Bexar County

3,671

7.69%

Gregg County

3,336

6.99%

Tarrant County

1,730

3.63%

El Paso County

1,691

3.54%

Nueces County

782

1.64%

Liberty County

717

1.50%

Dallas County

585

1.23%

Collin County

520

1.09%

Smith County

449

0.94%

Source: State Auditor’s Office analysis of records in the Texas Department of Criminal Justice’s ISYS.

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 39

Appendix 6

Counties That Did Not View Arrest Records Associated with Flash
Notices
Auditors reviewed flash notices associated with the Texas Department of
Criminal Justice’s probation programs in May 2011 and determined that users
representing 120 (47.24 percent) of the 254 counties in Texas had not viewed
arrest records associated with flash notices for at least a six-month period.
Table 8 lists the counties that had inactive accounts preventing them from
viewing arrests associated with flash notices.
Table 8

Counties That Did Not View
Arrest Records Associated with Flash Notices
County Name

Status of Account

Anderson County

Inactive

Angelina County

Inactive

Archer County

Inactive

Armstrong County

Inactive

Austin County

Inactive

Bailey County

Inactive

Baylor County

Inactive

Bexar County

Inactive

Borden County

Inactive

Bosque County

Inactive

Brazos County

Inactive

Brewster County

Inactive

Briscoe County

Inactive

Brooks County

Inactive

Brown County

Inactive

Calhoun County

Inactive

Castro County

Inactive

Cherokee County

Inactive

Clay County

Inactive

Cochran County

Inactive

Coke County

Inactive

Colorado County

Inactive

Comanche County

Inactive

Concho County

Inactive

Cottle County

Inactive

Crockett County

Inactive

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 40

Counties That Did Not View
Arrest Records Associated with Flash Notices
County Name

Status of Account

Dallam County

Inactive

DeWitt County

Inactive

Dickens County

Inactive

Dimmit County

Inactive

Duval County

Inactive

Ector County

Inactive

Edwards County

Inactive

Fannin County

Inactive

Fayette County

Inactive

Fisher County

Inactive

Floyd County

Inactive

Foard County

Inactive

Fort Bend County

Inactive

Glasscock County

Inactive

Goliad County

Inactive

Gonzales County

Inactive

Hale County

Inactive

Hamilton County

Inactive

Hansford County

Inactive

Hardeman County

Inactive

Hardin County

Inactive

Hartley County

Inactive

Haskell County

Inactive

Hemphill County

Inactive

Hill County

Inactive

Hockley County

Inactive

Houston County

Inactive

Howard County

Inactive

Hutchinson County

Inactive

Irion County

Inactive

Jackson County

Inactive

Jeff Davis County

Inactive

Jefferson County

Inactive

Jim Hogg County

Inactive

Jim Wells County

Inactive

Kenedy County

Inactive

Kent County

Inactive

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 41

Counties That Did Not View
Arrest Records Associated with Flash Notices
County Name

Status of Account

King County

Inactive

Kinney County

Inactive

Kleberg County

Inactive

Knox County

Inactive

Lamar County

Inactive

Lamb County

Inactive

Lavaca County

Inactive

Lipscomb County

Inactive

Loving County

Inactive

Marion County

Inactive

Martin County

Inactive

Maverick County

Inactive

McLennan County

Inactive

Midland County

Inactive

Milam County

Inactive

Mills County

Inactive

Mitchell County

Inactive

Montague County

Inactive

Moore County

Inactive

Motley County

Inactive

Navarro County

Inactive

Nolan County

Inactive

Ochiltree County

Inactive

Panola County

Inactive

Parmer County

Inactive

Pecos County

Inactive

Potter County

Inactive

Presidio County

Inactive

Randall County

Inactive

Reagan County

Inactive

Reeves County

Inactive

Refugio County

Inactive

Roberts County

Inactive

Runnels County

Inactive

Schleicher County

Inactive

Scurry County

Inactive

Shelby County

Inactive

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 42

Counties That Did Not View
Arrest Records Associated with Flash Notices
County Name

Status of Account

Sherman County

Inactive

Starr County

Inactive

Sterling County

Inactive

Stonewall County

Inactive

Sutton County

Inactive

Swisher County

Inactive

Terrell County

Inactive

Throckmorton County

Inactive

Tom Green County

Inactive

Upshur County

Inactive

Upton County

Inactive

Val Verde County

Inactive

Victoria County

Inactive

Waller County

Inactive

Ward County

Inactive

Wheeler County

Inactive

Wilbarger County

Inactive

Winkler County

Inactive

Wood County

Inactive

Zavala County

Inactive

Source: State Auditor’s Office analysis of local probation offices’ use of
the Department of Public Safety’s Web site in May 2011.

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 43

Appendix 7

Related State Auditor’s Office Work
Related State Auditor’s Office Work
Number

Product Name

Release Date

06-022

An Audit Report on the Criminal Justice Information System

February 2006

An Audit Report on the Criminal Justice Information System at
The Department of Public Safety and the Texas Department of Criminal Justice
SAO Report No. 12-002
September 2011
Page 44

Copies of this report have been distributed to the following:

Legislative Audit Committee
The Honorable David Dewhurst, Lieutenant Governor, Joint Chair
The Honorable Joe Straus III, Speaker of the House, Joint Chair
The Honorable Steve Ogden, Senate Finance Committee
The Honorable Thomas “Tommy” Williams, Member, Texas Senate
The Honorable Jim Pitts, House Appropriations Committee
The Honorable Harvey Hilderbran, House Ways and Means Committee

Office of the Governor
The Honorable Rick Perry, Governor

Department of Public Safety
Members of the Public Safety Commission
Mr. Allan B. Polunsky, Chairman
Ms. Carin Marcy Barth
Ms. Ada Brown
Ms. A. Cynthia “Cindy” Leon
Mr. John Steen
Mr. Steven C. McCraw, Director

Texas Department of Criminal Justice
Members of the Board of Criminal Justice
Mr. Oliver J. Bell, Chairman
Mr. Tom Mechler, Vice Chairman
Mr. Leopoldo “Leo” Vasquez III, Secretary
Mr. John “Eric” Gambrell
Mr. Lawrence Gist
Ms. Janice Harris Lord
Mr. R. Terrell McCombs
Mr. J. David Nelson
Ms. Carmen Villanueva-Hiles
Mr. Brad Livingston, Executive Director

This document is not copyrighted. Readers may make additional copies of this report as
needed. In addition, most State Auditor’s Office reports may be downloaded from our Web
site: www.sao.state.tx.us.
In compliance with the Americans with Disabilities Act, this document may also be requested
in alternative formats. To do so, contact our report request line at (512) 936-9500 (Voice),
(512) 936-9400 (FAX), 1-800-RELAY-TX (TDD), or visit the Robert E. Johnson Building, 1501
North Congress Avenue, Suite 4.224, Austin, Texas 78701.
The State Auditor’s Office is an equal opportunity employer and does not discriminate on the
basis of race, color, religion, sex, national origin, age, or disability in employment or in the
provision of services, programs, or activities.
To report waste, fraud, or abuse in state government call the SAO Hotline: 1-800-TX-AUDIT.