PROTECTING THE PUBLIC: 

Financial Management Service’s Control 

Over Computers Needs To Be Improved 

OIG-02-119 September 11, 2002

Office of Inspector General

******* 

The Department of the Treasury 
Contents 

Audit Report....................................................................................................2 

 Results in Brief...............................................................................................3 

 Background ...................................................................................................3 

Finding and Recommendation ..........................................................................4 

FMS Lacked Evidence of Independent Physical Inventories..............................4 

 Recommendation .......................................................................................6 

Appendices

 Appendix 1: Objectives, Scope, and Methodology ........................................7 

 Appendix 2: Management Response ...........................................................9 

 Appendix 3: Major Contributors To This Report ..........................................11 

 Appendix 4: Report Distribution ................................................................12 

Abbreviations

FMS Financial Management Service 

FY Fiscal Year

GAO General Accounting Office 

OIG Office of Inspector General 

RFC Regional Finance Center 

 FMS’ Control Over Computers Needs To Be Improved (OIG Draft Report) Page 1
OIG Audit 

Report

The Department of the Treasury 

Office of Inspector General 

FMS’ Control Over Computers Needs To Be Improved OIG-02-119 Page 2 

September 11, 2002 

Richard L. Gregg 

Commissioner 

Financial Management Service 

We conducted an audit of the Financial Management Service (FMS) 

controls over selected property items that, if lost or stolen, might 

compromise national security, the public’s safety, or ongoing 

investigations. Sensitive property at FMS included computers only. 

Based on our audit, we judged that the risk that these property 

items could be lost or stolen was moderate. FMS had written 

guidance, directives, and procedures for managing and 

safeguarding computers. FMS required reporting, administrative 

review, and a determination of liability for all lost or stolen 

computers. However, we noted that FMS’ annual physical 

inventory of computers did not provide evidence of personnel 

independent of the custodial function participated. This provided 

inadequate internal control against loss or theft. 

We conducted this audit at the request of Senator Charles E. 

Grassley, member of the Senate Committee on Finance. 

Our specific objectives were to answer the following questions: 

1. Are Treasury’s inventory regulations sufficient to prevent loss 

or theft of its inventory? 

2. Which Treasury bureaus are most susceptible to inventory loss 

or theft and why? 

3. Have any Treasury inventory items been identified as lost or 

stolen within the last 3 fiscal years? 

4. Does Treasury have a sufficient plan to recoup inventory that 

cannot be located? 

The audit fieldwork was performed from February to August 2002. 

We interviewed FMS officials and evaluated records and 
procedures. The scope of the review covered FY 1999 to 

FY 2001. See Appendix 1 for a more detailed description of the 

audit objectives, scope, and methodology. 

Results in Brief

FMS reported one computer lost or stolen during fiscal years 

(FY) 1999 through 2001, having a value of $2,300. Our 

assessment of the risk that computers could be lost or stolen was 

moderate ( ).1

 FMS had written guidance, directives, and 

procedures for managing and safeguarding computers. It required 

reporting, administrative review, and a determination of liability for 

all lost or stolen computers. Although FMS generally conducted 

periodic physical inventories of its property, they were not 

independent of the custodial function. Property custodial personnel 

conducted physical inventories of the property over which they

were responsible. Therefore, the physical inventories provided 

inadequate internal control against loss or theft. 

We made one recommendation in the draft report recommending 

that the Commissioner ensure personnel independent of the 

custodial function conduct a complete annual physical inventory of 

computers.

FMS concurred with the recommendation. As a result, FMS will 

establish a schedule for conducting independent inventories of FMS 

computers in the headquarters facilities and Regional Financial 

Centers. 

Background 

FMS disburses more than $1.2 trillion for nearly 950 federal 

payments, like Social Security, veterans’ benefits and income tax 

refunds to more than 100 million people, collects more than 

$2 trillion in federal revenues; oversees a daily cash flow of 

$10 billion; provides centralized debt collection services to most

federal agencies; and provides government-wide accounting and 

 

FMS’ Control Over Computers Needs To Be Improved OIG-02-119 Page 3 

1 Office of Inspector General (OIG) judgment ( Low Moderate High)
reporting. FMS is comprised of about 2,100 employees, one-third 

of whom are located in four Regional Financial Centers (RFC) and 

one Debt Collection Center where electronic funds transfer and 

paper check payments are issued. The RFCs are located in: Austin, 

Texas; Kansas City, Missouri; Philadelphia, Pennsylvania; and San 

Francisco, California. 

Finding And Recommendation 

FMS Lacked Evidence of Independent Physical Inventories

 

For FY 2001, FMS reported that it had 4,156 computers (3,580 

desktops, 525 laptops, and 51 handheld). It also reported that one 

laptop computer, having a value of $2,300, had been lost or stolen 

during the audited period. A subsequent investigation did not find 

any employee financially liable for the missing computer. We 

judged the risk of loss or theft of computers to be moderate. FMS 

had written policies and procedures that addressed the proper 

management and safekeeping of computers. This factor reduced 

the risk of loss or theft. However, FMS had no evidence of 

independent physical inventories of all computers. This factor 

increased the risk of loss or theft. In addition, because there was 

no evidence of an independent physical inventory, there was no 

reasonable assurance that the information FMS reported was 

reliable. FMS did have controls that limited access to computer 

files and its computer network. Those controls decreased the risk 

that sensitive data would be compromised, if a computer were lost 

or stolen. 

Written policies

FMS had written policies that provided guidance on the control and 

management of computers. These policies included conducting 

physical inventories; reporting lost or stolen items; determining 

employee accountability; obtaining computers from departing 

employees; and disposing of excess computers. 

FMS’ Control Over Computers Needs To Be Improved OIG-02-119 Page 4 
Physical inventories

FMS conducted and documented annual physical inventories of all 

computers. However, these inventories did not meet accepted 

internal control standards because they did not involve personnel 

independent of the property custodial function. Therefore, the 

results of these physical inventories are subject to question. The 

General Accounting Office’s (GAO) Standards for Internal Control 

in the Federal Government stated, “Key duties and responsibilities 

need to be divided or segregated among different people to reduce 

the risk of error or fraud.”2

 In a recent study, GAO stated, “the 

strongest control employed by leading-edge locations was to 

exclude those with asset custody from the counting activity.”3

Data security

FMS had sensitive and limited official use information.4

 Accessing 

a computer or the FMS network required unique access rights and 

a related password. All users of FMS information technology 

resources had to receive security training at least annually. FMS 

procedures required that hard drives of computers that were to be 

disposed of or transferred to a third-party be cleaned of 

information. 

These controls over data security decreased the risk that sensitive 

information would be compromised, even if a computer was lost or 

stolen. 

Reporting, investigating, and recouping lost or stolen computers 

FMS employees were required to immediately report lost, stolen, or 

damaged computers. During the audited period, one laptop 

computer was reported lost or stolen. The value of this computer 

 

2 Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1), November 1999. 3 Executive Guide: Best Practices in Achieving Consistent, Accurate Physical Counts of Inventory and 

Related Property (GAO-02-447G), March 2002. 

FMS’ Control Over Computers Needs To Be Improved OIG-02-119 Page 5 

4 FMS defined sensitive information as data that supports high level (e.g., Congressional, Federal 

Agency) decision processes, is critical to federal programs, and/or its corruption will have a serious 

impact on operations. It also includes data covered by the Privacy Act or is exempted from disclosure

under the Freedom of Information Act. 
was $2,300. It was stolen from an office/cubicle. The loss was 

reported to the Federal Protective Service for investigation. No one 

was held accountable for this loss. 

Recommendation

We recommend that the Commissioner ensure that: 

1. Personnel independent of the custodial function complete the 

physical inventory of computers.

Management Comments

FMS concurred with the recommendation; however, management 

disputed the control environment risk factor of moderate. FMS will 

establish a schedule for conducting independent inventories of FMS 

computers in the headquarters facilities and Regional Financial 

Centers. 

OIG Comments

We consider this recommendation to have a management decision 

with a target completion date of September 30, 2002. 

 ******* 

We appreciate the cooperation we received from FMS officials 

during this audit. If you wish to discuss this report, you may 

contact me at (312) 886-6300, ext. 118. 

 /s/

Roberta N. Rickey 

Regional Inspector General for Audit 

FMS’ Control Over Computers Needs To Be Improved OIG-02-119 Page 6 
Appendix 1 

Objectives, Scope and Methodology 

The overall objective of this audit was to address concerns Senator 

Charles E. Grassley, member of the Senate Committee on Finance, 

raised regarding Treasury-wide inventory practices for items that if 

lost or stolen, might compromise the public’s safety, national 

security, or ongoing investigations. Our specific objectives were to 

answer the following questions: 

(1) Are the bureau’s policies and practices sufficient to prevent loss 

and theft? 

(2) What items have been lost or stolen during FY 99 – 01? 

(3) Does the bureau have a sufficient plan to recoup lost items? 

(4) What improvements can be made to prevent future losses? 

At FMS, we considered computers to be a sensitive property item. 

Our audit scope covered FY 1999, 2000, and 2001 (from October 

1, 1998 through September 30, 2001). To accomplish our 

objectives, we requested data on inventory levels at or near the 

end of FY 20015

 and computers reported lost/stolen during FY 

1999 – FY 2001; reviewed pertinent laws and regulations; 

reviewed written bureau policies; reviewed the latest physical 

inventory reports; and reviewed reports/ investigations related to 

lost/stolen computers. 

To assess the risk of loss or theft of sensitive items, we examined 

elements related to six factors: Policies, Physical Controls, 

Inventory Records, Physical Counts, Quantity, and Threat. 

Policies - establish management guidelines and standards. 

Physical Controls - limit access. 

Property Records - identify accountability. 

Physical Counts - assure reliability of records. 

Quantity - impacts the opportunity for loss or theft. 

Threat - includes ease of loss and harm of unauthorized use. 

Having weighed these factors and the resulting overall control 

environment, we assigned a risk factor of low ( ), moderate ( ), 

or high ( ). 

 

5 The date of the reported inventory levels for the computers was from August 2001. 

FMS’ Control Over Computers Needs To Be Improved OIG-02-119 Page 7 
Appendix 1 

Objectives, Scope and Methodology 

We conducted our audit between February and August 2002 in

accordance with generally accepted government auditing 

standards. 

FMS’ Control Over Computers Needs To Be Improved OIG-02-119 Page 8 
Appendix 2 

Management Response 

FMS’ Control Over Computers Needs To Be Improved OIG-02-119 Page 9 
Appendix 2 

Management Response 

FMS’ Control Over Computers Needs To Be Improved OIG-02-119 Page 10 
Appendix 3 

Major Contributors To This Report

Central Region

Roberta N. Rickey, Regional Inspector General 

Charles Allberry, Audit Manager 

Bradley Mosher, Audit Manager 

Claire Schmidt, Auditor

FMS’ Control Over Computers Needs To Be Improved OIG-02-119 Page 11 
Appendix 4 

Report Distribution 

Department of the Treasury

Office of the Under Secretary of the Treasury for Enforcement 

Office of the Assistant Secretary of the Treasury for 

Management/Chief Financial Officer 

Office of Strategic Planning and Evaluations 

 Management Control Branch 

Office of Accounting & Internal Control 

Office of Organizational Improvement 

Financial Management Service

Commissioner 

Manager, Management Control Branch 

Program Integrity Division

Office of Management and Budget

OMB Budget Examiner 

FMS’ Control Over Computers Needs To Be Improved OIG-02-119 Page 12