IHS Has Had Millions of Dollars in Property Lost or Stolen and Has Made Wasteful Purchases

We substantiated the allegation of gross mismanagement of property at  IHS. IHS Records Indicate at Least $15.8 Million of Property Has Been Lost or Stolen

Our analysis of Report of Survey records from IHS headquarters and field  offices shows that from fiscal year 2004 through fiscal year 2007, IHS  property managers identified over 5,000 lost or stolen property items  worth about $15.8 million. First, IHS  does not consistently document lost or stolen property items. These items, valued at  around $2 million, included computers, computer servers, video  projectors, and digital cameras. We are referring these  cases where there was a potential release of sensitive data including  employee social security numbers to the HHS OIG for further  investigation. Specifically, we estimate that for the seven locations,  about 1,200 equipment items, with a value of $2.6 million were lost or  stolen. An IHS official stated that IHS purchased new  computers using “end of the year dollars.” Some examples of wasteful  spending that we observed during our audit of headquarters and field  offices include the following:    Approximately 10 pieces of IT equipment, on average, are issued for every  one employee at IHS headquarters. Computers and other IT equipment were often assigned to vacant offices. Weak Tone at the Top and Other Control Weaknesses Leave IHS Highly Vulnerable to Loss, Theft, and Waste

The lost or stolen property and waste we detected at IHS can be attributed  to the agency’s weak internal control environment and its ineffective  implementation of numerous property policies. Consequently, the extent of  missing property at IHS is unknown. IHS did not establish proper safeguards for storing IT equipment in IHS  facilities or employees’ offices. Because equipment was not protected against damage or destruction, IHS  had to dispose over $700,000 worth of equipment because it was “infested  with bat dung.”
Failure to use accountable property management system: HHS  policy requires that all accountable property with a value of $5,000 or  greater and all sensitive items with a value of $500 or greater be tracked  by the PMIS property management system. As a  result, IHS cannot account for its physical property and is vulnerable to  the loss and theft of IT equipment and sensitive personal data. Appendix I: Scope and Methodology

To substantiate the allegation of lost or stolen property and wasteful  spending at the Indian Health Service (IHS), we analyzed IHS documents  of lost or stolen property from fiscal year 2004 through fiscal year 2007. We also conducted a full physical inventory of property at IHS  headquarters and statistically tested information technology (IT)  equipment inventory at seven selected IHS field locations. We performed appropriate data reliability procedures for our physical  inventory testing at IHS Headquarters and sample testing at the seven case  study locations including (1) testing the existence of items in the database  by observing the physical existence of all items at IHS headquarters and IT  equipment selected in our sample, and (2) testing the completeness of the  database by performing a 100 percent floor-to-book inventory at IHS  headquarters and judgmentally selecting inventory items in our sample to  determine if these items were maintained in IHS inventory records. We conducted our forensic audit and related investigations from June 2007  to May 2008 in accordance with generally accepted government auditing  standards.
Why GAO Did This Study

In June 2007, GAO received information from a whistleblower through GAO's FraudNET hotline alleging millions of dollars in lost and stolen property and gross mismanagement of property at Indian Health Service (IHS), an operating division of the Department of Health and Human Services (HHS). GAO was asked to conduct a forensic audit and related investigations to (1) determine whether GAO could substantiate the allegation of lost and stolen property at IHS and identify examples of wasteful purchases and (2) identify the key causes of any loss, theft, or waste. GAO analyzed IHS property records from fiscal years 2004- 2007, conducted a full physical inventory at IHS headquarters, and statistically tested inventory of information technology (IT) equipment at 7 IHS field locations in 2007 and 2008. GAO also examined IHS policies, conducted interviews with IHS officials, and assessed the security of property.

What GAO Found

Millions of dollars worth of IHS property has been lost or stolen over the past several years. Specifically, (1) IHS identified over 5,000 lost or stolen property items, worth about $15.8 million, from fiscal years 2004 through 2007. These missing items included all-terrain vehicles and tractors; Jaws of Life equipment; and a computer containing sensitive data, including social security numbers. (2) GAO's physical inventory identified that over 1,100 IT items, worth about $2 million, were missing from IHS headquarters. These items represented about 36 percent of all IT equipment on the books at headquarters in 2007 and included laptops and digital cameras. Further, IHS staff attempted to obstruct GAO's investigation by fabricating hundreds of documents. (3) GAO also estimates that IHS had about 1,200 missing IT equipment items at seven field office locations worth approximately $2.6 million. This represented about 17 percent of all IT equipment at these locations. However, the dollar value of lost or stolen items and the extent of compromised data are unknown because IHS does not consistently document lost or stolen property and GAO only tested a limited number of IHS locations. Information related to cases where GAO identified fabrication of documents and potential release of sensitive data is being referred to the HHS Inspector General for further investigation. GAO also found evidence of wasteful spending, including identifying that there are about 10 pieces of IT equipment for every one employee at headquarters. GAO's investigation also found computers and other IT equipment were often assigned to vacant offices. GAO identified that the loss, theft, and waste can be attributed to IHS's weak internal control environment. IHS management has failed to establish a strong "tone at the top," allowing property management problems to continue for more than a decade with little or no improvement or accountability for lost and stolen property and compromise of sensitive personal data. In addition, IHS has not effectively implemented numerous property policies, including the proper safeguards for its expensive IT equipment. For example, IHS disposed over $700,000 worth of equipment because it was "infested with bat dung."