Audit Report on the New York City Office of the Actuary’s Controls over Its Computers and Computer-Related Equipment

EXECUTIVE SUMMARY

The New York City Office of the Actuary (OA), a non-mayoral City agency, provides actuarial information and services to the five major actuarially-funded New York City Retirement Systems and Pension Funds (NYCRS), the City’s nine variable supplements funds, two tax-deferred annuity programs, six group life insurance funds, three closed pension funds, and the New York City Health Benefits Program.

Between July 1, 2015 and January 10, 2018, the OA purchased 113 computers and related items at a total cost of $56,918.  As of January 24, 2018, the OA maintained an inventory of 272 computers and related items.

The objective of this audit was to determine whether the OA, in relation to its computers and computer-related equipment, complied with the Department of Investigation’s (DOI’s) Standards for Inventory Control and Management (DOI Inventory Standards) and maintained effective internal control systems as required by Comptroller’s Directive #1.

Audit Findings and Conclusion

The audit found that, with respect to its inventory of computers and related equipment, the OA failed to comply with several procedures prescribed by the DOI Inventory Standards and failed to maintain effective internal control systems as required by Comptroller’s Directive #1.  As a result, the OA’s inventory records for its computers and related items were incomplete and contained inaccurate information.  Although we found no instances of missing equipment, because the inventory list was incomplete and contained inaccuracies, we were unable to determine whether anything was missing.

Specifically, during our audit observations of computers and related equipment at the OA’s office, we identified inaccuracies and instances of noncompliance in the OA’s inventory management and record keeping.  Moreover, the evidence the agency provided was insufficient to show that it performs periodic inventory counts in accordance with the DOI Inventory Standards.  Finally, the OA did not segregate duties among its staff in relation to its inventory of computers and related equipment or establish compensating controls as required by Comptroller’s Directive #1 and the DOI Inventory Standards.  Based on the omissions and inaccuracies identified in the OA’s inventory records and procedures, we conclude that risks of loss and mismanagement exist with respect to the OA’s computers and related equipment.

Audit Recommendations

To address the issues raised by this audit, we make nine recommendations, including the following:

• The OA should maintain complete and accurate records of all equipment in accordance with the DOI Inventory Standards and update inventory records promptly as changes occur.
• The OA should ensure that only sequentially-numbered property identification tags are assigned and affixed to all valuable equipment and accurately recorded on the inventory list.
• The OA should ensure that all unused computers and computer-related equipment are relinquished in accordance with the requirements of the City’s relinquishment policy.
• The OA should ensure that key responsibilities for the management of computers and computer-related equipment are adequately segregated or that compensating controls are implemented.
• The OA should ensure that an annual inventory count is performed and adequately documented in accordance with the DOI Inventory Standards.

Agency Response

In its response, the OA agreed in substance with all of the audit’s nine recommendations.