assignment of laptops - risks

pma111
pma111 used Ask the Experts™
on
we have a spread sheet that stores unallocated IT stock (e.g laptops in stock, yet to be assigned to an end user). When an order is received the spread sheet is updated with the end user who the laptop was given too. Then this information is finally updated in the formal asset management database. My concerns at present are the people who have access to the stock room also have full control over this spread sheet to update records etc. So in theory you could steal a laptop, but maliciously update the spread sheet to pretend it had been assigned to an end user. I am wondering what kind of process/control could be put in place to ensure this risk doesn't exist, its almost like a separation of duties conflict.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Senior Developer
Commented:
Trust in the first place.

But there is one weakness in your process, you have already identified it: There is only one person updating the sheet. Even the later use of a database does not really help.

The solution is to use a second persons signature. Let the receiver of a device sign a receipt. And add an audit of that paper trail to your yearly inventory process.
The simple solution here would be to LIMIT ACCESS to BOTH the stockroom AND the spreadsheet, to either just one or two people!
Also, instead of having people update the spreadsheet, have a paper diary, where the person who is getting the equipment has to physically SIGN for the stuff!  They sign when they get, they sign when they return!
Rob HensonFinance Analyst
Commented:
Make use of existing paperwork. No doubt when the laptops arrive and are put into stock there is a Goods Receipt or Delivery Note.

Set up a file to store these documents. Have a rubber stamp made that includes signature and date boxes for:
1) who & when booked into stock
2) who & when issued to end user
3) end user receiving

If they are pool laptops that are used and returned then you can set up a diary system as suggested earlier, who and when booked out, who and when booked return.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Ste5an is right, there has to be some level of trust.  One thing you could do, if this is a real concern, is to put a camera in the stockroom. Then at least you have a record of who came in and what they touched.
Natty GregIn Theory (IT)
Commented:
You always assign a minimum of two people to the stockroom for I watch you watch me purpose. One person should over see the stockroom and report to the person who update the spread sheet, with the stockroom person bringing the person to receive the laptop, to the spread sheet holder and have the recipient signed that he or she had receive the laptop. The purchase order should be kept by a trusted manager who will check the stockroom and spread sheet for match up of distribution so as to record any machine missing from the original purchase order.
Distinguished Expert 2018
Commented:
This is a multifacted challenge. Access controls and periodic audits (when these are not in place it becomes very easy for time to lapse before things are noticed) are features that would make for improvement in this area in addition to what nattygreg has mentioned. Some of the controls and not others will make it very easy for gaps to exist that can be exploited.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial