2015-02 Performance Audit Report: County of Hawai'i Information Technology Asset Management

Home

County of Hawaii Introduction To better understand the standards and procedures in place related to the management of IT assets, questionnaires were requested and completed by key DIT personnel. The questionnaires covered the following topics: • Hardware Lifecycle • Hardware Inventory • Hardware Security • Software Lifecycle • Software Inventory • Software Security We reviewed and discussed the responses from the questionnaires through interviews with the Director of Information Technology, Information Systems Program Managers, Information Systems Analysts with the Help Desk and Network Divisions, and the Director of Finance. On-site inspections of DIT facilities were performed to observe the physical security controls in place to safeguard IT assets. We performed walkthroughs of the automated network and software inventory system and the automated software deployment tool used by DIT and reviewed output reports. A review of the County's Microsoft Volume Licensing portals was also performed to validate software entitlements. To review DIT's management of the Windows XP upgrade project, we interviewed the Director of IT to understand the project scope, project governance, and the extent of DIT's involvement. We also interviewed the designated project manager to understand how DIT communicated the project to the departments and other stakeholders. The designated project manager also described the physical inventory process and results, details on price negotiation, the method to determine purchase counts, and any issues that were raised throughout the upgrade project. An interview with the helpdesk personnel was conducted to understand the process of how computers are physically received, tracked, configured, deployed, and added to the fixed assets inventory. We obtained the agendas for the meetings DIT conducted with the department liaisons, related e-mail correspondences, inventory schedules that were distributed and collected from the department liaisons, physical inventory results, official Request for Quotes and Response Details Report Bids from vendors, and the signed Notices to Proceed. To gain an understanding of industry best practices related to the management of IT assets, we reviewed the Best Practices Library published by the International Association of Information Technology Asset Managers ("IAITAM"). The volumes we reviewed included Acquisition Management, Asset Identification, Disposal Management, Documentation Management, Financial Management, and Policy Management. 3