PROTECTING THE PUBLIC: 

Office of the Comptroller 

of the Currency’s Control Over 

Computers Needs To Be Improved 

OIG-02-118 September 11, 2002

Office of Inspector General

******* 

The Department of the Treasury 
Contents 

Audit Report....................................................................................................2 

 Results in Brief...............................................................................................3 

 Background ...................................................................................................3 

Finding and Recommendation ..........................................................................4 

OCC Lacked Evidence of Independent Physical Inventories..............................4 

 Recommendation .......................................................................................7 

Appendices

 Appendix 1: Objectives, Scope, and Methodology ........................................8 

 Appendix 2: Management Response .........................................................10 

 Appendix 3: Major Contributors To This Report ..........................................11 

 Appendix 4: Report Distribution ................................................................12 

Abbreviations

FY Fiscal Year

GAO General Accounting Office 

OIG Office of Inspector General 

OCC Office of the Comptroller of the Currency

OCC’s Control Over Computers Needs To Be Improved OIG-02-118 Page 1 
OIG Audit 

Report

The Department of the Treasury 

Office of Inspector General 

OCC’s Control Over Computers Needs To Be Improved OIG-02-118 Page 2 

September 11, 2002 

John D. Hawke, Jr. 

Comptroller of the Currency 

Office of the Comptroller of the Currency 

We conducted an audit of the Office of the Comptroller of the 

Currency (OCC) controls over selected property items that, if lost 

or stolen, might compromise national security, the public’s safety, 

or ongoing investigations. Sensitive property at OCC included 

computers only. Based on our audit, we judged that the risk that 

these property items could be lost or stolen was moderate. OCC 

had written guidance, directives, and procedures for managing and 

safeguarding computers. OCC required reporting, administrative 

review, and a determination of liability for all lost or stolen 

computers. However, we noted that OCC’s annual physical 

inventory of computers did not evidence personnel independent of 

the custodial function participated. This provided inadequate 

internal control against loss or theft. 

We conducted this audit at the request of Senator Charles E. 

Grassley, member of the Senate Committee on Finance. 

Our specific objectives were to answer the following questions: 

1. Are Treasury’s inventory regulations sufficient to prevent loss 

or theft of its inventory? 

2. Which Treasury bureaus are most susceptible to inventory loss 

or theft and why? 

3. Have any Treasury inventory items been identified as lost or 

stolen within the last 3 fiscal years? 

4. Does Treasury have a sufficient plan to recoup inventory that 

cannot be located? 

The audit fieldwork was performed from February to August 2002. 

We interviewed OCC officials and evaluated records and 
procedures. The scope of the review covered FY 1999 to 

FY 2001. See Appendix 1 for a more detailed description of the 

audit objectives, scope, and methodology. 

Results in Brief

OCC reported 39 computers lost or stolen during fiscal years 

(FY) 1999 through 2001, having a total acquisition cost of 

$108,610. Our assessment of the risk that computers could be 

lost or stolen was moderate ( ).1

 OCC had written guidance, 

directives, and procedures for managing and safeguarding 

computers. It also required reporting, administrative review, and a 

determination of liability for all lost or stolen computers. Although 

OCC generally conducted periodic physical inventories of its 

property, they were not independent of the custodial function. 

Property custodial personnel conducted physical inventories of the 

property over which they were responsible. Therefore, the physical 

inventories provided inadequate internal control against loss or 

theft. 

We made one recommendation in the draft report recommending 

that the Comptroller of the Currency ensure personnel independent 

of the custodial function conduct a complete annual physical 

inventory of computers. 

OCC concurred with the finding and recommendation. As a result, 

OCC will take the necessary steps to ensure that personnel 

independent of the custodial function conduct the annual 

inventory. 

Background 

OCC charters, regulates, and supervises all national banks. It also 

supervises the federal branches and agencies of foreign banks. 

Headquartered in Washington, DC, OCC has six district offices plus 

an office in London to supervise the international activities of 

national banks. OCC’s nationwide staff of examiners conducts on-

 

OCC’s Control Over Computers Needs To Be Improved OIG-02-118 Page 3 

1 The Office of Inspector General (OIG) judgment ( Low Moderate High)
site reviews of national banks and provides sustained supervision 

of bank operations. The agency issues rules, legal interpretations, 

and corporate decisions concerning banking, bank investments, 

bank community development activities, and other aspects of bank 

operations. 

Finding And Recommendation 

OCC Lacked Evidence of Independent Physical Inventories

 

For FY 2001, OCC reported that it had 4,801 computers (1,040 

desktops and 3,761 laptops). It also reported that 39 computers 

(1 desktop, 38 laptops), having a total acquisition cost of 

$108,610, had been lost or stolen during the audited period. We 

reviewed a sample of the supporting documentation for the 

subsequent investigation of these losses. OCC did not find 

employees financially liable for the missing computers. We judged 

the risk of loss or theft of computers to be moderate. OCC had 

written policies and procedures. This factor reduced the risk of

loss or theft. However, OCC had (1) a large number of computers 

dispersed throughout the country and (2) no evidence of 

independent physical inventories. These factors increased the risk 

of loss or theft. In addition, because there was no evidence of an 

independent physical inventory, there was no reasonable assurance 

that the information OCC reported was reliable. OCC did have 

controls that limited access to computer files and its computer 

network. Those controls decreased the risk that sensitive data 

would be compromised, if a computer were lost or stolen. 

Written policies

OCC had written policies that provided guidance on the control and 

management of computers. These policies included conducting 

physical inventories; reporting lost or stolen items; obtaining 

computers from departing employees; and disposing of excess 

property. 

OCC’s Control Over Computers Needs To Be Improved OIG-02-118 Page 4 
Quantity and geographic dispersion

OCC personnel were assigned computers to use in the performance 

of their duties. Examiners often used their computers in the field 

(off-site). A large number of computers dispersed over numerous 

geographic locations, many of which were carried in the field, 

increased the risk that some of those items would be lost or stolen. 

Since OCC’s mission made it impractical to reduce the number of 

computers or centralize their location, it was important that a 

strong control environment be in place. 

Physical inventories

OCC conducted and documented annual physical inventories of all 

computers. However, these inventories did not meet accepted 

internal control standards because they did not involve personnel 

independent of the property custodial function. Therefore, the 

results of these physical inventories are subject to question. The 

General Accounting Office’s (GAO) Standards for Internal Control 

in the Federal Government stated, “Key duties and responsibilities 

need to be divided or segregated among different people to reduce 

the risk of error or fraud.”2

 In a recent study, GAO stated, “the 

strongest control employed by leading-edge locations was to 

exclude those with asset custody from the counting activity.”3

Data security

OCC had sensitive but unclassified information.4

 Accessing a 

computer or OCC network required unique access rights and a 

related password. All users of OCC information technology 

resources had to receive security training with periodic refresher 

courses. OCC policy required periodic reviews at least every three 

years to check whether the controls established for a system were 

operating effectively. OCC procedures also required that hard

 

2 Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1), November 1999. 3 Executive Guide: Best Practices in Achieving Consistent, Accurate Physical Counts of Inventory and 

Related Property (GAO-02-447G), March 2002. 

OCC’s Control Over Computers Needs To Be Improved OIG-02-118 Page 5 

4 OCC defined sensitive but unclassified information as information that the loss, misuse, or

unauthorized access to or modification of could adversely affect the national interest, the conduct of 

Federal programs, or the privacy to which individuals are entitled under the Privacy Act. 
drives of retired computers must be downloaded and stored, and 

the hard disks must be wiped clean. 

These controls over data security decreased the risk that sensitive 

information would be compromised, even if a computer was lost or 

stolen. 

Reporting, investigating, and recouping lost or stolen computers 

OCC employees were required to immediately report lost or stolen 

computers assigned to them. During the audited period, one

desktop and thirty-eight laptop computers were reported lost or 

stolen. The total acquisition cost of these computers was 

$108,610. We reviewed a sample of ten stolen computers’ 

supporting documentation. Based on this information, the

circumstances associated with these cases are summarized below: 

Circumstance of Theft 

Number of 

Computers 

Stolen from OCC premises 3 

Stolen from client office (during regular 

business hours)

2 

Stolen from client office (after regular 

business hours)

1 

Stolen while being shipped 1 

Stolen by contract person 1 

Stolen from hotel room 1 

Stolen from personally owned vehicle 1 

Total 10

With two exceptions, the losses were reported to the OIG and/or 

local police departments for investigation. A contractor was 

investigating one of the two exceptions. OCC had no investigative 

information on the other exception. No one was held accountable 

for these losses. None of the computers were recovered, but OCC 

received reimbursement from the shipper for one of the losses. 

OCC’s Control Over Computers Needs To Be Improved OIG-02-118 Page 6 
Recommendation

We recommend that the Comptroller of the Currency ensure that: 

1. Personnel independent of the custodial function conduct a 

complete annual physical inventory of computers. 

Management Comments

OCC agreed with the finding and recommendations. As a result, 

beginning with the FY 2003 inventory, OCC will take the necessary 

steps to ensure that personnel independent of the custodial 

function conduct the annual inventory. 

OIG Comments

We consider this recommendation to have a management decision 

with a target completion date of September 30, 2003. 

******** 

We appreciate the cooperation we received from OCC officials 

during this audit. If you wish to discuss this report, you may 

contact me at (312) 886-6300, ext. 118. 

 /s/

Roberta N. Rickey 

Regional Inspector General for Audit 

OCC’s Control Over Computers Needs To Be Improved OIG-02-118 Page 7 
Appendix 1 

Objectives, Scope and Methodology 

The overall objective of this audit was to address concerns Senator 

Charles E. Grassley, member of the Senate Committee on Finance, 

raised regarding Treasury-wide inventory practices for items that if 

lost or stolen, might compromise the public’s safety, national 

security, or ongoing investigations. Our specific objectives were to 

answer the following questions: 

(1) Are the bureau’s policies and practices sufficient to prevent loss 

and theft? 

(2) What items have been lost or stolen during FY 99 – 01? 

(3) Does the bureau have a sufficient plan to recoup lost items? 

(4) What improvements can be made to prevent future losses? 

At OCC, we considered computers to be a sensitive property item. 

Our audit scope covered FY 1999, 2000, and 2001 (from October 

1, 1998 through September 30, 2001). To accomplish our 

objectives, we requested data on inventory levels at or near the 

end of FY 20015

 and computers reported lost/stolen during FY 

1999 – FY 2001; reviewed pertinent laws and regulations; 

reviewed written bureau policies; reviewed the latest physical

inventory reports; reviewed reports/ investigations related to 

lost/stolen computers; and interviewed officials. 

To assess the risk of loss or theft of sensitive items, we examined 

elements related to six factors: Policies, Physical Controls, 

Inventory Records, Physical Counts, Quantity, and Threat. 

Policies - establish management guidelines and standards. 

Physical Controls - limit access. 

Property Records - identify accountability. 

Physical Counts - assure reliability of records. 

Quantity - impacts the opportunity for loss or theft. 

Threat – includes ease of loss and harm of unauthorized use. 

Having weighed these factors and the resulting overall control 

environment, we assigned a risk factor of low ( ), moderate ( ), 

or high ( ). 

 

5

 The date of the reported inventory levels for the computers was from August 2001. 

OCC’s Control Over Computers Needs To Be Improved OIG-02-118 Page 8 
Appendix 1 

Objectives, Scope and Methodology 

We conducted our audit between February and August 2002 in

accordance with generally accepted government auditing 

standards. 

OCC’s Control Over Computers Needs To Be Improved OIG-02-118 Page 9 
Appendix 2 

Management Response 

OCC’s Control Over Computers Needs To Be Improved OIG-02-118 Page 10 
Appendix 3 

Major Contributors To This Report

Central Region

Roberta N. Rickey, Regional Inspector General 

Charles Allberry, Audit Manager 

Bradley Mosher, Audit Manager 

Claire Schmidt, Auditor

OCC’s Control Over Computers Needs To Be Improved OIG-02-118 Page 11 
Appendix 4 

Report Distribution 

Department of the Treasury

Office of the Under Secretary of the Treasury for Enforcement 

Office of the Assistant Secretary of the Treasury for 

Management/Chief Financial Officer 

Office of Strategic Planning and Evaluations 

 Management Control Branch 

Office of Accounting & Internal Control 

Office of Organizational Improvement 

Office of the Comptroller of the Currency

Comptroller of the Currency 

Senior Advisor, OIG/GAO, Liaison Program and Management

 Accountability Division 

Office of Management and Budget

OMB Budget Examiner 

OCC’s Control Over Computers Needs To Be Improved OIG-02-118 Page 12