A special agency that handles the Web hosting and online credit-card operations for the state and many local governments is under fire for its employees' spending on meals and other expenses and for not protecting sensitive data well enough.

The criticisms of the Statewide Internet Portal Authority were revealed in a state audit released Wednesday.

Some of the most critical parts of the audit focused on spending by SIPA's executive director, John Conley, who approves his own expenses, auditors found. There were $69,400 in expenses approved on Conley's corporate credit card in less than two years.

Conley said all of the expenses were business-related and included some operating costs such as paying the bill for the agency's e-mail services, but he agreed with auditors' contention that someone else should be approving his expenses.

Auditors also questioned $9,500 in meals charged by SIPA employees who were not traveling at the time and $4,200 in other expenses such as a holiday party that cost $80 per person, alcohol purchases and late-payment fees on credit cards.

"First, we question the business purpose of frequent, small purchases at places like Starbucks or 7-Eleven," the audit said. "Second, we question the high cost and business purpose of meals at restaurants such as Earl's, Panzano and The Broker, for which SIPA did not maintain documentation of the individuals attending the meal or the business purpose of the meal."

Conley said the meals were for business- development purposes, but he agreed SIPA officials should document the expenses more properly.

And he said the holiday party cost $80 per person because half the guests didn't show up due to inclement weather. Yet the catering bill still had to be paid, he said.

The audit also cited security concerns with Colorado Interactive, SIPA's credit- card-transaction contractor.

"We reviewed Colorado Interactive's controls over user access to the transaction payment engine system and found problems with 198 (61 percent) of the 327 user IDs we reviewed," auditors said. "IDs that are never used or not used for long periods provide attackers an unnecessary avenue for compromising systems."
