Engagement Memo—Managing Legacy IT Systems

Amtrak (the company) relies on hundreds of information technology (IT) systems to support its business and rail operations. These include systems that use obsolete technology that may create inefficiencies, increase maintenance costs, and elevate operational and cybersecurity risks. Accordingly, we are initiating a review of the company’s management of these IT systems—commonly called “legacy” systems.

Our objective is to assess the company’s efforts to manage its legacy systems and mitigate the associated risks. We may expand our scope or modify our objective during the review. We plan to interview company officials; review policies and procedures; and analyze system information. We will work to minimize disruptions to the company by coordinating meetings with staff in advance.

We will perform our work in accordance with generally accepted government auditing standards. Our interactions with the company will be consistent with P/I 2.1.4, which sets forth the relationship between our office and the company. In particular, section 7.0 of the policy discusses coordination between company officials and our Office of Audits.

We request that your office arrange an entrance conference for us with the appropriate company officials at the earliest possible date. We will keep you advised of the status of our work and any material changes in our objective, should they occur.

If you have any questions, please call (202) 906-4600.