IRS Criminal Investigation Equipment Vulnerable, TIGTA Warns

Synopsis

In response to our request for suggestions for Fiscal Year (FY) 2004 audit coverage, the former Chief, Criminal Investigation (CI), cited controls over equipment as a management concern because budget shortfalls resulted in a lack of support staff in the field office locations. According to documentation provided by the CI function, the number of nonspecial agents assigned to the field offices declined from 672 in FY 1999 to 589 in FY 2004.

The CI function uses various types of investigative equipment¹ to accomplish its mission, such as radio communication equipment, electronic surveillance equipment, and firearms. All investigative equipment valued at $500 or more is required to be entered into the CI function's inventory control system. Firearms, pocket commissions,² enforcement badges, and belt badges are required to be entered regardless of cost.

Our review determined weak internal controls within the CI function have created an environment susceptible to the loss of investigative equipment. We could not locate or find support for 70 of the 700 investigative equipment items selected for review. In addition to our review, the CI function Headquarters (HQ) office and 1 of the field offices in our review wrote off, or were prepared to write off as lost, 429 items (with an acquisition cost exceeding $1.3 million) during FYs 2004 and 2005. We identified several conditions that resulted in a weak control environment over investigative equipment that contributed to the loss of equipment. Specifically, the CI function did not effectively conduct the annual physical verifications, exercise proper separation of duties, maintain complete documentation to support equipment disposal transactions, and properly control equipment loaned by the CI function HQ office.

In addition, badges and sequentially numbered pocket commission inserts purchased by the CI function were not properly controlled, resulting in unreliable data and missing pocket commissions. Our review identified 2,850 pocket commissions that were not properly controlled on the Criminal Investigation Equipment Control System (CIECS),³ resulting in the CI function being unable to locate 111 pocket commissions. We also identified numerous enforcement and belt badges that have the same identification number. This weakens the CI function's ability to account for these items. The CI function must improve the control of its identification media to prevent the loss or theft of pocket commissions and badges. In the hands of an unauthorized person, these items could not only bring discredit and adverse publicity to the Internal Revenue Service (IRS) but could also be damaging to our nation's homeland security.

Further, the CIECS did not contain accurate or complete information. We determined the investigative equipment we physically verified contained inaccurate information on the CIECS; investigative equipment identified during our review, as well as equipment purchased during FY 2003, was not recorded on the system; and the CIECS contained duplicate records and records where the serial numbers were altered.

We also reviewed the physical security controls at the four offices in our review and identified weaknesses that left equipment vulnerable to theft or loss. For instance, we identified that combinations to the firearms safes and vaults were not changed for at least 1 year, custody receipts were not maintained for keys allowing access to investigative equipment storage areas, and access to equipment storage areas was not restricted. In addition, the environment for storing equipment at the CI function's HQ offsite warehouse is of concern. We believe the disarray observed at this facility, and the current procedure for relying on one's memory for recalling where equipment is located, contributed to the loss of investigative equipment.

The CI function is responsible for controlling over 40,000 investigative equipment items costing approximately $128 million. Unless CI function management takes action to improve the controls and procedures over its equipment, they will continue to be at risk of losing control of more investigative equipment.

Recommendations

To improve the internal controls over investigative equipment, we recommended the Chief, CI, issue a memorandum to applicable CI function personnel reemphasizing the importance of an independent verification of all equipment during the annual inventory process, properly segregating investigative equipment duties, and maintaining supporting documentation for disposed items. To ensure the annual inventory of investigative equipment was properly conducted, we recommended the Chief, CI, establish procedures requiring each office to submit the primary reconciliation document used during the inventory process along with the memorandum to the Director, Equipment and Technology Evaluation, and require each office attach a document listing the personnel that conducted the inventory verifications.

We also recommended procedures be established to periodically review the permissions of those personnel with access to the investigative equipment control system to ensure proper separation of duties. To ensure each disposal of equipment was properly conducted, we recommended monitoring procedures be established requiring the review of supporting documentation. Further, we recommended the Chief, CI, assess the viability of using bar coding nationwide to control investigative equipment that is conducive to such a process.

In addition, we recommended the Chief, CI, ensure all pocket commissions are properly controlled on the inventory system, as well as ensure all missing pocket commissions are properly referred to the Treasury Inspector General for Tax Administration (TIGTA), Office of Investigations. We also recommended the Chief, CI, determine if the current supply of belt and enforcement badges is sufficient to provide each special agent with a unique belt and enforcement badge identification number.

To improve the accuracy and completeness of the CI function's equipment control system, we recommended the Chief, CI, establish procedures to ensure all investigative equipment purchased is properly controlled. We also recommended procedures be established to ensure changes to serial number information are appropriate and to resolve all instances where the serial numbers were altered based on information provided by the TIGTA during this review. In addition, we recommended the Chief, CI, establish procedures to identify duplicate records in the control system.

To ensure physical security controls adequately safeguard investigative equipment from theft or loss, we recommended the Chief, CI, establish procedures to ensure functional security reviews of equipment storage areas are conducted annually. We also recommended restricting access to investigative equipment storage areas to only those personnel responsible for maintaining the equipment. Finally, we recommended the Chief, CI, establish procedures, such as incorporating a layout or schema, to ensure investigative equipment assigned to the CI function HQ offsite warehouse is effectively stored.

Response

Because the CI function is committed to perfecting its internal controls, it will convene an Investigative Equipment Control work group comprised of HQ and field personnel. The work group will conduct a thorough review of the CI function's equipment inventory control system and formulate detailed recommendations for improvement. The Chief, CI, concurred with all the recommendations in this report. Specifically, the Chief, CI, through the Director, Equipment and Technology Evaluation, will:

• Issue a detailed memorandum clarifying the inventory system and the roles and responsibilities of all CI function employees. Additional guidance will also be provided to all CI function managers.

• Revise the Property Management Handbook to require reconciliation documentation upon completion of the annual inventory.

• Determine the specifications for bar coding investigative equipment nationwide.

• Determine the appropriate levels of access for CIMIS users and how frequently these permissions are reviewed.

• Ensure all reports of survey and supporting documentation are reviewed for completeness and accuracy.

• Issue new pocket commissions and destroy and document those that were previously issued; ensure all missing pocket commissions are referred to the TIGTA, Office of Investigations; and issue uniquely serial-numbered enforcement and belt badges as necessary to prevent duplicates.

• Evaluate current procedures for controlling equipment purchases and recommend necessary enhancements.

• Resolve previously identified discrepancies where serial numbers were changed and review and recommend appropriate policy and procedural changes.

• Create a report to identify records with exactly matching duplicate serial numbers and determine who will review the report and how often it will be reviewed.

• Ensure functional security reviews of investigative equipment and firearms storage areas are conducted annually.

• Emphasize restricting access to investigative equipment areas to only necessary personnel.

• Review the operations of the warehouse facility and make necessary recommendations to ensure implementation of a sound and secure inventory tracking system for all investigative equipment stored at that facility.

Copies of this report are also being sent to the IRS managers affected by the report recommendations. Please contact me at (202) 622-6510 if you have questions or Daniel R. Devlin, Assistant Inspector General for Audit (Headquarters Operations and Exempt Organizations Programs), at (202) 622-8500.

                           Table of Contents

² Pocket commissions are special agent identification media consisting of a photograph and a sequentially numbered certification for authority.

³ The CIECS is a standardized nationwide online investigative equipment inventory system that allows management to track where its investigative equipment and accessories are located, to track to whom it is assigned, and to generate reports. It also tracks equipment loaned outside of the CI function and the disposal of equipment.

To accomplish their mission, CI function special agents use various types of investigative equipment¹ including, but not limited to, fleet vehicles, radio communication equipment, firearms, body armor, electronic surveillance equipment, night vision equipment, and optical equipment. Accessories and supplies used by CI function special agents include pagers, cellular telephones, binoculars, camera lenses, tape recorders, and transcribers.

The Office of Management and Budget Management's Responsibility for Internal Control, Circular A-123, requires that a management control system provide management with reasonable assurance that assets are safeguarded against waste, loss, unauthorized use, and misappropriation.

According to the Internal Revenue Manual (IRM), investigative equipment and investigative accessories and supplies valued at $500 or more will be entered into the Criminal Investigation Equipment Control System (CIECS).² Those items valued less than $500 are considered disposable items and are not entered. The exceptions are firearms, pocket commissions,³ enforcement badges, and belt badges.

Table 1 represents the total assets and total asset acquisition cost for the investigative equipment categories recorded in the CIECS as of September 30, 2004.

      Table 1: CI Function Investigative Equipment

In response to our request for suggestions for Fiscal Year (FY) 2004 audit coverage, the former Chief, CI, cited controls over equipment as a management concern because budget shortfalls resulted in a lack of support staff in the field office locations. According to documentation provided by the CI function, the number of nonspecial agents assigned to the field offices declined from 672 in FY 1999 to 589 in FY 2004 (a 12 percent decrease).

This review was performed at the CI function Headquarters (HQ) offices in Washington, D.C.; Chicago, Illinois; and Forestville, Maryland,⁶ and the CI function field offices located in Chicago, Illinois; Houston, Texas; and Los Angeles, California, during the period November 2004 through June 2005. The audit was conducted in accordance with Government Auditing Standards. Detailed information on our audit objective, scope, and methodology is presented in Appendix I. Major contributors to the report are listed in Appendix II.

We randomly selected 700 investigative equipment items to verify, including 125 firearms, at the CI function HQ office⁷ and 3 field offices. We could not locate or find support for 70 of these items and could not positively identify an additional 9 items. Also, during FYs 2004 and 2005, the CI function HQ office and 1 of the field offices wrote off, or were prepared to write off as lost, 429 items with an acquisition cost exceeding $1.3 million. This occurred because weak internal controls have created an environment susceptible to the loss of investigative equipment.

Results of physical verification

We conducted a physical verification of a sample of investigative equipment,⁸ excluding vehicles, recorded on the CIECS as active equipment as of September 30, 2004.

Table 2 illustrates the results of our physical verification, including the total population and sample size of equipment included in our review.

 Table 2: Results of Investigative Equipment Verification

Investigative equipment previously lost by the CI function

The CI function HQ offices wrote off 224 items as lost during February 2004. These items, with an acquisition cost of about $594,376,¹⁴ included enforcement badges, radios, and video equipment. Over 70 percent of these items (158 of 224) were assigned to the CI function HQ offsite warehouse. In addition, the CI function HQ office was preparing to write off an additional 73 items during FY 2005, as a result of the FY 2004 inventory. These items, with an acquisition cost of about $297,288, included secured fax machines, radios, and 1 belt badge; almost all (72 of the 73) were assigned to the offsite warehouse. According to CI function management, the write off of equipment occurred because these items could not be located during the last several annual inventories. They advised this was an effort to clean up the CIECS and not a regular practice. While we understand that it may be necessary to write off equipment from time to time, this practice should not become routine.

Further, 1 of the field offices in our review wrote off 68 items during February 2005. These items, with an acquisition cost of approximately $145,400,¹⁵ included audio and video equipment. According to the report of survey prepared at that office, the items were either lost, damaged, stolen, or excessed without proper supporting documentation. In December 2004, that same office also wrote off 64 dual-band radios costing about $286,500.¹⁶ The office theorized these items were transferred by the prior investigative technical agent¹⁷ to the Drug Enforcement Administration (DEA).¹⁸ According to documentation provided by the CI function, neither the IRS nor the DEA could locate these radios after a search of their locations.

Internal control weaknesses contributed to lost investigative equipment

We attribute the conditions described above to a weak control environment over investigative equipment. Specifically, our review showed the CI function did not:

• Effectively conduct the annual physical verifications.

• Exercise proper separation of duties.

• Maintain complete documentation to support equipment disposal transactions.

• Properly control equipment loaned by the CI function HQ office.

According to the CI function's Property Management Guidelines, each office is required to conduct an annual physical inventory of investigative equipment by the end of the fiscal year. This inventory should not only include verifying all equipment recorded on the CIECS but also account for those items in an office's possession that meet the CIECS reporting criteria. The CIECS coordinator and backup coordinators¹⁹ are prohibited from participating in the inventory verification, to maintain proper separation of duties.

At the conclusion of the physical inventory, each office should send a memorandum outlining the results to the Director, Equipment and Technology Evaluation (ETE). The memorandum should note that 100 percent of all equipment was inventoried and should include an attachment listing all items that were reported as lost or stolen with the proper supporting documentation.

We reviewed the inventory procedures at four CI function offices and determined the offices did not always properly conduct the physical inventories.

• One of the offices had not completed its FY 2004 physical inventory at the time of our review. Personnel from that office indicated they received an extension; however, the CI function HQ office stated the extension was not granted by its office.

• There was no evidence that a verification of unassigned equipment inventory was conducted for a Special Agent in Charge.

To better control its equipment and improve the inventory process, the CI function should consider using bar coding on equipment conducive to such a process. One of the offices in our review was planning to bar code its investigative equipment. In addition, the Director, ETE, indicated the possibility of going forward with plans to bar code equipment at the CI function HQ offsite warehouse. The CI function should analyze the results of these efforts to determine the feasibility of bar coding all of its investigative equipment. The use of bar coding can reduce human error, as well as improve the efficiency of the physical inventory process.

The CI function did not exercise proper separation of duties

According to the Government Accountability Office Standards for Internal Control in the Federal Government, key duties and responsibilities need to be divided or separated among different people to reduce the risk of error or fraud. This should include separating the responsibilities for authorizing transactions, processing and recording transactions, reviewing transactions, and handling any related assets. No one individual should control all key aspects of a transaction or event. In addition, the Property Management Guidelines state the CIECS coordinator and backup coordinators are prohibited from participating in the inventory verification to maintain proper separation of duties.

At three of the four offices reviewed, we identified the following instances where duties were not properly separated:

• Several property custodians at the CI function HQ office had recordkeeping duties. Not only did they have access to the CIECS database, but their permission levels allowed them to add records and change information on existing records.

• An employee of the CI function Finance section was responsible for purchasing, recording, and maintaining custody of enforcement badges and pocket commissions.

• Support staff at one office conducted their respective group inventories. According to the IRM, an employee may not inventory equipment where he or she is responsible for maintaining that inventory.

• The CIECS coordinator in one of the CI function field offices maintained custody of the keys to the surplus vehicles.

• A backup CIECS coordinator in one office conducted the inventory of the lead technical agent's equipment pool and the firearm coordinator's pool. Another backup coordinator at that same office conducted the inventory of one of the groups.

CI function management needs to ensure the investigative equipment duties are properly separated to reduce the risk of error or fraud.

The CI function did not maintain complete documentation to support equipment disposal transactions

According to the Standards for Internal Control in the Federal Government, all transactions should be authorized, clearly documented, and readily available for examination. Control activities, such as reviewing supporting documentation, help ensure all transactions are completely and accurately recorded.

Investigative equipment excessed during FY 2004 was not properly authorized and/or supported

The Property Management Guidelines state the disposal of an investigative equipment item can be made once the item has been offered to other field offices. Local management can approve the disposals, except the Director, ETE, is required to approve the disposal of all technical agent equipment; radio equipment; and, undercover, surveillance, and special purpose vehicles. Equipment that is excessed must be supported by a Report of Excess Property (Standard Form 120).

We judgmentally selected 89 items classified as excessed during FY 2004 and determined there was either no supporting documentation or the documentation was incomplete for almost one-half of these items.

    Table 3: Results of Review of Excessed Equipment

According to the Property Management Guidelines, any time investigative equipment is lost, stolen, or damaged a memorandum is prepared by the individual assigned the equipment documenting the circumstances of the loss. This memorandum is then forwarded to the employee's supervisor who determines if the loss was due to negligence.

A Report of Survey (Form 1933) must also be prepared to report equipment that is lost or stolen. Special Agent in Charge and Director of Field Operations approvals are required for equipment assigned to the field offices. Division Director approval is required for equipment assigned to their divisions. All approved Forms 1933 must be forwarded to the Director, ETE. The TIGTA, Office of Investigations (OI), must be contacted whenever a firearm, badge, or pocket commission is reported as lost or stolen.

We reviewed a total of 59 items reported as lost or stolen during FYs 2003 and 2004 and determined the following:

• In nine instances, the supporting documentation was incomplete, including the lack of the Director of Field Operations' signature or the lack of a determination for financial liability. There was also one instance where a security incident report was located, but there was no evidence this report was forwarded for proper approval.

• In three of the nine instances, the TIGTA, OI, was not notified, as required, of a lost pocket commission, firearm, and belt badge.

• In one instance, there was no supporting documentation.

Current CI function procedures did not ensure equipment disposed of was properly supported or applicable information was properly reported. For instance, annual inventory procedures did not require the review of supporting documentation for equipment that was excessed, lost, or stolen. Documentation is needed to ensure all transactions are properly recorded and to ensure equipment is effectively controlled. Equipment that is recorded on the CIECS as disposed of without supporting documentation could be an indication of an unauthorized alteration. Also, badges, pocket commissions, and firearms that are lost or stolen need to be reported to the TIGTA, OI, to allow for appropriate investigative actions, including entering the information on national crime databases.

The CI function did not properly control equipment loaned by the HQ office

According to the Property Management Guidelines, all loaned equipment must be tracked by the receiving office; that office must also verify all loaned equipment during the annual inventory process.

We attempted to physically verify 15 items that were loaned by the CI function HQ office to the 3 field offices in our review and could not locate 5 of these items costing $29,671. These five items included an enforcement badge, video equipment, and a concealment item used for surveillance activities. In addition, we selected 20 additional items that were in loaned status from the CI function HQ office to other field offices to determine if the HQ office verified these items during the last annual inventory. In six instances, there was no indication the item was verified during the last annual inventory (FY 2004).

This occurred because procedures were not effective in ensuring equipment in loaned status was physically verified during the annual inventory process. An item in loaned status would appear only on the loaner's (in most instances, the CI function HQ office) Report 1.²² The equipment would not appear on the Report 1 of the office with physical custody of the item.

CI function management indicated the new CIMIS database should more effectively ensure loaned equipment is properly verified. The new system now creates a temporary custody assignment of the loaned item. Both parties should have control and be accountable. The loaned item should now appear on both the loaner's and receiving office's Report 1. Both parties are responsible for verifying the item during the inventory process.

We agree these new procedures will help ensure equipment in loaned status is physically verified during the annual inventory process. However, this verification is still dependent on the inventory procedures practiced at each office.

The CI function is responsible for controlling over 40,000 investigative equipment items costing approximately $128 million. Unless CI function management takes action to improve the controls and procedures over this equipment, they will continue to be at risk of losing control of more investigative equipment.

Recommendations

The Chief, CI, should:

Recommendation 1: Issue a memorandum to applicable CI function personnel reemphasizing the importance of independently verifying all equipment during the annual inventory; not relying on oral statements made by the property custodians; physically verifying the serial number of each item; ensuring each item is properly recorded on the CIMIS; properly segregating investigative equipment duties; maintaining supporting documentation for disposed of items; and notifying the TIGTA, OI, when badges, pocket commissions, or firearms are lost or stolen.

Our review determined that pocket commission inserts were not always controlled on the CIECS, as required. As a result, the CI function could not locate 111 pocket commission inserts. In addition, we identified numerous enforcement and belt badges that had the same identification number. This weakened the CI function's ability to properly control the badges. The CI function must improve the control of its identification media to prevent the loss or theft of pocket commission inserts and badges. In the hands of an unauthorized person, these items could not only bring serious discredit and adverse publicity to the IRS but could also be damaging to our nation's homeland security.

Each special agent should be issued an enforcement badge together with a belt badge and a pocket commission containing the special agent's sequentially numbered insert. The CI function is responsible for establishing and maintaining necessary controls and records to adequately govern the issuance, control, and recovery of badges and pocket commissions authorized and issued to employees under its jurisdiction. Records should be such that they account for all badges and pocket commissions at all times. The Property Management Guidelines required that all enforcement badges, belt badges, and pocket commission inserts be recorded in the CIECS. At the time of our review, the CI function Finance section was responsible for maintaining the badges and pocket commission inserts.

Pocket commission inserts were not always controlled on the CIECS, resulting in missing commissions

The CI function purchased 6,000, sequentially numbered, pocket commission inserts during 1999. We identified 2,850 that were not controlled on the CIECS, as required. CI function management stated their practice was to record the pocket commission inserts in the CIECS when they were issued to special agents, rather than spending the time to record the blocks as received.

According to CI function personnel, 2,050 of the 2,850 inserts were kept in a locked cabinet. They said an additional 65 inserts containing the signature of the former Chief, CI, were awaiting destruction. Of the remaining 735 pocket commission inserts not controlled on the CIECS, the CI function advised they were able to account for 610, leaving 111 still missing. At the time of our audit, the Director, ETE, stated the CI function was in the process of issuing new pocket commission inserts, and the ETE section will be responsible for maintaining the enforcement badges and pocket commissions in the future.

In the response to this report, the Chief, CI, acknowledged that control over identification media is critical. CI function management indicated they have located all but 4 of the 111 missing pocket commissions. Further, they believe, based upon available documentation and statements from HQ office and field office personnel, it is very likely that all unissued and inactive pocket commissions were destroyed. CI function management also noted there is no evidence to suggest that any of the pocket commissions were unknowingly taken outside the agency or misused in any way. Therefore, they are confident the four pocket commissions missing from the inventory system do not present a substantial risk to the agency or the country. In this day and age of identity theft, we believe there is a risk associated with the inability to account for the location of even one pocket commission.

Enforcement badges and belt badges with the same identification numbers weaken accountability

We identified numerous enforcement and belt badges that had the same identification numbers. According to the CIECS data, there were 162 enforcement badges and 489 belt badges where at least 2 of each type had the same number. There are 12 instances where as many as 4 special agents have the same belt badge number and another 29 instances where there were at least 4 of the same belt badge number; however, not all of these were assigned to a special agent.

According to CI function management, the field offices were previously responsible for purchasing and issuing the enforcement and belt badges. In some instances, the sequences of badge numbers were the same.

Enforcement badges and belt badges with the same identification numbers weaken the controls for accountability of these items.²³ The CI function should ensure each special agent has unique enforcement and belt badge identification numbers.

Recommendations

The Chief, CI, should:

Recommendation 6: Ensure all pocket commissions are properly controlled on the CIMIS, with the following exception. The blocks of 2,050 pocket commission inserts currently stored at the CI function HQ office should be promptly destroyed when the new pocket commission inserts are issued. Prior to their destruction, an inventory should be taken to ensure each commission is properly accounted for and documented.

Recommendation 7: Ensure all missing pocket commissions are referred to the TIGTA, OI.

According to the Property Management Guidelines, the field offices are responsible for maintaining an accurate record of investigative equipment. Any management information system should readily provide CI function management with accurate information about their equipment and operations. We determined:

• Investigative equipment physically verified contained inaccurate information on the CIECS.

• Items selected for verification from the "floor" were not recorded on the CIECS.

• Equipment purchased during FY 2003 was not always recorded on the CIECS.

• Duplicate records, and records where serial numbers had been altered, were contained in the CIECS.

Of the 700 items in our original sample, we were able to verify 621. However, 81 of the 621 contained 1 of the following types of errors:

• Eleven items with inaccurate serial numbers.

• Fifty-eight items with inaccurate model numbers.

• Seven items with inaccurate assignment locations (four of these were firearms).

• Five items that were properly disposed of but were still listed on the CIECS as active (one was a firearm).

Items selected for verification from the "floor" were not recorded on the CIECS

We also judgmentally selected 118 investigative equipment items, including 21 vehicles, during our CI function HQ office and field office verification testing and traced the items to determine if they were recorded and controlled on the CIECS.

• Ten items were not controlled on the CIECS as required. These items included three hand-held radios, two secured fax machines, a freeze-frame video recorder, a video cassette recorder, a concealment device used in undercover operations, a playback monitor, and a portable receiver. The estimated cost of these items was approximately $25,460.

• Five items were incorrectly controlled on the CIECS. These items were controlled on the CIECS by the "kit"²⁴ container housing the equipment. According to the Property Management Guidelines, the serial number of the main component of each "kit" should have been recorded in the CIECS to control the equipment.

• Three items had inaccurate assignment locations, according to the CIECS.

Equipment purchased during FY 2003 was not always recorded on the CIECS

We identified 249 investigative equipment purchases made by the CI function HQ office during FY 2003 from procurement documentation²⁵ to determine if the items were properly controlled on the CIECS. Over 18 percent (46 of 249) of the equipment purchases, with an acquisition cost of about $116,221, were not controlled on the CIECS. These items included secured fax machines, telephones, safes, and video equipment. This occurred because procedures current at the time of our review did not ensure all investigative equipment purchased by the CI function HQ office was entered into the CIECS. Equipment purchased as part of a standard model (for example, a hand-held radio is part of the special agent's model) did not have to be approved by the Director, ETE. The ETE section would only be aware of equipment shipped directly to the field by the manufacturer (known as being "drop shipped") when a copy of the packing slip was provided to the ETE section upon receipt of the equipment. There were no procedures in place to verify that investigative equipment purchased and drop shipped to the field had been entered into the CIECS.

An internal review of the ETE section conducted in October 2003 also noted that no validation of drop shipped equipment was being performed. The review noted much of the investigative equipment was purchased and shipped directly to the field from the manufacturers.

We provided the results of our analysis to the CI function. CI function management provided the following response to the 46 investigative equipment items we could not locate:

• For 26 of the items, they were taking the necessary steps to add the equipment information to the CIMIS.

• A total of 11 items were radio components that did not have serial numbers and were purchased to replace components that were broken or damaged. While the purchase price may have been in excess of $500, these items should not have been entered on the CIMIS because they were part of a "kit."

• A total of five of the equipment items were safes and shredders. The CI function indicated these items were not required to be entered into the CIECS. (However, our review of CIECS information identified similar safes and shredders that were controlled on the system. A determination should be made to either add or remove these types of items from the CIMIS, consistent with Property Management Guidelines.)

• In four instances, supporting documentation could not be located to determine if the equipment should have been entered into the CIECS.

Duplicate records, and records where serial numbers had been altered, were contained in the CIECS

The serial number on the CIECS is the equipment's principal identifier and is used by the CI function during the inventory process to verify the equipment. We identified numerous investigative equipment records where the serial numbers were altered without detection. The CIECS permission levels allowed changes to the serial number, and there was no audit trail to identify who made the changes. As a result, the CI function lost control of several items, and 1 firearm went unrecorded on the CIECS for 7 to 11 months. In addition, we identified duplicate equipment records in the CIECS because the System did not prevent the creation of duplicate records.

Serial numbers were altered on the CIECS, resulting in equipment left uncontrolled

At 1 of the field offices in our review, we identified 12 instances where the serial number of a CIECS record was altered. We believe this occurred in response to the results of the annual inventory conducted in 2004. When changes in the assignments of investigative equipment were noted, the CIECS coordinator changed the serial numbers of the records instead of the employee assignments. The records that were altered controlled various equipment, including a firearm, pocket commissions, and a belt badge.

The firearm was returned to the firearms coordinator in March 2004 with a broken frame. We concluded that sometime after that, the CIECS coordinator altered the serial number instead of changing the assignment. We believe the firearm went unrecorded on the CIECS for 7 to 11 months since it was not on our download of CIECS information dated September 30, 2004. It did appear on our February 3, 2005, download as being assigned to the firearms coordinator. We physically verified the firearm at the office during fieldwork.

The 12 instances also included 8 pocket commissions and 1 belt badge where serial numbers were altered. We were unable to verify these commissions at the field office. The office indicated these items were most likely destroyed.

We conducted an analysis of the CIECS information and identified an additional 83 instances where serial numbers were altered in some way between September 30, 2004, and February 3, 2005. Most of these were minor corrections; however, there were 12 instances where the serial numbers were noticeably different. One of these items was a shotgun assigned to an office not included in our review. That office indicated the serial number was changed because the previous number was erroneously entered for that weapon.

CI function management stated there are legitimate business reasons for changing serial numbers and, like the CIECS, the new CIMIS will allow users to change this information. However, the new CIMIS has an audit trail feature that records information about these changes. CI function management also advised us reports should be available that will show these changes. The CI function's Security Officer is responsible for reviewing these reports.

While we agree the use of an audit trail will help the CI function eventually detect inappropriate changes to investigative equipment information, changes may go undetected until audit trail reports are generated. Since the serial number is the main equipment identifier, we believe the ability to make changes to this information should be limited.

Duplicate records were created in the CIECS, resulting in unreliable data

As previously discussed, the existence of duplicate records should have been identified during the annual inventory process. Our analysis of the CIECS data identified 95 instances where there were duplicate records for an investigative equipment item. In 49 instances, the same item was assigned to 2 different offices.

This occurred because the CIECS did not prevent duplicate records from being created. CI function personnel indicated the new system will prevent the creation of a duplicate record if the record has the same information in all of the following fields:

• Serial number.

• Model Number.

• Manufacturer.

• Category.

• Subcategory.

Recommendations

The Chief, CI, should:

Recommendation 9: Establish procedures to ensure all investigative equipment purchased is properly controlled on the CIMIS. For example, the ETE section should be notified by the CI function Finance section at the time investigative equipment is procured.

Our review of the physical security controls at the four offices²⁶ identified weaknesses that left equipment vulnerable to theft or loss. This occurred because management did not ensure physical security controls were properly maintained. This included not ensuring functional security reviews²⁷ were conducted, as required. In addition, the procedure for storing investigative equipment at the HQ offsite warehouse did not ensure equipment was adequately controlled. As a result, investigative equipment, such as firearms, was not properly secured.

According to the Standards for Internal Control in the Federal Government, an agency must establish physical control to secure and safeguard assets. Access to resources and records should be limited to authorized individuals, and accountability for their custody and use should be assigned and maintained.

In addition, the IRM states the safeguarding of investigative equipment (other than firearms) carries a "Normal Security" designation, signifying that equipment should be maintained in either a locked perimeter area, a locked interior area, or a locked container. Firearms, when not in use, should be protected as follows: one to four firearms -- security container; five or more firearms -- safe or vault. Access to a locked area, room, or container can be controlled only if the key, keycard, or combination is controlled.

The number of keys or knowledge of the combinations to a secured area must be kept to the absolute minimum. A Custody Receipt for Government Property (Form 1930) should be used to record the issuance of all keys (including keycards for electronic access controls systems). Combination locks, which rely on something the individual knows, have been used in the past for controlling access. If the combinations are widely disseminated and not changed frequently, unauthorized accesses may occur and may not be easily detected. Combinations must be changed at least once a year, or when a person who knows the combination terminates employment, and documentation of these changes should be maintained.

We reviewed the physical security controls at the four offices and identified the following weaknesses:

• Combinations for keypads allowing access to investigative equipment storage areas were not changed for at least 1 year, as required. CI function personnel could not recall when the combinations were last changed (two offices).

• Combinations to the firearms safes or vaults were not changed for at least 1 year; 1 of the combinations had not been changed since 1996. CI function personnel could not recall when the other combinations were last changed (two offices).

• A safe storing several shotguns was broken (one office).

• Control custody receipts or control logs were not maintained for keys allowing access to investigative equipment and firearms storage areas (three offices).

• The new firearms were not stored in a safe or vault. Instead, they were stored in the firearms storage area. The office cited a lack of space as a reason for not storing the firearms in a safe or vault; however, accessibility to this area was unknown because custody receipts indicating who had keys allowing access to this area were not maintained (one office).

• The CIECS coordinator and several computer investigative specialists had access to a garage storage area housing various radio and video equipment (one office).

• Several CI function personnel, including executives and an individual who was previously assigned temporarily, had access to the CI function HQ offsite warehouse.

In addition to our physical security concerns, the current environment for storing equipment at the CI function HQ offsite warehouse concerns us. This facility is used to store equipment purchased by the CI function HQ office until it is sent to the field offices for use. According to the CIECS, as of February 3, 2005, a total of 1,834 investigative equipment items with an acquisition cost exceeding $4 million was assigned to the warehouse. This included radios, video equipment, and firearms. The CI function advised us these firearms were never physically stored at the warehouse. They were erroneously recorded as assigned to the warehouse on the CIECS.

As previously mentioned, the CI function HQ office wrote off, or was prepared to write off as lost, a total of 230 items during FYs 2004 and 2005. In addition, we were unable to verify 24 items assigned to the warehouse. We believe the disarray observed at this offsite warehouse facility contributed to the loss of equipment. Items were haphazardly stored in multiple locations throughout the facility, and some items were obscured from view. Also, the current procedure for relying on one's memory to recall where equipment is located is not proper, effective, or efficient.

Properly managing the storage facility for investigative equipment is necessary to ensure equipment is adequately controlled. This can be accomplished by developing a layout or schema for storing investigative equipment that will allow the CI function to more easily track and locate items.

Recommendations

The Chief, CI, should:

Recommendation 13: Establish procedures to ensure functional security reviews of investigative equipment and firearms storage areas are conducted on an annual basis.

² The CIECS is a standardized nationwide online investigative equipment inventory system that allows management to track where its investigative equipment and accessories are located, to track to whom it is assigned, and to generate reports. It also tracks equipment loaned outside of the CI function and the disposal of equipment.

³ Pocket commissions are special agent identification media consisting of a photograph and sequentially numbered certification for authority.

⁴ This category includes enforcement and belt badges, pocket commissions, motion detectors, and fingerprint kits.

⁵ The CIMIS is a database that tracks the status and progress of criminal investigations and the time expended by special agents. It is also used by management to provide the basis for decisions of both local and national scope.

⁶ We performed fieldwork at these three offices within the HQ office. Unless otherwise noted, references made in this report to the HQ office reflect the results of our fieldwork at these three offices.

⁷ We selected equipment assigned to the Equipment and Technology Evaluation section.

⁸ We selected equipment from the following categories on the CIECS: Firearms (Category Number 10), Audio (20), Video (21), Photographic (23), Telecommunication (25), Optical (26), Radio (60), Tracking (70), and select subcategories from Miscellaneous Investigative Equipment (28).

⁹ This reflects the population of investigative equipment and firearms that we selected our samples from for the offices in our review.

¹⁰ A sample of 125 firearms (50 -- HQ, 75 -- field) was selected for verification. All 125 were verified during our review.

¹¹ According to CI function field office personnel, this included one item that was stolen during 2003. The office provided the memorandum prepared by the employee noting the loss; however, a Report of Survey (Form 1933) was not prepared, as required.

¹² We could not verify these items because the serial numbers were not visible or not found on the equipment. This included items installed in a surveillance van.

¹³ This figure was based upon the best available information we had at the time of our review and does not account for depreciation.

¹⁴ The CI function HQ office estimated the loss at $286,441, after the items were depreciated.

¹⁵ The field office asserted that these items had a remaining value of approximately $6,000.

¹⁶ The field office asserted that these items had no remaining value.

¹⁷ The CI special agent that is responsible for maintaining investigative equipment at the field offices.

¹⁸ The prior technical investigative agent at that office resigned during FY 2004. The TIGTA Office of Investigations, in conducting a related investigation, disclosed that 60 excessed dual-band radios designated to be given to the DEA were missing. The disposal of these radios was under the supervision of that agent. Eventually a total of 64 radios were disposed of as lost.

¹⁹ We considered backup coordinators as all personnel who had the ability to add, change, and delete information in the CIECS.

²⁰ This review was requested by the Director and Deputy Director, Operations, Policy, and Support, and was conducted by an ad hoc team comprised of personnel from the HQ office and various field offices.

²¹ This category includes three HQ and five field office items that were either excessed as a duplicate record or inaccurately classified as disposed of.

²² This report is generated by the current CIMIS (and was also generated by the CIECS), is used by each office as the beginning inventory, and serves as the primary reconciliation document.

²³ We recognize that, in the event of a lost or stolen badge, the CI function eventually would be able to determine to whom it belonged through either canvassing each agent who was assigned the number or self-reporting by the agent to whom the lost or stolen badge belonged. However, accountability is more effective if all badge numbers are unique, especially if a claim of potential misconduct is made against an agent and the only identifier was the badge number.

²⁴ Assembled kits consist of related equipment components that are used collectively as one unit. Examples include surveillance vans, camera kits, and radio repeaters.

²⁵ This documentation included purchase orders, credit card statements, and various receipt documentation for the purchase of equipment from financial accounting sub-object codes 3184 (Capitalized Radio Equipment) and 3185 (Capitalized Criminal Investigative Equipment). However, our review was hampered because some of the documentation was incomplete. For example, many of the credit card statements did not contain related documentation such as purchase orders and corresponding evidence of receipt.

²⁶ Each office consisted of multiple sites where we reviewed the physical security controls. For instance, we also reviewed the controls at the Laguna Niguel, California, site, which is part of the Los Angeles field office.

²⁷ According to the IRM, functional security reviews measure adherence to security requirements and procedures that apply to each manager's office or functional area. These reviews do not represent technical assessments of the security program but are a means to ensure the existing security procedures and requirements are in place on a day-to-day basis. First-line managers, on an annual basis, will conduct these reviews of areas for which they are responsible. Upper levels of management are responsible for reviews of their immediate work areas.

² We performed fieldwork at these three offices within the Headquarters office. Unless otherwise noted, references made in this report to the HQ office reflect the results of our fieldwork at these three offices.

³ This documentation included purchase orders, credit card statements, and various receipt documentation for the purchase of equipment from financial accounting sub-object codes 3184 (Capitalized Radio Equipment) and 3185 (Capitalized Criminal Investigative Equipment). However, our review was hampered because some of the documentation was incomplete. For example, many of the credit card statements did not contain related documentation such as purchase orders and corresponding evidence of receipt.

John R. Wright, Director

Diana M. Tengesdal, Audit Manager

Jeffrey K. Jones, Lead Auditor

James S. Mills, Jr., Senior Auditor

Janice A. Murphy, Senior Auditor

Office of the Commissioner -- Attn: Chief of Staff C

Deputy Commissioner for Services and Enforcement SE

Director, Operations Policy and Support, Criminal Investigation SE:CI:OPS

Director, Equipment and Technology Evaluation, Criminal Investigation SE:CI:OPS:ETE

Chief Counsel CC

National Taxpayer Advocate TA

Director, Office of Legislative Affairs CL:LA

Director, Office of Program Evaluation and Risk Analysis RAS:O

Office of Management Controls OS:CFO:AR:M

Audit Liaison: Director, Planning and Strategy, Criminal

Investigation SE:CI:S:PS

Type and Value of Outcome Measure:

• Protection of Resources -- Actual; 70 investigative equipment items costing $241,718 could not be located or positively identified (see page 4).

We randomly selected 700 investigative equipment items, including 125 firearms, to physically verify. We could not locate or find support for 70 items. The items we could not verify included audio and video equipment and secured fax machines. These items had an acquisition cost of $241,718.¹

Type and Value of Outcome Measure:

• Protection of Resources -- Actual; 2,850 pocket commission inserts were not properly controlled on the Criminal Investigation Equipment Inventory System (CIECS). As a result, the Criminal Investigation (CI) function could not locate 111 pocket commission inserts (see page 13).

We conducted an analysis of the CIECS to determine if the pocket commissions were numerically sequenced. We initially identified over 400 missing numbers. We subsequently obtained the purchasing information relating to the numeric sequence of the pocket commissions purchased by the CI function. We compared this information to the listing of pocket commissions recorded in the CIECS and identified 2,850² pocket commission inserts that were not properly controlled on the CIECS, as required. The CI function could not locate 111 pocket commissions.

Type and Value of Outcome Measure:

• Protection of Resources -- Actual; 10 investigative equipment items, with an acquisition cost of about $25,460, were not controlled on the CIECS, as required (see page 16).

We judgmentally selected 118 investigative equipment items to determine if the items were properly controlled on the CIECS. We identified 10 items that were not controlled on the CIECS, as required. These items had an acquisition cost of approximately $25,460 and consisted of various radio and video equipment.

Type and Value of Outcome Measure:

• Protection of Resources -- Actual; 46 investigative equipment items purchased by the CI function during Fiscal Year 2003 were not controlled on the CIECS, as required (see page 16).

We judgmentally selected a sample of 249 investigative equipment purchases made by the CI function during Fiscal Year 2003 using procurement documentation, such as purchase orders, credit card statements, and various receipts. We subsequently queried the CIECS to determine if these items were properly controlled. We determined that 46 of these purchases were not properly controlled on the CIECS. These items cost approximately $116,221 and included secured fax machines, telephones, safes, and video equipment.

Type and Value of Outcome Measure:

• Reliability of Information -- Actual; 81 (of the 621) investigative equipment items physically verified during testing contained inaccurate information on the CIECS, including inaccurate serial numbers, assignment locations, and equipment status. Additionally, 8 (of 118) items identified at the 4 offices were not accurately controlled (see page 16).

We captured certain equipment-identifying information (e.g., serial number, model number, and location) recorded in the CIECS for each of the 700 investigative equipment items we sampled and verified that information to the particular equipment item. In addition, we judgmentally selected 118 investigative equipment items to determine if the items were properly controlled on the CIECS. We identified eight items that were not controlled accurately on the CIECS.

Type and Value of Outcome Measure:

• Reliability of Information -- Actual; 95 instances where there were duplicate records for an investigative equipment item (see page 16).

We conducted an analysis of the data obtained from the CIECS dated February 3, 2005, and identified all CIECS records of equipment that contained the same serial number. We selected only those equipment records where the CIECS indicated the items were still in active status. We manually reviewed the resulting information and identified those instances where there was a duplicate record for one investigative equipment item.

Type and Value of Outcome Measure:

• Reliability of Information -- Actual; 95 instances where the serial number of a CIECS record was altered, resulting in the loss of 8 pocket commissions and 1 belt badge (see page 16).

We reviewed the Fiscal Year 2004 inventory supporting documentation at 1 office and identified 12 instances where a change in the assignment of equipment was noted. Our further analysis, including a review of CIECS data, determined in these 12 instances the serial number instead of the assignment number was changed in the CIECS. We then conducted an analysis of the data obtained from the CIECS dated September 30, 2004, and February 3, 2005. We compared the serial numbers of the CIECS records from the September 30, 2004, information to the serial numbers for those same records from the February 3, 2005, information to identify those records where the serial numbers had been changed.

² Of these pocket commissions, 2,115 belong to numerically sequenced blocks and were maintained in a locked cabinet at the CI function Headquarters office; 65 of these are awaiting destruction.

An historical context is important to consider when discussing issues related to CI equipment, because equipment controls were centralized and refined as a result of our reorganization in 2000. Criminal Investigation was restructured under line authority, based on recommendations from the Webster Report. This brought about several positive changes, which allowed the process of reshaping CI's Inventory control system to begin. The Equipment and Technology Evaluation section (ETE) was moved from the Office of Strategy to the Office of Operations. Further, the Director of ETE was ultimately elevated to the senior manager level, while procurement authority was centralized in Headquarters (HQ) CI. This ended individual field office procurement of investigative equipment such as enforcement badges, which previously caused some of the problems noted in the TIGTA draft report. Although these organizational changes strengthened oversight and control of CI's investigative equipment, it is apparent that additional enhancements are required to perfect the system. Criminal Investigation is committed to continued improvement.

Since the 2000 reorganization, CI has taken important steps that will positively affect equipment control and tracking. In April 2005, CI implemented an upgraded Criminal Investigation Management Information System (CIMIS), which replaced the Criminal Investigative Equipment Control System (CIECS). The CIMIS upgrade provided both immediate enhancements and future expansion possibilities to improve the tracking of investigative equipment. Audit reports are available under the new system which provide oversight and review capabilities not possible with CIECS. Also, changes to such critical components of equipment records as serial numbers can now be more readily reviewed for consistency and appropriateness. Criminal Investigation provided extensive training to all CIECS coordinators and backup coordinators in March 2005 on the new CIMIS equipment inventory upgrade. In June 2005, CI provided additional training on investigative equipment inventory control with emphasis placed on the proper separation of duties, as well as the roles and responsibilities of all CI personnel. These two training sessions provided important guidance and clarification for those involved in the day to day aspects of CI's investigative equipment inventory system.

Criminal Investigation has also planned future actions to further improve equipment inventory control. Additional training classes will be presented to pertinent employees in fiscal year 2006 and continuing professional education will be provided on an annual basis thereafter. Further, because CI is committed to perfecting its internal controls, it will convene an Investigative Equipment Control (EC) work group comprised of representatives from HQ CI and field operations by the end of calendar year 2005. This work group will conduct a thorough review of CI's equipment inventory control system and formulate detailed recommendations for improvements by June 15, 2006. The recommendations of the work group will include firm dates for implementation.

Due to concerns about the integrity of our credential system, CI completed an in-depth search to locate the 735 enforcement credentials referenced In the TIGTA audit. This project revealed numerous instances in which CI's record keeping methods were insufficient, CIECS input was inconsistent, and available inventory tracking procedures were not utilized. However, CI personnel were able to track down and substantially document the status of all but 14 of these enforcement credentials. Furthermore, only four lack available information on which to base logical assumptions as to their current status. Based on available information, there is a high probability that the remaining 10 credentials were destroyed. Criminal Investigation is confident that the enforcement credentials missing from the CIMIS system do not present a substantial risk to the agency or the country.

Starting in early 2005, CI dramatically changed its process of issuing enforcement credentials to prevent future tracking problems. A new CI enforcement credential was developed, which possesses updated security features to prevent forgery and unauthorized reproduction. These newly designed enforcement credentials are already being distributed to CI 1811s. Equipment and Technology Evaluation will issue all of these new credentials, after recording each in CIMIS prior to shipment transfer to assigned 1811s. It is anticipated that all CI 1811 enforcement credentials will be replaced with the new credentials by the end of December 2005. The prior credentials are being collected as the new ones are issued and will be appropriately documented and destroyed in an expeditious fashion.

The following comments present CI's perspective on the important issues discussed in the draft report.

Page 5, First Full Paragraph, First Sentence

"The 70 items we could not verify had an acquisition cost of $241,718, and were purchased by the CI function between January 1983 and April 2003."

It is important to point out that a lack of verification by the TIGTA auditors does riot necessarily equate to a loss. As discussed later in this response, HQ CI can confirm possession of some of these items. Furthermore, the use of acquisition cost with no associated mention of depreciation is inconsistent with other sections of the report where depreciated value is discussed in footnotes. Thus, without consideration of depreciation, the $241,718 figure quoted in the draft report is inflated.

Page 5, First Full Paragraph, Remaining Sentences

"These items included mobile and portable radios, video equipment, photographic equipment, and secured fax machines. The loss of sensitive investigative equipment, such as radios, could compromise ongoing investigations by allowing an unauthorized individual access to listen to radio transmissions."

The loss of sensitive investigative equipment such as that noted in this section of the report is a concern and needs to be prevented. Although the assertion that loss of CI radio equipment could pose a risk to ongoing CI investigations is correct in theory, the security controls inherent in CI radio systems make it improbable.

The radio frequencies utilized by all federal law enforcement agencies are easily obtainable by the public via the Internet and other legal sources. Radio equipment capable of monitoring these frequencies is also publicly available. It is the secure encryption coding capabilities of law enforcement radio systems that prevent the unauthorized interception of sensitive radio communications. Criminal Investigation's radio protocols require the use of secure encryption mode when transmitting sensitive operational information. Additionally, CI radio systems are designed so that their removal from a power source causes the erasure of the secure encryption coding. Finally, CI has the ability to disable radio equipment over the air in case of loss or theft. As a result, the possibility of someone intercepting sensitive operational radio communications and thereby compromising CI operations is unlikely.

Page 5, Second Full Paragraph

"Also included in the 70 items were 9 repeaters, duplexers, and base stations installed in remote locations such as mountain tops and rooftops. Even though CI function personnel at the field offices indicated these items would be impractical to verify, they were unable to provide any evidence to support the items existed."

The location of certain CI radio components can make physical verification difficult but not impossible. The functionality of the CI radio system actually serves as verification of these items, since the failure or absence of one of these components would be readily apparent. Additionally, the preventative maintenance contract CI has on these components requires them to be physically accessed by outside technicians on an annual basis. Criminal Investigation stands ready to initiate physical verification of these items if necessary.

Page 12, Paragraph 5

"Our review determined that pocket commission inserts were not always controlled on the CIECS, as required. As a result, the CI function could not locate 111 pocket commission inserts. In addition, we identified numerous enforcement and belt badges that had the same identification number. This weakened the CI function's ability to properly control the badges. The CI function must improve the control of its identification media to prevent the loss or theft of pocket commission inserts and badges. In the hands of an unauthorized person, these items have the potential of not only bringing serious discredit and adverse publicity to the IRS, but could also be damaging to our nation's homeland security."

Criminal Investigation agrees control of identification media is critical. However, them are only four enforcement credentials whose current status can not be fully accounted for or whose disposition can not be logically deduced. As the TIGTA report correctly points out, CI did not employ the most effective control procedures when issuing CI enforcement credentials in the past. Extra enforcement credentials and those damaged during creation were commonly destroyed at the local level, or returned to HQ CI for destruction, without recording them first in CIECS. Inadequate record keeping practices combined with subsequent changes in CI personnel, further complicated the process of accounting for all CI enforcement credentials. Criminal Investigation believes, based on available documentation and statements from HQ and field personnel, it is very likely that all unissued and inactive enforcement credentials not currently held by HQ CI were destroyed. While one can not dispute the sensitive nature of these items, CI strongly objects to the reference to potential damage to homeland security. The circumstances surrounding the CI credentials at issue do not support such an assertion.

Page 13, Paragraph 5

"We identified numerous enforcement and belt badges that had the same identification numbers. According to the CIECS data, there were 162 enforcement badges and 489 belt badges where at least 2 of each type had the same number. There are 12 instances where as many as 4 special agents have the same belt badge number, and another 29 instances where there were at least 4 of the same belt badge number; however, not all of these were assigned to a special agent."

Criminal Investigation's current inventory of enforcement and belt badges does include some with duplicate identification numbers, and CI agrees that this situation must be corrected. Current procedures on procurement of enforcement and belt badges prevent similar duplication of badge identification numbers in the future. Criminal Investigation will distribute sufficient enforcement and belt badges by the end of calendar year 2005 to ensure no 1811 holds the same serial numbered enforcement or belt badge as any other. By the end of calendar year 2006, CI will procure and distribute badges as needed so that each 1811 has an enforcement badge and a belt badge with a matching serial number unique to that 1811. All duplicate enforcement and belt badges will be destroyed and the appropriate documentation created and maintained.

Page 15, items selected for verification from the "floor" were not recorded on CIECS

The first bullet in this section includes a list of items notated as "not controlled on CIECS." The fifth item listed identifies a particular device CI utilizes in undercover operations. Direct reference to this item should be removed from the report. Criminal Investigation suggests language such as "an item of equipment utilized in undercover operations" be substituted.

The CI comments on the specific recommendations in this report are as follows:

Recommendation 1

"Issue a memorandum to applicable CI function personnel reemphasizing the importance of independently verifying all equipment during the annual inventory; not relying on oral statements made by the property custodians, physically verifying the serial number of each item; ensuring each item is property recorded on the CIMIS; properly segregating investigative equipment duties; maintaining supporting documentation for disposed items; and notifying the TIGTA, OI, when badges, pocket commissions, or firearms are lost or stolen."

Criminal Investigation concurs with this recommendation. Additional guidance on these matters was issued during the recent SAC/ASAC meeting, where the accuracy of CI's investigative equipment inventory and the need to maintain proper internal controls was reemphasized. The Chief, CI will also issue a comprehensive memorandum to all CI employees by the end of October 2005 covering the recommended topics.

Recommendation 2

"Establish procedures requiring each office to submit the primary reconciliation document used during the inventory process along with the memorandum that is submitted to the Director, ETE Section. These procedures should also require each office to attach a document listing the personnel that conducted the inventory verifications. This information should be utilized by the Director, ETE Section, in ensuring that each item was properly inventoried and an independent verification was conducted."

The Criminal Investigation Property Management Handbook will be revised to include specific instructions regarding annual inventory guidelines. Specifically, CI personnel will be required to submit a thorough report detailing how the inventory was conducted, the results, and the names of personnel conducting the inventory. In addition, reconciliation documents, copies of reports of survey (Forms 1933), and supporting documents will be required attachments to annual inventory certifications.

Recommendation 3

"Consider whether the use of bar coding would be an effective method of controlling the CI function's investigative equipment. The CI function can assess the viability of using bar coding nationwide by studying its effectiveness at the one field office in our review and at the offsite warehouse, if it is implemented."

Criminal Investigation is already exploring the use of bar coding as a means to enhance internal controls and tracking of equipment inventory. However, the specifications of such a system have not been determined. This is one area on which the IEC work group will focus.

Recommendation 4

"Establish procedures to periodically review the permissions of those users with access to the investigative equipment application of the CIMIS to ensure property custodians and those conducting the inventories have read-only access."

The IEC work group will determine the appropriate level and frequency of reviews of CIMIS roles and permissions.¹

Recommendation 5

"Establish monitoring procedures to require the review of supporting documentation to ensure all disposals (including lost or stolen items) are property conducted. Consider incorporating procedures requiring each disposal (identified from CIMIS) be analyzed by an independent person as part of the annual inventory process."

As previously stated in CI's response to Recommendation 2, CI personnel will submit supporting documentation with all reports of survey in the future. The IEC work group will recommend the appropriate follow-up procedures based on their review.

Recommendation 6

"Ensure that all pocket commissions are properly controlled on the CIMIS, with the following exception. The books of 2,050 pocket commission inserts currently stored at the CI function HQ office should be promptly destroyed when the new pocket commission inserts are issued. Prior to their destruction, an inventory should be taken to ensure each commission is properly accounted for and documented."

Criminal Investigation concurs and will comply with this recommendation. Custody and control of newly issued pocket commissions was transferred from the Finance Section to ETE and they are currently in the process of issuing new enforcement pocket commissions. Each new credential issued is input into CIMIS by ETE personnel and then shipped out via traceable means to the assigned 1811 employee, ensuring the availability of records for all CI enforcement credentials in the future. Follow-ups will be conducted as necessary to ensure enforcement credentials shipped out are actually received by the intended recipient.

As part of this process, all prior enforcement commissions are being collected, inventoried, and destroyed with appropriate witnesses and documentation. The blank pocket commission inserts for the new revisions are maintained exclusively by ETE personnel in boxes with tamper evident seals, which are stored in a locked cabinet within secure space. The computer system utilized for creation of enforcement credentials is also maintained in secured space and access is limited to specific ETE personnel. This computer system is capable of producing a validation report that will allow for thorough tracking of enforcement credential inserts and reconciliation to blank enforcement credential stock inventory. The IEC work group will closely review CI's existing enforcement credential controls and recommend any necessary additional improvements.

Recommendation 7

"Ensure that all missing pocket commissions are referred to the TIGTA, OI."

Criminal Investigation will notify TIGTA of all missing enforcement commissions.

Recommendation 8

"Determine if the current supply of belt and enforcement badges is sufficient to provide each special agent with a unique belt and enforcement badge identification number."

The reorganization of CI in 2000, which centralized control of belt badge procurement and issuance, corrected many of the circumstances resulting in duplicate badge numbers and prevented the problem from proliferating. It did not, however, address the situations where duplicate badge numbers already existed, which are the focus of the TIGTA report. Criminal Investigation is taking the necessary steps to correct all instances of duplicate badge numbers. By the end of calendar year 2005, CI will issue new badges to those 1811 employees possessing badges with duplicate numbers. During calendar year 2006, CI will procure and distribute new belt badges corresponding with each 1811's enforcement badge. Criminal Investigation will then dispose of the excess badges collected, in accordance with proper procedure.

Recommendation 9

"Establish procedures to ensure all investigative equipment purchased is properly controlled on the CIMIS. For example, the ETE section should be notified by the CI function's Finance section of the time investigative equipment is procured."

The CIMIS system, deployed in April 2005, provides additional features not available under the prior CIECS system, including procurement features that allow items to be tracked from the time of purchase. Current procedures require the CI Finance section to advise ETE once contracts are awarded for equipment procurements. This applies to equipment shipped directly to HQ as well as items drop shipped to the field. The ETE section then forwards an email notice to all affected equipment coordinators advising of the purchases. This notice includes specific data to ensure that the appropriate codes are used to record each piece of equipment in CIMIS. Once the equipment is physically received by HQ or the field offices, the necessary entries are made to reflect the proper assignment in CIMIS. The IEC work group will review this process and determine what procedures should be implemented to ensure established policies are consistently followed.

Recommendation 10

"Resolve all instances where the serial numbers were changed based on information provided by the TIGTA during our review."

Criminal Investigation will resolve the serial number changes noted during the audit. Field personnel will submit appropriate documentation to explain serial number changes. Each inappropriate change will be documented and necessary follow-up action taken. The IEC work group will recommend the oversight criteria and restrictions for future serial number changes.

Recommendation 11

"Establish procedures to ensure changes to serial number information in the CIMIS are appropriate. The ability to change a serial number should be limited to personnel at the CI function HQ office or each DFO. A request documenting the reason for changing a serial number should be sent to those personnel."

Criminal Investigation agrees that serial number changes need to be monitored and the number of people with the necessary CIMIS permissions to make such changes limited. The IEC work group will include this area in their review and make recommendations for changes to the policy and procedures as appropriate.

Recommendation 12

"Establish procedures to identify duplicate records in the CIMIS. A report listing all items with duplicate serial numbers should be generated periodically and provided to the Director, ETE Section, for review."

Although CIMIS does offer some validity checks to limit the number of duplicate records, the system is not infallible. A report will be developed to identify equipment records in CIMIS containing exactly matching serial numbers. The IEC work group will recommend the appropriate management level to review this report and the frequency of reviews. If erroneous duplicate serial numbers are identified, CI will promptly take the necessary corrective actions to maximize CIMIS accuracy.

Recommendation 13

"Establish procedures to ensure functional security reviews of investigative equipment and firearms storage areas are conducted on an annual basis."

Criminal Investigation will take the necessary steps to ensure functional security reviews of investigative equipment and firearms storage areas are conducted on an annual basis throughout CI. Although Internal Revenue Manual (IRM) Section 1.16.2.2, requires first line management, or designated representatives, to conduct functional security reviews on an annual basis, this audit clearly reflects CI has not uniformly and adequately adhered to the policy. The IEC work group will look at this area and make the necessary recommendations for improvement. Additionally, RPE will continue to check functional security review certifications for completeness, accuracy, and timeliness during their periodic reviews, paying particular attention to the components of the certifications addressed in the TIGTA draft report.

Recommendation 14

"Restrict access to investigative equipment storage areas to only those personnel responsible for maintaining the equipment. This includes limiting access to the CI function HQ offsite warehouse to only those CI function personnel with a requisite need."

As previously noted, the proper segregation and storage requirements of investigative equipment both in the field and HQ will be closely examined by the IEC work group to ensure all items are properly and consistently safeguarded.

Recommendation 15

"Establish procedures to ensure investigative equipment assigned to the CI function HQ offsite warehouse is effectively stored. This should include the use of a layout or schema to document where equipment is located at the site. The location should then be noted in the CIMIS database."

The IEC work group will scrutinize the operations of the warehouse and make necessary recommendations to ensure CI implements a sound and secure inventory tracking system for all investigative equipment and supplies stored there.

Other Comments

Criminal Investigation agrees that the draft audit report and CI's response should be available to the public. Below are CI's responses to TIGTA's recommendations.

Recommendation 1

"Issue a memorandum to applicable CI function personnel reemphasizing the importance of independently verifying all equipment during the annual inventory; not relying on oral statements made by the property custodians; physically verifying the serial number of each item; ensuring each item is properly recorded on the CIMIS; properly segregating investigative equipment duties; maintaining supporting documentation for disposed items; and notifying the TIGTA, OI, when badges, pocket commissions, or firearms are lost or stolen."

Corrective Action(s)

Criminal Investigation conducted a SAC/ASAC meeting from August 29 through September 1, 2005. At this meeting, CI's executive management discussed the results of TIGTA's audit and reemphasized the importance of independently verifying all equipment during the annual inventory. A detailed memorandum clarifying the system and the roles and responsibilities of all CI employees will be issued to all CI personnel by the end of October 2005. Additional guidance will also be provided to all CI managers in fiscal year 2006 on these topics.

Implementation Date

Completed _____

Proposed: March 15, 2006

Responsible Official(s)

Director, Equipment and Technology Evaluation

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support will ensure these actions are completed in a timely fashion.

Recommendation 2

"Establish procedures requiring each office to submit the primary reconciliation document used during the inventory process along with the memorandum that is submitted to the Director, ETE Section. These procedures should also require each office to attach a document listing the personnel that conducted the inventory verifications. This information should be utilized by the Director, ETE Section, in ensuring that each item was property inventoried and an independent verification was conducted."

Corrective Action(s)

Criminal Investigation will revise the Property Management Handbook to require reconciliation documents and a list of personnel conducting inventories as attachments to the annual certification memoranda. The IEC work group will recommend any additional policy and procedure changes necessary.

Implementation Date

Completed _________ Proposed June 15, 2006

Responsible Official(s)

Director, Equipment and Technology Evaluation

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support will ensure this action is completed in a timely fashion.

Recommendation 3

"Consider whether the use of bar coding would be an effective method of controlling the CI function's investigative equipment. The CI function can assess the viability of using bar coding nationwide by studying its effectiveness at the one field office in our review and at the offsite warehouse, if it is implemented."

Corrective Action(s)

The use of a bar coding inventory system is currently under review by CI. Criminal Investigation has not reached a determination as to the exact specifications of this system. However, this is one of the areas the IEC work group will address.

Implementation Date

Completed __________ Proposed June 15, 2006

Responsible Official(s)

Director, Equipment and Technology Evaluation

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support will ensure this action is completed in a timely fashion.

Recommendation 4

"Establish procedures to periodically review the permissions of those users with access to the investigative equipment application of the CIMIS to ensure property custodians and those conducting the inventories have read-only access."

Corrective Action(s)

The IEC work group will determine the appropriate level and frequency of reviews of CIMIS roles and permissions.

Implementation Date

Completed __________ Proposed June 15, 2006

Responsible Official(s)

Director, Equipment and Technology Evaluation

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support will ensure this action is completed in a timely fashion.

Recommendation 5

"Establish monitoring procedures to require the review of supporting documentation to ensure all disposals (including lost or stolen items) are properly conducted. Consider incorporating procedures requiring each disposal (identified from CIMIS) be analyzed by an independent person as part of the annual inventory process."

Corrective Action(s)

All reports of survey and supporting documentation will be reviewed beyond the field level for completeness and accuracy. Further disposal review requirements will be considered by the IEC work group.

Implementation Date

Completed __________ Proposed June 15, 2006

Responsible Official(s)

Director, Equipment and Technology Evaluation

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support will ensure this action is completed in a timely fashion.

Recommendation 6

"Ensure that all pocket commissions are properly controlled on the CIMIS, with the following exception. The blocks of 2,050 pocket commission inserts currently stored at the CI function HQ office should be promptly destroyed when the new pocket commission inserts are issued. Prior to their destruction, an inventory should be taken to ensure each commission is properly accounted for and documented."

Corrective Action(s)

Criminal Investigation is issuing new enforcement commissions. Prior revisions will be documented and destroyed.

Implementation Date

Completed __________ Proposed December 15, 2005

Responsible Official(s)

Director, Equipment and Technology Evaluation

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support will ensure this action is completed in a timely fashion.

Recommendation 7

"Ensure that all missing pocket commissions are referred to the TIGTA, OI."

Corrective Action(s)

Criminal Investigation will report to TIGTA all pocket commissions suspected of loss and/or theft.

Implementation Date

Completed __________ Proposed October 15, 2005

Responsible Official(s)

Director, Equipment and Technology Evaluation

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support will ensure this action is completed in a timely fashion.

Recommendation 8

"Determine if the current supply of belt and enforcement badges is sufficient to provide each special agent with a unique belt and enforcement badge identification number."

Corrective Action(s)

Criminal Investigation will issue uniquely serial numbered enforcement/belt badges as necessary by the end of 2005 to ensure no duplicate numbers exist among the 1811 ranks. New belt badges will be acquired and issued containing identification numbers that correspond with each 1811's enforcement badge, by the end of 2006. The ETE section will collect and properly dispose of excess badges.

Implementation Date

Completed __________ Proposed December 15, 2006

Responsible Official(s)

Director, Equipment and Technology Evaluation

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support will ensure this action is completed in a timely fashion.

Recommendation 9

"Establish procedures to ensure all investigative equipment purchased is properly controlled on the CIMIS. For example, the ETE section should be notified by the CI function's finance section at the time investigative equipment is procured."

Corrective Action(s)

Current procedures require Finance to notify ETE at the time investigative equipment is procured. The IEC work group will evaluate the current procedures and determine/recommend necessary enhancements.

Implementation Date

Completed __________ Proposed June 15, 2006

Responsible Official(s)

Director, Equipment and Technology Evaluation

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support will ensure this action is completed in a timely fashion.

Recommendation 10

"Resolve all instances where the serial numbers were changed based on information provided by the TIGTA during our review."

Corrective Action(s)

Resolution of the serial number changes identified in the TIGTA report will be accomplished by the end of 2005 as previously noted. Additionally, the IEC work group will review the issue of serial number changes and recommend appropriate policy and procedural changes.

Implementation Date

Completed __________ Proposed June 15, 2006

Responsible Official(s)

Director, Equipment and Technology Evaluation

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support will ensure this action is completed in a timely fashion.

Recommendation 11

"Establish procedures to ensure changes to serial number information in the CIMIS are appropriate. The ability to change a serial number should be limited to personnel at the CL function HQ office or each DFO. A request documenting the reason for changing a serial number should be sent to those personnel."

Corrective Action(s)

Criminal Investigation will update the necessary policies and procedures once determined by the IEC work group.

Implementation Date

Completed _________ Proposed December 15, 2006

Responsible Official(s)

Director, Equipment and Technology Evaluation; Director, Research; and Director, Business Systems Development

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support; Director, Strategy; and Director, Technology Operations and Investigative Services will ensure this action is completed in a timely fashion.

Recommendation 12

"Establish procedures to identify duplicate records in the CIMIS. A report listing all items with duplicate serial numbers should be generated periodically and provided to the director, ETE section, for review."

Corrective Action(s)

A report will be created to identify equipment records containing exactly matching serial numbers. The IEC work group will make recommendations concerning the level at which this report should be reviewed and the frequency.

Implementation Date

Completed _________ Proposed June 15, 2006

Responsible Official(s)

Director, Equipment and Technology Evaluation; Director, Research; and Director, Business Systems Development

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support; Director, Strategy; and Director, Technology Operations and Investigative Services will ensure this action is completed in a timely fashion.

Recommendation 13

"Establish procedures to ensure functional security reviews of investigative equipment and firearms storage areas are conducted on an annual basis."

Corrective Action(s)

Criminal Investigation will take the necessary steps to ensure functional security reviews of investigative equipment and firearms storage areas are conducted on an annual basis throughout CI. The IEC work group will look at this area and make the necessary recommendations for improvement. Additionally, RPE will continue to check functional security review certifications for completeness, accuracy, and timeliness during their periodic reviews, paying particular attention to the components of the certifications addressed in the TIGTA draft report.

Implementation Date

Completed _________ Proposed June 15, 2006

Responsible Official(s)

Director, Equipment and Technology Evaluation

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support will ensure this action is completed in a timely fashion.

Recommendation 14

"Restrict access to investigative equipment storage areas to only those personnel responsible for maintaining the equipment. This includes limiting access to the CI function HQ offsite warehouse to only those CI function personnel with a requisite need."

Corrective Action(s)

Renewed emphasis will be placed on restricting access to investigative equipment to necessary personnel only. The Director, ETE will monitor warehouse card key access assignments to ensure only necessary personnel have access. The IEC work group will make recommendations for further procedural improvements as needed.

Implementation Date

Completed _________ Proposed June 15, 2006

Responsible Official(s)

Director, Equipment and Technology Evaluation

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support will ensure this action is completed in a timely fashion.

Recommendation 15

"Establish procedures to ensure investigative equipment assigned to the CI function HQ offsite warehouse is effectively stored. This should include the use of a layout or schema to document where equipment is located at the site. The location should then be noted in the CIMIS database."

Corrective Action(s)

The IEC work group will scrutinize the operations of the warehouse and make necessary recommendations to ensure CI implements a sound and secure inventory tracking system for all investigative equipment and supplies stored there.

Implementation Date

Completed _________ Proposed June 15, 2006

Responsible Official(s)

Director, Equipment and Technology Evaluation

Corrective Action(s) Monitoring Plan

The Director, Operations Policy and Support will ensure this action is completed in a timely fashion.

If you have any questions, please call me at (202) 622-3200, or a member of your staff may contact Steven Pregozen, Director, Planning and Strategy section CI:S:PS at (202) 622-3679.