Massachusetts Bay Community College Did Not Properly Administer Its Inventory of Information Technology Equipment.

MBCC did not record the original purchase dates and costs for any of the 2,844 assets on its inventory list, and 534 of the assets were missing other key identifying information, such as the asset tag number, location, description and serial number.

Overview

Massachusetts Bay Community College’s (MBCC’s) information technology (IT) inventory list was inaccurate and did not contain all the required information. In addition, some items did not have asset tags affixed to them, some items had not been added to the inventory list, and MBCC could not substantiate that it conducted an annual physical inventory.

As a result of these issues, MBCC cannot be certain that all its IT equipment is accurately accounted for and adequately safeguarded against misuse or that it can effectively detect lost, missing, or stolen items.

MBCC Did Not Maintain Accurate Required Information on Its IT Inventory List, and Some Items Were Un

MBCC did not maintain the required information on its IT inventory list. Specifically, MBCC did not record the original purchase dates and costs for any of the 2,844 assets on the list, and 534 of the assets were missing other key identifying information, such as the asset tag number, location, description, and serial number.

In addition to lacking information, the college’s IT inventory list was inaccurate:

• Two hundred forty-six items had the same asset tag number as another asset on the list.
• Ninety-one items had the same serial number as another asset on the list.
• Three items were duplicated on the list.

Furthermore, in the sample of 60 IT equipment items we selected for testing, we noted the following:

• Four items were in different locations from those on the IT inventory list.
• Two items did not have inventory tags attached to them.
• Four items had the wrong inventory tag numbers recorded on the list.

Finally, we identified 79 inventory items, valued at $53,178, that were purchased during the audit period but not added to the IT inventory list.

Authoritative Guidance

Institutions of higher education in Massachusetts are required to follow fixed asset guidance issued by the Office of the Comptroller of the Commonwealth (CTR). CTR’s “Fixed Assets—Acquisition Policy” requires that departments record “the date of purchase, amount, description, location and disposition” for each non–generally accepted accounting principles fixed asset³ in their inventories.

MBCC’s “Inventory—Tracking and Disposal Policy” states,

a.   All applicable items will be assigned an asset tag number and entered into the College’s Inventory Tracking System.

b.   The information stored in the College’s Inventory Tracking System will include the description of the item, any relevant information, location of the equipment and purchase price or estimated price if purchase price is indeterminable.

Although the policy does not specifically require MBCC to record asset tag and serial numbers for each item on its inventory list, we determined that MBCC had established a practice of doing so. We believe it is important that these key pieces of identifiable information be recorded for all inventory items.

Reasons for Issues

Although MBCC’s “Inventory—Tracking and Disposal Policy” requires maintaining purchase price information, the college’s IT officials told us that they were unaware that original purchase dates and costs were required to be maintained. They added that human error probably contributed to items missing other key identifying information, such as the asset tag number, location, description, and serial number.

MBCC does not have adequate policies and procedures for the inventory of its IT equipment: its “Inventory—Tracking and Disposal Policy” does not include detailed procedures for all phases of the inventory process or any guidance for asset relocation. In addition, MBCC has not established monitoring controls to ensure that its inventory policies and procedures are consistently followed. Moreover, the college’s process for identifying items that should be added to the IT inventory list and assigned asset tag numbers is not integrated with the college’s purchasing software. For example, instead of identifying new inventory items at the point of purchase, MBCC relies on running queries after the fact to identify these items and then manually affixes tag numbers and updates the list. This process is cumbersome and allows for too high a degree of inaccuracy. Although PeopleSoft, MBCC’s electronic accounting system, has an Asset Management module designed to maintain fixed assets, MBCC has chosen not to implement this module.

MBCC Could Not Substantiate That It Conducted Annual Inventories of Its IT Equipment.

MBCC could not provide us with sufficient documentation to substantiate that it had conducted a complete annual inventory of all its IT equipment during our audit period. MBCC officials told us that a physical inventory had been conducted during fiscal year 2019, but could not provide us with any documentation to substantiate this assertion.

Authoritative Guidance

CTR’s “Fixed Assets—Accounting and Management Policy” states,

There shall be an annual inventory taken of fixed assets owned by every Department. This inventory shall include, at a minimum, a verification of the existence and location of fixed assets owned by a Department. . . .

There shall be a reconciliation of the fixed asset inventory against the books and records maintained by the Department. . . . This reconciliation is to be done, at a minimum, on an annual basis.

MBCC’s “Inventory—Tracking and Disposal Policy” also requires an annual physical inventory of all IT equipment regardless of cost, with the exception of inkjet printers.

Reasons for Issue

MBCC’s “Inventory—Tracking and Disposal Policy” does not require keeping evidence of the performance of physical inventories.

Recommendations

1. MBCC should review and edit its current IT inventory list to include purchase dates, costs, assigned tag numbers, locations, descriptions, and serial numbers for all items; should remove duplicate items; and should correct inaccurate data where possible.
2. MBCC should ensure that all IT assets have inventory tags affixed to them.
3. MBCC should enhance its current “Inventory—Tracking and Disposal Policy” to include detailed procedures for all phases of the IT inventory process. The policy should require keeping documentation supporting the annual physical inventory of IT equipment and should include guidance for relocating IT equipment.
4. MBCC should communicate this policy to all employees and establish monitoring controls to ensure that it is consistently followed.
5. MBCC should reevaluate its purchasing and inventory process to identify a best practice for identifying and tracking newly purchased IT equipment at the point of purchase. MBCC should determine whether incorporating its inventory process into the college’s purchasing system by using the PeopleSoft Asset Management module is a viable option.

Auditee’s Response

MassBay was not able to implement the Asset Management module of PeopleSoft due to turnover in key roles. We will reevaluate this option and consider other software packages to identify the best fit for our business process. The College understands the importance of having an integrated solution that identifies items to be added to the inventory list at the point of purchase, assigns asset tag numbers, and populates the required fields—date of purchase, purchase amount, description, and location. We will also employ scanning technology to track assets from point of entry during the receiving process and to facilitate and increase the accuracy of information reported back to the inventory tracking system. Additionally, we will ensure the system will allow for tracking asset relocation and disposition.

Once we identify the software, we will update our “Inventory—Tracking and Disposal Policy” to include detailed procedures for all phases of the inventory process. The policy will include technology and procedures necessary to capture and retain the details of the annual physical inventory, to reconcile discrepancies found during the annual inventory, and the actions to be taken to remedy the discrepancies found including Chapter 647 reporting when applicable. We will update our “Inventory—Tracking and Disposal Policy” to align it with the requirements of CTR’s “Fixed Assets—Acquisition Policy” and to require an annual inventory of only assets with a useful life of more than one year and an original cost greater than $1,000.

In order to implement proper monitoring controls, the College will assign an employee to be responsible for inventory.

In response to the specific deficiencies identified during this audit, MassBay has taken the following steps:

• MassBay is updating the inventory list to include the Commonwealth’s Fixed Assets Acquisition Policy—date of purchase, amount, description, location, and disposition status, and correcting duplicate and inaccurate records. In addition, all applicable items will be assigned a tag number. The reason some items are not tagged is because they were either shipped directly to employees during the pandemic or deployed in the initial push to transition to remote [work] per order of Governor Baker. . . .
• MassBay has identified the assets that meet CTR’s “Fixed Assets—Acquisition Policy” threshold. We will affix inventory tags when it is feasible to do so, after the College reopens post-pandemic.

The auditee also stated,   

While we appreciate the suggestion to include serial numbers, we intend to adopt CTR’s “Fixed Assets—Acquisition Policy” and will include the information fields required by that policy on our inventory list moving forward.

Auditor’s Reply

Based on its response, MBCC is taking measures that respond to our concerns and will allow it to account for its assets more effectively. However, in its response, MBCC indicates that it is updating its inventory list to include only the fields required by CTR’s “Fixed Assets—Acquisition Policy”: date of purchase, amount, description, location, and disposal status. As noted above, we believe it is important that MBCC also record other key pieces of identifiable information, such as asset tag and serial number, for all inventory items. We urge MBCC to fully implement our recommendations.

3.     This policy defines these assets as “vehicles, equipment, furniture, computer software, and all electrical and computer components with (1) a useful life of more than one year and (2) with an original cost between $1,000 and $49,999.”

Date published:	May 11, 2021