United States General Accounting Office GAO Report to Congressional Requesters February 1999 FINANCIAL MANAGEMENT FDAs Controls Over Property Have Improved, But Weaknesses Remain GAO/AIMD-99-51 United States GAO General Accounting Office Washington, D.C. 20548 Leter Accounting and Information Management Division Leter B-280138 February 22, 1999 The Honorable Tom Bliley Chairman, Committee on Commerce House of Representatives The Honorable Joe Barton House of Representatives This report responds to your request that we assess the adequacy and status of the Food and Drug Administration’s (FDA) planned actions to correct internal control weaknesses identified related to property and equipment in prior financial statement audit reports.1 The weaknesses identified in these reports were primarily that FDA (1) had inadequate controls over the physical quantities of property and equipment and their locations and (2) lacked proper reconciliations between its general ledger and property subsidiary ledger systems. As requested, we limited the scope of our work to property and equipment exclusive of buildings and land. In addition, you asked that we review FDA’s internal controls related to the safeguarding and reporting of automated data processing (ADP) equipment that is lost, stolen, destroyed, or surplussed. Results in Brief FDA developed an action plan that, if properly implemented, should correct the weaknesses identified in the financial audit reports regarding property and equipment. FDA has made progress in implementing various actions, but it has not yet resolved some of the reported weaknesses. According to FDA officials, as of January 21, 1999, 23 of the 41 tasks in the corrective action plan related to property and equipment had been completed. However, we found that 9 of these 23 tasks had not yet fully achieved their anticipated outcomes. One of these tasks was for FDA’s management to create and validate a new property database. While FDA conducted several physical inventories to create this database, our testing showed that the database was not accurate. For example, in a sample of 73 property items selected from FDA centers, 7 were not listed in the database. For the 18 remaining tasks, 17 of the tasks, such as replacing the 1 Report on the Financial Statement Audit of the Food and Drug Administration for Fiscal Year 1997 (OIG #A-17-97-0003, May 1998) and Report on the Financial Statement Audit of the Food and Drug Administration for Fiscal Year 1996 (OIG #A-17-96-0003, June 1997). Page 1 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 property management system, are not scheduled for full implementation until fiscal year 1999 or later. FDA did not have adequate controls in place to effectively monitor the loss, theft, or destruction of ADP equipment. FDA procedures for reporting and recording missing equipment were ineffective, with the result that information on missing equipment sometimes never reached the property management database, thus compromising database accuracy and completeness. The reliability of the database was further hampered because FDA used the same code to identify lost, stolen, and destroyed property and thus could not determine individual quantities and values in each of these categories. This was the case for $10.1 million in property, including ADP equipment, that FDA reported in 1998 as having been lost, stolen, or destroyed.2 Further, for $7.4 million of the $10.1 million, FDA was unable to determine, how much represented lost versus stolen or destroyed property even when it reviewed source documents. Lacking this level of detail in its data, FDA management could not effectively analyze the nature and severity of problems related to missing equipment and develop related management strategies to address its risks. FDA was unable to provide assurance that the proper authorizations were in place before ADP equipment was designated for surplus3 and removed from FDA premises. FDA’s procedures for surplussing equipment called for filing related paperwork that included the original signatures of the property management personnel who authorized the surplus. However, we found that in 8 of the 27 cases we reviewed, FDA staff altered the forms used to designate equipment for surplus. In other cases, we were told by the Department of Health and Human Services’ (HHS) Program Support Center officials that it was not uncommon for the drivers who picked up surplus equipment to alter signed forms before removing equipment from the premises when the equipment listed on the paperwork differed from that available for pickup. Such alterations of required paperwork seriously compromised the control environment and increased the risk of theft and inappropriate removal of equipment. 2The date the items were lost, stolen, or destroyed is not known because, according to FDA, no physical inventories of FDA assets were conducted for at least 3 years prior to fiscal year 1998. 3 Surplussed personal property includes any excess personal property for which there is no longer a need. These items can be donated or sold. Page 2 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 Another aspect of controls over surplussed ADP equipment concerned FDA's requirement to remove all sensitive information from the hard drives of surplussed computers. Based on our limited testing, we found an instance in which a computer donated to a school contained information that should have been removed before it was donated. Background FDA, a component of HHS, is one of the nation’s oldest consumer protection agencies whose mission is to protect and promote the health and well-being of consumers in the United States. Organizationally, FDA headquarters consists of five support offices and six centers. It has a $1 billion annual budget and employs approximately 9,000 employees who regulate and monitor the manufacture, import, transport, storage, and sale of over $1 trillion worth of food and drugs. In addition, FDA's records indicate that it manages about 40,000 capitalized and noncapitalized property and equipment4 items such as laboratory, office, ADP, and telecommunications equipment. These items are accounted for within FDA's Property Management Information System (PMIS) and are the responsibility of the particular FDA center using the equipment, with assistance from the Personal Property Management Branch within the Division of Central Services. FDA reported a net amount of $163 million5 in property and equipment on its fiscal year 1997 financial statements. HHS is required to have annual audited financial statements under the Chief Financial Officers Act of 1990, as expanded by the Government Management Reform Act of 1994. To meet this requirement, HHS decided to have most of its components’ financial statements audited. In its audit reports on FDA’s fiscal years 1996 and 1997 financial statements, the independent public accounting firm6 (IPA) cited internal control weaknesses related to property and equipment. To address these weaknesses and to strengthen internal controls, FDA engaged the IPA as a 4 Capitalized property and equipment is defined as items with a cost of $25,000 or more. Noncapitalized equipment is defined as those items that cost between $5,000 and $25,000, as well as items under $5,000 listed as sensitive, such as ADP equipment. Prior to 1996, the threshold for capitalized items was $5,000. 5This amount resulted from a total cost of $284 million minus accumulated depreciation of $121 million. The net amount of $163 million consisted of $36 million in ADP, laboratory, and office equipment and $127 million in construction, land, and buildings. 6 The HHS Office of the Inspector General contracted with Gardiner, Kamya, & Associates, P.C., an IPA, to perform the fiscal years 1996 and 1997 financial statement audits. Page 3 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 consultant7 to review its initial corrective action plan and provide any necessary recommendations. Based on the consultant’s recommendations, FDA updated its corrective action plan and issued a revised plan on October 28, 1998. Scope and To determine the adequacy and status of FDA’s corrective action plan, we reviewed the IPA’s report and workpapers related to the fiscal year 1997 Methodology financial statement audit. We also interviewed IPA personnel to obtain more details about the issues raised in the report and to gain an understanding of the work performed and the results. We obtained and reviewed FDA's corrective action plan and discussed with FDA personnel the current status of corrective actions on reported issues. Because one of the corrective actions was to update the PMIS database, we performed tests to ensure that items recorded in the database actually existed and that the database was complete. We also reviewed the results of the consultant’s agreed upon procedures to review the initial corrective action plan. However, as part of our work, we did not review the database design or the general and application system controls,8 which are critical to the integrity of the PMIS database. We obtained an understanding of the internal controls over property and equipment, which included reviewing the safeguarding and reporting of these assets. To determine whether FDA had adequate controls in place to monitor the loss and theft of ADP equipment, we reviewed and analyzed related Security and Property Office reports for lost, stolen, and destroyed property and equipment. In addition, we reviewed and analyzed related policies and procedures. To assess FDA's process for monitoring the surplussing of property and equipment, we reviewed and tested related policies and procedures. Procedures tested included the requirement to remove sensitive information before ADP equipment is surplussed. Since FDA could not provide a complete listing of donated equipment, we selected a nonstatistical sample of 22 computers from the six Washington regional 7 Gardiner, Kamya, & Associates, P.C., Independent Accountant's Report on Applying Agreed-Upon Procedures, (Contract Number: HHS-100-95-0010, August 14, 1998). 8 General controls are the structure, policies, and procedures that apply to an entity’s overall computer operations. Application controls ensure that transactions are valid, properly authorized, and completely and accurately processed and reported. Page 4 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 area schools that received and still had access to these donations in fiscal year 1998. For each of these donated computers, we scanned the hard drives to determine if sensitive information had been properly removed. Our work was performed at FDA's Washington, D.C., area offices from July 1998 through mid-January 1999 in accordance with generally accepted government auditing standards. We requested written comments on a draft of this report from the Commissioner of FDA or her designee. On February 16, 1999, FDA provided us with written comments, which are discussed in the "Agency Comments and Our Evaluation" section and reprinted in appendix I. Status of Corrective If FDA effectively implements all the tasks contained in its property management corrective action plan and achieves anticipated outcomes, it Actions for Prior Audit should be able to adequately resolve the weaknesses reported in the Findings financial statement audits for fiscal years 1996 and 1997. As of January 21, 1999, the plan contained 41 tasks related to property and equipment, each of which identified a specific anticipated outcome. Of these 41 tasks, FDA officials stated that 23 were complete. However, we determined that some of the tasks had not achieved their anticipated outcomes. Among the tasks included in the plan were: (1) performing periodic comprehensive inventories of property and equipment, as well as component-specific spot audits9 to provide an accurate database of property assets; (2) developing new policies and procedures, with associated training, to create increased responsibility and accountability for property and equipment at the level of each FDA center; and (3) purchasing and implementing a new property management system to integrate the general and subsidiary ledgers. The following is a discussion of these three areas, which are at the heart of the challenges FDA faces in addressing its property management weaknesses. Comprehensive Inventories Before fiscal year 1998, FDA had not performed a complete physical Are Crucial to a Reliable inventory of property and equipment in more than 3 years. As part of the fiscal year 1997 audit, FDA’s IPA had tested the PMIS database and found Database that in a sample of 66 capitalized items FDA could not locate 46 items. This 9 The plan describes these audits as repetitive audits of FDA component inventories and property management practices. Page 5 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 condition contributed to the IPA’s reporting of a material weakness regarding controls over the physical quantities of property and equipment and their locations. Our review of the PMIS database, which included both capitalized and noncapitalized property and equipment, indicated that while significant improvements were made over the last year, the database was still not accurate. For example, we traced 73 sample items from FDA offices to the database and found that 7 items were either not recorded in the database or were recorded incorrectly. We observed that these seven items did not have valid barcodes. Although FDA’s corrective action plan listed the task of conducting a comprehensive inventory and barcoding program of all property items as having been completed in April 1998, FDA had not yet achieved its anticipated outcome of having an accurate inventory of FDA property assets. In addition, we found that 1 computer among 46 items we sampled could not be traced from the database to FDA offices. FDA stated that this computer had been sent to HHS’ Program Support Center (PSC) as a surplus item without the required supporting documentation; therefore neither FDA nor we could readily confirm what actually happened to the computer. FDA’s proposed policies and procedures referred to in the corrective action plan call for conducting a comprehensive inventory at least once a year of all accountable personal property items10 throughout the agency, with the next such inventory planned for March 1999. According to FDA, a less frequent inventory schedule will be considered only when an FDA component’s statistics reflect an inventory accuracy of greater than 98 percent and when continuous audits reflect adherence to sound property management practices. In addition, the plan contained a provision for internal audits of FDA component inventories on a continuous basis to ensure (1) a continuing focus on property assets by accountable program officials and (2) positive external audit reports. As of January 1999, FDA officials stated that they were also considering adopting, on a quarterly basis, a modified inventory audit process for capitalized property items. 10 Accountable personal property is defined as equipment that is complete in itself and is of a durable nature with an expected service life of 2 years or more. The equipment should have an acquisition or adjusted cost of $5,000 or more or should be identified as “sensitive equipment” regardless of cost, such as ADP equipment. Page 6 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 FDA anticipates that these policy and procedural changes will address internal controls over property and equipment. Given FDA’s reported weaknesses in prior year audit reports and FDA’s piloting of a new system in the spring of 1999, performing regular inventories and internal audits and continuing to validate the PMIS database are crucial to the success of the new system and the future reliability of the property management database. New Policies and FDA’s corrective action plan calls for the creation of a new staff position, Procedures Include the the Personal Property Coordinator (PPC) at each FDA center. The PPC is to manage the acquisition and barcoding of all property and ensure that Creation of a New Position receiving data is promptly submitted to the Property Management and Finance offices to update their records. In addition, the PPC is to plan and coordinate center wide inventories and coordinate the activities of the center’s Property Custodial Officers (PCO), who are responsible for the day-to-day management of property charged to a specific area within an FDA center. As of January 21, 1999, three out of six FDA centers have full-time PPCs in place and formal training of PPCs and PCOs was scheduled for March 1999. FDA anticipates that this new structure, when fully in place, will improve the control environment as well as the reliability of data on FDA property. New System Expected to Because PMIS, the procurement system, and the general ledger system Improve Reconciliation were not integrated, FDA had to rely on manual processes to transfer data from one of these systems to another. As a result, PMIS did not contain Between FDA’s Property records of all the property owned by FDA, and cost information did not Management, Procurement, reach the general ledger promptly. In prior year audits, the IPA reported and General Ledger Systems that FDA did not perform periodic reconciliations between its general ledger system and its property subsidiary ledger system (the PMIS database) and that therefore, significant year-end adjustments were required in order for FDA to prepare its financial statements. The new property management system is scheduled to be piloted starting in May 1999. Based on the results of the pilot and following approval by the Office of Information Resources Management, a phased rollout of the new system is expected to begin, with full implementation scheduled to occur after fiscal year 1999. Until the new system is operational, the corrective action plan called for FDA to use manual processes to periodically Page 7 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 reconcile the general ledger to PMIS. However, FDA officials did not complete interim reconciliations during fiscal year 1998 as stipulated in the plan. A reconciliation was completed only at year-end, and numerous adjusting journal entries were needed to prepare the fiscal year 1998 financial statements. FDA’s corrective action plan calls for a new property management system that would be integrated with the procurement system and the general ledger system. In addition, the plan calls for the new system to (1) provide more timely data and provide a more accurate picture of property and equipment under FDA’s custody, as well as related costs and (2) have the ability to create a detailed audit trail that maintains a record of when property and equipment items are moved, lost, or surplussed, with the date each item’s status changed, its new location, and who approved the change. Using the new system, FDA anticipates that its staff should be able to more easily retrieve detailed information about areas of concern (e.g., surplussed ADP equipment), perform analyses, and make necessary changes regarding how this property is managed. FDA also expects that the integrated system will result in FDA’s management receiving more timely financial management reports. FDA Lacked Reliable FDA lacked reliable information to account for missing ADP equipment because of ineffective procedures for reporting and recording lost, stolen, Information Regarding and destroyed equipment. Without complete and accurate data, FDA was Lost, Stolen, or unable to assess its losses in this area and to respond with appropriate management strategies to address its risks. Destroyed ADP Equipment When ADP equipment was discovered missing, FDA procedures called for notifying both the Security Office and the Property Office. This notification was to be done by the supervisor of the individual discovering the loss. When the supervisor notified the Security Office, the Security Officer was to file an Incident Report and, if necessary, notify the police. Meanwhile, the supervisor was also required to provide the PCO with a completed Report of Survey concerning the missing equipment. The PCO was then to file the Report of Survey and the Incident Report with the Property Office, whose staff would then update the PMIS database. Our review of the records generated by the Security and Property offices indicated that this notification procedure was not being consistently followed. Neither office was able to provide us with a complete list of items reported lost, stolen, or destroyed during fiscal year 1998, and the partial Page 8 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 lists provided by each office were significantly different from one another in content. Because FDA’s procedures required the participation of several individuals and the use of two different forms to report and record stolen property, there were several opportunities for the flow of information to stop before it reached the PMIS database. In some cases, information on missing equipment was never entered into PMIS, compromising its accuracy and completeness. Further, a lack of communication and coordination between the Security and Property offices kept the Property Office (which had responsibility for updating the PMIS database) uninformed of all missing data on stolen property. In an attempt to determine the number of property and equipment items stolen during fiscal year 1998, we obtained a file copy of the PMIS database. However, our analysis was limited by the fact that, although PMIS had the capability to distinguish among lost, stolen, and destroyed items, FDA used the same property code to identify these items in the PMIS database. Thus, it was impossible to use the database to quantify the number of stolen versus lost or destroyed items. Therefore, we requested and reviewed the supporting manual records--Reports of Survey--for lost, stolen, and destroyed equipment. Based on the Reports of Survey reviewed, we found that some items reported missing had not been recorded in PMIS. After we informed FDA officials that the PMIS database was incomplete, the Property Office obtained Reports of Survey in addition to those we had reviewed and compiled a more extensive list of property and equipment (including items other than ADP equipment) reported lost, stolen, and destroyed. This list, compiled in fiscal year 1998, included about 1600 items, both capitalized and noncapitalized, with a reported total dollar value of approximately $10.1 million.11 Of the 1,600 items, 955 items with a reported value of $3.4 million represented ADP equipment. According to FDA officials, the 1,600 were lost, stolen, or destroyed over more than 3 years, dating back to the time FDA’s last comprehensive inventory of property and equipment was completed. Of the 1,600 items, FDA could not determine whether 976 items--with a combined reported value of $7.4 million--were lost, stolen, or destroyed because the PCOs involved had not provided that information as 11 According to FDA, of this total, 1,226 items valued at $7.6 million were fully amortized. Page 9 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 required on the Reports of Survey. Among the 976 were such items as (1) a $208,970 bench facstar laser, (2) a $60,981 Nikon Microscope, and (3) a $40,500 Threshold system molecular device. None of these three items were scheduled for replacement until after 2002. Of the 976 items, 502, valued at a reported $2.2 million, represented ADP equipment. In a further attempt to analyze data on ADP equipment theft, we obtained the Security Office’s fiscal year 1998 incident reports on stolen ADP equipment. However, we had a limited ability to trace items detailed in the incident reports to the Reports of Survey list or the PMIS database because information on missing equipment was recorded inconsistently in incident reports, Reports of Survey, and the PMIS database. In attempting to compare items, we assumed that barcode information would help us trace specific items from one report to another and to PMIS. However FDA’s procedures did not require recording barcodes on the incident reports, and many lacked barcodes. Of 22 items listed in the incident reports we reviewed, only 9 contained barcode information. However, even with barcodes, we could find none of the nine items in the PMIS database, and we could only find five of the nine on the Reports of Survey list. In December 1998, FDA drafted procedures to more effectively monitor and document lost, stolen, and destroyed property. FDA officials stated that these new procedures should be fully implemented by March 1999. Procedural changes include (1) requiring that the PCO, rather than the supervisor, notify both offices of lost and stolen property; (2) using only the Incident Report (with barcode information) to document stolen property and equipment; (3) immediately flagging the property as potentially stolen in the property database; and (4) requiring that PCOs who report lost or destroyed property complete a Report of Survey detailing why the equipment is considered to be lost or destroyed rather than stolen. As part of FDA’s tasks listed in its corrective action plan to address weaknesses identified by the IPA, FDA plans to use periodic quality control reviews to gain assurance that new procedures are fully and properly implemented, including procedures for accounting for lost, stolen, and destroyed property. In January 1999, FDA took the additional step of creating unique property codes to distinguish among lost, stolen, and destroyed equipment in the PMIS database. Page 10 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 Lack of Compliance Controls over relocating equipment were inadequate to prevent FDA staff from altering the documents used to control the surplussing of ADP With Procedures equipment, even though procedures require properly authorized Weakened Controls documents with original signatures. In addition, we identified an instance in which FDA did not properly remove sensitive data from ADP equipment Over Equipment Being that was donated to a school. Surplussed Alteration of Documents We found that documentation necessary to remove surplussed ADP Circumvented Controls equipment from FDA premises could be altered in two ways, circumventing this important control. 1. When equipment was being designated for surplus, the numbers and types of equipment listed on documents was sometimes altered by FDA staff. For example, some of the computers listed on the surplussing forms were crossed-out without being initialed to verify that the change was approved. In those cases, FDA was unable to provide assurance that appropriate approvals were obtained before equipment was designated for surplus and removed from FDA premises. 2. According to HHS Program Support Center (PSC) officials, when their drivers picked up surplus items from FDA, they sometimes changed the required documents when the amount and type of equipment available for removal differed from that listed on the documents. Because the document used for surplussing ADP equipment is also used for relocating other FDA property, and altered forms could be used to remove equipment from the building, the control environment was seriously compromised and the risk of misappropriation increased. Before any equipment is removed from FDA premises, FDA policy requires that the person removing it present either a property pass or a Request for Property Action form (HHS-22) at the security desk. A property pass is to be used when equipment is being temporarily relocated, such as computer equipment being used at home. Our inventory testing sample included two cases in which the use of property passes was required to remove equipment from the premises. In both cases, we found that proper procedures were followed and we were able to trace these two pieces of equipment to the locations outside FDA where they were being used. Page 11 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 When ADP equipment is to be surplussed, FDA guidance calls for a form HHS-22 to be authorized and forwarded to the Property Office, where the equipment record is to be removed from the PMIS database. The HHS-22 form is also to be sent to the Program Support Center (PSC), an HHS central location, which, in most cases, is responsible for picking up surplussed equipment. Sometimes, an FDA center donates surplus ADP equipment directly to a school. In those cases, in addition to filing an HHS- 22 form, FDA is required to have the school complete and sign a Certification Statement indicating receipt and ownership of donated ADP equipment. Our review of records for donated equipment showed that FDA staff did not always use original HHS-22 forms in designating equipment for surplus. Instead, they would sometimes alter the number or types of equipment to be surplussed on a form that had been previously approved and signed. FDA officials provided 27 HHS-22 forms, representing surplussed items they had on record for fiscal year 1998. Our review of the 27 forms showed that 8 had been altered. We asked Property Office staff whether, in these cases, the Property Management Officer provided an original signature authorizing the surplus of the equipment before it was removed from the building. While Property Office staff stated that this procedure was generally followed, in several cases, including these eight, the Property Office did not have its copies of the HHS-22 forms on file and so were unable to provide assurance that proper authorizations were obtained before equipment was removed from the premises. The HHS-22 forms provided for our review were copies obtained from the FDA centers. Even in cases when an original HHS-22 form was used, PSC management informed us that the PSC drivers regularly changed the information regarding the quantity and type of equipment listed on the form from that originally authorized. According to PSC management, drivers stated that the reason for altering the forms was that at the time of pickup, they often found more or fewer equipment items than those listed. According to FDA management, the drivers’ altering of HHS-22 forms may have occurred as a result of employees at FDA centers observing equipment being surplussed, thus seeing an opportunity to either claim the equipment for their own use or add equipment to that being surplussed. This explanation suggests that FDA employees were able to make decisions about the disposition of equipment in FDA’s custody without going through the proper channels or completing the necessary documents. In this manner, both PSC drivers and FDA employees were allowed to Page 12 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 circumvent the controls over the surplus of ADP equipment. As a result, FDA lacked assurance that the approved number of surplussed items left the building or reached PSC. FDA officials told us that as of December 1998, PSC drivers had been informed that they were no longer permitted to alter documents. If drivers see a discrepancy between the property available for pickup and what is described on the HHS-22, they are not to pickup anything until they receive new paperwork that properly describes the items being relocated. Sensitive Data on Donated For equipment donated to schools, FDA policy required that all sensitive ADP Equipment Not Always data be removed from the computer. However, the policy allowed for the retention of some software on the computer based upon the licensing Removed agreement with the software company involved. FDA centers are required to sign a statement indicating that ADP hard drives have been properly scrubbed or cleaned. Scrubbing ensures that formatting of the hard drive is complete and that all proprietary information has been removed. FDA could not provide a complete list of donated ADP equipment to support a statistically valid test of the proper scrubbing of hard drives. Although the PMIS database and the completed HHS-22 forms should each provide a complete record of donated ADP equipment, we found that some of the donated equipment recorded in the PMIS database could not be traced to the HHS-22 forms. Further, some donated equipment on the HHS- 22 forms could not be traced to the PMIS database. Due to FDA’s inability to provide a complete population of donated ADP equipment, we performed limited testing in this area. We selected and tested a nonstatistical sample of 22 computers from FDA centers and PSC. The 22 computers were donated to six different schools in the Washington D.C., area. We found that the schools' administrators generally exercised care in ensuring that computers were free from any previous software and viruses by reformatting the hard drives prior to installing the respective school's software. With 14 of the 22 computers we tested, these procedures had already been performed. Therefore, in those cases we could not determine whether FDA had done the proper scrubbing prior to donation. Regarding the other eight computers, one of the schools we visited had not yet placed the donated computers into service and therefore had not reformatted the hard drives. At this school, one of the eight computers tested contained sensitive FDA information. The information left on the Page 13 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 computer was a rejection letter from the Center for Devices and Radiological Health to a medical technology laboratory stating that FDA could not provide reasonable assurance that the medical device was safe and effective for its intended use. In this case, neither FDA officials nor the school were aware that the sensitive data remained on the computer. Using commercially available software, we took no extraordinary measures to retrieve this data from the computer. Thus, the retrieval could have been done by anyone with basic computer skills and software. After we found the sensitive information on the computer at the school, it was removed. FDA officials noted that the computer, which contained the sensitive information, was donated in November 1997, prior to FDA’s implementation of its new procedures in June 1998. The new procedures require that a center official be designated to certify by signature on the HHS-22 form that the computers are free of sensitive information. However, as mentioned, for those computers we tested that were donated after the effective date of the new procedures, we could not determine whether FDA had properly scrubbed the computers prior to donation. Conclusions While FDA is making progress in implementing its corrective action plan, continued emphasis on the tasks and the desired outcomes are key to resolving the internal control weaknesses related to property and equipment reported in prior audit reports. The implementation of a new property management system that integrates on an automated basis with the general ledger, as well as the creation of the PPC position, should provide FDA with enhanced accountability over property and equipment and financial reporting capabilities. However, if FDA fully complies with existing policies and procedures and implements those contemplated in its corrective action plan, the risk of incidents such as the loss and theft of equipment and the inadvertent release of proprietary information will be diminished. Recommendations To correct weaknesses identified in prior audit reports and strengthen controls over ADP equipment, we recommend that the Commissioner of Food and Drugs • finalize and implement proposed procedures for conducting comprehensive property inventories and component-specific spot audits; Page 14 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 • ensure that interim reconciliations of the general ledger system to the property subsidiary ledger system (PMIS) using manual processes are performed until the new property management system is fully operational, as stipulated in FDA’s corrective action plan; • finalize and implement proposed procedures to ensure the reliability of information on lost, stolen, and destroyed property and equipment and conduct periodic quality control reviews to ensure that new procedures are followed; and • ensure compliance with established policies and procedures that address the surplus of ADP equipment. Specifically, during the March 1999 training for PPCs and PCOs, ensure that proper documentation procedures are covered to prevent the use of altered documents. Agency Comments and In general, FDA agreed with the report findings and concurred with all of our recommendations. FDA indicated that actions are either planned, Our Evaluation already in process, or implemented to address the issues raised in our report. These include (1) developing new procedures for performing inventories and auditing outcomes (the next annual inventory is scheduled to begin later this month), (2) performing monthly reconciliations of the general ledger system to the property subsidiary ledger system, (3) using a new coding system that separates lost versus stolen or destroyed property listed in PMIS, and (4) designing training to include instructions for proper surplussing procedures. In addition, FDA provided some clarifying comments that we incorporated into our report where appropriate. FDA also raised several additional matters, none of which affect our findings and recommendations. Our response to these matters are discussed in appendix I. We are sending copies of this report to the Chairmen and Ranking Minority Members of the Senate and House Committees on Appropriations; Senate Committee on Governmental Affairs, and the House Committee on Government Reform. We are also sending copies of this report to the Secretary of Health and Human Services, the Commissioner of Food and Drugs, and other interested parties. We will also make copies available to others upon request. Page 15 GAO/AIMD-99-51 FDA’s Controls Over Property B-280138 If you have any questions, please call me at (202) 512-4476. Major contributors to this report are listed in appendix II. Gloria L. Jarmon Director, Health, Education, and Human Services Accounting and Financial Management Issues Page 16 GAO/AIMD-99-51 FDA’s Controls Over Property Page 17 GAO/AIMD-99-51 FDA’s Controls Over Property Appendix I Comments From the Food and Drug Administration ApeInxdi Note: GAO comments supplementing those in the report text appear at the end of this appendix. Page 18 GAO/AIMD-99-51 FDA’s Controls Over Property Appendix I Comments From the Food and Drug Administration See comment 1. See comment 2. Now on p. 1. Now on p. 4. Now on p. 1. See comment 2. Page 19 GAO/AIMD-99-51 FDA’s Controls Over Property Appendix I Comments From the Food and Drug Administration See comment 3. See comment 4. Page 20 GAO/AIMD-99-51 FDA’s Controls Over Property Appendix I Comments From the Food and Drug Administration See comment 5. Page 21 GAO/AIMD-99-51 FDA’s Controls Over Property Appendix I Comments From the Food and Drug Administration Page 22 GAO/AIMD-99-51 FDA’s Controls Over Property Appendix I Comments From the Food and Drug Administration The following are GAO’s comments on FDA’s letter received on February 16, 1999. GAO Comments 1. Although the IPA is planning to give FDA an unqualified opinion on its financial statements, FDA’s statement that “the auditors found sufficient evidence of FDA’s progress to accept FDA’s internal controls structure (including property)” is a misinterpretation of the auditor’s opinion. Our review of the audit workpapers showed that the IPA did not rely on the internal controls over property management, but instead performed extensive substantive tests of financial statement balances. As FDA indicated, the IPA will continue to report property management as a reportable condition. 2. We believe that this report is balanced and provides adequate recognition of the progress FDA is making to correct reported weaknesses. 3. Even though the corrective action plan indicated that the tasks and anticipated outcomes were complete, FDA acknowledged that the initiation of tasks would not fully achieve the anticipated outcomes immediately. We are encouraged that FDA plans to continue its efforts to correct reported weaknesses, including the review of the interim database and making corrections as errors are identified so data transferred into the new system will be as accurate as possible. 4. FDA believes that our sample test, for which we found 1 error out of 46 items, indicates that the PMIS database has a 2 percent error rate, which is within FDA’s stated goal. However, based on the statistical sample methodology we used, 1 error out of 46 items tested actually indicates, with 90 percent confidence, a possible error rate of 0.23 to 8.19 percent. Also, this test result was considered in conjunction with the completeness test of 73 items in which we found 7 errors. These seven errors indicate a potential error rate of 5.42 to 15.68 percent, which is significantly higher than the 2 percent referred to by FDA. 5. This report has been revised to reflect FDA’s comment. Page 23 GAO/AIMD-99-51 FDA’s Controls Over Property Appendix II Major Contributors to This Report ApIenxdi Accounting and Chinero Thomas, Assistant Director HeidiKitt Winter, Audit Manager Information Rosa Ricks Harris, Audit Manager Management Division, Angela Samblanet, Auditor Wm. David Grindstaff, Senior Assistant Director Washington, D.C. Maria Zacharias, Communication Analyst (916256) Page 24 GAO/AIMD-99-51 FDA’s Controls Over Property Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary, VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Orders by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send an e-mail message with “info” in the body to: email@example.com or visit GAO’s World Wide Web Home Page at: http://www.gao.gov United States Bulk Rate General Accounting Office Postage & Fees Paid Washington, D.C. 20548-0001 GAO Permit No. GI00 Official Business Penalty for Private Use $300 Address Correction Requested
Financial Management: FDA's Controls Over Property Have Improved, But Weaknesses Remain
Published by the Government Accountability Office on 1999-02-22.
Below is a raw (and likely hideous) rendition of the original report. (PDF)