Application of Standards into Policy

Application of Standards into Policy Bill Franklin - Moderator November 15, 2011

Purpose • How do you use the standards • ASTM E53 Committee over 11 years issuing standards • 26 Active Standards

Panelists • Rob King – • Department of Homeland Security, OCAO, Asset & Logistics Management • Rich Shultz – • John Hopkins University Applied Physics Laboratory • Cathy Seltzer – • TASC, Inc. • Brandon Kriner – • Harris Corporation

Rob King E2608-08 Standard Practice for Equipment Control Matrix

Department of Homeland Security Policy • In FY 09 DHS Management adopted a 0% acceptable loss rate for Sensitive Assets • This was in direct response to audit findings • Audit recommendations were to ensure sufficient controls were instituted to: • account for and control Sensitive assets throughout their life, and • identify and timely report occurrences of loss, damage and destruction (LDD)

DHS: Sensitive Assets • Sensitive assets are defined as all assets, regardless of value, which require special control and accounting to ensure accountability and safeguarding. They include, but are not limited to: • Dangerous and hazardous assets, • Law Enforcement equipment as identified by the DHS Components, • Assets authorized for storing and/or processing classified information • Assets with retainable memory, • Inherently portable assets and assets that can easily be converted to private use or have high potential for theft

DHS: Sensitive Assets • 0% acceptable loss rate was a point of debate between Management and DHS Components • Needed approach for balancing both Management’s objectives and Component’s Concerns • Other audit findings that needed to be addressed included DHS Management providing: • Standard classification and identification of assets • Consistent, comprehensive direction on appropriate accountability controls

E2608-08 Standard Practice for Equipment Control Matrix • This practice describes equipment control classes (ECCs), equipment control levels (ECLs), and their relationships. • The ECCs provide standard classes for equipment based on control and tracking requirements for the equipment. • Establishes a standard equipment control methodology to aid in requirements determination and communication with the end goal of the promulgation of safe, secure, cost effective, and risk appropriate control and tracking methodologies.

E2608-08Equipment Control Matrix

DHS: Equipment Control Matrix for Sensitive & Accountable Assets

DHS: Equipment Control MatrixSensitive Assets

DHS: Equipment Control MatrixAccountable Assets

Value of Equipment Control Matrix • DHS Management has approved industry recognized acceptable loss rates for ECCs 2, 3 and 4, but has maintained a 0% acceptable loss rate for ECC 1 • Additional controls tailored and applied to the vulnerabilities associated with classes of assets • Providing departmental guidance around standard classifications and controls for asset types

Next Steps with Instituting Equipment Control Matrix • Instituting within each DHS Component to adopt their classification system to the ECCs and incorporate into monthly LDD reporting • Adopting within policy and instruction • Providing a platform for demonstrating sufficient DHS guidance and controls to close outstanding audits • Measuring performance through Management-level quarterly Scorecards

Rich Shultz E2132-01 (2007) Standard Practice for Physical Inventory of Durable, Moveable Property

Implementing a Standard • Read the standard • Scope • Significance and Use • Inventory Verification Planning • Reconciliation • Results • Reporting • Does the standard apply to your organization?

Implementing a Standard (con’t) • Review your current process/procedures • Possibly flow chart • Identify requirements • From the standard • Identify any anomalies • Address them! • Identify stakeholders • Inform them of changes

Implementing a Standard (con’t) • Update Procedures • Reference Standard • Address specific requirements • Type of property • Assign responsibilities • Identify data elements to be captured JHU/APL’s inventory verification process is in accordance with ASTM Standard E2132, Standard Practice For Physical Inventory of Durable, Movable Property.

Questions to ponder….. • Does the standard apply to your organization? • What do your current procedures say concerning the subject? • Are there any anomalies between your procedures and the standard? • Do your procedures need tweaking? • How often does the process need to be reviewed?

Cathy Seltzer E2604-09 Standard Practice for Data Characteristics of Equipment Records

What is the Standard? • What does the Standard say? • Essential Data Elements • Optional Data Elements • Equipment vs. Material records Optional Essential

Essential & Optional Data Elements Essential Optional Identification Model Part Description Receipt Date Manufacturer Source Document Acquisition Cost Location User Cost Objective Disposal Date Disposal Method Disposal Document Date of Service Physical Inventory Date Status Owner Accountable Entity Parent/Child Useful Life Risk of Loss Financial Data Current Value Unit of Measure Maintenance Quantity Manufacture Date Serial Number Additional Identification

Implementing the Standard • When • New Asset Management system • Why • FAR requirements • Customer requirements • How • ERP roll-out

Brandon Kriner E2131-09 Standard Practice for Assessing Loss, Damage or Destruction of Property

“Low Hanging Fruit” • As a Government contractor we are required to report loss, damage, destruction or theft per FAR 52.245-1(f)(vi) • We are also required to perform self-assessments of our property management systems • E2131-09 is harmonious with and expands upon these contract requirements, making it relatively easy to implement • Contract requirements override certain portions of the standard

Significance and Use • LDD is an indicator of the effectiveness of operations. • “Excessive” LDD can indicate poor internal management and controls, policy and procedural weaknesses, or lack of compliance. • The FAR does not quantify “excessive” LDD- this standard does in the context of E2608 (Equipment Control Matrix) • FAR allows the revocation of the Government’s assumption of risk of loss if the contractor’s property management practices are inadequate or present undue risk to the Government

Procedure • “Entity policies and procedures will be developed with special attention to Practice E2608 (ECM) • Entity policies and procedures will establish specific guidelines for • evaluating and measuring LDD • conducting investigations • implementing corrective action and reporting

Acceptable LDD Ratios/Reporting • ECC 1: 0% (dollar value or quantity) • ECC 2: 0.5% • ECC 3: 1% • ECC 4: Entities must establish in accordance with applicable law, regulation or contractual guidance, otherwise 3% • Entities may establish more stringent criteria • Reporting requirements mirror FAR requirements

Philosophical Question • Is implementation of E2608 required in order to use E2131? • “Entity policies and procedures will be developed with special attention to Practice E2608 (ECM) • In a contract property setting, “acceptable” loss is at the discretion of the Contracting Officer • E2608 prescribes varying levels of control/tracking- FAR/contract language tends to require tracking all property at the same level • Has E2608 been “tested” in a contract property environment?

Questions for Panelist

Contact Information Bill Franklin wfranklin@noblis.org 703-610-1869

Application of Standards into Policy