oversight

Financial Management: FDA's Controls Over Property Have Improved, But Weaknesses Remain

Published by the Government Accountability Office on 1999-02-22.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                 United States General Accounting Office

GAO              Report to Congressional Requesters




February 1999
                 FINANCIAL
                 MANAGEMENT

                 FDA’s Controls Over
                 Property Have
                 Improved, But
                 Weaknesses Remain




GAO/AIMD-99-51
                   United States
GAO                General Accounting Office
                   Washington, D.C. 20548                                                                               Leter




                   Accounting and Information
                   Management Division                                                                                  Leter




                   B-280138

                   February 22, 1999

                   The Honorable Tom Bliley
                   Chairman, Committee on Commerce
                   House of Representatives

                   The Honorable Joe Barton
                   House of Representatives

                   This report responds to your request that we assess the adequacy and
                   status of the Food and Drug Administration’s (FDA) planned actions to
                   correct internal control weaknesses identified related to property and
                   equipment in prior financial statement audit reports.1 The weaknesses
                   identified in these reports were primarily that FDA (1) had inadequate
                   controls over the physical quantities of property and equipment and their
                   locations and (2) lacked proper reconciliations between its general ledger
                   and property subsidiary ledger systems. As requested, we limited the scope
                   of our work to property and equipment exclusive of buildings and land.

                   In addition, you asked that we review FDA’s internal controls related to the
                   safeguarding and reporting of automated data processing (ADP) equipment
                   that is lost, stolen, destroyed, or surplussed.



Results in Brief   FDA developed an action plan that, if properly implemented, should
                   correct the weaknesses identified in the financial audit reports regarding
                   property and equipment. FDA has made progress in implementing various
                   actions, but it has not yet resolved some of the reported weaknesses.
                   According to FDA officials, as of January 21, 1999, 23 of the 41 tasks in the
                   corrective action plan related to property and equipment had been
                   completed. However, we found that 9 of these 23 tasks had not yet fully
                   achieved their anticipated outcomes. One of these tasks was for FDA’s
                   management to create and validate a new property database. While FDA
                   conducted several physical inventories to create this database, our testing
                   showed that the database was not accurate. For example, in a sample of 73
                   property items selected from FDA centers, 7 were not listed in the
                   database. For the 18 remaining tasks, 17 of the tasks, such as replacing the


                   1
                     Report on the Financial Statement Audit of the Food and Drug Administration for Fiscal Year 1997
                   (OIG #A-17-97-0003, May 1998) and Report on the Financial Statement Audit of the Food and Drug
                   Administration for Fiscal Year 1996 (OIG #A-17-96-0003, June 1997).




                   Page 1                                          GAO/AIMD-99-51 FDA’s Controls Over Property
B-280138




property management system, are not scheduled for full implementation
until fiscal year 1999 or later.

FDA did not have adequate controls in place to effectively monitor the loss,
theft, or destruction of ADP equipment. FDA procedures for reporting and
recording missing equipment were ineffective, with the result that
information on missing equipment sometimes never reached the property
management database, thus compromising database accuracy and
completeness. The reliability of the database was further hampered
because FDA used the same code to identify lost, stolen, and destroyed
property and thus could not determine individual quantities and values in
each of these categories. This was the case for $10.1 million in property,
including ADP equipment, that FDA reported in 1998 as having been lost,
stolen, or destroyed.2 Further, for $7.4 million of the $10.1 million, FDA was
unable to determine, how much represented lost versus stolen or destroyed
property even when it reviewed source documents. Lacking this level of
detail in its data, FDA management could not effectively analyze the nature
and severity of problems related to missing equipment and develop related
management strategies to address its risks.

FDA was unable to provide assurance that the proper authorizations were
in place before ADP equipment was designated for surplus3 and removed
from FDA premises. FDA’s procedures for surplussing equipment called for
filing related paperwork that included the original signatures of the
property management personnel who authorized the surplus. However, we
found that in 8 of the 27 cases we reviewed, FDA staff altered the forms
used to designate equipment for surplus. In other cases, we were told by
the Department of Health and Human Services’ (HHS) Program Support
Center officials that it was not uncommon for the drivers who picked up
surplus equipment to alter signed forms before removing equipment from
the premises when the equipment listed on the paperwork differed from
that available for pickup. Such alterations of required paperwork seriously
compromised the control environment and increased the risk of theft and
inappropriate removal of equipment.




2The date the items were lost, stolen, or destroyed is not known because, according to FDA, no physical
inventories of FDA assets were conducted for at least 3 years prior to fiscal year 1998.

3
  Surplussed personal property includes any excess personal property for which there is no longer a need.
These items can be donated or sold.




Page 2                                            GAO/AIMD-99-51 FDA’s Controls Over Property
             B-280138




             Another aspect of controls over surplussed ADP equipment concerned
             FDA's requirement to remove all sensitive information from the hard drives
             of surplussed computers. Based on our limited testing, we found an
             instance in which a computer donated to a school contained information
             that should have been removed before it was donated.



Background   FDA, a component of HHS, is one of the nation’s oldest consumer
             protection agencies whose mission is to protect and promote the health
             and well-being of consumers in the United States. Organizationally, FDA
             headquarters consists of five support offices and six centers. It has a
             $1 billion annual budget and employs approximately 9,000 employees who
             regulate and monitor the manufacture, import, transport, storage, and sale
             of over $1 trillion worth of food and drugs. In addition, FDA's records
             indicate that it manages about 40,000 capitalized and noncapitalized
             property and equipment4 items such as laboratory, office, ADP, and
             telecommunications equipment. These items are accounted for within
             FDA's Property Management Information System (PMIS) and are the
             responsibility of the particular FDA center using the equipment, with
             assistance from the Personal Property Management Branch within the
             Division of Central Services. FDA reported a net amount of $163 million5 in
             property and equipment on its fiscal year 1997 financial statements.

             HHS is required to have annual audited financial statements under the
             Chief Financial Officers Act of 1990, as expanded by the Government
             Management Reform Act of 1994. To meet this requirement, HHS decided
             to have most of its components’ financial statements audited. In its audit
             reports on FDA’s fiscal years 1996 and 1997 financial statements, the
             independent public accounting firm6 (IPA) cited internal control
             weaknesses related to property and equipment. To address these
             weaknesses and to strengthen internal controls, FDA engaged the IPA as a


             4
               Capitalized property and equipment is defined as items with a cost of $25,000 or more. Noncapitalized
             equipment is defined as those items that cost between $5,000 and $25,000, as well as items under $5,000
             listed as sensitive, such as ADP equipment. Prior to 1996, the threshold for capitalized items was
             $5,000.

             5This amount resulted from a total cost of $284 million minus accumulated depreciation of $121 million.
             The net amount of $163 million consisted of $36 million in ADP, laboratory, and office equipment and
             $127 million in construction, land, and buildings.

             6
               The HHS Office of the Inspector General contracted with Gardiner, Kamya, & Associates, P.C., an IPA,
             to perform the fiscal years 1996 and 1997 financial statement audits.




             Page 3                                           GAO/AIMD-99-51 FDA’s Controls Over Property
              B-280138




              consultant7 to review its initial corrective action plan and provide any
              necessary recommendations. Based on the consultant’s recommendations,
              FDA updated its corrective action plan and issued a revised plan on
              October 28, 1998.



Scope and     To determine the adequacy and status of FDA’s corrective action plan, we
              reviewed the IPA’s report and workpapers related to the fiscal year 1997
Methodology   financial statement audit. We also interviewed IPA personnel to obtain
              more details about the issues raised in the report and to gain an
              understanding of the work performed and the results. We obtained and
              reviewed FDA's corrective action plan and discussed with FDA personnel
              the current status of corrective actions on reported issues. Because one of
              the corrective actions was to update the PMIS database, we performed
              tests to ensure that items recorded in the database actually existed and that
              the database was complete. We also reviewed the results of the consultant’s
              agreed upon procedures to review the initial corrective action plan.
              However, as part of our work, we did not review the database design or the
              general and application system controls,8 which are critical to the integrity
              of the PMIS database.

              We obtained an understanding of the internal controls over property and
              equipment, which included reviewing the safeguarding and reporting of
              these assets. To determine whether FDA had adequate controls in place to
              monitor the loss and theft of ADP equipment, we reviewed and analyzed
              related Security and Property Office reports for lost, stolen, and destroyed
              property and equipment. In addition, we reviewed and analyzed related
              policies and procedures.

              To assess FDA's process for monitoring the surplussing of property and
              equipment, we reviewed and tested related policies and procedures.
              Procedures tested included the requirement to remove sensitive
              information before ADP equipment is surplussed. Since FDA could not
              provide a complete listing of donated equipment, we selected a
              nonstatistical sample of 22 computers from the six Washington regional


              7
               Gardiner, Kamya, & Associates, P.C., Independent Accountant's Report on Applying Agreed-Upon
              Procedures, (Contract Number: HHS-100-95-0010, August 14, 1998).

              8
                General controls are the structure, policies, and procedures that apply to an entity’s overall computer
              operations. Application controls ensure that transactions are valid, properly authorized, and
              completely and accurately processed and reported.




              Page 4                                            GAO/AIMD-99-51 FDA’s Controls Over Property
                            B-280138




                            area schools that received and still had access to these donations in fiscal
                            year 1998. For each of these donated computers, we scanned the hard
                            drives to determine if sensitive information had been properly removed.

                            Our work was performed at FDA's Washington, D.C., area offices from July
                            1998 through mid-January 1999 in accordance with generally accepted
                            government auditing standards. We requested written comments on a draft
                            of this report from the Commissioner of FDA or her designee. On
                            February 16, 1999, FDA provided us with written comments, which are
                            discussed in the "Agency Comments and Our Evaluation" section and
                            reprinted in appendix I.



Status of Corrective        If FDA effectively implements all the tasks contained in its property
                            management corrective action plan and achieves anticipated outcomes, it
Actions for Prior Audit     should be able to adequately resolve the weaknesses reported in the
Findings                    financial statement audits for fiscal years 1996 and 1997. As of January 21,
                            1999, the plan contained 41 tasks related to property and equipment, each
                            of which identified a specific anticipated outcome. Of these 41 tasks, FDA
                            officials stated that 23 were complete. However, we determined that some
                            of the tasks had not achieved their anticipated outcomes.

                            Among the tasks included in the plan were: (1) performing periodic
                            comprehensive inventories of property and equipment, as well as
                            component-specific spot audits9 to provide an accurate database of
                            property assets; (2) developing new policies and procedures, with
                            associated training, to create increased responsibility and accountability
                            for property and equipment at the level of each FDA center; and
                            (3) purchasing and implementing a new property management system to
                            integrate the general and subsidiary ledgers. The following is a discussion
                            of these three areas, which are at the heart of the challenges FDA faces in
                            addressing its property management weaknesses.


Comprehensive Inventories   Before fiscal year 1998, FDA had not performed a complete physical
Are Crucial to a Reliable   inventory of property and equipment in more than 3 years. As part of the
                            fiscal year 1997 audit, FDA’s IPA had tested the PMIS database and found
Database                    that in a sample of 66 capitalized items FDA could not locate 46 items. This

                            9
                              The plan describes these audits as repetitive audits of FDA component inventories and property
                            management practices.




                            Page 5                                          GAO/AIMD-99-51 FDA’s Controls Over Property
B-280138




condition contributed to the IPA’s reporting of a material weakness
regarding controls over the physical quantities of property and equipment
and their locations.

Our review of the PMIS database, which included both capitalized and
noncapitalized property and equipment, indicated that while significant
improvements were made over the last year, the database was still not
accurate. For example, we traced 73 sample items from FDA offices to the
database and found that 7 items were either not recorded in the database or
were recorded incorrectly. We observed that these seven items did not have
valid barcodes. Although FDA’s corrective action plan listed the task of
conducting a comprehensive inventory and barcoding program of all
property items as having been completed in April 1998, FDA had not yet
achieved its anticipated outcome of having an accurate inventory of FDA
property assets.

In addition, we found that 1 computer among 46 items we sampled could
not be traced from the database to FDA offices. FDA stated that this
computer had been sent to HHS’ Program Support Center (PSC) as a
surplus item without the required supporting documentation; therefore
neither FDA nor we could readily confirm what actually happened to the
computer.

FDA’s proposed policies and procedures referred to in the corrective action
plan call for conducting a comprehensive inventory at least once a year of
all accountable personal property items10 throughout the agency, with the
next such inventory planned for March 1999. According to FDA, a less
frequent inventory schedule will be considered only when an FDA
component’s statistics reflect an inventory accuracy of greater than 98
percent and when continuous audits reflect adherence to sound property
management practices. In addition, the plan contained a provision for
internal audits of FDA component inventories on a continuous basis to
ensure (1) a continuing focus on property assets by accountable program
officials and (2) positive external audit reports. As of January 1999, FDA
officials stated that they were also considering adopting, on a quarterly
basis, a modified inventory audit process for capitalized property items.



10
  Accountable personal property is defined as equipment that is complete in itself and is of a durable
nature with an expected service life of 2 years or more. The equipment should have an acquisition or
adjusted cost of $5,000 or more or should be identified as “sensitive equipment” regardless of cost, such
as ADP equipment.




Page 6                                            GAO/AIMD-99-51 FDA’s Controls Over Property
                             B-280138




                             FDA anticipates that these policy and procedural changes will address
                             internal controls over property and equipment.

                             Given FDA’s reported weaknesses in prior year audit reports and FDA’s
                             piloting of a new system in the spring of 1999, performing regular
                             inventories and internal audits and continuing to validate the PMIS
                             database are crucial to the success of the new system and the future
                             reliability of the property management database.


New Policies and             FDA’s corrective action plan calls for the creation of a new staff position,
Procedures Include the       the Personal Property Coordinator (PPC) at each FDA center. The PPC is
                             to manage the acquisition and barcoding of all property and ensure that
Creation of a New Position   receiving data is promptly submitted to the Property Management and
                             Finance offices to update their records. In addition, the PPC is to plan and
                             coordinate center wide inventories and coordinate the activities of the
                             center’s Property Custodial Officers (PCO), who are responsible for the
                             day-to-day management of property charged to a specific area within an
                             FDA center.

                             As of January 21, 1999, three out of six FDA centers have full-time PPCs in
                             place and formal training of PPCs and PCOs was scheduled for March 1999.
                             FDA anticipates that this new structure, when fully in place, will improve
                             the control environment as well as the reliability of data on FDA property.


New System Expected to       Because PMIS, the procurement system, and the general ledger system
Improve Reconciliation       were not integrated, FDA had to rely on manual processes to transfer data
                             from one of these systems to another. As a result, PMIS did not contain
Between FDA’s Property       records of all the property owned by FDA, and cost information did not
Management, Procurement,     reach the general ledger promptly. In prior year audits, the IPA reported
and General Ledger Systems   that FDA did not perform periodic reconciliations between its general
                             ledger system and its property subsidiary ledger system (the PMIS
                             database) and that therefore, significant year-end adjustments were
                             required in order for FDA to prepare its financial statements.

                             The new property management system is scheduled to be piloted starting in
                             May 1999. Based on the results of the pilot and following approval by the
                             Office of Information Resources Management, a phased rollout of the new
                             system is expected to begin, with full implementation scheduled to occur
                             after fiscal year 1999. Until the new system is operational, the corrective
                             action plan called for FDA to use manual processes to periodically



                             Page 7                              GAO/AIMD-99-51 FDA’s Controls Over Property
                        B-280138




                        reconcile the general ledger to PMIS. However, FDA officials did not
                        complete interim reconciliations during fiscal year 1998 as stipulated in the
                        plan. A reconciliation was completed only at year-end, and numerous
                        adjusting journal entries were needed to prepare the fiscal year 1998
                        financial statements.

                        FDA’s corrective action plan calls for a new property management system
                        that would be integrated with the procurement system and the general
                        ledger system. In addition, the plan calls for the new system to (1) provide
                        more timely data and provide a more accurate picture of property and
                        equipment under FDA’s custody, as well as related costs and (2) have the
                        ability to create a detailed audit trail that maintains a record of when
                        property and equipment items are moved, lost, or surplussed, with the date
                        each item’s status changed, its new location, and who approved the change.
                        Using the new system, FDA anticipates that its staff should be able to more
                        easily retrieve detailed information about areas of concern (e.g., surplussed
                        ADP equipment), perform analyses, and make necessary changes regarding
                        how this property is managed. FDA also expects that the integrated system
                        will result in FDA’s management receiving more timely financial
                        management reports.



FDA Lacked Reliable     FDA lacked reliable information to account for missing ADP equipment
                        because of ineffective procedures for reporting and recording lost, stolen,
Information Regarding   and destroyed equipment. Without complete and accurate data, FDA was
Lost, Stolen, or        unable to assess its losses in this area and to respond with appropriate
                        management strategies to address its risks.
Destroyed ADP
Equipment               When ADP equipment was discovered missing, FDA procedures called for
                        notifying both the Security Office and the Property Office. This notification
                        was to be done by the supervisor of the individual discovering the loss.
                        When the supervisor notified the Security Office, the Security Officer was
                        to file an Incident Report and, if necessary, notify the police. Meanwhile,
                        the supervisor was also required to provide the PCO with a completed
                        Report of Survey concerning the missing equipment. The PCO was then to
                        file the Report of Survey and the Incident Report with the Property Office,
                        whose staff would then update the PMIS database.

                        Our review of the records generated by the Security and Property offices
                        indicated that this notification procedure was not being consistently
                        followed. Neither office was able to provide us with a complete list of items
                        reported lost, stolen, or destroyed during fiscal year 1998, and the partial



                        Page 8                              GAO/AIMD-99-51 FDA’s Controls Over Property
B-280138




lists provided by each office were significantly different from one another
in content.

Because FDA’s procedures required the participation of several individuals
and the use of two different forms to report and record stolen property,
there were several opportunities for the flow of information to stop before
it reached the PMIS database. In some cases, information on missing
equipment was never entered into PMIS, compromising its accuracy and
completeness. Further, a lack of communication and coordination between
the Security and Property offices kept the Property Office (which had
responsibility for updating the PMIS database) uninformed of all missing
data on stolen property.

In an attempt to determine the number of property and equipment items
stolen during fiscal year 1998, we obtained a file copy of the PMIS database.
However, our analysis was limited by the fact that, although PMIS had the
capability to distinguish among lost, stolen, and destroyed items, FDA used
the same property code to identify these items in the PMIS database. Thus,
it was impossible to use the database to quantify the number of stolen
versus lost or destroyed items. Therefore, we requested and reviewed the
supporting manual records--Reports of Survey--for lost, stolen, and
destroyed equipment. Based on the Reports of Survey reviewed, we found
that some items reported missing had not been recorded in PMIS.

After we informed FDA officials that the PMIS database was incomplete,
the Property Office obtained Reports of Survey in addition to those we had
reviewed and compiled a more extensive list of property and equipment
(including items other than ADP equipment) reported lost, stolen, and
destroyed. This list, compiled in fiscal year 1998, included about 1600
items, both capitalized and noncapitalized, with a reported total dollar
value of approximately $10.1 million.11

Of the 1,600 items, 955 items with a reported value of $3.4 million
represented ADP equipment. According to FDA officials, the 1,600 were
lost, stolen, or destroyed over more than 3 years, dating back to the time
FDA’s last comprehensive inventory of property and equipment was
completed. Of the 1,600 items, FDA could not determine whether 976
items--with a combined reported value of $7.4 million--were lost, stolen, or
destroyed because the PCOs involved had not provided that information as


11
 According to FDA, of this total, 1,226 items valued at $7.6 million were fully amortized.




Page 9                                           GAO/AIMD-99-51 FDA’s Controls Over Property
B-280138




required on the Reports of Survey. Among the 976 were such items as (1) a
$208,970 bench facstar laser, (2) a $60,981 Nikon Microscope, and (3) a
$40,500 Threshold system molecular device. None of these three items
were scheduled for replacement until after 2002. Of the 976 items, 502,
valued at a reported $2.2 million, represented ADP equipment.

In a further attempt to analyze data on ADP equipment theft, we obtained
the Security Office’s fiscal year 1998 incident reports on stolen ADP
equipment. However, we had a limited ability to trace items detailed in the
incident reports to the Reports of Survey list or the PMIS database because
information on missing equipment was recorded inconsistently in incident
reports, Reports of Survey, and the PMIS database. In attempting to
compare items, we assumed that barcode information would help us trace
specific items from one report to another and to PMIS. However FDA’s
procedures did not require recording barcodes on the incident reports, and
many lacked barcodes. Of 22 items listed in the incident reports we
reviewed, only 9 contained barcode information. However, even with
barcodes, we could find none of the nine items in the PMIS database, and
we could only find five of the nine on the Reports of Survey list.

In December 1998, FDA drafted procedures to more effectively monitor
and document lost, stolen, and destroyed property. FDA officials stated
that these new procedures should be fully implemented by March 1999.
Procedural changes include (1) requiring that the PCO, rather than the
supervisor, notify both offices of lost and stolen property; (2) using only the
Incident Report (with barcode information) to document stolen property
and equipment; (3) immediately flagging the property as potentially stolen
in the property database; and (4) requiring that PCOs who report lost or
destroyed property complete a Report of Survey detailing why the
equipment is considered to be lost or destroyed rather than stolen.

As part of FDA’s tasks listed in its corrective action plan to address
weaknesses identified by the IPA, FDA plans to use periodic quality control
reviews to gain assurance that new procedures are fully and properly
implemented, including procedures for accounting for lost, stolen, and
destroyed property. In January 1999, FDA took the additional step of
creating unique property codes to distinguish among lost, stolen, and
destroyed equipment in the PMIS database.




Page 10                              GAO/AIMD-99-51 FDA’s Controls Over Property
                          B-280138




Lack of Compliance        Controls over relocating equipment were inadequate to prevent FDA staff
                          from altering the documents used to control the surplussing of ADP
With Procedures           equipment, even though procedures require properly authorized
Weakened Controls         documents with original signatures. In addition, we identified an instance
                          in which FDA did not properly remove sensitive data from ADP equipment
Over Equipment Being      that was donated to a school.
Surplussed

Alteration of Documents   We found that documentation necessary to remove surplussed ADP
Circumvented Controls     equipment from FDA premises could be altered in two ways, circumventing
                          this important control.

                          1. When equipment was being designated for surplus, the numbers and
                          types of equipment listed on documents was sometimes altered by FDA
                          staff. For example, some of the computers listed on the surplussing forms
                          were crossed-out without being initialed to verify that the change was
                          approved. In those cases, FDA was unable to provide assurance that
                          appropriate approvals were obtained before equipment was designated for
                          surplus and removed from FDA premises.

                          2. According to HHS Program Support Center (PSC) officials, when their
                          drivers picked up surplus items from FDA, they sometimes changed the
                          required documents when the amount and type of equipment available for
                          removal differed from that listed on the documents.

                          Because the document used for surplussing ADP equipment is also used for
                          relocating other FDA property, and altered forms could be used to remove
                          equipment from the building, the control environment was seriously
                          compromised and the risk of misappropriation increased.

                          Before any equipment is removed from FDA premises, FDA policy requires
                          that the person removing it present either a property pass or a Request for
                          Property Action form (HHS-22) at the security desk. A property pass is to
                          be used when equipment is being temporarily relocated, such as computer
                          equipment being used at home. Our inventory testing sample included two
                          cases in which the use of property passes was required to remove
                          equipment from the premises. In both cases, we found that proper
                          procedures were followed and we were able to trace these two pieces of
                          equipment to the locations outside FDA where they were being used.




                          Page 11                            GAO/AIMD-99-51 FDA’s Controls Over Property
B-280138




When ADP equipment is to be surplussed, FDA guidance calls for a form
HHS-22 to be authorized and forwarded to the Property Office, where the
equipment record is to be removed from the PMIS database. The HHS-22
form is also to be sent to the Program Support Center (PSC), an HHS
central location, which, in most cases, is responsible for picking up
surplussed equipment. Sometimes, an FDA center donates surplus ADP
equipment directly to a school. In those cases, in addition to filing an HHS-
22 form, FDA is required to have the school complete and sign a
Certification Statement indicating receipt and ownership of donated ADP
equipment.

Our review of records for donated equipment showed that FDA staff did
not always use original HHS-22 forms in designating equipment for surplus.
Instead, they would sometimes alter the number or types of equipment to
be surplussed on a form that had been previously approved and signed.
FDA officials provided 27 HHS-22 forms, representing surplussed items
they had on record for fiscal year 1998. Our review of the 27 forms showed
that 8 had been altered. We asked Property Office staff whether, in these
cases, the Property Management Officer provided an original signature
authorizing the surplus of the equipment before it was removed from the
building. While Property Office staff stated that this procedure was
generally followed, in several cases, including these eight, the Property
Office did not have its copies of the HHS-22 forms on file and so were
unable to provide assurance that proper authorizations were obtained
before equipment was removed from the premises. The HHS-22 forms
provided for our review were copies obtained from the FDA centers.

Even in cases when an original HHS-22 form was used, PSC management
informed us that the PSC drivers regularly changed the information
regarding the quantity and type of equipment listed on the form from that
originally authorized. According to PSC management, drivers stated that
the reason for altering the forms was that at the time of pickup, they often
found more or fewer equipment items than those listed.

According to FDA management, the drivers’ altering of HHS-22 forms may
have occurred as a result of employees at FDA centers observing
equipment being surplussed, thus seeing an opportunity to either claim the
equipment for their own use or add equipment to that being surplussed.
This explanation suggests that FDA employees were able to make
decisions about the disposition of equipment in FDA’s custody without
going through the proper channels or completing the necessary documents.
In this manner, both PSC drivers and FDA employees were allowed to



Page 12                             GAO/AIMD-99-51 FDA’s Controls Over Property
                            B-280138




                            circumvent the controls over the surplus of ADP equipment. As a result,
                            FDA lacked assurance that the approved number of surplussed items left
                            the building or reached PSC.

                            FDA officials told us that as of December 1998, PSC drivers had been
                            informed that they were no longer permitted to alter documents. If drivers
                            see a discrepancy between the property available for pickup and what is
                            described on the HHS-22, they are not to pickup anything until they receive
                            new paperwork that properly describes the items being relocated.


Sensitive Data on Donated   For equipment donated to schools, FDA policy required that all sensitive
ADP Equipment Not Always    data be removed from the computer. However, the policy allowed for the
                            retention of some software on the computer based upon the licensing
Removed                     agreement with the software company involved. FDA centers are required
                            to sign a statement indicating that ADP hard drives have been properly
                            scrubbed or cleaned. Scrubbing ensures that formatting of the hard drive is
                            complete and that all proprietary information has been removed.

                            FDA could not provide a complete list of donated ADP equipment to
                            support a statistically valid test of the proper scrubbing of hard drives.
                            Although the PMIS database and the completed HHS-22 forms should each
                            provide a complete record of donated ADP equipment, we found that some
                            of the donated equipment recorded in the PMIS database could not be
                            traced to the HHS-22 forms. Further, some donated equipment on the HHS-
                            22 forms could not be traced to the PMIS database.

                            Due to FDA’s inability to provide a complete population of donated ADP
                            equipment, we performed limited testing in this area. We selected and
                            tested a nonstatistical sample of 22 computers from FDA centers and PSC.
                            The 22 computers were donated to six different schools in the Washington
                            D.C., area. We found that the schools' administrators generally exercised
                            care in ensuring that computers were free from any previous software and
                            viruses by reformatting the hard drives prior to installing the respective
                            school's software. With 14 of the 22 computers we tested, these procedures
                            had already been performed. Therefore, in those cases we could not
                            determine whether FDA had done the proper scrubbing prior to donation.

                            Regarding the other eight computers, one of the schools we visited had not
                            yet placed the donated computers into service and therefore had not
                            reformatted the hard drives. At this school, one of the eight computers
                            tested contained sensitive FDA information. The information left on the



                            Page 13                            GAO/AIMD-99-51 FDA’s Controls Over Property
                  B-280138




                  computer was a rejection letter from the Center for Devices and
                  Radiological Health to a medical technology laboratory stating that FDA
                  could not provide reasonable assurance that the medical device was safe
                  and effective for its intended use. In this case, neither FDA officials nor the
                  school were aware that the sensitive data remained on the computer. Using
                  commercially available software, we took no extraordinary measures to
                  retrieve this data from the computer. Thus, the retrieval could have been
                  done by anyone with basic computer skills and software. After we found
                  the sensitive information on the computer at the school, it was removed.

                  FDA officials noted that the computer, which contained the sensitive
                  information, was donated in November 1997, prior to FDA’s
                  implementation of its new procedures in June 1998. The new procedures
                  require that a center official be designated to certify by signature on the
                  HHS-22 form that the computers are free of sensitive information.
                  However, as mentioned, for those computers we tested that were donated
                  after the effective date of the new procedures, we could not determine
                  whether FDA had properly scrubbed the computers prior to donation.



Conclusions       While FDA is making progress in implementing its corrective action plan,
                  continued emphasis on the tasks and the desired outcomes are key to
                  resolving the internal control weaknesses related to property and
                  equipment reported in prior audit reports. The implementation of a new
                  property management system that integrates on an automated basis with
                  the general ledger, as well as the creation of the PPC position, should
                  provide FDA with enhanced accountability over property and equipment
                  and financial reporting capabilities. However, if FDA fully complies with
                  existing policies and procedures and implements those contemplated in its
                  corrective action plan, the risk of incidents such as the loss and theft of
                  equipment and the inadvertent release of proprietary information will be
                  diminished.



Recommendations   To correct weaknesses identified in prior audit reports and strengthen
                  controls over ADP equipment, we recommend that the Commissioner of
                  Food and Drugs

                  • finalize and implement proposed procedures for conducting
                    comprehensive property inventories and component-specific spot
                    audits;



                  Page 14                              GAO/AIMD-99-51 FDA’s Controls Over Property
                      B-280138




                      • ensure that interim reconciliations of the general ledger system to the
                        property subsidiary ledger system (PMIS) using manual processes are
                        performed until the new property management system is fully
                        operational, as stipulated in FDA’s corrective action plan;
                      • finalize and implement proposed procedures to ensure the reliability of
                        information on lost, stolen, and destroyed property and equipment and
                        conduct periodic quality control reviews to ensure that new procedures
                        are followed; and
                      • ensure compliance with established policies and procedures that
                        address the surplus of ADP equipment. Specifically, during the March
                        1999 training for PPCs and PCOs, ensure that proper documentation
                        procedures are covered to prevent the use of altered documents.



Agency Comments and   In general, FDA agreed with the report findings and concurred with all of
                      our recommendations. FDA indicated that actions are either planned,
Our Evaluation        already in process, or implemented to address the issues raised in our
                      report. These include (1) developing new procedures for performing
                      inventories and auditing outcomes (the next annual inventory is scheduled
                      to begin later this month), (2) performing monthly reconciliations of the
                      general ledger system to the property subsidiary ledger system, (3) using a
                      new coding system that separates lost versus stolen or destroyed property
                      listed in PMIS, and (4) designing training to include instructions for proper
                      surplussing procedures.

                      In addition, FDA provided some clarifying comments that we incorporated
                      into our report where appropriate. FDA also raised several additional
                      matters, none of which affect our findings and recommendations. Our
                      response to these matters are discussed in appendix I.


                      We are sending copies of this report to the Chairmen and Ranking Minority
                      Members of the Senate and House Committees on Appropriations; Senate
                      Committee on Governmental Affairs, and the House Committee on
                      Government Reform. We are also sending copies of this report to the
                      Secretary of Health and Human Services, the Commissioner of Food and
                      Drugs, and other interested parties. We will also make copies available to
                      others upon request.




                      Page 15                             GAO/AIMD-99-51 FDA’s Controls Over Property
B-280138




If you have any questions, please call me at (202) 512-4476. Major
contributors to this report are listed in appendix II.




Gloria L. Jarmon
Director, Health, Education, and Human Services
 Accounting and Financial Management Issues




Page 16                            GAO/AIMD-99-51 FDA’s Controls Over Property
Page 17   GAO/AIMD-99-51 FDA’s Controls Over Property
Appendix I

Comments From the Food and Drug
Administration                                                            ApeInxdi




Note: GAO comments
supplementing those
in the report text
appear at the end
of this appendix.




                      Page 18   GAO/AIMD-99-51 FDA’s Controls Over Property
                 Appendix I
                 Comments From the Food and Drug
                 Administration




See comment 1.




See comment 2.
Now on p. 1.
Now on p. 4.




Now on p. 1.
See comment 2.




                 Page 19                           GAO/AIMD-99-51 FDA’s Controls Over Property
                 Appendix I
                 Comments From the Food and Drug
                 Administration




See comment 3.




See comment 4.




                 Page 20                           GAO/AIMD-99-51 FDA’s Controls Over Property
                 Appendix I
                 Comments From the Food and Drug
                 Administration




See comment 5.




                 Page 21                           GAO/AIMD-99-51 FDA’s Controls Over Property
Appendix I
Comments From the Food and Drug
Administration




Page 22                           GAO/AIMD-99-51 FDA’s Controls Over Property
               Appendix I
               Comments From the Food and Drug
               Administration




               The following are GAO’s comments on FDA’s letter received on
               February 16, 1999.



GAO Comments   1. Although the IPA is planning to give FDA an unqualified opinion on its
               financial statements, FDA’s statement that “the auditors found sufficient
               evidence of FDA’s progress to accept FDA’s internal controls structure
               (including property)” is a misinterpretation of the auditor’s opinion. Our
               review of the audit workpapers showed that the IPA did not rely on the
               internal controls over property management, but instead performed
               extensive substantive tests of financial statement balances. As FDA
               indicated, the IPA will continue to report property management as a
               reportable condition.

               2. We believe that this report is balanced and provides adequate
               recognition of the progress FDA is making to correct reported weaknesses.

               3. Even though the corrective action plan indicated that the tasks and
               anticipated outcomes were complete, FDA acknowledged that the
               initiation of tasks would not fully achieve the anticipated outcomes
               immediately. We are encouraged that FDA plans to continue its efforts to
               correct reported weaknesses, including the review of the interim database
               and making corrections as errors are identified so data transferred into the
               new system will be as accurate as possible.

               4. FDA believes that our sample test, for which we found 1 error out of 46
               items, indicates that the PMIS database has a 2 percent error rate, which is
               within FDA’s stated goal. However, based on the statistical sample
               methodology we used, 1 error out of 46 items tested actually indicates, with
               90 percent confidence, a possible error rate of 0.23 to 8.19 percent. Also,
               this test result was considered in conjunction with the completeness test of
               73 items in which we found 7 errors. These seven errors indicate a potential
               error rate of 5.42 to 15.68 percent, which is significantly higher than the 2
               percent referred to by FDA.

               5. This report has been revised to reflect FDA’s comment.




               Page 23                             GAO/AIMD-99-51 FDA’s Controls Over Property
Appendix II

Major Contributors to This Report                                                                  ApIenxdi




Accounting and         Chinero Thomas, Assistant Director
                       HeidiKitt Winter, Audit Manager
Information            Rosa Ricks Harris, Audit Manager
Management Division,   Angela Samblanet, Auditor
                       Wm. David Grindstaff, Senior Assistant Director
Washington, D.C.       Maria Zacharias, Communication Analyst




(916256)               Page 24                           GAO/AIMD-99-51 FDA’s Controls Over Property
Ordering Information

The first copy of each GAO report and testimony is free.
Additional copies are $2 each. Orders should be sent to the
following address, accompanied by a check or money order made
out to the Superintendent of Documents, when necessary, VISA and
MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address are
discounted 25 percent.

Orders by mail:

U.S. General Accounting Office
P.O. Box 37050
Washington, DC 20013

or visit:

Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-6000
or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any list
from the past 30 days, please call (202) 512-6000 using a touchtone
phone. A recorded menu will provide information on how to obtain
these lists.

For information on how to access GAO reports on the INTERNET,
send an e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov
United States                       Bulk Rate
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. GI00
Official Business
Penalty for Private Use $300

Address Correction Requested