Auditors: Oregon DMV data system secure, accurate in handling fees, but online services could be more accessible

SALEM, Ore. (KTVZ) — In a largely positive audit released Wednesday, the Oregon Secretary of State Audits Division found the Oregon Driver and Motor Vehicle Services Division (DMV)’s data system for vehicle licensing and registration works well to accurately assess, collect and transfer fees and data.

That data system is the Oregon License Issuance and Vehicle Registration system, otherwise known as OLIVR. Before the implementation of OLIVR in 2019, the DMV had only three online services. There are now more than 20 online services available to Oregonians, from renewing vehicle registrations to replacing a lost or damaged ID card.

The DMV serves an average of 8,000 people each day and more than 2 million each year — meaning millions of dollars in fees for licensing and vehicle registrations flows through this data system. Beyond fees, OLIVR also captures personally identifiable information for millions of Oregonians, including birth dates and home addresses.

For this reason, it is critically important that OLIVR have robust, functional controls in place to ensure the accuracy of its data and the protection of this sensitive information. Auditors focused on controls for this IT audit, evaluating the effectiveness of controls governing financial transaction data input, processing and output, and application security, among others.

The audit did not assess how the system identifies voter registration records to be transferred to the Secretary of State as part of automatic voter registration.

Overall, the audit team found the OLIVR system accurately assesses and collects fees for issuing drivers licenses and vehicle registrations to Oregonians. Auditors also determined the system was secure, although there were some ways the department could further strengthen controls to better mitigate risk.

Specifically, auditors found the DMV could do a better job managing which employees have access to the system, strengthening passwords, and conducting more regular security risk assessments.

“Oregonians should be reassured by the findings in this audit, and the DMV should be happy with the work that’s already been done to implement and secure OLIVR,” said Audits Director Kip Memmott. “They’ve established a good foundation, but now it’s time to build on it and further strengthen IT controls.”

Auditors did identify one area in need of significant improvement: the accessibility of the system’s online services, specifically to Oregonians with disabilities or who are not proficient in English.

Auditors found the DMV’s public web portal lacked some accessibility features, such as multi-language support and support for the visually impaired.

For example, while the main DMV website has built-in language translation services, the service portal itself does not, relying instead on Google Translate within the web browser. The use of Google Translate in this context was not intuitive for users, inconsistent across pages, not functional on mobile devices, and could display error messages depending on the browser.