Weaknesses Continue to Exist in the Controls Over Investigative Equipment
January
21, 2011
Reference
Number: 2011-30-008
This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.
Redaction Legend:
1 = Tax return/return Information
3(a) = Identifying Information
Phone
Number | 202-622-6500
Email Address | TIGTACommunications@tigta.treas.gov
Web Site |
http://www.tigta.gov
HIGHLIGHTS
WEAKNESSES CONTINUE TO EXIST IN THE
CONTROLS OVER INVESTIGATIVE EQUIPMENT
Highlights
Final
Report issued on January 21, 2011
Highlights of Reference
Number: 2011-30-008 to the Internal
Revenue Service Chief, Criminal Investigation Division.
IMPACT ON TAXPAYERS
The Criminal
Investigation (CI) Division has responsibility
for controlling almost 44,000 pieces of investigative equipment costing nearly
$126 million to
accomplish its investigative and enforcement functions. Our review determined that weaknesses in the
controls over investigative equipment continue to exist. The risk of
loss, theft, and spending funds to purchase unnecessary investigative equipment
can decrease
the public’s confidence in the Internal Revenue Service’s (IRS) ability to
enforce tax laws in a fair, equitable, and consistent manner.
WHY TIGTA DID THE AUDIT
In September 2005, TIGTA issued a report
citing weaknesses in the CI Division’s controls that left investigative
equipment vulnerable to loss. The
objective of TIGTA’s current review was to determine whether controls and
procedures were effective to ensure investigative equipment is adequately
safeguarded against waste and loss. In
addition, TIGTA followed up to determine whether the agreed to corrective
actions from our prior report were implemented.
WHAT
TIGTA FOUND
Although
the CI Division took steps to strengthen controls over its investigative
equipment, TIGTA identified repeat findings and weaknesses that continue to
exist because the CI Division did not take or fully implement all agreed to
actions from our prior report. Results showed that
CI Division personnel did not always properly conduct the annual physical
verifications, maintain complete documentation to support investigative equipment
disposal transactions, and did not review user permissions for its management
information system.
TIGTA also determined that the CI Division’s management information system is inaccurate and incomplete, and that the CI Division needs to improve the physical security controls over its investigative equipment to reduce the risk of unauthorized access.
WHAT TIGTA RECOMMENDED
To
improve controls over its investigative equipment, TIGTA recommended that the
Chief, CI Division, finalize the Internal Revenue Manual and the Criminal Investigation
Equipment Management Procedures; modify the reports generated from the
management information system to facilitate the annual inventory; and ensure the
Director, Security and Technical Operations, and Director, Field Operations, review
disposal documentation for completeness and reject the documentation when it is
incomplete. TIGTA also made several
recommendations that will help the CI Division ensure the data captured in its
management information system are complete and accurate and that its assets are
adequately safeguarded against theft or loss.
IRS
management agreed with five recommendations, partially agreed with two recommendations,
and disagreed with the remaining recommendation. CI Division field offices currently review
all investigative equipment disposal documentation and conduct reviews of user
permissions in the Criminal Investigation Management Information System;
however, the IRS did not agree that national office oversight was warranted. Also, the IRS did not agree to establish an
annual functional security review of investigative equipment and weapons
storage areas. TIGTA maintains that
current procedures for disposing of investigative equipment and completing
periodic reviews of access permissions to the Criminal Investigation Management
Information System and storage areas are not adequate and need strengthening. When properly conducted, functional security
reviews will help ensure security standards are met.
January 21, 2011
MEMORANDUM FOR CHIEF, CRIMINAL INVESTIGATION DIVISION
FROM: Michael R. Phillips /s/ Michael R. Phillips
Deputy Inspector General for Audit
SUBJECT: Final Audit Report – Weaknesses Continue to Exist in the Controls Over Investigative Equipment (Audit # 201030008)
This report presents the results of our review to determine whether controls and procedures are
effective to ensure investigative equipment is adequately safeguarded against
waste and loss. In addition, we
determined whether the agreed to corrective actions from our prior report were
implemented. This audit was
included in our Fiscal Year 2010 Annual Audit Plan and addresses the major
management challenge of Leveraging Data to Improve Program Effectiveness and Reduce
Costs.
Management’s complete response to the draft report is included as Appendix VII.
Copies of this report are also being sent to the Internal Revenue Service managers affected by the report recommendations. Please contact me at (202) 622-6510 if you have questions or Margaret E. Begg, Assistant Inspector General for Audit (Compliance and Enforcement Operations), at (202) 622-8510.
Weaknesses
Continue to Create an Environment Where Investigative Equipment Is Vulnerable
to Loss
The Criminal
Investigation Management Information System Is Inaccurate and Incomplete
Physical
Security Controls Need to Be Reemphasized
Appendices
Appendix
I – Detailed Objectives, Scope, and Methodology
Appendix
II – Major Contributors to This Report
Appendix
III – Report Distribution List
Appendix
IV – Outcome Measures
Appendix
VI – Glossary of Terms
Appendix
VII – Management’s Response to the Draft Report
Abbreviations
|
CI |
Criminal Investigation |
|
CIMIS |
Criminal Investigation Management Information
System |
|
FY |
Fiscal Year |
|
HQ |
Headquarters |
|
STO |
Security and Technical Operations |
|
TIGTA |
Treasury Inspector General for Tax
Administration |
The Criminal Investigation
(CI) Division’s primary mission is to serve the American public by
investigating potential criminal violations of the Internal Revenue Code[1] and related financial crimes in a manner
that fosters confidence in the tax system and compliance with the law. To accomplish its mission, CI Division
special agents use various types of investigative equipment. Special agents also use accessories and
supplies that include cellular telephones, global positioning systems,
binoculars, camera lenses, recorders, and transcribers. As of October 15, 2009, the CI
Division had responsibility for controlling almost 44,000 pieces of
investigative equipment costing nearly $126 million. Figure 1 represents the total assets and
total acquisition cost for the investigative equipment categories recorded in
the Criminal Investigation Management Information System (CIMIS).
Figure 1: CI Division’s Investigative Equipment Inventory
|
Category |
Number of Items |
Acquisition Cost |
|
Motor Vehicle |
2,883 |
$61,995,084 |
|
Radio |
9,764 |
$37,120,281 |
|
Video |
3,061 |
$7,016,287 |
|
Audio |
2,507 |
$5,688,815 |
|
Miscellaneous Investigative Equipment |
7,268 |
$4,481,910 |
|
Weapon |
5,728 |
$2,131,240 |
|
Training |
1,741 |
$2,023,925 |
|
Photographic |
1,664 |
$1,574,234 |
|
Tracking |
2,517 |
$1,297,540 |
|
Telecommunication |
334 |
$970,196 |
|
Optical |
214 |
$641,295 |
|
Microfilm |
99 |
$255,816 |
|
Enforcement Badge |
6,158 |
$199,533 |
|
Shop |
27 |
$107,264 |
|
Total
Investigative Equipment |
43,965 |
$125,503,420 |
Source: Our analysis of the CIMIS as of October 15,
2009.
The CI Division’s Security and Technical Operations (STO) section
manages investigative equipment by determining needs and assisting with
distribution of the investigative equipment to the field offices. In addition, the STO section oversees the
annual inventory of investigative equipment and establishes property management
policy. The Criminal Investigation Equipment Management Procedures provide equipment
coordinators with uniform procedures for managing and accounting for
investigative equipment and using the CIMIS for controlling investigative
equipment. For example, the Procedures require
that investigative equipment and investigative accessories and supplies, valued
at $500 or more, be entered into the CIMIS.[2] Those
items valued less than $500 are considered disposable items and are not
controlled in the CIMIS. The exceptions
are weapons, pocket commissions, enforcement badges, belt badges, body armor,
and property that is susceptible to being converted to personal use such as
digital cameras, video recorders, and global positioning systems units.
This review is a followup to the Fiscal Year (FY) 2005 audit in which we
determined that internal control weaknesses created an environment susceptible
to the loss of investigative equipment.[3] We made 14 recommendations[4]
for improvement that the Chief, CI Division, agreed to implement. During
the planning for this review, STO section management advised us that CI
Division personnel identified significant discrepancies during the 2008 annual investigative
equipment inventory of CI Division Headquarters (HQ). As a result, CI Division management requested
the completion of an internal, independent review and reconciliation. The independent review team issued a report
in March 2009 which discussed how the team resolved the inventory discrepancies
reported during the 2008 annual investigative equipment inventory. The report also highlighted that significant
control weaknesses at CI Division HQ contributed to the inability to account
for investigative equipment. Many of the
findings and recommendations outlined in the March 2009 report are repeat
findings reflected in our FY 2005 report.
This review was performed at the CI Division HQ, STO section,[5] in Washington, D.C.; the warehouse in Forestville, Maryland;[6] and the CI Division field office post of duty locations in Atlanta, Georgia; Baltimore, Maryland; and Newark, New Jersey, during the period February through July 2010. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Detailed information on our audit objectives, scope, and methodology is presented in Appendix I. Major contributors to the report are listed in Appendix II.
While Some Controls Over Investigative Equipment Have Improved Since Our Last Review, Repeat Findings Still Exist
The results of this review determined that the CI Division
has taken corrective action on 8 (57 percent) of the 14 recommendations
made in our September 2005 audit report.
For example, in our prior report, we identified that investigative equipment at the CI Division HQ warehouse was
haphazardly stored in multiple locations throughout the facility, and some
items were obscured from our review. In
addition, duplicate badges and pocket commission inserts purchased by CI
Division personnel were not properly controlled. Our observations during this review showed
the warehouse was more organized and a schematic has been developed to note the
location of investigative equipment.
Further, CI Division personnel created a master log for all pocket
commissions, stored unassigned pocket commissions in a locked safe, and
provided detailed instructions for assigning and recording pocket commissions
in the CIMIS.
However, we determined that 6 of the 14 recommendations remain incomplete because the CI Division did not take, or fully implement, the agreed to corrective actions. Specifically, CI Division management agreed to establish procedures for reviewing disposed investigative equipment documentation to ensure it is complete and accurate; however, this documentation continues to be incomplete. In addition, CI Division management agreed to implement a process for periodically reviewing CIMIS user permissions, and we determined these reviews do not exist. In addition, CI management did not:
· Properly conduct the annual inventory reviews of the investigative equipment.
· Update the CIMIS to include all purchases of investigative equipment.
· Conduct required security reviews.
· Restrict access to investigative equipment to only authorized personnel.
By not completing the corrective actions from our prior report, the CI Division accepted the risk that existing internal controls over investigative equipment were not being adhered to and that the inventory data in the CIMIS cannot be relied upon to make decisions regarding new purchases. The results from this review indicate CI Division management needs to take additional steps to strengthen internal controls over investigative equipment.
Weaknesses Continue to Create an Environment Where Investigative Equipment Is Vulnerable to Loss
Our review identified several conditions that attributed to the CI Division’s inability to maintain effective controls over its investigative equipment. As part of our testing to arrive at this conclusion, we visited the CI Division HQ[7] and three field offices and physically verified investigative equipment items controlled in the CIMIS (i.e., referred to as book-to-floor testing). We judgmentally selected a sample of 265 investigative equipment items, including 31 weapons, from a population of 6,951 items recorded in the CIMIS. We accounted for all the weapons but could not locate or find proper support for 23 (8.7 percent) of the items valued at $82,326. Further analysis of inventory records showed that 11 (of the 23) items could not be located because they had been disposed of without adequate documentation to support the disposal.
We also judgmentally selected a sample of 128 investigative equipment items located in the offices to verify if these items were controlled in the CIMIS (i.e., referred to as floor-to-book testing). Our results showed 23 (18 percent) items valued at an estimated $48,888 were not controlled in the CIMIS. Nine of these items were in the process of being disposed.
In addition, the CI Division’s independent review and reconciliation of its HQ investigative equipment inventory identified similar deficiencies. The review noted that personnel could not physically locate 190 items. The review team later determined these items were lost as a result of the June 2006 flood of the Internal Revenue Service HQ building or were items that could not be located during prior inventory reviews. The review team also identified 508 items that were not controlled in the CIMIS, as required.
The CI Division continues to improperly conduct the annual inventory
We reviewed the annual inventory procedures and determined CI offices did not always conduct, or properly conduct, the investigative equipment inventories. Specifically,
We also determined that CI Division personnel were not updating the CIMIS to document the date inventory items were last verified. Our analysis of the CIMIS identified 20,516 (46.7 percent) of the 43,965 investigative equipment items had a last verification date of 2007 or earlier. According to the CIMIS Data Dictionary, the last verification date should reflect the year when the latest physical inspection of the investigative equipment item was completed. However, the equipment coordinators we interviewed did not know about this requirement or updated the CIMIS only when investigative equipment was transferred to another office or special agent.
The Criminal
Investigation Equipment Management Procedures requires that equipment coordinators
ensure an annual, 100 percent inventory
review is conducted of all investigative equipment tracked in the CIMIS.[8] This assessment
includes identifying investigative equipment, in storage or office areas, valued
at $500 or greater that is not already recorded in the CIMIS. At the conclusion of the inventory review, the
coordinator will update the CIMIS with any corrections identified by the
inventory review team.
The CI Division annual inventory procedures require the use of the Storage Responsibility for Government Property Report (Standard EQR 02). This report identifies the investigative equipment by storage area and cannot be manipulated. However, this report is not organized in any specific order which makes it difficult for the person conducting the inventory to determine which items can be accounted for and which are missing from the inventory. During our visits, we determined that most of the offices stored the equipment by type (i.e., all recorders in one area). We believe modifying the CIMIS reports generated for the common storage areas to sort the data by equipment type may help facilitate the verification of equipment and identification of items that should be controlled on the CIMIS.
In March 2010, we advised the Director, STO, of our interim results and recommended the CI Division discuss our results during the April 2010 continuing professional education seminar for the CIMIS equipment coordinators. We believed the timing of this training provided a good opportunity to advise the equipment coordinators about the weaknesses we identified. The CI Division agreed and the continuing professional education training materials we reviewed reiterated the roles and responsibilities of equipment coordinators and included practical classroom exercises to help reinforce key concepts regarding controls over investigative equipment. CI Division personnel also indicated the Internal Revenue Manual would be modified with guidelines on updating the last verification date field in the CIMIS starting with the FY 2010 inventory. However, as of October 2010, these guidelines had not yet been incorporated.
While the continuing professional education seminar helped CIMIS equipment coordinators better understand their responsibilities, CI Division management needs to take additional steps to ensure CI Division personnel follow existing procedures. Otherwise, investigative equipment will continue to be at risk of loss and CI Division personnel will be unable to rely on data within the CIMIS to make business decisions.
The CI Division did not maintain complete documentation to support investigative equipment disposal transactions
Our results continue to show that the internal controls over the disposal of investigative equipment (which includes items reported as lost, stolen, damaged, or no longer useful) need strengthening. The CI Division either did not have supporting documentation or the documentation was incomplete for 31 (57.4 percent) of the 54 investigative equipment items reported as disposed. For example, the documentation did not contain the required approval signatures or a recommendation of financial liability. We also reviewed documentation for seven weapons reported as lost or stolen since 2005 for all CI field offices. One of the seven weapons selected had complete documentation; however, our review of records for the remaining six weapons showed:
The Criminal Investigation Equipment Management Procedures state any time investigative equipment is lost, stolen, or damaged, a memorandum documenting the circumstances of the loss is to be prepared by the individual assigned the investigative equipment. This memorandum is then forwarded to the employee’s supervisor who determines if the loss was due to negligence. A Form 1933 must also be prepared to report investigative equipment that is lost or stolen. All approved Forms 1933 must be forwarded to the Director, STO, as part of the annual inventory process. In addition, the TIGTA Office of Investigations must be contacted whenever a weapon, badge, or pocket commission is reported as lost or stolen. The TIGTA Office of Investigations will complete an investigation to determine if there was employee misconduct and whether disciplinary action is necessary.
The Standards for Internal Control in the Federal Government requires that all transactions be authorized, clearly documented, and readily available for examination. Control activities, such as reviewing supporting documentation, help ensure the completeness and accuracy of all transactions. Investigative equipment recorded as disposed of in the CIMIS without proper supporting documentation could be an indication of an unauthorized alteration.
Reviews are not being performed on access permissions to the investigative equipment module within the CIMIS
Our review found that the CI Division has taken steps to ensure an adequate separation of duties for CI Division personnel conducting the annual inventory. However, the CI Division did not complete planned corrective actions to perform quarterly reviews to ensure only authorized CI Division personnel have access to the investigative equipment module in the CIMIS. For example, in one office visited, CI Division personnel continued to have access authority to the CIMIS investigative equipment module even though their current positions no longer require this access.
According to the Government Accountability Office Standards for Internal Control in the Federal Government, key duties and responsibilities need to be divided or separated among different people to reduce the risk of error or fraud. This delineation should include separating the responsibilities for authorizing transactions, processing and recording transactions, reviewing transactions, and handling any related assets. In addition, access to resources and records should be limited to authorized individuals, and periodic review of employee accesses should be made to help reduce the risk of errors, fraud, misuse, or unauthorized alteration.
If CI Division management does not ensure the proper completion of periodic reviews of user permissions for CI Division personnel with investigative equipment responsibilities, the risk of fraud or error increases.
Recommendations
The Chief, CI Division, should:
Recommendation 1: Finalize the Internal Revenue Manual and the Criminal Investigation Equipment Management Procedures and instructions to ensure employees are aware of the requirement to update the CIMIS with the last date the investigative equipment items were verified during the annual inventory process.
Management’s
Response:
IRS management agreed with the
recommendation. Internal Revenue Manual
sections regarding annual physical inventory will be updated to emphasize the
requirement to update the CIMIS with the date that the investigative equipment
items were verified during the inventory process. The Criminal Investigation Equipment
Management Procedures handbook will also include specific emphasis on the
requirement that each equipment
record be updated for every
investigative equipment item that was verified during the physical inventory
process. In addition, a suggestion for
enhancement to the CIMIS has been submitted to the CI Division Technology
Operations and Investigative Services office for approval, design, and eventual
implementation that will create a new report to identify the last date the
investigative equipment items tracked in the CIMIS were verified.
Recommendation 2: Modify the CIMIS-generated reports to sort the investigative equipment items (e.g., by category, manufacturer, and model) to facilitate the storage area inventory process. Because the investigative equipment in the storage areas are grouped by like items, a sorted report can provide a more efficient inventory process and help identify items that should be recorded in the CIMIS.
Management’s
Response:
IRS management agreed with this
recommendation. A suggestion for
enhancement to the CIMIS has been submitted to the CI Division Technology
Operations and Investigative Services office for approval, design, and eventual
implementation. This enhancement will
change the storage inventory report to be sorted by manufacturer, model, and
category to increase the efficiency of the inventory process.
Recommendation 3: Ensure the Director, STO, and the Director, Field Operations, review all documentation relating to investigative equipment disposals for accuracy and completeness. When documentation is incomplete, the documentation should be rejected and returned to the initiating office for corrective action. In addition, followup action should be taken to ensure the documentation is returned to the Director, STO, or the Director, Field Operations.
Management’s Response: IRS management partially agreed with the recommendation. The CI Division Director, Field Operations, and/or Special Agent in Charge currently review all documentation relating to investigative equipment disposals for accuracy and completeness, and reject and return to the initiating office for corrective action when documentation is incomplete. Investigative equipment disposal logs and/or documentation are forwarded to the Director, STO, annually as part of the annual Physical Investigative Equipment Certification. In addition, each Director, Field Operations, will be responsible for maintaining a Form 1933 tracking system.
Office of Audit
Comment: The IRS stated field offices currently review all documentation related
to investigative equipment disposals for accuracy and completeness and the
Director of Field Operations will track Form 1933. However, we continue to believe the internal
controls over the disposal of
investigative equipment need strengthening.
The results of our review showed that the CI Division either did not
have supporting documentation or the documentation was incomplete for 31
(57.4 percent) of the 54 investigative equipment items reported as
disposed. The lack of documentation or incomplete documentation for more than one-half of the items in
our sample supports our conclusion that the current procedures are not
adequate.
Recommendation 4: Ensure the Director, STO, establishes procedures to periodically review the permissions of users with access to the investigative equipment application of the CIMIS to ensure they are accurate.
Management’s Response: IRS management partially agreed with this recommendation. The review of CIMIS user permissions is the responsibility of each field office and HQ Director. The CI Division conducts certifications of all user profiles to include permissions of users with access to the CIMIS on an annual basis. Area Subject Matter Experts will be informed and required to review annual certifications to ensure user permissions are correct.
Office of
Audit Comment: We are
encouraged that Area Subject Matter Experts will review annual certifications
to ensure the CIMIS user permissions are correct. However, we continue to believe that annually
reviewing permissions is not adequate to ensure only authorized users have
access to the CIMIS. The results of our
review showed that some CI Division personnel continued to have access
authority to the CIMIS investigative equipment module even though their current
positions no longer required this access.
The Criminal
Investigation Management Information System Is Inaccurate
and Incomplete
Although the CI Division established procedures to ensure
the accuracy of investigative equipment records within the CIMIS, procedures are
not being followed. As a result, the CIMIS
contains incomplete and inaccurate information.
For example, we selected a judgmental sample of 49 equipment items from
1,799 items purchased[9]
by the 4 offices we visited. We obtained
purchase order documentation for these 49 items and determined 5 of the 49
contained discrepancies. A total of 462
items were purchased using the procurement documentation for the 5 purchases
with discrepancies.[10] We researched the CIMIS for the 462 items and
could not locate 125 (27 percent).
The acquisition costs for these items
totaled $88,485. These items represent a
potential risk of theft or loss because they are not controlled in the CIMIS
and would not be included in the annual inventory process.
The CI Division also uses the CIMIS to monitor investigative equipment items in a pending status (i.e., a pending purchase or disposal). The Criminal Investigation Equipment Management Procedures state equipment coordinators should check for pending items twice a month and report all discrepancies after 60 days. Our analysis of the CIMIS identified that, of the 628 investigative equipment items still in a pending order status for all CI offices, 230 (36.6 percent) were ordered between Calendar Years 2005 and 2008. According to CI Division procedures, upon receipt of the investigative equipment in an office, the equipment coordinators should “accept” the items in the CIMIS by recording the serial number, receipt date, and physical location of the item. However, CI Division personnel advised that some offices created a new entry in the CIMIS to record investigative equipment purchases, rather than “accepting” the item. When this procedural deviation occurs, the CI Division is at risk of creating duplicate records and overstating the inventory in the CIMIS.
We also identified 183 investigative equipment items for all CI Division offices in a pending disposal status as of October 15, 2009. Our analyses showed 26 of these items were placed in this status during Calendar Years 2002 through 2005. When the CI Division initiates the process to dispose of investigative equipment within the CIMIS, the item is considered in pending disposal status until a disposal date is input into the System. According to CI Division HQ management, these records were not updated when the conversion from the old inventory system to the CIMIS took place in April 2005. In addition, for one of the field offices we visited, we identified 49 investigative equipment items documented in the CIMIS as pending disposal status. Further review showed the items had already been destroyed, but CI Division personnel did not update the CIMIS to reflect the items were no longer in active inventory.
The CI Division should strategically assess its investigative equipment inventory and remove outdated investigative equipment items
Our analysis of the CIMIS identified 17,093 (39 percent) of the 43,965 active investigative equipment items were purchased 6 or more years ago.[11] According to the Internal Revenue Manual, the useful life (the period during which the asset provides benefits) for investigative equipment is 6 years. Figure 2 shows the number of investigative equipment items and the year the investigative equipment was acquired.
Figure 2: Investigative
Equipment Inventory by Acquisition Year
|
Year of Acquisition |
Number of Investigative Equipment Items |
|
1950 to 1990 |
1,177 |
|
1991 to 2000 |
10,836 |
|
2001 to 2003 |
5,080 |
|
2004 to 2009 |
26,872 |
|
Total |
43,965 |
Source: Our analysis of the CIMIS as of October 15,
2009.
While the CI Division maintains older items for investigative and historical purposes (****1, 3(2)************), we believe it has an opportunity to strategically assess its investigative equipment inventory and remove items that are beyond the useful life and no longer needed. If the CI Division determined these items were no longer useful and removed them from its active inventory, the annual inventory process would be more efficient because fewer items would need to be physically verified in the future.
Recommendations
The Chief, CI Division,
should:
Recommendation 5: Create a report to identify the investigative equipment inventory in a pending status for more than 60 days and provide this report to the Director, STO, to ensure the CIMIS is updated.
Management’s
Response:
IRS management agreed with this
recommendation. A suggestion for
enhancement to the CIMIS has been submitted for approval, design, and eventual
implementation to the CI Division Technology Operations and Investigative
Services office. This enhancement will
create a new report that will provide the Director, STO, maximum flexibility to
determine which items require updating in the CIMIS and identify the
investigative equipment inventory in pending “ordered” status for any specified
length of time.
Recommendation 6: Analyze the CIMIS investigative equipment data to identify obsolete items and provide specific instructions to the field offices to properly document the removal of this investigative equipment from the CIMIS.
Management’s
Response: IRS management agreed with this
recommendation. The CI Division has
already begun the process of identifying potentially obsolete equipment items
for further analysis and disposal where appropriate. Special ad hoc reports accompanied by
specific instructions regarding the disposition of obsolete items will be
provided by HQ to the field offices annually for review to reduce unneeded
inventory.
Physical Security
Controls Need to Be Reemphasized
In our prior review, we reported
that the CI Division did not restrict access to investigative equipment storage
areas to only those individuals with responsibility for maintaining the investigative
equipment. During this review, we
visited three field offices
and determined that controls were not in place to ensure only those individuals
with a need had access to investigative equipment. For example, in two field offices, we
identified CI Division personnel who did not have a business reason for having
access to the investigative equipment storage room. In the remaining field office, we could not
readily determine who had access to the weapons or tech equipment storage areas
because the computer system maintaining the records was outdated and could not
be accessed.
CI Division management advised
that because of Homeland Security Presidential Directive 12, separate entry
access systems (such as the one referenced in the prior paragraph) will
eventually become obsolete. As a result,
the Internal Revenue Service will not provide funding to upgrade or replace
these systems. Instead, the Internal
Revenue Service Physical Security and Emergency Preparedness office is working
to fully implement the Directive to provide a special identification card used
by employees to gain and monitor access to facilities and storage areas.
Further, we could not find
evidence that functional security reviews were performed at the offices in our
review. This condition also existed in
our prior review. When properly
conducted, functional security reviews will help ensure security standards are
met. In addition, according to the Standards for Internal Control in the
Federal Government, an agency must establish physical control to secure and
safeguard assets. Access to resources
and records should be limited to authorized individuals, and accountability for
their custody and use should be assigned and maintained. If access to investigative equipment is not
restricted and security reviews are not completed, investigative equipment is
vulnerable to risk of loss, theft, or unauthorized use.
Recommendations
Recommendation 7: Until Homeland Security Presidential Directive 12 is fully implemented, the Chief, CI Division, should initiate a manual process in those field offices where computer systems cannot be upgraded to help maintain the records of CI Division personnel who have access to investigative equipment items.
Management’s Response: IRS management agreed with this recommendation. The Director, Operations, will issue a
memorandum to all Special Agents in Charge reminding all personnel of the
necessity to control access to investigative equipment. Each Special Agent in Charge will ensure an
access control log/sign out sheet is utilized by the office.
Recommendation 8: The Chief, CI Division, should establish
procedures to ensure the CI Division completes annual
functional security reviews of investigative equipment and weapons storage
areas. This includes reviewing access
lists to ensure only authorized CI Division personnel have access to
investigative equipment.
Management’s Response: IRS management disagreed
with this recommendation. All CI Division
managers, as part of the Annual Assurance Review, must certify compliance with
Internal Revenue Manual sections regarding security requirements and
responsibilities as well as Internal Revenue Manual sections concerning
investigative property requirements.
Controls over investigative equipment require a constant balance of security
of the equipment with the accessibility of equipment to field personnel to
successfully complete CI Division’s mission. In addition, CI Division office space in
general is restricted to CI Division personnel unlike other
Office of
Audit Comment: Requiring each Special Agent in Charge to ensure access
control log/sign out sheets are utilized will provide some assurance that access
to equipment is controlled. However, we
continue to believe that current procedures are not adequate because we could not
find evidence that functional security reviews were performed at the offices visited
during our review. When properly
conducted, functional security reviews will help ensure security standards are
met.
Appendix I
Detailed Objectives, Scope, and Methodology
The overall objective of this review was to determine whether controls and procedures were effective to ensure investigative equipment[12] is adequately safeguarded against waste and loss. In addition, we determined whether the agreed to corrective actions from our prior report were implemented. In prior audits, our overall assessment has been that the CIMIS data are of undetermined reliability. However, one of the purposes of this audit was to verify the accuracy of the investigative equipment data maintained in the system. In our opinion, using the data from the CIMIS did not weaken our analyses. To accomplish our objectives, we:
I. Evaluated and discussed procedures for ensuring unassigned investigative equipment were adequately stored and safeguarded.
II. Evaluated policies and procedures to ensure investigative equipment duties were adequately separated. We also reviewed the permissions of CI Division personnel with access to the CIMIS.
III. Determined whether the inventory of investigative equipment is adequately controlled by the CI Division on its CIMIS.
A. Analyzed the CIMIS as of October 15, 2009, and identified 43,965 investigative equipment items with an acquisition cost of approximately $126 million. We also reviewed records of investigative equipment that was in a disposed status per the CIMIS (which includes items reported as lost, stolen, damaged, or no longer useful). The CI Division HQ offices in Washington, D.C., and Forestville, Maryland,[13] and the CI Division field office post of duty locations in Atlanta, Georgia; Baltimore, Maryland; and Newark, New Jersey, were judgmentally selected based upon factors such as the total number and cost of investigative equipment currently assigned to each office, the total number of items reported as lost or stolen during Calendar Years 2007 and 2008, and the total number of items with a pending disposal status. We used judgmental sampling because we determined statistical sampling techniques would have been cost prohibitive and we did not plan to project our results to the entire population.
B. Conducted a physical verification of investigative equipment items, excluding vehicles, listed in the CIMIS and assigned to the four offices in our review as of October 15, 2009.
1.
Analyzed all active
inventory records in the CIMIS as of October 15, 2009, and identified
investigative equipment from the following categories: Weapons (Category Number 1), Audio (2), Video
(3), Photographic (4), Telecommunication (6), Optical (7), Radio (11), Tracking
(12), and select subcategories from Miscellaneous Investigative Equipment (8).
2.
Judgmentally selected
265 investigative equipment items assigned to the CI Division HQ and 3 field
offices. We used judgmental sampling
because we determined statistical sampling techniques would have been cost
prohibitive and we did not plan to project our results to the entire
population.
3. Physically verified 242 of the 265 investigative equipment items at the 4 offices.
C. Evaluated each office’s inventory procedures and determined whether an annual inventory of investigative equipment was properly performed in FY 2009.
D. Selected a judgmental sample of 49 equipment items from 1,799 items purchased[14] by the 4 offices we visited. We obtained purchase order documentation for the 49 items and determined 5 of the 49 contained discrepancies. A total of 462 items were purchased using the procurement documentation for the 5 purchases with discrepancies.[15] We researched the CIMIS for the 462 items and could not locate 125 (27 percent). The acquisition costs for these items totaled $88,485.
E.
Selected a judgmental
sample of 54 investigative equipment items, including weapons,
that were listed in the CIMIS as disposed (which includes items
reported as lost, stolen, damaged, or no longer useful). We used judgmental sampling because we
determined statistical sampling techniques would have been cost prohibitive and
we did not plan to project our results to the entire population.
F.
Judgmentally selected
from the “floor” a total of 128 investigative equipment items from the 4
offices and determined whether the investigative equipment was properly
controlled in the CIMIS. We used judgmental
sampling because we could not determine the population of all investigative equipment
items in these offices.
Internal
controls methodology
Internal controls relate to management’s plans, methods, and procedures used to meet their mission, goals, and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations. They include the systems for measuring, reporting, and monitoring program performance. We determined the following internal controls were relevant to our audit objective: CI Division’s policies, procedures, and practices relating to accounting for and controlling its investigative equipment. We evaluated these controls by interviewing CI Division equipment coordinators, reviewing the annual inventory procedures, physically verifying investigative equipment, and tracing investigative equipment purchases to ensure they were recorded in the CIMIS.
Appendix II
Major Contributors to This Report
Margaret E. Begg, Assistant Inspector General for Audit (Compliance and
Enforcement Operations)
Frank W. Jones, Director
Diana M. Tengesdal, Audit Manager
Janice A. Murphy, Lead Auditor
Margaret F. Filippelli, Senior Auditor
Chanda L. Stratton, Auditor
Appendix III
Commissioner C
Office of the Commissioner – Attn: Chief of Staff C
Deputy Commissioner for Services and Enforcement SE
Director, Operations Policy and Support, Criminal Investigation Division SE:CI:OPS
Director, Strategy, Criminal Investigation Division SE:CI:S
Director, Security and Technical Operations, Criminal Investigation Division SE:CI:OPS:STO
Chief Counsel CC
National Taxpayer Advocate TA
Director, Office of Legislative Affairs CL:LA
Director, Office of Program Evaluation and Risk Analysis RAS:O
Office of Internal Control OS:CFO:CPIC:IC
Audit Liaison: Chief, Criminal Investigation Division SE:CI
Appendix IV
This appendix presents detailed information on the
measurable impact that our recommended corrective actions will have on tax
administration. These benefits will be
incorporated into our Semiannual Report to the Congress.
Type and Value of Outcome Measure:
·
Protection of Resources – Actual; 46 investigative
equipment items costing $131,214 that could not be located or positively
identified or were not controlled in the CIMIS[16]
(see page 5).
Methodology Used to Measure the Reported Benefit:
Type and Value of Outcome Measure:
· Reliability of Information – Actual; 20,795 investigative equipment items that either did not have a current inventory verification date or had been disposed but remained in active inventory (see page 5 and 10).
Methodology Used to Measure the Reported Benefit:
Our analysis of the CIMIS identified 20,516 (46.7 percent) of the 43,965 investigative equipment items had a last verification date of 2007 or earlier. Also, during our visit to one field office, we identified 49 items in its inventory were scheduled for disposal. However, CI Division management could not provide us with any documentation to support the disposal action was approved. We determined the items were destroyed but were not removed from the active inventory as required.
We also analyzed the CIMIS investigative equipment data and identified that of the 628 investigative items still in a pending order status for all CI offices, 230 (36.6 percent) were ordered between Calendar Years 2005 and 2008. We were advised that instead of “accepting” the item in the CIMIS, some field offices created a new entry to record the investigative equipment. When this procedural deviation occurs, the CI Division is at risk of creating duplicate records and overstating the inventory in the CIMIS.
Type and Value of Outcome Measure:
· Protection of Resources – Actual; 125 investigative equipment items costing $88,485 that were purchased by the CI Division during FYs 2006, 2007, and 2009 but not controlled in the CIMIS, as required (see page 10).
Methodology Used to Measure the Reported Benefit:
We selected a judgmental sample of 49 equipment items from 1,799 items purchased[17] by the four offices we visited. Our review of purchase order documentation for these 49 items determined 5 of the 49 contained discrepancies. A total of 462 items were purchased using the procurement documentation for the 5 items with discrepancies.[18] We researched the CIMIS for the 462 items and could not locate 125 (27 percent). The acquisition costs for these items totaled $88,485.
Appendix V
Status of Recommendations From the September
2005 Treasury Inspector General for Tax Administration Report
|
Recommendation |
CI
Division Response and Corrective Action |
Current Status |
|
1 - Issue a memorandum to applicable CI Division personnel
reemphasizing the importance of independently verifying all equipment during
the annual inventory. |
Management agreed stating the results of our audit
were discussed and inventory procedures reemphasized to the Special Agents in
Charge and Assistant Special Agents in Charge. |
Implemented. In addition to
the discussions held at the Special Agent In Charge meeting, a memorandum was issued in January 2006 clarifying the
roles and responsibilities of CI Division personnel. |
|
2 - Establish procedures requiring each office to
submit the primary reconciliation document used during the inventory process
along with the memorandum that is submitted to the Director, Equipment and Technology
Evaluation. |
Management agreed and was to revise the Property
Management Handbook |
Incomplete. The CI Division Internal
Revenue Manual has not been updated to reflect the current procedures, and
the Equipment Management Procedures with revisions has not been issued in
final. As a result, we believe weak
internal controls continue to exist in the annual inventory process. |
|
3 - Consider whether the use of bar coding would be
an effective method of controlling the CI Division’s investigative equipment.[19] |
Management agreed stating a bar coding system would
be reviewed; however, management later advised the system is not possible due
to the inability to integrate data from the bar coding system into the CIMIS. |
We did not address this in our current review. |
|
4 - Establish procedures to periodically review the
permissions of those users with access to the investigative equipment
application of the CIMIS to ensure they have |
Management agreed and will determine the appropriate
level and frequency of the reviews of the CIMIS roles and permissions. Management later advised the reviews would
be conducted by area analysts on a quarterly basis beginning in April
2006. |
Incomplete. Reviews have not
been conducted on a quarterly basis, and no CIMIS report exists that would
assist area analysts in conducting a review of CIMIS user permissions. |
|
5 - Establish monitoring procedures to require the
review of supporting documentation to ensure all disposals are properly
conducted and consider incorporating procedures requiring each disposal to be
analyzed by an independent person as part of the annual inventory process. |
Management agreed and will review all reports of
survey and supporting documentation beyond the field level for completeness
and accuracy. |
Incomplete. Supporting
documentation was incomplete for investigative equipment being disposed from
the CIMIS because it was lost, stolen, damaged, or no longer useful. |
|
6 - Ensure all pocket commissions are properly
controlled in the CIMIS. |
Management agreed indicating new enforcement
commissions will be issued and the prior revisions will be destroyed. |
Implemented. The new pocket commissions
are being properly controlled in the CIMIS and detailed instructions have
been issued for assigning and recording them in the CIMIS. In addition, a master log for all
unassigned pocket commissions has been established. |
|
7 - Ensure all missing pocket commissions are
referred to the TIGTA Office of Investigations. |
Management agreed indicating they will ensure all
pocket commissions suspected of loss and/or theft are reported to the
TIGTA. |
Implemented. Procedures have
been established for referring pocket commissions suspected of loss and/or
theft to the TIGTA. In addition, our
review of documentation for six identification media reported lost or stolen
indicated the TIGTA was notified. |
|
8 - Determine if the current
supply of belt and enforcement badges is sufficient to provide each special
agent with a unique belt and enforcement badge identification number. |
Management agreed and will issue uniquely
serial-numbered enforcement/belt badges and will properly dispose of excess
badges. |
Implemented. Our review
determined the new enforcement/belt badges were purchased and issued. In addition, proper actions were taken to
dispose of the old badges. |
|
9 - Establish procedures to ensure all investigative
equipment purchased is properly controlled in the CIMIS. |
Management agreed and stated current procedures
require the Finance section to notify the Equipment and Technology Evaluation
section at the time the investigative equipment is procured. In addition, they were to evaluate the
current procedures and determine if enhancements were needed. |
Incomplete. The CIMIS
continues to be incomplete and inaccurate.
Our review of documentation for the purchases of investigative
equipment showed that not all of the investigative equipment ordered and
received was being entered into the CIMIS. |
|
10 - Resolve all instances
where the serial numbers were changed based on information provided by the
TIGTA during our review. |
Management agreed and stated they would resolve the
serial number changes identified during the audit. |
Implemented. |
11 - Establish procedures to ensure changes to
serial number information in the CIMIS are appropriate. |
Management agreed and stated they would review the
issue of serial number changes and update the necessary policies and procedures
where appropriate. |
Implemented. The CI Division
has issued changes to the CIMIS criteria so that the chance for a duplicate
record being input is limited. In
addition, procedures have been established to limit the persons with the
ability to change serial numbers within the CIMIS. |
|
12 - Establish procedures to identify duplicate
records in the CIMIS. A report listing
all items with duplicate serial numbers should be generated periodically and
provided to the Director, Equipment and Technology Evaluation, for
review. |
Management agreed and stated they would create a
report to identify equipment records containing exactly matching serial
numbers. |
Implemented. While no
report was established, the CI Division has enhanced the CIMIS so the record
is rejected if a duplicate serial number is entered. |
|
13 - Establish procedures to
ensure functional security reviews of investigative equipment and firearms
storage areas are conducted on an annual basis. |
Management agreed and stated they would take the
necessary steps to ensure functional security reviews of investigative
equipment and firearms storage areas are conducted on an annual basis. |
Incomplete. We
determined during our office visitations that functional security reviews
were not being conducted. |
|
14 - Restrict access to
investigative equipment storage areas to only those personnel responsible for
maintaining the equipment. |
Management agreed to place renewed emphasis on
restricting access to the investigative equipment to necessary personnel
only. |
Incomplete. We
determined during our field office visitations that access to the
investigative equipment storage areas is not restricted to only those
personnel with a business reason. |
|
15 - Establish procedures to
ensure investigative equipment assigned to the CI Division HQ offsite
warehouse is effectively stored. This
should include the use of a layout or schema to document where equipment is
located at the site. The location
should then be noted in the CIMIS database. |
Management agreed stating they would review the
operations of the warehouse facility. |
Implemented. Our review
of the warehouse indicated a schema had been prepared and the CIMIS has been
enhanced to capture a storage location. |
Appendix VI
Criminal Investigative Management Information
System (CIMIS) – A database that is used by the CI Division to track the
status and progress of investigations and the time expended by special
agents. In 2005, the CIMIS was enhanced
to include the ability to track investigative equipment for the CI
Division. The CIMIS allows management to
track where the equipment is, to whom it is assigned, and to generate reports
on the use of the equipment.
CIMIS Data Dictionary – A document identifying the data fields in
the CIMIS and the business description of each data field.
Field Office – Offices within the four CI Division geographical areas
throughout the country with boundaries that range from a portion of a single
State to inter-State areas.
Homeland Security Presidential Directive 12 – This directive calls for a mandatory, Government-wide standard for secure and reliable forms of identification issued by the Federal Government to its employees and employees of Federal contractors for access to Federally controlled facilities and networks.
Internal Revenue Code
– The code is a codified collection of
Investigative Equipment – Equipment required by the CI Division for carrying out its investigative and enforcement responsibilities. Examples of equipment used by special agents include fleet vehicles, radio communication equipment, weapons, body armor, electronic surveillance equipment, night vision equipment, and optical equipment.
Miscellaneous Investigative Equipment Category – This category includes enforcement and belt badges, pocket commissions, and fingerprint kits.
Pocket Commission – Special agent identification media consisting of a photograph and sequentially numbered Certification for Authority.
Recommendation of Financial Liability – A determination made by management to impose financial liability against an individual in the actual amount of the loss to the Federal Government (the difference between the value of the property immediately before the loss, theft, damage, or destruction and the value immediately after) when there is evidence of gross negligence or willful disregard of the regulations.
Appendix VII
Management’s Response to the Draft Report
DEPARTMENT OF THE
TREASURY
INTERNAL REVENUE
SERVICE
WASHINGTON, D.C. 20224
Criminal Investigation
December 13, 2010
MEMORANDUM FOR DEPUTY INSPECTOR GENERAL FOR AUDIT
FROM: For Victor S. O. Song /s/ Rick A. Raven
Chief, Criminal Investigation CI (SE:CI)
SUBJECT: Response To Draft Audit Report—Weaknesses Continue to Exist in the Controls Over Investigative Equipment (Audit #201030008)
The following is Criminal Investigation’s (CI) response to the above named report. Please incorporate this memorandum into the final audit report.
While CI continues to experience some weaknesses with equipment controls, we appreciate Treasury Inspector General for Tax Administration’s (TIGTA) recognition of the substantial progress that CI has made in this area. Internal controls over investigative equipment require a constant balance of security of the equipment with the accessibility of equipment to field personnel to successfully complete CI’s mission. Despite CI’s limited resources we believe that progress will continue to be made in this important area. To emphasize the importance of controls over investigative equipment, CI instituted a Fiscal Year 2011 performance commitment on this issue for every Special Agent in Charge.
Our comments on the specific recommendations in this report are as follows:
IDENTITY OF RECOMMENDATION #1
Finalize the Internal Revenue Manual and the Criminal Investigation Equipment Management Procedures and instructions to ensure employees are aware of the requirement to update CIMIS with the last date the investigative equipment items were verified during the annual inventory process.
CORRECTIVE ACTION (S)
Criminal Investigation agrees with the recommendation. Internal Revenue Manual (
Additionally, a suggestion for enhancement to the CIMIS
system has been submitted to the CI Technology Operations Investigative Services
(TOIS) office for approval, design and eventual implementation. This enhancement will create a new report
that will identify the last date the investigative equipment items tracked in
CIMIS were verified. The report will be
written to provide the Director, Security & Technical Operations (
IMPLEMENTATION DATE
PROPOSED COMPLETION DATE:
RESPONSIBLE OFFICIAL (S)
Director
CORRECTIVE ACTION (S) MONITORING PLAN
Verify in next published versions of IRMs 9.11.3 and 9.10.1 that changes have been made. Verify in completed, revised Criminal Investigation Equipment Management Procedures handbook that changes have been made. At the end of the first annual physical inventory cycle that occurs after the revised guidance has been issued, last verification date data from CIMIS will be sampled to ensure updates were input.
IDENTITY OF RECOMMENDATION #2
Modify the CIMIS generated reports to sort the investigative equipment items (e.g., by category, manufacturer, and model) to facilitate the storage area inventory process. Because the investigative equipment in the storage areas are grouped by like items, a sorted report can provide a more efficient inventory process and help identify items that should be recorded in the CIMIS.
CORRECTIVE ACTION (S)
Criminal Investigation agrees with this recommendation. A suggestion for enhancement to the CIMIS system has been submitted to the CI Technology Operations Investigative Services (TOIS) office for approval, design and eventual implementation. This enhancement will change the storage inventory report to be sorted by Manufacturer, Model and Category to increase the efficiency of the inventory process.
IMPLEMENTATION DATE
PROPOSED COMPLETION DATE: November 2012
CIMIS upgrades require significant funding in addition to
the time required in designing program changes.
With
RESPONSIBLE OFFICIAL (S)
Director TOIS
CORRECTIVE ACTION (S) MONITORING PLAN
If suggested enhancements have been implemented in CIMIS, interviews will be conducted with staff to determine whether the newly sorted report enabled them to more efficiently perform their equipment storage inventory duties.
IDENTITY OF RECOMMENDATION #3
Ensure the Director,
CORRECTIVE ACTION (S)
Criminal Investigation partially agrees with the recommendation. The CI Director, Field Operations and/or Special Agent in Charge (SAC) currently review all documentation relating to investigative equipment disposals for accuracy and completeness; and reject and return to the initiating office for corrective action when documentation is incomplete. Investigative equipment disposal logs and/or documentation is forwarded to the Director, Security & Technical Operations annually as part of the annual Physical Investigative Equipment Certification. When the loss or damage of a badge, pocket commission or firearm occurs, the Director, Field Operations forwards the disposal documentation immediately to the Director, Security & Technical Operations.
Proper processing of forms 1933’s will be addressed at the
2011 Equipment Coordinators
IMPLEMENTATION DATE
PROPOSED COMPLETION DATE:
RESPONSIBLE OFFICIAL (S)
DFO’s
CORRECTIVE ACTION (S) MONITORING PLAN
Guidance regarding this implementation will be provided to DFO’s during a CI Senior Staff meeting. DFO staff will then review the 1933 logs quarterly to ensure all 1933’s are processed properly and completely timely.
IDENTITY OF RECOMMENDATION #4
Ensure the Director,
CORRECTIVE ACTION (S)
Criminal Investigation partially agrees with this recommendation. CIMIS review of user permissions is the responsibility of the each Field Office and HQ Director. Criminal Investigation conducts certifications of all user profiles to include permissions of users with access to the investigative equipment application of CIMIS on the annual basis during the annual Mandatory Briefings. Area Subject Matter Experts (SME) will be informed and required to review annual certifications to ensure user permissions are correct.
IMPLEMENTATION DATE
PROPOSED COMPLETION DATE:
RESPONSIBLE OFFICIAL (S)
DFO’s
CORRECTIVE ACTION (S) MONITORING PLAN
Subject Matter Experts will reconcile user permissions with actual need and recommend corrective action to the Director of Research through the respective management chain as appropriate.
IDENTITY OF RECOMMENDATION #5
Create a report to identify the investigative equipment inventory
in a pending status for more than 60 days and provide this report to the
Director,
CORRECTIVE ACTION (S)
Criminal Investigation agrees with this recommendation. A suggestion for enhancement to the CIMIS
system has been submitted for approval, design and eventual implementation to
the CI Technology Operations Investigative Services (TOIS) office. This enhancement will create a new report
that will identify the investigative equipment inventory in pending “ordered”
status for any specified length of time.
The report will be written to provide the Director,
IMPLEMENTATION DATE
PROPOSED COMPLETION DATE: November 2012
Criminal Investigation Management Inventory System upgrades
require significant funding in addition to the time required in designing
program changes. With
RESPONSIBLE OFFICIAL (S)
Director TOIS,
CORRECTIVE ACTION (S) MONITORING PLAN
If the new report is deployed in CIMIS, it will be run iteratively until any pending ordered items deemed “overage” (i.e., 60 days or more in ordered status) have been either acquired or disposed.
IDENTITY OF RECOMMENDATION #6
Analyze the CIMIS investigative equipment data to identify obsolete items and provide specific instructions to the field offices to properly document the removal of this investigative equipment from the CIMIS.
CORRECTIVE ACTION (S)
Criminal Investigation agrees with this recommendation. Criminal Investigation has already begun the process of identifying potentially obsolete equipment items for further analysis and disposal where appropriate. Special ad hoc reports accompanied by specific instructions regarding the disposition of obsolete items will be provided by HQ to the field offices annually for review to reduce unneeded inventory.
IMPLEMENTATION DATE
PROPOSED COMPLETION DATE: March 31, 2011
RESPONSIBLE OFFICIAL (S)
Director,
CORRECTIVE ACTION (S) MONITORING PLAN
Utilizing existing management information, Criminal Investigation will continue to monitor the inventory of items ten (10) years or older to ensure that they are being actively used or otherwise needed for investigative purposes.
IDENTITY OF RECOMMENDATION #7
Until Homeland Security Presidential Directive 12 is fully
implemented, the Chief, CI, should initiate a manual process in those field
offices where computer systems cannot be upgraded to help maintain the records
of CI Division personnel who have access to investigative equipment items.
CORRECTIVE ACTION (S)
Criminal Investigation agrees with this recommendation. The Director of Operations (OPS) will issue a memorandum to all SAC’s reminding all personnel of the necessity to control access to investigative equipment. Each SAC will ensure an access control log/sign out sheet is utilized by the office.
IMPLEMENTATION DATE
PROPOSED COMPLETION DATE: March 31, 2011
RESPONSIBLE OFFICIAL (S)
Director OPS and all SAC’s
CORRECTIVE ACTION (S) MONITORING PLAN
During the annual inventory the inventory team will verify
that control logs are being utilized and report any issues needing to be
addressed to the Head of Office as well as the Director,
IDENTITY OF RECOMMENDATION #8
The Chief, CI, should establish procedures to ensure the CI Division completes annual functional security reviews of investigative equipment and weapons storage areas. This includes reviewing access lists to ensure only authorized CI Division personnel have access to investigative equipment.
CORRECTIVE ACTION (S)
Criminal Investigation disagrees with this recommendation. All CI managers as part of the Annual
Assurance Review must certify compliance with
Controls over investigative equipment require a constant
balance of security of the equipment with the accessibility of equipment to
field personnel to successfully complete CI’s mission. The level of security that is afforded equipment does differ
depending on the sensitivity of the equipment.
For instance firearms and electronic surveillance equipment is locked
down with controlled access limited to Firearms Instructors and Tech Agents
respectively. Other routine equipment
such as cameras, recorders, high power binoculars, etc. are
necessarily accessible to all personnel 24 hours a day. It is also noted that CI space in general is
restricted to CI personnel unlike other
As referenced in number seven above, each SAC will ensure an access control log/sign out sheet is utilized by the office and access to equipment is controlled as appropriate.
IMPLEMENTATION DATE
PROPOSED COMPLETION DATE:
RESPONSIBLE OFFICIAL (S)
Heads of Office
[1] See Appendix VI for a glossary of terms.
[2] In January 2010, the CI Division raised the dollar criteria to $900. Because we selected our samples using data as of October 2009, we did not conduct any tests to determine how this new criteria was implemented.
[3] Weaknesses in the Criminal Investigation Function’s Controls Leave Investigative Equipment Vulnerable to Loss (Reference Number 2005-10-163, dated September 30, 2005).
[4] The original report contained 15 recommendations; however, CI Division management did not implement our recommendation pertaining to bar coding, stating it was not feasible.
[5] We performed fieldwork at the warehouse and STO section. Unless otherwise noted, reference made in this report to the CI Division HQ office reflects the results of our fieldwork at these two locations.
[6] The CI Division HQ office maintains most of its radios in this warehouse location.
[7] We selected equipment assigned to the STO section and warehouse.
[8] CI Division personnel utilize reports generated from the CIMIS to perform the annual inventory. These reports include Custody Receipt for Government Property (EQR 01), Storage Responsibility for Government Property (EQR 02), Equipment Checked Out on Temporary Custody (EQR 07), and Equipment Checked Into Temporary Custody (EQR 08).
[9] We reviewed purchases made by the CI Division HQ during FYs 2006 through 2007 (to account for items that may have been purchased after the June 2006 flood) and reviewed the most recent purchases made by the CI Division HQ and field offices during FY 2009.
[10] For example, our sample included a global positioning system. The procurement documentation indicated a total of eight units were purchased; however, our review of the CIMIS could only locate six units.
[11] Examples of these items include video cassette recorders, pagers, and tape cassette recorders.
[12] See Appendix VI for a glossary of terms.
[13] We performed fieldwork at the warehouse and STO section. Unless otherwise noted, reference made in this report to the CI Division HQ office reflects the results of our fieldwork at these two locations.
[14] We reviewed purchases made by the CI Division HQ during FYs 2006 through 2007 (to account for items that may have been purchased after the June 2006 flood) and reviewed the most recent purchases made by the CI Division HQ and field offices during FY 2009.
[15] For example, our sample included a global positioning system. The procurement documentation indicated a total of eight units were purchased; however, our review of the CIMIS could only locate six units.
[16] See Appendix VI for a glossary of terms.
[17] We reviewed purchases made by the CI Division HQ during FYs 2006 through 2007 (to account for items that may have been purchased after the June 2006 flood) and reviewed the most recent purchases made by the CI Division HQ and field offices during FY 2009.
[18] For example, our sample included a Global Positioning System. The procurement documentation indicated a total of eight units were purchased; however, our review of the CIMIS could only locate six units.
[19] See Appendix VI for glossary of terms.