U.S. RAILROAD RETIREMENT BOARD

OFFICE OF INSPECTOR GENERAL 

Railroad Retirement Board Did 

Not Implement Sufficient 

Internal Controls in the Mobile 

Phones Deployed as a Result of 

the Pandemic

Report No. 22-07 March 17, 2022
OFFICE OF INSPECTOR GENERAL

U.S. RAILROAD RETIREMENT BOARD

Railroad Retirement Board Did Not Implement Sufficient Internal Controls in 

the Mobile Phones Deployed as a Result of the Pandemic

Report Summary March 17, 2022 Report No. 22-07

What RMA Found

RMA Associates, LLC (RMA) determined that the Railroad 

Retirement Board (RRB) did not implement sufficient internal 

controls in the mobile phones deployed as a result of the 

pandemic. RMA determined that RRB did not have a records 

management and retention system over electronic records or 

updated policies in place for the mobile phones. In addition, 

RRB telecommuting policies were outdated and personal 

usage policies were inconsistent. As a result, a portion of the 

funding associated with the mobile phone deployment could 

have been put to better use.

RMA also determined that the RRB’s inability to properly 

establish and implement the mobile phone program was due 

to the following five findings: (1) no records management 

policies; (2) inconsistencies in RRB internal guidance; (3) lack 

of sufficient internal controls over mobile phones deployed;

(4) incomplete and inaccurate mobile phone records; and

(5) lack of records management system.

What RMA Recommends

To address weaknesses identified in this audit, RMA made 

one recommendation to the Director of Administration and

ten recommendations to the Bureau of Information Services.

Specifically, RMA conducted a cost-benefit analysis and 

identified $310,359 in funds that could have been put to 

better use. This calculation was based on the total costs 

associated with mobile phones not used and usage outside of 

core hours.

RRB management concurred with six recommendations, 

partially concurred with two recommendations and did not 

concur with three recommendations.

What We Did

The Office of Inspector General (OIG) for 

the RRB engaged RMA to conduct a 

performance audit of the RRB’s mobile 

phones deployed as a result of the 

pandemic. This audit was conducted in 

accordance with the performance audit 

standards established by generally 

accepted government auditing standards. 

RMA is responsible for the audit report 

and the conclusions expressed therein. 

RRB OIG does not express any assurance 

on the conclusions presented in RMA’s 

audit report.

The audit objectives were to: 

(1) determine if mobile phones purchased 

and deployed as a result of the pandemic 

comply with RRB mobile device policies 

including records retention for voice mail, 

text messages, photographs, etc.; 

(2) conduct a cost benefit analysis for the 

cell phones that would include 

identification of non-usage of cell phones 

and extensive personal usage; (3) assess 

the necessity for the mobile phone based 

on cell phone usage tied to employee 

positions within the agency; (4) assess the 

types of applications downloaded to the 

mobile phones and determine if they are 

appropriate for business purposes and if 

approvals were required and provided; 

and (5) assess whether agency records of 

mobile phone assignment are accurate 

and complete.

The scope of the audit was the period of 

March 2020 through September 2021.
Railroad Retirement Board (RRB)

Office of Inspector General (OIG)

Railroad Retirement Board Did Not Implement Sufficient 

Internal Controls in the Mobile Phones Deployed as a 

Result of the Pandemic

Performance Audit Report

Contract No: GS23F016AA

Order No: 140D0421F0718

RMA Associates, LLC

1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

Fax: (703) 852-7272

www.rmafed.com
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page i

Inspector General

Railroad Retirement Board

Chicago, IL

March 17, 2022

RMA Associates, LLC (RMA) conducted a performance audit of the Railroad Retirement Board 

(RRB) Mobile Phones Deployed as a Result of the Pandemic.

Our audit objectives were to 1) determine if mobile phones purchased and deployed as a result of 

the pandemic comply with RRB mobile device policies including records retention for voice mail, 

text messages, photographs, etc.; 2) conduct a cost benefit analysis for the cell phones that would 

include identification of non-usage of cell phones and extensive personal usage 3) assess the 

necessity for the mobile phone, for the entire population of cell phones, based on cell phone usage 

tied to employee positions within the agency; 4) assess the types of applications downloaded to 

the mobile phones and determine if they are appropriate for business purposes and if approvals 

were required and provided via a statistically valid random sample; and 5) assess whether agency 

records of mobile phone assignment are accurate and complete for the entire population of cell 

phones.

We conducted this performance audit in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to obtain sufficient, 

appropriate evidence to provide a reasonable basis for our findings and conclusions based on our 

audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives.

As a result of our audit, we found the following for each objective:

Objective RMA Assessment

1. Determine if mobile phones purchased and deployed as a result of

the pandemic comply with RRB 

mobile device policies including 

records retention for voice mail, 

text messages, photographs, etc.

We did not find evidence of record retention requirements for mobile phones after reviewing RRB’s policies. Through inquiry, RRB confirmed they did not have 

the software capabilities to retain electronic records.

2. Conduct a cost benefit analysis for 

the cell phones that would include 

identification of non-usage of cell 

phones and extensive personal usage.

We conducted a cost-benefit analysis and identified 

$310,359 in funds that could have been put to better use. 

This calculation was based on the total costs associated 

with mobile phones not used and usage outside of core 

hours.

3. Assess the necessity for the mobile 

phone, for the entire population of 

cell phones, based on cell phone 

usage tied to employee positions 

within the agency.

We tested RRB’s iPhone inventory and call detail records for the population of phones to assess mobile phone 

usage. We determined mobile phones were assigned but 

not used for 255 of 774 phones when analyzing the September 2021 call detail, representing 33% of the population.
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page ii

Objective RMA Assessment

4. Assess the types of applications 

downloaded to the mobile phones 

and determine if they are appropriate for business purposes and if approvals were required and provided via a statistically valid random sample.

We compared the entire population of applications 

downloaded onto the mobile phones to the 1) list of acceptable applications and 2) RRB Banned Applications 

list. We categorized each downloaded application into 

one of eight categories: Commerce, Messaging/social 

media, Gambling, News, Entertainment/Gaming, Office 

Applications, Video Conferencing, and Other. We determined 696 downloaded applications (of the total 725 

applications downloaded) were not found on the lists. Of 

these 696, seven were gambling applications, explicitly 

prohibited in RRB policy. In addition, no approvals 

were required, and no controls were in place to prevent 

downloading of applications.

5. Assess whether agency records of 

mobile phone assignment are accurate and complete for the entire 

population of cell phones.

We assessed agency records of mobile phone assignment and found instances of incomplete and inaccurate 

records.

Information on our findings and recommendations are included in the accompanying report.

Respectfully,

RMA Associates, LLC
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page i

Table of Contents

Introduction..................................................................................................................................... 1

Objectives, Scope, and Methodology..................................................................................................1

Background.............................................................................................................................................3

Results of Audit .............................................................................................................................. 4

No Records Management Policies.......................................................................................................5

Recommendations.........................................................................................................................5

Inconsistencies in RRB Internal Guidance.........................................................................................6

Recommendations.........................................................................................................................7

Lack of Sufficient Internal Controls Over Mobile Phones Deployed.............................................8

Recommendations.........................................................................................................................9

Incomplete and Inaccurate Mobile Phone Records.........................................................................10

Recommendations.......................................................................................................................11

Lack of Records Management System..............................................................................................11

Recommendations.......................................................................................................................11

Appendix I: Management’s Comments........................................................................................ 13

Appendix II: Cost Benefit Analysis.............................................................................................. 16
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 1

Introduction

This report presents the results of RMA Associates, LLC’s (RMA) performance audit of the 

Railroad Retirement Board (RRB) Mobile Phones Deployed as a Result of the Pandemic.

Objectives, Scope, and Methodology

Objectives

The objectives of this audit were to:

1. Determine if mobile phones purchased and deployed as a result of the pandemic comply 

with RRB mobile device policies including records retention for voice mail, text messages, 

photographs, etc.;

2. Conduct a cost benefit analysis for the cell phones that would include identification of nonusage of cell phones and extensive personal usage;

3. Assess the necessity for the mobile phone, for the entire population of cell phones, based 

on cell phone usage tied to employee positions within the agency;

4. Assess the types of applications downloaded to the mobile phones and determine if they 

are appropriate for business purposes and if approvals were required and provided via a 

statistically valid random sample; and

5. Assess whether agency records of mobile phone assignment are accurate and complete for 

the entire population of cell phones.

Scope

The scope of the audit was mobile phones deployed by the RRB as a result of the pandemic during 

the period of March 2020 through September 2021.

Methodology

To address and accomplish the audit objectives, we used the following evidence-gathering and 

evidence-analysis techniques:

• Performed audit procedures to address the audit objectives in accordance with Generally 

Accepted Government Auditing Standards (GAGAS);

• Identified criteria from applicable laws, regulations, policies, and procedures, including 

GAGAS and the Government Accountability Office Green Book;

• Reviewed the prior OIG audit findings (Interim Report Regarding CARES Act 

Expenditures and Controls, RRB’s Telework Program Needs Improvement);

• Reviewed agency documentation to address the audit objectives;

• Reviewed RRB policies and procedures to identify record retention policies for voice mail, 

text messages, and photographs;
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 2

• Assessed the population of downloaded applications and software and determined appropriateness for business purposes;

• Calculated the total costs (e.g., implementation and monthly recurring) for the population 

of mobile phones as part of the cost benefit analysis;

• Reviewed invoices for the population of mobile phones to identify and calculate the total 

non-usage; and non-usage tied to employee grade;

• Reviewed invoices to identify and analyze call outliers, such as weekend and night calls to 

identify personal usage;

• Held discussions with applicable management, staff, and key personnel; and

• Conducted a cost benefit analysis for the mobile phones that includes identification of nonusage.

We compared mobile phones purchased as part of the CARES Act and the RRB employee position 

index (Table 1). We also evaluated agency records and internal policies to determine compliance 

with RRB guidance and federal regulations.

Table 1: CARES Act Inventory Population1

Pay 

Grade

Number of Mobile 

Device Users

ES-00 1

GS-04 5

GS-05 37

GS-06 7

GS-07 64

GS-08 49

GS-09 29

GS-10 96

GS-11 107

GS-12 162

GS-13 72

GS-14 48

GS-15 14

Spare 83

Total 774

Upon our assessment of the CARES Act inventory, we found 744 of 774 mobile phones (96%) 

purchased in March 2021 were added to the organization on or after July 2021.

We leveraged prior audit reports performed by RRB OIG relevant to mobile phones, CARES Act 

funding, and telework program controls. We reviewed their internal guidance to assess whether 

appropriate internal control policies and procedures were in place and assessed risks associated 

with the mobile phones.

1 General Schedule (GS) is the predominant pay scale within U.S civil services and includes most white-collar 

personnel positions. Executive Service (ES) includes senior leadership or senior personnel.
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 3

We researched RRB’s mobile device management (MDM) software, BlackBerry Unified Endpoint 

Manager (UEM) and Microsoft Intune and identified the controls available to RRB management. 

To assess data reliability, we conducted a BlackBerry UEM walkthrough to 1) assess controls 

associated with the existing data; and 2) review information systems maintained by RRB. We 

determined that the data from the information systems were sufficiently reliable for the purposes 

of this report. During our discussion, management explained how the devices are in the process of 

migrating from Blackberry UEM to Microsoft Intune.

RMA conducted this performance audit in accordance with GAGAS. Specifically, we used 

chapters 8 and 9 of GAGAS (GAO-21-368G). In complying with GAGAS requirements for 

performance audits, we obtained sufficient appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. We believe that the evidence provides 

a reasonable basis for our findings and conclusions based on our audit objectives.

We conducted our fieldwork at RMA headquarters in Arlington, Virginia from September 2021 

through February 2022.

Background

The U.S. Railroad Retirement Board (RRB) is an independent agency in the executive branch of 

the federal government. The RRB’s primary function is to administer comprehensive retirement, 

survivor, unemployment, and sickness insurance (UI/SI) benefit programs for railroad workers and 

their families under the Railroad Retirement Act and the Railroad Unemployment Insurance Act 

(RUIA). These programs provide income protection during old age in the event of disability, death, 

temporary unemployment, and sickness.

As a result of the pandemic, the Coronavirus Aid, Relief, and Economic Security (CARES) Act 

was signed into law on March 27, 2020, boosting unemployment and sickness benefits for railroad 

workers impacted by the pandemic. The CARES Act awarded RRB a $5 million appropriation to 

prevent, prepare for, and respond to coronavirus. RRB approved a plan to purchase and deploy 

mobile phones to RRB employees to improve mobility of the workforce with this funding. RRB 

stated that there was uncertainty regarding its ability to support expansion and sustainment of 

telework for most agency employees. RRB indicated that the acquisition of mobile phones would 

serve as a secondary means of communications and connectivity to RRB resources to continue 

work should the primary means of communications and connectivity to RRB not be available.

As part of this plan, the RRB purchased 685 mobile phones that were received in RRB’s inventory 

as of April 17, 2020 and awarded a contract for mobile phone deployment in July 2020. This 

contract initially called for mobile phone completion by August 31, 2020, to deploy a minimum 

of 500 mobile phones. The initial operating plan did not include the resources necessary to deploy 

the mobile phones to RRB employees. The contract was modified to include the necessary 

resources to deploy the phones delaying the deployment completion until November 2020, 

approximately six months after the phones were received by RRB.
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 4

Results of Audit

RRB did not implement sufficient internal controls in the mobile phones deployed as a result of 

the pandemic during the scope of our audit (March 2020 to September 2021). RRB did not have a 

records management and retention system over electronic records or updated policies in place for 

the mobile phones. In addition, RRB telecommuting policies were outdated and personal usage 

policies were inconsistent. As a result, a portion of the funding associated with the mobile phone 

deployment could have been put to better use. The results of assessing the audit objectives for the 

RRB’s mobile phone program are as follows:

• Objective 1: We did not find evidence of record retention requirements for mobile phones 

after reviewing RRB’s policies. Through inquiry, RRB confirmed they did not have the 

software capabilities to retain electronic records.

• Objective 2: We conducted a cost-benefit analysis and identified $310,359 in funds that 

could have been put to better use. This calculation was based on the total costs associated 

with mobile phones not used and usage outside of core hours. (Appendix II: Cost Benefit 

Analysis).

• Objective 3: We tested RRB’s iPhone inventory and call detail records for the population 

of phones to assess mobile phone usage. We determined mobile phones were assigned but 

not used for 255 of 774 phones when analyzing the September 2021 call detail, representing 

33% of the population. (Table 4).

• Objective 4: We compared the entire population of applications downloaded onto the mobile phones to the 1) list of acceptable applications and 2) RRB Banned Applications list. 

We categorized each downloaded application into one of eight categories: Commerce, 

Messaging/social media, Gambling, News, Entertainment/Gaming, Office Applications, 

Video Conferencing, and Other. We determined 696 downloaded applications (of the total 

725 applications downloaded) were not found on the lists. Of these 696, seven were gambling applications, explicitly prohibited in RRB policy. In addition, no approvals were required and no controls were in place to prevent downloading of applications.

• Objective 5: We assessed agency records of mobile phone assignment and found instances 

of incomplete and inaccurate records.

The inability to properly establish and implement the mobile phone program was due to the 

following findings identified by RMA's completion of the audit objectives:

• No Records Management Policies;

• Inconsistencies in RRB Internal Guidance;

• Lack of Sufficient Internal Controls Over Mobile Phones Deployed;

• Incomplete and Inaccurate Mobile Phone Records; and

• Lack of Records Management System.
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 5

We provided additional details on these five findings in the following sections and provided 

recommendations to assist RRB in remediating them.

No Records Management Policies

RRB policies did not document records retention and management over electronic records. 

Through inquiry, RRB management verified they have records management policies over emails 

and retain call-detail summaries for three years through the Verizon Company Portal. Specifically, 

RRB management confirmed all Capstone officials are required to retain records for 25 years before transferring to National Archives and Records Administration (NARA) and non-capstone officials are required to retain records for 7 years before deleting. However, this was not documented

in their policies.

NARA expanded records retention requirements to include electronic records. RRB’s current 

policy does not explicitly address electronic records such as text messages, photographs, 

voicemail, and social media. RRB management found it difficult to update and implement 

NARA’s electronic requirements due to additional costs associated with the mobile phone 

program. However, the lack of records management can lead to mishandling and misusing of 

sensitive information and increase the potential threat of unauthorized use, alteration, concealment, 

or deletion of federal records.

Recommendations

RMA recommends the Bureau of Information Services:

1. Update their mobile phone policies to include and implement a NARA-approved records 

schedule and transfer procedures for electronic records associated with mobile phones; and

2. Submit a yearly affidavit to confirm electronic records associated with mobile phones have 

been identified and retained until the full transition into Microsoft Azure Cloud.

Management’s Comments:

RRB’s Bureau of Information Services partially concurred with Recommendation 1 with the 

following statement:

RRB will update polices related to mobile phones based upon information supplied by 

NARA for retention requirements related to mobile devices. RRB will work with mobile 

service provider to determine what retention options are available and will seek solutions 

based upon technology limitations.
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 6

RRB’s Bureau of Information Services did not concur with Recommendation 2 with the following 

statement:

All emails sent using mobile phones are already captured in the email system. RRB mobile 

devices are used to extend the capability for RRB employees to conduct aspects of official 

business (such as internal coordination and scheduling); however, all official business 

conducted is still required to be captured in already approved RRB systems of records.

RMA’s Response:

According to NARA Bulletin 2015-02, the Federal Records Act defined electronic records as 

“email and other electronic messaging systems that are used for purposes of communicating 

between individuals.” They list the types of electronic messaging in addition to emails, which 

include instant messaging, text messaging, and voicemail messaging. All these forms of electronic 

messages created or received during agency business are considered federal records. NARA 

suggests agencies develop policies that identify, manage, and capture electronic messages by 

updating policies when new tools are deployed, configuring electronic records, and using thirdparty services to automatically capture and produce the message. Regardless of the approach, RRB 

must have records schedules and transfer procedures implemented that cover all forms of 

electronic messages.

Inconsistencies in RRB Internal Guidance

RRB management did not update internal guidance consistent with the recent laws and regulations 

associated with telework programs and they did not adjust the policies to account for the impact 

associated with the COVID-19 pandemic. In addition, RRB’s internal policies and procedures

inconsistently defined personal usage of the mobile phones.

RRB did not define personal usage per our audit objectives. To evaluate personal usage, RMA 

proposed the implementation of core hours to assist RRB management in properly defining 

personal usage. Core hours are the designated time-period for all employees expected to work. 

RRB agreed to the proposed core hours below (Table 2) to accommodate all employees.

Table 2: RRB Core Hours

Core Hours Outside of Core 

Hours

5:00 AM 7:01 PM

7:00 PM 4:59 AM

To assess our audit objective, we tested the Verizon Wireless call detail summary report and found

2% of phone calls were made outside of the core hours.

We also reviewed OIG’s Telework Program audit report to help better understand the controls in 

place to ensure protection of privacy data, agency information, and compliance with telework laws 

and regulations. OIG found RRB’s Telecommuting/Mobile Computing Security Policy, dated 
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 7

May 27, 2009, was outdated since the Telework Enhancement Act of 2010 was enacted on 

December 9, 2010. During our audit, RRB management continued using the outdated policy over 

RRB’s mobile phone program.

Recommendations

RMA recommends that RRB’s:

3. Director of Administration define and communicate ‘personal usage’ establishing RRB’s 

core hours of 5:00 AM to 7:00 PM. Any usage outside of the core hours would be 

considered personal usage excluding business management purposes.

4. Bureau of Information Services 1) continue efforts to update the Telecommuting and 

Mobile Security Computing Policy with current laws and regulations and 2) develop a 

periodic monitoring control to assess personal usage and address it according to agency 

guidance.

Management’s Comments:

RRB’s Director of Administration did not concur with Recommendation 3 with the following 

statement:

RRB management does not concur that the Director of Administration should release a 

communication stating that all use of mobile devices outside of 5:00 am and 7:00 pm 

should automatically be considered personal use. Further, “business management 

purposes” is too vague a term to define with respect to audit closure. Frequently, staff of 

the RRB must communicate outside those hours with respect to lapses in funding, 

continuing resolutions, late breaking court decisions, COOP activity, severe weather 

alerts, agency operating status, time zone differences, and other definite official agency 

business. The Director of Administration agrees to release a statement to all employees 

reminding them of the RRB personal use policy.

Further, RRB’s Bureau of Information Services concurred with Recommendation 4.

RMA’s Response:

Per the audit objectives, RMA must assess the device usage of the mobile phones deployed within 

our scope, including non-usage and personal usage. Due to inconsistent policies, we worked with 

RRB to define parameters to test personal usage. RRB concurred with the RRB core hours during 

our audit. After discussing recommendations during the exit conference, RMA revised the 

recommendation to caveat the exclusion of “business management purposes.” In addition, RMA 

agrees to the Director of Administration releasing a personal usage reminder to all mobile phone

users until the current policies are updated and consistent with the other.
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 8

Lack of Sufficient Internal Controls Over Mobile Phones Deployed

The mobile phone program did not have an internal control system associated with the mobile 

phones. According to the 17 Principles of the Green Book, specific requirements are necessary to 

establish an effective internal control system. Specifically, there was no evidence of the following:

• Implementation of a risk profile/assessment to identify, analyze and respond to risks;

• Review and approval process for application and software download;

• Restrictions of certain applications and software;

• Controls to track and monitor inappropriate use and unusual activity;

• Logging of iPhone usage for compliance and auditing purposes; and

• Enforcement and monitoring completion of G-6 Acknowledgement form before obtaining 

the phone.

Through inquiry, RRB management explained they did not identify the mobile phones as an 

assessable unit (AU) during the onset of the pandemic. Because the phones were not designated as 

AUs within their agency, an effective internal control assessment was not performed. RRB has 

controls in place to monitor IOS and system updates on the mobile phones. If the device is not 

updated within a 30-day period, the device’s MDM capabilities are suspended. RRB is currently 

reviewing and updating the policy using Intune as the technical control.2

Further, two offices were handling the mobile phone deployment. Specifically, the Telecommunications office was responsible for the device shipment, while the users’ supervisors were responsible for enforcing the completion of the Employee Acknowledgement Statement. Coordination 

between the two offices was inconsistent and their roles and responsibilities were not documented 

in RRB’s G-6 Rules of Behavior Policy.

An ineffective internal control system and risk assessment may lead to a possibility of end-user 

misconduct and noncompliance with federal regulations. Without the active monitoring, tracking, 

and reporting of mobile device usage, deficiencies and violations are not detected, prevented, or 

corrected in a timely manner. Specifically, the lack of application restrictions, resulted in 

696 downloaded applications inappropriate for business purposes. Of these 696, seven were 

gambling applications, explicitly prohibited in RRB policy (Table 3).

2 Microsoft Intune will identify and block applications that fall under certain categories (e.g., gaming, gambling).
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 9

Table 3: Downloaded Applications Testing Results

Application Category Number of 

Applications

Number of 

Exceptions

Commerce 135 135

Messaging/Social Media 39 38

Gambling 7 7

News/Web Browser 40 38

Entertainment/Gaming 339 339

Office Applications 29 12

Video Conferencing 5 5

Other 131 122

Total 725 696

When we examined the Multi-Module Report, which tracks and monitors the completion of the 

Employee Acknowledgement Statement for the Rules of Behavior, 295 device users received their 

mobile phone before completing the form, a violation of RRB internal policies.

After testing mobile phone usage, 33% of the entire mobile phone population was not used and 

2% of minutes used were outside of core hours. As a result, RRB is incurring monthly cellular 

service costs on mobile phones issued to employee who do not require the mobile phone to perform 

normal job functions. We identified $310,359 in funds that could have been put to better use. This 

calculation was based on the total costs associated with mobile phones not used and usage outside 

of core hours.

Recommendations

RMA recommends the Bureau of Information Services:

5. Incorporate the mobile phones in an existing assessable unit and update their mobile phone 

policies to include documentation regarding the specific roles and responsibilities of each 

office overseeing the mobile phone program;

6. Enforce and execute a review and approval process for application and software download 

and restrict access to specified applications found in their RRB G-6 Rules of Behavior; and

7. Implement procedures to periodically track, log, and monitor iPhone usage and the 

completion of the G-6 Acknowledgement Statement.

Management’s Comments:

RRB’s Bureau of Information Services concurred with Recommendations 5, 6, and 7. Specifically, 

RRB included the following statements for Recommendations 5 and 6:

Recommendation 5: RRB will incorporate mobile devices into the Networking Services 

assessable unit. The telecommunications section transferred from Office of Administration 
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 10

to the Bureau of Information Services. As a result, mobile devices services are no longer 

split between two business units and the recommended action can now be instituted.

Recommendation 6: RRB will create an approved list of acceptable mobile applications 

and publish those on the “Company Portal” which is now available on the phone with our 

switch from BlackBerry to Microsoft Intune for mobile device management. Additionally, 

the RRB will only allow for approved Apps to be installed on the mobile device and Risk 

Management will monitor the mobile devices for unauthorized used [sic].

Incomplete and Inaccurate Mobile Phone Records

During our assessment of the mobile phones inventory and personnel position index, we 

determined RRB’s mobile phone records were incomplete and inaccurate. Specifically, we found 

the following errors:

Incomplete Records:

• Five instances where a mobile phone record had missing data elements (such as the part 

number, order number, date(s) added to organization and assigned to the mobile device 

management (MDM) server); and

• Five mobile phones were missing serial number information.

Inaccurate Records:

• Seventeen instances of phone records containing duplicate Subscriber Identity Module 

(SIM) numbers;

• Two instances of an RRB employee with multiple mobile phones;

• Three instances where a phone number was manually entered incorrectly; and

• Ten mobile users that could not be identified in RRB’s personnel position index.

Upon identifying these errors, RRB management was able to correct and update the following 

errors:

• Two instances of an RRB employee with multiple devices; and

• Ten mobile users that could not be identified in RRB’s personnel position index.

The Green Book outlines management requirements for an effective design of control activities; 

specifically, “Documentation and records are properly managed and maintained.”

Due to daily operational requirements and additional costs, RRB did not continually update the 

iPhone inventory to reflect personnel changes associated with attrition and the transition to remote 

working and telecommunication. Improper reporting of agency records may result in the misuse 

or misallocation of mobile phones.
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 11

Recommendations

RMA recommends the Bureau of Information Services:

8. Periodically review the mobile phone inventory for completeness and accuracy to include 

a comparison to RRB’s personnel position index.

9. Implement the use of unique identifiers between disparate data sets (e.g., mobile phone 

inventory, personnel position index) to facilitate comparisons and reconcile inconsistent 

information.

Management’s Comments:

RRB’s Bureau of Information Services concurred with both recommendations associated with this 

finding.

Lack of Records Management System

RRB lacks a records management and retention system over electronic records. During the onset 

of the pandemic, RRB did not have a practical solution for records retention of electronic records. 

Further, they did not have a system with automated records management capabilities. According 

to NARA's Universal Electronic Records Management (ERM) Requirements, agencies must manage all electronic records to avoid the possibility of unauthorized use, alteration, concealment, or 

deletion of federal records.

Other agencies utilize third-party cloud providers to sync text messages, photographs, and audio 

records. The syncing process generates a duplicate copy of the data and stores it so the data can be 

accessed from any device using a user identification and password. RMA noted that the integration 

of Microsoft Azure Cloud is part of RRB’s Legacy Systems Replatform Services (LSMS)

Information Technology (IT) Modernization Initiative. This cloud software falls under the thirdparty cloud service provider and contains the described capabilities.

Recommendations

RMA recommends the Bureau of Information Services:

10. Develop and implement a records management and retention system for electronic records.

11. Research the capabilities of RRB’s Microsoft Azure Cloud’s functionality to determine 

feasibility of incorporating the automated records management and retention capabilities 

to govern the mobile phones electronic records.
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 12

Management’s Comments:

RRB’s Bureau of Information Services did not concur with Recommendation 10 referring to the 

response for Recommendation 2:

All emails sent using mobile phones are already captured in the email system. RRB mobile 

devices are used to extend the capability for RRB employees to conduct aspects of official 

business (such as internal coordination and scheduling); however, all official business 

conducted is still required to be captured in already approved RRB systems of records.

RRB’s Bureau of Information Services partially concurred with Recommendation 11 with the 

following statement:

There are legal and cost implications to maintaining electronic records generated on 

mobile devices. The agency will likely be constrained by the capabilities of the service 

providers themselves and their legal requirements to provide such records. The RRB will 

confer with agency leadership to confirm compliance within these constraints and 

implications.

RMA’s Response:

In reference to our response for Recommendation 2, instant messaging, text messaging, and 

voicemails are classified as electronic records per the NARA guidance. All forms of electronic 

messages created or received during agency business are considered federal records. RRB should 

have records management and schedules that cover all forms of electronic messages. RMA 

understands the legal and cost implications to maintain electronic records. We continue to 

recommend RRB research the Microsoft Azure Cloud capabilities until a records management and 

retention system for electronic records is implemented.
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 13

Appendix I: Management’s Comments
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 14
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 15
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 16

Appendix II: Cost Benefit Analysis

We used RRB's iPhone inventory and September 2021 call detail records to test the mobile phone

usage in support of our cost benefit analysis. Please note, we did not use earlier invoices because 

phones were added sporadically. The September 2021 call detail was used to discern usage because 

September was the most comprehensive number of assigned users and all phones assigned within 

our audit scope. We tied each phone number in the RRB iPhone Inventory with the phone numbers 

in the call detail records.

During our usage testing, we determined mobile phones were assigned but not used for 255 of 774 

phones, representing 33% of the population (Table 4). Additionally, we identified 2% of usage 

was made outside of core hours.

Table 4: Mobile Phone Non-Usage Results

Pay 

Grade

Number of Mobile 

Phones

Number of Mobile 

Phones with No 

Usage

Percent of NonUsage by Grade

ES-00 1 - -

GS-04 5 4 80%

GS-05 37 16 43%

GS-06 7 5 71%

GS-07 63 31 49%

GS-08 49 24 49%

GS-09 31 10 32%

GS-10 96 16 17%

GS-11 106 15 14%

GS-12 162 40 25%

GS-13 72 13 18%

GS-14 48 7 15%

GS-15 14 - -

Spare 77 71 92%

N/A 6 3 50%

Total 774 255 33%

We calculated the total costs associated with the purchase and deployment of the iPhones and 

identified the percentage of 1) mobile phones issued and used, 2) mobile phones issued and not 

used, 3) mobile phones not issued and not used, 3 and 4) mobile phones not used and could not be 

identified in the CARES Act inventory list or position index within our scope. We believe the costs 

identified are funds RRB could put to better use (Table 5). Additionally, we identified 2% of cell 

phone usage was outside of work hours, with an additional $12,139.31 of funds put to better use.

3 These are spare and vacant mobile phones.
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 17

Table 5: Mobile Phone Usage Cost or Benefit

Description Number of 

Mobile Phones

Percent of 

Population

Cost () or Benefit 

()?

Mobile Phones Issued/Used 519 67.0% 

Mobile Phones Issued/Not Used 181 23.4% 

Mobile Phones Not Issued/Not Used 71 9.2% 

Mobile Phones Unidentified/Not Used4 3 0.4% 

RMA found the mobile phones program had a total cost of $905,185.47, with implementation costs 

of $340,560 (Table 6) and total monthly invoice costs of $564,625.47 during our period of review

(Table 7).

Table 6: Implementation Costs

One-Time Purchase Value

iPhone XR $250.00

Blackberry UEM $190.00

Cost per Mobile Phone $440.00

Multiplied by the Number of Mobile Phones 774

Total Implementation Cost $340,560.00

4 "Unidentified" means we could not determine whether the mobile phone was in scope due to inaccurate iPhone 

inventory. Through inquiry, we found these mobile phones belonged to prior RRB employees.
1005 N. Glebe Road, Suite 610

Arlington, VA 22201

Phone: (571) 429-6600

www.rmafed.com

Member of the American Institute of Certified Public Accountants’ Government Audit Quality Center

Page 18

Table 7: Monthly Invoice Costs

Monthly Invoice Value

March 20205 -

April 2020 $46,448.99

May 2020 $32,432.82

June 2020 $31,878.72

July 2020 $32,290.90

August 2020 $31,084.15

September 2020 $31,003.02

October 2020 $31,108.34

November 2020 $32,135.24

December 2020 $31,373.79

January 2021 $31,396.68

February 20216 $9,230.23

March 2021 $31,401.86

April 2021 $31,408.12

May 2021 $31,410.52

June 2021 $31,404.12

July 2021 $31,397.18

August 2021 $31,423.76

September 2021 $35,797.03

Total Invoice Costs $564,625.47

Mobile phones issued and used have total benefits of $594,826.14. The mobile phones not used

have the total costs of $298,220.02 (Table 8). The 2% of usage outside core hours accounts for an 

additional $12,139.31 of funds that could have been put to better use.

Table 8: Cost-Benefit Analysis Results

Description Calculations Value

Total Costs (Total Costs * Percent of Costs Identified) + Usage 

Outside Core Hours (Total Benefits * 2%) $310,359.33

Total Benefits (Total Costs *Percent of Benefits) - Usage of 

Outside of Core Hours (Total Benefits *2%) $594,826.14

Total $905,185.47

RMA determined $310,359.33 as funds that could have been put to better use. We noted this as 

the effect of finding 3: Lack of Sufficient Internal Controls; specifically highlighting the impact of 

no tracking, monitoring, and logging of usage and non-usage.

5 The CARES Act Inventory Verizon Account was activated 4/7/2020; therefore, we could not include March 2020 

invoice.

6 The reason for the change in cost for this month is each phone received a refund (1st Responder SP UNL Refund 

and Hotspot Refund).