Colorado audit finds state agencies lacked complete phone inventories

Colorado agencies spent about $10.5 million on phones, tablets and mobile hotspots in fiscal 2025, but five departments with the highest costs could not produce complete, reliable inventories of the devices they issued, auditors told the Legislative Audit Committee on Aug. 10. The hearing record shows agencies planning new inventory, approval and device-management controls.

The audit examined Corrections, Human Services, Natural Resources, Public Safety and Transportation. Together, they accounted for 65% of statewide payments to mobile-service vendors. Verizon received about $9 million of the fiscal 2025 payments, auditors said.

Auditors reviewed usage data for 6,688 phones and identified 398 with no recorded use during the periods examined. They estimated those devices cost the state about $173,000 annually, but said the data was insufficient to determine how many were legitimately retained for emergencies, vacant positions or other reasons. The hearing did not establish how much, if any, of that amount could be eliminated or recovered. No agency reported completed savings, cancellations, refunds or recovered money.

No department had complete documentation for every phone in a sample covering about 10% of identifiable devices. Corrections, Natural Resources and Transportation generally had approval and employee-agreement requirements but lacked some records. Human Services and Public Safety generally had not required the specific approvals and signed agreements called for in state controller policy.

The audit issued 11 recommendations. The five departments were directed to maintain complete inventories, establish written usage-monitoring procedures and improve cellphone data. Corrections was also told to formalize its relationship with the Governor’s Office of Information Technology. Corrections, Natural Resources and Transportation were directed to enforce existing approval policies and obtain missing signed employee usage agreements. Human Services and Public Safety were told to adopt policies meeting the minimum requirements of the State Controller’s cellphone policy and obtain missing documentation for current phones.

A separate recommendation directs the Department of Personnel and Administration to enforce vendors’ quarterly sales-reporting requirements and ensure the information is accurate. Auditors said DPA did not receive one of 12 required AT&T reports or eight of 12 required Verizon reports from fiscal 2023 through fiscal 2025, and did not identify errors in the reports it received.

The departments agreed to corrective plans, but the hearing did not verify completion:

• Corrections: Formalize its mobile-device-management relationship with OIT, document devices individually and require reapproval when employees change positions. It did not provide an overall completion date.
• Human Services: Back-capture missing inventory and documentation by December 2026, make a centralized system operational by June 2027 and add electronic signatures for employee agreements by the end of 2026.
• Natural Resources: Assess a department-wide management tool, update usage-monitoring policies and assign responsibility through a standard operating procedure, with an August 2027 implementation target.
• Public Safety: Track phones by department, division and program; reconcile device counts and billing; and create a standalone cellphone agreement. It did not provide a completion date.
• Transportation: Consolidate inventory data, reconcile internal and vendor records twice a year and move approval forms to an electronic workflow. It expected to implement the recommendations by the end of 2026, with the workflow planned for fall 2026.

DPA said it would work with carriers to obtain more useful department-level reports and review procurement, pricing, inventory and usage data. It did not provide a completion date.

Committee members also asked about cybersecurity risks from incomplete inventories, including device access to state Wi-Fi or sensitive systems, multifactor authentication, app restrictions and the handling of retired phones. The record contains no quantified cybersecurity finding, unauthorized-access incident or audit test of residual data on retired devices.

Corrections and Public Safety officials said their controls include multifactor authentication or double authentication, mobile-device management, app restrictions, employee offboarding and wiping retired phones before surplus. Those statements were not independently verified during the hearing, and the record does not specify whether any of the 398 unused devices have been canceled, transferred, returned or sold. Completion evidence for the agency plans, the missing deadlines and DPA’s carrier-reporting improvements remain unresolved.