The internal controls over the equipment inventory systems in the U.S. House of Representatives (House) can be improved to provide greater assurance that the House's assets are identified, accounted for, secured, and valued uniformly on a House-wide basis. The House has not implemented adequate controls to ensure that its system of inventories is in accordance with sound management principles. Specifically, (1) equipment is inventoried in numerous systems which are inconsistent with each other and contain incomplete information; (2) certain policies and procedures necessary to ensure a reliable inventory system either are not implemented or are not consistently applied; (3) inventory records are not timely reviewed and updated; (4) the integrity and reliability of management controls for the computer-based Office Equipment System are inadequate; (5) segregation of duties is not always implemented; and (6) physical security is inadequate to safeguard certain assets. We have also addressed an additional matter in our report that, while not as critical as the findings themselves, warrants management's attention and action to correct. As a result, the House's ability to identify and account for all its assets and to provide effective, timely, and accurate input to the financial statements used by management is diminished.

RECOMMENDATIONS

We recommend that the Chief Administrative Officer (CAO) develop a proposal, for approval by the Committee on House Oversight (CHO), to implement an inventory tracking process for equipment which contains all information necessary to adequately identify and account for all assets House-wide. We also recommend that the CAO submit a proposal to the CHO for approval to develop House-wide, written policies and procedures which ensure the accountability of all assets. We also recommend that the CAO periodically review and adjust the inventory records where appropriate; limit access authority to supervisory transactions to authorized personnel only; implement effective segregation of duties; and ensure that assets are properly secured at all times.

MANAGEMENT RESPONSE

On May 28, 1997, the Acting CAO concurred with the 6 findings and all 21 recommendations (see Appendix). According to the response, the Acting CAO is implementing, or plans to implement, a variety of corrective actions to improve the accountability and uniformity of equipment inventory systems. Some examples of current and planned actions include:

(1) proposing a policy, for approval by the CHO, that all purchases of equipment and furniture go through one of the following entities, Office Systems Management (OSM), Furniture Resource Center (FRC), or House Information Resources (HIR), to ensure that all assets of the House are accounted for in one of these inventory systems (purchases outside these inventory systems would not be honored by the Office of Finance); (2) submitting a proposal to the CHO to determine the requirements and cost-benefits of consolidating the inventories of the House; (3) proposing a policy, for approval by the CHO, to conduct inventories of equipment owned by the House to reconcile the assets to the inventory on a timely basis, investigating and adjusting any differences as appropriate; (4) proposing a policy, for approval by the CHO, which provides for the establishment of depreciation rates and capitalization thresholds and authorization to write-off obsolete or lost assets; (5) ensuring that policies and procedures are clearly disseminated and consistently and uniformly applied by House management; (6) reviewing and resolving the "not billed/not paid" report and using it to supplement the accounts payable tracking system; (7) proposing a policy to address the discrepancies between payments and purchase order amounts, and addressing the validity of current OSM procedures used to process vendor invoices; (8) having OSM work with HIR personnel to address security issues and instituting a policy requiring documentation of changes made by HIR, including appropriate testing; (9) performing independent reconciliation of OSM physical inventories; and (10) ensuring that assets are secured at all times.

OFFICE OF INSPECTOR GENERAL COMMENTS

The CAO's current and planned actions on all of the findings are responsive to the issues we identified and, when fully implemented, should satisfy the intent of the recommendations.

I. INTRODUCTION

Background

Office Systems Management (OSM) is the entity primarily responsible for the purchase and subsequent tracking of office equipment and computers (herein known collectively as equipment) for the U.S. House of Representatives (House). OSM is also responsible for purchasing and tracking District office furnishings. Furniture Resource Center (FRC) purchases and accounts for the furnishings of Members' Washington, D.C. offices as well as of other House entities, such as the Page School. For further discussion about FRC's inventory responsibilities, see the Office of Inspector General's report entitled, Internal Controls Over House Furnishings Need Improvement, 96-CAO-08, dated September 10, 1996. House Information Resources (HIR), the House's internal computing and telecommunications facility, purchases computers and telecommunications equipment for its own use, in addition to purchasing telecommunications equipment for the House, and maintains its own computer and telecommunications equipment inventory.

One of OSM's duties is to process equipment requests from Members, Committees, and House offices. OSM purchases the equipment through its operating or program budget and then charges the requester's account for the amount of the purchase. Typically, OSM offers two types of payment plans for equipment purchases, the one time acquisition plan and the three-year plan. With the latter plan, OSM charges the account each month for 1/36th of the total purchase price. The account under either plan is also charged monthly for any associated maintenance.

Management officials in the Office of the Chief Administrative Officer (CAO) stated that the House has three main inventory systems, OSM, HIR, and FRC but is aware that other House entities do purchase and track equipment unique to their operations themselves. For instance, the Attending Physician, House Recording Studio (HRS), and Photography Studio purchase hospital beds, microphones, and cameras, respectively, from their own funding instead of having OSM make these purchases. However, these entities purchase personal computers, fax machines, and other general equipment through OSM.

In total, we have identified nine House entities which perform some type of purchasing function and maintain, in whole or in part, their own inventory listings. In addition, some may have their equipment listed in OSM or elsewhere. Besides OSM, HIR, FRC, Attending Physician, HRS, and the Photography Studio, the other entities are: Sergeant at Arms (SAA), Office of Supply Services, and Office of the Clerk.

Objective, Scope, And Methodology

Our objective was to evaluate the effectiveness of internal controls over OSM's equipment inventory system. During the survey phase, we identified other entities, as noted above, which procured items without going through OSM, therefore, we included these entities on a limited basis in our audit. We identified and evaluated the internal control structure of OSM through (1) interviews with personnel in OSM, HIR, Office of Finance, Attending Physician, HRS, Photography Studio, Page School, and SAA; (2) reviews of pertinent policies and procedures; (3) observations of operations; (4) reviews of management reports; and (5) an evaluation of the flow of transactions. Our audit was limited to OSM's various locations, and to HIR, the Office of Finance, Attending Physician, HRS, Photography Studio, Page School, and SAA and covers Calendar Year 1995. We also conducted physical inventories of the telecommunications equipment assigned to two House offices and the House-owned, used pagers. In addition, we identified and reviewed subsequent events related to accounts payable, records updating, and bulk inventory. The audit was conducted in accordance with Government Auditing Standards issued by the Comptroller General of the United States and included such tests as we considered necessary under the circumstances.

According to a June 30, 1995 organization chart, published by the Office of the CAO, Office Systems Management's (OSM) name was changed to Property Asset Management (PAM). However, PAM's current Assistant Chief informed us that PAM was renamed OSM effective October 1, 1996. To avoid any confusion associated with having to footnote or explain why we use PAM instead of OSM and vice versa, we will use the reference OSM consistently throughout this report. In addition, for purposes of this report, the term House office includes Leadership and other House organizations, unless otherwise noted.

Internal Controls

We reviewed internal controls related to the operation of the House's inventory system. We found numerous internal control weaknesses which are discussed below in Section II, "Findings and Recommendations."

Prior Audit Coverage

• Audit of Financial Statements for the 15-Month Period Ended December 31, 1994 (Report No. 95-HOC-22, dated July 18, 1995). This audit reviewed the internal control structure of the House for the 15-months ended December 31, 1994, and made recommendations for its improvement in several areas, including accountability of equipment.

• Audit of Financial Statements for the Year Ended December 31, 1995 (Report No. 96-HOC-05, dated July 30, 1996). This audit assessed the status of those recommendations and determined that only a few had been implemented and that the majority were still pending action by the House.
  
• House Office Systems Management-Fiscal Year Ended 9/30/93 and Three Months Ended 9/30/92 (GAO/AIMD-95-78, dated March 30, 1995). The General Accounting Office (GAO) audited OSM's Statements of Cash Receipts and Disbursements for fiscal year 1993 and the three months ended September 30, 1992 and found that the statements were reliable in all material respects and that internal controls in effect on September 30, 1993, reasonably ensured that losses, noncompliance with laws or regulations, or misstatements affecting the financial statements would be prevented or detected and there was no material noncompliance with laws and regulations. GAO reported that OSM corrected the internal control weakness identified in its previous report (House Office Systems Management-Three Months Ended 9/30/92 and Fiscal Years Ended 6/30/92 and 6/30/91, GAO/AIMD-94-18 dated January 14, 1994). In that report, GAO noted that OSM did not have procedures to prevent or detect all unauthorized changes to its automated data files. GAO did not make any recommendations in the March 30, 1995 audit report.
  
  
  II. FINDINGS AND RECOMMENDATIONS
  

Finding A: Numerous Inventory Systems Exist Which Are Inconsistent

With Each Other And Contain Incomplete Information

No centralized equipment inventory control system exists to acquire, receive, record, value, and account for all equipment purchased and leased by and for the House. Instead, numerous systems exist, some of which are inconsistent with each other and do not contain the same type of information, such as cost or depreciation. Because of the decentralized nature of House inventory management, we do not know if we have identified all existing House inventory systems or whether all House assets are recorded in a system. Separate inventory systems exist in some cases because of the specialized nature of the equipment. Some entities did not value their inventories because they did not consider cost to be a relevant factor in inventory accountability. Inventory systems that collectively do not reflect the sum total of all assets under House control, that are not consistent with each other, and do not provide complete information, may improperly indicate a lack of assets, misstate the financial statements, and lessen accountability of the assets.

Discussion

OSM managers stated that OSM served as the House's central purchasing office for equipment and district office furnishings. Although they were aware of two other inventory systems of the House, HIR and FRC, they indicated they were not aware that other systems, such as the one maintained by the Attending Physician, existed "outside" of these systems. However, subsequent discussions with CAO management during our March 12, 1997 exit conference indicated they consider OSM, FRC, and HIR the only bona fide inventory systems of the House. Nonetheless, they did acknowledge that, based on information developed in our audit, these three systems do not contain all assets owned by the House. FRC's principal responsibility is to furnish the Washington, D.C. offices, however, it also acts as a conduit for purchasing non-furniture items for Members, Committees, and House offices, such as subscriptions for a Member and a public address system for the Page School. FRC management said they purchased these items, even though they were not furniture, at the request of the Member and House office. The latter items are not included in FRC's inventory system, according to FRC personnel, because the expenditures are not made through its program budget. Rather, they are purchased with the Member's or House office's funds. These items may or may not be tracked by OSM; it depends on whether OSM is notified about them. In contrast, OSM includes items it purchases for Members and other House offices in its inventory system. These purchases are made from OSM's program budget and then charged back to the Member, Committee, or House office.

In the past, OSM has been able to track inventory because it processed purchases on behalf of Members, Committees, and House offices. OSM entered the purchase information into its inventory system and assigned a control number to each item. The Members' Congressional Handbook, the regulations governing the Member's Representational Allowance issued by the Committee on House Oversight (CHO), effective September 1, 1995, states that Members must contact OSM before purchasing any equipment. These regulations gave OSM a means for capturing and entering new purchases into its inventory system, thus providing accountability. The regulations in the Committees' Congressional Handbook, also issued by the CHO and effective on June 1, 1996, indicate that Committees should not purchase equipment without consulting OSM and should refer to the User's Guide to Purchasing Equipment, Software, and Related Services. With the termination of the Approved Equipment List, Members, Committees, and House offices may purchase equipment themselves--from any source. However, unless they notify OSM about these purchases, the information may not be entered into OSM's inventory system.

Inventory system problems

OSM conducts an annual inventory count of the equipment that it has purchased for each Member, Committee, and House office. During the audit period, the CAO distributed inventory listings of equipment to Members, Committees, and House offices and asked for confirmation as to their accuracy. Items which were purchased "outside" OSM (e.g., equipment purchased through FRC or items purchased under different funding sources) will not be included in these listings unless OSM has been notified about these items and subsequently entered them into the inventory system. Based on interviews with House personnel, we understand offices do not always inform OSM that the listings exclude certain items. Therefore, all listings may not contain a complete inventory count nor would OSM necessarily know this.

Other inventory systems contribute to the problem

Besides the inventory systems maintained by OSM, FRC, and HIR, other House offices have their own systems. Personnel we interviewed at HRS, the Communications and Client Services Groups within HIR, the Page School and the Attending Physician, indicate that these groups maintain their own systems and do not always report their assets to OSM.

• HRS inventory system

HRS has certain equipment that was not included in OSM's inventory system. Because HRS had not purchased this equipment through OSM, it initially was not tracked by OSM. Instead, certain production equipment, such as televisions and audio equipment, were recorded in a separate customized computer system residing on HIR's mainframe. Until September 30, 1995, HRS had statutory authority to purchase production equipment from its revolving fund. Consequently, it did not have to submit equipment procurement requests through OSM. (Pursuant to the Legislative Branch Appropriations Act for Fiscal Year 1996, Public Law 104-53, funds for HRS "shall be available only to the extent provided in the appropriation Acts" effective October 1, 1995.) According to HRS personnel, as of November 1, 1995, HRS stopped using its revolving fund and began purchasing all studio production, House floor coverage production, and administrative office equipment through OSM; therefore, these items are now tracked by OSM. (Based on our review of the HRS detailed inventory equipment listing dated May 1996, we did not see any equipment with a purchase date of October 1, 1995 through October 31, 1995.)

• HIR telecommunications inventory system

We also identified a fragmented, telecommunications equipment inventory information system within HIR. HIR's Communications Group is responsible for the House's Washington, D.C. telephone and network infrastructure while the Client Services Group provides the phone system and service to both Washington, D.C. and district offices. This information is recorded in several different inventory systems or databases maintained by different subgroups within HIR. For example, the Communications Group's Network Configuration Management subgroup maintains several different inventories for the network infrastructure. The four network configuration managers within this subgroup maintain their own inventory databases, which are all designed differently. Each of these systems was generally designed for a specific use, but contain useful data that can be utilized for inventory purposes. However, these systems do not contain all the necessary information required in a typical inventory system. Nevertheless, the Group has the capability to track network equipment through its current network management system (NMS) but these capabilities have not yet been utilized. That is, through configuring all equipment connected to the House network, the NMS (i.e., NetView for Advanced Interactive Executive (AIX)) can detect the location and type of equipment attached to the network. Therefore, it is our view that the Group should explore the possibility of consolidating the various databases maintained by HIR's subgroups and integrating the consolidated database with the House NMS.

In contrast, Communications Group's Management of Network Income, Expense, and Services (MONIES) System tracks telecommunications voice equipment and lines for the House and district offices and provides the overall telecommunications utilization and service expense information for generating the monthly charge-backs to Members and other House offices. However, the inventory does not contain all voice equipment, such as the PBX switch equipment, located at the Longworth Building. Presently, the switch information is contained in the PBX telephone system. According to HIR, they were not aware of a need to maintain an all-inclusive voice telecommunications inventory for decision-making or asset valuation purposes, but can easily add the switch information to the MONIES System. Therefore, we believe that HIR should centralize all voice telecommunications equipment and lines in the MONIES System by adding equipment, such as PBX switch equipment, currently not in the MONIES System.

• Additional systems

The Page School maintains its own internal listing of equipment, only some of which is included in OSM's inventory. The Attending Physician purchases medical equipment "outside" of OSM. Based on discussions with SAA personnel, SAA's computers and office equipment are recorded in OSM's inventory system. However, before the House discontinued the Approved Equipment List, SAA ordered equipment not on this list through FRC. Since then, SAA personnel indicated they place all orders for equipment, such as radios and communications equipment, through OSM.

Telecommunications inventory system information

In late July 1996, we conducted limited tests of the accuracy of the telecommunications equipment, lines, and voice mail links used for charging expenses back to Member, Committee, and other House offices and concluded that opportunities exist for improving HIR's voice telecommunications inventory system information. We obtained the CAO's July 1996 telecommunications equipment and services list generated from HIR's MONIES System, which was sent to Member and other House offices for review and verification. We then performed physical inventories of telecommunications equipment, lines, and software at two House offices (i.e., the office suites of the CHO and the Office of Inspector General (OIG)). The results of our physical inventory were compared to the CAO's list to determine the accuracy of the information in the MONIES system, in which charge backs are based. In the CHO offices, we found that HIR was billing the CHO for 18 voice/data lines, which we could not locate. On the other hand, the CHO was using three voice lines and eight voice mail boxes, which were not recorded in the inventory system and, therefore, were not charged to the office. In the OIG's offices, we found that HIR was billing the OIG for fourteen telephone lines, three voice mail boxes, one soft line, two 36-button digital sets, and eight 10-button analog sets, which we could not locate. However, we did identify one telephone line, two voice mail boxes, one analog speaker phone, and twenty two 10-button analog sets that were in use and needed to be added to the inventory.

We discussed these discrepancies with the HIR Telecommunications (a subgroup within the Client Services Group) manager and found reasonable explanations for some of these discrepancies. From HIR management, we learned that the three voice lines and eight voice mail boxes, which were not recorded in the inventory system and were not charged to the CHO, may have been listed and billed to the individual Member offices instead of the CHO. HIR indicated that billing a Member office, instead of a Committee, is not an uncommon practice. They further surmised that some of the other discrepancies may have been attributed to the OIG's major office move in early June 1996. HIR further stated that some of the telephone line numbers we could not locate were data lines that, in fact, existed in the OIG offices, but were not in the room locations indicated on the inventory list. HIR was able to provide us the locations of the data lines by using the jack location numbers identified on the office floor plan. Each data line in House offices are marked only with a jack location number. This makes it difficult for office personnel to locate a data line without the jack number--especially when the room numbers are incorrect. Had the inventory list also listed the jack location numbers, the offices could have been able to match the telephone number with the jack location. According to the Telecommunications manager, the jack location information was removed from the inventory list because users found this information confusing. However, the fact remains that while some of these discrepancies could be explained, others could not because some records had not been kept beyond the retention period and, therefore, were not readily available at the time of our inquiry. This raises doubt as to the accuracy and reliability of the inventory information. In addition, a Member's account may be charged when, in fact, the Committee's account should be charged. Although the Telecommunications manager admitted that the inventory information in the MONIES System may not be accurate, she maintained that discrepancies of this volume in any one office do not normally occur.

In conclusion, the House's verification and certification process is ineffective for ensuring the accuracy, completeness, and reliability of the MONIES System inventory information. Consequently, the inventory information in MONIES may be considered unreliable because of admitted inaccuracies. Furthermore, since this information is used to charge telecommunications expenses and services back to Member and other House offices, charge backs to these offices may also be erroneous.

Inconsistent information

The inventory systems we identified do not contain the same, basic information such as cost, depreciation, acquisition value, or equipment location that one would expect to find in an inventory system. For example, OSM's system values its inventory while HIR's system does not record the cost of an asset or its subsequent depreciation. Under generally accepted accounting principles (GAAP), an asset is depreciated in order to allocate its cost to the periods in which services are received from the asset. Failure to depreciate assets may impact the financial statements, depending on materiality. Consequently, those inventory systems which do not depreciate assets make it difficult for management to prepare financial statements according to GAAP. (For further discussion on depreciation refer to Finding B.) The HIR inventory system also does not utilize its ability to track equipment by location. FRC's system may, but does not always, record the cost of an asset such as raw materials and it does not include any additional value derived from processing the item. The usefulness of an inventory system is only as good as the information it provides. From an internal controls perspective, safeguarding assets, and assuring accountability is essential. Providing room locations, control and serial numbers, and equipment descriptions enables management to readily track and identify assets.

The disjointed nature of the inventory systems and the inconsistent reporting and updating of information perpetuate incomplete, inconsistent, and inaccurate records. Consequently, management cannot be assured that it has accurate and meaningful information for decision-making purposes. Furthermore, the House cannot be assured that equipment and services are sufficiently protected from waste, theft, unauthorized use, and mismanagement. Allowing information to exist in multiple inventory systems increases the likelihood that information is inconsistently recorded, incomplete, and inaccurate. Best practices recognize the use of a centralized inventory system within an organization to avoid duplication of information (and the errors associated with duplicate entries) and inconsistencies, and reduce multiple system maintenance support. This approach allows one individual or group to be responsible for the timely updating and maintenance of the inventory system and its contents. However, because entities are unique, there may be circumstances where more than one inventory system is necessary. The House should identify and review all its systems--both formal and informal--and determine the optimum number of systems it needs to track and control its assets.

Recommendation:

We recommend that the Chief Administrative Officer develop a proposal, for approval by the Committee on House Oversight, to:

1. Implement an inventory tracking process for House equipment which contains all information necessary to:

(a) prepare financial statements in accordance with GAAP.

(b) adequately identify and account for all assets on a House-wide basis.

2. Appoint a qualified project manager to oversee and report on the progress of the consolidation effort described below.

3. Comply with recommendation one above by implementing an SDLC approach to maximize inventory consolidation by:

(a) identifying all inventory systems (the systems discussed in this report may not be all-inclusive);

(b) conducting a modified requirements analysis of those inventory systems at the data element level to identify any changes needed to optimize compatibility with one another;

(c) determining which inventory systems can be readily consolidated; that would serve as temporary subsidiary feeder systems; and those, if any, that must stand-alone; reviewing available off-the-shelf software and/or contacting other government entities to determine availability of consolidated inventory systems.

4. Periodically evaluate inventory consolidation efforts to determine if, and at what point, optimum consolidation has been achieved.

Management Response

The Acting CAO agreed with the recommendations in this finding. Specifically, he agreed to implement an inventory tracking system for House equipment that contains sufficient information to satisfy GAAP requirements and adequately identify and account for all assets on a House-wide basis. He also agreed to propose a policy to the CHO to require that all purchases of equipment and furniture go through one of the three appropriate inventory systems (OSM, HIR, and FRC). Purchases outside these inventories would not be honored by the Office of Finance. The Acting CAO will also develop and submit a proposal to the CHO to identify all assets of the House and place such information in one of the three inventories as appropriate. These proposals will be submitted by August 31, 1997 and will include a request for adequate staffing and resources to accomplish them. The Acting CAO also indicated a project manager needed to oversee this inventory effort will be appointed within 30 days after the CHO approves the proposal cited above. In addition, the Acting CAO will submit a proposal to the CHO to determine the requirements and cost-benefits of consolidating the inventories of the House. This proposal will include a request to compare the costs-benefits of this endeavor with other priorities of the House. This proposal will also be submitted by August 31, 1997. A timetable for evaluating consolidation efforts to determine optimum consolidation will be included in the above proposals.

Office of Inspector General Comments

The CAO's planned actions are responsive to the issues we identified and, when fully implemented, should fully satisfy the intent of the recommendations.

Finding B: Formal Policies And Procedures Do Not Exist Or Are Not Followed Consistently

The House does not have, or does not consistently enforce, policies and procedures necessary to ensure an adequate, accountable inventory record across the various inventory systems that currently exist. House managers we spoke to did not specifically state why certain policies and procedures have not been formulated although they explained that time constraints and inadequate staffing have contributed to the lack of enforcement of certain established policies. (However, it should be noted that at the time of our audit no requests for additional staffing had been made to the CHO.) Formal policies and procedures help clearly communicate detailed guidance for handling specific transactions and the importance of this guidance. Without them, processes may be handled inconsistently or improperly. Without consistent application of established policies and procedures, overall compliance by House entities may diminish and operational efficiency may suffer.

Discussion

The Executive Branch has issued numerous directives in the form of Federal guidance aimed at improving Federal financial management, including internal controls. Although the House is not required to adhere to Executive Branch directives, its intent to modernize and integrate its financial management system would benefit from adherence to generally accepted management practices as expressed, for example, in circulars issued by Office of Management and Budget (OMB). OMB Circular No. A-123, entitled Management Accountability and Control (revised June 21, 1995), provides guidance on improving the accountability and effectiveness of Federal programs and operations by establishing, assessing, correcting, and reporting on controls by management. An organization's internal control structure consists of management's policies, procedures, and commitment to reasonably prevent material errors and irregularities from occurring or going undetected. In addition, internal controls are the overall plan of an organization and the methods employed to: (1) safeguard assets; (2) ensure the reliability of accounting data; (3) promote efficient operations; and (4) ensure compliance with established policies. Although some House inventory systems have implemented certain internal controls, no formal, documented House-wide policy has been developed or implemented requiring that: (1) detailed property and equipment records be checked periodically by physical inventory by personnel knowledgeable about such equipment; (2) differences between the records and physical counts be reconciled and the records be adjusted to reflect the differences; (3) supporting documentation, including proper authorization of transactions, be maintained; (4) assets be depreciated; (5) policies for the write-off of obsolete and missing equipment be established; (6) regulations prescribing the freezing of accounts be uniformly enforced; (7) transactions be approved by the proper party; and (8) receipts be timely deposited.

Formal policies and procedures not developed

• Periodic House-wide physical inventory

OSM performs an annual spring inventory of House equipment via "tearsheets"--a listing of equipment assigned to each office. However, it does not conduct a physical inventory of the Member's Washington, D.C. office unless the Member moves to another office location, leaves the House, or requests help with confirming the accuracy of the inventory list. In addition, OSM directs the General Services Administration (GSA) to perform physical inventories of District offices. The Member is ultimately responsible for the accuracy of his or her inventory listing, and confirms it by signing the listing and returning it to OSM, with any discrepancies noted. According to the Member's Congressional Handbook, Members are personally liable for missing, damaged, or stolen equipment assigned to their office equipment account and, in the event an item has been identified as missing, damaged, or stolen must notify the CAO, in writing, of the circumstances. However, during the audit period, the House had no policy in place requiring a periodic physical inventory of its equipment by persons knowledgeable about such equipment. Good business practices mandate conducting a periodic physical inventory by appropriate personnel to ensure that the records accurately reflect the assets on hand. In addition, differences between the records and physical counts should be reconciled on a timely basis and the records adjusted to reflect the differences. An inaccurate count of assets may misstate the financial statements or affect House operations. For example, if a Member requests a piece of used equipment from House inventory (House inventory contains items available for reissue) and OSM does not have an accurate record of such items, OSM may incorrectly deny the request because it does not know what is available or OSM may purchase new equipment for a Member unnecessarily.

Pursuant to the Member's Congressional Handbook, OSM sends out "tearsheets" each spring to all offices, requesting they verify the accuracy of the listing. OSM management informed us that they question returned tearsheets which are not "marked-up" because they believe some offices merely sign off the tearsheet without performing a physical inventory. However, if a questioned office indicates they did a physical inventory, OSM does not independently confirm this. Regardless of who is ultimately responsible for the equipment, failure to conduct a complete physical inventory undermines the effectiveness of this control. Furthermore, the tearsheets may include items such as the internal parts of a computer, e.g., the motherboard, memory chips, controller cards, etc. Unless office personnel are familiar with these items, it may be difficult for them to determine whether the listed component part is correct. Discussions with OSM personnel indicate that maintenance vendors (or employees) may exchange or remove equipment parts that are inventoried, such as internal parts, keyboards, monitors, etc., without OSM receiving proper documentation to adjust the inventory records. (Typically, OSM discovers this when the computer is returned to the House due to obsolescence or a Member relocates or leaves office.) However, the office staff should have been aware of alterations done to their equipment because vendors should not have keys to access Members offices; therefore, office staff should have been present and the change reported to OSM.

HIR also issues an inventory tearsheet for verification with the monthly invoices that are sent to Members, Committees, and House offices. As we delved further into the voice telecommunications inventory validation procedures at the House, we found the process to be ineffective for assuring the accuracy and completeness of voice telecommunications equipment and lines. Annually, a system-wide inventory is conducted to verify both the voice and data equipment. As part of this annual process, HIR sends out an inventory printout to each Member, Committee, and other House office for verification and certification. HIR informed us that because the Member is ultimately responsible for the accuracy of his or her equipment inventory, the Member's office should be responsible for performing the inventory. However, HIR has always offered their assistance with the inventory. Nevertheless, according to HIR, they only received a few requests for assistance from offices. When a Member leaves the House, HIR is responsible for conducting a physical inventory and preparing the office for the new incoming Member and staff.

As with OSM, the annual verification process is not always reliable because HIR relies on Member, Committee, and other House office staff for verification of inventory, yet these individuals often are not technically trained to the level that is needed to differentiate one type of equipment from another. They also may not be familiar with the types of test to employ to locate a voice or data line. Further, they may not have the time to physically verify counts, therefore, they are performing spot checks or no checks at all and returning the inventory as accurate, if at all. In fact, the Telecommunications manager estimated the response rate to the 1996 physical inventory request to be about 30 percent. This adversely affects the accuracy of inventory reconciliation. HIR agreed the responsibility for conducting physical inventories of voice telecommunications equipment and lines should be assigned to HIR.

Further, as of October 1996, not all spring 1995 tearsheets had been returned to OSM. (According to a letter written by the CAO and dated June 2, 1995, the tearsheets should have been returned within 30 days of receipt of the letter.) In addition, OSM staff are still reconciling tearsheet differences to their records. This significant time lag weakens the accuracy of the inventory and lessens the ability of recovering assets which may be lost or misappropriated. OSM management noted that the process is so time-consuming because each component part is listed on the tearsheet, regardless of cost and must be accounted for. For example, a computer processing unit may have five component parts. These are tracked separately by OSM and must be reconciled to OSM's records if a Member or organization notes discrepancies in the tearsheet. In addition, only two staff are assigned to do 1,500-1,600 reconciliations in addition to their other duties, such as office moves. It is not practicable to rely on two staff to reconcile the tearsheets on a timely basis. From an internal control standpoint, assets must be adequately safeguarded. However, a reasonable dollar threshold should be established to avoid the expense and free up staff resources required to track items of nominal value. Items should also be inventoried by operable unit, not component part as this would expedite the reconciliation process.

• Reconciliation of physical counts to records

There is no uniform House-wide policy requiring a reconciliation of the inventory physical count to the records. Although some offices do reconcile their assets to their records, it is not on a timely basis, as illustrated in the OSM example above. However, OSM cannot do timely reconciliations if they do not receive all the necessary information, i.e., the tearsheets, within the prescribed deadline. House organizations, such as HRS, reconcile their recorded production assets with the physical equipment at least once a year. However, this reconciliation process is done by the staff when they have time, i.e., it is not done on a scheduled basis. Management said that they do try to update the records when they have available time. A routine, timely, independent reconciliation process helps assure that (1) assets are adequately safeguarded because missing items would be identified and the cause of these losses could be corrected; (2) inventory records are accurate; and (3) management's policies and procedures are being followed.

• Supporting documentation is not maintained by the appropriate office

During the audit period, OSM's Correspondence division, which processes equipment requests from Members and other House offices, did not retain signed, approved copies of purchase orders. Instead, it submitted the approved purchase orders to the vendors. Failure to keep proper supporting documentation may result in unsubstantiated claims if a dispute arises between the vendor and a Member, Committee, or House office. In addition, signed copies would prove invaluable in those instances where purchase orders are lost in transit.

To ensure that the House receives and is billed for only authorized goods, the Accounts Payable division compares the installation and issue tickets (i.e., receiving reports) and the vendor's invoice with the purchase order. Because the division's copy of the purchase order does not show the authorizing signatures, Accounts Payable cannot confirm that the equipment on the purchase order was properly authorized. According to OSM management, the Office of Procurement and Purchasing maintains an authorized copy of the purchase order. However, to improve this control, Accounts Payable should receive a copy of the signed purchase order from Correspondence, where it is generated. In addition, the authorizing officials should review the supporting documents when signing the voucher, and Accounts Payable should keep a copy of the signed voucher for its files to show that the disbursement to the vendor is authorized. The Office of Finance keeps a copy of the signed voucher, according to OSM management; however, we believe Accounts Payable should maintain a copy for its records.

Furthermore, since the voucher numbers are consecutively assigned by the computer, Accounts Payable should periodically account for all voucher numbers to ensure that they have been forwarded to the Office of Finance for payment. Finally, to improve controls ensuring that transactions are properly supported and authorized, policies should be clearly stated in writing and systemically communicated to appropriate parties.

• Depreciation of equipment

We were unable to identify any established, uniform, House-wide policy governing the depreciation of equipment. In addition, not all entities we reviewed depreciated their equipment, and of those that did, management was unsure, in certain instances, how the depreciation policy had been developed. To comply with GAAP for financial statement purposes, entities must depreciate their assets. In addition, one objective of an entity's internal controls is to ensure the reliability of accounting data. This includes consistency of accounting information within an organization. According to CAO personnel, the House has adopted a depreciation policy; however, during the audit period, based on our discussions with the various personnel who maintained inventory systems, we were unable to identify any specific, uniform policy. Further, a review of the notes to the financial statements for the 15-month period ended December 31, 1994 and for the year ended December 31, 1995, indicates that, "Accumulated depreciation and depreciation expense have been estimated based on available records." If a systematic depreciation policy had been in effect, an estimate of depreciation expense based on available records would not have been required. The depreciation expense should have been readily available from the inventory systems. CAO personnel informed us that the contractor who compiled the numbers for the House's 1995 financial statement audit had created a database which provided the depreciation expense.

Because separate inventory systems still exist, the House should ensure that any depreciation policy it adopts is implemented on a House-wide basis and is disseminated to the entities maintaining inventory systems. The House should refer to standard industry practices to determine the depreciation rates for each asset class.

• Write-off of obsolete or missing equipment

According to OSM management, there is no formal policy prescribing when and how to write off obsolete or missing equipment from inventory accounts. For example, the Accounts Payable supervisor informed us that approximately 75 broken pagers intended for disposal through GSA have been missing since 1991. However, seventy-five pagers represent an immaterial amount relative to the House's overall assets and illustrates the point that there should be a threshold for writing off missing or obsolete equipment. (For further discussion of adjusting the inventory records see Finding C.) In addition, when an item is reported as missing by a Member, Committee, or other House office, we were told it is entered into a "missing items" account and is never transferred to a "deletions" account. Unless OSM plans to actively pursue these missing items, a policy should be established to review this account for unusual items or activity and purge it periodically. Further, a policy should be developed authorizing OSM management to write-off equipment below a certain threshold amount. This would save time on following-up and reporting on items with a nominal value.

• Timely deposit of surplus sales receipts

During our review of surplus sales, we noted that OSM remitted checks untimely to the Finance Office. The sale of surplus goods was handled by the Accounts Payable division until the sales were ended in 1995. The staff manned the surplus sales room, answered questions, prepared the necessary paperwork for the sale of the goods, and forwarded the receipts to the Finance Office. We noted that between February and April 1995 Accounts Payable received 14 checks and money orders totaling $1,425.00 which were not remitted to Finance until May 1995. Prudent management practices dictate timely deposits of checks to avoid their misappropriation or loss. The current Assistant Chief is aware of this situation and agreed that ideally, monies should be deposited timely. Because the surplus sales program has been terminated according to the CAO's Administrative Counsel, we have no recommendation to make; however, if it is revived, a policy should be developed concerning timely deposits.

• Maintaining accountability

We were informed that OSM depreciates items it purchases in bulk, such as pagers, televisions, and video cassette recorders only when they are assigned to an office. To prevent the inventory system from depreciating these items, OSM does not assign control/serial numbers to them until they are issued. However, failure to assign control/serial numbers makes it more difficult to account for these items when they are temporarily loaned out (bulk items may be loaned to an office for a day or two without charge). Asset Management personnel informed us that bulk purchases ended subsequent to our audit period and bulk inventory will be excessed to GSA, therefore, we have not made any recommendations with regard to bulk purchases.

Inconsistent or ineffective application of established policies and procedures

• Annual tearsheets

If a tearsheet is not returned on a timely basis, OSM is supposed to freeze the account, which means that it will not process any requests to purchase, transfer, or remove equipment. In June 1995, the CAO sent out a letter requesting Members to verify their inventories within 30 days of the date of the letter, or their account would be suspended. OSM management generally allows 90 days (because Member activity is slower in the summer) before they suspend the accounts. However, personnel indicated to us that there is no computerized flag to prevent OSM staff from processing a request once an account is suspended. Instead, staff are notified by electronic mail about the delinquent offices and are supposed to stop processing transactions until the tearsheets are submitted. To assess whether this is an effective means of control, we obtained a list of accounts frozen since September 1995. We tested six accounts and determined that purchase requests had been processed for each account during the period the accounts were supposed to be frozen.

• OSM management also informed us that during the last Congressional changeover various outgoing Committee tearsheets contained discrepancies between the assets on hand and the recorded amount. According to OSM, the outgoing chairpersons (who are ultimately responsible) refused to sign the tearsheets, refuting their accuracy. The incoming chairpersons would not take responsibility for these missing items. Consequently, OSM has not been able to account for all items listed in the tearsheets. Since the changeover, OSM has been reconciling the unsigned tearsheets to its inventory records and, as of October 1996, has accounted for approximately 25 percent of the items. Instead of assigning these items to the "missing" computerized inventory account and requesting the chairperson reimburse the House, which is the normal procedure, OSM continues to keep these items in the Committees' account or else has transferred them to a "holding" account, because it does not know whom to hold responsible. OSM management explained they did not want to designate these items as missing until they were positive they could not be found. Typically, the responsible party is held personally liable for a missing item and can appeal OSM's decision within 30 days to the CHO. In this particular instance, the policy regarding missing items has not been enforced because no one has been held responsible almost two years after the items were determined to be "missing." Furthermore, OSM has expended its limited resources investigating these discrepancies. According to the CAO's Administrative Counsel, the CHO is aware of the problems resulting from the changeover

Additional matters

Bulk items have been purchased by OSM for use as "loaners," generally for a period of a day or two; however, as of September 26, 1996, we identified a total of ten televisions and three video cassette recorders loaned out between December 1994 and February 1996 which have neither been returned nor been charged to the requesters' accounts. During a review of the bulk orders account, we discovered a Member and two House entities have borrowed items from the bulk orders account without being charged by OSM. As a result, five televisions and a video cassette recorder have been on loan, free of charge, for almost two years. Asset Management personnel explained they previously felt they had to honor a Member's request for a loaner even if the period extended for more than a few days; however, they now obtain approval from OSM's current Assistant Chief.

Recommendations:

We recommend that the Chief Administrative Officer develop a proposal, for approval by the Committee on House Oversight, to:

1. Establish House-wide written policies and procedures in accordance with prudent business practices which ensure the accountability of all assets, including:

(a) Conducting a timely physical inventory by technically qualified personnel; notifying the responsible Member, Committee, or other House office of missing, damaged, or stolen equipment; and inventorying items by operable unit;

(b) Reconciling the assets to the inventory records on a timely basis and adjusting and investigating any differences where appropriate;

(c) Requiring supporting documentation and proper authorization of transactions by appropriate personnel;

(d) Establishing depreciation rates and capitalization thresholds; and

(e) Identifying property to be written off due to obsolescence or loss and authorizing appropriate personnel to periodically write off the property.

2. Ensure that established policies and procedures are clearly disseminated, and consistently and uniformly applied by House management.

Management Response

The Acting CAO concurred with the recommendations in this finding. Specifically, he agreed to submit a proposal to the CHO by August 31, 1997, to conduct inventories of House-owned equipment and to reconcile the assets to the inventory and to adjust and investigate any differences as appropriate. The proposal will include approval of additional staffing to accomplish the additional workload. He also noted that in January 1997, OSM implemented a policy of conducting physical inventories of Member offices on at least a biannual basis. In addition, the Acting CAO indicated that OSM's Correspondence division began keeping copies of signed purchase orders in June 1996 and began to provide copies to the Accounts Payable division in March 1997. Also in March 1997, the Accounts Payable division began keeping copies of signed vouchers and will ensure vouchers are timely forwarded to the Office of Finance. The Acting CAO also agreed to submit a proposed capitalization policy to the CHO for approval by June 30, 1997. The Acting CAO will review the inventory systems in HIR and FRC and determine the best method for including a depreciation component in them by June 30, 1997. The Acting CAO will also present a proposal to the CHO by July 30, 1997 for authorization to write off obsolete or lost assets.

Office of Inspector General Comments

The CAO's current and planned actions are responsive to the issues we identified and, when fully implemented, should fully satisfy the intent of the recommendations.

Finding C: Computerized Accounting Records Are Not Updated On A Timely Basis

To Ensure Accuracy And Accountability Of Assets

Computerized accounting records are not always adjusted to reflect changes to the equipment inventory accounts. OSM management agreed that these records should be adjusted to accurately reflect the assets of the House but said time constraints have limited their ability, or they do not have the authorization, to do so. Failure to timely adjust these records may incorrectly state the inventory on hand.

Discussion

House inventory, surplus sales, and GSA accounts

OSM is comprised of three divisions: Correspondence, Accounts Payable, and Asset Management. Correspondence processes equipment transaction requests from Members and other House offices; Accounts Payable pays the vendors; and Asset Management removes, transfers, and verifies the installation of, and affixes uniquely numbered control stickers on, equipment. At a Member's, Committee's, and other House office's request, Asset Management removes unwanted equipment from the office. Before any action is taken, the Correspondence division must receive a signed equipment removal request. Once the request is received, the Correspondence division generates a removal receipt and forwards it to the Asset Management division. When the equipment is removed from an office, the removal receipt is supposed to be signed by a responsible party of that office. The supervisor of Asset Management examines the removed equipment and, based on its condition and age, decides whether it should go into House inventory, be sold as surplus, or sent to GSA for disposal. The supervisor writes the decision on the removal receipt for data entry and tracking purposes. Personnel in Asset Management enter this information into OSM's computerized inventory system.

During the audit period, equipment which was not in use typically was handled by OSM in one of four ways. It was (1) maintained in the House inventory account awaiting reissue to a Member or office; (2) maintained in the surplus sales account to be sold to Members and staff; (3) maintained in the GSA account to be disposed of through GSA; or (4) traded to a vendor for credit or like equipment. Surplus sales were managed by the Accounts Payable division of OSM but were ended during the audit period. OSM management indicated that surplus sales should not be resumed because the procedure is not cost beneficial and also gives preferential treatment to Members and House staff. OSM management does not know the last time a complete physical inventory of its storerooms was taken or reconciled to recorded inventory. OSM attempted one in 1994 but stopped before it was completed because the change in Congress necessitated reassigning staff to help with office moves. OSM has not performed one since that time. Because management did not know the last time a complete physical count of these inventories has been done or been reconciled to OSM's records, we decided to test the procedures applicable to House inventory, surplus sales, and GSA items. To determine if items were being properly accounted for, we analyzed the following computerized listings of inventory accounts: (1) the surplus sales pending, approved, and sold accounts; (2) the GSA pending and deletions accounts; and (3) House inventory account.

Surplus sales and GSA

During the period surplus sales were being held, the Asset Management supervisor prepared a list of surplus sales items and their recommended sales prices for approval by the CHA (now the CHO). Prior to approval, these items were entered into the computerized account designated as "surplus sales pending." Once the items were approved for sale by the CHO, they were recorded as "surplus sales approved." (For further discussion on the approval process see Finding B). When they were sold, the items were transferred to the "surplus sold account." Although surplus sales were ended in 1995, we noted that there were still items listed in both the pending and approved accounts as of August 23, 1996. OSM personnel explained that any items in the surplus sales approved account which were on display in the salesroom and had not been sold after 90 days were sent to GSA. Consequently, we would expect to see these items excessed to GSA. However, OSM management noted that as of April 1996, there were approximately 300 items approved for sale as surplus which were still on hand and were now obsolete. These items may not have been displayed in the salesroom because of space constraints, and thus were not sold or shipped to GSA. Because we were unable to determine which items had been displayed for sale but not sold, we could not test the 90-day rule. Ideally, these items should have been removed from the surplus sales approved account, entered into the GSA account, and subsequently deleted when shipped to GSA. In addition, the items listed as surplus sales pending should have been transferred to the approved account to be sold, or else shipped to GSA prior to August 23, 1996. According to the CAO's Administrative Counsel, the CHO decided to terminate the surplus sales program in 1995. Therefore, we believe any existing items may have become obsolete by now and their book values and the resultant recommended sales prices should have decreased during this time period.

House inventory and GSA

OSM management indicated that the House inventory account still listed items that had already been shipped to GSA and, therefore, were no longer considered to be House property. Management explained that they tried to clear the storerooms of obsolete items during spring 1995. In doing so, they made several shipments to GSA but did not update the inventory records to reflect this. (According to OSM personnel, a former Associate Administrator told them not to update the records.) In addition, the manifest accompanying the GSA shipment only listed the primary control number. For example, if a computer was shipped to GSA with several internal parts--each part labeled with a unique control number--the internal parts were not listed on the manifest. The computerized account listing generated by the House, however, tracks the equipment by the unique control number. Consequently, the inventory listing has not been adjusted to reflect all items shipped to GSA during this time. Although OSM management explained that this was an unusual occurrence, not their prescribed practice, the inventory records should be adjusted to reflect the disposal of equipment.

Pager records

The Accounts Payable division maintains custody of and the accounting records for House-owned pagers, including used pagers. Used pagers are recorded in the House inventory account. To determine whether recorded used pagers were still in House custody, we obtained a listing of pagers in the House inventory account. The account reported 401 pagers. Our physical observation of the amount of used pagers stored in Accounts Payable showed that the computer records included a number of pagers no longer in their custody. To determine the extent of this discrepancy, we performed a physical count of all used pagers in the division's custody and determined that 127 pagers were missing. (We performed this count in the presence of OSM personnel who could not explain the discrepancy or what happened to the missing pagers.) Consequently, the pager records in OSM's computer system are not reliable.

Unpaid items to vendors needs to be reviewed

The House has equipment on its books dating back to at least March 1985 for which it has not been billed and/or not made payment. The "not billed/not paid" report, which is produced by HIR, reported more than $7 million in unpaid purchase orders from March 3, 1985 through June 28, 1996. According to CAO and OSM officials, the House does not consider equipment as owned by the House (although the item may be physically present and, in some cases, in use) unless (1) an installation ticket signed by the requesting office has been submitted to OSM, (2) a signed issue ticket has also been submitted, and (3) an invoice has been presented and paid.

• Unpaid purchase orders

During our review of the "not billed/not paid" report, we inquired as to why there were outstanding, unpaid purchase orders dating as far back as March 1985. We were told by OSM management that they believed the Office of Finance had told them they were prohibited from paying the older, outstanding purchase orders. The CAO's Administrative Counsel indicated that purchase orders may be outstanding because of a dispute, i.e., the ordered equipment was not functioning properly, or because the vendor failed to invoice the House. The existence of a questionable, multimillion dollar amount representing unpaid purchase orders should concern OSM management. In an exit conference with OIG staff, OSM and CAO officials agreed to use the "not billed/not paid" report as a supplement to OSM's accounts payable tracking system.

HIR generates a list of "not billed/not paid" purchase orders which, according to OSM management, is sent to them only at OSM's request. The list indicates the status of an item, e.g., whether it has been received or partially paid for, although OSM management explained that the report was intended to provide OSM with information on outstanding items and not intended as a receiving report. HIR produces this information based on input from OSM's computerized inventory system. If a vendor fails to notify OSM that it has provided the requested item to a Member, OSM will not pay the vendor. (Typically, a vendor completes an installation ticket upon delivering the equipment to a Member's office, has the installation ticket signed, and then forwards it to OSM. This notifies OSM that the goods have been received and are ready to be inspected by Asset Management. Asset Management receives an issue receipt from the Accounts Payable division and compares the information on the issue receipt with the physical equipment in the office, places an inventory control label on the equipment, and obtains the Member's, or designated staff's, signature on the receipt.) If a vendor fails to invoice OSM directly, even if OSM's Asset Management division has physically confirmed that the equipment was received by the Member, OSM does not consider it "officially received" and will not pay.

The "not billed/not paid" report might also include equipment which has never been received or which was ordered by a Member or office, who subsequently canceled the order, without notifying OSM. The Accounts Payable division does not have policies and procedures to ensure that vendor invoices are received or are paid timely when the equipment has been delivered. According to OSM, the vendor is responsible for submitting a signed installation ticket indicating that the equipment has been delivered and installed and for submitting an invoice for payment. We were told that the staff tries to review open items when they have time but this is neither consistent or necessarily timely.

• Vendor billing practices

The supervisor of OSM's Accounts Payable division said certain vendors were known to have poor billing practices but was not aware of any pattern advantageous or disadvantageous to a particular Member. We selected 20 "not billed/not paid" purchase orders (i.e., accounts payable) from the list based on age, dollar amount, and vendor. Although the list does not contain the name of the requesting office, it does include the purchase order number and this enabled us to extract the name from the computer. From this, we determined that there did not appear to be a pattern of failing to pay for a particular requester's equipment. In addition, numerous vendors are represented in the accounts payable listing and this appears to indicate that nonpayment by OSM is random, and not targeted towards a specific vendor.

According to the "not billed/not paid" report, equipment listed on one purchase order dated April 17, 1992, had not been received. However, the supporting documentation included a signed installation ticket. OSM's procedures require stamping a copy of the purchase order "installed" if a signed installation ticket has been returned by the vendor to OSM. In this case, the purchase order was not stamped. We also noted that the supporting documentation did not include an issue receipt. Upon further review of the supporting documentation, we learned that OSM personnel had contacted the vendor in February 1993. The vendor replied that it had no record of shipping the equipment and, therefore, could not invoice the House. According to the documentation provided, this item was purchased under the one time payment plan which means OSM should have charged the requester once the purchase order was generated. OSM itself has not been charged and has not paid for this equipment totaling $7,515.00.

Of the 20 "not billed/not paid" purchase orders tested, the report indicated that equipment had been received in seven instances. We also noted three purchase orders marked "payment pending," although they already had been paid according to the computerized records. We were told this was probably a keying error. In addition, the amount paid for two items exceeded the purchase order amount. We initially had been told by OSM management that Accounts Payable pays only the purchase order amount (or invoice amount if lower) even if a vendor's invoice shows a larger amount due. We asked the Accounts Payable supervisor about these apparent discrepancies and were informed that the differences were probably due to the installation fees. She said the computer does allow a payment exceeding the purchase order amount. She also noted that the new Federal Financial System (FFS) allows a 20 percent override but anything higher requires an amended purchase order. She said the purchasing office is normally not charged the difference but believes this may have changed with FFS.

This supervisor further stated it is the vendors' responsibility to bill the House timely, not the House's responsibility. She said a vendor occasionally will ask about an invoice that the Accounts Payable division never received. Sometimes the original invoice was sent to the office that received the equipment and the office never forwarded it to the Accounts Payable division. She also said, which the Office of Finance confirmed, that Finance would not pay for equipment unless the invoice came from OSM's Accounts Payable division. However, we noted that a Member was able to purchase computer-related equipment through FRC, thereby weakening this control. She said OSM does not have time to research all open purchase orders, and they only represent a small percentage of the total processed.

When a Member purchases an item under the one time payment plan, his or her account is charged at the time a purchase order is generated. However, OSM does not pay the vendor until the vendor submits the installation ticket and invoice. Therefore, Members have been charged for items for which OSM has not paid because the vendors have not submitted the ticket and invoice. We were also told that if a vendor submits an invoice which is less than the purchase order amount, OSM still charges the Member, Committee, or House office the purchase order amount. According to OSM management, this procedure enables OSM to have funds available in case the vendor eventually requests the correct amount. Unless OSM believes that vendors who invoiced the House for an amount less than the purchase order amount will be submitting an invoice for the difference at a later date, OSM should adjust obligations for differences between obligations previously recorded and actual outlays to liquidate those obligations.

OSM also frequently absorbs certain costs, e.g., Members are charged 100 percent of the vendor's maintenance fee for new equipment but only 55 percent of the vendor's maintenance fee for reissued (used) equipment. OSM absorbs the remaining 45 percent.

• Inaccurate information

The "not billed/not paid" report contains other information which is inaccurate and obsolete. For example, the report indicated that five of the twenty purchase orders we tested, dated March 5, 1992, had not been filled, i.e., equipment had not been installed. However, we obtained a copy of a letter dated January 11, 1995, written by a Committee chairperson, indicating that the equipment had been received at least two years earlier, but no installation ticket had been signed. Therefore, OSM had no record that the equipment was received. (According to the explanation we were given regarding the House's official position on recognizing assets, this equipment was never officially received and is not a House asset.) Although OSM has indicated that this report was intended to provide information on open purchase orders and was not intended for use as a receiving report, the information provided can be inaccurate. This discrepancy should have been noted when the annual inventory tearsheets were circulated in 1993 and 1994, and further illustrates the need for periodically conducting physical inventories and timely reviews of open purchase orders.

In discussions with the OSM manager at a March 12, 1997 exit conference, we were told that the "not billed/not paid" report was not designed to be a management tool and that we should not have placed so much reliance upon it. However, regardless of what it was intended for, it is our view that the information in the "not billed/not paid" report (a report that has been prepared and in use for at least the past four years) could prove very useful in monitoring the status of unpaid vouchers and the assets they represent but only after the outstanding items have been addressed and resolved.

Recommendations:

We recommend that the Chief Administrative Officer:

1. Periodically review and adjust the inventory records where appropriate, or establish a suspense account and periodically review the account to ensure that only authorized items are being transferred in.

2. Determine what is needed to resolve the "not billed/not paid" report and use it as a management tool to identify and investigate reasons for outstanding, unpaid purchase orders and the status of the assets they represent.

3. Review purchase orders which were recorded at greater than the actual amount paid. Determine whether vendors who invoiced the House for an amount less than the purchase order amount will be submitting an invoice for the difference at a later date. If they are not, adjust the obligations for the differences between the obligations previously recorded and actual outlays to liquidate these obligations and adjust the requester's account accordingly.

4. Review accounts payable periodically to determine whether they are being timely paid.

5. Evaluate the validity of current OSM procedures used to process vendor invoices whose amounts differ from the original purchase order amounts.

Management Response

The Acting CAO agreed with the recommendations in this finding and cited the following corrective actions to be taken. OSM created a suspense account for inventory reconciliation purposes in March 1996 and will continue to use it when investigating and reconciling assets to inventory records. OSM is now reviewing the "not billed/not paid" report in order to resolve the payment status of purchase orders. OSM currently uses the accounts payable tracking system to determine timely payment of accounts payable, and will supplement this system with the "not billed/not paid" report. In addition, OSM agreed to routinely review the "not billed/not paid" report and provide periodic status reports beginning on August 31, 1997. With regard to purchase orders recorded at greater than the actual amount paid, OSM officials indicated they will submit a proposal to the CHO to develop a procedure whereby payments of a certain dollar threshold (to be determined at a later date with an explanation and/or supporting rationale) will automatically be credited to the House account charged. Any differences between the invoice amount and the established threshold will be reviewed and resolved. In addition, the procedures used to process vendor invoices that differ from the original purchase amounts will be reviewed and modified accordingly. The Acting CAO also stated that OSM uses the accounts payable tracking system (since May of 1996) to review outstanding payables and provide summary information in the CAO's indicators report.

Office of Inspector General Comments

The CAO's current and planned actions are responsive to the issues we identified and, when fully implemented, should fully satisfy the intent of the recommendations.

Finding D: The Integrity And Reliability Of Management Controls For Office Systems Management's Inventory System Are Inadequate

Management controls surrounding OSM's Office Equipment Systems (OES) application system have not been adequately established to prevent unauthorized activity. In an automated environment, best practices require the establishment of general controls that ensure the protection and integrity of resident software systems, as well as the establishment of application controls to ensure the reliability of the data that is maintained by each application system. Our audit determined that (1) approximately 48 percent of OSM personnel have been granted supervisory level authority within the system, which allows access to some of the restricted OES inventory transactions; (2) current practice allows the supporting HIR programmer to modify the OES system without written authorization; and (3) personnel no longer employed by OSM still have supervisory access to the OES system. These weaknesses occurred, in part, because there is no comprehensive set of standards and procedures defining the general and application controls that can be expected to be contained within a well managed computer environment. As a result, management can place no assurance that erroneous or fraudulent transactions have not occurred in, or been entered into, the OES system.

Discussion

The equipment inventory system is updated by entering an individual transaction or by selecting a function from a menu through the Customer Information Control System (CICS) communication system. During the audit period, the OES system was still an active member of, and accessed through, the Financial Management System.

Excessive number of OSM personnel have unnecessary system level access

There are a total of 42 personnel within the OSM division. Almost half of this group (20 of 42) have OES system privileges that allow them to access "supervisory" transactions, even though only three are supervisors. This privilege level allows access to OES transactions J010 (Control Record Utility) and J020 (Terminal Printer Maintenance). These "supervisory" transactions have been established to control access to transactions that management has identified as requiring restricted access--said access being accomplished via password control. The J010 "supervisory" transaction provides the means for establishing a password for selected inventory transactions, thereby limiting access to only those authorized users who have been given the corresponding password. The J010 transaction itself does not provide this password change capability. However, additional functionality was built into this transaction. When it is called up, a password and transaction prompt are activated at the bottom of the screen. This gives users who can access J010 the ability to select a protected transaction and then change its password before entering the selected transaction screen. The J020 "supervisory" transaction defines and links application screen address locations to authorized users via their Resource Identification Code (RIC), thereby giving the false impression of limiting access to inventory transactions to pre-approved individuals.

Granting access to these transactions to a majority of the staff, i.e., anyone with access level "1" or higher, is self-defeating and undermines the reliability of the on­line activities within the OES system. As an example, one of the restricted transactions, J130, is used to make authorized changes to the vendor name and address file/table. Allowing unauthorized personnel the opportunity to access the J010 transaction, which in turn allows them to change passwords to restricted transactions, e.g., the vendor transaction (J131), exposes the system to fraud, waste and abuse, or simple human error. Subsequent to our January 29, 1997 exit conference with OSM personnel, the Assistant Chief informed us that all but two OSM personnel with access level "1" have been changed to level "0," a level that cannot access J010 and J020, and that she has limited assess level "2" to only two individuals. This action is laudable and should provide a higher level of protection but more work needs to be done. For example, as a result of our review and test of employee access levels, we identified one employee who had two RICs with different access levels. This particular situation stymied our test efforts because in addition to having two active RICs (which is a security exposure), this employee was still carried in the system under an inactive RIC. Given this information, we believe a comprehensive review of all users is needed to identify and remove inactive RICs as a cleanup measure if nothing else, and more importantly, determine if access levels for individuals are accurate for every mainframe application (i.e., terminal ID) they can access. In addition, OSM can eliminate the exposure that currently exists when the password and transaction prompts are activated with the J010 transaction screen by requesting HIR to move these prompts to a separate transaction screen and require verification of the current password (which is not required now) before allowing a password change.

HIR programmer can modify the OES system without written authorization

As part of the System Development Life Cycle process, an information system will continue to evolve over its lifetime as user and site requirements change. As the term 'change' implies, this process will transform the existing production program(s) to reflect those requirements. Best practices require that management develop a methodology regulating the change process in a manner that ensures only authorized, tested, and documented changes are made to the system. These fundamental concepts offer management a level of assurance regarding the integrity of the application system in that all changes that have been made have been authorized and are correct. However, the current authorization process employed by OSM management, allows changes to the inventory system by verbal request, thus bypassing this practice. As an example, the current process governing the adding of personnel to the inventory security table that is maintained by the HIR supporting programmer can be authorized by a telephone request.

Personnel no longer employed by OSM still have access

We noted that ten personnel terminated from OSM were still defined as having access to the inventory system. Of these ten, one has supervisory level authority. Best practices require the immediate removal of access to an automated system, once an employee's authorization is withdrawn either as a result of a transfer or termination of employment. Access controls within the OES system are based exclusively on the authentication of the on-line requester through the input of an identification code and password. If an unauthorized user gains knowledge of these still active access codes, then the system will not only be unable to prevent access, but also be unable to produce an accurate audit trail. As a compensating control, management must develop detective controls that continuously monitor and report on sensitive transaction activity such as the supervisory transactions. These two management initiatives relating to preventative and detective controls should offer a adequate short term solution. Since we already made recommendations in a previous audit report to address the issue of terminated employee access for which HIR security has initiated implementation, we are not making any additional recommendations at this time.

Recommendations:

We recommend that the Chief Administrative Officer:

1. Develop procedures that limit access authority to J010 and J020 transactions to authorized personnel only.

2. Develop monitoring procedures that require continuous review of password-protected transactions and require follow-up and documented review of activity against such transactions.

3. Re-design the J010 transaction screen so that a separate path is required to access the password function and transaction prompt function. Modify the password prompt to require confirmation of the current password before allowing a password change.

4. Review and update employee information via transaction J020 on a periodic basis and verify employee access levels for each RIC and mainframe application screen they can access.

5. Require HIR personnel be restricted from making changes to the inventory production system without appropriate testing and authorized documentation from designated OSM management.

Management Response

The Acting CAO agreed with the recommendations in this finding. Specifically, he stated that OSM is working with HIR personnel to address concerns raised in all of the recommendations of this finding. In addition, OSM will institute a policy that requires documentation of changes made by HIR personnel, including appropriate testing. Both of these actions will be completed by June 30, 1997.

Office of Inspector General Comments

The CAO's current and planned actions are responsive to the issues we identified in this finding and, when fully implemented, should fully satisfy the intent of the recommendations.

Finding E: Segregation Of Duties Is Not Always Implemented

During a review of OSM's operations, we identified several areas where segregation of duties has not been implemented. One of the objectives of achieving an effective internal control structure is to establish a logical plan of organization with clear lines of authority and responsibility and segregation of the operating, recording, and custodial functions among divisions or individuals. Failure to segregate key duties and responsibilities increases the possibility of assets being misappropriated and also reduces timely detection of such misappropriation.

• The Office of Finance mails most checks directly to the vendor which helps prevent the check from being misappropriated. Segregating the custody of the asset from accounting is an effective control technique. However, the Accounts Payable division can complete a check attachment form which instructs the Office of Finance to return a check to the Accounts Payable division so that the vendor can pick the check up from them. This procedure weakens the control technique as there is no assurance that the check is adequately safeguarded during this process or that the person receiving the check currently works for the vendor. Therefore, the Office of Finance should mail all checks to the payee or the vendor should receive them directly from the Office of Finance.

• Staff in the Asset Management division of OSM have both custody of the asset and recordkeeping duties for the GSA and House inventory equipment. In addition, before surplus sales were ended in 1995, Asset Management was responsible for processing and entering the inventory transactions for the "pending surplus sales" account. Therefore, key duties of entering and processing these transactions were not adequately segregated among individuals. The segregation of these duties is critical because there is no independent reconciliation of physical items to the recorded assets. One compensating control is if the equipment removed from the Member's office is not deleted from the Member's account, the Member may still be charged for the equipment or maintenance and notify OSM of the discrepancy. Another control would be if an independent reconciliation of physical items to the recorded assets was performed.

• The Accounts Payable division was responsible for surplus sales until the sales were ended in 1995. Staff collected proceeds and entered the sale into OSM's computer system. Because Accounts Payable had both custody of the assets and recorded the sale in the computer, key duties of entering data and processing transactions were not adequately segregated among divisions. Based on conversations with OSM management, we understand surplus sales have been terminated, therefore, we have no recommendation to make with respect to this issue.

Recommendations:

We recommend that the Chief Administrative Officer:

1. Assign an independent staff member to perform a reconciliation of physical inventories of equipment in OSM's custody such as House inventory, surplus sales, and GSA.

2. Require that the Office of Finance mail all checks to the payee or the vendor receive checks directly from the Office of Finance.

Management Response

The Acting CAO agreed with the two recommendations in this finding. He indicated that a non­OSM employee will perform a reconciliation of physical inventories in OSM's custody, including House inventory, surplus sales, and GSA, and that all such inventory reconciliations will be done within the two-year cycle of a Congress. A policy statement to that effect will be issued no later than July 31, 1997. The process began on January 3, 1997 and the non-OSM employee will begin the physical inventory on October 1, 1997. With regard to the disposition and handling of checks to vendors, the Acting CAO indicated that there may be legitimate needs for the CAO to receive and sign for checks, such as when a dispute is involved. However, the Acting CAO agreed that at no time will checks to vendors be returned to OSM personnel. Again, a policy directive covering this change in procedures will be in place by July 31, 1997.

Office of Inspector General Comments

The CAO's current and planned actions are responsive to the issues we identified in this finding and, when fully implemented, should fully satisfy the intent of the recommendations.

Finding F: Physical Security Is Not Adequate To Safeguard Certain Assets

During tours of Asset Management's facilities, we noted unattended equipment in corridors, open storerooms, and unlocked storage cabinets. In addition, pagers in the Accounts Payable division were not kept in a locking file cabinet because the staff did not think they needed additional security precautions. Failure to properly secure assets may result in their misappropriation. Further, because the physical inventory of these items is not consistently reconciled to the records, it may take years before any theft or loss is detected.

Asset Management

On several occasions, subsequent to the audit period, we noted photocopiers and computer processing units left unattended in the corridors outside the Asset Management section. We also were able to open filing cabinets containing keyboards. One compensating control is that photocopiers are large, heavy objects and may be difficult to remove from the building without notice. However, the computer equipment and keyboards are portable and could be concealed and removed from the building without detection. We also noticed the storeroom where House inventory is kept was open on occasion and portable equipment, such as keyboards, were located on shelves near the entrance and staff were not visibly present.

In addition, Asset Management personnel informed us that Member offices occasionally leave equipment in the hallways which the Building Superintendent finds and subsequently instructs Asset Management to retrieve. Asset Management will put the equipment in House inventory only to discover that the office did not want it removed and merely had placed it in the hallway for convenience. Asset Management should not be asked to remove equipment, and should not remove equipment, unless they have written authorization from the requester.

Accounts Payable

During the audit period, the Accounts Payable division did not store pagers assigned to House inventory in a locking cabinet. We suggested the division purchase and use a padlock on the pager storage cabinet to adequately safeguard the assets. The division subsequently purchased and affixed a lock to the cabinet. Further precautions should not be necessary because the book values are minimal, a small quantity would be necessary for replacement as they are currently storing more used pagers than are necessary for House operations, and the pagers are of limited use outside the House.

Besides the missing, broken pagers discussed in Finding B, we also determined that an additional three pagers cannot be located by the Accounts Payable division. As noted above, the pagers are of limited value; however, from an internal controls perspective, safeguarding assets is a primary objective. Additionally, maintaining accurate accounting information also is critical; therefore, the records should be adjusted to reflect the actual pagers on hand.

Storeroom access

Besides OSM staff, we were told other personnel, such as the Superintendent's staff, have access to OSM's equipment storerooms. When we asked who specifically in the Superintendent's office, or anyone else for that matter, had access to these rooms, we were told they didn't know. According to OSM management, the current Assistant Chief has keys to all storerooms and other OSM personnel have access to particular rooms where they work. Access to the rooms should be restricted only to those who work in the rooms, or oversee the operation, such as the Assistant Chief. A roster should be kept of the individuals who have keys and should be reviewed on a periodic basis for changes in personnel and duties. Because OSM has not conducted a complete physical inventory or reconciled its records to these assets, items could be removed by unauthorized personnel with little risk of detection. Therefore, any personnel outside of OSM should notify OSM in writing when they need access to the storerooms and where practicable should be accompanied by Asset Management staff.

Computer hard drives

According to Asset Management staff, computer hard drives are reformatted when the equipment is reassigned to other offices within the House, but not when the equipment is excessed to GSA. OSM officials explained that they do not have the resources it would require to erase or reformat hard drives in all equipment sent to GSA. Outdated but usable computer equipment is excessed to GSA where it may be offered to other Federal agencies who can use it or it may be sold at auction to the general public. Therefore, House files and software programs may still be on the computer(s). The latter situation may violate site licensing agreements; whereas the former may incur breaches of confidentiality if retained files contain sensitive information which should not be released. Best practices would require all hard drives be reformatted or that a cleaning method (e.g., bulk erasure) be implemented to protect sensitive information and comply with applicable licensing agreements.

Recommendations:

We recommend that the Chief Administrative Officer:

1. Ensure that assets are secured at all times.

2. Determine whether used pagers should be excessed to GSA.

3. Develop and implement procedures to bulk erase or reformat hard drives in all computers excessed to GSA.

Management Response

The Acting CAO agreed with all recommendations in this finding. He stated that OSM is currently taking measures to ensure that all assets are secured at all times and will take necessary steps to evaluate and address any weaknesses to current practices. An initial security evaluation will be completed by August 31, 1997. With regard to used pagers, OSM is currently disposing of obsolete and irreparable pagers to GSA and will continue to do so. Finally, the Acting CAO will submit a proposal to the CHO by July 30, 1997 to develop and implement procedures to bulk erase or reformat hard drives in all computers sent to GSA, including required additional staffing and resources to accomplish this additional workload. Until this proposal is approved and implemented, the CAO will not dispose of any hard drive that has not been erased or reformatted.

Office of Inspector General Comments

The CAO's current and planned actions are responsive to the issues we identified in this finding and, when fully implemented, should fully satisfy the intent of the recommendations.

III. OTHER MATTERS

During our audit, the following matter came to our attention and, while this issue is not as critical as the findings contained herein, we feel it warrants management's attention and corrective action.

Based on the computer access provided to them, Accounts Payable personnel can change a vendor's address when they are preparing a voucher. The vendor's address for the voucher is obtained from the computer's purchase order record and may need to be changed if the vendor requests that purchase orders and remittances be mailed to two different addresses. However, to prevent misappropriation of funds, we suggest vendor address changes be carefully reviewed by an independent staff member (e.g., in-house personnel that are not functionally responsible for that area) and said review be documented to ensure that checks are not mailed to inappropriate addresses. According to OSM management, this procedure is reviewed by another party; however, this review should be documented, e.g., a sign-off, in order to strengthen the controls.

Management Response

The Acting CAO agreed with us on this issue and indicated that, in addition to a third party review, OSM officials stated that "checkers" began initialing OSM's copies of the vouchers in 1994 to verify that all information, including the 'remit to address,' was correct . However, beginning in February 1997, the Finance copy of the voucher carried the checker's initials.

Office of Inspector General Comments

The CAO's corrective action is responsive to the issue we identified in this section.

EXHIBIT

Chief Administrative Officer CAO

Committee on House Oversight CHO

Customer Information Control System CICS

Federal Financial System FFS

Furniture Resource Center FRC

General Accounting Office GAO

General Services Administration GSA

Generally Accepted Accounting Principles GAAP

House Information Resources HIR

House Recording Studio HRS

Management of Network

Income, Expense, and Services MONIES

Network Management System NMS

Office Equipment Systems OES

Office of Inspector General OIG

Office of Management and Budget OMB

Office Systems Management OSM

Property Asset Management PAM

Resource Identification Code RIC

Sergeant at Arms SAA

U.S. House of Representatives House