SEC’s Controls Over Government 

Furnished Equipment and 

Contractor Acquired Property 

March 28, 2012 

Report No. 503 

Audit Conducted by Castro & Company, LLC
OFFICE OF 

INSPECTOR GENERAL 

UNITED STATES 

SECURITIES AND EXCHANGE COMMISSION 

WASHINGTON, D.C. 20549 

SEC Controls Over GFE and CAP 

Report No. 503 

Page ii 

March 28, 2012 

MEMORANDUM 

March 28, 2012 

To: Jayne Seidman, Acting Director, Office of Administrative 

Services (OAS) 

Thomas Bayer, Chief Information Officer, Office of Information 

Technolo �(OIT) 

No e aloney, Inspector General, Office of Inspector 

G n ral (OIG) 

From: 

Subject: SEC's Controls Over Government Furnished Equipment and 

Contractor Acquired Property, Report No. 503 

This memorandum transmits the U.S. Securities and Exchange Commission 

OIG's final report detailing the results of our audit on the SEC's controls over 

government furnished equipment and contractor acquired property. This audit 

was conducted as part of our continuous effort to assess management of the 

Commission's programs and operations and as a part of our annual audit plan. 

The final report contains nine recommendations which if fully implemented 

should strengthen the Commission's controls over government furnished 

equipment and contractor acquired property. OAS and OIT concurred with all the 

report's recommendations. Your written response to the draft report is included 

in Appendix V. 

Within the next 45 days, please provide the OIG with a written corrective action 

plan that is designed to address the recommendations identified in our final 

report. The corrective action plan should include information such as the 

responsible official/point of contact, timeframes for completing required actions, 

and milestones identifying how you will address the recommendations. 

70�� 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page iii

Should you have any questions regarding this report, please do not hesitate to 

contact me. We appreciate the courtesy and cooperation that you and your staff 

extended to our contractors.

Attachment

cc: James R. Burns, Deputy Chief of Staff, Office of the Chairman

Luis A. Aguilar, Commissioner

Troy A. Paredes, Commissioner

Elisse B. Walter, Commissioner

Daniel M. Gallagher, Commissioner

Jeff Heslop, Chief Operating Officer

Vance Cathell, Deputy Director, Office of Administrative Services

Todd Scharf, Chief Information Security Officer, Office of Information

 Technology

 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page iv

SEC’s Controls Over Government Furnished 

Equipment and Contractor Acquired 

Property

Executive Summary

Background. The U.S. Securities and Exchange Commission (SEC or 

Commission) Office of Inspector General (OIG) contracted with Castro & 

Company, LLC to conduct an audit of the SEC’s Government Furnished 

Equipment (GFE) and Contractor Acquired Property (CAP), and to identify 

potential areas for improvement. 

The SEC’s mission is to protect investors; maintain fair, orderly, and efficient 

markets; and facilitate capital formation. The SEC accomplishes much of its 

mission through the use of contractors and frequently provides its contractors 

with information technology equipment to use. 

Federal Acquisition Regulation (FAR) Part 45 – Government Property defines 

GFE or, Government Furnished Property (GFP), as property in the possession 

of, or directly acquired by, the government and subsequently furnished to the 

contractor for performance of a contract. It further defines CAP as property 

acquired, fabricated, or otherwise provided by the contractor for performing a 

contract and to which the government has title.

1

 Examples of GFP include 

servers and machinery the government provides to a contractor to use at the 

contractor’s facility to perform the terms of its contract. For simplicity, throughout 

this report GFE and CAP will be referred to as GFP.

When the SEC issues GFP to a contractor, the contractor is required to manage 

and account for GFP in accordance with the FAR, and the contractor is required 

to have a system to manage (i.e., control, use, preserve, protect, repair and 

maintain) the government property in its possession. In doing so, the contractor 

should initiate and maintain the processes, systems, procedures, records, and 

methodologies necessary for effective control of government property. To 

ensure contractors comply with these requirements, contractors should develop 

property management systems.2

 

The Commission has approximately 3,500 employees and 1,400 contract 

employees who are located at its Headquarters site in Washington, D.C., the 

Operations Center in Alexandria, VA, and its 11 regional offices located 

 

1 Federal Acquisition Regulation, Part 45 – Government Property, Clause 45.101 – Definitions, 

https://www.acquisition.gov/far/html/FARTOCP45.html. 2 Federal Acquisition Regulation, Part 52.245-1 - Government Property, Clause (b)(1), Property 

management, https://www.acquisition.gov/far/html/52_245.html. 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page v 

throughout the country. The scope of our audit primarily covered SEC’s Office of 

Administrative Services (OAS), Office of Information Technology (OIT), and

Office of Financial Management (OFM).

OAS assists the SEC with managing its facilities and assets, and provides a wide 

range of support services to SEC staff. OAS provides service to SEC employees 

agency-wide on matters such as procurement and contracting, property 

management, office lease acquisition and administration, space renovation, 

supplies and office equipment management, transportation, mail distribution, 

publications, printing, and desktop publishing. OAS’ Associate Executive 

Director is the Property Management Officer who has oversight of the SEC’s

property management program. 

OIT supports the SEC employees regarding all aspects of information 

technology. OIT further has overall management responsibility for the 

Commission's information technology program including application 

development, infrastructure operations and engineering, user support, 

information technology program management, capital planning, security, and 

enterprise architecture. OIT’s Asset Management Branch (AMB) is responsible 

for establishing property management policies for information technology

equipment, including serving as the inventory control point for the acquisition, 

storage and issuance of information technology equipment; serving as the 

utilization coordinator for the reassignment and disposal of information 

technology assets; and interfacing with the Assistant Property Management 

Officer regarding all information technology property issues. 

OFM administers the SEC’s financial management and budget functions, and is 

responsible for accounting policies, procedures, and operations, including

overseeing internal control procedures to ensure accountability of property and 

reconciliation of the SEC’s official property records to the general ledger control 

accounts. 

Objectives. The overall objective of the audit was to determine whether 

sufficient management controls over government property held by contractors

were in-place and operating effectively. The specific audit objectives were to 

determine whether:

• SEC has reliable records to assess which contractors have 

received GFP and the dollar value of the assets provided,

• Contracting Officer Representatives or others responsible for 

administration of property, are properly trained and are performing 

their required duties in accordance with the SEC policy, 

• Contractors that were provided GFP by the SEC have performed 

annual inventories of property in accordance with their contracts 

and the FAR, 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page vi

• SEC and contractors that were provided GFP by the SEC have 

adequate policies and procedures for the management and 

disposal of property, including the sanitization and disposal of IT 

property such as media, magnetic tapes, removable media, and 

hard drives which can contain sensitive data; and

• Assets held by contractors are properly accounted for and reported 

in the SEC’s financial statements.

Where appropriate, we also identified areas for improvement.

Results. We identified a number of control deficiencies concerning the SEC’s 

management and accountability over GFP. Specifically, the audit found that 

OAS and OIT could not identify the universe of GFP the SEC has issued to its 

contractors. Additionally, OAS, in conjunction with OIT have not clearly identified 

in the SEC Administrative Regulation (SECR), SECR 9-2, Property Management 

Program, and SECR 9-3, Report of Survey Program, the specific property items 

that it has designated as GFP, or the particular circumstances that are needed to 

meet the GFP requirements in the Federal Acquisition Regulation (FAR), Part 45 

– Government Property, including Section 45.101 – Definitions and Section 

45.103 - General.3

 Because OAS and OIT have not identified the universe of 

GFP and have not clearly defined what it considers to be GFP, there is an 

increased risk of the SEC not complying with the FAR and property that is lost, 

stolen, or misused may not be detected. 

In addition, we found that the Configuration Management Database (CMDB) 

utilized by AMB to monitor information technology equipment, including GFP is 

not reliable due to the fact that controls are insufficient to ensure the information 

in the database is accurate and complete. Additionally, AMB did not have proper 

policies and procedures related to the accountability of information technology

equipment, including coordinating with the Contracting Officer Representatives,

or other Property Accountability Officers, as designated in the contract, to ensure 

that government issued property items are properly returned to OIT when the 

contractor is no longer using the property item or when the contract with the 

vendor is no longer active. 

Further, we found that information technology equipment provided to contractors 

that AMB is required to monitor is not appropriately tracked, monitored, or 

inventoried. In addition, AMB does not have up-to-date policies and procedures 

to ensure the effective accountability of information technology equipment, 

including GFP. AMB has not conducted a wall-to-wall inventory of the SEC’s 

information technology equipment since 2009. The last inventory that was 

conducted included information technology equipment at the SEC’s 

Headquarters, Operations Center, and regional offices. To properly account for 

information technology equipment, in February 2012, AMB began a wall-to-wall 

3 Federal Acquisition Regulation (FAR), Part 45 – Government Property, Section 45.101 – Definitions and 

Section 45.103 – General. 

 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page vii

inventory of the SEC’s information technology equipment at its Headquarters, 

Operations Center, and regional offices locations. Once the inventory is 

completed AMB then plans to conduct an inventory every two years thereafter.

Finally, we found that Contracting Officers, Contract Specialists, and Contracting 

Officer Representatives are not properly trained regarding their responsibilities as 

it relates to contracts containing provisions for contractor who are issued GFP. 

In 10 out of the 30 contracts we sampled there was a section stating the 

contractor would be provided GFP. For example, one contract contained a 

section that stated, “Government Furnished Facilities and Equipment. The SEC 

shall provide office space and computers for contractor personnel.” However, 

OAS informed us that this equipment is generally provided to all contractors and 

is not considered GFP. Therefore, the GFP section was erroneously included in 

the contracts. Based on interviews we conducted, there is confusion with the 

Contracting Officer Representative’s understanding of the definition of GFP, their 

responsibilities for monitoring property that is provided to contractors, whether 

there are procedures for assigning GFP to contractors, and collecting or 

disposing of GFP when a contract employee exits a contract.

Summary of Recommendations. Based on the results of our audit, we made

the following recommendations: 

(1) The Office of Administrative Services (OAS), in conjunction with the Office 

of Information Technology (OIT), should revise SECR 9-3, Report of 

Survey Program and SECR 9-2, Property Management Program, and 

clearly define property that is designated as Government Furnished 

Property (GFP). OAS and OIT should further identify in SECR 9-3 and 9-2 

the particular circumstances that are needed to meet the GFP 

requirements in accordance with Part 45 of the Federal Acquisition 

Regulation.

(2) The Office of Information Technology (OIT) should revise its policy to 

specify how often the office will conduct wall-to-wall inventories of the 

SEC’s information technology equipment and how frequently the 

Configuration Management Database (CMDB) should be updated. In 

performing the inventories, OIT should ensure that:

• All relevant fields related to asset management in the CMDB are 

accurate and properly completed, including verifying that 

individuals using the property items are properly identified within 

the database; 

• Equipment in regional offices is included in the wall-to-wall 

inventory; and

• Fields in the CMDB that capture contract numbers and contract 

expiration dates using the Active Directory. 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page viii

(3) The Office of Information Technology (OIT) should coordinate with the 

Contracting Officer Representative or other Property Accountability 

Officer, as designated in the contract, to ensure that government issued 

property items are properly returned to the OIT and the items are promptly 

removed from the Configuration Management Database when the 

contractor is no longer using it or when the contract is no longer active. 

(4) The Office of Information Technology should develop and implement 

procedures for monitoring information technology equipment at the 

regional offices that is communicated to appropriate personnel. These 

procedures should include the regional office’s roles in monitoring 

information technology equipment issued to contractors, including their 

responsibilities when a contractor employee exits a contract or when the 

equipment is moved to a new location. 

(5) The Office of Information Technology should revise its policies and 

procedures to establish clear accountability within the Asset Management 

Branch that is associated with properly tracking and monitoring 

information technology equipment, including documenting the issuance 

and receipt of information technology equipment to specific Commission 

contractors. 

(6) When the Office of Information Technology completes the 2012, wall-towall inventory of information technology equipment, it should use this 

information to establish a baseline of the equipment in the Configuration 

Management Database. 

(7) The Office of Administrative Services, in conjunction with the Office of 

Information Technology, should develop periodic training for Contracting 

Officers, Contract Specialists, and Contracting Officer Representatives 

that clearly defines and addresses their responsibilities related to 

government furnished property consistent with Part 45 of the Federal 

Acquisition Regulation, Government Property and SECR 9-2, Property 

Management Program. 

(8) The Office of Administrative Services should ensure when the 

Commission issues Government Furnished Property to contractors, the 

Contracting Officer (and where appropriate the Contract Specialist), 

includes language in the contract that specifies:

• The name of the equipment, 

• What equipment will be retained, disposed of, or returned to the 

government, 

• When the equipment will be disposed of or returned to the 

government, and

• Who can accept the returned equipment. 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page ix

(9) The Office of Information Technology should issue Government Furnished 

Property to contractors only after it obtains proof that the vendor’s contract 

has language authorizing the contractor to receive the equipment. 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page x 

TABLE OF CONTENTS

Executive Summary............................................................................................. iv 

Table of Contents ................................................................................................. x 

Background and Objectives............................................................................... 1 

......................................................................... 1 

......................................................................... 5 

....................................................................... 6 

Background ......................

Objectives .........................

Findings and Recommendations

Finding 1: The SEC Could Not Identify the Universe of Property Issued to 

Contractors ............................................................................. 6 

Recommendation 1............................................................... 7 

Finding 2: The Configuration Management Database Is Not Reliable for 

Identifying Information Technology Equipment........................ 8 

Recommendation 2 ............................................................. 10 

............................................................ 11 

............................................................ 11 

Recommendation 3 .

Recommendation 4 .

Finding 3: OIT Has Not Conducted Timely Inventory of the SEC’s 

Information Technology Equipment and Lacks Up-to-Date 

Information Technology Equipment Policies and 

Procedures.... ....................................................................... 12 

Recommendation 5 ............................................................. 13 

Recommendation 6 ............................................................. 14 

Finding 4: Contracting Officers, Contract Specialists, and Contracting 

Officer Representatives Have Not Received Adequate Training Related to 

Government Furnished Property.............................................................. 14 

Recommendation 7............................................................. 17 

........................ 18 

........................ 18 

........................ 19 

........................20

........................24

........................26

........................ 29 

........................34

Recommendation 8 .....................................

Recommendation 9 .....................................

Appendices

Appendix I: Abbreviations. .............................................

Appendix II: Scope and Methodology .............................

Appendix III: Criteria ........................................................

Appendix IV: List of Recommendations ...........................

Appendix V: Management Comments ............................

Appendix VI: OIG Response to Management Comments
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 1 

Background and Objectives

Background

The U.S. Securities and Exchange Commission (SEC or Commission) Office of 

Inspector General (OIG), in accordance with its annual audit plan, contracted 

with Castro & Company, LLC (Castro & Co) to conduct an audit of the SEC’s

controls over Government Furnished Equipment (GFE) and Contractor Acquired 

Property (CAP). The SEC’s mission is to protect investors; maintain fair, orderly, 

and efficient markets; and facilitate capital formation. The SEC accomplishes 

much of its mission through the use of contractors, and frequently provides its 

contractors with information technology equipment to aid in carrying out its work. 

The Federal Acquisition Regulation (FAR) Part 45 – Government Property

defines GFE or, Government Furnished Property (GFP), as follows:

“Government-furnished property" means property in the

possession of, or directly acquired by, the Government and 

subsequently furnished to the contractor for performance of 

a contract... 

GFP also includes contractor-acquired property that is a deliverable under a cost 

contract that is accepted by the government for continued use under the 

contract.4

The FAR defines CAP as “property acquired, fabricated, or otherwise provided by 

the contractor for performing a contract and to which the government has title.”5

 

Examples of GFP include servers or machinery that the government provides to 

a contractor to use at the contractor facility to perform the terms of its contract. 

For simplicity, throughout this report GFE and CAP will be referred to as GFP.

The FAR requires contractors “have a system to manage (i.e., control, use, 

preserve, protect, repair and maintain) government property” that is in its 

possession and to initiate and maintain processes, systems, procedures, 

records, and methodologies necessary for effective control of the government 

property.6

 

The SEC has approximately 3,500 employees and 1,400 contract employees 

who work at its Headquarters site in Washington, D.C., the Operations Center in 

Alexandria, VA, and its 11 regional offices located throughout the country. The 

 

4 FAR 45.101, Definitions 5

 FAR 45.101, Definitions. 6 FAR 52.245-1(b)(1) - Government Property management, Clause (b)(1), Property management, 

https://www.acquisition.gov/far/html/52_245.html. 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 2 

scope of our audit primarily covered the SEC’s Office of Administrative Services

(OAS), Office of Information Technology (OIT), and Office of Financial 

Management (OFM).

The SEC Administrative Regulation (SECR) 9-2, Property Management Program, 

prescribes the policies and procedures governing the development, 

administration, application, and oversight of the SEC’s personal property 

management program to ensure that public assets under SEC custody are 

effectively and efficiently managed and controlled. The SECR 9-2 applies to 

personal property that is purchased or leased by the SEC. 7 Additionally, SECR 

9-2 does not address GFP except by stating, “It should be noted that government 

furnished property used by a contractor off-site is governed by the Federal 

Acquisition Regulation.”

OAS’s Role With GFP 

The Property Management Officer is OAS’ Associate Executive Director, and is 

responsible for the SEC’s property management program. The Property 

Management Officer’s responsibilities include establishing policies, standards, 

and guidance in accordance with applicable laws, regulations, and sound 

personal property management practices and standards, and assessing the 

effectiveness of the Commission’s personal property activities to ensure that 

sound, economical and efficient systems and internal controls are in place. 

OAS conducts annual inventories of all accountable SEC property – items with 

an original acquisition cost of $5,000 or more - in Momentum’s Fixed Asset 

Module (FAM) accounting system.

8

 Accountable property includes items such as 

internal use software and leasehold improvements, with an original acquisition 

cost of $5,000 or more. This property is subject to being inventoried each year 

and it is entered into FAM.9 Information technology equipment not meeting the 

$5,000 accountable property threshold is not required to be inventoried in FAM. 

OAS conducts annual physical inventories on all accountable property, including 

information technology equipment that cost more than $5,000, and enters the 

resulting data in FAM. 

All Momentum modules, including FAM, are scheduled to be closed for new data 

entry as of March 31, 2012, as the SEC transitions to a new Financial Shared 

Services Provider, Delphi Accounting System (Oracle Financials). At that time, 

existing SEC accountable property in FAM will be converted to the Oracle Assets 

Module.

 

7 SECR 9-2, Property Management Program (Mar. 16, 2009) cover letter and ch.1.1 – Purpose. 8 Momentum is the SEC’s accounting system. Fixed Asset Module (FAM), is a separate module in 

Momentum that is SEC’s property management system.

9 SECR 9-2, section 1-5(C). 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 3 

OAS tracks all the SEC contracts in the Federal Procurement Data System 

(FPDS) and will continue to do so after the SEC’s transition to Oracle 

Financials.

10 FPDS includes a field that Contracting Officers can use to identify 

contracts that authorize the issuance of GFP during the contract’s period of 

performance. If the SEC provides GFP to a contractor, the FAR requires that the 

Contracting Officer insert the government property clause FAR Part 52.245.1, in 

its entirety, into the contract. Contracting Officer Representatives are 

responsible for ensuring that GFP, as specified in a contract, is available when 

authorized and for reporting any accountable property to the contracting officer.

11 

AMB’s Role With GFP

OIT’s Asset Management Branch (AMB) is responsible for establishing property 

management policies for information technology equipment, including serving as 

the inventory control point for the acquisition, storage and issuance of information 

technology equipment (this includes computers and mobile devices); serves as 

the utilization coordinator for the reassignment and disposal of information 

technology assets; and interfaces with the OAS’ Assistant Property Management 

Officer regarding all information technology property issues.

12 

Further, AMB is responsible for issuing SEC owned information technology 

property items to contract employees and tracking these items. Further, AMB is 

responsible for identifying what property has been issued to contractors, 

determining the location of government issued property, and ensuring the return 

of the government issued property to AMB when the contractor no longer needs 

it or when the contractor no longer works on the contract. 

AMB maintains the Configuration Management Database (CMDB), which tracks 

agency-wide information technology equipment (includes GFP) that the SEC 

owns, as well as equipment that is located at the SEC’s regional offices and 

equipment the regional offices issues to its contractors. AMB uses CMDB to 

track and monitor all SEC information technology equipment that is not 

considered accountable property.13 

OFM’s Role With GFP

OFM administers the SEC’s financial management and budget functions, and is 

responsible for accounting policies, procedures, and operations, including 

overseeing the Commission’s internal control procedures to ensure accountability 

10 FPDS is an automated system for collecting and reporting on federal procurement spending and serves 

as a repository for federal procurement award data, https://www.fpds.gov/downloads/Manuals/FPDSNG_Overview.ppt

11 SECR 10-15 (rev. 1), Acquisitions Contract Administration Positions (Aug. 12, 2009), app. A (rev. Aug. 13, 

2009).

12 SECR 9-2, section 1-5(F). 13 Per the AMB Branch Chief, the CMDB is used to identify information technology equipment when AMB 

conducts agency-wide, wall-to-wall inventories.

 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 4 

for property and reconciliation of the official property records to the general 

ledger control accounts.14 

Regional Office Questionnaire

To determine the adequacy of the SEC identifying, issuing, and tracking GFP at 

its regional offices, Castro & Co developed and issued a questionnaire that was 

sent to administrative officers and supervisors at the SEC’s 11 regional offices

regarding the following: 

• Regional Office Location and Personnel – Names, phone numbers 

and e-mail addresses of the Property Accountability Officer, 

Property Custodian Officer, Receiving Official, Administrative 

Officer, and any other individual associated with GFP. 

• Requisition and Procurement – Respond to questions associated 

with the office’s methodology for procuring equipment and 

contractors, procedures for identifying contracts with GFP items, 

and procedures for determining whether GFP items were provided 

to contractors. 

• Receipt of Property Items – Does the office have a centralized 

location for the receipt of property items? Does the office have 

procedures associated with the receipt of property items? Are 

there procedures pertaining to the distribution of property items to 

end users? 

• Accountability of Property Items – Respond to a series of questions 

related to tracking property items in FAM15

• Other – What are the office procedures associated with collecting 

GFP from contractors after the period of performance on a given 

contract has ended? 

or some other database

and the recent inventorying of property items at the regional offices. 

We received responses to our questionnaire from 10 regional offices. However, 

after repeated requests, the Los Angeles regional office did not respond to the 

questionnaire. 

 

14 SECR 9-2, section 1-5(E). 15 FAM is located in the SEC’s Momentum Accounting System.
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 5 

Objectives

The overall objective of this audit was to determine whether the SEC has in place 

sufficient management controls over government property held by contractors 

and whether those controls were operating effectively.

Castro & Co’s additional objectives were to determine whether: 

• SEC has reliable records to determine which contractors have 

received GFP and the dollar value of the assets provided; 

• Contracting Officer Representatives or others responsible for 

administration of property are properly trained and performing their 

required duties in accordance with SEC policy; 

• Contractors that were provided GFP by the SEC have performed 

annual inventories of property in accordance with their contracts 

and the FAR; 

• The SEC and contractors that were provided GFP by the SEC have 

adequate policies and procedures for the management and 

disposal of property, including the sanitization and disposal of 

information technology property such as media, magnetic tapes, 

removable media, and hard drives containing sensitive data; and

• Assets held by contractors are properly accounted for and reported 

in the SEC’s financial statements.

Where appropriate Castro & Co also identified areas for improvement.
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 6 

Findings and Recommendations

Finding 1: The SEC Could Not Identify the 

Universe of Property Issued to Contractors 

OAS and OIT could not identify the universe of property 

issued to contractors that was designated as GFP, and it has 

not clearly defined property that is considered GFP. As a 

result, there is an increased risk that the SEC’s management 

of GFP is not in compliance with the FAR, and the property 

will be lost, stolen, or misused. 

From our review of the SEC property databases (e.g., FAM and AMB’s

Configuration Management Database (CMDB)), we could not identify which 

property items in the databases that would create the universe of GFP. 

Additionally, through discussions with OAS, OIT, OFM, Contracting Officers, 

Contracting Officer Representatives, and regional office personnel, we 

determined that SEC personnel lack a clear understanding of what constitutes

GFP. The FAR defines GFP as: 

“Government-furnished property” means property in the 

possession of, or directly acquired by, the Government and 

subsequently furnished to the contractor for performance of 

a contract...Government-furnished property also includes 

contractor-acquired property if the contractor-acquired 

property is a deliverable under a cost contract when 

accepted by the Government for continued use under the 

contract.16

In its administrative regulations, the SEC does not clearly identify the specific 

property items that are considered GFP, or the particular circumstances that are 

needed for SEC property to meet the FAR definition of GFP. 

Our review found that SECR 9-3 indicates “Government Furnished Property is 

defined in the FAR, Part 45.”17 However, it does not discuss what specific SEC 

property is designated as GFP. In addition, SECR 9-2 does not address GFP

except by stating, “It should be noted that government furnished property used by 

a contractor off-site is governed by the Federal Acquisition Regulation.”18

 

16 FAR 45.101, Definitions. 17 SECR 9-3, Report of Survey Program (Mar. 18, 1996), section A(3)(A). SECR 9-3 3 “provides criteria 

and procedures for initiating, preparing, and approving reports of survey for SEC property.” In addition, it 

establishes criteria for determining an individual's financial liability for loss of or damage to SEC property. 18 SECR 9-2, Property Management Program, section 6.2(B).
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 7 

Response to Regional Office Questionnaire. In response to the questionnaire 

we issued to the SEC’s 11 regional offices, five offices identified contractors they 

determined had been issued GFP. These offices indicated the GFP items were 

desktop computers and monitors that AMB provided to the contractor’s 

employees.

19 Three regional offices verbally stated they did not have a clear 

understanding of what SEC information technology equipment is defined as GFP. 

Conclusion. OAS and OIT could not identify the universe of GFP that was 

issued to SEC contractors. Further, the SEC has not clearly defined in its 

internal policies and the SECR, exactly what property is considered to be GFP. 

Because the SEC has not clearly identified the universe of GFP, there is a risk 

that the SEC may not be in compliance with the FAR Part 45, and property that is 

lost, stolen, or misused may not be detected. We found that some contracts we 

reviewed included sections related to GFP items that were provided in the 

contract, but OAS later determined that the items did not meet the definition of 

GFP in Part 45. For example, one contract had a section stating, “Government 

Furnished Facilities and Equipment. The SEC shall provide office space and 

computers for contractor personnel,” and the SEC confirmed they do not 

consider these items to be GFP. 

Recommendation 1:

The Office of Administrative Services (OAS), in conjunction with the 

Office of Information Technology (OIT), should revise SECR 9-3, 

Report of Survey Program and SECR 9-2, Property Management 

Program, and clearly define property that is designated as Government 

Furnished Property (GFP). OAS and OIT should further identify in 

SECR 9-3 and 9-2 the particular circumstances that are needed to 

meet the GFP requirements in accordance with Part 45 of the Federal 

Acquisition Regulation.

Management Comments. OAS and OIT concurred with this 

recommendation. See Appendix V for management’s full comments.

OIG Analysis. We are pleased that OAS and OIT concurred with this 

recommendation. 

 

19 Computers issued to contract personnel are not the type of information technology equipment OAS or OIT 

consider to be GFP. 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 8 

Finding 2: The Configuration Management 

Database Is Not Reliable for Identifying 

Information Technology Equipment

The CMDB, which AMB uses to track and monitor 

information technology equipment, is not reliable because its 

controls over the monitoring and tracking of information 

technology equipment are insufficient and do not ensure that 

the information in the database is accurate and complete.

To determine the appropriateness and completeness of the CMDB for tracking 

and identifying information technology equipment, we obtained an FPDS report 

from OAS containing all the contracts that were identified as having been issued 

GFP. OAS tracks all SEC contracts in the FPDS and the FPDS has a field that 

Contracting Officers can use to identify contracts that are authorized to be issued 

GFP during the contract’s period of performance. 

We then obtained a CMDB report from AMB that identified all information 

technology property items that were provided to contractors. To analyze these 

reports, Castro & Co: 

(1) Reviewed the reports for any anomalies; 

(2) Reconciled the reports by comparing them to determine if 

contractors on one of the databases were missing from the 

other; 

(3) Selected a sample number of contractors from the CMDB listing 

that were not included on the FPDS report and obtained a copy 

of the contracts; and 

(4) Obtained a Momentum report from OFM of all transactions 

recorded against the “equipment” Budget Object Class 31XX, in 

2010 and 2011.

Our review of the FPDS report and the report from the CMDB identified the 

following discrepancies: 

• Certain data fields in the CMDB were inaccurate or incomplete. For 

example, 31 items in the population of 1,658 information technology 

assets in the CMDB did not have the required room number for the 

location of the asset; and three items did not have the required floor 

number for the asset.

• An Asset Tag number was listed twice in the CMDB. 

• A significant number of Blackberries being held for stock were 

wrongly assigned to a contract employee in the CMDB. 

• The FPDS report identified 42 contractors with GFP and the CMDB 

showed 110 contractors had GFP. We determined that 74 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 9 

contractors on the CMDB report were not included in the FPDS 

report. 

• We were unable to determine if 11 of the 110 contractors in the 

CMDB report had active contracts with SEC because contract 

numbers are not included in the CMDB and therefore could not be 

tracked. 

Based on our analysis, we determined that the information in the CMDB was 

unreliable because the database contained erroneous information. 

Past Problems Associated With Updating the CMDB. AMB has not 

conducted a wall-to-wall inventory of SEC information technology equipment 

since 2009. The AMB Branch Chief informed Castro & Co that during the 2009 

inventory, server problems interfered with loading inventory data into the CMDB 

correctly, and the contractor responsible for conducting the inventory spent 

approximately a year trying to correct the issues, which caused delays in 

performing the next scheduled equipment inventory. He further relayed that as a 

result, AMB did not start to plan the next wall-to-wall inventory until the third 

quarter of fiscal year 2010. As a result, he acknowledged that the data in the 

CMDB is not current. 

Further AMB’s Branch Chief told us that OIT’s “Tier II20” technicians neglected to 

update the CMDB when they issued new equipment to contractors. 

Assessment of the CMDB’s Controls. In Castro & Co’s questionnaire, five 

regional offices stated they had issued information technology equipment to 

contractors; however, only one of the offices maintained a listing of the 

equipment. We attempted to trace all items identified on this particular regional 

office’s list, to the CMDB to determine if AMB properly tracked the items and 

found that some if the information technology equipment was not in the CMDB.

AMB did not have proper policies and procedures related to the accountability for

information technology equipment, including GFP in the CMDB. AMB also did 

not have policies and procedures for coordinating with the Contracting Officer 

Representatives or other Property Accountability Officers, as designated in the 

contract, to ensure that GFP items are properly returned to OIT when for 

example, the contractor no longer needs the item, the contractor no longer works 

for the vendor or in the area requiring equipment, or when the period of 

performance on the contract ends. 

Four staff in the regional offices informed Castro & Co that they did not have a 

clear understanding of the procedures they should follow when a contract

employee who was issued GFP either no longer works on the contract or when 

the period of performance on the contract ends. Therefore, there is a risk that 

 

20 AMB’s “Tier II” technicians are contractors who are managed by OIT’s Technical Assistance Center 

Branch. 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 10

property items AMB provided to contractors may have been transferred to

another contractor or SEC employee without being properly tracked. 

Conclusion. The CMDB was unreliable due to missing data fields, the data 

being unreliable, and not utilized fully by staff, and we could not trace the 

assignment of certain information technology equipment to specific contracts or 

individuals. Therefore, if equipment was lost, stolen, or was not returned to the 

agency, the SEC would have a difficult time identifying the contractor and or 

individual who was responsible for the equipment. AMB is not complying with 

SECR 9-2, Section 1-1, Purpose, which states, “This Property Management 

Regulation prescribes procedures to ensure that public assets under the SEC 

custody are effectively and efficiently managed and controlled. Implementation 

of logistical and financial accountability and controls will enable the SEC 

resource managers to maximize the taxpayers’ investment in government

property by preventing unnecessary acquisitions, promoting effective use of 

existing assets, and attaining optimum return by systematic disposal of unneeded 

equipment.”

21

Recommendation 2:

The Office of Information Technology (OIT) should revise its policy to specify 

how often the office will conduct wall-to-wall inventories of the Securities and 

Exchange Commission’s information technology equipment and how 

frequently the Configuration Management Database (CMDB) should be

updated. In performing the inventories, OIT should ensure that: 

• All relevant fields related to asset management in the CMDB are 

accurate and properly completed, including verifying that 

individuals using the property items are properly identified within 

the database; 

• Equipment in regional offices is included in the wall-to-wall 

inventory; and

• Fields in the CMDB that capture contract numbers and contract 

expiration dates using the Active Directory. 

Management Comments. OIT concurred with this recommendation. See 

Appendix V for management’s full comments.

OIG Analysis. We are pleased that OIT concurred with this 

recommendation. 

 

21 SEC Administrative Regulation, SECR 9-2, Property Management Program, Section 1.1. 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 11

Recommendation 3: 

The Office of Information Technology (OIT) should coordinate with the 

Contracting Officer Representative or other Property Accountability Officer, as 

designated in the contract, to ensure that government issued property items 

are properly returned to the OIT and the items are promptly removed from the 

Configuration Management Database when the contractor is no longer using 

it or when the contract is no longer active. 

Management Comments. OIT concurred with this recommendation. See 

Appendix V for management’s full comments.

OIG Analysis. We are pleased that OIT concurred with this 

recommendation. 

Recommendation 4: 

The Office of Information Technology (OIT) should develop and implement 

procedures for monitoring information technology equipment at the regional 

offices that is communicated to appropriate personnel. These procedures 

should include the regional office’s roles in monitoring information technology

equipment issued to contractors, including their responsibilities when a 

contractor employee exits a contract or when the equipment is moved to a 

new location. 

Management Comments. OIT concurred with this recommendation. See 

Appendix V for management’s full comments.

OIG Analysis. We are pleased that OIT concurred with this 

recommendation. 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 12

Finding 3: OIT Has Not Conducted Timely 

Inventory of the SEC’s Information Technology

Equipment and Lacks Up-to-Date Information 

Technology Equipment Policies and Procedures 

AMB has not appropriately inventoried the SEC information 

technology equipment, including information technology

equipment provided to contractors. In addition, AMB does 

not have up-to-date policies and procedures to ensure that 

information technology equipment, including GFP, is 

accounted for effectively. As a result, the risk is increased 

that such equipment could be lost, stolen, misused and that 

the loss, theft, or misuse could go undetected. 

OIT Has Not Conducted Timely Inventory of the SEC’s 

Information Technology Equipment

As previously mentioned, AMB has not conducted a wall-to-wall inventory of the 

SEC’s information technology equipment since 2009. The AMB Branch Chief

informed Castro & Co that during the 2009 inventory, server problems interfered 

with loading inventory data into the CMDB correctly, and the contractor 

responsible for conducting the inventory spent approximately a year trying to 

correct the issues, which caused delays in performing the next scheduled 

equipment inventory. In February 2012, AMB initiated an agency-wide, wall-towall inventory of the SEC’s information technology equipment. AMB says the 

office will now conduct an inventory every two years, hereafter. AMB’s 

inventories will obtain the following information for each property item 

inventoried, including GFP, if applicable: 

• Name of Employee/Contractor to whom the equipment is assigned

• Equipment Serial Number

• Office Number and Floor where equipment is located

• Office Location (Headquarters, regional office, etc.)

• Asset Sub Class (e.g., monitors, desktops, laptops)

The Government Accountability Office (GAO) identified a number of best 

practices in performing an inventory of property, including the following key 

factors for achieving consistent and accurate counts of physical inventories:

• Establish Accountability

• Establish Written Policies

• Select an Approach

• Determine Frequency of Counts
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 13

• Maintain Segregation of Duties

• Enlist Knowledgeable Staff

• Provide Adequate Supervision

• Perform Blind Counts

• Ensure Completeness of the Count

• Execute Physical Count

• Perform Research

• Evaluate Count Results22

The GAO Executive Guide presents processes and controls that private sector 

companies use and recognize as excelling in their ability to manage inventory 

and achieve consistent and accurate counts of physical inventories.

Since the SEC has not performed timely inventories of information technology 

equipment, they are not able to accurately identify a complete universe of 

information technology equipment. 

AMB Property Management Policies. AMB has not developed up-to-date 

property management policies for the SEC’s information technology equipment. 

The AMB Branch Chief, who joined the SEC during the summer of 2011, said 

that his major focus had been on updating outdated procedures related to 

monitoring and developing a plan to conduct a wall-to-wall inventory of the SEC’s 

information technology equipment. Because AMB did not have up-to-date 

policies and procedures, there were not adequate controls in place related to the 

accountability of information technology equipment. 

Conclusion. Because it did not conduct a timely wall-to-wall inventory of the 

SEC information technology equipment and has not established or implemented

up-to-date policies and procedures to ensure information technology equipment 

can be effectively accounted for, AMB is not complying with SECR 9-2, or 

fulfilling the purpose of the regulation, which is to ensure that “public assets 

under the SEC custody are effectively and efficiently managed and controlled.”23

Recommendation 5: 

The Office of Information Technology (OIT) should revise its policies and 

procedures to establish clear accountability within the Asset Management 

Branch that is associated with properly tracking and monitoring information 

technology equipment, including documenting the issuance and receipt of 

information technology equipment to specific Commission contractors. 

 

22 Government Accountability Office, Executive Guide - Best Practices in Achieving Consistent, Accurate 

Physical Counts of Inventory and Related Property, GAO-02-447G (Mar. 1, 2002), at 12. 

http://www.gao.gov/new.items/d02447g.pdf. 23 SECR 9-2, section 1.1. 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 14

Management Comments. OIT concurred with this recommendation. See 

Appendix V for management’s full comments.

OIG Analysis. We are pleased that OIT concurred with this 

recommendation. 

Recommendation 6: 

When the Office of Information Technology completes the 2012, wall-to-wall 

inventory of information technology equipment, it should use this information 

to establish a baseline of the equipment in the Configuration Management 

Database. 

Management Comments. OIT concurred with this recommendation. See 

Appendix V for management’s full comments.

OIG Analysis. We are pleased that OIT concurred with this 

recommendation. 

Finding 4: Contracting Officers, Contract 

Specialists, and Contracting Officer 

Representatives Have Not Received Adequate 

Training Related to Government Furnished 

Property

 Contracting Officers, Contract Specialists, and Contracting 

Officer Representatives are not properly trained regarding their

GFP responsibilities. As a result, sections in awarded contracts 

included language stating the contractor was issued GFP, such 

as a SEC computer desktop or a monitor. In addition, 

Contracting Officers and Contracting Officer Representatives do 

not fully know their responsibilities related to GFP. 

Contracting Officer and Contract Specialist Responsibilities 

Related to GFP

As discussed in Finding 1, Castro & Co obtained a FPDS report from OAS that 

identified contracts that had GFP. We then got a CMDB report from AMB that 

identified contractors who had been issued GFP and compared the two reports. 

The FPDS report identified 42 contractors that had GFP and the CMDB report 

identified 110 contractors that had GFP. We initially determined that 86 

contractors on the CMDB report that were not included on the FPDS report. 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 15

However, we determined six contractors were repeated twice and three contracts 

were on the report three times. After removing the duplicate entries, we 

determined that 74 contractors remained on the CMDB report, were not on the 

FPDS report. 

We selected a sample of 30 contractors from the list of 74 contractors on the 

CMDB report and reviewed the associated contracts to determine if the contracts 

included 

• A section stating the contractor would be issued GFP; and

• FAR 52.245-1 (as required by FAR 45.107).24

Ten out of the 30 contracts in our sample included a section in the contract 

indicating the contractor would be provided GFP. For example, one contract 

contained a contained the following language: 

“Government Furnished Facilities and Equipment. The SEC 

shall provide office space and computers for contractor 

personnel.” 

Both OAS and OIT informed us that computers issued to contract personnel are

not the type of information technology equipment it considers to be GFP. These 

are standard equipment that is issued to most contractors (depending on need) 

and it does not leave the SEC’s work sites. Therefore, we determined that the 

GFP section should not have been included in the contracts. OAS and OIT staff 

stated the GFP section was included in the contracts by Contracting Officers and 

Contract Specialists who did not have a clear understanding of what SEC defines 

as GFP. Additionally, Contracting Officers and Contract Specialists tend to use 

old Statement of Works to develop templates to develop new contract 

requirements that have the GFP sections already included in it.

 

Contracting Officer Representatives Responsibilities Related to 

GFP

We judgmentally selected 15 contractors from the list of property items in the 

CMDB and requested names for the Contracting Officer Representatives that 

were associated with the contracts, from the Office of Acquisitions. We

interviewed all but one Contracting Officer Representatives, who was from the 

Office of Human Resources, and did not respond to our e-mail and telephone 

requests for an interview. 

Based on the interviews we conducted, Castro & Co found that Contracting 

Officer Representatives are confused about the definition of GFP and their 

responsibilities for monitoring GFP, including whether procedures exist for 

 

24 Federal Acquisition Regulation Part 45 – Government Property, Section 45.107, Contract Clauses. 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 16

assigning GFP to contractors and collecting GFP when a contract employee exits 

a contract. The majority of Contracting Officer Representatives believe they are 

not responsible for tracking property that is issued to contractors because they 

believe it is AMB’s responsibility. However, SECR 10-15 states that Contracting 

Officer Representatives’ responsibilities and duties include ensuring GFP, as 

specified in the contract, is available when required, and for reporting any 

accountable property to the appropriate personnel.25

Contracting Officer Representatives Training. The Contracting Officer 

Representatives indicated they are required to complete 40 hours of training 

every two years to maintain their certification. OAS regularly provides the 

Contracting Officer Representatives with suggested courses in e-mails and they 

also remind them of their recertification requirements. 

There are three levels of Contracting Officer Representatives designation, each 

with different training and experience requirements:

1. Level I – Level I Contracting Officer Representatives are required 

to complete eight hours of training and are not required to have

previous experience. This designation is generally appropriate for 

low-risk contract vehicles, such as supply and order contracts.

2. Level II – Level II Contracting Officer Representatives are required 

to complete 40 hours of training and must have two years of 

previous Contracting Officer Representatives experience. This 

designation is generally appropriate for contract vehicles of 

moderate to high complexity, including both supply and service 

contracts. Level II Contracting Officer Representatives may also be 

called upon to perform general project management activities.

3. Level III – Level III Contracting Officer Representatives, are 

required to complete 60 hours of training every two years, and must 

have experience on contracts of moderate to high complexity that 

require significant acquisition investment. Level III Contracting 

Officer Representatives are the most experienced Contracting 

Officer Representatives should be assigned the most complex and 

mission-critical contracts. These Contracting Officer 

Representatives are often called upon to perform significant 

program management activities.26

We conducted interviews with the SEC University personnel to identify available 

training that is related to property management. The SEC University sends out 

 

25 SECR 10-5, app. A. 26 Office of Management and Budget, Memorandum for Chief Acquisition Officers, Senior Procurement 

Executives: Revisions to the Federal Acquisition Certification for Contracting Officer’s Representatives 

(FAC-COR) (Sept. 6, 2011), at 2, http://www.whitehouse.gov/sites/default/files/omb/procurement/revisionsto-the-federal-acquisition-certification-for-contracting-officers-representatives.pdf.
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 17

agency-wide emails about Contracting Officer Representatives training and is the 

primary SEC office responsible for developing and administering courses that 

Contracting Officer Representatives can take to obtain their Level I to Level III

recertification. The SEC University offers various courses Contracting Officer 

Representatives can take to maintain their certifications. Our review of the 

training courses found that the current courses do not address the role of 

Contracting Officer Representatives who oversee contracts with GFP. Currently, 

the SEC University offers a “Putting it All Together” course for Contracting Officer 

Representatives that covers procurement procedures and includes a panel 

discussion with active SEC Contracting Officers and Contracting Officer 

Representatives. The SEC University personnel stated that a new “Putting it All 

Together” or “Webinar” course could be developed that addresses GFP 

requirements. Such a course could also include a panel discussion with property 

experts, including representatives from AMB. 

Because Contracting Officers, Contract Specialists and Contracting Officer 

Representatives do not have a clear understanding of what is or is not GFP, SEC 

contracts may erroneously include or exclude GFP clauses. Further, because 

Contracting Officers, Contract Specialists, and Contracting Officer 

Representatives do not know what their responsibilities related to GFP. Finally, 

GFP currently is not being properly accounted for, tracked, and monitored. 

Recommendation 7: 

The Office of Administrative Services, in conjunction with the Office of 

Information Technology, should develop periodic training for Contracting 

Officers, Contract Specialists, and Contracting Officer Representatives that 

clearly defines and addresses their responsibilities related to government 

furnished property consistent with Part 45 of the Federal Acquisition 

Regulation, Government Property and SECR 9-2, Property Management 

Program. 

Management Comments. OAS and OIT concurred with this 

recommendation. See Appendix V for management’s full comments.

OIG Analysis. We are pleased that OAS and OIT concurred with this 

recommendation. 
SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 18

Recommendation 8:

The Office of Administrative Services should ensure when the Securities and 

Exchange Commission issues Government Furnished Property to 

contractors, the Contracting Officer (and where appropriate the Contract 

Specialist), includes language in the contract that specifies: 

• The name of the equipment, 

• What equipment will be retained, disposed of, or returned to the 

government, 

• When the equipment will be disposed of or returned to the 

government, and

• Who can accept the returned equipment. 

Management Comments. OAS concurred with this recommendation. 

See Appendix V for management’s full comments.

OIG Analysis. We are pleased that OAS concurred with this 

recommendation. 

Recommendation 9: 

The Office of Information Technology should issue Government Furnished 

Property to contractors only after it obtains proof that the vendor’s contract 

has language authorizing the contractor to receive the equipment. 

Management Comments. OIT concurred with this recommendation. See 

Appendix V for management’s full comments.

OIG Analysis. We are pleased that OIT concurred with this 

recommendation. 
Appendix I

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 19

Abbreviations

AMB Asset Management Branch

CAP Contractor Acquired Property

Castro & Co Castro & Company, LLC

CMDB Configuration Management Database

COSO Committee of Sponsoring Organizations

 of the Treadway Commission

FAM Fixed Asset Module

FAR Federal Acquisition Regulation

FPDS Federal Procurement Data System

GAO Government Accountability Office

GFE Government Furnished Equipment

GFP Government Furnished Property

OAS Office of Administrative Services

OFM Office of Financial Management

OIG Office of Inspector General

OIT Office of Information Technology

OMB Office of Management and Budget

SEC or Commission U.S. Securities and Exchange Commission

SECR SEC Administrative Regulation
Appendix II

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 20

Scope and Methodology

As part of the OIG’s annual audit plan, Castro & Co conducted an audit of 

management controls over the SEC’s GFP. 

Castro & Co conducted this performance audit in accordance with generally 

accepted government auditing standards. Those standards require that we plan 

and perform the audit to obtain sufficient, appropriate evidence to provide a 

reasonable basis for our findings and conclusions based on our audit objectives. 

We believe that the evidence obtained provides a reasonable basis for our 

findings and conclusions based on our audit objectives.

Scope. The OIG contracted with Castro & Co to conduct a performance audit to 

identify potential areas for improvement with regard to the Commission’s GFP. 

The overall objective of the audit was to determine whether sufficient 

management controls over government property held by contractors were in 

place and operating effectively. The scope of our audit covered GFP acquired 

from fiscal year 2007 through fiscal year 2011, and included examining:

• The Commission’s processes for managing and accounting for 

GFP, and 

• The policies and procedures in place to ensure the proper 

management of and accountability for GFP. 

Castro & Co conducted its fieldwork from October 2011 through January 2012. 

The scope of our audit further included the SEC’s Headquarters site in

Washington, D.C., the Operations Center in Alexandria, VA, and its 11 regional 

offices that are located throughout the country.

Methodology. To accomplish the audit’s objectives, Castro & Co’s fieldwork 

included the following:

• To gain an understanding of the GFP’s we reviewed SEC’s

regulations and policies and procedures pertaining to property 

management and management of and accountability for GFP and 

information technology equipment. 

• We reviewed relevant federal laws, regulations, and guidance; 

• Reviewed OIG issued reports related to GFP or accountability for

information technology equipment to determine the impact of their 

findings on our audit procedures and to determine the status of 

applicable recommendations. 
Appendix II

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 21

• Reviewed reports issued by other federal agencies related to GFP

and accountability for information technology equipment, to 

determine whether any issues in these reports were applicable to 

the scope of our audit. 

• Conducted interviews with select personnel who had 

responsibilities related to SEC property and contracts management, 

including: personnel from OAS, OIT, OFM; contracting officers; 

Contracting Officer Representatives; contractors; and regional 

office personnel. We also conducted interviews with the SEC 

University staff to determine specific training requirements related 

to property management that are available to SEC employees. 

• Developed, administered, and analyzed the results of a 

questionnaire that was directed to SEC’s regional offices to 

determine the adequacy of their identification, issuance, and 

tracking processes for GFP. 

• Obtained, reviewed and analyzed contracts to determine whether 

they included GFP language. 

• Identified areas in which improvements could be made. 

nternal Controls. Internal Control – Integrated Framework, published by the 

ommittee of Sponsoring Organizations of the Treadway Commission (COSO), 

rovides a framework for organizations to design, implement, and evaluate 

ontrols that facilitate compliance with federal laws, regulations, and program 

ompliance requirements.27 For this audit, we based our assessment of internal 

ontrols related to the accountability and management of GFP that were 

ignificant to the audit objectives on the COSO framework, including control 

nvironment, control activities, information and communication, and monitoring. 

I

C

p

c

c

c

s

e

We reviewed the management control activities as they pertained to the audit’s

objectives and assessed the design effectiveness of key controls over GFP. 

Among the internal controls we assessed to determine whether they were

properly designed and implemented, were OAS, OIT, and OFM’s controls and 

policies and procedures related to the accountability and management of GFP. 

To facilitate our understanding of applicable GFP process controls, we reviewed 

information in organization charts, current policies and procedures, fiscal year

2010 GAO Financial Statement Audit Property and Equipment Cycle 

Memorandum, and systems used to track and monitor property and equipment, 

including GFP. We met with appropriate staff from OAS, OIT, and OFM to gain 

an understanding of the controls surrounding property and equipment items they 

manage, including GFP, if applicable. Additionally, to determine the adequacy of 

27 Committee of Sponsoring Organizations of the Treadway Commission, Internal Control-Integrated 

Framework (1992), http://www.coso.org/guidance.htm.

 
Appendix II

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 22

the controls over the identification, issuance and tracking process of GFP at the 

SEC regional offices, we developed a questionnaire that was submitted to the 

SEC’s 11 regional offices. 

Judgmental Sampling. Castro & Co employed a judgmental sampling 

methodology for performing this audit. Judgmental sample sizes were 

determined after giving consideration to the frequency of the control, significance 

of the control, inherent risk, and professional judgment. 

We judgmentally selected 30 contracts from a list of 74 active contracts OAS 

provided, where the Contracting Officer initially identified the contractor was 

provided GFP. We reviewed these contracts to determine whether they properly 

identified GFP.

Further, we judgmentally selected 80 contracts from a Momentum report OFM 

provided that contained 110 contracts that had transactions that were charged to 

the equipment Budget Object Class 31XX, for the period of October 1, 2009 

through September 30, 2011. The supporting contracts were reviewed to 

determine whether they properly identified GFP.

Further, we judgmentally selected 15 Contracting Officer Representatives from 

the SEC’s approximate 59 Contracting Officer Representatives to interview. 

These Contracting Officer Representatives were selected from a list we were 

provided that showed the Contracting Officer Representatives was assigned 

information technology equipment. We interviewed the Contracting Officer 

Representatives because they responsible for the administration of property and 

to determine whether they were properly trained and were performing their 

required duties in accordance with the SEC policy.

Because we did not use statistical sampling techniques, we did not try to project 

the results of the items reviewed in our samples to the entire population.

Prior Audit Coverage. SEC OIG Controls Over Laptops, Inspection Report No. 

441, issued March 31, 2008, found weaknesses in the SEC’s inventory and 

control of laptop computers. While OAS and OIT implemented most of the 

recommendations identified in the report, Recommendations C and D, which are 

related to this audit, have not been closed. 

Recommendation C has not been addressed. OIT indicated it will address 

Recommendations C when AMB completes its wall-to-wall inventory of 

information technology equipment, which includes laptops. OIT informed us that 

Recommendation D has not been completely addressed. AMB has not yet 

revised its procedures to establish clear accountability for laptops and it has not 

established procedures to document the issuance of equipment to a specific SEC 

employees or the receipt of equipment from SEC employees. AMB informed 
Appendix II

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 23

Castro & Co they are currently in the process of updating their procedures to 

address these requirements. 

 
Appendix III

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 24

Criteria

FAR Part 45, Government Property. Prescribes policies and procedures for 

providing government property to contractors, contractors’ management and use 

of government property, and reporting, redistributing, and disposing of contractor 

inventory. FAR 45.107, Contract clauses, requires that FAR 52.245-1 be 

inserted in its entirety in contracts where the government provides contractors 

with GFE or directs them to acquire property to which the government has title for 

use under the contract.

SECR 9-2, Property Management Program, March 16, 2009. Prescribes 

policies and procedures governing the development, administration, application, 

and oversight of the SEC personal property management program and applies to 

personal property purchased or leased by the SEC.

SECR 9-3, Report of Survey Program, March 18, 1996. Prescribes policies, 

procedures, and standards that govern the SEC's Report of Survey Program. It 

provides criteria and procedures for initiating, preparing, and approving reports of 

survey for SEC property and establishes criteria for determining an individual's 

financial liability for loss of or damage to SEC-owned or -controlled property. 

SECR 10-15 (Rev. 1), Acquisitions Contract Administration Positions 

(August 12, 2009). Establishes uniform policies and procedures for the 

appointment, termination, and responsibilities of Contracting Officer 

Representatives and other contract administration positions at the SEC.

Government Accountability Office, Executive Guide: Best Practices in 

Achieving Consistent, Accurate Physical Counts of Inventory and Related 

Property, GAO-02-447G, March 2002. Describes fundamental practices and 

procedures used in the private sector to achieve consistent and accurate 

physical counts; summarizes fundamental principles successfully implemented 

by companies recognized for outstanding inventory management; and explains 

and describes leading practices from which the federal government might draw 

lessons and ideas. 
Appendix III

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 25

Office of Management and Budget, Memorandum for Chief Acquisition 

Officers Senior Procurement Executives: Revisions to the Federal 

Acquisition Certification for Contracting Officer Representatives (FACCOR), September 6, 2011. Prescribes revisions to the federal acquisition 

certification for Contracting Officer Representatives, including requirements for 

certification, recertification, and a new title for the position formerly known as 

contracting officer technical representatives.

Committee of Sponsoring Organizations of the Treadway Commission, 

Internal Control—Integrated Framework, 1992. Provides principles-based 

guidance for designing and implementing effective internal controls, 
Appendix IV

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 26

List of Recommendations

Recommendation 1:

The Office of Administrative Services (OAS), in conjunction with the Office of 

Information Technology (OIT), should revise SECR 9-3, Report of Survey 

Program and SECR 9-2, Property Management Program, and clearly define 

property that is designated as Government Furnished Property (GFP). OAS and 

OIT should further identify in SECR 9-3 and 9-2 the particular circumstances that 

are needed to meet the GFP requirements in accordance with Part 45 of the 

Federal Acquisition Regulation.

Recommendation 2:

The Office of Information Technology (OIT) should revise its policy to specify how 

often the office will conduct wall-to-wall inventories of the Securities and 

Exchange Commission’s information technology equipment and how frequently 

the Configuration Management Database (CMDB) should be updated. In 

performing the inventories, OIT should ensure that:

• All relevant fields related to asset management in the CMDB are 

accurate and properly completed, including verifying that 

individuals using the property items are properly identified within 

the database; 

• Equipment in regional offices is included in the wall-to-wall 

inventory; and

• Fields in the CMDB that capture contract numbers and contract 

expiration dates using the Active Directory. 

Recommendation 3:

The Office of Information Technology (OIT) should coordinate with the 

Contracting Officer Representative or other Property Accountability Officer, as 

designated in the contract, to ensure that government issued property items are 

properly returned to the OIT and the items are promptly removed from the 

Configuration Management Database when the contractor is no longer using it or 

when the contract is no longer active. 
Appendix IV

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 27

Recommendation 4: 

The Office of Information Technology (OIT) should develop and implement 

procedures for monitoring information technology equipment at the regional 

offices that is communicated to appropriate personnel. These procedures should 

include the regional office’s roles in monitoring information technology equipment

issued to contractors, including their responsibilities when a contractor employee 

exits a contract or when the equipment is moved to a new location. 

Recommendation 5: 

The Office of Information Technology (OIT) should revise its policies and 

procedures to establish clear accountability within the Asset Management Branch 

that is associated with properly tracking and monitoring information technology 

equipment, including documenting the issuance and receipt of information 

technology equipment to specific Commission contractors. 

Recommendation 6: 

When the Office of Information Technology completes the 2012, wall-to-wall 

inventory of information technology equipment, it should use this information to 

establish a baseline of the equipment in the Configuration Management 

Database. 

Recommendation 7: 

The Office of Administrative Services, in conjunction with the Office of 

Information Technology, should develop periodic training for Contracting Officers, 

Contract Specialists, and Contracting Officer Representatives that clearly defines 

and addresses their responsibilities related to government furnished property 

consistent with Part 45 of the Federal Acquisition Regulation, Government 

Property and SECR 9-2, Property Management Program. 
Appendix IV

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 28

Recommendation 8: 

The Office of Administrative Services should ensure when the Securities and 

Exchange Commission issues Government Furnished Property to contractors, 

the Contracting Officer (and where appropriate the Contract Specialist), includes 

language in the contract that specifies:

• The name of the equipment, 

• What equipment will be retained, disposed of, or returned to the 

government, 

• When the equipment will be disposed of or returned to the 

government, and

• Who can accept the returned equipment. 

Recommendation 9: 

The Office of Information Technology should issue Government Furnished 

Property to contractors only after it obtains proof that the vendor’s contract has 

language authorizing the contractor to receive the equipment. 

 
0 

Appendix V 

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 29

Management Comments 

MEMORANDUM 

TO: Jacqueline Wilson, Assistant Inspector General for Audits, Office of 

Inspector General 

FROM: Jayne L. Seidman, Acting Director 

SUBJECT: SEC's Controls Over Govemment Fumlshed Equipment and Contractor 

Acquimd Property, Report No. 503 

DATE: March 23,2012 

This memorandum is in response to the Office of Inspector General's (DIG) Draft 

Report No. 503, titled SEC's Controls Over Govemment Fumished Equipment and 

Contractor Acquired Property. Thank you for the opportunity to review and respond to 

this report. . 

OIG Recommendation 1. The Offlce of Administrative Services (OAS), in conjunction 

with the Offlce of Informat/on Technology (011), should revise SECR 9-3, Report of 

Survey Program and SEeR 9-2, Property Management Program, and clearly define 

property that is designated as Govemment Fumished Property (GFP). OAS and OIT 

should further identify in SECR 9-3 and 9-2 the particular circumstances that are 

needed to meet the GFP requirements in accordance with Part 45 of the Federal 

Acquisition Regulation (FAR). . 

The Office of Administrative Services (DAS) concurs. DAS will coordinate with OIT in 

revising SECR 9-3, Report of Survey Program and SECR 9-2, Property Management 

Program to incorporate the definition of Govemment Fumished Property and clarify that 

the requirements of FAR Part 45 do not apply to 

(1) Govemment property provided under any statutory leasing authority, except as to 

non-govemment use of property under FAR 45.301 (f); 

(2) Property to which the govemment has acquired a lien or title solely because of 

partial, advance, progress, or perfOrT!lance based payments; 

(3) Disposal of real property; 

(4) Software and intellectual property; or 

(5) Govemment property that Is incidental to the place of performance, when the 

contract requires contractor personnel to be located on a govemment site or 

Installation, and when the property used by the contractor within the location 

remains accountable to the government. Hems considered to be incidental to the 

place of performance include, for example, office space, desks, chairs, 

telephones, computers, and fax machines. 
Appendix V 

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 30

OIG Recommendation 7. The Office of Administrative Services, in conjunction with the 

Office of Infonnation Technology, should develop periodic training for Contracting 

Officers, Contract Specialists, and Contracting Officer Representatives that clearly 

defines and addresses their responsibilities related to government furnished property 

consistent with Parl 45 of the Federal Acquisition Regulation, Governrnent Property and 

SECR 9-2, Properly Manegement Program. 

The Office of Administrative Services (OAS) concurs. OAS will work with the Office of 

Infonnation Technology to develop periodic training consistent with FAR Part 45, for 

Contracting Officers, Contract Specialists, and Contracting Officer Representatives who 

have Government Furnished Property responsibilities. The training will clearly define 

and address assigned responsibilities relating to government furnished property. 

OIG Recommendation 8. The Office of Administrative Services should ensure when 

the Commission issues Government Furnished Property to contractors, the Contracting 

Officer (and where appropriate the Contract Specialist), includes language in the 

contract that specifies: 

• The name of the equipment, 

• What equipment will be retained, disposed of, orreturned to the government, 

• When the equipment will be disposed of or returned to the government, and 

• Who can accept the returned equipment. . 

The Office of Administrative Services (OAS) concurs. OAS will include information 

including the specified Items in any contracts which contain Government Furnished 

Property. 
Appendix V 

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 31

1 

MEMORANDUM 

TO: Jacqueline Wilson, Assistant Inspector General for Audits, Office of 

Inspector General \jJ' 0 \) 

FROM: Thomas A. Bayer, Director, Office of Information TechnoloA. {OIT)J\ 

RE: SEC's Controls Over Government Furnished EqUipmentJn\~actor Acquired Property, Report No. 503 

DATE: March 26, 2012 

This memorandum is in response to the Office of Inspector General's (OIG) Draft 

Report No. 503, SEC's Controls Over Government Furnished Equipment and 

Contractor Acquired Property. Thank you for the opportunity to review and respond to 

this report. 

orG Recommendation 1. The Office of Administrative Services (OAS), in conjunction 

with the Office of Information Technology (OIT), should revise SECR 9-3, Report of 

Survey Program and SECR 9-2, Property ManagementProgram, and clearly define 

property that is designated as Government Furnished Property (GFP). OAS and OIT 

should further identify in SECR 9-3 and 9-2 the particular circumstances that are 

needed to meet the GFP requirements in accordance with Part 45 of the Federal 

Acquisition Regulation (FAR). . 

orT concurs with this recommendation. 

",,0-k--C 

orG Recommendation 2. The Office of Information Technology (OIT) should revise its 

policy to specify how often the office will conduct wall-to-wall inventories of the 

Securities and Exchange Commission's information technology equipment and how 

frequently the Configuration Management Database (CMDB) should be updated. In 

performing the' inventories, OIT should ensure that: 

• All relevant fields related· to asset management in the CMDB are accurate and 

properly completed, including verifying that individuals using the property items 

are properly identified within the database; 

• Equipment in Regional Offices is included in the wall-ta-wall inventory; and 

• Fields in the CMDB that capture contract numbers and contract expiration dates 

using the Active Directory. 

OtT concurs with this recommendation. 
Appendix V 

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 32

2 

OIG Recommendation 3. The Office of Information Technology (OIT) should 

coordinate with the Contracting Officer Representative or other Property Accountability 

Officer, as designated in the contract, to ensure that government issued property items 

are properly returned to the OIT and the items are promptly removed from the 

Configuration Management Database when the contractor is no longer using it or when 

the contract is no longer active. 

OIT concurs with this re=mmendation. 

OIG Recommendation 4. The Office of Information Technology (OIT) should develop 

and implement procedures for monitoring information technology equipment at the 

Regional Offices that is communicated to appropriate personnel. These procedures 

should include the Regional Office's roles in monitoring information technology 

equipment issued to contractors, including their responsibilities when a contractor 

employee exits a contract or when the equipment is moved to a new location. 

OIT concurs with this recommendation. 

OIG Recommendation 5. The Office of Information Technology (OIT) should revise its 

poliCies and procedures to establish clear accountability within the Asset Management 

Branch that is associated with properly tracking and monitoring information technology 

equipment, including documenting the issuance and receipt of information technology 

equipment to specific Securities and Exchange Commission contractors. 

OIT concurs with this recommendation. 

OIG Recommendation 6. When thfi Office of Information Technology completes the 

2012, wall-to-wall inventory of information technology equipment, it should use this 

information to establish a baseline of the equipment in the Configuration Management 

Database. 

·OIT concurs. with this recommendation. 

OIG Recommendation 7. The Office of Administrative Services, in conjunction with the 

Office of Information Technology, should develop periodic training for Contracting 

Officers, Contract Specialists, and Contracting Officer Representatives that clearly 

defines and addresses their responsibilities related to government furnished property 

consistent with Part 45 of the Federal Acquisition Regulation, Government Property and 

SECR 9-2, Property Management Program. 

OIT concurs with this recommendation. 
Appendix V 

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 33

OIG Recommendation 9. The Office of Information Technology should issue 

Government Furnished Property to contractors only after it obtains proof that the 

vendor's contract has language authorizing the contractor to receive the equipment. 

OIT concurs with this recommendation. 

3 
Appendix VI

SEC Controls Over GFE and CAP March 28, 2012

Report No. 503

Page 34 

OIG Response to Management’s Comments

OIG is pleased OAS and OIT concurred with all of the report’s recommendations. 

We are also encouraged that OAS and OIT indicated they will take prompt action 

to address the areas of concern we identified in this report. We believe OAS and 

OIT’s full implementation of OIG’s recommendations will result in significant 

improvements to SEC’s management controls over government furnished 

equipment and contractor acquired property. 
Audit Requests and Ideas

The Office of Inspector General welcomes your input. If you would like to request an 

audit in the future or have an audit idea, please contact us at:

U.S. Securities and Exchange Commission

Office of Inspector General

Attn: Assistant Inspector General, Audits (Audit Request/Idea)

100 F Street, N.E.

Washington D.C. 20549-2736

Tel. #: 202-551-6061

Fax #: 202-772-9265

Email: oig@sec.gov

Hotline 

To report fraud, waste, abuse, and mismanagement at SEC, contact the 

Office of Inspector General at:

Phone: 877.442.0854

Web-Based Hotline Complaint Form:

www.reportlineweb.com/sec_oig