HomeMy WebLinkAboutEvidence Room (Physical observation and new software controls)Sheriff’s Office - Evidence room report #11/12-10 October 2012
Sheriff’s Office –
Evidence room
(Physical observation and new software controls)
To request this information in an alternate format, please call (541) 330-4674 or send email to David.Givans@Deschutes.org
Deschutes County,
Oregon
David Givans, CPA, CIA
Deschutes County Internal Auditor
PO Box 6005
1300 NW Wall St, Suite 200
Bend, OR 97708-6005
(541) 330-4674
David.Givans@Deschutes.org
Audit committee:
Gayle McConnell, Chair - Public member
Chris Earnest - Public member
Jean Pedelty - Public member
Greg Quesnel - Public member
Michael Shadrach - Public member
Jennifer Welander - Public member
Anthony DeBone, County Commissioner
Dan Despotopulos, Fair & Expo Director
Scot Langton, County Assessor
Sheriff’s Office - Evidence room report #11/12-10 October 2012
{This page left blank}
Sheriff’s Office - Evidence room report #11/12-10 October 2012
TABLE OF
CONTENTS:
HIGHLIGHTS
1. INTRODUCTION
1.1. Background on Audit …………..………………………………………...…… 1
1.2. Objectives and Scope ………………….……………………………..……… 1
1.3. Methodology …………………………………….…………………...…...… 1-2
2. BACKGROUND …………………………………………………………………… 2
3. FINDINGS
Evidence inventory observation ……….………………..………………….... 2-7
Evidence software implementation ……………………..……………………... 8
Budgetary issue ..………………….……………………..………..……….... 9-10
4. MANAGEMENT RESPONSE – Deschutes County Sheriff’s Office ….... 11-14
Sheriff’s Office - Evidence room report #11/12-10 October 2012
HIGHLIGHTS
Why this audit was
performed:
The Sheriff’s Office is
undergoing a replacement
of their evidence software
and wanted a review of
controls. It also made good
sense to perform an
inventory of their current
evidence.
What is recommended
Significant
recommendations included:
Developing additional
procedures to improve
control over items to be
destroyed, items not
under direct custody,
and location
information.
Improving guidelines for
evidence
documentation
Resolving that
electronic system
reports are functioning
Developing additional
procedures to assure
the proper planning and
budgeting of capital
expenditures.
Sheriff’s Office – Evidence room
What was found
The evidence inventory inspection indicated overall good tracking and only minor issues.
Areas where there were suggestions for improvement included:
Evidence was observed that was not supposed to be there. There were some 16 evidence items
(.08%) located that were supposed to have been gone.
8% of the inventory was not under the direct custodianship of the evidence room’s staff and the
location information was not being updated. These included:
o items “not received” by evidence room staff (7%); These represent evidence items where
evidence staff could not confirm receiving an item.
o items located as hazardous materials (1%);
o items located at the shops (de minimus). These include large items, heavy items, vehicles,
or other designated items.
Evidence information collected could be improved. It was noted that descriptions and identifiers
could be improved, including:
o weight or measure descriptions for controlled substances,
o using a location identified for hazardous materials however only a small portion of that
evidence may be hazardous (~3%), and
o case tracking for digital evidence held in a media library is not always in agreement with
records of evidence maintained in the evidence tracking systems.
A review of software controls identified some areas to work on. The most significant one was that reports
for the system were not getting updated, including some security role reports, evidenced by old
information in the reports.
The evidence room software was part of a larger law enforcement records management software
purchase ($1.2 million) through the 911 County Service District tax levy. The non-recurring capital
expenditure was not included in the initial budgets for FY 2011 or in FY 2012. This purchase was
anticipated in the tax levy passed for the 911 CSD. There were no details in the various published budget
documents of the nature of these anticipated capital improvements over the two years. Subsequent
resolutions were required to provide sufficient appropriations in the revised budgets for FY 2011 and
again in FY 2012.
Deschutes County Internal Audit
Sheriff’s Office - Evidence room report #11/12-10 October 2012
Page 1 of 14
1.
Introduction
1.1 BACKGROUND ON AUDIT
Audit Authority:
The Deschutes County Audit Committee authorized the review of the Sheriff Office’s evidence room software
implementation in the Internal Audit Program Work Plan for FY 11/13. The Sheriff’s Office is in the process
of transitioning to a new evidence room software in early 2012. Certain identified procedures including an
evidence inventory observation will be performed.
1.2 OBJECTIVES and SCOPE
Objectives:
Assess new software implementation for the evidence room.
a) Assist department in inventory of evidence on transition.
b) Review of selected general and application controls for new software.
c) Review completeness of conversion of evidence records. {On hold – conversion of evidence to
new software has not taken place as planned and this objective and any associated procedures
are deferred until the conversion takes place. A future addendum to this report will address that
additional work.}
Scope:
The focus of the review was on selected aspects of the transition to the new evidence room software. The
inventory observations were performed in June 2012 for selected areas. The scope of the audit did not
include all aspects of internal controls employed. Highly sensitive items such as cash, firearms and
controlled substances were given additional attention.
1.3 METHODOLOGY
Audit procedures included:
Observing and interviewing staff on their inventory taking procedures,
Observe and interview staff on the new evidence room systems and selected aspects of general and
application level controls. These include areas such as
o Security controls o Data controls
o Processing controls o Output controls
o Audit trails
Reviewing written procedures and documents provided, and
Reviewing and analyzing inventory detail reports.
DESCHUTES COUNTY
INTERNAL AUDIT
REPORT
DESCHUTES COUNTY
INTERNAL AUDIT
REPORT
DESCHUTES COUNTY
INTERNAL AUDIT
REPORT
Sheriff’s Office - Evidence room report #11/12-10 October 2012
Page 2 of 14
We conducted this performance audit in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to obtain suf ficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We
believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on
our audit objectives. (2011 Revision of Government Auditing Standards, issued by the Comptroller General of the United States.)
2.
Background
Evidence room staff maintain a property management system that ensures accuracy and completeness of
records. The chain of custody for evidence is strictly maintained from receipt to disposal. This is critical for
the successful conviction of criminals. Audit procedures included developing an understanding of evidence
room procedures, determining whether procedures are being followed, locating evidence, and establishing
that evidence is properly safeguarded. Currently, there are two dedicated staff with sole access to the
evidence room. Immediate supervision comes from the Detective Captain.
A new multi-jurisdictional software system is being developed and implemented. The system will replace the
current evidence room software that was developed by the County. As of the date of this report, the old
software was still being used for previous evidence items. The prior evidence data is planned to be
converted over to the new system any time now. The inventory of evidence included all items for selected
locations. The inventory was performed with the assistance of selected Sheriff’s Office staff. T he Detective
Captain has already internally reported many of the findings included herein and is already developing and
responding to the recommendations.
Employees of the Sheriff’s Office take their duties seriously. The high security involved in the Sheriff’s
facilities (especially evidence) results in a high level of safeguarding of assets. Management and staff
appear diligent in their efforts to develop an environment supporting internal controls. Evidence room staff
were open and professional and had a positive attitude towa rds making improvements in the control system.
3. Findings The audit included a review of selected aspects of the newly implemented evidence software system as well
as an inventory of evidence room items. Audit findings result from incidents of non-compliance with stated
procedures and/or departures from prudent operation. The findings are, by nature, subjective. The audit
disclosed certain policies, procedures and practices that could be improved. The audit was neither designed
nor intended to be a detailed study of every relevant system, procedure or transaction. Accordingly, the
opportunities for improvement presented in the report may not be all-inclusive of areas where improvement
may be needed and does not replace efforts needed to design an effective system of internal control.
Sheriff’s Office - Evidence room report #11/12-10 October 2012
Page 3 of 14
A significant deficiency is defined as an internal control deficiency that could adversely affect the entity’s
ability to initiate, record, process, and report financial data consistent with the assertions of manageme nt in
the financial statements. The findings noted were not considered significant deficiencies.
Evidence inventory observation
Evidence inspection indicated overall good tracking and only minor issues.
The primary inventory observation went through 92% of the evidence inventory in the system and 100% of
the evidence the Sheriff’s Office staff maintains. There were some 23 thousand items of evidence that are
cataloged, tracked and protected. There were six (6) items that could not be located a t the time of the
inventory and for which staff will look to resolve. That error rate of .02%, given the number of items
reviewed, is very low.
We also identified evidence items:
not properly located (.4%);
that were not updated for being released, destroyed or auctioned (.14%); and
that were present but marked as destroyed or auctioned (.08%).
Though a 100% inventory would be desirable and an expectation set by the Sheriff’s Office, the observed
error rate seems low. The observation did not identify any significant nor systemic issues with the systems
or procedures in place.
Evidence was observed that was not supposed to be there.
There were some 16 evidence items (.08%) located that were supposed to have been gone. Nine of these
items were identified as controlled substances were marked as having been destroyed. The destruction
dates spanned from 2008 through 2011. On discovery, these items were put back into the inventory system
and identified for destruction. The prior and current evidence room software encourages staff to utilize a
blank location to indicate evidence that is no longer in custody. However, it appears that in certain
circumstances the location was not updated and left blank or items marked as gone or moved to destruction
that were not.
Sheriff’s Office - Evidence room report #11/12-10 October 2012
Page 4 of 14
The absence of a location is data quality issue. However, the current evidence software system and the new
one prefer to use blanks to limit reporting for evidence that is no longer under custody. In the absence of
tight controls over destruction, items may be diverted from control. Items that have marked as gone no
longer have any oversight and control over their disposition.
Location type fixes constituted the one of the larger errors identified at roughly .4%. Items readied for
destruction are randomly tested by separate staff but not to a significant extent. Evidence marked for
destruction can include firearms and controlled substances. The department has seen a significant increase
in the amount of materials being sent for destruction. They also handle the destruction of found items and
items relinquished by the public.
Systems were designed to utilize the blank location field to indicate they no longer have the item. This will
require greater caution in providing meaningful notes and remarks when items are moved. The new software
system has added audit trails that can track modifications to location.
It is recommended for staff to establish additional procedures to assure "blank" location entries are
not utilized until the movement of those items are confirmed. It is recommended the department
consider utilizing/developing an audit trail report available under the new software system to monitor
location changes of evidence items to assure proper handling.
It is recommended for separate Sheriff’s Office staff perform a more extensive review of items for
destruction (i.e. it could be determined that all controlled substances would be audited).
Evidence information collected could be improved.
It was noted that a number of areas with descriptions and identifiers could be improved. These include:
Location type fixes constituted the one of the larger errors identified at roughly .4%.
Approximately a third of the evidence descriptions for controlled substances lack specificity as to
weight or measure. Evidence staff do not open the evidence but it is not clear what amounts they are
taking into custody.
Staff have been using the location identifier “NR” for evidence not received by evidence room staff
(~7%);
There is a location identified for hazardous materials however only a small portion of that evidence
may be hazardous (~3%). “Hazardous material” is a technical term. A majority of the items are
related to drug seizure evidence and though these materials ha ve issues with odor and safety they
Sheriff’s Office - Evidence room report #11/12-10 October 2012
Page 5 of 14
are not technically considered hazardous materials.
For the items not part of the inspections, there were many items (s ome 19%) that had location notes,
which included the terms “auctioned”, “released”, or “destroyed” and were still associated with a
location.
Case tracking for digital evidence held in a media library is not always in agreement with records of
evidence maintained in the evidence tracking systems. Seven percent of the cases could not be
matched up and require further research and resolution.
Evidence rooms need to be able to control the evidence placed under their care, this requires empirical
descriptions of items, accurate locations and sufficient information to understand whether there should be
special handling. Professional standards from the International Association of Property and Evidence, Inc.
(IAPE) indicate controlled substances should be weighed. Best practices identified around digital evidence
indicate that sufficient operating procedures should be developed for their admissibility.
In the absence of the sufficient descriptions, which include appropriate weight or quantity measures, it would
be unclear how much was collected as evidence and placed under custody of the evidence room. In the
absence of proper locations, evidence could be lost. In the absence of special handling instructions, the
evidence could be compromised or the safety of personnel jeopardized.
The department’s policy does not expressly require measures, but a number of evidence item descriptions
included sufficient information on weights. In many of these cases, staff needs to take the time to make sure
they are being thorough. It appears the current practice should be to remove the location identifier when the
evidence is no longer in custody or being tracked. This streamlines reports that account for items by
locations. Officers are responsible for loading the media evidence on the media storage system and they
may not be consistent or careful in how they place it in the system.
It is recommended the Sheriff’s Office develop procedures to be systematic about how they locate
evidence in the evidence system. It is recommended for the Sheriff’s Office to develop and
implement consistent practices around evidence locations.
It is recommended that staff utilize meaningful descriptions in their system for inventory requir ing
special handling.
It is recommended for the Sheriff’s Office to establish evidence documentation and preparation
procedures that will provide and require meaningful weight, measures and descriptions for
controlled substances.
Sheriff’s Office - Evidence room report #11/12-10 October 2012
Page 6 of 14
It is recommended that evidence that is potentially a hazardous material be specifically identified
and located as such for the safety of personnel. The description for non-hazardous material location
could also be changed.
It is recommended that evidence room staff periodically reconcile the information present in the two
systems for managing electronic media.
It is recommended for the department to consider additional procedures for electronic media
evidence that will help assure more efficient and effective management of the information.
Evidence room staff lack control over certain areas.
The 8% of inventory not observed were items that did not come under the direct custody of evidence room
staff and were identified as
Not received by evidence room staff (7%); These represent evidence items where evidence staff
could not confirm receiving an item.
Located as hazardous materials (1%); Certain substances that could pose a health hazard if retained
in the evidence room. It is not clear that there are steps being currently taken to remove items from
the inventory listing that have been destroyed.
Located at the shops (de minimus). These include large items, heavy items, vehicles, or other
designated items.
Some of these were items included items like: vehicles, recreational vehicles or controlled substance items.
Deschutes County and other regional law enforcement agencies have employees directly assigned to drug
enforcement efforts. Evidence is reported in the evidence system for the law enforcement unit in charge of
the arrest. This creates a number of potential obstacles in managing the evidence. No one law enforcement
agency has the entire list of evidence and the agency housing the evidence does not have a complete listing
of the evidence at tits location.
As previously stated, the evidence system’s information should be complete for those items entered into it
and systems should be developed to assure there are staff responsible for updating and assuring that it
accurate. Evidence room staff cannot control or be accountable for items not under their direct control. This
could jeopardize active law enforcement investigations and trials.
In the absence of specific procedures for handling these items, it is difficult to assure the safeguarding and
Sheriff’s Office - Evidence room report #11/12-10 October 2012
Page 7 of 14
chain of custody of those items and it would be difficult to ascertain if something was missing.
It is not clear that consistent evidence policies have been created over all items. Evidence room staff are not
given authority of these items even though they are asked to assign these items tracking numbers as
evidence. It is not clear that alternative staff were made responsible for updating this information. Old
systems did not provide a way to manage the multi-jurisdictional evidence. The new software system has a
more accessible structure for handling these items.
It is recommended for evidence room staff to resolve all discrepancies identified during inventory
prior to the conversion to the new system.
It is recommended that management consider how evidence currently located as “hazardous
materials”, “shop” and “not received” should be handled for controlling the chain of custody and
providing adequate safekeeping for those items.
It is recommended that staff should notify supervisors if evidence information is submitted
without the corresponding evidence. The custodian of that evidence should handle the
associated evidence sheets. Separate evidence room sheets could be utilized or shared by
different custodians.
It is recommended for the Sheriff’s Office in coordination with their peers in drug enforcement
(C.O.D.E.) develop and implement a combined and uniform approach to handling their
evidence.
It is recommended C.O.D.E. assign a limited number of staff to perform the role as evidence
custodians to limit access, provide better accountability and better manage the evidence
system.
In order to consolidate C.O.D.E.’s current evidence items, it is recommended they accumulate
current evidence information from all of the team members, inventory all evidence, compare
and resolve all discrepancies to the inventory. Additional inquiry and resolution should occur
with any evidence not properly accounted for.
Sheriff’s Office - Evidence room report #11/12-10 October 2012
Page 8 of 14
Evidence software implementation
Review of software controls identified some areas to work on.
A number of selected areas were reviewed for the software. A number of items were noted that were not
resolved at the time.
The software administrators (with unchecked user rights) have not established a separate login name
for themselves that would be more appropriate for their daily work.
Reports for the system, including some security role reports, were not being updated with new
information and may not be including the appropriate information. This limits their effectiveness and it
could not be determined what the current settings were over the entire system. This include d the
current user security settings.
Evidence room staff could have the ability to delete evidence entries. With custody over items, the
evidence room staff should not have direct delete rights to the entries. A supervisor or the software
administrator can perform this for those limited circumstances.
There is a comprehensive help system built into the software, however, staff have not had time yet to
document in writing their particular settings and procedures.
The noted areas are potential weaknesses in associated software controls.
There are no specific effects at this point, but the impact could undermine efficiencies or effectiveness of
systems.
The system is still being rolled out and these systems and reports will continue to evolve.
It is recommended for software administrators assure the reports in the system (especially the
security role reports) be fixed so that appropriate settings can be confirmed.
It is recommended for software administrators receive an operational user login for daily usage.
Usage of their administrator rights should be limited to when necessary.
It is recommended for the department to develop a process to provide oversight over the infrequent
need to delete electronic evidence records.
It is recommended the software administrator(s) develop a written manual for how they have setup
the system and plan for its operation.
Sheriff’s Office - Evidence room report #11/12-10 October 2012
Page 9 of 14
Budgetary issue
Budgeting for non-recurring capital expenditure could be improved.
The County's capital budgeting which includes the 911 County Service District (CSD) budget for the
countywide records management system was not included in initial budgets for FY 2011 or in FY 2012. This
software (which includes that used by evidence) was anticipated to cost $1.2 million dollars and was
anticipated in the tax levy passed for the 911 CSD. There were no details in the various published budget
documents of the nature of these capital improvements amounting to $1.2 million over the two years.
Subsequent resolutions were required to provide sufficient appropriations in the revised budgets for FY 2011
and again in FY 2012.
The budget process consists of activities that encompass the development, implementation, and evaluation
of a plan for the provision of services and capital assets. Best practices are laid out by the Government
Finance Officers Association (GFOA) in their "Recommended Budget Practices: A Framework For lmproved
State and Local Government Budgeting". lf the entity has any significant, nonrecurring capital expenditures,
the document should describe these items (i.e. indicate the project's purpose and funding sources) and
indicate the amount appropriated for the project during the budget year(s). In addition, the document should
include the amount appropriated for significant, nonrecurring capital expenditures in the budget year. The
criteria are also used for the GFOA’s distinguished budget presentation awards program that the County
participates in.
GFOA recommends that state and local governments prepare and adopt comprehensive multi -year capital
plans to ensure effective management of capital assets. A prudent multi -year capital plan identifies and
prioritizes expected needs based on a community's strategic plan, establishes project scope and cost,
details estimated amounts of funding from various sources, and projects future operating and maintenance
costs. A capital plan should cover a period of at least three years, preferably five or more. Some of the more
significant aspects include:
describe estimated costs of the project, based on recent and accurate sources of information.
describe the schedule for completion of the project, including specific phases of a project, estimated
funding requirements for the upcoming year(s), and planned timing for acquisition, design, and
construction activities;
describe if and to what extent significant nonrecurring capital expenditures will affect the entity's
current and future operating budget and the services that the entity provides;
describe anticipated operating costs associated with significant nonrecurring capital expenditures
Sheriff’s Office - Evidence room report #11/12-10 October 2012
Page 10 of 14
described and quantified;
identify specific significant financial impacts upon current and future years that are likely to result from
significant nonrecurring capital expenditures (other than the cost of the improvements them selves.)
The entity may make its own determination of what is "significant." Examples could include whether it
o would require an increase in the tax rate,
o would result in a reduction in spending elsewhere in the budget , or
o would require additional staff.
describe and quantify additional anticipated revenues and expenditure reductions;
Identify funding sources for all aspects of the project, specifically referencing any financing
requirements for the upcoming fiscal year.
describe funding authority based either on total estimated project cost, or on estimated project costs
for the upcoming fiscal year. Consideration should be given to carry-forward funding for projects
previously authorized.
In the absence of adequate capital planning for expenditures of this magnitude, there may not be sufficient
funds to complete a project or know whether it was properly carried out. The missing budgetary
appropriations indicate a lack of a system for adequately accumulating and identifying these capital asset
projects and where they are in progress.
The 911 CSD was provided ample resources from the tax levy to fund this software acquisition. During this
time frame, the 911 CSD was transitioning between executive directors and they were not aware of some of
these capital budgeting requirements. However, County management should have had a process to
accumulate and report on the anticipated capital assets being acquired and that were identified in actual
expenditures, budgetary revisions and other planning documents.
It is recommended for the County to implement additional procedures to identify and budget non-
recurring capital expenditures.
It is recommended for capital projects, the County consider improving the County’s process for
capital budgeting to follow the guidance provided by GFOA.
Sheriff’s Office - Evidence room report #11/12-10 October 2012
Page 11 of 14
4.
MANAGEMENT
RESPONSE –
Deschutes
County
Sheriff’s
Office
Sheriff’s Office - Evidence room report #11/12-10 October 2012
Page 12 of 14
MANAGEMENT
RESPONSE –
continued
Sheriff’s Office - Evidence room report #11/12-10 October 2012
Page 13 of 14
MANAGEMENT
RESPONSE –
continued
Sheriff’s Office - Evidence room report #11/12-10 October 2012
Page 14 of 14
MANAGEMENT
RESPONSE –
continued
{End of Report}