u.s. COMMODITY FUTURES TRADING COMMISSION

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5110

Facsirnile: (202) 418-5522

Office of the

Inspector General

MEMORANDUM

TO:

FROM:

Gary Gensler

Chairman

A. Roy Lavik Q [) £-

Inspector General

DATE: May 25,2010

SUBJECT: Inspection OfCFTC's Disposal Of

Surplus Information Technology Equipment

Executive Summary

The Office ofthe Inspector General(OIG) conducted an inspection ofthe CFTC's Disposal of

Surplus Information Technology Equipment. The OIG found that

• We were able to account for 1184 items or 99% ofthe selected sample ofsurplus

Information Technology assets.

• One regional office was able to supply documentary evidence that 88 out of 88 surplused

Information Technology assets that contain a data storage device were wiped clean

("sanitized") prior to its shipment to General Services Administration. However for other

Information Technology assets containing a data storage device, located in three other

offices, we found that the CFTC had no available record to confirm that those surplus

assets were sanitized by agency employees as required by CFTC disposal policy.

Recommendation

• The Office ofInformation Technoloy Services Asset Manager should confirm, document,

and retain evidence that Information Technology assets which contain a data storage

device were sanitized prior to shipment to General Services Administration or any

outside party.

Management Response

• Management has reviewed and accepted this recommendation

Attached is the full report.
Background

In Fiscal Year 20091 the Commodity Futures Trading Commission(CFTC) initiated a technology

refresh2 of all Information Technology(IT) equipment provided to employees.3 Consequently,

the replaced equipment, e.g. personal computers4

, computer monitors, and other electronic

equipment became surplus equipment. Once an agency declares personal property to be in

excess oftheir need the property is transferred to the General Services Administration(GSA)

which then follows established guidelines stated in the Federal Management Regulation (FMR)s

for disposing surplus equipment. Alternatively, Executive Order 129996 permits an agency to

donate excess electronic equipment directly to needy schools, which the agency elected to do for

IT assets in the New York, Chicago, and Kansas City offices.

In December 2009, this Office received an anonymous allegation ofimproper disposal ofsurplus

IT equipment. The allegation did not name any CFTC employees involved in the alleged

improper disposal. Because the allegation was vague, and because the source could not be

contacted for more information, we decided it would be most appropriate to conduct this

inspection.

Objectives

• One objective was to examine agency records and verify that the agency had properly

accounted for and disposed selected surplus equipment related to the information

technology refresh.

• Another was to review the internal controls associated with the disposal process for

agency IT assets.

Scope and Methodology

We limited this inspection7 to FY2009 records for IT assets8

• We undertook actual verification

of each unique asset identified as surplus. In order to achieve our objective we acquired a copy

ofthe agency's inventory of all IT equipment subject to replacement during the upgrade.

1 October 1, 2008 to September 31, 2009

2 In November 2004 the Office ofInformation Resources Management upgraded agency personal computers to

Windows XP and Office 2003. See Memo from H. Schultz to All DC dated 11-18-04. Also see Memo from M.

Bolinger to All CFTC dated 10-1-04.

3 See Memo to All CFTC from D.C. OITS Customer Support Center dated 3-26-08; also see Memo to All CFTC

from F. Dragotto, Associate Director for Customer Services dated 12-22-08 regarding New Vista Desktop Rollout

Plans.

4 We are referring to computer processors-when appropriate we will identify specific equipment such as monitors.

S See Federal Management Regulation (FMR) (41 CFR Chapter 102 Subchapter B "Personal Property"). For

donation ofsurplus personal property see 41 CFR Part 102-37.

6 See Executive Order 12999,61 FR 17227 (April 17, 1996).

7 "An inspection includes evaluations, inquiries and similar types ofreviews that do not constitute an audit or

investigation. An inspection evaluates programs and activities for the purpose ofproviding information to managers

for decision making; making recommendations for improvements to programs, policies, or procedures; and

2
Operationally, the Office ofInformation Technology (OITS) identifies and replaces all IT

equipment subject to this technology refresh and then transfers the surplus equipment to the

Office ofManagement Services (OMO). OMO is then charged with disposing the surplus

equipment. During FY2009 OMO transferred all surplus equipment located in the headquarters

office to the GSA. Consequently, we obtained from GSA a listing of all equipment received

from CFTC. For donated equipment to needy schools we contacted9 the schools designated to

receive the surplused asset. In order to verify the accuracy of each list we contacted the

individual who acknowledged receiving the IT equipment. We cross checked each asset listed in

the different lists to its final destination.

Results

For FY2009 CFTC surplused 1219 information technology assets. These assets consisted of

personal computers, monitors, laptops, servers, scanners, printers, switches, enclosures, and

miscellaneous IT items.

We examined transfer data for 1196 IT assets consisting of personal computers, laptops, servers,

and enclosures(we did not examine surplused personal communication devices such as

Blackberry smartphones). These items were located in 4 different offices ofthe agency and were

transferred to the GSA and several educational entities that met requirements ofExecutive Order

12999.

We were able to account10 for 118411 items or 99% ofthe selected sample ofsurplus assets. All

11 itemsl2 not verified as disposed were initially recognized as CFTC assets and it appears that

these assets were disposed of, but documentation was not completed or retained. For valuing

these assets the GSA relies on acqisition cost for these items. That cost, as determined by GSA,

was slightly more than $1.6 million dollars. However, CFTC had fully depreciated these assets

to a current value of zero.

The Government Accountability Office's Standards/or Internal Controls in the Federal

Government13 (GAO Standards) state that duties and responsibilities for authorizing,

processing, recording, and reviewing transactions should be separated among individuals.

identifying where administrative action may be necessary." (See Quality Standards for Inspections January 2005

page i)

8 Smaller dollar value peripheral equipment such as: PC stands, keyboard trays, speakers, cables, and docking

stations were not verified.

9 GSA was the official donor ofthe equipment. In the regional offices the schools picked up the equipment from the

regional office. Therefore we decided to contact the schools by phone and some did not respond to the inquiry. The

schools are not obliged to respond since the former CFTC computers were donated by the GSA.

10 We directly contacted the designated recipients of each individual asset to verify that they actually received the

surplus equipment.

11 Not including one duplicate asset which resulted in reducing our tally from 1185 to 1184.

12 Total items count is 1196 which consist of 1184 verified+11 not verified and 1 item counted twice.

13 GAO/AIMD-OO-2I.3.l Standards for Internal Control in the Federal Government (11/99) page 14

3
We found adequate separation of duties in the process for releasing surplus IT assets to external

entities.

Also, as mentioned in the GAO standards14, "internal control and all transactions and other

significant events need to be clearly documented, and the documentation should be readily

available for examination;" we found appropriate documentation oftransactions and internal

control relating to the disposal ofIT assets.

One regional office15 was able to supply documentary evidence that 88 out of 88 surplused IT

assets that contain a data storage device were wiped clean ("sanitized") prior to its shipment to

GSA. However, for other IT assets, located in three16 other offices, containing a data storage

device we found that the CFTC had no available record to confirm that those surplus assets were

sanitized by agency employees as required by CFTC disposal policy.

Recommendation

The OITS Asset Manager17 should confirm, document, and retain evidence that IT assets which

contain a data storage device were sanitized prior to shipment to GSA or any outside party.

14 GAOlAIMD-00-21.3.1 Standards for Internal Control in the Federal Government (11/99) page 15

IS Chicago Regional Office

16 The offices are New York, Washington, and Kansas City.

17 See CFTC Property Inventory Management System Policy and Procedure Guide dated 7-28-08 page 9.

4