£
<
33
V
Q
PRCf
-------
Report Contributors:
Paul Curtis
Wanda Whitfield
Catherine Allen
Kelly Bonnette
Sheila May
Myka Sparrow
Gloria Taylor-Upshaw
Abbreviations
CTS
Customer Technology Solutions
EPA
U.S. Environmental Protection Agency
FAR
Federal Acquisition Regulation
FAS
Fixed Assets Subsystem
FY
Fiscal year
IFMS
Integrated Financial Management System
OARM
Office of Administration and Resources Management
OEI
Office of Environmental Information
OIG
Office of Inspector General
PAO
Property accountable officer
PMO
Property management officer
PUO
Property utilization officer
Hotline
To report fraud, waste, or abuse, contact us through one of the following methods:
e-mail: OIG Hotline@epa.gov write: EPA Inspector General Hotline
phone: 1-888-546-8740 1200 Pennsylvania Avenue NW
fax: 703-347-8330 Mailcode 8431P (Room N-4330)
online: http://www.epa.gov/oiq/hotline.htm Washington. DC 20460
-------
* ' U.S. Environmental Protection Agency n-p-0705
f JHL \ Office of Inspector General September 26, 2011
s
—'—'J"
\ vjv "
At a Glance
Why We Did This Review
We performed this review to
determine whether the U.S.
Environmental Protection
Agency (EPA) has adequate
controls for safeguarding
personal computers.
Specifically, we sought to
determine (1) whether EPA
has adequate controls in place
for tracking and disposing of
personal computers, and
(2) the status of EPA-owned
personal computers replaced
under the Customer
Technology Solutions (CTS)
service contract.
Background
EPA's Office of
Administration and
Resources Management
manages the Agency's
personal property. During
fiscal year 2009, EPA
contracted its desktop
computer services with the
CTS service contract. The
Office of Environmental
Information has primary
oversight of the contract.
For further information,
contact our Office of
Congressional and Public
Affairs at (202) 566-2391.
The full report is at:
www.epa.qov/oiq/reports/2011/
20110926-11 -P-0705.pdf
Catalyst for Improving the Environment
EPA's Contract Oversight and Controls Over
Personal Computers Need Improvement
What We Found
EPA paid the CTS contractor a total of $489,734 over an 11-month period for
3,343 seats—a standard seat includes a leased computer with accessories and
technical support—not ordered by the Agency during the period. In addition, EPA
did not accept the contractor's monthly asset management performance self-rating
for over a year because of its nonperformance in properly accounting for and
tracking assets. As a result, EPA should take action to reduce the minimum
number of seats requirement in the CTS contract. If EPA does not make changes
to the CTS contract, EPA may pay as much as $1.4 million more through
September 2012 for personal computer standard seats that it did not order, for a
total potential payment of $1.9 million for seats not ordered.
Because EPA did not safeguard and track personal computers to ensure proper
replacement and disposal in accordance with property regulations, it cannot
account for 638 personal computers valued at over $1 million. EPA did not know
the status of these personal computers, some of which may have been replaced
under the CTS contract. EPA's Personal Property Policy and Procedures Manual
outlines requirements for property staff to ensure the effective accountability,
utilization, and disposal of personal property. EPA should improve controls for
updating data in the fixed assets database, and should retain property acquisition
documentation in accordance with retention requirements. In addition, the
Agency should have a separation of duties in its property staff positions and
consider assigning permanent property positions.
What We Recommend
We recommend that the Assistant Administrator for Environmental Information
and Chief Information Officer review and/or modify the CTS contract to adjust
the minimum standard seat requirement to eliminate monthly payments for CTS
computers that EPA will not need. We recommend that the Assistant
Administrator for Administration and Resources Management update the property
manual to require the separation of duties in property staff positions and consider
assigning permanent property positions throughout the Agency to ensure that there
are safeguards over EPA's assets. We also recommend that the Assistant
Administrator for Administration and Resources Management develop and
implement processes that would (1) require property staff to routinely review and
update the Fixed Assets Subsystem database, and (2) ensure that property staff
adhere to records retention requirements. EPA disagreed with our first
recommendation and we consider it unresolved and are working toward a
resolution. EPA agreed with the remaining three recommendations.
-------
o^EDSrX
sS?
£ \ UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
1^7 S WASHINGTON, D.C. 20460
\p„o/
THE INSPECTOR GENERAL
September 26, 2011
MEMORANDUM
SUBJECT: EPA's Contract Oversight and Controls Over Personal Computers
Need Improvement
Report No. ll-P-0705
FROM: Arthur A Elkins, Jr.
Inspector General
TO: Malcolm D. Jackson
Assistant Administrator for Environmental Information and
Chief Information Officer
Craig E. Hooks
Assistant Administrator for Administration and Resources Management
This is our report on EPA's controls over personal computers conducted by the Office of
Inspector General (OIG) of the U.S. Environmental Protection Agency (EPA). This report
contains findings that describe the problems the OIG has identified and corrective actions the
OIG recommends. This report represents the opinion of the OIG and does not necessarily
represent the final EPA position on the subjects reported. Final determination on matters in this
report will be made by EPA managers in accordance with established audit resolution
procedures.
The estimated direct labor and travel costs for this report are $191,519.
Action Required
The Agency disagreed with recommendation 1, and this recommendation is unresolved with
resolution efforts in progress. The Agency provided an acceptable corrective action plan for
recommendations 2, 3, and 4; these are still in an open status. Therefore, in accordance with EPA
Manual 2750 and ongoing resolution efforts, you are required to provide a written response to
recommendation 1, including a proposed corrective action plan, within 90 calendar days of the
report date. In addition, in your 90-day response you may update the OIG on the implementation
status of the agreed-to corrective actions for recommendations 2, 3, and 4. The response will be
posted on the OIG's public website, along with our memorandum commenting on the response.
-------
The response should be provided as an Adobe PDF file that complies with the accessibility
requirements of Section 508 of the Rehabilitation Act of 1973, as amended. The final response
should not contain data that should not be released to the public; if the response contains such
data, the data for redaction or removal should be identified. We have no objections to the further
release of this report to the public. We will post this report to our website at
http://www.epa.gov/oig.
If you or your staff have any questions regarding this report, please contact Paul Curtis at
(202) 566-2523 or curtis.paul@epa.gov; or Wanda (Whitfield) Arrington, Project Manager, at
(202) 566-2533 or whitfield.wanda@epa.gov.
-------
EPA's Contract Oversight and Controls Over
Personal Computers Need Improvement
11-P-0705
Table of C
Chapters
1 Introduction 1
Purpose 1
Background 1
Noteworthy Achievements 2
Scope and Methodology 3
2 EPA Should Reduce the Minimum Quantity Required
Under the CTS Contract 5
Federal Acquisition Regulations Allow for Deductive Changes 5
EPA Paid for Seats Not Used and Could Potentially Pay $1.9 Million 6
EPA Did Not Accept the Contractor's Asset Management
Performance Self-Ratings 7
Conclusion 8
Recommendation 8
Agency Comments and OIG Evaluation 8
3 EPA's Personal Computer Controls Need Continued Improvement 10
EPA Could Not Account for Some Personal Computers 10
EPA Did Not Update FAS 11
EPA Did Not Retain Acquisition Documentation 11
EPA Property Staff Hold Multiple Positions 11
Conclusion 12
Recommendations 12
Agency Comments and OIG Evaluation 13
Status of Recommendations and Potential Monetary Benefits 14
Appendices
A Details on Scope and Methodology 15
B OEI Response to Draft Report 16
C OARM Response to Draft Report 18
D Distribution 21
-------
Chapter 1
Introduction
Purpose
We performed this review to determine whether the U.S. Environmental
Protection Agency (EPA) has adequate controls for safeguarding personal
computers. Specifically, we wanted to determine:
• Whether EPA has adequate controls in place to track and dispose of
personal computers that are owned by EPA, and whether EPA has
adequate oversight controls of computers provided through the Customer
Technology Solutions (CTS) contract.
• The status of EPA-owned personal computers replaced under the CTS
service contract during fiscal year (FY) 2009.
Background
Accountable Personal Property Management
The EPA Office of Administration and Resources Management (OARM) is
responsible for providing direction to develop and establish an effective and
efficient property program Agency-wide. Within OARM, the Agency property
management officer ensures that all accountable personal property is maintained
in the Integrated Financial Management System (IFMS) Fixed Assets Subsystem
(FAS), and advises employees of their responsibilities to manage and account for
government personal property. EPA defines accountable personal property as
nonexpendable personal property with an acquisition cost of $5,000 or greater,
EPA-leased personal property, or property identified as a sensitive item. Sensitive
items are personal property owned or leased by EPA that may be converted to
private use or that has a high potential for theft, such as personal computers, cell
phones, personal digital assistants, and cameras.
The 4832 EPA Personal Property Policy and Procedures Manual, dated April 18,
2006, is the primary authoritative reference for property management. Property
staffs manage personal property in 24 accountable areas nationwide, to include
headquarters, regions, and laboratories. Each accountable area should have a
property management officer (PMO), property accountable officer (PAO), and
property utilization officer (PUO) who are responsible for ensuring that adequate
and effective administrative controls are established for all personal property
under their jurisdiction.
11-P-0705
1
-------
Customer Technology Solutions
The EPA Office of Environmental Information (OEI) has the primary oversight
responsibility for the CTS service contract. As a Working Capital Fund service,
the CTS service contract is an indefinite delivery/indefinite quantity contract with
fixed rates for services that provides computers and technical support for end
users. The contract period is from May 1, 2008, to August 21, 2012, with optional
award terms extending through December 31, 2016.
During FY 2009, EPA began using the CTS contract to provide and coordinate
technology end-user support and services for headquarters program offices and
laboratories. Under the CTS contract, the Agency replaced over 11,000 computers
from October 2008 to September 2009. The rapid replacement of EPA-owned
computers with CTS computers heavily taxed headquarters accountable areas and
outpaced EPA's efforts to update Agency property records in IFMS/FAS.
After the first 16 months of the contract's base period, starting in the 17th month,
the contract requires EPA to purchase a monthly minimum of 12,000 standard
seats, which includes a computer with accessories and technical support.
Noteworthy Achievements
In May 2010, EPA took immediate steps to locate property it could not account
for that was reported during our annual financial statement audit. EPA conducted
additional inventories in the 24 accountable areas and accounted for 1,332 items
valued at $4.7 million. In addition, an EPA official issued a letter to Agency
senior management discussing the current property concerns and the need to
ensure that necessary property officers are assigned for each accountable area and
given the resources and support necessary to perform their functions effectively.
For FY 2011, the Agency will place more emphasis on property during the A-123
internal control reviews. Additionally, EPA plans to address property controls
nationwide by developing online training programs for property staff. In its
response to our draft report, EPA noted that it has made significant progress
toward improving the personal property program and mitigating vulnerabilities.
For example, EPA has located an additional 96 items as of August 2011.
In addition, EPA stated that it continues to make significant resource investments
to address end user dissatisfaction with the CTS deployments and/or other related
concerns, as outlined in a previous OIG report (i.e., EPA Needs to Improve
Management Practices to Ensure a Successful Customer Technology Solutions
Project, Report No. 10-P-0194, August 23, 2010).
11-P-0705
2
-------
Scope and Methodology
We performed this review from February 4, 2010, through July 7, 2011,1 at EPA
headquarters in Washington, DC. We also visited field offices located in Atlanta,
Georgia; Kansas City, Kansas; and Research Triangle Park, North Carolina. We
conducted this review in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our objectives. We believe that the evidence obtained
provides a reasonable basis for our findings and conclusions based on our
objectives.
We did not evaluate the entire system of internal controls over personal or
accountable property. We assessed internal controls related to the activities
associated with EPA's personal computers. Specifically, we documented the
Agency's procedures, including contract requirements, related to EPA's personal
computers. We also reviewed the Federal Acquisitions Regulations (FAR)
Sections 16 and 52, EPA 's Personal Property Policy and Procedures Manual,
and EPA's Record Retention Schedule 631. Appendix A contains a detailed
discussion of our scope and methodology.
Prior EPA Office of Inspector General Reports
The EPA Office of Inspector General (OIG) has not performed any past audits of
EPA's personal computers, but issued the following reports with findings related
to personal property or CTS:
• Audit of EPA's Fiscal 2010 and 2009 Consolidated Financial Statements,
Report No. 11-1-0015, November 15, 2010. This report noted that EPA
headquarters could not account for certain personal property items in
FY 2010 as required by EPA 's Personal Property and Procedures
Manual. The primary cause was that headquarters mid-level management
was not knowledgeable about Agency property management procedures.
• EPA Needs to Improve Management Practices to Ensure a Successful
Customer Technology Solutions Project, Report No. 10-P-0194,
August 23, 2010. This report noted that missteps in project planning for
the CTS deployment led to questions about four areas: (1) the quality of
the helpdesk supporting the project, (2) a quality management program
that was not finalized, (3) key business processes to support ongoing
operations not being defined, and (4) vacant leadership positions needed to
facilitate communication and coordination with customers about CTS
equipment deployments. These conditions resulted in many end users
'We suspended the assignment in September 2010 and resumed work on January 25,2011. We performed additional work to
update our assignment findings and concluded our audit on July 7, 2011.
11-P-0705
3
-------
voicing dissatisfaction with the CTS deployment and continued
dissatisfaction with helpdesk support.
• Improved Security Planning Needed for the Customer Technology
Solutions Project, Report No. 10-P-0028, November 16, 2009. This report
noted that EPA lacks a process to routinely test CTS equipment for known
vulnerabilities and to correct identified threats. In addition, EPA placed
CTS equipment into production without fully assessing the risk the
equipment poses to the Agency's network and authorizing the equipment
operations.
• Audit of EPA 's Fiscal 2009 and 2008 (Restated) Consolidated Financial
Statements, Report No. 10-1-0029, November 16, 2009. This report noted
that EPA did not conduct a physical inventory of 1,804 items of
accountable personal property at EPA headquarters in FY 2009 as required
by EPA 's Personal Property and Procedures Manual. EPA did not
inventory all headquarters accountable property because it did not develop
procedures to account adequately for the replacement of thousands of
personal computers resulting from EPA implementing a new desktop
service provider.
We found no prior U.S. Government Accountability Office reports with findings
or recommendations related to EPA's personal computers.
11-P-0705
4
-------
Chapter 2
EPA Should Reduce the Minimum Quantity Required
Under the CTS Contract
EPA paid the CTS contractor a total of $489,734 over an 11-month period for
3,343 seats2 not ordered by the Agency during the period. In addition, EPA did
not accept the contractor's monthly asset management performance self-rating for
over a year because of its nonperformance in properly accounting for and tracking
assets. After the first 16 months of the contract's base period, starting in the
17th month, the contract requires EPA to purchase a monthly minimum of 12,000
standard seats. However, EPA did not order the minimum number of seats for
11 of the 12 months reviewed. EPA believes it is required to pay for a minimum
order of 12,000 standard seats regardless of the actual number of computers
ordered. If EPA does not make changes to the CTS contract, we estimate that
EPA may pay as much as $1.4 million more through September 2012 for personal
computer standard seats that it did not order, for a total potential payment of
$1.9 million for seats not ordered.
Federal Acquisition Regulations Allow for Deductive Changes
The CTS contract requires EPA to order monthly a minimum of 12,000 standard
seats. Because of the contract requirements, EPA paid for 12,000 standard seats
monthly even when it did not order the minimum seat requirement. FAR Section
16.504(a) (2) states that to ensure that the contract is binding, the minimum
quantity must be more than a nominal quantity, but it should not exceed the
amount that the government is fairly certain to order. The CTS contract
incorporates by reference FAR Section 52.243-1, Alternate II, which states:
The Contracting Officer may at any time, by written order,
and without notice to the sureties, if any, make changes within
the general scope of this contract in any one or more of the
following: (1) Description of services to be performed, (2)
Time of performance, (3) Place of performance for the
services, (4) Drawings, designs, or specifications when the
supplies to be furnished are to be specifically manufactured
for the Government, in accordance with drawings, designs, or
specifications. (5) Method of shipment or packing of supplies,
and (6) Place of delivery.
2 A standard seat includes a leased computer with accessories and technical support.
11-P-0705
5
-------
The contract also notes FAR Section 52.249-2, which states:
The Government may terminate performance of work under
this contract in whole or, from time to time, in part if the
Contracting Officer determines that a termination is in the
Government's interest.
EPA should reduce the minimum seats required under the contract to a
level consistent with the record of actual orders through a deductive
change to the contract. EPA could use either the Changes clause, FAR
52.243-1, Alternate II; or as a partial termination for convenience, the
authority under FAR 52.249-2. Through one of the clauses, EPA should be
able to adjust its CTS contract to reduce the minimum number of seats the
Agency is required to order to a number that it is likely to use.
EPA Paid for Seats Not Used and Could Potentially Pay $1.9 Million
We found that EPA paid the contractor a total of $489,734 for a cumulative
3,343 standard seats that were not utilized (an average of 304 per month for the
11-month period) from February 2010 through January 2011. In FY 2010, from
February 2010 through September 2010, EPA paid a total of $204,255 for
1,397 computers it did not order. During the contract's third fiscal year, October
2010 through January 2011, EPA paid the contractor an additional $285,478 for
1,946 seats it did not order. EPA negotiated a modification that reassigned the
student/intern seats as counting toward the 12,000 standard seat requirement; the
modification was in effect from April through September 2010. Because of this
modification, EPA was able to use all 12,000 monthly seats in July 2010.
EPA believes it is required to pay for a minimum order of 12,000 standard seats
regardless of the actual number of computers ordered. We estimate that EPA
could pay the contractor $1.4 million for seats not ordered from February 2011
through September 2012. Our estimate is based on an average of monthly
payments (table 1) for seats not ordered from October 2010 to January 2011. EPA
could potentially pay a total of $1.9 million in current and future payments for
standard seats not utilized.
11-P-0705
6
-------
Table 1: Payments for seats not ordered associated with the CTS contract
Performance period
# of seats
ordered
# of
seats
not
ordered
Payment amount
for seats not
ordered
February 2010
11,744
256
$ 37,429.76
March 2010
11,666
334
48,834.14
April 2010
11,679
321
46,933.41
May 2010
11,759
241
35,236.61
June 2010
11,982
18
2,631.78
July 2010
12,040
n/a
0.00
August 2010
11,992
8
1,169.68
September 2010
11,781
219
32,019.99
October 2010
11,538
462
67,775.40
November 2010
11,533
467
68,508.90
December 2010
11,520
480
70,416.00
January 2011
11,463
537
78.777.90
Total (actual)
3.343
$ 489.733.57
February 2011 to September 2011
570,956.40
October 2011 to September 2012
859.820.64
Total (estimated)
$ 1.430.777.04
Total potential payment for
seats not ordered
$ 1.920.510.61
Source: OIG analysis.
EPA Did Not Accept the Contractor's Asset Management Performance
Self-Ratings
EPA did not accept the contractor's monthly asset management performance self-
ratings of its assets from May 2009 through January 2011. The performance
measures for asset management assess the contractor's accounting, recording, and
tracking of its assets. These measures, along with other measures in the contract,
are used to ensure that the contractor delivers quality service in accordance with
performance requirements outlined by the government.
The Agency noted that the contractor's performance had improved since contract
inception, but was still below expectations. As a result, EPA has not granted the
contractor an award fee for its performance. The payment of any award fee is
contingent upon the contractor's performance and its compliance with contract
requirements. According to the Agency, it generates and uses the award fee
documentation to identify specific contractual obligations not yet completed, such
as the submission of government-approved deliverables. EPA noted that the
contractor has not been responsive to various issues such as outstanding
deliverables and meeting the performance measures.
11-P-0705
7
-------
Conclusion
EPA is currently in the process of reviewing the contract to identify FY 2011
modifications that may be needed to include the student/intern seats in the
12,000 standard seat monthly requirement. EPA has been unable to meet the
minimum standard seat requirements, and the contractor's performance has not
met expectations. Therefore, we believe EPA should renegotiate the CTS contract
requirements, so the government is not paying for computers and related services
it does not need. In addition, EPA should continue to withhold the contractor's
award fee until its performance is at an acceptable level.
Recommendation
We recommend that Assistant Administrator for Environmental Information and
Chief Information Officer:
1. Review and/or modify the CTS contract to adjust the minimum
standard seat requirement to eliminate monthly payments for CTS
computers that EPA does not order.
Agency Comments and OIG Evaluation
In a memorandum dated August 18, 2011, OEI stated:
OEI respectfully disagrees with this recommendation. The
contract structure considers components other than just the
number of computers ordered for figuring the standard seat
minimum and for calculating the monthly standard seat cost.
In addition to the cost of the computers, the cost of the
infrastructure used to support users, as well as contractor
support are all factored into the total cost of providing the
overall CTS service to EPA.
Since the needed infrastructure and head-count for support
personnel is not variable, making adjustments based on the
number of seats utilized would spread the overall price over
fewer seats, thus resulting in a greater seat price to users. The
pricing on this contract is the total price to provide the service
to a minimum of 12,000 users. If there are less than 12,000
users the overall price will not change. Therefore, adopting a
"pay by the number of active seats" approach as
recommended would not eliminate monthly payments for CTS
computers, but would simply spread the overall price over a
lesser number of seats, thus resulting in a greater per-seat
price with the overall price remaining the same.
11-P-0705
8
-------
Therefore, the prospect of modifying the contract in this
respect has not been a course of action pursued by OEI.
The OIG agrees that the contract structure considers components other than just
the number of computers ordered for figuring the standard seat minimum and for
calculating the monthly standard seat cost. We also agree that the current pricing
on this contract is for a minimum of 12,000 users. However, we believe that by
using the contract clauses, EPA can negotiate with the contractor to change the
pricing on this contract for the minimum 12,000 users to keep from paying for
computers and related services it does not need. With the potential to pay a total
of $1.9 million in current and future payments for standard seats and services not
utilized, EPA should renegotiate the CTS contract requirements. We consider this
issue unresolved. Appendix B contains the full text of OEI's response.
11-P-0705
9
-------
Chapter 3
EPA's Personal Computer Controls Need
Continued Improvement
Because EPA did not safeguard and track personal computers to ensure proper
replacement and disposal in accordance with property regulations, it cannot
account for 638 personal computers valued at over $1 million. EPA did not know
the status of these personal computers, some of which may have been replaced
under the CTS contract. EPA 's Personal Property Policy and Procedures Manual
outlines requirements for property staff to ensure the effective accountability,
utilization, and disposal of personal property. However, EPA did not update FAS
and retain acquisition documentation for property. In addition, we found a lack of
separation of duties in property staff positions. As a result, EPA did not safeguard
EPA assets and could not account for these personal computers.
EPA Could Not Account for Some Personal Computers
EPA did not know the status of 638 personal computers valued at over $1 million,
of which 171 may have been computers that were replaced under the CTS
contract with an estimated value of $299,000. We requested a list of all the
personal computers replaced by the CTS computer deployment. EPA provided an
incomplete list of end-user stations at headquarters that received CTS computers,
and was unable to provide a list of computers replaced outside of headquarters.
We performed a test of personal computers and could not locate four in
headquarters. After our review, EPA reinventoried property, including personal
computers, to locate unrecorded property. As a result, EPA determined that 638
computers were unaccounted for as of January 2011, including the 171 laptops
that the Agency stated may have been replaced by the CTS service contract
computers. A senior official stated that program offices in accountable areas did
not follow the property policy during the CTS computer deployment. From its
internal review, EPA found that numerous unaccounted for headquarters personal
property items were transferred without the proper documentation.
EPA's Personal Property Policy and Procedures Manual, section 3.5.1, states
that all actions that remove accountable personal property from an accountable
area's records in IFMS must be documented with approved forms and recorded in
a voucher log. Removal actions include transfers to other accountable areas,
transfers to other federal agencies, transfers to state or local governments, returns
to the lessor, and disposal.
11-P-0705
10
-------
EPA Did Not Update FAS
EPA did not have accurate property data in the financial system. During testing,
we found inconsistencies in the location of personal computers, incorrect serial
numbers, and inaccurate descriptions. For instance, FAS reported network servers
as personal computers. According to EPA's Personal Property Policy and
Procedures Manual, sections 1.1.6, 1.2.1, and 1.2.2, property officers are required
to ensure that all accountable personal property is maintained in IFMS to control
and account for personal property assigned to the accountable area. Property
officers are required to enter additions, transfers, and deletions into IFMS in a
timely manner. Property staff did not follow property procedures to correct or
update data in FAS. One accountable area relied on a contractor to maintain and
update data in FAS; this contractor did not always update the system to account
for property. FAS needs accurate data to ensure proper asset management. In its
response to our draft report, EPA noted that it has made considerable progress in
scrubbing and verifying data between offices with shared responsibility and
stakeholders.
EPA Did Not Retain Acquisition Documentation
Accountable areas did not retain acquisition records for property. During our
testing, we identified three accountable areas that did not maintain acquisition
documents. One of three areas did not keep documentation for property more than
3 years from the date of acquisition. According to EPA's Personal Property
Policy and Procedures Manual, section 3.1, personal property records must be
maintained in IFMS and original documents pertaining to the acquisition of
property must be retained for 5 years or the life of the item, whichever is longer.
EPA's property staff was not aware of the requirements for records retention and
therefore did not retain supporting documents for active property. In response to
our FY 2010 financial statement audit recommendations, EPA plans to address
property controls nationwide by developing an online training program to
improve property staff skills. EPA also noted in its response to our draft report
that it has initiated improvements in this area and has taken steps to ensure that
necessary acquisition documentation is appropriately maintained.
EPA Property Staff Hold Multiple Positions
EPA's accountable areas did not have a separation of duties in property positions
to ensure safeguards over personal computers. We found that property staff held
more than one property position. Accountable area property officers are
responsible for managing personal property. They include:
• Property Management Officer: The PMO is responsible for the effective
day-to-day implementation of the personal property management program.
• Property Accountability Officer: The PAO is responsible for ensuring
the effective acquisition, management, utilization, and disposal of personal
11-P-0705
11
-------
property and overall accountability of IFMS as it relates to personal
property.
• Property Utilization Officer: The PUO is responsible for promoting the
acquisition and profitable use of available excess personal property from
known sources, including EPA, the General Services Administration, and
other federal agencies.
During our testing, we identified property staff appointed to multiple positions in
the same or different accountable areas. Two accountable areas had one person in
both the PAO and PUO positions. In another area, one person held all three
property positions. EPA's Personal Property Policy and Procedures Manual,
section 1.2, notes that the PMO, PUO, and PAO roles should be assigned to
separate individuals, if possible. EPA stated that staff held multiple positions
because in one instance, as a position became vacant, staff had to absorb the work
of that vacant property position.
In a September 3, 2010, memorandum, OARM stated that for EPA's personal
property program to function efficiently, the jurisdictional program or regional
manager for each accountable area is to appoint, in writing, separate individuals,
and ensure that the proper resources are available to them. By the end of our
review, we identified limited changes in these property positions. EPA should
review this requirement for consistency and implementation throughout the
Agency, and consider permanent property positions to ensure proper safeguards
over assets. In its response to our draft report, EPA noted that all accountable
areas have been advised of the need to assign different individuals to the extent
possible within their available resources.
Conclusion
EPA did not safeguard and track personal computers to ensure proper replacement
and disposal in accordance with property regulations, and therefore could not
account for numerous personal computers. EPA currently is working with
property custodial officers in each of the 24 property accountable areas to account
for the computers. EPA management has worked to give attention to property
issues by issuing its September 3, 2010, memorandum for improving
accountability of personal property. We believe EPA should continue its emphasis
on controls and specifically address property controls relating to FAS, property
management positions, and adherence to records retention policies.
Recommendations
We recommend the Assistant Administrator for Administration and Resources
Management:
2. Update the property manual to require the separation of duties in
property staff positions and consider assigning permanent property
11-P-0705
12
-------
positions throughout the Agency to ensure that there are safeguards
over EPA's assets.
3. Develop and implement a process that would require property staff to
routinely review and update FAS data.
4. Develop and implement a process that would ensure that property
staffs adhere to records retention requirements.
Agency Comments and OIG Evaluation
EPA agreed with our recommendations and proposed acceptable corrective action
plans to address them. Appendix C contains the full text of OARM's response.
11-P-0705
13
-------
Status of Recommendations and
Potential Monetary Benefits
RECOMMENDATIONS
POTENTIAL MONETARY
BENEFITS (In $000s)
Rec.
No.
Page
No.
Subject
Status1
Action Official
Planned
Completion
Date
8 Review and/or modify the CTS contract to adjust
the minimum standard seat requirement to
eliminate monthly payments for CTS computers
that EPA does not order.
12 Update the property manual to require the
separation of duties in property staff positions and
consider assigning permanent property positions
throughout the Agency to ensure that there are
safeguards over EPA's assets.
13 Develop and implement a process that would
require property staff to routinely review and
update FAS data.
13 Develop and implement a process that would
ensure that property staffs adhere to records
retention requirements.
Claimed
Amount
Ag reed-To
Amount
Assistant Administrator for
Environmental Information
and Chief Information Officer
Assistant Administrator for 10/01/11
Administration and
Resources Management
Assistant Administrator for 111301]2
Administration and
Resources Management
Assistant Administrator for 11130112
Administration and
Resources Management
$1,400
1 0 = recommendation is open with agreed-to corrective actions pending
C = recommendation is closed with all agreed-to actions completed
U = recommendation is unresolved with resolution efforts in progress
11-P-0705
14
-------
Appendix A
Details on Scope and Methodology
We conducted this audit in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our audit
objectives. We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives. We conducted our audit from February to July
2010 at EPA headquarters, in Washington DC. We also visited field offices located in Atlanta,
Georgia; Kansas City, Kansas; and Research Triangle Park, North Carolina. In September 2010,
we suspended the assignment and reopened it in January 2011. We performed additional work to
update our assignment findings and concluded our audit on July 7, 2011.
Using EPA's 24 accountable areas, with the assistance of the OIG Data Mining and Analysis
staff, we identified a population of 35,050 EPA personal computers from the IFMS/FAS. We
identified the four accountable areas with the highest acquisition cost. We statistically selected
235 computers for our sample from the four areas (table A-l). We identified 159 personal
computers as historical items (e.g., conversion items from the prior property system or disposals
from 1994 to 2006). We could not locate at the time of our audit 18 computers, resulting in
58 samples tested. We tested samples, performed an inventory, and reviewed property controls
and data in FAS. We reviewed supporting documentation for disposed property and property on-
site in accordance with EPA's Personal Property Policy and Procedures Manual and EPA's
Records Retention Schedules.
Table A-1: OIG testing schedule for EPA's personal computers
Accountable area and location
Total
samples
Sample
dollars
Historical
samples
Missing
samples
Tested
samples
AA01—Headquarters
59
$189,058.75
29
16
14
AA06—Research Triangle
Park, North Carolina
59
225,798.02
42
0
17
AA14—Atlanta, Georgia
59
97,942.43
37
1
21
AA17—Kansas City, Kansas
58
140,648.56
51
1
6
TOTALS
235
$653,447.76
159
18
58
Source: OIG analysis.
For CTS contract computers, we used EPA's most recent inventory deliverable as of December
2009 to obtain our universe. We identified our universe of 10,359 deployed CTS computers. We
selected two accountable areas for which we were already reviewing EPA's personal computers.
We statistically selected 59 deployed computers for our sample at the two sites. We tested
samples and performed an inventory. We reviewed documentation supporting EPA's oversight
of the CTS contract and CTS inventory requirements. For all samples, we held interviews with
EPA personnel, performed observations, and analyzed property data.
11-P-0705
15
-------
Appendix B
OEI Response to Draft Report
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
WASHINGTON, D,C, 20460
AUG 1 8 2011
OFFICE OF
ENVIRONMENTAL INFORMATION
MEMORANDUM
SUBJECT: OEI Response to Draft Report: EPA's Contract Oversight and Controls Over
Personal Computers Need Improvement (Project No. OA-FY 10-0057)
FROM: Malcolm D. Jackson /s/
Assistant Administrator and Chief Information Officer
TO: Arthur Elkins
Inspector General
The purpose of this memorandum is to provide a response to the subject draft report and
provide additional clarification regarding the Office of Environmental Information's (OEI)
management of the Customer Technology Solutions (CTS) service contract.
OEI appreciates the OIG's desire to ensure EPA has adequate controls for safeguarding
personal computers and contract oversight. Although OEI has the primary oversight
responsibility for the CTS contract, we are in partnership with EPA's Office of Acquisition
Management (OAM).
While OEI does not concur with OIG's current audit report recommendation, OEI
continues to make significant resource investments to address end user dissatisfaction with CTS
deployments and/or other related concerns as outlined in a previous OIG report (i.e., EPA Needs
to Improve Management Practices to Ensure a Successful Customer Technology Solutions
Project, Report No. 10-P-0194, August 23, 2010).
Attached please find OEI's detailed response to OIG's current draft report. OEI believes,
as outlined in the attached response, that OIG may have a fundamental misunderstanding of
CTS' contractual structure, especially as it relates to the standard seat minimum and for
calculating monthly standard seat cost.
11-P-0705
16
-------
While OEI cannot agree with OIG's recommendation at this point, we look forward to
further discussions regarding CTS' monthly seat costs. If you have any questions, please feel
free to contact me.
Attachment
cc: Gloria Taylor-Upshaw, OIG
Craig Hooks, Assistant Administrator, OARM
Renee Wynn, Acting Principal Deputy Assistant Administrator, OEI
Vaughn Noga, Director, Office of Technology Operations and Planning
Johnny E. Davis Jr., Director, Enterprise Desktop Solutions Division
Jeff Worthington, OEI
Patrick Huber, OEI Audit Follow-up Coordinator
Anne Mangiafico, OTOP Audit Coordinator
ATTACHMENT
OEI's Detailed Response to Draft Report: EPA's Contract Oversight and Controls over Personal
Computers Need Improvement (Project No. OA-FY 10-0057)
The following is OEI's response to the recommendation number one identified in the draft report:
Review and/or modify the CTS contract to adjust the minimum standard seat requirement
to eliminate monthly payments for CTS computers that EPA does not order.
OEI respectfully disagrees with this recommendation. The contract structure considers
components other than just the number of computers ordered for figuring the standard seat
minimum and for calculating the monthly standard seat cost. In addition to the cost of the
computers, the cost of the infrastructure used to support users, as well as contractor support are
all factored into the total cost of providing the overall CTS service to EPA.
Since the needed infrastructure and head-count for support personnel is not variable, making
adjustments based on the number of seats utilized would spread the overall price over fewer
seats, thus resulting in a greater seat price to users. The pricing on this contract is the total price
to provide the service to a minimum of 12,000 users. If there are less than 12,000 users the
overall price will not change. Therefore, adopting a "pay by the number of active seats" approach
as recommended would not eliminate monthly payments for CTS computers, but would simply
spread the overall price over a lesser number of seats, thus resulting in a greater per-seat price
with the overall price remaining the same.
Therefore, the prospect of modifying the contract in this respect has not been a course of action
pursued by OEI.
11-P-0705
17
-------
Appendix C
OARM Response to Draft Report
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
WASHINGTON, D.C, 20460
AUG 2 5 2011
OFFICE OF
ADMINISTRATION
AND RESOURCES
MANAGEMENT
MEMORANDUM
SUBJECT: Comments on Draft Report: EPA's Contract Oversight and Controls Over
Personal Computers Need Improvement (Project No. OA-FY10-0057)
Nanci Gelb /s/
FROM: for Craig E. Hooks, Assistant Administrator
TO: Melissa M. Heist, Assistant Inspector General for Audits
Office of Inspector General
The Office of Administration and Resources Management appreciates the opportunity to
comment on the draft report. OARM's detailed comments are included in the attached document.
While we recognize that the OIG had requested a consolidated response, this memorandum is
limited to OARM as we understand that the Office of Environmental Information has elected to
reply separately.
OARM has taken significant steps since the audit to improve the program and mitigate
vulnerabilities. Should the OIG have questions or wish to discuss any part of this response, Dr.
Jerry Oakley, Deputy Director, Facilities Management and Services Division, is available at
(202) 564-2082 or oaklev.ierry@epa.gov.
Attachment
cc: Nanci Gelb
John Showman
Renee Page
Dennis Bushta
Bridget Shea
Jerry Oakley
Bernie Davis-Ray
David Shelby
11-P-0705
18
-------
Draft Report: EPA's Contract Oversight and Controls Over Personal
Computers Need Improvement (Project No. OA-FYI 0-0057)
OARM Comments
Chapter 3 - EPA's Personal Computer Controls Need Continued Improvement
Findings:
EPA Cannot Account for Personal Computers
OARM concurs with the finding in the draft report that EPA could not account for 638 personal
computers as of January 2011. As stated in my transmittal memo, we have made significant
progress toward improving the personal property program and mitigating vulnerabilities. For
example, we have already located an additional 96 items as of 08/01/11. However, we ask that
OIG consider being more specific in the report's subtitle regarding the number of unaccounted
items in order to more accurately reflect the percentage of the inventory involved.
EPA Did Not Update FAS
OARM concurs with the finding in the draft report that "EPA did not have accurate property data
in the financial system" because of "inconsistencies in the location of personal computers,
incorrect serial numbers, and inaccurate descriptions." We acknowledge that property staff
apparently did not always have the information or was not able to update data in FAS. It is worth
noting that we have made considerable progress in that data have now been scrubbed and
verified between offices with shared responsibility and stakeholders.
EPA Did Not Retain Acquisition Documentation
OARM acknowledges and concurs with the finding in the draft report that... "you identified one
accountable area that did not maintain acquisition documents more than 3 years from the date of
acquisition." As this was a specific finding in one accountable area, we request that OIG consider
being more specific in this subtitle. We have initiated improvements in this area and have taken
steps to ensure necessary acquisition documentation is appropriately maintained by validating
records retention schedules through EPA's Record Retention Office and National Archives and
Records Administration.
EPA Property Staff Hold Multiple Positions
OARM concurs with the finding "identified property staff appointed to multiple positions in the
same or different accountable areas." At this time, all accountable areas have been advised of the
need to assign different individuals within their available resources.
11-P-0705
19
-------
OIG Recommendations:
2. Update the property manual to require the separation of duties in property staff
positions and consider assigning permanent property positions throughout the Agency to
ensure that there are safeguards over EPA's assets.
OARM concurs with this recommendation. Since we do not control staffing numbers and duty
assignments throughout the agency, we will take the following corrective actions:
Reissue the September 3, 2010, memorandum stating the requirement for separation of
property roles and ask that consideration be given to assigning permanent property
positions. Completion date: October 1, 2011
Include information on the required separation of property roles in the revision of EPA's
Personal Property and Procedures Manual. Completion date: October 1, 2011
3. Develop and implement a process that would require property staff to routinely review
and update FAS data.
OARM concurs with this recommendation to require property staff to routinely review and
update personal property data. Property personnel are already expected to accurately enter and
update data. The implementation of the agency's new financial system should permit a more
functional and effective means to identify and track data. The following corrective action will
help ensure that property data in the financial system are accurate.
Conduct at least six field audits annually to monitor compliance with property
requirements for data entry and updating. Completion date: November 2012
4. Develop and implement a process that would ensure that property staffs adhere to
records retention requirements.
OARM concurs with this recommendation and will take the following corrective actions:
Review the existing process for collecting and maintaining acquisition documents and
make any necessary modifications. Completion date: November 1, 2011
Inform property personnel of the need to maintain all necessary acquisition
documentation and provide timeframes and implementing guidance. Completion date:
December 1, 2011
Include a review of records retention documentation in a minimum of six annual field
audits. Completion date: November 2012
11-P-0705
20
-------
Appendix D
Distribution
Office of the Administrator
Assistant Administrator for Environmental Information and Chief Information Officer
Assistant Administrator for Administration and Resources Management
Agency Followup Official (the CFO)
Agency Followup Coordinator
General Counsel
Associate Administrator for Congressional and Intergovernmental Relations
Associate Administrator for External Affairs and Environmental Education
Director, Office of Acquisition Management, Office of Administration and Resources
Management
Director, Office of Regional Operations
Director, Facilities Management and Services Division, Office of Administration and
Resources Management
Director, Office of Technology Operations and Planning, Office of Environmental Information
Director, Enterprise Desktop Solutions Division, Office of Environmental Information
Audit Followup Coordinator, Office of Environmental Information
Audit Followup Coordinator, Office of Administration and Resources Management
11-P-0705
21
------- |