1. Consider a 400-MW, 32 percent efficient coal-fired power plan.docx

1. Consider a 400-MW, 32 percent efficient coal-fired power
plant that uses cooling water withdrawn from a nearby river
(with an upstream flow of 10-m3/s and temperature 20 °C) to
take care of waste heat. The heat content of the coal is 8,000
Btu/lb, the carbon content is 60% by mass, and the sulfur
content is 2% by mass.
i. How much electricity (in kWh/yr) would the plant produce
each year?
ii. How many pounds per hour of coal would need to be burned
at the plant?
iii. Estimate the annual carbon emissions from the plant (in
metric tons C/year).
iv. Convert the carbon emissions to g C/kJ of energy produced.
Compare your answer to that in Problem 2.7 of Homework 3 for
petroleum combustion, and Example 2-3 for methane
combustion. Comment on why coal is considered the “dirtiest”
fossil fuel!
v. If the cooling water is only allowed to rise in temperature by
10 °C, what flow rate (in m3/s) from the stream would be
required? Is this sustainable? What would you recommend?
vi. What would be the river temperature if all the waste heat
was transferred to the river water assuming no heat losses
during transfer? Would that be a problem? Why or why not.
vii. Estimate the hourly SO2 emissions (in kg/h) from the plant
assuming that all the sulfur is oxidized to SO2 during
combustion.
viii. What would be the problem in releasing SO2 to the
atmosphere? Is sulfur dioxide a regulated priority pollutant? If
yes, report the NAAQS?
ix. How would you propose to remove sulfur dioxide at the
power plant?
x. Report on the required efficiency (in removal %) of the SO2
scrubber, if the plant is only allowed to emit the legal limit of

0.6 lb SO2 per million Btu of heat input.
xi. How much particulate matter could be released (in kg/year
particulates) if the plant met New Source Performance
Standards (NSPS) that limit particulate emissions to 0.03 lb per
106 Btu heat?
xii. Comment on the sources of particulates in the plant
emissions? We have seen a dramatic decrease in particulate
emissions since the 1970 Clean Air Act. How are particulate
emissions controlled at stationary sources?
2. Consider an area-source box model for air pollution above a
peninsula of land. The length of the box is 50 km, its width is
20 km, and a radiation inversion restricts mixing to 20 m. Wind
is blowing clean air into the long dimension of the box at 0.4
m/s. Between 8 and 10 a.m. there are 300,000 vehicles on the
road, each being driven 50 km, and each emitting 4 g CO/km.
CO gets oxidized to carbon dioxide in the atmosphere. The half-
life for CO in the atmosphere is 3 hours. Assume air
temperature is 20⁰C.
i. Estimate the steady state CO concentration in the air shed (in
mg/m3)
ii. Convert to ppmv and determine whether it exceeds the
NAAQS.
iii. If there was no CO at 8 a.m., determine the CO
concentration(in mg/m3) at 10 o’clock.
iv. How would air quality change if the wind speed picked up to
20 mph (miles per hour)? Here you need to recalculate the
steady state CO concentration (in mg/m3).
Report 20: May 2019

Western Australian
Auditor General’s Report
Information Systems
Audit Report 2019
Office of the Auditor General
Western Australia
7th Floor Albert Facey House
469 Wellington Street, Perth
Mail to:
Perth BC, PO Box 8489
PERTH WA 6849
T: 08 6557 7500
F: 08 6557 7600
E: [email protected]
W: www.audit.wa.gov.au
National Relay Service TTY: 13 36 77
(to assist people with hearing and voice impairment)
We can deliver this report in an alternative format for
those with visual impairment.

© 2019 Office of the Auditor General Western Australia.
All rights reserved. This material may be reproduced in
whole or in part provided the source is acknowledged.
ISSN: 2200-1931 (Print)
ISSN: 2200-1921 (Online)
WESTERN AUSTRALIAN AUDITOR GENERAL’S REPORT
Information Systems Audit Report 2019
Report 20
May 2019
THE PRESIDENT THE SPEAKER
LEGISLATIVE COUNCIL LEGISLATIVE ASSEMBLY
INFORMATION SYSTEMS AUDIT REPORT 2019
This report has been prepared for Parliament under the
provisions of section 24 and 25 of
the Auditor General Act 2006.

Information systems audits focus on the computer environments
of public sector entities to
determine if these effectively support the confidentiality,
integrity and availability of
information they hold.
I wish to acknowledge the cooperation of the staff at the entities
included in our audits.
CAROLINE SPENCER
AUDITOR GENERAL
15 May 2019
Information Systems Audit Report 2019 | 3
Contents
Auditor General’s overview
......................................................................................... 4
Application controls audits
.......................................................................................... 5
Introduction
...............................................................................................
................... 5
Audit focus and scope
...............................................................................................
... 5
Summary
...............................................................................................

....................... 6
Recruitment Advertisement Management System – Public Sector
Commission ........... 8
Advanced Metering Infrastructure – Horizon
Power.....................................................16
Pensioner Rebate Scheme and Exchange – Office of State
Revenue .........................23
New Land Registry - Titles – Western Australian Land
Information Authority ..............29
General computer controls and capability assessments
........................................... 34
Introduction
...............................................................................................
..................35
Conclusion
...............................................................................................
...................35
Background
...............................................................................................
..................35
...............................................................................................
..36
Audit findings
...............................................................................................
................36

Recommendations
...............................................................................................
.......46
Appendix 1 – Cloud application (SaaS) better practice
principles ............................ 47
4 | Western Australian Auditor General
Auditor General’s overview
This is the eleventh annual Information Systems Audit Report
by my
Office. The report summarises the results of the 2018 annual
cycle of
information systems audits, and application reviews completed
by my
Office since last year’s report.
The report contains important findings and recommendations to
address
common system weaknesses that can seriously affect the
operations of
government and potentially compromise sensitive information
held by
entities. All public sector entities should consider the relevance
of the recommendations to
their unique operations. The newly funded Office of Digital
Government has an important role
in supporting entities to address these weaknesses and improve

their capability and cyber
resilience.
The first section of the report contains the results of our audit
of key business applications at
4 public sector entities. All 4 had weaknesses, the most common
of which related to poor
contract management, policies, procedures and information
security.
When government outsources any ICT function, or buys cloud
hosted applications, it remains
responsible for identifying risks and ensuring appropriate
functionality, security and
availability controls are in place. Proper due diligence processes
must be undertaken, when
designing the contract and throughout the term of the contract,
to ensure government gets
the service it needs and the community expects. The potential
effect of any weaknesses
includes the compromise of sensitive information. Our Software
as a Service (SaaS) better
practice principles at Appendix 1 can assist entities in assessing
whether to move to the
cloud, choosing a provider and with ongoing contract
management.
The second section presents the results of our general computer
controls and capability
assessments and I have identified 4 entities that have
consistently demonstrated good
practices over at least the past 3 years. I was pleased to find
that 3 more entities were
assessed this year as having mature general computer control
environments across the 6
control categories of our assessment. However, the 2 categories

of information security and
business continuity, continue to show little improvement in the
last 11 years. Despite a slight
increase in the number of entities assessed as having mature
business continuity controls,
half of the entities we reviewed still do not manage this area
well.
Ensuring good security practices are implemented, enforced and
regularly tested should be a
focus and key responsibility for all entities’ executive teams.
Continually raising staff
awareness, at all levels, about information and cyber security
issues is another proven way
to embed good practice and security hygiene into everyday
operations.
Application controls audits
Introduction
Applications are software programs that facilitate an
organisation’s key business processes
including finance, human resources, case management, licensing
and billing. Applications
also facilitate specialist functions that are unique and essential
to individual entities.
Each year we review a selection of important applications that
entities rely on to deliver

services. We focus on the key controls that ensure data is
complete, and accurately
captured, processed and maintained. Failings or weaknesses in
these controls have the
potential to affect other organisations and the public. Impacts
range from delays in service
and loss of information, to possible fraudulent activity and
financial loss. Entities can use our
better practice principles at Appendix 1 to help ensure any
Software as a Service (SaaS)
contracts include measures to mitigate risks and protect entity
information.
We reviewed key business applications at a number of state
government entities. Each
application is important to the operations of the entity and may
affect stakeholders, including
the public, if the application and related processes are not
managed appropriately.
The 4 applications covered in this report are:
1. Recruitment Advertisement Management System – Public
Sector Commission
2. Advanced Metering Infrastructure – Horizon Power
3. Pensioner Rebate Scheme and Exchange – Office of State
Revenue
4. New Land Register – Western Australian Land Information
Authority
Our application reviews focused on the systematic processing
and handling of data in the

following control categories:
1. Policies and procedures – are appropriate and support
reliable processing of
information
2. Security of sensitive information – controls exist to ensure
integrity, confidentiality
and availability of information at all times
3. Data input – information entered is accurate, complete and
authorised
4. Backup and recovery – is appropriate and in place in the
event of a disaster
5. Data output – online or hard copy reports are accurate and
complete
6. Data processing – information is processed as intended, in an
acceptable time
7. Segregation of duties – no staff perform or can perform
incompatible duties
8. Audit trail – controls over transaction logs ensure history is
accurate and complete
9. Masterfile maintenance, interface controls, data preparation
– controls over data
preparation, collection and processing of source documents
ensure information is
accurate, complete and timely before the data reaches the
application.
Our testing was a point in time assessment. We reviewed a

sample of key controls and
processes to obtain reasonable assurance that the applications
worked as intended and that
information they contained and reports were reliable, accessible
and secure. Our testing may
highlight weaknesses in control design or implementation that
increase the risk that an
application’s information may be susceptible to compromise.
However, we do not design our
tests to determine if information has been compromised.
Summary
The 4 applications we reviewed all had control weaknesses.
Most related to policies and
procedures, and poor information security. We also found
weaknesses in controls aimed to
ensure the applications function efficiently, effectively and
remain available. We reported 37
findings across the 4 applications. Nine findings were rated as
significant, 17 moderate and
11 minor.
Most of the issues we found are relatively simple and
inexpensive to fix. Figure 1 shows the
findings for each of the control categories and Figure 2 shows
the findings for each of the 4
applications reviewed.
Source: OAG

Figure 1: Application audits
Source: OAG
Figure 2: Findings per application
Recruitment Advertisement Management System –
Public Sector Commission
Introduction
Western Australian (WA) government entities use the
Recruitment Advertisement
Management System (RAMS) to manage staff recruitment and
redeployments, and to record
severance details. The public use the system to apply for WA
government jobs. The system
is externally hosted, and managed by a third-party vendor in a
Software as a Service (SaaS)
arrangement. It contains personal identifiable and sensitive
information such as names,
addresses, work history, qualifications, bank details and tax file
numbers.
Conclusion
RAMS has successfully facilitated a significant number of
recruitment processes since the
application was implemented in 2003. However, we identified a
number of opportunities to

improve application governance. The Public Sector Commission
(the Commission) has not
undertaken or received independent assurance that key vendor
managed information
security controls are adequate and operating to ensure the
confidentiality, integrity and
availability of information in RAMS.
Further, the Commission cannot demonstrate it is monitoring
and managing vendor
compliance in accordance with the service level agreement and
so may not be fully informed
of any issues with service delivery or not meeting all users’
needs.
There is also a risk that insufficient business continuity
planning could see an outage
impacting recruitment activities across the whole of the WA
government.
Poor user access management has the potential to expose
personal and sensitive
information to inappropriate access or misuse, particularly as
the Commission has kept all
information stored on the system since 2003.
Background
RAMS is a mandated whole of government e-recruitment
solution. All relevant WA state
entities must use the application to advertise vacancies, manage
redeployments and record
severances. Entities access the application via an internet
administration portal. A separate
portal is provided for data analysis and reporting. The public
can view vacancies, create a
profile and submit job applications online through multiple job

boards (Figure 3).
Source: OAG
Figure 3: High-level overview of RAMS
In 2017-18, RAMS processed about 238,000 applications for
almost 15,400 job
advertisements. Currently, there are about 712,000 people with
a job seeker profile in the
application.
The vendor manages the underlying environment (network,
storage, servers, virtualisation,
operating systems, middleware, runtime, data and applications)
and controls to protect the
system.
The Commission retains ownership of the data and the risks to
its confidentiality, integrity
and availability (Figure 4). It is also responsible for monitoring
delivery of service as per the
SaaS contract arrangement.
Security responsibility Software (as a service)
Governance Entity
Data Entity and Vendor
Runtime Vendor
Middleware Vendor
Operating Systems Vendor

Virtualisation Vendor
Servers Vendor
Storage Vendor
Network Vendor
Data Centres Vendor
Source: OAG based on RAMS contract and SaaS principles 1
Figure 4: SaaS security responsibilities
The WA public sector has used RAMS since 2003. The most
recent contract extension was
awarded in April 2018 for 2 years. A service level agreement is
in place that sets out
expectations of service.
Audit findings
The Commission has not sought adequate assurance on vendor
controls
The Commission has not undertaken or received independent
assurance that key vendor
managed information security controls are adequate and
operating effectively. As a result,
the Commission does not have assurance that information in
RAMS is protected to ensure its
confidentiality, integrity and availability.
We identified the following control deficiencies:
• Unsupported software – Some software components that
underpin the application are
no longer supported by the software vendors. In addition, 1

component has not had
software updates applied that fix known security vulnerabilities.
Unsupported and out–
of-date software increases the risk of attackers using known
vulnerabilities to gain
access to sensitive information or disrupt systems.
• Disaster recovery not tested – The vendor has not performed a
full disaster recovery
test since 2015. The Commission cannot be certain that it can
recover the application
as required.
• Outdated technical specification documentation – The
technical documentation
describing the application does not reflect the current
application environment. The
Commission cannot be certain that all appropriate controls are
in place to protect the
application.
Lack of a risk assessment has led to inadequate information
security
requirements in the contract
The Commission did not assess the information security risks to
the RAMS application and
information at the time of contract or extensions. Without a
formal risk assessment, the
Commission is less likely to know if controls documented in the
contract adequately address
risks and vulnerabilities. In a SaaS environment, the customer
does not directly manage the
controls that protect information. Therefore, it is critical that
controls are well defined in the
service contract.

We found key terms and conditions for security of information
are inadequately specified in
the contract.
Weaknesses we identified include:
• No right to conduct security audits – There is no specific right
for the Commission to
conduct security audits of the RAMS environment. As a result,
the Commission may
have limited ability to verify security controls.
1 https://cloudsecurityalliance.org/download/security-guidance-
v4/
• No controls assurance – There is no requirement for the
vendor to provide the
Commission with third party assurance reports or certification
that controls are in place
and operating effectively. The Commission cannot be certain
that RAMS and the
information it holds are protected.
• Unspecified obligation to report data security breaches – The
vendor’s obligation
and process to report data security breaches to the Commission
have not been
specified. In addition, there are no defined penalties or
indemnities for a security
breach. Defining these requirements would allow the
Commission to act in a timely

fashion and, if necessary, recover costs in the event of a breach.
• Encryption not specified – Data encryption requirements to
protect sensitive
information in transit, at rest and stored on backups have not
been specified. For
example, the vendor does not encrypt backup tapes which are
stored by a third party
offsite. If the tapes are lost or stolen the information on them
could be inappropriately
accessed. The international standard for information security
(ISO27002/2015) advises
data owners to encrypt backup media where confidentiality is
important.
• Unspecified data retention – Data retention requirements have
not been specified. All
information since 2003 has been retained in the system. This
information is vulnerable
to exposure if the application is compromised. Further,
retaining all this information
increases the risk that Australia’s Privacy Act 1988 and the
European General Data
Protection Regulation may be breached, which could result in
infringements and
reputational damage.
The contract should also be consistent with the State Records
Office’s General
Disposal Authority. This states that job applicant information
should be disposed after 7
years for successful applicants and 1 year for unsuccessful
applicants.
Inadequate access controls increase the risk of unauthorised
access or misuse

We identified the following weaknesses in access controls to
minimise the risk of
unauthorised access:
• Ineffective user account management – The Commission does
not have a policy or a
procedure to manage entity user accounts, including highly
privileged accounts. In
addition, there is no process to routinely review user activity
and their levels of access.
There is an increased risk of unauthorised access to, or misuse
of, information in the
application.
Ineffective user account management may have contributed to
the high number of
enabled accounts (approximately 30,000). 26% of these (8,000
accounts) have never
been used and 50% (15,000 accounts) have not been used in
over 6 months.
• Weak password configuration – The ‘admin’ portal does not
meet good practice
requirements for password complexity and does not limit the re-
use of passwords. In
addition, multi-factor authentication, where user access is only
granted after successful
presentation of 2 or more pieces of information, is not required
to access the
application. This leaves the portal susceptible to password
guessing attacks and
unauthorised access to information.
• Unmanaged generic accounts – Fifty five entities use generic
accounts to access the
internet facing reporting portal and the password for the generic

account is easy to
guess. Generic accounts and passwords are shared by email and
the Commission
does not know who has been given this information. As the
password is easy to guess
and not changed on a regular basis, staff moving within or
leaving an entity may retain
access to the reporting portal, increasing the likelihood of
unauthorised access and
disclosure.
Inadequate business continuity arrangements
We identified the following weaknesses in the Commission’s
business continuity
arrangements that increase the risk that RAMS may not be
restored in a timely manner after
a disruption:
• Out of date business continuity plan – The Commission has
not reviewed the RAMS
Business Continuity Plan since 2014. Further, stakeholder
entities’ critical functions,
processes and their recovery objectives were not considered
during the 2014 business
impact analysis. There is an increased risk that RAMS may not
operate adequately
during an incident and key stakeholder recovery requirements
have not been specified
in the vendor service contract.
• Ineffective escrow management – A software escrow

agreement is in place, but the
vendor has not deposited the code, data or documentation as
required by the contract.
The Commission was not aware of this since it had not verified
the deposits to confirm
that RAMS can be recovered from escrow. Without escrow
deposits, the Commission
will not be able to recover and continue the use of RAMS if the
vendor can no longer
provide the services.
A software escrow helps protect all parties in a software license
by having a third party
(escrow agent) hold application source code, data and
documentation. It ensures the
Commission has access to a copy of the system, under certain
contractual conditions.
Vendor compliance has not been well monitored to ensure
RAMS meets
entities’ needs
We identified weaknesses in how the Commission manages the
service level agreement
(SLA). These increase the risk that the Commission will not
receive the contracted services,
or be aware of issues with the vendor’s service delivery.
In particular, the Commission has not implemented key
requirements of the SLA to manage
the contracted service delivery. For example, the Commission
has not:
• held annual contract review and periodic contract management
meetings
• established, or allocated, a governance body to support

forward planning and provide
feedback on vendor performance
• conducted annual user satisfaction surveys since 2013
• received application backup reports and capacity management
plans from the vendor.
We note that the Commission does hold quarterly and ad hoc
meetings with the vendor. The
Commission informed us that the 3rd quarter meeting is
considered to be the annual review of
the contract. However, we found no documentary evidence of an
annual contract or SLA
review in our examination of the most recent 3rd quarter
meeting agenda or minutes.
Important application management processes could be improved
to reduce the
risk of unplanned system downtime
The Commission and vendor have not adequately documented,
and do not routinely follow,
change and incident management processes to manage issues
with the application (e.g.
incidents). Inadequate change and incident management can
lead to unplanned system
downtime and recurring issues. We identified the following
weaknesses:
• Changes are not properly managed – Change management
documentation is
unclear and inconsistent. In addition, the vendor had not
provided detailed change

process documentation as required by the SLA. We tested 2
changes which identified
that:
o the formal contract change template is not used
o written confirmation of regression testing, to confirm changes
have not negatively
affected existing functions, and user acceptance testing is not
performed.
• Incidents are not properly recorded, classified and analysed –
The Commission
does not record incidents and service requests in an appropriate
service desk tool,
increasing the risk that incidents may not be resolved in a
timely manner.
We note that the vendor does provide the Commission with
incident volume reports.
However, we found that incidents are not classified to allow
trend analysis, and there is
no documented process for identifying the root cause of
recurring incidents. There is an
increased risk that recurring incidents may not be identified and
addressed.
Recommendations
The Commission should:

1. implement a risk assurance framework for SaaS arrangements
and conduct a risk
assessment of the RAMS application and information. Update
contractual terms based on
identified risks
Commission response: Agreed
Implementation timeframe: by December 2019
2. implement appropriate mechanisms and processes to manage
and monitor SLA
contractual obligations
3. establish a suitable mechanism for obtaining feedback from
stakeholders in key entities
Implementation timeframe: by July 2019
4. implement appropriate user account management practices
and communicate these to all
entities
Implementation timeframe: by October 2019
5. review and update the RAMS Business Continuity Plan based
on an appropriate Business

Impact Analysis involving key stakeholders, and update
contractual availability
requirements, if required.
Response from the Public Sector Commission
The Commission notes the feedback and recommendations
provided and
undertakes to implement these recommendations.
The current whole-of-government e-recruitment system (RAMS)
has had no security
breaches since its inception in 2003. The Commission is
confident that users’
information is protected to ensure its confidentiality, integrity
and availability.
The information provided in the audit will assist the
Commission in enhancing the
management of this contract, and will guide its future
contractual requirements
relating to information technology security as well as its
auditing and application
control requirements.

Advanced Metering Infrastructure – Horizon Power
Introduction
Our audit focused on the applications within the Advanced
Metering Infrastructure used by
the Regional Power Corporation, trading as Horizon Power
(Horizon), to record, monitor and
bill for the consumption of electricity. The applications store
personal and sensitive client
information such as customer name, address, date of birth and
locations where electricity
meters are installed.
Conclusion
The AMI system achieves its purpose. It collects and stores
electricity consumption data and
communicates the information to other Horizon business
systems.
However, the integrity and confidentiality of the system and
information it holds is at risk due

to inadequate background checks and contractor access
management. Improved network
and database security controls would also strengthen system
integrity.
Background
Horizon, is a state government-owned corporation that
generates, procures and distributes
electricity to residential, industrial and commercial customers
in regional towns and remote
communities. Currently it provides electricity to over 100,000
residents and 10,000
businesses.
Horizon has a suite of applications to manage electricity
consumption and billing. Together,
they are referred to as Advanced Metering Infrastructure (AMI).
These include the MV90,
Velocity, MDR, MData21 and SSN systems. Our audit focused
on the MV90 commercial
metering system, and associated applications including the ‘My
Account’ portal.
The following figure (Figure 5) shows an overview of
information flow across the different
parts of the AMI system.
Figure 5: High level view of AMI system

In October 2016, more than 47,000 ageing electricity meters
across regional WA were
replaced with advanced meters. These meters allow Horizon to
use the MV90 and other
systems to collect electricity consumption data over the network
without staff having to
physically visit customer sites.
Audit findings
There are appropriate processes to detect and remedy
consumption errors
before bills are issued, but the value of errors is high
Horizon has good processes to detect and remedy data errors in
consumption readings.
Consumption readings occur daily for all advanced meters with
network access. The Velocity
system reports significant billing variances for early corrective
action where required, and
account managers review bills before they are issued to
commercial customers.
In 2017-18, Horizon corrected errors valued at $1.43 billion
(Figure 6). These comprised
errors of $1.42 billion for one commercial customer and $8.5
million for other commercial
customers. The $1.42 billion error arose from the manual
reading of the customer’s meter
which does not have network access and must be read using a
handheld device. Remaining
errors were due to factors such as incorrect rates being applied
to a customer, incorrect data
and system changes.
While Horizon resolves errors as they arise, their high value is
concerning.

Figure 6: Data errors corrected in FY 2017-18
Inadequate human resource security and contractor access
management
Horizon’s policies …

1. Consider a 400-MW, 32 percent efficient coal-fired power plan.docx

Recommended

Recommended

More Related Content

Similar to 1. Consider a 400-MW, 32 percent efficient coal-fired power plan.docx

Similar to 1. Consider a 400-MW, 32 percent efficient coal-fired power plan.docx (20)

More from stilliegeorgiana

More from stilliegeorgiana (20)

Recently uploaded

Recently uploaded (20)

1. Consider a 400-MW, 32 percent efficient coal-fired power plan.docx