The objective of information technology management is to provide and support information technology systems in a manner that minimizes the overall total cost of ownership, which includes all costs associated with procuring, deploying, operating, and disposing of information technology systems. Given how much the City has expended in its procurement and deployment of information technology systems, an important measure of the City's overall success in its procurement and deployment is how well it manages its information technology systems.

Lack of Citywide Policies and Procedures

There are no policies, procedures, or standards for safeguarding and accounting for computer equipment, or for replacing computer equipment. Although the Committee on Information Technology and the Department of Telecommunications and Information Services were established to provide information technology leadership, they have not provided leadership citywide or to City departments for better management of their information technology systems.

Inventory Management

The Budget Analyst obtained computer equipment inventory reports from 13 City departments in order to determine the existence and adequacy of such reports. The report formats varied significantly in the information that they provided, ranging from (a) those reports which only provided basic information, such as the equipment vendor, serial number, and model, to (b) those reports which provided additional information such as the name of the staff person assigned to each computer, the operating system version, and the date of equipment deployment.

Should the City attempt to realize some form of centralized information technology systems management, it should establish minimum criteria for the contents of departments' inventory reports, which would enable a central agency to access inventory information on a citywide basis for better management of citywide information technology systems. Specifying minimum criteria for the content of computer inventory reports would not prohibit departments from using additional data fields particular to their own specialized management needs.

The Budget Analyst selected nine departments for a sample of desktop and laptop computers in order to determine the accuracy of the equipment inventory reports. The inventory report provided by the Office of the Assessor-Recorder included a data field for equipment serial number, which is a necessary component of an information technology systems inventory. However, the majority of the individual records in the Assessor-Recorder's inventory did not actually include a serial number. The Budget Analyst was thus unable to audit a sample of the equipment reported by the Office of the Assessor-Recorder.

The Budget Analyst's review of the information technology systems inventories of the remaining eight departments is summarized in the following table.

Computer Equipment Audit Results

As shown in the table above, of the total sample of 269 computers, out of a population of 2,810 total computers, the Budget Analyst was able to verify the existence of all but eight computers, four each in the Recreation and Park Department and San Francisco General Hospital. Although there was variation in the control environments of the six remaining departments, in general those control environments functioned appropriately, with little search time necessary to identify the selected computers.

San Francisco General Hospital and the Recreation and Park Department operate in the most challenging control environments of the selected departments. At San Francisco General Hospital, many of the computers, even desktop computers, are mobile, and medical staff move them around freely. Computers allocated to the Recreation and Park Department are dispersed to approximately 59 sites throughout the City, and the information technology staff allocated to the department consist of six information technology positions, including one manager.

This review indicates that, while certain City departments are accounting for their computer assets effectively, others, as exemplified in the Office of the Assessor-Recorder, the Recreation and Park Department, and San Francisco General Hospital, need to improve their accountability of computer assets. To ensure against future inventory errors, the Budget Analyst recommends that the City develop (a) citywide policies on maintaining computer inventories and (b) a quality control process to ensure adequate compliance with such policies.

Use of Asset Management Tools

City departments with large information technology systems, such as the Public Utilities Commission and the Municipal Transportation Agency, use formal asset management tools for management and maintenance of their information technology systems. Asset management tools can automate and track equipment and software inventories. These tools have the capability to collect hardware (e.g., Pentium IV processor) and software (e.g., Windows 2000 Operating System) information and can greatly enhance a department's ability to manage: (a) the life cycle of its computer assets, from deployment to disposal; (b) software license compliance; (c) software patches; and, (d) software distribution and upgrades.

The Public Utilities Commission, whose information technology systems includes an International Business Machine (IBM) mainframe, 120 servers, 1,725 desktop computers, and 394 laptop computers, uses an asset management tool named Track-IT Enterprise. Track-IT is an automated asset management tool which electronically maintains a hardware and software inventory of all of the Public Utilities Commission's systems. Track-IT automatically conducts an audit of any hardware or software when it is first connected to the Public Utilities Commission's network and a network user logs on. Thereafter, Track-IT repeats this audit every 90 days in order to maintain up-to-date inventory information in the Track-IT database.

With an effective asset management program, departments can better forecast budget expenditures throughout the life cycles of all of their information technology systems.

Computer Replacement Policies and Practices

The ages of existing information technology systems vary significantly by department. Typically, enterprise departments - with a consistent revenue stream - are able to use more recent technology and replace their information technology systems on a regular basis. This contrasts with General Fund-supported departments, which generally have much longer replacement cycles than enterprise departments. For example, the Fire Department has a 400 megahertz, Windows 95 desktop in its administrative office that takes several minutes just to load the computer's basic operating system. By contrast, every desktop computer within the Department of Building Inspection is approximately one year old.

Because older equipment is only able to operate using older operating systems and older versions of applications, those departments with older computers generally support a greater number of operating system types and application types. For example, the Fire Department supports Microsoft Office versions 97, 2000, and 2003, and, therefore, Fire Department information technology staff must be able to support Microsoft Windows versions 95, 98, 2000, and XP.

Given this finding, the Budget Analyst recommends that the Committee on Information Technology, with the assistance of the Department of Telecommunications and Information Services, develop and implement a citywide information technology replacement plan.

Laptop Usage Policies

Many City departments utilize both desktop and laptop computers. This is significant because, unlike desktop computers, which are large and generally include several large components, laptop computers are light and portable and, therefore, more susceptible to theft or loss than are desktop computers. To guard against potential theft or loss, the Municipal Transportation Agency has a policy on the issuance of laptop computers to department personnel which is to provide laptop computers to staff only (a) on loan under special circumstances and (b) if the proper authorization has been provided through an authorization form signed by a supervisor.

In order to better monitor the issuance of laptop computers and guard against their potential theft or loss, the Budget Analyst recommends that the City implement a citywide policy similar to the Municipal Transportation Agency's policy, requiring strict controls around issuance of laptop computers to department personnel including clear lines of authority for management of such an issuance process.

Conclusion

Currently, citywide policies, procedures, and standards for accurate information technology systems inventory management are non-existent. What policies, procedures, and standards do exist have been implemented by individual departments and are inconsistent in the information they track and the means by which they are updated. Several City departments have not invested the resources or the controls which would ensure an appropriate level of computer asset accountability.

Recommendations

The Chair of the Committee on Information Technology should:

6.1 Develop citywide information technology inventory management policies, procedures and standards.

6.2 Develop a citywide plan for replacing and upgrading General Fund department information technology.

6.3 Develop a citywide policy and controls for issuing and monitoring laptop computers.

6.4 Request all City department directors to maintain information technology inventories consistent with the Committee on Information Technology's standards.

Costs and Benefits

Implementation of these recommendations would reduce the risk of loss and associated costs due to theft, waste, or abuse.

1 On a daily basis, the Department of Elections uses two laptop computers and up to 40 desktop computers.

2 The numbers of desktop and laptop computers shown are for San Francisco General Hospital only, and do not include computer equipment on site but owned by the University of California, San Francisco. In addition to the SFGH assets, the Department of Public Health has 2,308 desktops and 247 laptops assigned to Community Health; 210 desktops and 6 laptops assigned to Jail Health Service; and 375 desktops and 15 laptops assigned to Laguna Honda Hospital.

3 A thin client is a network computer without a hard disk drive, which, in client/server applications, is designed to be especially small so that the bulk of the data processing occurs on the server.