There are a variety of weaknesses in the EPA’s physical security of laptop computers and other IT, according to an audit that originated with a hotline tip about one region but that was expanded after that disclosure proved to be justified.
Issues identified in the region initially reviewed included lack of a policy for tracking laptops available to employees waiting to be assigned a new computer or whose assigned laptops are not working properly; the report includes pictures of laptops piled atop each other in the open, in one case on a contractor employee’s desk.
Other problems there included personnel being unaware of IT property status or procedural changes; excess property not always being tracked or recorded; lack of guidance for taking laptops out of the office; and lack of consideration in employee performance standards for handling of property.
On widening the review, the IG found that: agencywide responsibility for the EPA property management program rested with a non-managerial-level employee; personnel lacked awareness of the EPA’s asset management system and were not always using it; guidance for excess IT personal property was lacking; employee performance standards often did not include care of property; and a form for documenting property custody was rarely used.
The report said that management ultimately agreed with recommendations to address those issues, after they were revised from their original version.