Financial Management: FDA's Controls Over Property Have Improved, But
Weaknesses Remain (Letter Report, 02/22/99, GAO/AIMD-99-51).
Pursuant to a congressional request, GAO assessed the adequacy and
status of the Food and Drug Administration's (FDA) planned actions to
correct internal control weaknesses related to property and equipment
identified in prior financial statement audit reports, focusing on
FDA's: (1) inadequate controls over the physical quantities of property
and equipment and their locations; (2) improper reconciliations between
its general ledger and property subsidiary ledger systems; and (3)
internal controls related to the safeguarding and reporting of automated
data processing (ADP) equipment that is lost, stolen, destroyed, or
surplussed.
GAO noted that: (1) FDA developed an action plan that should correct the
weaknesses identified in the financial audit reports regarding property
and equipment; (2) FDA has made progress in implementing various
actions, but it has not yet resolved some of the reported weaknesses;
(3) according to FDA officials, as of January 21, 1999, 23 of the 41
tasks in the corrective action plan related to property and equipment
had been completed; (4) GAO found 9 of these 23 tasks had not yet fully
achieved their anticipated outcomes; (5) one of these tasks was for
FDA's management to create and validate a new property database; (6)
while FDA conducted several physical inventories to create this
database, GAO's testing showed that the database was not accurate; (7)
FDA did not have adequate controls in place to effectively monitor the
loss, theft, or destruction of ADP equipment; (8) FDA procedures for
reporting and recording missing equipment were ineffective, with the
result that information on missing equipment sometimes never reached the
property management database, thus compromising database accuracy and
completeness; (9) the reliability of the database was further hampered
because FDA used the same code to identify lost, stolen, and destroyed
property and thus could not determine individual quantities and values
in each of these categories; (10) this was the case for $10.1 million in
property, including ADP equipment, that FDA reported in 1998 as having
been lost, stolen, or destroyed; (11) for $7.4 million of the $10.1
million, FDA was unable to determine how much represented lost versus
stolen or destroyed property even when it reviewed source documents;
(12) FDA management could not effectively analyze the nature and
severity of problems related to missing equipment and develop related
management strategies to address its risks; (13) FDA was unable to
provide assurance that the proper authorizations were in place before
ADP equipment was designated for surplus and removed from FDA premises;
(14) FDA's procedures for surplussing equipment called for filing
related paperwork that included the original signatures of the property
management personnel who authorized the surplus; (15) GAO found that in
8 of the 27 cases it reviewed, FDA staff altered the forms used to
designate equipment for surplus; (16) such alterations of required
paperwork seriously compromised the control environment and increased
the risk of theft and inappropriate removal of equipment; and (17) GAO
also found an instance in which a computer donated to a school contained
information that should have been removed before it was donated.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: AIMD-99-51
TITLE: Financial Management: FDA's Controls Over Property Have
Improved, But Weaknesses Remain
DATE: 02/22/99
SUBJECT: Surplus federal property
Internal controls
Financial statement audits
ADP
Data bases
Data integrity
Information resources management
Federal property management
Equipment inventories
Inventory control systems
IDENTIFIER: FDA Property Management Information System
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO report. This text was extracted from a PDF file. **
** Delineations within the text indicating chapter titles, **
** headings, and bullets have not been preserved, and in some **
** cases heading text has been incorrectly merged into **
** body text in the adjacent column. Graphic images have **
** not been reproduced, but figure captions are included. **
** Tables are included, but column deliniations have not been **
** preserved. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
** A printed copy of this report may be obtained from the GAO **
** Document Distribution Center. For further details, please **
** send an e-mail message to: **
** **
** **
** **
** with the message 'info' in the body. **
******************************************************************
AI99051.book GAO
United States General Accounting Office
Report to Congressional Requesters
February 1999 FINANCIAL MANAGEMENT
FDA's Controls Over Property Have Improved, But Weaknesses Remain
GAO/AIMD-99-51
United States General Accounting Office Washington, D. C. 20548
Letter
Page 1
GAO/AIMD-99-51
FDA's Controls Over Property
Page 1 GAO/AIMD-99-51 FDA's Controls Over Property
GAO
Accounting and Information Management Division Letter
B-280138 February 22, 1999 The Honorable Tom Bliley Chairman,
Committee on Commerce House of Representatives
The Honorable Joe Barton House of Representatives
This report responds to your request that we assess the adequacy
and status of the Food and Drug Administration's (FDA) planned
actions to correct internal control weaknesses identified related
to property and equipment in prior financial statement audit
reports. 1 The weaknesses identified in these reports were
primarily that FDA (1) had inadequate controls over the physical
quantities of property and equipment and their locations and (2)
lacked proper reconciliations between its general ledger and
property subsidiary ledger systems. As requested, we limited the
scope of our work to property and equipment exclusive of buildings
and land.
In addition, you asked that we review FDA's internal controls
related to the safeguarding and reporting of automated data
processing (ADP) equipment that is lost, stolen, destroyed, or
surplussed.
Results in Brief FDA developed an action plan that, if properly
implemented, should correct the weaknesses identified in the
financial audit reports regarding
property and equipment. FDA has made progress in implementing
various actions, but it has not yet resolved some of the reported
weaknesses. According to FDA officials, as of January 21, 1999, 23
of the 41 tasks in the corrective action plan related to property
and equipment had been completed. However, we found that 9 of
these 23 tasks had not yet fully achieved their anticipated
outcomes. One of these tasks was for FDA's management to create
and validate a new property database. While FDA conducted several
physical inventories to create this database, our testing showed
that the database was not accurate. For example, in a sample of 73
property items selected from FDA centers, 7 were not listed in the
database. For the 18 remaining tasks, 17 of the tasks, such as
replacing the
1 Report on the Financial Statement Audit of the Food and Drug
Administration for Fiscal Year 1997 (OIG #A- 17- 97- 0003, May
1998) and Report on the Financial Statement Audit of the Food and
Drug Administration for Fiscal Year 1996 (OIG #A- 17- 96- 0003,
June 1997).
B-280138 Page 2 GAO/AIMD-99-51 FDA's Controls Over Property
property management system, are not scheduled for full
implementation until fiscal year 1999 or later.
FDA did not have adequate controls in place to effectively monitor
the loss, theft, or destruction of ADP equipment. FDA procedures
for reporting and recording missing equipment were ineffective,
with the result that information on missing equipment sometimes
never reached the property management database, thus compromising
database accuracy and completeness. The reliability of the
database was further hampered because FDA used the same code to
identify lost, stolen, and destroyed property and thus could not
determine individual quantities and values in each of these
categories. This was the case for $10.1 million in property,
including ADP equipment, that FDA reported in 1998 as having been
lost, stolen, or destroyed. 2 Further, for $7.4 million of the
$10.1 million, FDA was unable to determine, how much represented
lost versus stolen or destroyed property even when it reviewed
source documents. Lacking this level of detail in its data, FDA
management could not effectively analyze the nature and severity
of problems related to missing equipment and develop related
management strategies to address its risks.
FDA was unable to provide assurance that the proper authorizations
were in place before ADP equipment was designated for surplus 3
and removed from FDA premises. FDA's procedures for surplussing
equipment called for filing related paperwork that included the
original signatures of the property management personnel who
authorized the surplus. However, we found that in 8 of the 27
cases we reviewed, FDA staff altered the forms used to designate
equipment for surplus. In other cases, we were told by the
Department of Health and Human Services' (HHS) Program Support
Center officials that it was not uncommon for the drivers who
picked up surplus equipment to alter signed forms before removing
equipment from the premises when the equipment listed on the
paperwork differed from that available for pickup. Such
alterations of required paperwork seriously compromised the
control environment and increased the risk of theft and
inappropriate removal of equipment.
2 The date the items were lost, stolen, or destroyed is not known
because, according to FDA, no physical inventories of FDA assets
were conducted for at least 3 years prior to fiscal year 1998.
3 Surplussed personal property includes any excess personal
property for which there is no longer a need. These items can be
donated or sold.
B-280138 Page 3 GAO/AIMD-99-51 FDA's Controls Over Property
Another aspect of controls over surplussed ADP equipment concerned
FDA's requirement to remove all sensitive information from the
hard drives of surplussed computers. Based on our limited testing,
we found an instance in which a computer donated to a school
contained information that should have been removed before it was
donated.
Background FDA, a component of HHS, is one of the nation's oldest
consumer protection agencies whose mission is to protect and
promote the health
and well- being of consumers in the United States.
Organizationally, FDA headquarters consists of five support
offices and six centers. It has a $1 billion annual budget and
employs approximately 9,000 employees who regulate and monitor the
manufacture, import, transport, storage, and sale of over $1
trillion worth of food and drugs. In addition, FDA's records
indicate that it manages about 40,000 capitalized and
noncapitalized property and equipment 4 items such as laboratory,
office, ADP, and telecommunications equipment. These items are
accounted for within FDA's Property Management Information System
(PMIS) and are the responsibility of the particular FDA center
using the equipment, with assistance from the Personal Property
Management Branch within the Division of Central Services. FDA
reported a net amount of $163 million 5 in property and equipment
on its fiscal year 1997 financial statements.
HHS is required to have annual audited financial statements under
the Chief Financial Officers Act of 1990, as expanded by the
Government Management Reform Act of 1994. To meet this
requirement, HHS decided to have most of its components' financial
statements audited. In its audit reports on FDA's fiscal years
1996 and 1997 financial statements, the independent public
accounting firm 6 (IPA) cited internal control weaknesses related
to property and equipment. To address these weaknesses and to
strengthen internal controls, FDA engaged the IPA as a
4 Capitalized property and equipment is defined as items with a
cost of $25,000 or more. Noncapitalized equipment is defined as
those items that cost between $5,000 and $25,000, as well as items
under $5,000 listed as sensitive, such as ADP equipment. Prior to
1996, the threshold for capitalized items was $5,000.
5 This amount resulted from a total cost of $284 million minus
accumulated depreciation of $121 million. The net amount of $163
million consisted of $36 million in ADP, laboratory, and office
equipment and $127 million in construction, land, and buildings.
6 The HHS Office of the Inspector General contracted with
Gardiner, Kamya, & Associates, P. C., an IPA, to perform the
fiscal years 1996 and 1997 financial statement audits.
B-280138 Page 4 GAO/AIMD-99-51 FDA's Controls Over Property
consultant 7 to review its initial corrective action plan and
provide any necessary recommendations. Based on the consultant's
recommendations, FDA updated its corrective action plan and issued
a revised plan on October 28, 1998.
Scope and Methodology
To determine the adequacy and status of FDA's corrective action
plan, we reviewed the IPA's report and workpapers related to the
fiscal year 1997 financial statement audit. We also interviewed
IPA personnel to obtain more details about the issues raised in
the report and to gain an understanding of the work performed and
the results. We obtained and reviewed FDA's corrective action plan
and discussed with FDA personnel the current status of corrective
actions on reported issues. Because one of the corrective actions
was to update the PMIS database, we performed tests to ensure that
items recorded in the database actually existed and that the
database was complete. We also reviewed the results of the
consultant's agreed upon procedures to review the initial
corrective action plan. However, as part of our work, we did not
review the database design or the general and application system
controls, 8 which are critical to the integrity of the PMIS
database.
We obtained an understanding of the internal controls over
property and equipment, which included reviewing the safeguarding
and reporting of these assets. To determine whether FDA had
adequate controls in place to monitor the loss and theft of ADP
equipment, we reviewed and analyzed related Security and Property
Office reports for lost, stolen, and destroyed property and
equipment. In addition, we reviewed and analyzed related policies
and procedures.
To assess FDA's process for monitoring the surplussing of property
and equipment, we reviewed and tested related policies and
procedures. Procedures tested included the requirement to remove
sensitive information before ADP equipment is surplussed. Since
FDA could not provide a complete listing of donated equipment, we
selected a nonstatistical sample of 22 computers from the six
Washington regional
7 Gardiner, Kamya, & Associates, P. C., Independent Accountant's
Report on Applying Agreed- Upon Procedures, (Contract Number: HHS-
100- 95- 0010, August 14, 1998). 8 General controls are the
structure, policies, and procedures that apply to an entity's
overall computer operations. Application controls ensure that
transactions are valid, properly authorized, and completely and
accurately processed and reported.
B-280138 Page 5 GAO/AIMD-99-51 FDA's Controls Over Property
area schools that received and still had access to these donations
in fiscal year 1998. For each of these donated computers, we
scanned the hard drives to determine if sensitive information had
been properly removed.
Our work was performed at FDA's Washington, D. C., area offices
from July 1998 through mid- January 1999 in accordance with
generally accepted government auditing standards. We requested
written comments on a draft of this report from the Commissioner
of FDA or her designee. On February 16, 1999, FDA provided us with
written comments, which are discussed in the "Agency Comments and
Our Evaluation" section and reprinted in appendix I.
Status of Corrective Actions for Prior Audit Findings
If FDA effectively implements all the tasks contained in its
property management corrective action plan and achieves
anticipated outcomes, it should be able to adequately resolve the
weaknesses reported in the financial statement audits for fiscal
years 1996 and 1997. As of January 21, 1999, the plan contained 41
tasks related to property and equipment, each of which identified
a specific anticipated outcome. Of these 41 tasks, FDA officials
stated that 23 were complete. However, we determined that some of
the tasks had not achieved their anticipated outcomes.
Among the tasks included in the plan were: (1) performing periodic
comprehensive inventories of property and equipment, as well as
component- specific spot audits 9 to provide an accurate database
of property assets; (2) developing new policies and procedures,
with associated training, to create increased responsibility and
accountability for property and equipment at the level of each FDA
center; and (3) purchasing and implementing a new property
management system to integrate the general and subsidiary ledgers.
The following is a discussion of these three areas, which are at
the heart of the challenges FDA faces in addressing its property
management weaknesses.
Comprehensive Inventories Are Crucial to a Reliable Database
Before fiscal year 1998, FDA had not performed a complete physical
inventory of property and equipment in more than 3 years. As part
of the fiscal year 1997 audit, FDA's IPA had tested the PMIS
database and found that in a sample of 66 capitalized items FDA
could not locate 46 items. This
9 The plan describes these audits as repetitive audits of FDA
component inventories and property management practices.
B-280138 Page 6 GAO/AIMD-99-51 FDA's Controls Over Property
condition contributed to the IPA's reporting of a material
weakness regarding controls over the physical quantities of
property and equipment and their locations.
Our review of the PMIS database, which included both capitalized
and noncapitalized property and equipment, indicated that while
significant improvements were made over the last year, the
database was still not accurate. For example, we traced 73 sample
items from FDA offices to the database and found that 7 items were
either not recorded in the database or were recorded incorrectly.
We observed that these seven items did not have valid barcodes.
Although FDA's corrective action plan listed the task of
conducting a comprehensive inventory and barcoding program of all
property items as having been completed in April 1998, FDA had not
yet achieved its anticipated outcome of having an accurate
inventory of FDA property assets.
In addition, we found that 1 computer among 46 items we sampled
could not be traced from the database to FDA offices. FDA stated
that this computer had been sent to HHS' Program Support Center
(PSC) as a surplus item without the required supporting
documentation; therefore neither FDA nor we could readily confirm
what actually happened to the computer.
FDA's proposed policies and procedures referred to in the
corrective action plan call for conducting a comprehensive
inventory at least once a year of all accountable personal
property items 10 throughout the agency, with the next such
inventory planned for March 1999. According to FDA, a less
frequent inventory schedule will be considered only when an FDA
component's statistics reflect an inventory accuracy of greater
than 98 percent and when continuous audits reflect adherence to
sound property management practices. In addition, the plan
contained a provision for internal audits of FDA component
inventories on a continuous basis to ensure (1) a continuing focus
on property assets by accountable program officials and (2)
positive external audit reports. As of January 1999, FDA officials
stated that they were also considering adopting, on a quarterly
basis, a modified inventory audit process for capitalized property
items.
10 Accountable personal property is defined as equipment that is
complete in itself and is of a durable nature with an expected
service life of 2 years or more. The equipment should have an
acquisition or adjusted cost of $5,000 or more or should be
identified as sensitive equipment regardless of cost, such as ADP
equipment.
B-280138 Page 7 GAO/AIMD-99-51 FDA's Controls Over Property
FDA anticipates that these policy and procedural changes will
address internal controls over property and equipment.
Given FDA's reported weaknesses in prior year audit reports and
FDA's piloting of a new system in the spring of 1999, performing
regular inventories and internal audits and continuing to validate
the PMIS database are crucial to the success of the new system and
the future reliability of the property management database.
New Policies and Procedures Include the Creation of a New Position
FDA's corrective action plan calls for the creation of a new staff
position, the Personal Property Coordinator (PPC) at each FDA
center. The PPC is to manage the acquisition and barcoding of all
property and ensure that receiving data is promptly submitted to
the Property Management and Finance offices to update their
records. In addition, the PPC is to plan and coordinate center
wide inventories and coordinate the activities of the center's
Property Custodial Officers (PCO), who are responsible for the
day- to- day management of property charged to a specific area
within an FDA center.
As of January 21, 1999, three out of six FDA centers have full-
time PPCs in place and formal training of PPCs and PCOs was
scheduled for March 1999. FDA anticipates that this new structure,
when fully in place, will improve the control environment as well
as the reliability of data on FDA property.
New System Expected to Improve Reconciliation Between FDA's
Property Management, Procurement, and General Ledger Systems
Because PMIS, the procurement system, and the general ledger
system were not integrated, FDA had to rely on manual processes to
transfer data from one of these systems to another. As a result,
PMIS did not contain records of all the property owned by FDA, and
cost information did not reach the general ledger promptly. In
prior year audits, the IPA reported that FDA did not perform
periodic reconciliations between its general ledger system and its
property subsidiary ledger system (the PMIS database) and that
therefore, significant year- end adjustments were required in
order for FDA to prepare its financial statements.
The new property management system is scheduled to be piloted
starting in May 1999. Based on the results of the pilot and
following approval by the Office of Information Resources
Management, a phased rollout of the new system is expected to
begin, with full implementation scheduled to occur after fiscal
year 1999. Until the new system is operational, the corrective
action plan called for FDA to use manual processes to periodically
B-280138 Page 8 GAO/AIMD-99-51 FDA's Controls Over Property
reconcile the general ledger to PMIS. However, FDA officials did
not complete interim reconciliations during fiscal year 1998 as
stipulated in the plan. A reconciliation was completed only at
year- end, and numerous adjusting journal entries were needed to
prepare the fiscal year 1998 financial statements.
FDA's corrective action plan calls for a new property management
system that would be integrated with the procurement system and
the general ledger system. In addition, the plan calls for the new
system to (1) provide more timely data and provide a more accurate
picture of property and equipment under FDA's custody, as well as
related costs and (2) have the ability to create a detailed audit
trail that maintains a record of when property and equipment items
are moved, lost, or surplussed, with the date each item's status
changed, its new location, and who approved the change. Using the
new system, FDA anticipates that its staff should be able to more
easily retrieve detailed information about areas of concern (e.
g., surplussed ADP equipment), perform analyses, and make
necessary changes regarding how this property is managed. FDA also
expects that the integrated system will result in FDA's management
receiving more timely financial management reports.
FDA Lacked Reliable Information Regarding Lost, Stolen, or
Destroyed ADP Equipment
FDA lacked reliable information to account for missing ADP
equipment because of ineffective procedures for reporting and
recording lost, stolen, and destroyed equipment. Without complete
and accurate data, FDA was unable to assess its losses in this
area and to respond with appropriate management strategies to
address its risks.
When ADP equipment was discovered missing, FDA procedures called
for notifying both the Security Office and the Property Office.
This notification was to be done by the supervisor of the
individual discovering the loss. When the supervisor notified the
Security Office, the Security Officer was to file an Incident
Report and, if necessary, notify the police. Meanwhile, the
supervisor was also required to provide the PCO with a completed
Report of Survey concerning the missing equipment. The PCO was
then to file the Report of Survey and the Incident Report with the
Property Office, whose staff would then update the PMIS database.
Our review of the records generated by the Security and Property
offices indicated that this notification procedure was not being
consistently followed. Neither office was able to provide us with
a complete list of items reported lost, stolen, or destroyed
during fiscal year 1998, and the partial
B-280138 Page 9 GAO/AIMD-99-51 FDA's Controls Over Property
lists provided by each office were significantly different from
one another in content.
Because FDA's procedures required the participation of several
individuals and the use of two different forms to report and
record stolen property, there were several opportunities for the
flow of information to stop before it reached the PMIS database.
In some cases, information on missing equipment was never entered
into PMIS, compromising its accuracy and completeness. Further, a
lack of communication and coordination between the Security and
Property offices kept the Property Office (which had
responsibility for updating the PMIS database) uninformed of all
missing data on stolen property.
In an attempt to determine the number of property and equipment
items stolen during fiscal year 1998, we obtained a file copy of
the PMIS database. However, our analysis was limited by the fact
that, although PMIS had the capability to distinguish among lost,
stolen, and destroyed items, FDA used the same property code to
identify these items in the PMIS database. Thus, it was impossible
to use the database to quantify the number of stolen versus lost
or destroyed items. Therefore, we requested and reviewed the
supporting manual records-- Reports of Survey-- for lost, stolen,
and destroyed equipment. Based on the Reports of Survey reviewed,
we found that some items reported missing had not been recorded in
PMIS.
After we informed FDA officials that the PMIS database was
incomplete, the Property Office obtained Reports of Survey in
addition to those we had reviewed and compiled a more extensive
list of property and equipment (including items other than ADP
equipment) reported lost, stolen, and destroyed. This list,
compiled in fiscal year 1998, included about 1600 items, both
capitalized and noncapitalized, with a reported total dollar value
of approximately $10.1 million. 11 Of the 1,600 items, 955 items
with a reported value of $3.4 million
represented ADP equipment. According to FDA officials, the 1,600
were lost, stolen, or destroyed over more than 3 years, dating
back to the time FDA's last comprehensive inventory of property
and equipment was completed. Of the 1,600 items, FDA could not
determine whether 976 items-- with a combined reported value of
$7.4 million-- were lost, stolen, or destroyed because the PCOs
involved had not provided that information as
11 According to FDA, of this total, 1,226 items valued at $7.6
million were fully amortized.
B-280138 Page 10 GAO/AIMD-99-51 FDA's Controls Over Property
required on the Reports of Survey. Among the 976 were such items
as (1) a $208,970 bench facstar laser, (2) a $60,981 Nikon
Microscope, and (3) a $40,500 Threshold system molecular device.
None of these three items were scheduled for replacement until
after 2002. Of the 976 items, 502, valued at a reported $2.2
million, represented ADP equipment.
In a further attempt to analyze data on ADP equipment theft, we
obtained the Security Office's fiscal year 1998 incident reports
on stolen ADP equipment. However, we had a limited ability to
trace items detailed in the incident reports to the Reports of
Survey list or the PMIS database because information on missing
equipment was recorded inconsistently in incident reports, Reports
of Survey, and the PMIS database. In attempting to compare items,
we assumed that barcode information would help us trace specific
items from one report to another and to PMIS. However FDA's
procedures did not require recording barcodes on the incident
reports, and many lacked barcodes. Of 22 items listed in the
incident reports we reviewed, only 9 contained barcode
information. However, even with barcodes, we could find none of
the nine items in the PMIS database, and we could only find five
of the nine on the Reports of Survey list.
In December 1998, FDA drafted procedures to more effectively
monitor and document lost, stolen, and destroyed property. FDA
officials stated that these new procedures should be fully
implemented by March 1999. Procedural changes include (1)
requiring that the PCO, rather than the supervisor, notify both
offices of lost and stolen property; (2) using only the Incident
Report (with barcode information) to document stolen property and
equipment; (3) immediately flagging the property as potentially
stolen in the property database; and (4) requiring that PCOs who
report lost or destroyed property complete a Report of Survey
detailing why the equipment is considered to be lost or destroyed
rather than stolen.
As part of FDA's tasks listed in its corrective action plan to
address weaknesses identified by the IPA, FDA plans to use
periodic quality control reviews to gain assurance that new
procedures are fully and properly implemented, including
procedures for accounting for lost, stolen, and destroyed
property. In January 1999, FDA took the additional step of
creating unique property codes to distinguish among lost, stolen,
and destroyed equipment in the PMIS database.
B-280138 Page 11 GAO/AIMD-99-51 FDA's Controls Over Property
Lack of Compliance With Procedures Weakened Controls Over
Equipment Being Surplussed
Controls over relocating equipment were inadequate to prevent FDA
staff from altering the documents used to control the surplussing
of ADP equipment, even though procedures require properly
authorized documents with original signatures. In addition, we
identified an instance in which FDA did not properly remove
sensitive data from ADP equipment that was donated to a school.
Alteration of Documents Circumvented Controls
We found that documentation necessary to remove surplussed ADP
equipment from FDA premises could be altered in two ways,
circumventing this important control.
1. When equipment was being designated for surplus, the numbers
and types of equipment listed on documents was sometimes altered
by FDA staff. For example, some of the computers listed on the
surplussing forms were crossed- out without being initialed to
verify that the change was approved. In those cases, FDA was
unable to provide assurance that appropriate approvals were
obtained before equipment was designated for surplus and removed
from FDA premises.
2. According to HHS Program Support Center (PSC) officials, when
their drivers picked up surplus items from FDA, they sometimes
changed the required documents when the amount and type of
equipment available for removal differed from that listed on the
documents.
Because the document used for surplussing ADP equipment is also
used for relocating other FDA property, and altered forms could be
used to remove equipment from the building, the control
environment was seriously compromised and the risk of
misappropriation increased.
Before any equipment is removed from FDA premises, FDA policy
requires that the person removing it present either a property
pass or a Request for Property Action form (HHS- 22) at the
security desk. A property pass is to be used when equipment is
being temporarily relocated, such as computer equipment being used
at home. Our inventory testing sample included two cases in which
the use of property passes was required to remove equipment from
the premises. In both cases, we found that proper procedures were
followed and we were able to trace these two pieces of equipment
to the locations outside FDA where they were being used.
B-280138 Page 12 GAO/AIMD-99-51 FDA's Controls Over Property
When ADP equipment is to be surplussed, FDA guidance calls for a
form HHS- 22 to be authorized and forwarded to the Property
Office, where the equipment record is to be removed from the PMIS
database. The HHS- 22 form is also to be sent to the Program
Support Center (PSC), an HHS central location, which, in most
cases, is responsible for picking up surplussed equipment.
Sometimes, an FDA center donates surplus ADP equipment directly to
a school. In those cases, in addition to filing an HHS22 form, FDA
is required to have the school complete and sign a Certification
Statement indicating receipt and ownership of donated ADP
equipment.
Our review of records for donated equipment showed that FDA staff
did not always use original HHS- 22 forms in designating equipment
for surplus. Instead, they would sometimes alter the number or
types of equipment to be surplussed on a form that had been
previously approved and signed. FDA officials provided 27 HHS- 22
forms, representing surplussed items they had on record for fiscal
year 1998. Our review of the 27 forms showed that 8 had been
altered. We asked Property Office staff whether, in these cases,
the Property Management Officer provided an original signature
authorizing the surplus of the equipment before it was removed
from the building. While Property Office staff stated that this
procedure was generally followed, in several cases, including
these eight, the Property Office did not have its copies of the
HHS- 22 forms on file and so were unable to provide assurance that
proper authorizations were obtained before equipment was removed
from the premises. The HHS- 22 forms provided for our review were
copies obtained from the FDA centers.
Even in cases when an original HHS- 22 form was used, PSC
management informed us that the PSC drivers regularly changed the
information regarding the quantity and type of equipment listed on
the form from that originally authorized. According to PSC
management, drivers stated that the reason for altering the forms
was that at the time of pickup, they often found more or fewer
equipment items than those listed.
According to FDA management, the drivers' altering of HHS- 22
forms may have occurred as a result of employees at FDA centers
observing equipment being surplussed, thus seeing an opportunity
to either claim the equipment for their own use or add equipment
to that being surplussed. This explanation suggests that FDA
employees were able to make decisions about the disposition of
equipment in FDA's custody without going through the proper
channels or completing the necessary documents. In this manner,
both PSC drivers and FDA employees were allowed to
B-280138 Page 13 GAO/AIMD-99-51 FDA's Controls Over Property
circumvent the controls over the surplus of ADP equipment. As a
result, FDA lacked assurance that the approved number of
surplussed items left the building or reached PSC.
FDA officials told us that as of December 1998, PSC drivers had
been informed that they were no longer permitted to alter
documents. If drivers see a discrepancy between the property
available for pickup and what is described on the HHS- 22, they
are not to pickup anything until they receive new paperwork that
properly describes the items being relocated.
Sensitive Data on Donated ADP Equipment Not Always Removed
For equipment donated to schools, FDA policy required that all
sensitive data be removed from the computer. However, the policy
allowed for the retention of some software on the computer based
upon the licensing agreement with the software company involved.
FDA centers are required to sign a statement indicating that ADP
hard drives have been properly scrubbed or cleaned. Scrubbing
ensures that formatting of the hard drive is complete and that all
proprietary information has been removed.
FDA could not provide a complete list of donated ADP equipment to
support a statistically valid test of the proper scrubbing of hard
drives. Although the PMIS database and the completed HHS- 22 forms
should each provide a complete record of donated ADP equipment, we
found that some of the donated equipment recorded in the PMIS
database could not be traced to the HHS- 22 forms. Further, some
donated equipment on the HHS22 forms could not be traced to the
PMIS database.
Due to FDA's inability to provide a complete population of donated
ADP equipment, we performed limited testing in this area. We
selected and tested a nonstatistical sample of 22 computers from
FDA centers and PSC. The 22 computers were donated to six
different schools in the Washington D. C., area. We found that the
schools' administrators generally exercised care in ensuring that
computers were free from any previous software and viruses by
reformatting the hard drives prior to installing the respective
school's software. With 14 of the 22 computers we tested, these
procedures had already been performed. Therefore, in those cases
we could not determine whether FDA had done the proper scrubbing
prior to donation.
Regarding the other eight computers, one of the schools we visited
had not yet placed the donated computers into service and
therefore had not reformatted the hard drives. At this school, one
of the eight computers tested contained sensitive FDA information.
The information left on the
B-280138 Page 14 GAO/AIMD-99-51 FDA's Controls Over Property
computer was a rejection letter from the Center for Devices and
Radiological Health to a medical technology laboratory stating
that FDA could not provide reasonable assurance that the medical
device was safe and effective for its intended use. In this case,
neither FDA officials nor the school were aware that the sensitive
data remained on the computer. Using commercially available
software, we took no extraordinary measures to retrieve this data
from the computer. Thus, the retrieval could have been done by
anyone with basic computer skills and software. After we found the
sensitive information on the computer at the school, it was
removed.
FDA officials noted that the computer, which contained the
sensitive information, was donated in November 1997, prior to
FDA's implementation of its new procedures in June 1998. The new
procedures require that a center official be designated to certify
by signature on the HHS- 22 form that the computers are free of
sensitive information. However, as mentioned, for those computers
we tested that were donated after the effective date of the new
procedures, we could not determine whether FDA had properly
scrubbed the computers prior to donation.
Conclusions While FDA is making progress in implementing its
corrective action plan, continued emphasis on the tasks and the
desired outcomes are key to
resolving the internal control weaknesses related to property and
equipment reported in prior audit reports. The implementation of a
new property management system that integrates on an automated
basis with the general ledger, as well as the creation of the PPC
position, should provide FDA with enhanced accountability over
property and equipment and financial reporting capabilities.
However, if FDA fully complies with existing policies and
procedures and implements those contemplated in its corrective
action plan, the risk of incidents such as the loss and theft of
equipment and the inadvertent release of proprietary information
will be diminished.
Recommendations To correct weaknesses identified in prior audit
reports and strengthen controls over ADP equipment, we recommend
that the Commissioner of
Food and Drugs finalize and implement proposed procedures for
conducting
comprehensive property inventories and component- specific spot
audits;
B-280138 Page 15 GAO/AIMD-99-51 FDA's Controls Over Property
ensure that interim reconciliations of the general ledger system
to the property subsidiary ledger system (PMIS) using manual
processes are performed until the new property management system
is fully operational, as stipulated in FDA's corrective action
plan; finalize and implement proposed procedures to ensure the
reliability of
information on lost, stolen, and destroyed property and equipment
and conduct periodic quality control reviews to ensure that new
procedures are followed; and ensure compliance with established
policies and procedures that
address the surplus of ADP equipment. Specifically, during the
March 1999 training for PPCs and PCOs, ensure that proper
documentation procedures are covered to prevent the use of altered
documents.
Agency Comments and Our Evaluation
In general, FDA agreed with the report findings and concurred with
all of our recommendations. FDA indicated that actions are either
planned, already in process, or implemented to address the issues
raised in our report. These include (1) developing new procedures
for performing inventories and auditing outcomes (the next annual
inventory is scheduled to begin later this month), (2) performing
monthly reconciliations of the general ledger system to the
property subsidiary ledger system, (3) using a new coding system
that separates lost versus stolen or destroyed property listed in
PMIS, and (4) designing training to include instructions for
proper surplussing procedures.
In addition, FDA provided some clarifying comments that we
incorporated into our report where appropriate. FDA also raised
several additional matters, none of which affect our findings and
recommendations. Our response to these matters are discussed in
appendix I.
We are sending copies of this report to the Chairmen and Ranking
Minority Members of the Senate and House Committees on
Appropriations; Senate Committee on Governmental Affairs, and the
House Committee on Government Reform. We are also sending copies
of this report to the Secretary of Health and Human Services, the
Commissioner of Food and Drugs, and other interested parties. We
will also make copies available to others upon request.
B-280138 Page 16 GAO/AIMD-99-51 FDA's Controls Over Property
If you have any questions, please call me at (202) 512- 4476.
Major contributors to this report are listed in appendix II.
Gloria L. Jarmon Director, Health, Education, and Human Services
Accounting and Financial Management Issues
Page 17 GAO/AIMD-99-51 FDA's Controls Over Property
Page 18 GAO/AIMD-99-51 FDA's Controls Over Property
Appendix I Comments From the Food and Drug Administration Append i
x I
Note: GAO comments supplementing those in the report text appear
at the end of this appendix.
Appendix I Comments From the Food and Drug Administration
Page 19 GAO/AIMD-99-51 FDA's Controls Over Property
See comment 1. See comment 2. Now on p. 1. Now on p. 4.
Now on p. 1. See comment 2.
Appendix I Comments From the Food and Drug Administration
Page 20 GAO/AIMD-99-51 FDA's Controls Over Property
See comment 3. See comment 4.
Appendix I Comments From the Food and Drug Administration
Page 21 GAO/AIMD-99-51 FDA's Controls Over Property
See comment 5.
Appendix I Comments From the Food and Drug Administration
Page 22 GAO/AIMD-99-51 FDA's Controls Over Property
Appendix I Comments From the Food and Drug Administration
Page 23 GAO/AIMD-99-51 FDA's Controls Over Property
The following are GAO's comments on FDA's letter received on
February 16, 1999.
GAO Comments 1. Although the IPA is planning to give FDA an
unqualified opinion on its financial statements, FDA's statement
that the auditors found sufficient
evidence of FDA's progress to accept FDA's internal controls
structure (including property) is a misinterpretation of the
auditor's opinion. Our review of the audit workpapers showed that
the IPA did not rely on the internal controls over property
management, but instead performed extensive substantive tests of
financial statement balances. As FDA indicated, the IPA will
continue to report property management as a reportable condition.
2. We believe that this report is balanced and provides adequate
recognition of the progress FDA is making to correct reported
weaknesses.
3. Even though the corrective action plan indicated that the tasks
and anticipated outcomes were complete, FDA acknowledged that the
initiation of tasks would not fully achieve the anticipated
outcomes immediately. We are encouraged that FDA plans to continue
its efforts to correct reported weaknesses, including the review
of the interim database and making corrections as errors are
identified so data transferred into the new system will be as
accurate as possible.
4. FDA believes that our sample test, for which we found 1 error
out of 46 items, indicates that the PMIS database has a 2 percent
error rate, which is within FDA's stated goal. However, based on
the statistical sample methodology we used, 1 error out of 46
items tested actually indicates, with 90 percent confidence, a
possible error rate of 0.23 to 8.19 percent. Also, this test
result was considered in conjunction with the completeness test of
73 items in which we found 7 errors. These seven errors indicate a
potential error rate of 5.42 to 15.68 percent, which is
significantly higher than the 2 percent referred to by FDA.
5. This report has been revised to reflect FDA's comment.
Page 24 GAO/AIMD-99-51 FDA's Controls Over Property
Appendix II Major Contributors to This Report Append i x I I
Accounting and Information Management Division, Washington, D. C.
Chinero Thomas, Assistant Director HeidiKitt Winter, Audit Manager
Rosa Ricks Harris, Audit Manager Angela Samblanet, Auditor Wm.
David Grindstaff, Senior Assistant Director Maria Zacharias,
Communication Analyst
(916256)
Ordering Information The first copy of each GAO report and
testimony is free. Additional copies are $2 each. Orders should be
sent to the following address, accompanied by a check or money
order made out to the Superintendent of Documents, when necessary,
VISA and MasterCard credit cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address are
discounted 25 percent.
Orders by mail: U. S. General Accounting Office P. O. Box 37050
Washington, DC 20013
or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW)
U. S. General Accounting Office Washington, DC
Orders may also be placed by calling (202) 512- 6000 or by using
fax number (202) 512- 6061, or TDD (202) 512- 2537.
Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any
list from the past 30 days, please call (202) 512- 6000 using a
touchtone phone. A recorded menu will provide information on how
to obtain these lists.
For information on how to access GAO reports on the INTERNET, send
an e- mail message with info in the body to:
info@ www. gao. gov or visit GAO's World Wide Web Home Page at:
http:// www. gao. gov
United States General Accounting Office Washington, D. C. 20548-
0001
Official Business Penalty for Private Use $300
Address Correction Requested Bulk Rate
Postage & Fees Paid GAO Permit No. GI00
*** End of document. ***