OIG Says EPA Needs Tougher IT Policies

In a report released today, the Environmental Protection Agency’s (EPA) Office of the Inspector General (OIG) sounded the alarm regarding EPA’s handling of IT property in a number of regions around the country, and said it offered the agency an extensive list of administrative fixes to those problems.

OIG said EPA agreed with its recommendations and was taking action to respond to them.

Equipment Control Audits

In June 2016, OIG received a hotline request from the then-acting Regional Administrator for Region 5 of EPA, which serves Illinois, Indiana, Michigan, Minnesota, Ohio, Wisconsin, and 35 tribal nations. According to OIG, the acting Regional Administrator requested that the OIG review Region 5’s IT property procedures. As a result, OIG launched an audit to determine whether Region 5 had controls in place to protect IT property–particularly laptops–from fraud, waste, and abuse.

After some preliminary research in Region 5, OIG expanded its audit to Region 2, which serves New Jersey, New York, Puerto Rico, U.S. Virgin Islands, and eight tribal nations, as well as the Office of Water (OW) at EPA’s headquarters in Washington. OIG expanded the audit to determine whether there were any agency-wide trends that should be of concern to EPA.

In both regions, OIG found that the “lack of sufficient controls for managing IT property creates vulnerability to fraud, waste and abuse, including potential theft and misuse.”

Region 5

After auditing Region 5, OIG found five areas of concern:

• No policy existed for tracking laptops in transition from being used from one employee to being assigned to another.
• Personnel were unaware of IT property status or procedural changes.
• Excess property was not always tracked or recorded.
• Existing policy did not include guidance for taking laptops out of the office.
• The role of property custodians was not always included in employee performance standards.

In response to these areas of concern, OIG offered five recommendations:

• Issue a policy and procedure describing how to track returned laptops that are in transition.
• Revise the current standard operating procedures to address the process for reconciling new laptop arrivals and assignments with Property Custodial Officers.
• Establish a policy and procedure for tracking excess property within Region 5.
• Update the current Region 5 policy to include guidance on the removal of laptop computers from the office.
• Direct managers to include property roles in employee performance standards for staff responsible for managing government property at the supervisory level or below.

Agency-wide Concerns

By expanding its audit to include Region 2, OIG identified five agency-wide areas of concern.

• Agency-wide responsibility for the EPA property management program rested with a non-managerial-level employee.
• Personnel lacked sufficient awareness of the EPA’s Agency Asset Management System and were not always using the system.
• EPA guidance for excess IT personal property was not established.
• Property roles and responsibilities were often not included in employee performance standards.
• A required form documenting employee property custody was rarely used.

In terms of recommendations, OIG offered one specific recommendation for Region 2 and OW: OIG said EPA should require managers to include property roles in employee performance standards for staff responsible for managing government property.

OIG had five additional recommendations for the Office of Administration and Resources Management (OARM), which is responsible for EPA property management.

• Verify that IT property data is included and updated in the EPA’s asset management system in a timely manner.
• Coordinate with the Office of Environmental Information on the creation of guidance that includes specific timeframes for properly sanitizing and excessing IT property in accordance with EPA and Federal requirements.
• Update the EPA Personal Property Manual with timeframes for sanitizing and excessing IT property and verify that EPA regions and program offices are following the new disposal procedures.
• Verify that approved language on the responsibilities for managing government property has been included in employee performance standards for all staff responsible for managing government property at the supervisory level or below.
• Verify whether EPA regions and headquarters program offices are using Form 1740-22, which documents the assignment of personal property to an EPA employee, as directed by the OARM and mentioned in the EPA Personal Property Manual.

All regions and offices included in the audit agreed with OIG’s recommendations and provided “acceptable planned corrective actions and dates for completion,” OIG said. All recommendations in the report should be completed by October 2018, according to the EPA.