State comptroller auditors tell Senate panel New York lacks reliable IT inventory and comprehensive AI governance

At a March 5 meeting of the Senate Internet and Technology Committee, the Office of the State Comptroller presented two audits that found widespread weaknesses in New York StateInformation Technology Services(ITS) hardware asset controls and in statewide AI governance.

The audits, described by Tita Kim, deputy controller for state government accountability, and David Schafer, head of AI audits, found that ITS could not reliably account for thousands of computers and other devices and that agencies lack a comprehensive inventory or operational playbooks for AI systems. The auditors told the committee that those gaps create fiscal, operational and cybersecurity risk and make meaningful oversight difficult.

The comptrolleraudits covered different areas but reached similar conclusions: policy-level guidance exists in both IT asset management and AI acceptable-use rules, but the audits found insufficient training, monitoring and enforcement to translate policy into consistent practice. Kim told the committee that without reliable data, human oversight and transparency it is hard to identify weaknesses before they cause larger problems.

The IT inventory audit, released in February 2025, reviewed the period from March 2020 through August 2024. Auditors reported that nearly 18,000 workstations were marked "absent" in ITS records; close to 1,000 duplicated serial-number entries; and about 1,600 records lacking any serial number. The review also found stockrooms that had not completed required quarterly counts, staff keeping unofficial "shadow" spreadsheets, unsecured pallets and boxes of loose hard drives in shared spaces, and a set of new or barely used computers scheduled for shredding instead of resale or donation. The auditors said the latter group amounted to roughly $530,000to$660,000 in hardware.

Those gaps, the audit concluded, leave open the possibility of undetected loss or theft, unnecessary overstocking and wasted purchases, and greater exposure to data compromise when devices are not securely wiped before disposal. The report also said ITS had delayed seven months in providing auditors with requested data and staff access, during which inventory records were altered, which auditors cited as evidence of a weak control environment.

The comptroller recommended eight steps to address the deficiencies, including continuous cleanup and validation of inventory data, securing stockrooms and mandating quarterly counts by trained staff, deploying automated tools to detect unregistered devices on the network, written emergency procedures for procurement and asset handling, evaluating resale or donation before shredding, enforcing mandatory hardware return during employee offboarding, and a policy requiring timely cooperation with auditors.

Kim told the committee that ITS agreed to accept all eight recommendations in the agencyresponse dated January 2025, created an IT asset management team, adopted a new asset management policy, began rolling out a hardware asset management module to track devices from acquisition to disposal, and was conducting stockroom security surveys and quarterly inventory checks. The agency also indicated it would test resale and donation through the state's CREATE program and redesign offboarding forms to focus on hardware returns.

On AI governance, the auditors reviewed ITS and four agencies(NYSOCA, Department of Corrections and Community Supervision, Department of Motor Vehicles and Department of Transportation) and found no comprehensive statewide AI governance framework. The review said the ITS acceptable-use policy, originally issued in January 2024 and updated shortly before the audits, tells agencies what to do but not how to do it, leaving critical steps such as bias and accuracy testing, risk-management methods and contract-level data-use limits undefined.

Auditors said agencies interpreted the broad guidance differently, producing inconsistent practices. The audit cited an example in which the DMV excluded an application that uses facial recognition from its informal AI inventory and from its AI oversight process. Auditors also reported virtually no systematic bias or accuracy testing, limited human-oversight provisions, and inconsistent contractual terms for vendor data use. In one sample item identified as "LIQ," agency staff could not clearly state how vendor data could be used until auditors met the vendor and confirmed controls.

The auditors recommended that ITS expand its current policy into a full governance toolkit, produce a statewide inventory of every AI system in use, and deliver roles-based training so nontechnical staff can identify AI components embedded in existing applications. Kim said ITS had issued inventory guidance in March and that inventories and training were already in progress. The comptroller's office also said it planned a responsible-AI training series for agency accountability professionals and that additional AI audits are underway, including reviews at SUNY campuses and several New York City agencies.

Senators on the committee voiced concern about both the cybersecurity and oversight implications of the findings. After the presentation, ITS and the auditors agreed to provide committee offices with copies of the reports and to continue following up on implementation progress.

The presentation took place at the committee's March 5 session and preceded consideration of six bills on the committee's agenda.