2015-02 Performance Audit Report: County of Hawai'i Information Technology Asset Management

Home

In Brief Background Information Technology (IT) asset management is the management of IT assets, including all elements of software and hardware, from the identification of requirements to the disposal of the assets. The IT asset management process typically involves gathering a detailed inventory of an organization's hardware and software and then using that information to make informed decisions about IT - related purchases and redistribution. By avoiding unnecessary asset purchases and making the best use of current resources, IT asset managers can eliminate waste and improve efficiency. The Department of Information Technology (DIT) is primarily responsible for managing and operating the County's central computer system and telecommunications network. DIT also advises County agencies on computer-related matters, coordinates the purchase and use of computer equipment and software, and provides computer training and support for County employees. DIT is not responsible for managing or supporting the Department of Water Supply, Police Department, Office of Housing and Community Development, Office of the Prosecuting Attorney and the Office of Aging since these departments have their own internal information technology function. Why we did this audit This performance audit was undertaken to evaluate the County of HawaiTs management of IT assets. Specifically, this audit assessed if hardware lifecycle management policies and procedures followed industry best practices. We also evaluated whether the software licensing management system is adequate to ensure compliance with current applicable licensing agreement terms and conditions and follows industry best practices. On April 1, 2014, the Council approved Resolution No. 308-14 to authorize the payment of funds to replace County owned personal computers and laptops using an operating system that will no longer be supported by the manufacturer. We initiated this audit to determine if DIT is following IT asset management industry best practices. The DIT follows several IT asset management industry best practices as prescribed by the International Association of Information Technology Asset Managers. Two of the key elements of IT asset management are the centralization of the IT function and the use of an IT asset management role. However, at the County, the upgrade and replacement of computers is typically determined at the department level, not centrally at DIT. In addition, DIT has not established an IT asset management role. Without these two elements, the County is at an increased risk of security concerns, system instability, helpdesk and County employee inefficiencies, as well as increased hardware and software costs. Management complete response to this audit can be found on page 13: Management's Response. The recommendations identify improvements for management to follow industry best practices. Our audit report offers recommendations designed to address these issues. 1. The DIT should own all IT assets. Furthermore, an IT asset management role should be established to manage the County's IT assets including: • Developing a financial forecast of hardware and software upgrades and replacements; • Maintaining an approved software list for standardization; • Identifying re -deployable IT assets; • Continuing to evaluate leasing as an option; • Maintaining a listing of IT assets and the assigned users in a centralized database; • Centrally receiving and accepting all IT assets; • Reconciling IT assets in the IT asset management inventory; and • Ensuring the disposal of IT assets occurs in a secured manner. 2. The County should address gaps in formal written policies and procedures over IT practices.