Audit finds college’s process for clearing surplus IT equipment has strengths worth highlighting

A check of one state college’s approach to erasing confidential data from surplus computer equipment found strong controls in place, as detailed in a new performance audit released today. 

The Office of the Washington State Auditor conducted two previous audits evaluating how well state agencies and some colleges removed confidential data from IT devices before selling them through the state’s surplus program. However, some public colleges and universities have their own surplus programs. 

Auditors reviewed the data disposal procedures of one such college and found its program took strong steps to ensure all surplus devices were sanitized of any data. The college: 

• Only resells IT equipment that can be sanitized  

• Treats every device as if it contains confidential information 

• Uses professional sanitization systems to sanitize devices  

All surplus IT equipment auditors tested at the college was properly sanitized. However, the audit recommends the college should test a greater proportion of its sanitized IT equipment to help ensure procedures remain successful. 

The full report can be found here: Safe Data Disposal - College | Office of the Washington State Auditor

The report does not disclose detailed results of individual tests performed to decrease the risk to the audited college’s data security. As an added precaution, the State Auditor’s Office does not disclose the identity of the college.