July 12, 2007 

MEMORANDUM TO: Luis A. Reyes 

Executive Director for Operations 

FROM: Stephen D. Dingbaum /RA/ 

Assistant Inspector General for Audits 

SUBJECT: AUDIT OF NRC’S NON-CAPITALIZED PROPERTY 

(OIG-07-A-14) 

Attached is the Office of the Inspector General’s (OIG) report titled, Audit of NRC’s NonCapitalized Property.

This report presents the results of the subject audit. Agency comments provided at the 

exit conference on June 26, 2007, have been incorporated, as appropriate, into this 

report. The agency did not provide formal comments. 

Please provide information on actions taken or planned on each of the 

recommendations within 30 days of the date of this memorandum. Actions taken or 

planned are subject to OIG follow up as stated in Management Directive 6.1. 

We appreciate the cooperation extended to us by members of your staff during the 

audit. If you have any questions or comments about our report, please contact me at 

415-5915, or Steven Zane at 415-5912. 

Attachment: As stated 

cc: V. Ordaz, OEDO 

 M. Malloy, OEDO 

 P. Tressler, OEDO
Electronic Distribution

Frank P. Gillespie, Executive Director, Advisory Committee on Reactor 

 Safeguards/Advisory Committee on Nuclear Waste 

E. Roy Hawkens, Chief Administrative Judge, Atomic Safety and 

 Licensing Board Panel 

Karen D. Cyr, General Counsel 

John F. Cordes, Jr., Director, Office of Commission Appellate Adjudication 

William M. McCabe, Chief Financial Officer 

Janice Dunn Lee, Director, Office of International Programs 

Rebecca L. Schmidt, Director, Office of Congressional Affairs 

Eliot B. Brenner, Director, Office of Public Affairs 

Annette Vietti-Cook, Secretary of the Commission 

Luis A. Reyes, Executive Director for Operations 

William F. Kane, Deputy Executive Director for Reactor 

 and Preparedness Programs, OEDO 

Martin J. Virgilio, Deputy Executive Director for Materials, Waste, Research, 

 State, Tribal, and Compliance Programs, OEDO 

Darren B. Ash, Deputy Executive Director for Information Services 

 and Chief Information Officer, OEDO 

Vonna L. Ordaz, Assistant for Operations, OEDO 

Timothy F. Hagan, Director, Office of Administration 

Cynthia A. Carpenter, Director, Office of Enforcement 

Charles L. Miller, Director, Office of Federal and State Materials 

 and Environmental Management Programs 

Guy P. Caputo, Director, Office of Investigations 

Edward T. Baker, Director, Office of Information Services 

James F. McDermott, Director, Office of Human Resources 

R. William Borchardt, Director, Office of New Reactors 

Michael F. Weber, Director, Office of Nuclear Material Safety and Safeguards 

James E. Dyer, Director, Office of Nuclear Reactor Regulation 

Brian W. Sheron, Director, Office of Nuclear Regulatory Research 

Corenthis B. Kelley, Director, Office of Small Business and Civil Rights 

Roy P. Zimmerman, Director, Office of Nuclear Security and Incident Response 

Samuel J. Collins, Regional Administrator, Region I 

William D. Travers, Regional Administrator, Region II 

James L. Caldwell, Regional Administrator, Region III 

Bruce S. Mallett, Regional Administrator, Region IV 

 
AUDIT REPORT 

Audit of NRC’s Non-Capitalized Property 

OIG-07-A-14 July 12, 2007 

All publicly available OIG reports (including this report) are accessible through 

NRC’s Web site at: 

http:/www.nrc.gov/reading-rm/doc-collections/insp-gen/ 
Audit of NRC’s Non-Capitalized Property 

i 

EXECUTIVE SUMMARY 

BACKGROUND

The Nuclear Regulatory Commission (NRC) has an established 

property management program to account for and control property.1 

Property management encompasses both capitalized2

 and noncapitalized3

 property. This report focuses on NRC’s program to 

account for and control non-capitalized property. As of June 2006, 

non-capitalized property was comprised of almost 16,000 pieces of 

equipment costing approximately $26 million. 

The Space Planning and Property Management Branch (Property 

Branch), Division of Facilities and Security, is currently responsible 

for developing and administering the agency's property 

management program, including the Space and Property 

Management System (SPMS). Since March 1999, NRC 

management has moved this responsibility to three different 

divisions. 

PURPOSE

This audit was conducted to determine whether NRC has 

established and implemented an effective system of management 

controls for maintaining accountability and control of noncapitalized property. 

RESULTS OF AUDIT

While NRC’s property management policies for non-capitalized 

property provide a framework to control and safeguard property, the 

program, as implemented, needs improvement to provide effective 

control. Specifically: 

 

1 Management Directive 13.1, Property Management, defines government personal property as any 

equipment, furniture, or supply items that are owned, leased, borrowed, donated, forfeited, or transferred 

from another Federal agency, purchased with NRC funds, or otherwise in the possession or control of the 

NRC. 

2 Management Directive 13.1 defines capitalized property as any NRC-purchased property with an initial 

acquisition cost of $50,000 or more. 

3

 Management Directive 13.1 defines non-capitalized property as NRC property with an initial acquisition 

cost of less than $50,000. 
Audit of NRC’s Non-Capitalized Property 

ii 

A. SPMS data is not accurate; 

B. Controls for Information Technology (IT) property that may 

contain personally identifiable information (PII) 4 are lacking; 

C. Physical security deficiencies exist; and 

D. The policy for notifying Office of the Inspector General (OIG) 

of missing property needs improvement. 

In light of NRC’s imminent growth in full-time equivalents (FTE), 

and anticipated office relocations, it is increasingly important that 

NRC maintain effective and efficient accounting and control over 

non-capitalized property. Therefore, now is an opportune time for 

NRC management to increase accountability for, and improve 

control of, the property management program. An effective and 

efficient property management program is essential to assure that 

staff have the property needed to carry out their duties and assure 

optimum utilization of staff time, property and fiscal resources. 

RECOMMENDATIONS

This report makes recommendations to the Executive Director for 

Operations to help NRC strengthen the effectiveness of 

management controls with respect to maintaining accountability 

and control of non-capitalized property. This report also 

recommends that the threshold for accountable non-sensitive 

property5

 be raised so that property custodians can focus on 

maintaining accurate and reliable property records for sensitive and 

more expensive items. 

AGENCY COMMENTS

At an exit conference held on June 26, 2007, agency managers 

generally agreed with the audit findings and recommendations and 

provided comments concerning the draft audit report. We modified 

the report in response to the comments, as we deemed 

appropriate. NRC reviewed these modifications and opted not to 

submit formal written comments for the final version of this report. 

 

4

 "Personally Identifiable Information (PII)" represents information about an individual that can be used to 

distinguish or trace a person’s identity (e.g., Social Security Number, Date and Place of Birth, Mother’s 

Maiden Name, etc.). 

5 MD 13.1 defines accountable property as any equipment, excluding furniture and supplies, that is complete 

in itself, is of a durable nature with an expected life of 2 years or more, does not ordinarily lose its identity or 

becomes a component of another article, and is not consumed in its useful life. Accountable property is 

classified either as “sensitive” or as “non-sensitive.” Footnote 9 defines sensitive property.
Audit of NRC’s Non-Capitalized Property 

iii 

ABBREVIATIONS AND ACRONYMS

 ADM Office of Administration 

 FTE Full-Time Equivalent 

 FY Fiscal Year 

 GAO Government Accountability Office 

 IT Information Technology 

 JFMIP Joint Financial Management Improvement 

 Program 

 MD Management Directive 

 NRC Nuclear Regulatory Commission 

 OIG Office of the Inspector General 

 OIS Office of Information Services 

 OMB Office of Management and Budget 

 PII Personally Identifiable Information 

 SPMS Space and Property Management System 

Property Branch Space Planning and Property Management 

Branch 
Audit of NRC’s Non-Capitalized Property 

iv 

[Page intentionally left blank.] 
Audit of NRC’s Non-Capitalized Property 

v 

TABLE OF CONTENTS 

EXECUTIVE SUMMARY..............................................................................i 

ABBREVIATIONS AND ACRONYMS ..........................................................iii 

I. BACKGROUND ...................................................................................1 

II. PURPOSE............................................................................................4 

III. FINDINGS............................................................................................5 

A. SPMS DATA IS NOT ACCURATE ............................................................5 

B. CONTROLS FOR INFORMATION TECHNOLOGY (IT) PROPERTY THAT MAY 

CONTAIN PERSONALLY IDENTIFIABLE INFORMATION (PII)

ARE LACKING.......................................................................................12 

 

C. PHYSICAL SECURITY DEFICIENCIES EXIST..............................................14 

D. THE POLICY FOR NOTIFYING OFFICE OF THE INSPECTOR GENERAL (OIG)

OF MISSING PROPERTY NEEDS IMPROVEMENT .......................................17 

IV. AGENCY COMMENTS ........................................................................19 

V. CONSOLIDATED LIST OF RECOMMENDATIONS ............................21 

 

 APPENDIX

A. SCOPE AND METHODOLOGY .....................................................23 
Audit of NRC’s Non-Capitalized Property 

vi 

[Page intentionally left blank.] 
Audit of NRC’s Non-Capitalized Property 

1 

I. BACKGROUND 

The NRC has an established property management program to 

account for and control property. Property management 

encompasses both capitalized and non-capitalized property. This 

report focuses on NRC’s program to account for and control noncapitalized property. The planned growth in NRC’s FTE’s,6

 coupled 

with anticipated office relocations, heightens the importance of 

having the right equipment, at the right place, with the right person, 

at the right time, to facilitate efficient and effective mission 

accomplishment. As of June 2006, non-capitalized property was 

comprised of almost 16,000 pieces of equipment costing 

approximately $26 million. 

Guidance

Certain rules and regulations are in place to ensure that Federal 

property is safeguarded, properly accounted for, and adequately 

controlled to reduce the potential for waste, fraud, and 

mismanagement. Below is a list of key guidance pertinent to 

NRC’s accounting and control of non-capitalized property: 

3⁄4 The Office of Management and Budget (OMB) Circular 

A-123, Revised, Management's Responsibility for Internal 

Control, 

3⁄4 The Joint Financial Management Improvement Program 

(JFMIP),7 Property Management Systems Requirements,

and 

3⁄4 NRC Management Directive 13.1, Property Management, 

revised January 14, 2002 (MD 13.1). 

 

6

 The agency plans to increase the number of FTEs by 228 over the FY 2007 level by the end of 

FY 2008. 7 JFMIP is a joint undertaking of OMB, the Government Accountability Office, the Department of the 

Treasury, and the Office of Personnel Management, to work in cooperation with each other and with other 

agencies to improve financial management practices throughout the government. 
Audit of NRC’s Non-Capitalized Property 

2 

Responsibility for Property Management

The Property Branch, Division of Facilities and Security, is currently 

responsible for developing and administering the agency's property 

management program, including the SPMS. Since March 1999, 

NRC management has moved this responsibility to three different 

divisions (see following chart). In addition to changing the reporting 

lines, the Property Branch has experienced a turnover of both the 

division director and the branch chief positions since 

December 2005. In FY 2006, the estimated total resources 

dedicated to administering NRC's property management program 

was approximately $923,000 and 5.25 FTEs.8

Responsibility for Property Management 

As of May 10, 2006, 71 property custodians and 36 alternate 

property custodians, located in individual NRC offices, assist the 

Property Branch with property management functions. After the 

Property Branch assigns property to their accounts, property 

custodians and their alternates manage and control those accounts 

by — 

3⁄4 Updating records, 

3⁄4 Recovering property assigned to separating employees, 

3⁄4 Assisting in locating missing property, 

 

8 This total does not include property custodian and alternate property custodian salaries and overhead 

expenses. 

Time from 3/15/1999 to Present

3/15/1999 6/30/2002 12/25/2005 Present 

Division of Contracts and

Property Management

(DCPM)

Division of Administrative

Services (DAS)

Division of

Facilities

and

Security

(DFS)
Audit of NRC’s Non-Capitalized Property 

3 

3⁄4 Conducting annual reviews of their property accounts, and 

3⁄4 Participating in official biennial inventories. 

Property System Replaced

In June 2005, SPMS replaced the Property and Supply System as 

the agency’s official property management system. MD 13.1 

requires that SPMS contain records for all sensitive equipment,9

regardless of cost, and accountable non-sensitive equipment10

having an acquisition cost of at least $500. Non-sensitive items 

with an acquisition cost of at least $500 and all sensitive items are 

assigned a unique blue tag number. Non-sensitive items with an 

acquisition cost below $500 are assigned a red tag and generally 

are not recorded in SPMS. The following chart illustrates the 

percent of items that are sensitive and non-sensitive. 

Inventories

MD 13.1 requires NRC to conduct physical inventories of property 

every two years. The Property Branch is required to reconcile all 

discrepancies for missing items with SPMS once an inventory is 

completed. The Property Branch reports the results to NRC senior 

 

9 MD 13.1, defines sensitive property as property that is desirable for personal use and can be easily 

removed from the premises (e.g., laptop computers, cell phones, etc.). 10 MD 13.1, defines accountable property as any equipment, excluding furniture and supplies, that is 

complete in itself, is of a durable nature with an expected life of 2 years or more, does not ordinarily lose its 

identity or becomes a component of another article, and is not consumed in its useful life. Accountable 

property is classified either as “sensitive” or as “non-sensitive.” 

NRC Non-capitalized Property Count 

by Sensitive vs. Non-sensitive*

(n=15,975)

Nonsensitive

74%

Sensitive

26%

As of 6/13/2006

*Excludes OIG and the 

 Technical Training Center
Audit of NRC’s Non-Capitalized Property 

4 

management after reconciliation. In addition, property custodians 

are required to conduct an annual review of their property accounts 

to certify that the SPMS records are accurate. 

II. PURPOSE 

This audit was conducted to determine whether NRC has 

established and implemented an effective system of management 

controls for maintaining accountability and control of noncapitalized property. 
Audit of NRC’s Non-Capitalized Property 

5 

III. FINDINGS 

While NRC’s property management policies for non-capitalized 

property provide a framework to control and safeguard property, the 

program, as implemented, needs improvement to provide effective 

control. Specifically: 

A. SPMS data is not accurate; 

B. Controls for IT property that may contain PII are lacking; 

C. Physical security deficiencies exist; and 

D. The policy for notifying OIG of missing property needs 

improvement. 

A rigorous effort by NRC senior management is needed to initiate 

and sustain improvements to the property management program. 

A. SPMS Data is Not Accurate 

Although the agency uses SPMS to maintain property records, 

SPMS data is not accurate. This condition exists primarily because 

the property management program lacks adequate accountability. 

Without accurate and reliable records for non-capitalized property, 

NRC is subject to loss of property and information, inefficient use of 

staff time, and potential unnecessary expense. 

Guidance

The Government Accountability Office (GAO) Standards for Internal 

Control in the Federal Government requires agencies to: (1) record 

transactions promptly and (2) periodically inventory property and 

compare results to property records. NRC guidance requires staff 

to maintain accurate personal property records. Additionally, 

JFMIP Property Management Systems Requirements call for the 

property management system to capture: 

 property identification number, 

 location, 

 current user, 

 identity of property custodian, and 

 accountable organization. 
Audit of NRC’s Non-Capitalized Property 

6 

SPMS Contains Inaccurate Data

Various tests of SPMS records performed by OIG during this audit 

revealed that SPMS contains inaccurate data. Specifically, 

location/sub-location information is inaccurate, SPMS contained 

errors on firearms location/sub-location and serial numbers, and 

SPMS shows property assigned to separated employees. 

a. SPMS Location/Sub-Location Information is Inaccurate

 

SPMS does not accurately reflect the location and sub-location11 for 

many non-capitalized property items. The results of OIG’s 

unannounced physical inventory of a statistical random sample of 

non-capitalized property at NRC Headquarters, Region III, and 

Region IV are summarized in the following table.12 

Error Rates

Percent of Errors 

The Percent of Errors 

Could be as Low as 

The Percent of Errors 

Could be as High as 

Headquarters 37.5% 31.58% 43.52% 

Region III 6.1% .3% 11.82% 

Region IV 17.1% 8.31% 25.97% 

Reference to the first line of the table reveals that there was a 

37.5 percent error rate for headquarters’ location/sub-location data 

in SPMS. We can project the sample results to all of headquarters 

and say, with 95 percent confidence, that the location/sub-location 

error rate could be as low as 31.58 percent and as high as 43.52 

percent. The table reflects the sample results and 95 percent 

confidence for Regions III and IV as well.13 The cumulative 

acquisition cost associated with the high-end of the projection is 

$7.42 million at headquarters, and over $8 million for all three 

locations. 

 

11 Sub-location means the room or cubicle designation within a building. 12 OIG requested that the agency perform follow-up effort to locate the items identified as missing, 

as a result of our unannounced physical inventory, and correct SPMS. 

13 Subsequent to OIG’s sample physical inventory, personnel from Regions III and IV located the missing 

property for OIG auditors. Reportedly, Region IV personnel updated SPMS location/sub-location information 

accordingly.
Audit of NRC’s Non-Capitalized Property 

7 

b. SPMS Contained Errors on Firearms Location/SubLocation and Serial Numbers

OIG found that SPMS contains inaccurate data for NRC firearms. 

During an unannounced physical verification to locate 48 Office of 

Investigations’ firearms,14 OIG found incorrect information recorded 

in SPMS. 

Specifically, of the 48 firearms, SPMS showed 17 firearms as being 

located at headquarters. Only 2 of these 17 firearms were actually 

located at headquarters. A third firearm located at headquarters 

was shown in SPMS as being located in Region I. Subsequently, 

based on information contained in Office of Investigations’ records, 

OIG accounted for the remaining 45 firearms. OIG auditors 

accounted for all 48 firearms included in our test. 

OIG also noted that the serial numbers for 13 of the 48 firearms 

contained typographic errors. Because of the highly sensitive 

nature of this property, the recording of accurate serial numbers for 

firearms is particularly important. 

c. SPMS Shows Property Assigned to Separated Employees

MD 13.1 requires that “...all Government-furnished property ... 

assigned to NRC employees be returned [to the property custodian] 

or accounted for at least 10 working days before separation, and all 

items must be returned before clearance from NRC.” MD 13.1 

also requires property custodians to reassign sensitive equipment 

before the Property Branch can approve separation clearance for 

an individual. 

OIG’s analysis of SPMS records revealed that, as of 

August 11, 2006, 39 (or 10.7 percent) of 366 employees who 

separated between January 1, 2005, and June 30, 2006, had a 

cumulative total of 106 items with a total acquisition cost of 

$110,188 still assigned to them. Of the 39 separated employees, 

six had sensitive property assigned, consisting of four laptop 

computers, four cell phones, and three cameras. One separated 

Office of Nuclear Security and Incident Response employee had 17 

items assigned to his name with a total acquisition cost of $34,710. 

In some cases, property remained assigned to separated 

employees for as long as 18 months beyond their effective date of 

separation from the agency. OIG requested that the agency 

perform follow-up effort to locate these items and correct SPMS. 

 

14 The 48 firearms were handguns, 16 manufactured by Smith & Wesson, 32 manufactured by Glock. 
Audit of NRC’s Non-Capitalized Property 

8 

Reasons for Inadequate Property Management

SPMS contains inaccurate property records because the property 

management program lacks adequate accountability and the 

threshold for accounting and controlling non-sensitive property is 

too low. 

Inadequate Accountability

OIG believes the following areas contribute to the lack of 

accountability: 

Reorganizations and Changes in Management

Frequent reorganizations and changes in management in the 

Property Branch do not create an effective control environment that 

fosters monitoring and continuous process improvements. 

Management continuity is critical to achieve focused and sustained 

program improvements. 

Senior Executives

Senior Executives’ performance plans and appraisals do not reflect 

accountability for property management. Accordingly, little 

attention and low priority are given to the property management 

function. 

Property Custodians

Property custodian duties and responsibilities are essential to 

maintaining an effective, efficient, and accurate property 

management program. However, property custodians’ elements 

and standards generally do not reflect property management duties 

and responsibilities,15 despite the fact that the Director, Office of 

Administration (ADM), issued a memorandum, dated 

September 25, 2001, requesting that position descriptions be 

updated appropriately. ADM reissued the memorandum on 

October 10, 2006. 

Performance Measures

NRC’s performance measures for property management evaluate 

performance after inventory reconciliation activities. Measuring the 

accuracy after reconciliation does not provide transparency 

 

15 OIG found that only 24 out of 69 property custodians’ elements and standards included property 

custodian duties as of August 2006. 
Audit of NRC’s Non-Capitalized Property 

9 

regarding the property custodians’ performance of maintaining 

accurate SPMS records. This does not enable effective monitoring 

of program performance, accuracy, or easy identification of 

program improvements. 

Property Custodian Training

Property custodians are not required to take formal periodic 

training. Instead, they are provided an SPMS Users Guide and 

advised to call the Property Branch, if needed. The Property 

Branch conducts training on a one-on-one basis upon request. The 

effective accounting and control of non-capitalized property relies 

heavily on the performance of property custodians, therefore, it is 

critical that property custodians receive formal periodic training. 

Reporting Threshold is Too Low

The threshold for recording accountable non-sensitive property in 

SPMS is $500. There are 4,485 non-sensitive items with an 

approximate acquisition cost of $2.2 million currently recorded in 

SPMS, with a value between $500 and $1,000. Property 

custodians’ recording and monitoring these inexpensive items takes 

time away from maintaining accurate and reliable property records 

for sensitive and more expensive items. OIG contacted other 

Federal agencies16 and learned that their threshold for recording 

accountable property in their respective property management 

systems ranged from $50 - $5,000. Raising NRC’s threshold for 

reporting accountable non-sensitive property in SPMS from $500 to 

$1,000 would reduce the number of items tracked in SPMS by 37 

percent (72 percent minus 35 percent) while still accounting for 84 

percent of the dollar value of property that is both non-capitalized 

and non-sensitive (see the following chart). 

 

16 Other Federal agencies contacted were the Small Business Administration, National Oceanic and 

Atmospheric Administration, and the Office of Personnel Management. 
Audit of NRC’s Non-Capitalized Property 

10 

Impact of Accountable Thresholds on SPMS17

100% 100%

72%

93%

35%

84%

26%

78%

21%

73%

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

% of Current

Current Database ≥ $500 ≥ $1000 ≥ $1500 ≥ $2000

# Items as % of Current

Acq $ as % of Current

Risk of Loss of Property and Information

Accurate and reliable information on the location and sub-location 

of property is essential for NRC to assure the optimum use of 

property and the efficient use of staff time. The high level of errors 

found in SPMS combined with property assigned to separated 

employees: 

3⁄4 Increases the risk of loss of property and information, 

3⁄4 Results in inefficient use of staff time, and 

3⁄4 May result in unnecessary expense. 

Recommendations

OIG recommends that the Executive Director for Operations: 

1. Incorporate responsibility for property management into the 

Senior Executive Service Performance Plan and Appraisal. 

2. Incorporate property management duties and responsibilities 

into all property custodian and alternate property custodian 

performance evaluations. 

3. Develop and implement performance measures to provide 

transparency of inventory results immediately after the 

physical inventory is taken. 

 

17 The number of items and acquisition costs taken from SPMS and used as the basis for the chart excludes 

capitalized property and sensitive property. 
Audit of NRC’s Non-Capitalized Property 

11 

4. Provide formal periodic mandatory property management 

training to property custodians and their alternates. 

5. Raise the threshold for recording non-sensitive property in 

SPMS to $1,000. 
Audit of NRC’s Non-Capitalized Property 

12 

B. Controls for Information Technology Property That May Contain 

Personally Identifiable Information Are Lacking 

Although, NRC has initiated improvements for protecting PII as 

required by OMB and NRC guidance,18 not all reports of potential 

releases of PII are reported to the Office of Information Services 

(OIS) as required. This condition exists because a control is 

lacking on NRC Form 395, “Report of Property for Survey,” to flag 

missing property capable of storing PII and requiring coordination 

with the OIS. Without this critical internal control, NRC is at risk of 

not detecting potential or actual releases of PII, and of not 

mitigating the damage caused by such releases. 

As of March 2006, NRC staff had not found 25 items capable of 

storing PII identified as missing during the FY 2005 biennial 

inventory. However, the staff filed no reports of potential releases 

of PII to OIS. OIG requested that the agency perform follow-up 

effort to locate these items. 

While the Agency has increased efforts to protect PII, these efforts 

do not include improving the process for reporting missing IT 

property that may contain PII. NRC Form 395 does not include a 

field to alert agency personnel about a possible release of PII due 

to missing IT devices such as laptops, personal digital assistants, 

and cell phones. Currently, Form 395 preparers are not required to 

report — 

3⁄4 Whether missing IT property contains/may contain PII, or 

3⁄4 Whether OIS has been alerted, as warranted. 

Additionally, in instances involving missing IT property, MD 13.1 

procedures for reporting the loss or theft does not reference 

MD 12.5, NRC Automated Information Security Program, and does 

not include procedures for coordinating with the OIS. 

Without adequate controls for IT property that may contain PII, 

NRC is at risk of not detecting potential or actual releases of PII 

and of not mitigating the damage caused by such releases. 

 

18 OMB guidance dated June 23, 2006, memorandum (M-06-16), "Protection of Sensitive Agency 

Information," and Chairman Klein’s memorandum dated July 26, 2006, "Protection of Personal Privacy 

Information." NRC is required to ensure that any files or images that may contain PII are adequately 

protected from unauthorized access. 
Audit of NRC’s Non-Capitalized Property 

13 

Recommendations

OIG recommends that the Executive Director for Operations: 

6. Modify NRC Form 395 to include a field for reporting 

instances to OIS when missing NRC property contains or 

may contain personally identifiable information. 

7. Modify Management Directive 13.1, “Property Management,” 

to reference, where applicable, Management Directive 12.5, 

“NRC Automated Information Security Program,” to include 

procedures for coordinating with OIS regarding missing 

property that contains or may contain PII. 

8. Issue interim guidance to accomplish the intent of 

Recommendation 7, pending revision of Management 

Directive 13.1. 
Audit of NRC’s Non-Capitalized Property 

14 

C. Physical Security Deficiencies Exist 

Four rooms, containing equipment vital to the continuity of agency 

operations and valued in excess of $1 million, were found 

unsecured during OIG’s unannounced sample inventory at NRC's 

Headquarters. GAO guidance19 requires that vulnerable assets 

must be safeguarded to prevent loss or unauthorized use. 

Unsecured rooms, caused by lack of due care exercised by 

employees/contractors, could lead to: 

• Interruptions to agency operations, 

• Loss of property and/or PII, and

• Unnecessary expense.

Physical Security Guidance

MD 12.5, NRC Automated Information Security 

Program, requires controls be in place to protect 

NRC buildings, facilities, and related supporting 

infrastructures that house essential resources, such 

as data centers, server rooms, rooms that contain 

telecommunications equipment and wiring closets. 

For instance, as shown in the photograph, certain 

rooms containing servers and/or 

telecommunications equipment have multiple locks. 

These controls protect against potential threats to 

the physical environment and are intended to help prevent: 

• interruptions in computer services, 

• physical damage, 

• unauthorized disclosure of information, 

• loss of control over system integrity, and 

• theft. 

In addition, the directive provides guidance on protection against 

insider threats posed by disgruntled employees or contractors who 

may attempt to: 

• intentionally disrupt computer operations, 

 

19 GAO Standards for Internal Control in the Federal Government, November 1999. 
Audit of NRC’s Non-Capitalized Property 

15 

• gain unauthorized access to network resources or services, 

or 

• perform other related unauthorized activities. 

Physical Security Observations

During this audit, OIG found four rooms at headquarters with 

computer and telecommunication equipment unsecured. Many of 

these items are capable of storing PII. The initial acquisition cost of 

the 144 items reported in SPMS as being located in the four rooms 

was in excess of $1 million. 

One of the four rooms found unsecured 

is labeled, "Authorized Personnel Only," 

and is protected by a card reader, 

keypad, and door lock (see photo). 

During the physical verification of 

property, OIG auditors gained entry to 

this room through an unlocked door 

(i.e., no card or key code was needed) 

and the room was unattended. A 

system query by OIG found that this 

room contained 40 items (primarily high 

value computer equipment) with an 

acquisition cost of $519,168. 

Another unsecured room contained system units and 

telecommunications equipment. The room was protected by a 

push button deadbolt lock and two keyed locks; however, OIG 

auditors found the door propped open. A system query found that 

this room contained 17 items with an initial acquisition cost of 

$116,198. 

Additionally, as shown in the 

photograph, auditors were able to 

enter another unsecured and 

unattended room containing 

system units and other computer 

equipment. The room was not 

protected by a card reader and the 

door lock was broken. A system 

query revealed that this room 

contained 63 items with an initial 

acquisition cost of $367,935. 

SPMS listed 2 of the 63 items as 

laptop computers. 
Audit of NRC’s Non-Capitalized Property 

16 

Additionally, three headquarters telephone equipment closets were 

identified as unsecured and unattended in a prior OIG audit report, 

OIG-05-A-13, Audit of NRC’s Telecommunications Program, dated 

June 7, 2005. 

Based on these observations, OIG concludes that employees 

and/or contractors did not exercise due care. 

Impact on Agency Operations

IT equipment left unattended and unsecured is more likely to be 

lost or stolen risking a potential information security breach. In 

recent months, media reports of laptop computer thefts from 

various Federal agencies has raised the public’s sensitivity to risks 

associated with the loss of PII. Without due care by employees and 

contractors to assure that rooms containing IT equipment are 

appropriately secured, NRC risks a possible release or theft of PII 

pertaining to employees, licensees, or other stakeholders. A 

release or theft of PII could result in significant damage to an 

individual’s identity and could compromise the public’s confidence 

in the agency. 

Unauthorized access to agency computer or telecommunication 

systems could lead to potential interruptions of agency operations 

due to intentional or accidental damage. Unsecured rooms leave 

NRC vulnerable to intentional damage (i.e. cutting of cables, 

breaking components, etc.) by a disgruntled employee or contractor 

or accidental damage by someone that may mistake the space to 

be a storage area. 

Recommendations

OIG recommends that the Executive Director for Operations: 

9. Reemphasize the importance of physical security to both 

employees and contractors using means such as yellow 

announcements or posters. 

10. Periodically survey NRC buildings to ensure that physical 

security measures (i.e. locks, latches, door closers, badge 

readers, etc.) are functioning as intended for rooms containing 

mission critical equipment. 
Audit of NRC’s Non-Capitalized Property 

17 

D. Policy for Notifying OIG of Missing Property Needs Improvement 

Although MD 13.1 requires OIG notification for incidents involving 

suspected theft of NRC property, in OIG’s opinion, the emphasis on 

“suspected” theft has caused staff to frequently characterize 

missing property as simple loss rather than theft. While it is 

commonly understood that the timeliness of reporting missing 

property has a direct correlation to the likelihood of recovering it, 

OIG received few security incident reports regarding missing noncapitalized property in recent years. Unless OIG is notified of 

incidents of missing accountable property, the opportunity for OIG 

and other law enforcement officials to assist the agency with 

recovering property may be missed and potential wrongdoing may 

go undetected. 

During FYs 2005 and 2006, agency staff filed approximately 130 

NRC Form 395s for missing property. However, during this same 

two-year period, staff filed only two security incident reports for 

suspected theft of NRC property, resulting in OIG notification. 

Since the prevailing attitude for missing property emphasizes loss 

rather than suspected theft, OIG may not have received all reports 

of missing property that warrant investigation. Unless NRC notifies 

the OIG Assistant Inspector General for Investigations of all 

instances requiring Form 395s in a timely manner — 

3⁄4 Cases that may warrant OIG investigation may go 

undetected, and 

3⁄4 The agency compromises the likelihood of recovering 

missing property. 

Recommendations

OIG recommends that the Executive Director for Operations: 

11. Collaborate with OIG to modify NRC Management Directive 

13.1, “Property Management,” to develop a process for 

notifying the OIG Assistant Inspector General for 

Investigations of all reports (i.e., Form 395s) of missing 

sensitive property (regardless of value) and missing nonsensitive property with a current value of at least $1,000. 

12. Issue interim guidance to accomplish the intent of 

Recommendation 11, pending revision of Management 

Directive 13.1. 
Audit of NRC’s Non-Capitalized Property 

18 

Summary

Although it is NRC’s policy “to manage and use property and 

supplies in its possession or its contractors’ possession effectively 

and efficiently and to provide sufficient controls to deter or eliminate 

loss through fraud, waste, or misuse”; the program, as 

implemented, needs improvement. NRC’s property management 

program lacks adequate controls to assure that— 

3⁄4 SPMS records are accurate, 

3⁄4 Staff alert OIS when IT equipment capable of storing PII is 

missing, 

3⁄4 Employees and contractors exercise due care to physically 

secure rooms containing expensive equipment important to 

the continuity of NRC operations, and 

3⁄4 OIG Assistant Inspector General for Investigations is 

appropriately notified of missing property. 

In light of NRC’s imminent growth in FTEs, and anticipated office 

relocations, it is increasingly important that NRC maintain effective 

and efficient accounting and control over non-capitalized property. 

Therefore, now is an opportune time for NRC management to 

increase accountability for, and improve control of, the property 

management program. An effective and efficient property 

management program is essential to assure that staff have the 

property needed to carry out their duties and assure optimum 

utilization of staff time, property and fiscal resources. 
Audit of NRC’s Non-Capitalized Property 

19 

IV. AGENCY COMMENTS 

At an exit conference held on June 26, 2007, agency managers 

generally agreed with the audit findings and recommendations and 

provided comments concerning the draft audit report. We modified 

the report in response to the comments, as we deemed 

appropriate. NRC reviewed these modifications and opted not to 

submit formal written comments for the final version of this report. 
Audit of NRC’s Non-Capitalized Property 

20 

[Page intentionally left blank.] 
Audit of NRC’s Non-Capitalized Property 

21 

V. CONSOLIDATED LIST OF RECOMMENDATIONS 

OIG recommends that the Executive Director for Operations: 

1. Incorporate responsibility for property management into the 

Senior Executive Service Performance Plan and Appraisal. 

2. Incorporate property management duties and responsibilities 

into all property custodian and alternate property custodian 

performance evaluations. 

3. Develop and implement performance measures to provide 

transparency of inventory results immediately after the physical 

inventory is taken. 

4. Provide formal periodic mandatory property management 

training to property custodians and their alternates. 

5. Raise the threshold for recording non-sensitive property in 

SPMS to $1,000. 

6. Modify NRC Form 395 to include a field for reporting instances 

to OIS when missing NRC property contains or may contain 

personally identifiable information. 

7. Modify Management Directive 13.1, “Property Management,” to 

reference, where applicable, Management Directive 12.5, “NRC 

Automated Information Security Program,” to include 

procedures for coordinating with OIS regarding missing property 

that contains or may contain PII. 

8. Issue interim guidance to accomplish the intent of 

Recommendation 7, pending revision of Management 

Directive 13.1. 

9. Reemphasize the importance of physical security to both 

employees and contractors using means such as yellow 

announcements or posters. 

10. Periodically survey NRC buildings to ensure that physical 

security measures (i.e. locks, latches, door closers, badge 

readers, etc.) are functioning as intended for rooms containing 

mission critical equipment. 
Audit of NRC’s Non-Capitalized Property 

22 

11. Collaborate with OIG to modify NRC Management Directive 

13.1, “Property Management,” to develop a process for notifying 

the OIG Assistant Inspector General for Investigations of all 

reports (i.e., Form 395s) of missing sensitive property 

(regardless of value) and missing non-sensitive property with a 

current value of at least $1,000. 

 

12. Issue interim guidance to accomplish the intent of 

Recommendation 11, pending revision of Management 

Directive 13.1. 
Audit of NRC’s Non-Capitalized Property 

23 

Appendix A 

SCOPE AND METHODOLOGY 

To accomplish the audit objective, OIG identified and analyzed 

pertinent laws, regulations, authoritative guidance, NRC policies 

and procedures, and prior relevant NRC OIG reports. OIG also 

obtained and analyzed information from three other Federal 

agencies20 related to their property program best practices. 

Working with NRC’s statistician, OIG designed and implemented a 

statistical sample to test the accuracy of location/sub-location 

information of property records in SPMS for headquarters, Region 

III and Region IV. The results of the sample were projected to the 

universe of each of the three locations, with a 95 percent 

confidence level. 

In addition, OIG reviewed the Office of Administration’s property 

program metrics and performed various tests of internal controls 

associated with non-capitalized property recorded in SPMS. 

OIG also conducted interviews with selected headquarters and 

regional officials to: 

3⁄4 Gain an understanding of NRC’s property management 

operations; 

3⁄4 Determine current issues, problems, or known deficiencies; 

and 

3⁄4 Assess internal controls. 

This audit did not include a review of property assigned to OIG,21

NRC’s Technical Training Center,22 NRC’s Warehouse,23 or 

Department of Energy Laboratories.24 OIG conducted this audit in 

accordance with Generally Accepted Government Auditing 

Standards from May 2006 through March 2007. 

 

20 OIG obtained and analyzed information from the Office of Personnel Management, the National Oceanic 

and Atmospheric Administration, and the Small Business Administration. 

21 Property assigned to OIG was removed from the scope because the OIG cannot audit itself. 22 Property management at NRC’s Technical Training Center was excluded from the scope of this audit 

because it was included in the 2007 Audit of NRC’s Technical Training Center.

23 Property management at NRC’s Warehouse was excluded from this audit because OIG plans to conduct 

an audit on the Warehouse in the future. 

24 Oversight of property purchased with NRC funds by Department of Energy Laboratories was excluded 

from this audit because OIG plans to perform an audit of the placement and monitoring of work at DOE 

Laboratories that will include property management. 
Audit of NRC’s Non-Capitalized Property 

24 

The major contributors to this report were Steven Zane, Team 

Leader; Debra Lipkey, Audit Manager; Kathleen Stetson, Audit 

Manager; Michael Steinberg, Senior Auditor; Terri Cooper, Senior 

Auditor; Robert Woodward, Auditor and Christopher Lange, 

Management Analyst.