Colorado audit finds incomplete inventories for state-issued phones

Colorado agencies spent about $10.5 million on phones, tablets and mobile hotspots in fiscal 2025, but five departments with the highest costs could not show complete, reliable inventories of the devices they issued, auditors told the Legislative Audit Committee Monday. The hearing recording shows agencies preparing new inventory, approval and device-management controls.

The audit examined Corrections, Human Services, Natural Resources, Public Safety and Transportation. Together, the departments accounted for 65% of statewide payments to mobile-service vendors. Auditors also reviewed the Department of Personnel and Administration, which oversees the state’s carrier agreements. Verizon received about $9 million of the fiscal 2025 payments, auditors said.

Auditors reviewed usage data for 6,688 phones and identified 398 with no recorded use during the periods examined. They estimated those devices cost the state about $173,000 annually. The hearing record did not include a department-by-department estimate of savings, refunds or recovered money.

Agency officials said some inactive lines remained active because cancellation fees could exceed the cost of service, or because devices were assigned to vacant, temporarily inactive or transitioning positions. Corrections said it reviews phones unused for more than three months every six months.

No department had complete documentation for every phone in a sample covering about 10% of identifiable devices. Corrections, Natural Resources and Transportation generally had approval and employee-agreement requirements but lacked some records. Human Services and Public Safety generally had not required the specific approvals and signed agreements called for in state controller policy.

The departments agreed to improve inventories, usage monitoring and documentation. Their planned changes include:

• Corrections: Formalize its mobile-device-management relationship with the Governor’s Office of Information Technology, document devices individually and require reapproval when employees change positions. It also plans to restrict applications by job duties, replace phones before operating systems become unsupported, wipe retired devices and send them through the state surplus process.
• Human Services: Create a centralized management system, back-capture missing inventory and documentation by December 2026, make the system operational by June 2027, and add electronic signatures for employee usage agreements by the end of 2026.
• Natural Resources: Assess a department-wide management tool, update usage-monitoring policies and assign responsibility through a standard operating procedure. It set an August 2027 target for implementing the system and related administrative changes.
• Public Safety: Track active phones at the department, division and program levels; regularly check device counts and billing; and create a standalone cellphone agreement with stronger documentation of who receives devices and why. Officials also cited mobile-device-management controls and multifactor authentication, but the hearing did not establish a uniform cybersecurity standard across departments.
• Transportation: Consolidate inventory data, reconcile internal and vendor records twice a year, improve vendor information and move approval forms into an electronic workflow by the end of 2026.

DPA said it would work with carriers to obtain more useful department-level reports and review procurement, pricing, inventory and usage data. Auditors said DPA did not receive one of 12 required AT&T reports or eight of 12 required Verizon reports from fiscal 2023 through fiscal 2025, and did not identify errors in the reports it received.

The hearing record does not specify completion dates for Corrections’ work, Public Safety’s tracking system or DPA’s carrier-report improvements. It also does not show whether any of the 398 unused devices have been canceled, transferred, returned or sold. The $173,000 figure is therefore an estimated annual cost identified by auditors, not money the state has confirmed it will recover.