PROTECTING THE PUBLIC: 

Bureau of the Public Debt’s Control 

Over Computers Needs To Be Improved 

OIG-02-116 September 11, 2002

Office of Inspector General

******* 

The Department of the Treasury 
Contents 

Audit Report....................................................................................................2 

 Results in Brief...............................................................................................3 

 Background ...................................................................................................4 

Finding and Recommendation ..........................................................................4 

BPD Lacked Independence in the Loss Review Process...................................4 

 Recommendation .......................................................................................6 

Appendices

 Appendix 1: Objectives, Scope, and Methodology ........................................8 

 Appendix 2: Management Response .........................................................10 

 Appendix 3: Major Contributors To This Report ..........................................11 

 Appendix 4: Report Distribution ................................................................12 

Abbreviations

BOS Board of Survey 

BPD Bureau of the Public Debt 

DAS Director, Administrative Services 

FY Fiscal Year

OIG Office of Inspector General 

BPD’s Control Over Computers Needs To Be Improved OIG-02-116 Page 1 
OIG Audit 

Report

The Department of the Treasury 

Office of Inspector General 

BPD’s Control Over Computers Needs To Be Improved OIG-02-116 Page 2 

September 11, 2002 

Van Zeck 

Commissioner 

Bureau of the Public Debt 

We conducted an audit of the Bureau of the Public Debt (BPD) 

controls over selected property items that, if lost or stolen, might 

compromise national security, the public’s safety, or ongoing 

investigations. Sensitive property at BPD included computers only. 

Based on our audit, we judged that the risk that these property 

items could be lost or stolen was moderate. BPD had written 

guidance, directives, and procedures for managing and 

safeguarding computers. BPD required reporting, administrative 

review, and a determination of liability for all lost or stolen items. 

However, we noted that BPD’s annual physical inventory of 

computers did not provide evidence of an independent review of 

computer losses in the two most recent fiscal years. Therefore, 

the loss review process provided inadequate internal control 

against loss or theft.

We conducted this audit at the request of Senator Charles E. 

Grassley, member of the Senate Committee on Finance. 

Our specific objectives were to answer the following questions: 

1. Are Treasury’s inventory regulations sufficient to prevent loss 

or theft of its inventory? 

2. Which Treasury bureaus are most susceptible to inventory loss 

or theft and why? 

3. Have any Treasury inventory items been identified as lost or 

stolen within the last 3 fiscal years? 

4. Does Treasury have a sufficient plan to recoup inventory that 

cannot be located? 
The audit fieldwork was performed from January to August 2002. 

We interviewed BPD officials and evaluated records and 

procedures. The scope of the review covered FY 1999 to 

FY 2001. See Appendix 1 for a more detailed description of the 

audit objectives, scope, and methodology. 

Results in Brief

BPD reported 33 computers lost or stolen during fiscal years 

(FY) 1999 through 2001, having a total acquisition cost of 

$85,541. One computer was subsequently recovered. The total 

book value of the remaining computers was $1,251. No employee 

was disciplined or held financially responsible for these losses. Our 

assessment of the risk that computers could be lost or stolen was 

moderate ( ).1

 BPD had written guidance, directives, and 

procedures for managing and safeguarding computers. It also 

required reporting, administrative review, and a determination of 

liability for all lost or stolen computers. BPD conducted annual 

physical inventories of its property, however, there was no 

evidence of independent review of computer losses the last two 

fiscal years. Therefore, the loss review process provided 

inadequate internal control against loss or theft. 

We made one recommendation in the draft report recommending 

that the Commissioner ensure the Director of Administrative 

Services makes the recommendation on whether or not to convene 

a Board of Survey to the Executive Director and the decision 

discussed and documented at the Executive Board. 

BPD concurred with the finding and recommendation. As a result, 

BPD has implemented revised procedures to ensure that the results 

of its annual property inventory are discussed with senior Public

Debt officials and that a conscious decision be made each year as 

to whether a Board of Survey be convened. 

 

BPD’s Control Over Computers Needs To Be Improved OIG-02-116 Page 3 

1 Office of Inspector General (OIG) judgment ( Low Moderate High)
Background 

BPD regulates the primary and secondary Treasury securities 

markets; ensures that reliable systems and processes are in place 

for purchasing and transferring Treasury securities; annually 

auctions and issues $2 trillion of marketable securities; issues and 

redeems more than 100 million savings bonds each year; maintains 

more than $400 billion in securities accounts directly for investors; 

and provides timely and accurate information on the public debt. 

While most BPD employees are in two locations - Parkersburg, 

West Virginia and Washington, D.C.- the bureau also has marketing 

personnel located in field offices throughout the country. 

Finding And Recommendation 

BPD Lacked Independence in the Loss Review Process

 

For FY 2001, BPD reported that it had 3,358 computers (2,963 

desktops, 378 laptops, and 17 handheld). It also reported that 

33 computers (24 desktops, 8 laptops, 1 handheld) had been lost 

or stolen during the audited period. One computer was 

subsequently recovered. The total depreciated value of the 

remaining computers was $1,251. No employees were found 

financially liable for the missing computers. We judged the risk of 

loss or theft of computers to be moderate. BPD had written 

policies that addressed the proper management and safekeeping of

computers. This factor reduced the risk of loss or theft. However, 

BPD had no independence in the loss review process. This factor 

increased the risk of loss or theft. In addition, BPD had controls 

that limited access to computer files and BPD’s computer network. 

These controls decreased the risk that sensitive data would be 

compromised, even if a computer were lost or stolen. 

During the course of conducting our audit work, and as a result of 

an internal management control review, BPD issued revised 

operating procedures for expendable and non-expendable property, 

which included detailed steps on reporting missing items to each 

Assistant Commissioner. Also, the Director of Administrative 

Services (DAS) recommendation to convene a Board of Survey 

(BOS) to investigate missing items will be sent to the Executive 

BPD’s Control Over Computers Needs To Be Improved OIG-02-116 Page 4 
Director and the decision will be discussed at the Executive Board. 

These actions, if followed in the future, reduce the risk of future 

losses to a low level. 

Written policies

BPD had written policies that provided guidance on the control and 

management of computers. These policies included conducting 

physical inventories; reporting lost or stolen items; determining 

employee accountability; obtaining computers from departing 

employees; and disposing of excess computers. 

Physical inventories

BPD conducted and documented annual physical inventories of all 

computers. Items were scanned into the automated tracking 

system using a scanner. Discrepancies found during the scanning 

process were reported to the appropriate offices for investigation. 

We reviewed recent physical inventory reports and observed that 

any reported discrepancies were followed up and resolved between 

the offices and BPD headquarters property management personnel. 

Data security

BPD had sensitive but unclassified information.2 Accessing a 

computer or BPD network required access rights and a related 

password. All users of BPD information technology resources had 

to receive security training applicable to their assigned duties with 

annual refresher courses. BPD used a computer program, 

CLEARDRV, to purge and over-write all data on computers that 

were to be disposed of or transferred to a third-party. 

These controls over data security decreased the risk that sensitive 

information would be compromised, even if a computer was lost or 

stolen. 

 

BPD’s Control Over Computers Needs To Be Improved OIG-02-116 Page 5 

2 BPD defined sensitive but unclassified information as information that the loss, misuse, or unauthorized 

access to or modification of could adversely affect the national interest, the conduct of Federal 

programs, or the privacy to which individuals are entitled under the Privacy Act. 
Reporting, investigating, and recouping lost or stolen computers 

BPD employees were required to immediately report lost, stolen, or 

damaged computers assigned to them. During the audited period, 

33 computers were reported lost or stolen. One computer was 

subsequently recovered. The total book value of the remaining 

computers was $1,251. No employee was disciplined or held 

financially responsible for any of the lost or stolen computers. 

We reviewed a sample of five computer losses (the highest valued 

computer, one additional desktop and one laptop from FY 2001, 

and two laptops from FY 2000). BPD was unable to provide detail 

on the losses. It believed these computers were donated to area 

schools, but they were unable to provide any documentation to 

support this assertion. While a BOS was convened in FY 1999, no 

BOS was convened to investigate losses from FY 2000 and FY 

2001. BDP policy did not mandate that a BOS be formed in the 

event of a loss. 

BPD implemented new reporting procedures during the course of 

our conducting audit fieldwork. These new procedures require that 

the DAS make his recommendation to the Executive Director, if a 

BOS should be conducted and the decision discussed at the 

Executive Board. 

Recommendation

We recommend that the Commissioner ensure that: 

1. The Director of Administrative Services makes the 

recommendation on whether or not to convene a Board of 

Survey to the Executive Director and the decision discussed and 

documented at the Executive Board. 

Management Comments

BPD agreed with the finding and recommendation. As a result, 

BPD has implemented revised procedures to ensure that the results 

of its annual property inventory are discussed with senior Public

Debt officials and that a conscious decision be made each year as 

to whether a Board of Survey be convened. 

BPD’s Control Over Computers Needs To Be Improved OIG-02-116 Page 6 
OIG Comments

We consider this recommendation to have a management decision 

with a final action completed. 

 ******* 

We appreciate the cooperation we received from BPD officials 

during this audit. If you wish to discuss this report, you may 

contact me at (312) 886-6300, ext. 118. 

 /s/

Roberta N. Rickey 

Regional Inspector General for Audit 

BPD’s Control Over Computers Needs To Be Improved OIG-02-116 Page 7 
Appendix 1 

Objectives, Scope and Methodology 

The overall objective of this audit was to address concerns Senator 

Charles E. Grassley, member of the Senate Committee on Finance, 

raised regarding Treasury-wide inventory practices for items that if 

lost or stolen, might compromise the public’s safety, national 

security, or ongoing investigations. Our specific objectives were to 

answer the following questions: 

(1) Are the bureau’s policies and practices sufficient to prevent loss 

and theft? 

(2) What items have been lost or stolen during FY 99 – 01? 

(3) Does the bureau have a sufficient plan to recoup lost items? 

(4) What improvements can be made to prevent future losses? 

At the BPD, we considered computers to be a sensitive property 

item. Our audit scope covered FY 1999, 2000, and 2001 (from 

October 1, 1998 through September 30, 2001). To accomplish 

our objectives, we requested data on inventory levels at or near the 

end of FY 20013

 and computers reported lost/stolen during FY 

1999 – FY 2001; reviewed pertinent laws and regulations; 

reviewed written bureau policies; reviewed the latest physical

inventory reports; and reviewed reports/ investigations related to 

lost/stolen computers. 

To assess the risk of loss or theft of sensitive items, we examined 

elements related to six factors: Policies, Physical Controls, 

Inventory Records, Physical Counts, Quantity, and Threat. 

Policies - establish management guidelines and standards. 

Physical Controls - limit access. 

Property Records - identify accountability. 

Physical Counts - assure reliability of records. 

Quantity - impacts the opportunity for loss or theft. 

Threat - includes ease of loss and harm of unauthorized use. 

Having weighed these factors and the resulting overall control 

environment, we assigned a risk factor of low ( ), moderate ( ), 

or high ( ). 

 

3

 The date of the reported inventory levels for the computers was from August 2001. 

BPD’s Control Over Computers Needs To Be Improved OIG-02-116 Page 8 
Appendix 1 

Objectives, Scope and Methodology 

We conducted our audit between January and August 2002 in

accordance with generally accepted government auditing 

standards. 

BPD’s Control Over Computers Needs To Be Improved OIG-02-116 Page 9 
Appendix 2 

Management Response 

BPD’s Control Over Computers Needs To Be Improved OIG-02-116 Page 10 
Appendix 3 

Major Contributors To This Report

Central Region

Roberta N. Rickey, Regional Inspector General 

Charles Allberry, Audit Manager 

Bradley Mosher, Audit Manager 

Claire Schmidt, Auditor

BPD’s Control Over Computers Needs To Be Improved OIG-02-116 Page 11 
Appendix 4 

Report Distribution 

Department of the Treasury

Office of the Under Secretary of the Treasury for Enforcement 

Office of the Assistant Secretary of the Treasury for 

Management/Chief Financial Officer 

Office of Strategic Planning and Evaluations 

 Management Control Branch 

Office of Accounting & Internal Control 

Office of Organizational Improvement 

Bureau of the Public Debt

Commissioner 

Executive Director, Administrative Resource Center 

Manager, Program Review Branch

Office of Management and Budget

OMB Budget Examiner 

BPD’s Control Over Computers Needs To Be Improved OIG-02-116 Page 12