Audit Report on the Development and Implementation of the Police Department’s Auto Pound System
EXECUTIVE SUMMARY
The NYC Police Department’s (NYPD) Property Clerk Division (Division) accepts, catalogs, safeguards, stores, and produces for the court property that is in the custody of NYPD. Vehicles, parts, motorcycles, and marine craft are stored by NYPD at three vehicle storage sites—College Point, Queens; Gowanus, Brooklyn; and, Erie Basin, Brooklyn. Those vehicle-related types of items, when received, are inspected and entered into the NYPD Auto Pound computer system. In 2000, as part of the Year 2000 remediation, it was decided to upgrade the Auto Pound system to allow the NYPD Support Services Bureau to monitor the three vehicle storage sites from One Police Plaza by linking the sites into one network. NYPD contracted with Information Builders Inc., at a cost of $249,200, to design and implement the upgraded system.
Our objectives were to determine whether:
- a structured methodology was followed when the upgraded Auto Pound system was developed;
- the upgraded Auto Pound system meets user needs;
- the upgraded system allows for future enhancements and further upgrades; and,
- users are satisfied with the system.
Our fieldwork was conducted from October 2001 to April 2002. To achieve our objectives we reviewed and analyzed:
- task orders defining deliverables;
- purchase orders and voucher information pertaining to the upgrade; and,
- the Requirements Design and Specifications document.
In addition, we interviewed NYPD officials, verified that the system met design specifications, and conducted a user satisfaction survey.
We used Comptroller’s Internal Control and Accountability Directive #18 (Directive 18), Guidelines for the Management, Protection and Control of Agency Information and Information Processing Systems as the criterion for this audit. Since the City does not have a formal System Development Methodology, we also used the National Institute of Standards and Technology Special Publication #500-233, A Framework for the Development and Assurance of High Integrity Software (NIST), to assess whether a system development methodology had been followed.
The audit was conducted in accordance with generally accepted government auditing Standards (GAGAS) and included tests of the records and other auditing procedures considered necessary. This audit was performed in accordance with the City Comptroller’s audit responsibilities as set forth in Chapter 5, § 93, of the New York City Charter.
Our user satisfaction survey indicated that the upgraded Auto Pound system meets user needs and that users were generally satisfied with the system. In addition, the upgraded system allows for future enhancements and further periodic upgrades. However, the methodology used by NYPD in the creation of the upgraded Auto Pound system did not ensure that all needed aspects of the system were provided or developed. Also, users stated that they had problems accessing the system and entering data, and complained about the system’s slow response time. Had NYPD used an independent quality assurance individual, these problems could have been identified and resolved during the development of the system. Finally, NYPD does not ensure that inactive users are eliminated from the system, and it does not have a complete, formally approved Disaster Recovery Plan for the system.
The report contains seven recommendations, including that NYPD should:
- Meet with system users and resolve the problems identified in this report.
- Develop written security policies and procedures for Auto Pound. These procedures should require that access to the system be terminated for inactive users.
- Develop a formal Disaster Recovery Plan for the Auto Pound system and ensure that it is tested in accordance with Directive 18.
- Use an independent quality assurance individual for all future system development projects.
The matters covered in this report were discussed with officials from NYPD during and at the conclusion of this audit. A preliminary draft was sent to NYPD officials and discussed at an exit conference held on May 24, 2002. On May 30, 2002, we submitted a draft report to NYPD officials with a request for comments. We received a written response from NYPD on June 18, 2002.
In its response, NYPD agreed to implement three of the report’s recommendations, pertaining to: following a formal system development methodology on future system development projects; using an independent quality assurance individual on future projects; and obtaining any missing documents for Auto Pound, as required by the task orders. NYPD responded that it had taken actions independently of the audit to address the remaining four recommendations, pertaining to developing procedures for disaster recovery, maintenance, and system security; and meeting with users to resolve the system problems identified in this report.