Surplus and Disposal of Information Technology Equipment

The Office of the Inspector General audited the adequacy of the Tennessee Valley Authority's (TVA) process to surplus and dispose of information technology (IT) equipment due to the risk of (1) protected information disclosure and (2) environmental compliance and regulatory compliance violations associated with the surplus and disposal of IT equipment. We found weaknesses with TVA's policies, procedures, and process to surplus and dispose of IT equipment, including (1) surplus IT equipment was not properly sanitized, tracked, and processed; (2) badge access control reviews of areas holding surplus IT equipment were not being performed as required by policy; and (3) processes for the surplus and disposal of cathode ray tubes do not address environmental regulations to prevent release of the lead into the environment. TVA management agreed with our findings and recommendations.