FEDERAL MARITIME COMMISSION 

OFFICE OF INSPECTOR GENERAL 

Evaluation of the FMC’s 

Information Technology Inventory 

May 2018 

FINAL 
TABLE OF CONTENTS
	

PURPOSE....................................................................................................................................... 1
	

BACKGROUND ............................................................................................................................ 1
	

SCOPE AND METHODOLOGY .................................................................................................. 3
	

RESULTS IN BRIEF...................................................................................................................... 3
	

FINDINGS AND RECOMMENDATIONS................................................................................... 5 

MANAGEMENT RESPONSE MEMORANDUM.....................................................10 

 Office of Information Technology - Receiving IT Inventory into Inventory, May 2018....................13 

 Tracking Spreadsheet for Excessed Inventory........................................................................14 
 

 

 

 

 

 

PURPOSE
	

Your Internal Controls (contractor), on behalf of the Federal Maritime Commission (FMC), 

Office of Inspector General (OIG), conducted an independent evaluation of the quality, 

completeness, and accuracy of the FMC’s information technology (IT) inventory. Your Internal 

Controls’ evaluation focused on the FMC’s maintenance of the IT inventory, as well as the 

various policies and procedures governing the addition, deletion, and/or modification of IT 

inventory at the FMC. 

BACKGROUND 

The Federal Maritime Commission (FMC) is an independent Federal agency of the United States 

government responsible for regulating the U.S. international ocean transportation system for the 

benefit of the U.S. exporters, importers, and the U.S. consumer. The FMC’s mission is to ensure 

a competitive and reliable international ocean transportation supply system that supports the U.S. 

economy and protects the public from unfair and deceptive practices. 

The FMC is directed by five commissioners nominated by the President and confirmed by the 

Senate, each serving a staggered five-year term. No more than three members of the Commission 

may be from the same political party. The President designates one commissioner to serve as 

Chairman. For the last full fiscal year, Congress approved a 2017 budget of $27,490,000, and the 

agency was authorized 134 full-time equivalent positions. The majority of these employees are 

located in Washington, D.C., with a small number of personnel stationed in major U.S. seaport 

locations in Houston, Los Angeles, New Orleans, New York, Seattle, and South Florida. 

The FMC’s Office of Information Technology (OIT) is responsible for the overall management 

of the agency’s IT inventory. The OIT’s mission is to provide management, technical, and 

administrative support to the program operations of the Commission through information 

resources management; IT acquisitions; technologies and applications support; computer network 

infrastructure support; IT strategic planning and governance; web services support; documents 

and records management; and cyber security. The OIT maintains two separate IT inventory lists, 

as follows: (1) a Microsoft Excel IT inventory list that is updated throughout the year, and is also 

used to conduct an annual physical inventory of all IT equipment; and (2) an automated inventory 

1 
 

of all devices connected to the agency computer network maintained in the OIT’s help desk 

software. The OIT has several policies and procedures to manage IT equipment, to include 

procedures for excessing IT equipment, loss-theft procedures, loaner laptop procedures, 

procedures for conducting the annual physical inventory, and distribution and receipt of property. 

In recent years, the FMC has expended a considerable amount of money on IT acquisitions. 

Approximately $1.4 million has been expended from fiscal year 2015 through January 2018 on 

IT acquisitions, including desktop and laptop computers; servers; network storage; monitors; 

printers; among other expenditures. Examples of those expenditures were $93,004 for 50 laptops; 

$115,147 for 77 desktops; $12,124 for five color LaserJet printers; and $26,550 for a backup 

appliance; among other purchases. 

Effective internal controls are required for the accountability and safeguarding of IT equipment. 

For example, laptops are portable and easy to conceal, and may contain sensitive information. 

Consequently, laptops are at risk of loss and theft, and must be properly safeguarded and 

accounted for. Inventory records must be accurate and kept up-to-date to account for and 

safeguard IT equipment assets. 

The U.S. Government Accountability Office Standards for Internal Control in the Federal 

Government (known as the Green Book), provides the overall framework for establishing and 

maintaining an effective internal control system. Internal control comprises the plans, methods, 

policies, and procedures used to fulfill the mission, strategic plan, goals, and objectives of the 

agency. Internal control serves as the first line of defense in safeguarding assets. In short, internal 

controls help managers achieve desired results through effective stewardship of public resources. 

Management is responsible for designing controls to provide reasonable assurance of preventing 

or promptly detecting unauthorized acquisition, use, or disposition of assets. Among the types of 

control activities are the documentation of responsibilities through policies and procedures, 

management monitoring of the internal control system through ongoing monitoring and 

evaluation, and segregation of duties. 

2 
 

 

Management is responsible for determining the policies and procedures necessary to operate the 

process based on the objectives and related risks. In addition, ongoing monitoring is necessary 

and includes regular management and supervisory activities, comparisons, reconciliations, and 

other routine actions. Further, management divides or segregates key duties and responsibilities 

among different people to reduce the risk of error, misuse, or fraud. For example, this includes 

separating the responsibilities for authorizing purchases, processing and recording them, 

reviewing the transactions, and handling any related assets so that no one individual controls all 

key aspects of a transaction or event. If segregation of duties is not practical within an operational 

process because of limited personnel or other factors, management designs alternative control 

activities to address the risk of fraud, waste, or abuse in the operational process. FMC’s controls 

over IT equipment should be designed to provide reasonable assurance that the IT equipment are 

safeguarded throughout their lifecycles. 

SCOPE AND METHODOLOGY 

The scope of our testing focused on all IT inventory, such as desktops, laptops, servers, printers, 

monitors, routers, switches, and firewalls. This engagement also included a review of all inventory 

related policies and procedures. Furthermore, the evaluation encompassed a review of the position 

description for the OIT staff person responsible for the IT inventory, and an inspection of a 

judgmental sample of IT assets to assess the effectiveness of the OIT’s inventory processes and 

records. Lastly, this evaluation included a review of the inventory software settings such as 

password controls and audit settings. The inspection was performed in accordance with the 

Council of the Inspectors General on Integrity and Efficiency Quality Standards for Inspection 

and Evaluation, January 2012. 

RESULTS IN BRIEF 

A judgmental sample of inventory items was selected for inspection from the OIT’s latest 

inventory list of all agency IT equipment. A total of 63 IT equipment items were sampled, 

consisting of several employees, different FMC offices, and various types of equipment, including 

laptops, monitors, printers, Blackberries, among other equipment types. Out of the 63 IT items, 

3 
 

 

 

 

 

 

 

23 items were not able to be located in the location identified on the IT inventory list, to include 

several laptops, Blackberries, All-in-One desktop computers, among other items. Subsequent to 

the completion of this testing, it was revealed that OIT was able to locate all but seven (7) of the 

23 items that were not identified in the original testing. The 7 items are three (3) laptops and four 

(4) wireless hubs. There were also several IT items that lacked a serial number on the IT inventory 

list, making it difficult to reconcile the inventory item against the inventory list. Lastly, there were 

also some issues with classification of the inventory, such as IT equipment assigned to an employee 

that did not match the IT inventory list, or the location of IT equipment that did not match the IT 

inventory list. 

We identified several opportunities for improvement in the FMC’s IT equipment inventory 

management. Although OIT has several policies and procedures for managing IT equipment 

inventory, we recommend OIT enhance written procedures for maintaining an accurate and up-todate IT inventory list. These procedures should include specific requirements for OIT staff 

responsible for maintaining the IT inventory list, as well as supervisory responsibilities for periodic 

verification and reconciliation of the respective list. We also identified a lack of segregation of 

duties without compensating controls in the FMC’s IT inventory system. Specifically, there is one 

(1) OIT staff person that manages the IT inventory list, who is also one of two OIT staff responsible 

for IT purchasing. As a result, this OIT staff person is responsible for IT purchasing, and then is 

the only individual with access to add, remove, and update inventory in the IT inventory list. A 

lack of segregation of duties could create opportunities for the misappropriation of IT equipment 

without management’s knowledge. Also, all inventory items should have a barcode that contains 

the serial number. OIT has indicated the possibility of purchasing a new inventory software 

application that can improve IT inventory management. The deficiencies and recommendations 

for corrective action are detailed in the table that follows. 

4 
FINDINGS AND RECOMMENDATIONS

# Deficiency Risk Cause Criteria 

1 A walkthrough from the latest

inventory listing to the physical

inventory was performed and the

following was observed:

a. 23 out of 63 sampled inventory

items were not able to belocated in the location

identified on the IT inventorylist; subsequent to the OIG

testing, all but 7 of the items

were located by OIT.

b. The receiving reports do not

contain the necessary details toreconcile against the inventory

on‐site or the inventory listing.

c. 12 out of 63 sampled inventory

items had no serial number

associated with the inventory.

The following risks were identified from

the deficiencies:a. Without knowing where asset

inventory items are located, there isthe risk that those inventory pieces

could be stolen, contain personally

identifiable information (PII), andmay be in the hands of adversarialparties, thereby exposing the

agency to exploitation.

b. Without the appropriate source

documents to show the details of

each inventory item, there is the

risk that inventory items could be

misclassified or become lost/stolen.

c. Without the necessary details such

as serial numbers, there is anincreased risk that inventory could

Written

policies and

procedures

need

improvement.

NIST 800‐531 Configuration

Management (CM– 8) states, in part,the following:a. Develops and documents an

inventory of information system

components that:1. Accurately reflects the current

information system;

2. Is at the level of granularity

deemed necessary for tracking

and reporting; and

b. Reviews and updates the

information system componentinventory [Assignment:

organization‐defined frequency].

Thnoa. 

b. c. 

d. 

d. 4 out of 63 sampled inventory

items were misclassified for

either staff assignment orlocation.

e. 1 out of 63 inventory items had

a description that was

insufficient to identify the

inventory asset.

become misclassified, lost, orstolen.

d. Without accurate identification as

to who the inventory is assigned to,

there is an increased risk thatinventory could be misclassified and

unaccounted for.

e. Without appropriate descriptions

for inventory items, there is anincreased risk that inventory couldbe misclassified or becomeunaccounted for.

e. 

1 NIST, Security and Privacy Controls for Federal Information Systems and Organizations, SP 800‐53, Revision 4 (Gaithersburg, Md.: Apr

5 
Management Response

1a Management agrees with the recommendation, and has taken corrective action to ensure that, going forward, all items on the inventory spr

to specific personnel and/or locations within the agency. As noted above, OIT will continue reliance on its existing inventory spreadsheet pe

software solution, to be procured no later than the end of FY 2018.

1b Management agrees with the first part of this recommendation. OIT staff has updated the inventory spreadsheet and will ensure that it is ke

are received, relocated, or reassigned.Management also agrees with the second part of this recommendation. OIT staff does currently ascertain that IT purchases and inventory re

are reconciled against the actual equipment received to the extent possible. For example, if purchase requests and inventory receiving docu

have been shipped to the Commission, OIT staff verify whether 10 computers have been received. However, inventory purchasing and rece

(such as serial numbers, barcodes, etc.) specifically identifying each piece of equipment shipped to the Commission. Going forward, OIT staf

 record serial numbers on packing slips as items are unboxed;

 place barcode stickers on items as they are unboxed; and

 ensure that each items’ information (serial number, barcode, location, etc.) is entered into the inventory spreadsheet before delive

locations.

An SOP has been developed and implemented for receiving IT equipment into inventory, copy attached.

1c Management agrees with this recommendation and will make the necessary adjustments to ensure that all IT inventory items are barcoded 

noted in the inventory spreadsheet as items are received into the Commission’s inventory (see response to #1b above).

1d Management agrees with this recommendation. By way of clarification, management believes that when the review was conducted, all equi

was located with that individual with the exception of a single item — a hard drive —which was passed from its assigned user to another em

responsibilities. OIT was not notified of this transfer of equipment by either employee. Management will consider whether to clarify, on the 

policy, the obligation of each individual receiving IT property to properly notify OIT in the event an asset is to be transferred to another pers

1e Management agrees with the recommendation and has taken corrective action to ensure that all inventory items will be more clearly descri

6 
# Deficiency Risk Cause Criteria 

2 The current inventory procedures

are not sufficient for maintaining

an accurate and up‐to‐date IT

equipment inventory list.

Procedures do not currentlyaddress supervisoryresponsibilities for periodic

verification and reconciliation of

the inventory list. The inventory

procedures also do not addressasset transfers between

employees; and misclassified

and/or inaccurate inventory.

An incomplete or inaccurate IT

inventory list increases the risk that IT

equipment could be lost, stolen, orunaccounted for.

Written

policies and

procedures

need

improvement.

NIST 800‐53, System and

Communications Protection Policy

and Procedures (SC– 1) states the

following:The organization:

a. Develops, documents, and

disseminates to [Assignment:

organization‐defined personnel or

roles]:

1. A system and communications

protection policy that addressespurpose, scope, roles,

responsibilities, managementcommitment, coordination

among organizational entities,

and compliance; and

2. Procedures to facilitate the

implementation of the system

En

IT 

and communications protection

policy and associated system

and communications protection

controls; and

b. Reviews and updates the current:

1. System and communications

protection policy [Assignment:organization‐defined

frequency]; and

2. System and communications

protection procedures[Assignment: organization‐

defined frequency].

Management Response

2 Management agrees with this recommendation, and OIT will review and strengthen their policies and procedures for IT equipment managem

than the end of FY 2018. These efforts are inclusive of selecting an integrated software solution for OIT, to be procured no later than the en

7 
# Deficiency Risk Cause Criteria 

3 FMC maintains a listing of the

assets that were excessed;

however, there is no associated

date to identify when theequipment or hardware was

removed from the agency nor was

the method of sanitizationdocumented for those excessedassets.

Without the appropriatedocumentation of when and how the

inventory was excessed, there is the

risk that PII will still be residing on theinventory, thereby exposing the agency

to unforeseen risks.

Written

policies and

procedures

NIST 800‐53, ConfigurationManagement (CM– 8) states, in part,

the following:

a. Develops and documents an

inventory of information systemcomponents that:

1. Accurately reflects the current

information system;

Enth

sa

en

inv

need

improvement. 2. Is at the level of granularity

deemed necessary for tracking

and reporting; and

b. Reviews and updates the

information system componentinventory [Assignment:organization‐defined frequency].

Management Response

3 Management agrees with the recommendation and has taken steps to ensure that as inventory is excessed, the date of excess and method o

ensure that PII is removed from the inventory appropriately. When items in the Commission’s IT inventory are to be excessed, a spreadshee

item that is to be excessed. In order to include the method of sanitization and bar code or serial number, OIT has added two columns to the 

will begin using this new spreadsheet format immediately.

8 
# Deficiency Risk Cause Criteria 

4 There is a lack of segregation of

duties for maintaining thecompleteness and accuracy of

inventory.

A lack of segregation of duties increases

the risk that inventory will be

incomplete and/or inaccurate withoutthe appropriate preventive or detective

controls in place. Written

policies and

procedures

need

improvement.

NIST 800‐53, Access Control (AC– 5)

states the following:

The organization:

a. Separates [Assignment:

organization‐defined duties of

individuals];

b. Documents separation of duties of

individuals; and

c. Defines information system access

authorizations to supportseparation of duties.

Th

prsem

Management Response

4 Management agrees with the recommendation. An SOP has been developed for receiving IT equipment into inventory (see comment for Re

will ensure that, to the extent possible, there is appropriate segregation of duties in the management of computer inventory.

9 
10 
11 
12 
13 
14