Summary

Wasco State Prison: Its Failure to Proactively Address Problems in Critical Equipment, Emergency Procedures, and Staff Vigilance Raises Concerns About Institutional Safety and Security October 1999 99118 The first copy of each California State Auditor report is free. Additional copies are $3 each. You can obtain reports by contacting the Bureau of State Audits at the following address: California State Auditor Bureau of State Audits 555 Capitol Mall, Suite 300 Sacramento, California 95814 (916) 445-0255 or TDD (916) 445-0255 x 216 OR This report may also be available on the World Wide Web http://www.bsa.ca.gov/bsa/ Permission is granted to reproduce reports. C S A ALIFORNIA TATE UDITOR KURT R. SJOBERG MARIANNE P. EVASHENK STATE AUDITOR CHIEF DEPUTY STATE AUDITOR October 15, 1999 99118 The Governor of California President pro Tempore of the Senate Speaker of the Assembly State Capitol Sacramento, California 95814 Dear Governor and Legislative Leaders: As requested by the Joint Legislative Audit Committee, the Bureau of State Audits presents its audit report entitled Wasco State Prison: Its Failure to Proactively Address Problems in Critical Equipment, Emergency Procedures, and Staff Vigilance Raises Concerns About Institutional Safety and Security. This report concludes that Wasco’s management has failed to create an atmosphere of vigilance in which emergency equipment is adequately maintained and inmates are appropriately monitored as mandated by its policies. In addition, Wasco has not adequately prepared the prison and its staff for institution-wide emergency situations. Finally, we are concerned about the depth and the timing of the exercises Wasco intends to use to test the viability of its year 2000 contingency plan. An unnecessarily risky atmosphere will remain until these problems are resolved. Respectfully submitted, KURT R. SJOBERG State Auditor BUREAU OF STATE AUDITS 555 Capitol Mall, Suite 300, Sacramento, California 95814 Telephone: (916) 445-0255 Fax: (916) 327-0019 CONTENTS Summary 1 Introduction 5 Chapter 1 Wasco’s Failure to Repair and Maintain Critical Equipment Jeopardizes the Institution’s Safety 9 Recommendation 16 Chapter 2 Wasco’s Emergency Readiness Has Significant Weaknesses 17 Recommendations 28 Chapter 3 Weak Managerial Oversight and a Lack of Staff Vigilance Led to Inmates Gaining Access to Confidential Information At Wasco 29 Recommendations 38 Response to the Audit California Department of Corrections and Wasco State Prison 41 California State Auditor’s Comments on the Response From the California Department of Corrections and Wasco State Prison 47 SUMMARY RESULTS IN BRIEF T he California Department of Corrections (CDC) and the management at Wasco State Prison (Wasco) near Bakersfield have developed many policies and procedures to ensure the safety of Wasco’s staff and inmates. However, such Audit Highlights . . . policies are essentially useless if not enforced. As several recent Our review of Wasco State incidents demonstrate, Wasco has not followed its own policies Prison concludes that: that direct management to create an atmosphere of vigilance in (cid:254) which emergency equipment receives sufficient maintenance Wasco has a considerable backlog of incomplete and staff monitor inmates appropriately. By failing to enforce maintenance and these policies effectively, Wasco has needlessly endangered both repairs on its critical staff and inmates. equipment. (cid:254) Its failure to repair Specifically, management at Wasco has not ensured that plant defective equipment equipment undergoes adequate service and that staff complete nearly four years high-priority repairs promptly. Because it does not keep its ago resulted in a complete loss of equipment functioning properly, Wasco suffered an electrical power in April 1999. failure in April 1999 that caused a total power outage lasting (cid:254) almost seven hours—a problem that Wasco could have pre- Due to a lack of vented had management made certain that staff repaired training and specific emergency plans, during previously identified flaws in the electrical system. By neglecting the recent power priority repairs and scheduled maintenance on critical emer- outage some of its gency equipment, Wasco risks the occurrence of significant staff were unprepared. problems in the future. And finally, unsupervised inmates gained access to In spite of the fact that emergency readiness is a significant confidential information part of Wasco’s mission, its management has not adequately because of poor vigilance by staff. prepared the prison and its staff for emergency situations that could affect the entire institution. Although Wasco trains staff to handle certain types of emergencies, the power outage revealed that many employees had never received instruction in procedures that they should follow during an emergency of this nature. Moreover, at the time the outage occurred, neither Wasco’s management nor the CDC had developed an emergency operations plan which might have aided staff that were oversee- ing the prison, so employees were instead forced to rely on their own experience. The fact that some of Wasco’s emergency supplies were deficient only exacerbated the problems that occurred during the emergency. Furthermore, Wasco’s lack of preparedness for the power outage prompts us to question the C A L I F O R N I A S T A T E A U D I T O R 1 prison’s readiness for infrastructure or equipment malfunctions that might arise from year 2000 (Y2K) problems. We are concerned about the extent and timing of the exercises Wasco intends to use to test the viability of its year 2000 contingency plan. Finally, even though Wasco’s policies and training emphasize the importance of staff remaining constantly alert and vigilant, recent events indicate that staff have become increas- ingly complacent when supervising inmates. Circumstances also suggest that an absence of managerial oversight or evaluation may be contributing to this lack of vigilance. In particular, staff and management have been lax in protecting confidential information; as a result, inmates recently gained access to documents that listed staff addresses and social security num- bers. Without a heightened sense of awareness among prison staff, Wasco has no guarantee that future compromises to security will not occur. Additionally, we question the CDC’s policy that allows inmates to use a detailed map of the institu- tion. Although these conditions have not yet caused any serious repercussions, an unnecessarily risky atmosphere will remain until Wasco resolves these problems. RECOMMENDATIONS To prepare for the possibility of another emergency, such as the recent power outage, that could affect the entire facility, Wasco should take the following steps: • First identify all the high-priority repairs and preventative maintenance that its emergency equipment requires and then develop a staffing plan to eliminate quickly the backlog of repair and maintenance tasks. • Develop a specific plan for such institution-wide emergencies as power outages and include this plan as a supplement to its emergency operations procedures. • Train and drill employees to make certain they understand procedures and are prepared to act appropriately during an institution-wide emergency. 2 C A L I F O R N I A S T A T E A U D I T O R To ensure its readiness for possible infrastructure or equipment problems related to year 2000 (Y2K) computer errors, Wasco should do the following: • Conduct a partial or full-scale simulation of a Y2K emer- gency in order to test the prison’s Y2K contingency plan. • Perform as soon as possible a drill that simulates loss of power so that management can evaluate the feasibility of Wasco’s contingency plan and allow adequate time to correct any deficiencies or to adjust the plan. • Complete the repair and testing of its systems that rely on microprocessor chips, such as Wasco’s thermostats and electronic controls for inmate cell doors, to make sure the systems comply with the CDC’s year 2000 requirements. • Make certain that supplies of emergency equipment are adequate and that the equipment is fully functional. To safeguard prison staff, Wasco’s supervisors and managers need to cultivate an atmosphere of vigilance by setting examples with their own behavior and by closely monitoring staff interac- tions with inmates. When they observe staff displaying lax behavior while they are working with inmates, managers need to intervene promptly. To prevent future problems concerning the security of confiden- tial information, Wasco needs to take these actions: • Incorporate into its procedure manuals management’s recent instructions about the storage and duplication of sensitive data. • Require staff to record in control logs any documents sched- uled for shredding. In addition, the CDC should require each correctional facility to develop a plan for handling institution-wide emergencies, such as power failures, and to include this plan in its emergency operations manual. The CDC should also eliminate the unneces- sary risk associated with inmates access to detailed plans and maps of its institutions by amending the policy that allows such access. C A L I F O R N I A S T A T E A U D I T O R 3 AGENCY COMMENTS Both Wasco State Prison and the California Department of Corrections concurred with our findings and recommendations and are taking corrective actions. n 4 C A L I F O R N I A S T A T E A U D I T O R INTRODUCTION BACKGROUND T he California Department of Corrections (CDC) oversees the operation of 33 prisons located throughout the State, manages various community correctional facilities, and supervises all parolees during their reentry into society. For each of the 33 prisons it oversees, the CDC provides general policy guidance through its departmental operations manual. In addition, each prison is responsible for supplementing the departmental operations manual by develop- ing and formalizing certain institution-specific Profile of Wasco State Prison policies, such as emergency operations plans and procedures for ensuring the security of employees’ Warden: Randolph Candelaria (since 8/15/97) personal property and the security of computer- ized information. The CDC furnishes additional Date Opened: February 1991 oversight through periodic compliance reviews of Number of Acres: 634 each institution. Square Footage of Buildings: 803,311 Wasco State Prison (Wasco) is one of the State’s Number of Custody Staff: 800 33 prisons and is located about 20 miles north of Number of Support Staff: 440 Bakersfield. Wasco serves as one of the State’s Total Staff: 1,240 reception centers, with its primary mission to provide the short-term housing necessary to Annual Operating Budget: $95 million process, classify, and evaluate new inmates Current Approximate physically and mentally to determine where each Type of Design Inmate inmate will ultimately be incarcerated. In addition Facility Capacity Count to functioning as a reception center, Wasco houses Minimum inmates who help support and maintain the custody 200 400 prison and reception center, participate on work crews for community service projects, and keep up Medium custody 575 1,000 the outside perimeter of the institution. According to the warden, despite its design capacities, Reception Wasco’s actual inmate counts have historically center 2,284 4,300 averaged close to 6,000. He stated that having a Total 3,059 5,700 population that consistently exceeds design capacity places a great burden on the equipment needed to operate and secure the institution. In April 1999, several events occurred at Wasco that raised concerns about the safety of correctional staff and inmates. One incident involved prisoners obtaining C A L I F O R N I A S T A T E A U D I T O R 5 confidential information relating to correctional officers and administrative staff. In the same month, Wasco also suffered a complete power outage that lasted for nearly seven hours. The failure of a single electrical transformer terminated the institution’s incoming utility power. Because the blown trans- former operates on the same electrical circuit as the emergency generators, the generators were unable to respond. SCOPE AND METHODOLOGY The Joint Legislative Audit Committee (committee) requested that the Bureau of State Audits review and evaluate Wasco’s policies and procedures concerning the security of confidential information so that we could determine whether Wasco was placing its correctional staff and their families at unnecessary risk. We were also asked to examine Wasco’s guidance, protocols, and maintenance practices to assess its readiness for emergen- cies, including those that could arise from year 2000 (Y2K) computer problems. Finally, the committee requested us to assess how management communicates its policies to staff and to evaluate corrective actions management has taken in response to recent events. To analyze the adequacy of policies and procedures designed to protect correctional staff and their families, we interviewed CDC and Wasco management and staff, then examined the institution’s practices relating to confidential information and information security. We also reviewed incident reports alleging that inmates obtained access to the personal information of Wasco staff. In our report, we discuss the details of those incidents that we were able to substantiate. To assess Wasco’s readiness for emergencies, we looked at CDC’s and Wasco’s emergency operations procedures and we analyzed Wasco’s Y2K plans. We also examined the adequacy of existing procedures and emergency backup equipment by checking incident reports and interviewing supervisors and staff present during the recent power outage. In addition, we interviewed plant operations staff and reviewed maintenance schedules, work orders, and other evidence related to the institution’s repair and maintenance practices. To determine whether Wasco’s management effectively communicates to staff its policies regarding emergency preparedness and information security, we analyzed Wasco’s 6 C A L I F O R N I A S T A T E A U D I T O R training requirements, researched the content of selected courses, reviewed staff training records, and interviewed various staff members, including Wasco’s training coordinator. Further, we investigated whether Wasco uses course evaluations or some other method to obtain comments and suggestions from staff who have participated in the institution’s training program. We also discussed with management its methods for ensuring that staff comply with policies and procedures. Finally, we interviewed management and staff about corrective actions that Wasco has taken in response to the recent events concerning emergency safety and staff confidentiality issues. In addition, we reviewed the specific changes to policies and procedures and the procurement of goods and services that these events prompted. n C A L I F O R N I A S T A T E A U D I T O R 7 Blank page inserted for reproduction purposes only. 8 C A L I F O R N I A S T A T E A U D I T O R CHAPTER 1 Wasco’s Failure to Repair and Maintain Critical Equipment Jeopardizes the Institution’s Safety CHAPTER SUMMARY W asco State Prison (Wasco) has failed to repair and maintain adequately its regular and emergency equipment, thus placing the reliability of this equipment in doubt. In April 1999, a complete power outage highlighted the importance of equipment upkeep. The power outage, which affected both regular power and emergency generators, was caused by a faulty electrical transformer—a problem that Wasco management had identified nearly four years earlier but had not yet fixed. Repairing and maintaining equipment designed to provide basic services such as lighting and communications during emergencies are critical to ensuring the safety of prison staff and inmates. Although no serious injuries occurred in this instance, the power outage caused unnecessary threats to the safety of Wasco’s staff and inmates. Because Wasco has not attended to some of its equipment, the prison risks experiencing similar problems in the future. WASCO HAS NOT COMPLETED EMERGENCY REPAIRS AND SCHEDULED MAINTENANCE IN A TIMELY MANNER According to the monthly reports Wasco submits to the California Department of Corrections (CDC), the prison has a large backlog of repairs and maintenance that staff have not yet performed. Although it sets reasonable maintenance and repair goals, these reports show that Wasco falls far short of its objectives. Not only does it fail to complete regular preventative maintenance according to its own schedules, but it also fails to perform promptly ordered repairs to critical emergency equipment, often delaying repairs for months. C A L I F O R N I A S T A T E A U D I T O R 9 According to its Plant Operations Work Order Request Proce- dures manual, Wasco assigns different priorities to needed repairs and maintenance. The institution designates as “Priority 1” those repairs, such as fixing a malfunctioning fire alarm or cell door, that require immediate attention to protect the health and safety of the institution’s staff and inmates. These repairs should take place within 24 hours after plant operations receives the request. Regularly scheduled preventative maintenance of critical equipment, such as generators and transformers, receives a “Priority 2” designation. Staff are supposed to complete this sort of upkeep, which includes testing, inspections, cleaning, and adjustments, within 15 days of its scheduled date. For example, Wasco schedules biweekly start-up testing of its backup generators and schedules inspec- tions and cleaning of its electrical transformers annually. 1 Adhering to a regularly scheduled plan for preventative maintenance is key to ensuring the smooth operation and continued security of the institution. However, its August 1999 Since January 1995, maintenance report indicated that, as of the end of May 1999, Wasco was significantly Wasco had a total of 34 Priority 1 repairs and 2,268 Priority 2 late completing nearly scheduled maintenance work orders that were over 30 days past 900 emergency repairs due. In addition, this report shows that, since January 1995, and over 12,000 Wasco has failed to complete nearly 900 Priority 1 repairs and scheduled maintenance more than 12,000 Priority 2 maintenance work orders within work orders. 60 days of the work requests or due dates. These repairs should have been completed within 24 hours and the maintenance within 15 days. The CDC states that it is aware of the mainte- nance backlog at Wasco and has taken some steps to address the problem; however, the backlog remains. By not completing its emergency repairs and scheduled maintenance in a timely manner, Wasco cannot ensure the effective operation of its equipment in the event of an emergency. WASCO IGNORED CRITICAL ELECTRICAL PROBLEMS THAT EVENTUALLY CAUSED A COMPLETE POWER OUTAGE The failure of Wasco management to maintain emergency equipment appropriately became evident on April 12, 1999, when an electrical transformer malfunctioned at the prison, resulting in a complete power outage that lasted nearly seven hours. Wasco had identified this transformer as defective nearly 1 Requests for repairs and/or maintenance of noncritical equipment receive a lower priority and longer response times. 10 C A L I F O R N I A S T A T E A U D I T O R four years earlier, yet management had neither tracked the transformer’s deterioration nor fixed the problem. Conse- quently, Wasco plunged into darkness and risked the safety of its staff and inmates. The transformer in question was first identified as faulty in May 1995, when Wasco performed infrared thermography (thermoscans) on all its high-voltage electrical transformers in an attempt to discover the source of electrical problems in the institution’s laundry facility. Thermoscans use infrared imagers to detect heat radiated from electrical equipment, since overheating can cause premature, costly, and irreversible deterio- ration to electrical components. Until a defective transformer receives corrective repairs, the transformer’s temperature and rate of deterioration will increase with time. Because high-voltage transformers are completely sealed, thermoscans can detect problems that regularly scheduled maintenance and inspections would not reveal. In this case, the 1995 thermoscan and an additional thermoscan completed in August 1996 both indicated excessive heat in several of Wasco’s transformers, signifying the need for immediate repair. However, Wasco management did not request subsequent thermoscans of Wasco’s transformers to monitor the heat buildup, nor did management order corrective repairs.2 Rather, Wasco left the transformers to deteriorate until one of those previously identified as faulty failed in April 1999. The failure of this single transformer had a number of significant conse- quences for Wasco. First, the malfunction disrupted the institution’s normal electrical power, which is supplied by the local utility company and distributed through the prison via A transformer known to electrical circuits and transformers, including the transformer be faulty failed, causing that failed. Moreover, the faulty transformer used the same a power outage and the electrical circuit connected to Wasco’s two standby generators; back-up generators to when the transformer failed, it not only disrupted the flow of short out. normal power, but it also caused a ground fault in the emer- gency circuit that powers such key areas as the fire house and the door controls in the buildings housing inmates. Then, even though the primary emergency generator started up properly when Wasco lost utility power, the generator immediately shut itself off to avoid damage when it sensed the ground fault. 2 According to the warden, thermoscan contractors are located throughout California, and the procedure is relatively inexpensive. For example, the cost to perform thermoscans on all of Wasco’s high-voltage transformers was less than $800. C A L I F O R N I A S T A T E A U D I T O R 11 With both its primary and emergency power lost, Wasco was left to rely on its other emergency backup systems to maintain most of the institution for up to seven hours while its plant operations staff worked to restore power.3 As discussed in Chapter 2, even though the consequences of this situation were not as serious as they could have been, the power loss unneces- sarily jeopardized the safety of both staff and inmates. Wasco’s management was unable to explain why no one had fixed the While we know that faulty transformers when the thermoscans first identified the many staff were aware of problems. We do know that many staff members were aware of the transformer testing the thermoscan results, but it is unclear who made the decision results, it is unclear who not to repair the transformers; in fact, no one could provide us made the decision not to with a work order or any other documentation to indicate that repair the transformers. management had ever requested or ordered repairs to the transformers. We found this situation indicative of Wasco’s poor repair and maintenance practices. In response to the power outage, Wasco has finally taken action to repair all faulty transformers and has performed additional thermoscans to verify that repairs were successful. In addition, although the CDC does not mandate the thermoscan procedure, Wasco has recently made thermoscans a regular part of its annual scheduled maintenance for transformers. Fortunately, no serious injuries occurred during Wasco’s power failure; none- theless, the outage illustrates the potential danger inherent in a prison’s neglect of its electrical equipment. WASCO’S FAILURE TO MAINTAIN ITS EMERGENCY EQUIPMENT PROPERLY COULD CAUSE FUTURE PROBLEMS As discussed in the beginning of this chapter, defective electrical transformers are not the only examples of Wasco’s failure to make emergency repairs to its Priority 1 equipment. In fact, Wasco has had backlogs of emergency repairs for the past several years. To determine if other uncompleted repairs have placed the institution’s security at risk, we reviewed a number of Priority 1 repair requests and Priority 2 maintenance orders, investigating the nature of the work requested, the length of Wasco’s delay in completing it, and the possible consequences that the institu- tion risked by this delay. 3 The emergency generator for Wasco’s perimeter electric fence operates on its own dedicated electrical circuit. The fence generator sensed the power outage, started within 10 seconds, and operated throughout the loss of normal power. 12 C A L I F O R N I A S T A T E A U D I T O R To begin, we examined Wasco’s history of Priority 1 repairs for two critical equipment items included in Wasco’s backlog: its emergency battery backup light systems and its fire alarm systems. These systems are clearly critical to the safe operation of the institution, the former supplying light in the event of a power failure and the latter providing early detection of fires. When asked, Wasco furnished records that showed that 18 Priority 1 repair requests for its fire alarm systems had been made during the past three years; however, 12 of these requests remained incomplete as of August 16, 1999. In addition, of the 23 Priority 1 work orders related to failed battery backup lights requested during the past two years, only 12 were completed within the required 24-hour period. The reports indicate that 2 requests from February 1998 remain incomplete as of August 31, 1999, and that some of the backup light repairs were finished several months after the initial request date, well beyond the required 24-hour time frame for emergency repairs. The plant operations manager was unable to explain why staff did not complete these critical Priority 1 work orders sooner. However, he thought staff had made many of the repairs on time but had failed either to submit or to enter data showing repair completion. In addition to identifying delays in Priority 1 repairs, we found many examples of inadequate Priority 2 maintenance on Wasco’s two emergency standby generators, the generator for its lethal electric fence, its electrical transformers, the emergency Required monthly battery backup lights, and the fire alarm systems. As previously maintenance and testing noted, Wasco has carried a considerable backlog of Priority 2 of the lethal electric fence maintenance items; therefore, we reviewed its maintenance generator has occurred practices for several of these equipment items that are particu- only eight times in nearly larly critical to maintaining safety and security at the prison. five years. One of these items is the lethal electric fence generator, which ensures that the electric fence is able to operate properly in the event of a power outage, thus assisting in preventing inmate escapes during emergencies. In analyzing the maintenance records, we found that, although Wasco schedules monthly start-up testing and maintenance of its electric fence, it has completed this testing only eight times in the 56 months since the generator was installed. In fact, the records indicate that Wasco did not perform any testing on this generator from February 1995 through November 1998. By not ensuring that the electric fence generator is functioning properly, Wasco potentially jeopardizes the safety of the community surrounding its facility. C A L I F O R N I A S T A T E A U D I T O R 13 In another instance, we found that Wasco has failed to maintain and test adequately its battery backup lighting system. This emergency lighting system is designed to be the sole source of light in many critical areas, such as inmate housing buildings, during a complete power outage. Proper functioning of this system is especially crucial in inmate dormitories, where as few as two correctional officers, armed only with batons and pepper spray and without gun coverage, oversee up to 200 inmates. During a power failure, these officers face complete black-out conditions unless the buildings have backup lights. For this reason, Wasco is supposed to perform both monthly testing and annual Priority 2 maintenance on its emergency lighting system. Monthly testing includes turning the lights on for a short period to ensure proper operation. Annual maintenance includes cleaning, testing the battery capacity, and inspecting the integ- rity of plugs and cords. Because Wasco does not keep records of the monthly testing, we were unable to determine the exact extent to which the prison performs this testing. However, interviews with staff indicate that testing of backup lighting rarely occurs. Wasco’s records for Priority 2 annual maintenance of these emergency lights are inconsistent; however, the latest report we received indicated that although Wasco scheduled maintenance for these lights on Wasco failed to complete 232 occasions over the past 19 months, staff completed mainte- 90 percent of preventive nance on only 23 occasions. The consequences of Wasco’s maintenance on its failure to maintain and test these lights became evident during emergency battery the April 1999 power outage, when some of these backup lights back-up lights during the failed to operate or operated only for a short time. Although past 19 months. all of the lights eventually stopped working because they are designed only to last for up to three hours, the failure of some of the backup lights to function at all meant that some correctional officers did not have even a brief time to secure potentially dangerous situations. Instead, the officers immediately faced a complete black out. Because so many lights failed, Wasco has since undertaken a project to replace and upgrade its emergency lighting system. When asked about these Priority 2 maintenance problems, Wasco’s plant operations manager stated that he does not have sufficient staff to complete the scheduled maintenance workload and, as a result, he has focused on completing emergency Priority 1 work orders and assisting in the construction of new facilities. However, as we have shown, Wasco has not consis- tently completed Priority 1 repair orders in a timely manner either. Moreover, in reviewing Wasco’s plant operations 14 C A L I F O R N I A S T A T E A U D I T O R staffing records for September 1999, we noted that 27 of Wasco’s 98 budgeted positions were vacant. Wasco’s business manager stated that Wasco has not filled these positions in part because the CDC requires each institution to maintain a 4.9 percent salary savings and in part because the prison needs additional salary savings to pay for staff overtime. However, in light of its repair and maintenance backlog, we believe it is imperative for Wasco management to identify its critical Priority 1 and Priority 2 needs and plan for the staff and budget necessary to ensure that Wasco accomplishes these tasks. In fact, with the year 2000 fast approaching, it is even more important that Wasco take immediate action toward reducing its maintenance backlog so that it can ensure its emergency equipment is ready for any contingencies that might occur this January. Wasco is currently in the process of implementing a new automated maintenance system that is intended to increase and improve the data concerning facility maintenance and make this data easily accessible to both Wasco’s management and the CDC. Expected to be fully implemented by October 1999, the new system should improve Wasco’s ability to track work orders and plan the most efficient use of staff time. With such knowledge, management should be better able to monitor its maintenance projects and plan for the elimination of the backlog. CONCLUSION In the past few years, Wasco has neglected to perform needed repairs and maintenance on critical emergency equipment, thus calling into question the reliability of this equipment. In fact, Wasco’s failure to repair or replace a transformer that tests had already identified as faulty, led to a complete power failure that placed the security of the institution at risk. Although Wasco has acted to address some of its repair and maintenance problems, we believe that it must act decisively and quickly to eliminate its backlog of all Priority 1 repairs and Priority 2 maintenance work orders. Without such immediate action, Wasco may further jeopardize the safety of its staff and inmates. C A L I F O R N I A S T A T E A U D I T O R 15 RECOMMENDATION To prepare fully for future emergencies, Wasco State Prison should first identify for its emergency equipment all Priority 1 repairs and Priority 2 maintenance. The institution should then develop a staffing plan to eliminate quickly this repair and maintenance backlog and work to keep the equipment ready continuously. n 16 C A L I F O R N I A S T A T E A U D I T O R CHAPTER 2 Wasco’s Emergency Readiness Has Significant Weaknesses CHAPTER SUMMARY A s Chapter 1 explains, Wasco State Prison (Wasco) suffered a complete power outage on April 12, 1999. Even though no staff or inmates received serious injuries, the incident demonstrated that Wasco’s staff are not adequately trained for institution-wide emergencies, no emergency opera- tions plan exists for a complete power outage, and Wasco’s emergency equipment and supplies were deficient. In fact, we believe that the absence of major injuries was due primarily to fortuitous mitigating circumstances, such as the occurrence of the power failure when staff members were changing shifts, rather than to Wasco’s emergency readiness. Perhaps the most serious weakness revealed by the power outage was the staff’s lack of training for emergencies of this nature. When we discussed the incident with Wasco staff members present during the power outage, they told us of instances in which some individuals were generally unprepared to handle the crisis effectively. Many staff attributed this lack of readiness to an absence of training and drills for institution-wide emer- gencies. Although Wasco has trained its staff regarding the general Emergency Operations Plan (EOP) guidelines and has conducted training and drills related to specific types of emer- gencies, such as inmate disturbances, the training and drills to date have yet to address such emergencies as an electrical power outage. In addition to these problems with staff training, Wasco also has failed to include within its EOP a strategy to guide staff in the event of a complete power outage, despite the fact that its EOP acknowledges that backup power equipment has a high failure rate. We found that the EOP includes procedural checklists to aid in emergencies such as earthquakes, dam failures, and floods; however, it includes only vague guidelines regarding alternative sources of power and communications when primary systems fail. Although Wasco’s officers were able to use their experience C A L I F O R N I A S T A T E A U D I T O R 17 to manage the institution during the April power outage, key officers indicated that established plans were not helpful and that there is a need for better guidelines regarding electrical failures. Moreover, even if Wasco’s staff had received adequate training and its EOP included an appropriate emergency plan, the staff’s lack of drills negated the opportunity to detect and correct problems in advance of those that occurred on the night of the power outage as a result of deficiencies in the prison’s emer- gency supplies and equipment. Some officers did not have flashlights or radios, and the central control board failed during the outage. Management could have been forewarned of these sorts of problems if Wasco had engaged in institution-wide drills. Finally, although the prison appears to be on track with its plans for addressing possible year 2000 (Y2K) complications, the depth and timing of the exercises Wasco intends to conduct to ensure that its Y2K contingency plan is viable may affect Wasco’s ability to detect and correct any deficiencies it finds before the end of the year. A LACK OF TRAINING AND DRILLS LEFT MANY STAFF UNPREPARED FOR WASCO’S RECENT POWER OUTAGE To assess how Wasco responded to the April power outage, we interviewed several correctional officers and supervisors who were present at the institution during the emergency. Although some staff indicated that the prison handled the emergency The black out revealed well, others pointed out areas in which staff members were that some staff did not generally unprepared for this sort of crisis. For example, a tower know how to manually guard was injured when he fell while climbing down the dark- open gates, the location ened stairs of one of the guard towers in an attempt to deliver of keys to open inmate keys necessary to open a gate. However, an outside patrol officer housing, or where to with the needed key was nearby but was unaware he had a key. find emergency lanterns Had the outside patrol officer been better prepared, the injury to and radios. the officer responding from the guard tower could have been avoided. In another instance, a Sheriff’s helicopter that was providing light for correctional officers during a move of inmates from one housing building to another was asked by the emergency commander to light the perimeter fence instead. This action left officers with only their flashlights and lanterns to complete the inmate move. 18 C A L I F O R N I A S T A T E A U D I T O R These are only two examples of problems caused that night by a lack of staff training and preparedness. In addition, staff mem- bers told us that some staff did not know how to open gates manually and that some supervisors did not know the locations of keys necessary to open manually the locks for inmate housing buildings. We also learned that some staff did not know where to find emergency keys, lanterns, and radios. Such examples indicate that communication and coordination during the power outage could have been better. Moreover, the examples highlight the importance of training staff in emergency proce- dures, including how to conduct operations manually and where to locate emergency resources. Although the consequences of the power outage were not as serious as they could have been, several staff members mentioned that good timing contributed at least in part to the relatively benign outcome to the emergency. When the power failed at 10:05 p.m., the Wasco staff were in the middle of a shift The outage occurred at a change. Fortunately, even though some of its staff members shift change providing were confused and uncertain about what to do, Wasco was able additional staff to control to redirect immediately most of its outgoing staff back into the the emergency. Had it institution to provide additional support in controlling the happened one hour later, emergency. In contrast, if the power outage had occurred just the nighttime skeleton one hour later, Wasco would have had only its nighttime skel- crew may not have fared eton crew to contain the institution and might not have fared so so well. well. Under these hypothetical circumstances, Wasco would have found staff training and preparedness even more necessary than they were in April. Nevertheless, despite the staff’s obvious need for training, Wasco had not conducted training or drills for situations such as power outages that require an institution-wide response. Wasco has provided some training related to its general emergency opera- tions procedures, such as how to man the perimeter towers and which staff are designated to assist in responding to emergencies in specific areas of the institution. However, this training, though valuable, does not address what to do in the event of a complete power failure.4 Wasco has conducted focused drills related to specific types of emergencies, but these sessions dealt only with parts of the facility, such as a hostage situation or an inmate-induced power failure in one building. In an isolated disturbance training drill, management designates unaffected 4 In addition to furnishing classroom training, Wasco’s supervisors provide on-the-job training to correctional officers. However, none of the officers we spoke to could recall receiving any guidance from his or her supervisors about what to do during a power outage. C A L I F O R N I A S T A T E A U D I T O R 19 parts of the institution to assist in responding to the emergency or to staff critical posts, such as the building or perimeter gun towers. However, in an institution-wide emergency, such as a power outage, which affects all areas, such assistance would not be as readily available. For this reason, the training of supervisory staff is particularly important. In an institution-wide emergency, most staff would have to remain at their respective posts to maintain security, while the remaining supervisors would be responsible for deciding where to lend help and what type of help to lend. Such choices are difficult, if not impossible, without training and practice. Wasco was fortunate that this lack of training and preparation did not result in any serious consequences last April; however, it should ensure that staff are adequately pre- pared for the possibility of a future institution-wide emergency. Although Wasco’s chief deputy warden acknowledges the need for additional training and drills for staff, he stated that the high cost of training and drilling combined with budget constraints limits the extent to which these activities can take place. WASCO’S EMERGENCY OPERATIONS PLANS DO NOT ADEQUATELY ADDRESS PROCEDURES FOR STAFF TO FOLLOW DURING A COMPLETE POWER FAILURE The problem of Wasco’s inadequate staff training is com- pounded by the fact that its emergency operations procedures do not include a coherent plan or sufficiently detailed checklist to help supervising staff deal with a complete power outage. Wasco’s emergency procedures consist of an Emergency Operations Plan (EOP) plus a series of supplements. Outlining preparations for such emergencies as earthquakes, dam failures, Unlike earthquakes, and floods, the EOP defines staff responsibility during emergen- dam failures, and floods, cies and establishes procedures for notifying management, for there are no procedures sharing information between various staff members, and for specific to power implementing command and control of activities. The supple- outage emergencies. ments provide more detailed emergency procedures in certain areas such as inmate counts, lockdowns, weapons distribution, communications, and the establishment of alternate sources of power. Although these sections provide guidance for certain needed actions during a power outage, such as setting up the emergency operations center, the EOP and its supplements do not offer specific procedures for handling this type of emergency. 20 C A L I F O R N I A S T A T E A U D I T O R We also found that the supplements on “Communication” and “Alternate Sources of Power and Utilities,” which seem most relevant to a power outage, do not provide adequate or specific guidance. For instance, while the supplement on alternative sources of power acknowledges that utility power is critical, the publication only mentions the standby generators as the alterna- tive to normal power. The supplement states that in the event of a prolonged power outage, Wasco may use the services of out- side resources. However, this supplement does not contain procedures for staff to follow during the interim period while Wasco obtains alternative power sources or outside assistance. The emergency operations supplement for communication appears similarly ineffective. The plan specifies the use of radios and hand-carried notes as alternative communication devices, yet it provides no guidance for implementing these alternatives, leaving open questions such as who should carry the notes and where the additional radios are located. Instead, another supple- ment supplies information on the number and location of additional radios. However, this second supplement did not list the backup supply of radios kept by the person acting as liaison for Wasco’s radio communications. Although the radios were needed during the April power outage, they were never located or used because staff were unaware of the supply. Wasco has since updated these supplements to include a procedure to contact the radio liaison in the communications supplement and has added the location of the radios to another supplement; however, the supplements still lack integration for ready use and do not include sufficient information to be effective. The commanders in charge of Wasco during the April power outage confirmed the apparent weaknesses of the EOP’s guide- lines. Both the interim emergency commander, who has control of an emergency until the warden or his designee arrives, and The commanders in the alternate watch commander, who oversees any portions of charge of Wasco the institution not affected during an emergency, stated that during the April power Wasco’s emergency operations plans were not very helpful to outage stated that them during the emergency because the guidance related to emergency operations power and communications failures is not specific enough. plans were not very The commanders indicated that they had to rely on their helpful to them during combined knowledge and experience rather than the emergency the emergency. operations procedures to determine what actions to take. Each acknowledged the need for more detailed procedures regarding this type of emergency and recommended using the reports from the April power failure as guides for similar occurrences in C A L I F O R N I A S T A T E A U D I T O R 21 the future. Although Wasco overcame the emergency in April without serious incident, the fact that these managers still recommend the development of specific procedures highlights the importance of this critical task. For this reason, we found it curious that although the California Department of Corrections (CDC) requires each of its institu- tions to develop checklists for emergencies such as dam failures, floods, and earthquakes, the CDC does not have a similar requirement for specific emergency procedures related to power outages. CDC officials explained that the department’s guidance in this area is more general than it is for other types of emergen- cies because of the unique character of the facilities and varying risk levels of inmates housed at each institution. Thus, the CDC has delegated development of more detailed procedures to the prison wardens. However, in light of the power outage suffered by Wasco, it does appear that this type of procedure would benefit all California correctional institutions. Without such procedures, institutions risk confusion and possible breaches of security during power failures. TESTING OF EMERGENCY PLANS COULD HAVE REVEALED DEFICIENCIES IN WASCO’S EMERGENCY EQUIPMENT In addition to revealing problems in Wasco’s staff training and emergency procedures, the power outage also exposed several deficiencies in Wasco’s emergency backup equipment, including its supply of flashlights and lanterns, battery operated radios, personal alarms, and fire alarms. If Wasco had conducted train- ing and drills related to a complete power outage before an actual emergency occurred, prison management could have uncovered these deficiencies and taken action to correct them. For example, because battery backup lights in the buildings failed, staff were dependent on flashlights and lanterns to The loss of power provide illumination. However, despite Wasco guidelines, which disclosed deficiencies require correctional officers to carry flashlights, some staff relating to the supply of members were not appropriately equipped. The problem was flashlights and lanterns, further complicated when Wasco found its backup supply of and radio batteries. lanterns inadequate to meet staff needs during this emergency. As a result, some correctional officers were forced to work in situations in which they had minimal or no light, and these circumstances created unnecessary risks to their safety. If Wasco had already conducted appropriate drills, they would 22 C A L I F O R N I A S T A T E A U D I T O R have shown that the supply of lanterns was inadequate and reinforced the need for each officer to carry a flashlight. In response to the deficiencies noted during the black out, Wasco has since purchased 204 lanterns to supplement its existing supply. In addition, the loss of power also uncovered weaknesses in Wasco’s backup communications systems. The institution’s phone system has a battery backup system designed to operate in the event of a complete power outage. However, the phone system was significantly damaged by a power surge resulting from the failed transformer, leaving staff dependent upon battery operated radios and other methods for communication. In accordance with the CDC guidelines, radios are only issued to staff when fixed communication devices such as telephones will not meet critical communications needs, so they are typically not issued to the staff of the inmate-housing buildings because these buildings have telephones. Therefore, once the phone system failed, all 30 inmate-housing buildings were left without immediate communication and had to depend on messengers until management could issue radios.5 However, many of the radios proved unreliable because of an insufficient supply of batteries, further impeding the ability of some correctional officers to communicate problems or receive orders. In fact, Wasco did have additional radios and batteries available, but staff were unaware of their availability and did not contact Another example of the radio liaison, who could have advised them of the location deficiencies in Wasco’s of the radio storage area. As a result of this unused supply, emergency equipment is Wasco did not need to purchase additional radios or radio the failure of the central batteries after the outage. Nevertheless, the person acting as control board which liaison for Wasco’s radio communications advised us he has shows the status of since informally made appropriate staff aware of the additional personal and fire alarms. supply and its location, and he has purchased an additional 100 radio batteries to upgrade Wasco’s backup supply. In a final example of deficiencies in Wasco’s emergency equip- ment, Wasco’s central control board, which shows the status of personal alarms and fire alarms, failed during the April power outage. Plant operations staff later learned that the board, which allows the coordination and supervision of the response to an emergency such as a fire or an officer’s call for help, did not 5 Several correctional officers retrieved personal cellular phones from their automobiles in the parking lot for use by the supervisory staff to communicate with the emergency commander. C A L I F O R N I A S T A T E A U D I T O R 23 have an emergency battery backup. With the phone system down, the board’s role was even more critical for the officers inside the inmate-housing buildings who had no other immedi- ate means of communicating an emergency to supervisors. If it had tested its emergency plans, Wasco would have discovered the lack of a backup battery for this important system. Wasco management has since connected the control board to a backup battery designed to last up to eight hours. WASCO’S HANDLING OF THE RECENT POWER OUTAGE RAISES CONCERNS ABOUT THE PRISON’S PREPAREDNESS FOR YEAR 2000 EQUIPMENT PROBLEMS The problems that arose in conjunction with the recent power outage may foreshadow some of the possible scenarios that could occur when the year 2000 (Y2K) arrives. Although Wasco has been actively preparing for Y2K, the institution still has not completed certain steps necessary to ensure it will be ready for potential computer problems. Specifically, it still needs to Wasco has yet to conduct a test of its Y2K contingency plan, required by the conduct tests of its Y2K CDC, and to complete remediation and testing of some of its contingency plan. high-priority systems. In addition, it has yet to conduct a planned disturbance control exercise that will simulate a loss of power throughout the whole institution similar to the electrical failure that occurred earlier this year. Until these steps are successfully completed, Wasco is not at the point it can declare itself ready for Y2K. Wasco has prepared a Y2K contingency plan that details alterna- tive sources that Wasco could use to fill its institutional needs for power, food, heat, water, lighting, and communications should its primary sources be unavailable. For example, the plan addresses the possible loss of power to the perimeter electric fence, including depletion of the fuel supply for its backup generator. If this event should occur, the plan calls for the posting of armed staff in the perimeter towers, an institution- wide inmate lockdown, and both vehicle and foot patrols of the institution perimeter. To ensure that its contingency plan can be carried out effectively, Wasco intends to have all fuel supplies at full capacity and a sufficient number of staff on duty to contend with any electronic equipment or infrastructure problems caused by the Y2K date change. Although the plan seems fairly com- plete, we are concerned about the timing and depth of the exercises intended to test its viability. 24 C A L I F O R N I A S T A T E A U D I T O R To test its Y2K readiness, Wasco has planned two main exercises. First, the CDC is requiring each of its institutions to conduct at least one exercise to test the major elements of its Y2K contin- gency plan. According to the CDC’s Year 2000 Validation and Training Guide (guide), the objective of testing each institution’s Y2K contingency plan is to determine if individual plans are capable of providing support for the CDC’s most critical business processes. Other goals described in the guide include testing to see if each institution can implement its plan during a specified time and provide the time necessary to make any needed adjustments to the plan so that it can be used if required. The guide further specifies that testing the functional capability of Y2K contingency plans should enable a responsible officer at the institution to certify that the plan has been tested, training is complete, and the plan is ready for implementation if necessary. This certification was due by October 8, 1999. The guide further gives each institution several options, or exercises, for testing its Y2K contingency plan and leaves the choice of which option to use up to the individual institutions. Two of the five options suggested by the CDC—orientation lectures and desktop exercises—do not include any actual drills to test whether critical parts of the plan will work in practice. Orientation lectures introduce a new plan to an existing group or an existing plan to a new group. A desktop exercise is Unless Wasco plans to hypothetical in nature and performed by management and actually test its Y2K supervisory staff. This type of exercise poses specific emergency contingency plan, there is scenarios to a supervisor who then discusses how to resolve the significant risk flaws will emergency. The management team then critiques the proposed not be detected. resolution. The other three options involve drilling or simula- tions. Skill enhancement drills train staff on a specific function or reinforce an existing skill. Functional exercises simulate a real event, usually with external communications in a real-time environment. A full-scale exercise simulates reality to the high- est degree possible. However, unless Wasco intends to go beyond discussing and critiquing possible Y2K scenarios by actually testing its Y2K contingency plan, using either a functional or full-scale exercise, there is a significant risk that any flaws in the plan will not be detected and corrected by year-end. In addition, Wasco plans to conduct a disturbance control exercise in which the entire institution will act out a drill, which includes a simulated loss of power to the prison. After the drill is complete, Wasco’s management and CDC observers intend to C A L I F O R N I A S T A T E A U D I T O R 25 critique the performance of supervisors and staff to assess areas in which they could improve. According to Wasco’s training coordinator, this exercise is planned for the middle of December. Although both these exercises seem valuable, we are concerned about the depth and timing of the events. With the year 2000 so Because one Y2K exercise close to the dates of the planned exercises, Wasco may not is not planned until be able to detect flaws in its plan and have adequate time to December, there may not address any deficiencies or make needed adjustments that the be sufficient time to exercises might reveal. For instance, if Wasco discovers signifi- remediate problems. cant problems with its equipment during the December drill, it may prove impossible to replace or fix this equipment before Wasco needs the equipment to mitigate any Y2K problems. Moreover, in addition to testing and finalizing its contingency plan, Wasco still has work to do before its systems and equip- ment are all Y2K compliant. The CDC is responsible for remediation and testing any deficiencies in information tech- nology systems that support Wasco and, according to the Y2K manager of the CDC’s Institutions Division, these systems are now wholly Y2K compliant. According to the Y2K manager, Wasco’s responsibility lies in the remediation and testing of its embedded chip systems, which are systems where a microprocessor chip controls, monitors, or assists the operation of equipment or machinery. Thermostats as well as electronic controls for inmate cell doors are examples of equipment that rely on embedded systems. Wasco’s plan to assess and remediate its embedded systems has three phases. Phase I, which consists of testing its high priority equipment and systems, is nearly complete, with three systems still noncompliant and needing repair. First, Wasco found that the software controlling an automated inventory of keys and their location was noncompliant; however, the CDC is currently reviewing this issue to determine by October whether repairs are necessary or manual operations will suffice. In addition, Wasco’s personal alarm and fire alarm computer is noncompliant, and Wasco is currently considering alternatives to repair this system. Finally, Wasco’s time recorder for its fire alarm system is noncompliant and should have received repairs by September 14, 1999.6 Wasco needs to ensure that these 6Wasco has not completed testing on four other high-priority items. One item, a missing sterilizer, could not be located, and remediation and testing will be rescheduled as soon as this item is found. The other three items are components of an X-ray system that is inoperable and will not receive remediation. Wasco has a contract with a vendor to provide the X-ray services. 26 C A L I F O R N I A S T A T E A U D I T O R high-priority systems are fully remediated and retested quickly to allow time for Wasco to pursue alternatives if its initial efforts are unsuccessful. In addition, Wasco has not yet begun testing of its Phase II and III systems and equipment. Phase II involves testing high-priority systems that are duplicates or multiples of Phase I equipment and certain important medium-priority systems, such as the computer for the electric fence emergency generator and the medical blood cell analyzer. Phase III focuses on testing equipment and systems with lower-priority levels or functions, such as night-vision goggles and food delivery vehicles. Wasco planned to complete its Phase II testing by October 8, 1999, and to complete its Phase III testing by the end of October or early November. However, the anticipated late completion of its testing efforts will not leave much time for Wasco to complete any needed repairs. Wasco management needs to move quickly to accelerate the completion of the prison’s remediation and testing of at least its Phase I and Phase II equipment to reduce the risk of Y2K-related problems. CONCLUSION The April power outage at Wasco revealed a number of serious problems in the prison’s emergency readiness. The power outage showed that some members of Wasco’s staff had not been adequately trained in handling an institution-wide emergency and were generally unprepared to deal effectively with a crisis of this nature. The problem was further exacerbated by a lack of clear and specific guidelines in Wasco’s EOP about proper procedures to follow in the case of a total power outage and by deficiencies in Wasco’s emergency equipment. Although no staff or inmates suffered serious injuries, Wasco might not have been so fortunate if the power outage had occurred only an hour later, when less than half the number of staff would have been on hand. The problems exposed in the power outage could fore- shadow similar problems the prison might encounter on January 1, 2000, if Wasco does not act promptly to ensure its emergency readiness. The depth and lateness of Wasco’s pro- posed testing of its Y2K contingency plan and the proposed timing of its remaining remediation and testing of its systems C A L I F O R N I A S T A T E A U D I T O R 27 and equipment that rely on embedded chips may not allow sufficient time for Wasco management to detect and make any necessary revisions to its plan or to fix noncompliant systems and equipment. RECOMMENDATIONS To prepare for the possibility of another institution-wide emer- gency such as the recent power outage, Wasco should do the following: • Develop a specific plan for institution-wide emergencies such as power outages and include this plan as a supplement to its emergency operations procedures. • Conduct training and drills to ensure staff understand procedures and are prepared to perform necessary functions during an institution-wide emergency. To ready itself for possible year 2000 computer and equipment problems, Wasco should take these steps: • Perform either a functional or full-scale exercise to test its Y2K contingency plan. • Conduct its Y2K disturbance control exercise as soon as possible to test the feasibility of its contingency plan and to allow adequate time to correct any deficiencies or to make necessary adjustments to its plan. • Complete the remediation and testing of its Phase I and Phase II embedded-chip systems for Y2K compliance as soon as possible. • Ensure that the prison’s supplies of emergency equipment are adequate and that its equipment is fully functional. Furthermore, the California Department of Corrections should require each correctional facility to develop a plan that covers institution-wide emergencies such as power failures and to include this plan in the facility’s emergency operations manual. n 28 C A L I F O R N I A S T A T E A U D I T O R CHAPTER 3 Weak Managerial Oversight and a Lack of Staff Vigilance Led to Inmates Gaining Access to Confidential Information At Wasco CHAPTER SUMMARY T he failure of management at Wasco State Prison (Wasco) to demonstrate sufficient foresight in handling potential problems is apparent not just in its preparation for emergency situations, but also in its daily interactions with inmates. Specifically, in several separate instances this spring, inmates at Wasco were able to obtain the addresses and social security numbers of staff members because documents contain- ing confidential information were not adequately secured and because staff were lax in their supervision. In addition, a California Department of Corrections (CDC) policy gives inmates access to a detailed map of the institution that shows such sensitive information as the location of the prison’s armory, generators, and fuel supplies. These conditions illustrate a general complacency on the part of Wasco’s staff members when they interact with inmates, a breakdown in staff vigilance regarding the protection of confidential information, and what we consider a poor policy choice on the part of the CDC. Moreover, incidents such as these suggest that supervisors who should have detected and prevented this breakdown in security were not exercising appropriate oversight. Although we are not aware of any specific harm caused to persons compromised by inmate access to confidential information, these conditions put Wasco staff and their families at undue risk. Wasco’s management has since taken some positive steps to correct staff practices related to the handling and security of confidential information; however, management needs to find ways both to engender a more vigilant attitude among staff and to ensure that staff adhere to established procedures. C A L I F O R N I A S T A T E A U D I T O R 29 STAFF DID NOT SAFEGUARD CONFIDENTIAL INFORMATION OR SUPERVISE INMATE WORKERS APPROPRIATELY Statements of policy by both Wasco’s management and the CDC emphasize the importance of vigilance. Yet several recent events and our own observations suggest that Wasco’s staff have not adequately safeguarded confidential information and that Recent incidents suggest overall vigilance at the prison has become too lax. Because of that management has these conditions, inmates recently gained access both to certain failed to set a sufficiently personal information about correctional officers and administra- vigilant tone. tive staff and to sensitive information about the institution itself. These incidents, which created a threat to the safety of administrative and correctional staff and their families, indicate that management has failed to set a sufficiently vigilant tone at the prison. Several Inmates Had Access to a Closet That Held Confidential Records CDC policy requires institutions to strive for an inmate partici- pation rate of 98 percent in work, training, and educational activities. Because Wasco staff assign inmates tasks that include maintenance, clerical, and janitorial work, inmates work in most areas of the prison. During our visit at Wasco, we observed that many of these inmates appeared idle, indicating to us that perhaps the prison does not have enough appropriate jobs for its inmate population. If inmates have time on their hands, the staff that supervise these inmates need to remain especially alert and cautious. However, some recent events indicate that Wasco has not always maintained appropriate vigilance. Specifically, in April 1999, a correctional officer discovered a list hidden among supplies in a janitorial closet that contained such confidential information as the names, phone numbers, social security numbers, and an address of current and former correctional officers and staff. Wasco investigators traced this list to an inmate who admitted preparing it from confidential information contained in boxes formerly located in the closet. Even though the Department of Corrections Operations Manual (DOM) requires that all confi- dential information be stored in locked areas, staff had not adhered to this requirement and had allowed inmates unfettered access to the unlocked closet. 30 C A L I F O R N I A S T A T E A U D I T O R According to the office technician working in the area adjacent to the closet, the boxes, which contained confidential informa- tion such as time sheets, incident reports, and other documents, were moved to the janitorial closet around February 1998 due to space constraints. The boxes remained there until March 1999, when other space became available. The inmate who prepared the list had regular access to the closet as part of his work assign- ment as a janitor and also used the closet for taking breaks. Because of the location of her desk, the office technician respon- sible for supervising the inmate could not observe his actions when he was in the closet. Therefore, unless she stood at the door every time the inmate entered the closet, the inmate would have had ample opportunities to peruse the contents of the boxes without being detected. In addition to the inmate responsible for creating the list of confidential information, seven other inmates also worked as janitors or clerks at this Despite knowing that location and had access to the closet from December 1997 boxes containing through April 1999, when the list was discovered. confidential information were accessible to In spite of the fact that many of Wasco’s staff and management inmates, no extra knew these boxes were accessible to inmate workers, no one precautions were taken took extra precautions to safeguard the information contained to safeguard them. in them. As a result of this laxness in attitude, at least one inmate had time to look through the boxes and jot down confidential information, thus creating a threat to the safety of institution staff and their families. An Inmate Used Information Obtained From an Incident Package to Threaten a Correctional Officer In a second, unrelated incident in which staff failed to maintain appropriate vigilance, an inmate obtained access to a correctional supervisor’s personal information from a State Compensation Insurance Fund form. The form was part of an incident package provided by another correctional supervisor to an inmate involved in a physical altercation with the supervisor. According to the various memos we reviewed concerning the incident, the inmate who received the insurance form then gave it to another inmate. Although portions of the form had been blacked out, the inmate who received the form was able to discern most of the supervisor’s social security number and a partial home address. The inmate subsequently used this information to threaten the officer on an inmate appeal form he filed to request a transfer to another prison. Specifically, the inmate threatened to provide C A L I F O R N I A S T A T E A U D I T O R 31 the officer’s personal information to other inmates “who wish to do harm” if he did not receive a transfer to another facility within 72 hours. In response to the threat, Wasco transferred the inmate to another prison three days later and disciplined the officer who initially provided the incident package to the first inmate. Although the personal information the inmate garnered from the document was incomplete and the officer was not harmed, this incident underscores the potential danger that exists when inmates learn personal information about institution staff. CDC Policy Allows Inmate Access to a Detailed Map of the Institution and the Surrounding Area While attempting to obtain a map of Wasco’s facilities, we discovered that inmates in the vocational education program had access to a detailed map of Wasco and the surrounding area. The inmates used the map during computerized drafting instruction. This map identifies the two roads adjacent to Wasco Inmates have access to and provides the location and description of all prison facilities, detailed maps of the including the positions of critical equipment, armories, and institution, depicting hazardous materials storage areas. In our view, for inmates to the position of critical have such detailed knowledge of Wasco’s physical facilities equipment, armories, represents a serious security threat. Furthermore, maps in the and hazardous hands of inmates depicting any area within 10 miles of a materials storage areas. facility are considered contraband and carry disciplinary penalties according to both the DOM and the California Code of Regulations. When we spoke to Wasco’s warden about the inmates’ possession of the map, he explained that an inmate’s map is considered contraband only if it delineates streets and roadways of communities surrounding the institution and thus suggests that the inmate is planning an escape. He referred to the map we saw as a “plot plan,” explaining that he was aware of its general use and that it is common practice for inmates to have access to this type of information because they help build structures and conduct maintenance throughout the institu- tions. In fact, the warden stated that the CDC specifically provides for such access through its policy memorandums. We reviewed these memorandums and found that the CDC restricts inmate access only to plot plans and blueprints containing electrical schematics of radio towers, security systems, or alarm systems; mechanical drawings of internal locking devices; and information about key numbers or phone numbers. 32 C A L I F O R N I A S T A T E A U D I T O R Nevertheless, we believe that it is unnecessarily risky and poor policy to allow inmates access to comprehensive facility maps that show the locations and descriptions of all buildings, fixtures, and weaponry. BEFORE APRIL 1999, WASCO DID NOT STORE SECURELY ITS CONVENIENCE COPIES OF CONFIDENTIAL RECORDS In addition to finding these specific instances in which Wasco’s security was compromised, we also noted a general practice previously pervasive throughout Wasco that increased the risk of inmates obtaining confidential information. Specifically, some administrative staff stated that, until April 1999, it was common practice to create “convenience copies” of confidential records, such as time sheets, so staff could avoid having to obtain these documents from their secure location in another area of the institution. This practice contributed to the large volume of confidential documents created and stored in all areas of the prison, including the boxes stored in the janitorial closet mentioned earlier. After the discovery that an inmate had obtained access to these boxes, management instructed staff to shred all surplus docu- Making convenience ments that contained confidential information. As a result, we copies is symptomatic of were unable to determine the exact volume and nature of all the Wasco’s past atmosphere previously stored documents, nor were we able to uncover of complacency. whether or not inmates had access to other confidential or sensitive information. However, we found the practice of mak- ing convenience copies to be symptomatic of the atmosphere of complacency that appears to have pervaded the prison. WASCO’S MANAGEMENT LACKS EFFECTIVE METHODS FOR ENSURING THAT STAFF PRACTICE VIGILANCE Even though Wasco’s policies and the training courses it offers on staff vigilance appear adequate, the institution’s management has not established effective ways to assess whether staff are putting into practice directives related to vigilance. In particular, Wasco does not regularly obtain evaluations from staff regarding how well training courses prepare them to work in a correctional setting. Further, no other preventive measures appear to be in place to help management assess whether its efforts to instill vigilance among staff result in adherence to Wasco’s policies. C A L I F O R N I A S T A T E A U D I T O R 33 The training Wasco offers its staff concerning security issues appears adequate and appropriate. For instance, during a mandatory 40-hour orientation training session given to all new employees, Wasco staff members receive instruction about the policies, procedures, and regulations included in the DOM and the California Code of Regulations, which mandate the policies and procedures Wasco must follow regarding confidential information and security. In particular, the DOM clearly defines what constitutes confidential information and outlines the responsibility of staff to secure and protect all confidential information and to prevent its disclosure to unauthorized individuals. The DOM also clarifies and limits the types of written documents to which inmates may have access, and it specifically excludes any type of confidential information. In addition to covering these regulations, the mandatory orientation also introduces staff to a variety of skills needed to work in a prison setting, including ways to secure information and the importance of maintaining a heightened awareness when working around inmates. These skills are reiterated and reinforced when employees complete a required combined minimum of 40 hours of formal and on-the-job training each year. Many available training classes also discuss the importance of staff vigilance: Courses cover correctional awareness, inmate/ staff relations, the danger of overfamiliarity with inmates, universal precautions, and information security. In fact, the inmate/staff relations and universal precautions courses are part of the annual training required for all job classifications. Thus, the training requirements and available courses appear to address sufficiently the need for staff vigilance at all levels. However, with the exception of a limited number of A formalized process of state mandated courses in which course evaluations are course evaluations would required, Wasco generally leaves to the discretion of the provide management individual instructors the decision whether to request course with valuable feedback. evaluations from participating staff. We feel that a formalized process of course evaluations would give management a good mechanism for feedback and for confirming that training courses are adequately providing staff with the necessary tools to work in a correctional environment. Moreover, while we found that Wasco’s management generally reacts well when incidents affecting the security of its staff arise, we also noted that managers do not employ preventive measures to ensure that staff comply with its policies and procedures in the absence of a specific security breach. Without 34 C A L I F O R N I A S T A T E A U D I T O R such measures and monitoring, Wasco’s management may be allowing a complacent or lax atmosphere to continue among its staff. WASCO ACTED PROMPTLY TO RESOLVE RECENT CRISES, BUT MANAGEMENT SHOULD TAKE FURTHER ACTIONS TO AVOID FUTURE PROBLEMS After the series of incidents in which inmates gained access to confidential information, Wasco took specific actions in order to While Wasco’s minimize any negative impact and reiterated policies to avoid management generally future recurrence. In general, we found that Wasco management responds well to security reacted in a prompt, appropriate manner to protect its staff and breaches, it does not improve the safeguarding of confidential information. However, employ proactive even after management had taken these precautionary measures, measures to ensure we identified additional staff members who should have been compliance with its alerted that their personal information may have been compro- policies and procedures. mised, and we also noted instances in which staff still failed to follow security policies for the shredding of documents and the distribution of inmate forms. Because of the sensitive nature of the compromised information found in the storage closet and the potential threat it posed to the safety of staff and their families, management took quick action to mitigate potential negative ramifications. Within three to four working days, which is a reasonable time period, management had informed all staff included on the inmate’s list. Wasco management waited to notify those persons affected until its investigators completed the fundamental elements of the internal investigation. Once the investigators had deter- mined the extent of the problem, the employee relations officer notified all staff included on the inmate’s list. Nonetheless, despite Wasco’s prompt and seemingly appropriate actions, we identified additional staff that we feel Wasco man- agement should have notified. Specifically, we noted that the names and social security numbers of two additional staff appeared on the same time sheets from which the inmate’s list appeared to be compiled. In each case, the name and social security number of the staff member were the last entries on the time sheets; all other staff on these same time sheets appeared on the inmate’s list. We also determined that another staff member’s time sheet was located in the same box from which the inmate had obtained the other information. However, C A L I F O R N I A S T A T E A U D I T O R 35 Wasco management did not inform these three people that their confidential information might have been compromised. We feel that, considering the financial and security risks involved, management would have been prudent to notify these staff members as well to provide them with the opportunity to take any precautions they deemed necessary. After we brought this fact to management’s attention, the warden had his staff contact the three individuals. After a Wasco correctional officer found the inmate’s list in the janitorial closet, Wasco officials also conducted a series of searches throughout the prison to establish if other inmates possessed confidential information and, more importantly, to identify the inmate responsible for creating the list. To find this individual, Wasco management ordered cell searches of all inmates who had been assigned to work in or around the janito- rial closet between December 1997 and February 1999. This cell search had two goals: identifying the inmate responsible for creating the list and ascertaining if other inmates assigned to that area possessed confidential information. The search was successful in pinpointing the responsible inmate and in deter- mining that no other inmates possessed sensitive information.7 Next, to avoid a reoccurrence of the problem, Wasco manage- ment issued a series of memorandums to all staff that reiterated the prison’s policies regarding the proper handling and storage In reaction to the of confidential information. Many of these memos highlighted problem, management the importance of staff maintaining a vigilant attitude and issued a series of appropriately safeguarding the security of sensitive information. memorandums on the Additionally, some memorandums outlined new policies, such proper handling of as elimination of the informal practice of creating “convenience confidential information. copies.” Specifically, management directed all staff to cease copying time sheets or any other documents containing per- sonal information. Prison staff were instructed that confidential forms could only be retained in secured areas; for example, Wasco would store time sheets in the personnel office that is accessible only to prison staff. We believe that eliminating the practice of making convenience copies should help to reduce the amount of sensitive information present in the prison. 7 In addition to the cell search, Wasco management also carried out two additional searches of the general prison population. Management conducted the first search the day following the list’s discovery, with an additional search performed the following week. These searches did not uncover any additional confidential information. 36 C A L I F O R N I A S T A T E A U D I T O R To further eliminate extraneous copies of confidential information, Wasco management established policy guidelines for the shredding of confidential documents. In particular, management directed all staff to review active, supervisory, and other types of files in order to purge and shred all personal information concerning staff. Although we agree that Wasco should shred unnecessary documents, we did not find evidence that staff kept logs of the shredded documents, in spite of management’s directive to do so. Because Wasco did not retain logs, and because the staffs’ initial shredding of existing documents occurred in reaction to the warden’s directive and before our visit, we were unable to determine the volume and nature of confidential information to which inmates had access. Another new policy changed how time sheets identify staff. Management now requires that time sheets list only the last four digits of the employee’s social security number, along with their full name. This change in policy reduces the risk of a staff person’s social security number being compromised. Wasco management communicated these policy changes through the prison’s monthly staff training bulletins, memorandums to all staff, and additional memorandums distributed to supervisors and managers. These policy directives, if followed, should improve the security of confidential information and reduce the risk that anyone could use this information inappropriately. Nevertheless, in spite of these corrective actions, we still have some concern about how management will ensure that staff comply with its policies. Specifically, we discovered that after the In spite of corrective warden had issued a directive mandating the elimination of the actions taken, we still State Compensation Insurance Fund form from any file other have some concern than the claim file in the health and safety office, staff contin- about how management ued to use an old document checklist calling for a copy of this will ensure compliance insurance form. This practice continued despite the fact that the with policy. checklist had also been revised. Because staff members that compile the documents provided to inmates during disciplinary hearings use this checklist to make certain inmates receive all required documents, use of the old checklist could potentially lead to inmates once again receiving inappropriate information. This example highlights the need for Wasco management to monitor whether staff put new policies into practice. C A L I F O R N I A S T A T E A U D I T O R 37 CONCLUSION In the past, the improper storage of confidential information coupled with a general breakdown in staff vigilance resulted in Wasco inmates obtaining confidential information that placed staff members and their families at risk. We found that while staff receive appropriate training to be vigilant around inmates and to secure and protect confidential information, few manage- ment controls are in place to ensure that they follow security policies and remain vigilant around inmates. In reaction to the recent breaches of security, Wasco’s management has acted swiftly to implement various corrective actions that, if followed, should improve security and avoid a recurrence. However, these actions will be in vain if top management does not set the tone for vigilance by strengthening its efforts to ensure that staff follow its policies and practices concerning staff watchfulness and information security. RECOMMENDATIONS To ensure the safety of staff, Wasco’s supervisors and managers need to cultivate an atmosphere of vigilance by setting an example with their own behavior and by closely monitoring staff interactions with inmates. When they observe staff exhibit- ing lax behavior, managers need to intervene promptly. To avoid future problems involving the security of confidential information, Wasco should take these measures: • Incorporate into its procedural manuals the recent manage- ment directives concerning the storage and duplication of confidential information. • Ensure that staff use control logs to record documents sched- uled for shredding. To eliminate the unnecessary risk of allowing inmates access to detailed plans of its institutions, the CDC should amend its policy and restrict such access. 38 C A L I F O R N I A S T A T E A U D I T O R We conducted this review under the authority vested in the California State Auditor by Section 8543 et seq. of the California Government Code and according to generally accepted government auditing standards. We limited our review to those areas specified in the audit scope section of this report. Respectfully submitted, KURT R. SJOBERG State Auditor Date: October 15, 1999 Staff: Doug Cordiner, Audit Principal Dale A. Carlson, CGFM John F. Collins II, CPA Tyler Covey, CPA, CMA Leah Northrop C A L I F O R N I A S T A T E A U D I T O R 39 Blank page inserted for reproduction purposes only. 40 C A L I F O R N I A S T A T E A U D I T O R Agency’s response provided as text only. California Department of Corrections Wasco State Prison Memorandum Date : October 4, 1999 To : Kurt R. Sjoberg State Auditor Bureau of State Audits Subject: RESPONSE TO BUREAU OF STATE AUDITS REPORT This memorandum serves as Wasco State Prison-Reception Center’s (WSP) and the California Department of Corrections’ (CDC) response to the issues identified in the recent Bureau of State Audits report concerning maintenance and security at WSP. The following provides our response and respective action plans to those areas of concern. WASCO’S FAILURE TO REPAIR AND MAINTAIN CRITICAL EQUIPMENT JEOPARDIZES INSTITUTIONAL SAFETY Audit findings revealed that: 1) Wasco has not completed emergency repairs and scheduled maintenance in a timely manner; 2) Wasco ignored critical electrical problems that eventually caused a complete power outage; and, 3) Wasco’s failure to properly maintain its emergency equipment could cause further problems in the future. Wasco State Prison has begun a comprehensive re-evaluation of all outstanding Priority 1 and Priority 2 repair/maintenance requests. Previously misclassified requests will be properly identified. Upon conclusion of the re-evaluation, remaining Priority 1s will be quickly addressed, with the objective being a 24-hour turnaround. Additionally, remaining Priority 2s will be addressed with all reasonable efforts being employed to complete such requests within 15 days. Future requests will be completed within these respective time frames contingent upon staffing, budget constraints and materials. Additionally the CDC is implementing an automated preventive maintenance system that will help resolve many of these issues. Effective immediately, the practice of allowing a non-supervisory/non-trades person to categorize work orders will cease. All work order requests will be categorized daily by a supervisor skilled in Plant Operations’ equipment and maintenance requirements. C A L I F O R N I A S T A T E A U D I T O R 41 Kurt R. Sjoberg Page 2 The CDC will actively pursue the staffing of vacant WSP Plant Operations’ positions. Such hiring would be subject to workloads, maintenance priorities, both long and short term, and appropriate budget constraints. Additional training will be provided to maintenance staff through their respective area supervisors and managers. A main focus of this additional training will concern proper documentation of completed work. The failure to document completed work was clearly addressed in your audit. SIGNIFICANT WEAKNESSES EXIST IN WASCO’S EMERGENCY READINESS Audit findings revealed that: 1) Due to a lack of training and drills, many staff were unprepared for the recent power outage; 2) Emergency operation plans do not adequately address procedures to follow in the event of a complete power failure; 3) Testing of emergency plans could have revealed deficiencies in Wasco’s emergency equipment; and, 4) Wasco’s handling of the recent power outage raises concerns about its preparedness for the Year 2000. Upon review of the power outage incident (04/12/99), WSP found its existing operational procedures regarding power outages to be lacking specificity. In response to the lack of specific directives, WSP is undergoing an internal process to identify and correct this deficiency. WSP is currently doing a full load emergency simulation test twice a month. The CDC will develop and incorporate a more comprehensive Power Outage Operational Procedure into its master emergency response manual. It should be noted that WSP will continue to conduct quarterly power outage drills. The record of all tests and drills will be kept in a logbook within Plant Operations. Upon completion of WSP’s Power Outage Operational Procedure, scheduled formal training will be undertaken by November 1, 1999. This training will ensure that all institutional staff understand their job responsibilities and emergency responses during a power outage. After this initial training, which will include live simulation, the institutions’ In Service Training department will schedule periodic training and follow-up. Additionally, the Emergency Operations Unit (EOU) of the Department of Corrections, shall prepare a format for an Emergency Operations Plan Resource Supplement specifically relating to power failures. The EOU shall route this format to each prison, along with a directive to each warden ensuring the Power Resource Supplement is amended. This amendment is to include the specific procedures necessary at their respective prison to manage such an event. This initial Power Resource Supplement preparation and routing shall be accomplished by November 1, 1999. Additionally, a final response date from the respective wardens of December 1, 1999, for the finalized amendment of their individual Resource Supplement shall be given. 42 C A L I F O R N I A S T A T E A U D I T O R Kurt R. Sjoberg Page 3 WSP has requested and received permission from EOU to accelerate the planned disturbance exercise for Y2K compliance at WSP to the first or second week of November 1999. During this exercise there will be a functional testing of the institution’s Y2K contingency plan. This functional testing will be in addition to the already scheduled desktop exercise. Any deficiencies noted will be immediately addressed and resolved prior to the end of the year. Phase I testing of time sensitive embedded computer chips and a risk assessment has been recently completed. Phase II testing is underway with an anticipated completion date of October 8, 1999. The fire alarm system time recorder remediation was completed September 14, 1999. A contract has been initiated for the personal alarm and fire alarm computer remediation. We recognize the urgency of addressing any remaining non-compliant item(s) from Phase I and any new issues that may surface in the Phase II testing. Priority has been given to those systems which provide support for the primary security of the institution. We are committed to resolving problem areas that might arise from any Y2K embedded system failures. In order to prepare for any possible future power losses, CDC has substantially upgraded its emergency lighting and power backups at WSP. Included in this package of additional resources are: 1) 500 KVA transformer; 2) approximately 150 additional indoor battery-powered emergency lights; 3) 20 standing light systems; and, 4) approximately 50 portable battery-power lights with substantial battery backups. All items are in the possession of WSP and are fully functional. The functional aspects of these additional items will be re-tested during the emergency exercise scheduled for November 1999. AS A RESULT OF WEAK MANAGERIAL OVERSIGHT AND A LACK OF STAFF VIGILANCE, INMATES AT WASCO GAINED ACCESS TO CONFIDENTIAL INFORMATION Audit findings revealed that: 1) Staff did not appropriately safeguard confidential information and were lax in supervising inmate workers; 2) Several inmates had access to a closet in which confidential records were stored; 3) An inmate used information obtained from an incident package to threaten a correctional officer; 4) The CDC’s policy allows inmate access to a detailed map of the institution and the surrounding area; 5) Prior to April 1999, convenience copies of confidential records were not stored securely as required by the CDC; 6) Although the need for vigilance is addressed in both institution policy and staff training, Wasco’s management lacks effective methods for ensuring it occurs in practice; and, 7) Although Wasco acted promptly to resolve recent crises, further actions should be taken to avoid future problems. C A L I F O R N I A S T A T E A U D I T O R 43 Kurt R. Sjoberg Page 4 The CDC’s vision and philosophy has always been toward professionalism, and the Department encourages professional standards in all its employees. We do appreciate an outside look at policies and procedures and the recommendations of your office will provide the opportunity to correct any oversights that may have been identified. 1 * The individual failures/oversights of a few supervisory and management employees were mistakes in judgement. These mistakes have been addressed via corrective action with the responsible individuals. As noted in this section, CDC has taken immediate steps to remedy the identified 1 areas of concern, at Wasco and all institutions. Several institutional policy memos have been generated and implemented regarding staff personal information. These directives are now being compiled into an operational plan. This operational plan will be formalized and made part of WSP formal procedures within 30 days. The CDC will also be revising existing procedures regarding document retention and shredding schedules. All necessary changes will be incorporated into institutional operations plans. These plans will also include the implementation of shredding logs. This plan will be functional within the next 30 days. The CDC appreciates the BSA comments in regards to institutional plot plans. CDC is currently reviewing policy and procedures to ensure that inmates are not being allowed any inappropriate access to information which would jeopardize institutional security. Such plans, to the extent that they do not jeopardize safety, are utilized in the facilities under the direction of staff for the maintenance of the institution and for construction projects. Summary Be assured that CDC has taken immediate steps to ensure the safety of the community, its staff and inmates as it relates to the items identified in your report. Many additional policies and/or revisions have been implemented to prevent a reoccurrence of the incident(s) cited. In addition to this clarification of policy, hands-on training through the institutions’ IST will be provided. The CDC has an outstanding record in preventing disturbances and protecting public safety. At no time during the incidents cited was there a breach of security which jeopardized the public, nor were there any serious injuries incurred by staff or inmates at the prison. * California State Auditor’s comments on this response appear on page 47. 44 C A L I F O R N I A S T A T E A U D I T O R Kurt R. Sjoberg State Auditor Bureau of State Audits Date Page 5 The Warden and members of his administrative staff reported to the institution immediately to personally observe and coordinate staff responses. These administrators remained on duty until operations returned to normal. Many of the items identified in the report as needing correction and/or clarification have already been addressed by Wasco administration prior to the initiation of this audit. Since inception of the audit, WSP and the surrounding community experienced a large-scale electrical blackout. WSP’s emergency generators, electrified fence and emergency lighting worked as designed. As such, the prison was able to function normally without incident while maintaining the safety of the community, its staff and inmates housed therein. I appreciate the opportunity to respond to the issues identified by your audit team. I would also like to commend your staff for the professional manner in which they conducted the audit. Should you have any additional questions or concerns regarding this response, please contact David Tristan, Deputy Director, Institutions Division, at (916) 445-5691, or Elizabeth A. Mitchell, Assistant Director, Office of Compliance, at (916) 358-2494. (Signed by: C.A. Terhune) C. A. TERHUNE Director Department of Corrections cc: David Tristan, Deputy Director, Institutions Division Elizabeth Mitchell, Assistant Director, Office of Compliance Bill Dieball, Assistant Deputy Director, Institutions Division Jan Polin, Chief, Institutions Maintenance Unit R. L. Candelaria, Warden, Wasco State Prison C A L I F O R N I A S T A T E A U D I T O R 45 Blank page inserted for reproduction purposes only. 46 C A L I F O R N I A S T A T E A U D I T O R COMMENTS California State Auditor’s Comments on the Response From the California Department of Corrections and Wasco State Prison T o provide clarity and perspective, we are commenting on the response to our audit report from the California Department of Corrections and Wasco State Prison (Wasco). The number below corresponds to the number we have placed in the response. 1 We acknowledge on pages 32 and 36 that Wasco reacted swiftly to breaches in security by disciplining one officer and issuing a series of memorandums to all staff reiterating the prison’s policies regarding the proper handling and storage of confidential information. However, we are still concerned that these two actions alone will not ensure that staff remain watchful and that policies are followed without supervisors and management setting a tone for vigilance by actively monitoring staff interactions with inmates and intervening when necessary. C A L I F O R N I A S T A T E A U D I T O R 47 cc: Members of the Legislature Office of the Lieutenant Governor Attorney General State Controller Legislative Analyst Assembly Office of Research Senate Office of Research Assembly Majority/Minority Consultants Senate Majority/Minority Consultants Capitol Press Corps 48 C A L I F O R N I A S T A T E A U D I T O R