Audit Report on the Department of Records and Information Services’ Controls over Its Inventory of Computers and Related Equipment

Executive Summary

The New York City Department of Records and Information Services (DORIS) provides record management services to 50 City agencies, 10 courts, and the City’s 5 district attorneys’ offices.  DORIS’s record management services include off-site storage and retrieval, and overall guidance to those entities on how to manage their records in various media.

DORIS maintains computers and related equipment at three locations: its main offices in Manhattan and at two warehouses located in Brooklyn and Queens.  DORIS maintains a master inventory list in a Microsoft Excel file, and as of March 6, 2017, DORIS recorded that it had 462 computers and related equipment items in inventory.

During Fiscal Year 2017, DORIS expended $7,726,350 consisting of $3,702,713 for personal services and $4,023,637 for other than personal services (supplies, materials, and services necessary to support agency operations).  According to DORIS officials, the agency purchased 174 computers and related equipment, totaling $215,854, in Calendar Year 2017 through August[1].

The objective of this audit was to determine whether DORIS maintains adequate controls over its inventory of computers and related equipment.

Audit Findings and Conclusions

DORIS’s management has not instituted proper controls over the agency’s inventory of computers and related equipment.  Specifically, we found that DORIS did not have written policies and procedures for managing its inventory.  We also found inadequate segregation of duties related to DORIS’s management of its computer and related inventory and inadequate evidence that the agency performed periodic inventory counts as required.

As a result of the above-mentioned control deficiencies, we found that DORIS’s inventory records were incomplete and inaccurate.  Specifically, DORIS’s master inventory list included equipment that auditors could not find in the agency’s possession, excluded other equipment that was in the agency’s possession, and omitted certain information required by City inventory-control policies, such as purchase dates and prices paid for listed assets.  In addition, DORIS could not identify all relinquished items, nor was it able to provide documentation that those items met the criteria that would qualify them to be relinquished.

DORIS’s failure to institute adequate controls over its inventory operations significantly increases the risk of waste, fraud and mismanagement with respect to its computers and related equipment.

Audit Recommendations

To address the issues raised by this audit, we make nine recommendations, including the following:

• DORIS should create written inventory-management policies and procedures that delineate its staff’s responsibilities for computers, related equipment, and other assets in conformity with the DOI Inventory Standards and the specific needs and operations of the agency.
• DORIS should ensure that key responsibilities for the management of the agency’s inventory of computers and related equipment are adequately segregated or that compensating controls are implemented.
• DORIS should perform and document annual inventory counts of its entire inventory in accordance with the DOI Inventory Standards.
• DORIS should ensure that all necessary information for each inventory item is include in the master list.
• DORIS should review its inventory of computers and related equipment and ensure that items already in stock are distributed before making additional purchases for the same items.
• DORIS should comply with the City’s relinquishment policy and ensure that all unused computers and related equipment presently in storage are relinquished in accordance with the requirements.

Agency Response

In its response, DORIS agreed with the audit’s nine recommendations and contended that it is already in compliance with the recommendation that it review existing stock levels before making purchases.  DORIS also provided us with an implementation plan for the recommendations.

[1] The purchases include 42 wireless access points and 72 phones.