Audit Report on the Public Advocate Office’s Controls Over Its Inventory of Computers and Computer-Related Equipment

Executive Summary

The objective of this audit was to determine whether the Office of the Public Advocate (PAO) had adequate controls over its inventory of computer and computer-related equipment.

The PAO, headed by a public official elected every four years in a City-wide election, represents the consumers of City services; reviews and investigates complaints about City services; assesses whether agencies are responsive to the public; recommends improvements in agency programs and complaint-handling procedures; and serves as an intermediary for individuals who have encountered difficulties in obtaining assistance from City agencies.  The PAO also monitors the effectiveness of the City’s public information and education efforts and the compliance of City officers and agencies with the New York City Charter.

The PAO is comprised of six units, the largest of which is the Outreach Unit.  Computers and computer-related equipment (including mobile devices) play a vital role in helping PAO staff achieve the agency’s mission.  The PAO’s Information Technology (IT) Coordinator maintains lists of all of the PAO computers and computer-related equipment and mobile devices on two excel spreadsheets that included, respectively, 565 computer equipment items and 21 mobile devices as of January 19, 2016.

Audit Findings and Conclusion

The PAO does not have adequate controls over its computer and computer-related equipment.  We found that the PAO has not developed comprehensive policies to govern the oversight of this equipment.  Although we were able to locate all sampled equipment, we found that the Master Inventory list was not accurate and did not include all equipment in the custody of the PAO.  In addition, although we found inventory tags on many (but not all) of the items we examined, we identified numerous missing tag numbers that the PAO could not account for.  In the absence of an accounting or verifiable explanation for why those numbers were missing, we were unable to ascertain whether the tag numbers had not been assigned or whether the tag numbers had been assigned to equipment that could not now be located[1].   We also found some items that did not have tag numbers affixed to them or that were listed on the Master Inventory list without their tag numbers.  We also found that equipment serial numbers are not tracked, obsolete items are not relinquished, and there was an inadequate segregation of duties over the purchasing and management of computer equipment.

Further, in addition to the inventory deficiencies described above, we found that the PAO does not adequately monitor the use of its mobile devices and does not comply with the City’s purchasing procedures on a consistent basis.

Audit Recommendations

Based on the audit, we make 10 recommendations, including:

• The PAO should strengthen its inventory management controls to ensure that all equipment is properly accounted for, assigned to the correct employee, tagged and secured.
• The PAO should ensure that tag numbers are assigned sequentially and tracked, especially those tag numbers assigned to equipment that is salvaged.
• The PAO should ensure that equipment serial numbers for all computer and computer-related equipment are tracked and recorded on the Master Inventory list.
• The PAO should comply with the Office of Surplus Activities’ (OSA’s)[2] relinquishment policy and ensure that all unused computer and computer-related equipment presently in storage is relinquished in accordance with the requirements.
• The PAO should ensure that key responsibilities for the management of the inventory of computer and computer-related equipment are adequately segregated or institute compensating controls.
• The PAO should improve its monitoring of mobile device usage to ensure that phone lines are activated and paid for only when there is a need and should follow its procedures to promptly deactivate any spare phones not reassigned within 30 days.
• The PAO should ensure that it complies with all purchasing procedures required by Directive #24, including properly coding purchases.

Agency Response

In its response, the PAO generally agreed with nine recommendations and disagreed with our recommendation that it relinquish all unused computer and computer-related equipment presently in storage in accordance with City requirements.

[1] Comptroller’s Directive #30 requires that tag numbers, made of a sturdy material with sequential control numbers, be affixed to equipment indicating that it is property of the PAO.

[2] The Office of Surplus Activities is responsible for the timely and proper disposition of surplus City assets relinquished from the various City agencies.