Where have the Apple products that the University of Évry has purchased since 2019 gone?
The Court of Auditors notes that they are not recorded in the inventory. And they are not the only digital devices in this situation. Computers, tablets, phones, projectors, or audio equipment that are not inventoried amount to a total of €8.4 million.
According to the university, this can be explained by negligence in organizing the tracking of equipment… or by theft.
There are indeed no formal procedures when an employee leaves. Coupled with the lack of coordination between HR and the IT department (DSI), the IT equipment is often not returned, with no consequences for the person involved. A symbol, in the Court’s view, of weaknesses in the purchasing strategy in a tight-budget context.
Purchases are carried out in a decentralized manner, with 42 managers drawn from laboratories, UFRs, IUTs and other central services, responsible for entering data within their respective scopes. Consequently, the Purchasing Department exercises no control over expenditures below €40,000. This organization contributes to a high rate of off-contract purchases, particularly in IT. A reflection of insufficient awareness of the rules of public procurement, to borrow the words of the sages on Rue Cambon.
Purchasing controls frequently circumvented…
Despite the principles set by the board, the university has several channels for acquiring and tracking IT equipment.
In principle, any acquisition — whether for investment or operating purposes — of so-called “high-demand” assets must be submitted to the Administrative Council for IT Resources (CARI). But exceptions are provided. Routine requests, in particular, are approved without examination. More problematically: the CARI effectively handles only requests expressed by central services and shared services. UFRs, laboratories and IUTs can draw from their own budgets. As for requests from vice-presidents and service directors, they are handled by the Director of the IT department (DSI), again without passing through the CARI. Such a setup does not yield a comprehensive view of IT equipment.
Requests are, moreover, accompanied by lacunary justifications. Even when they are costly. They are rarely refused, if at all questioned. The Court of Auditors views this as evidence of a lack of understanding of actual needs. It also notes that when requests are made following a theft, filing a police report is not systematically requested.
… as with the IT department
By ordering on their own budgets, the faculties and central services sidestep the DSI’s oversight. And, in so doing, bypass the constraints imposed on equipment used for professional purposes (access controls, among others). This situation is made possible by users’ reluctance to install the DSI’s tracking software on every phone and computer — to which are supposed to be affixed inventory tags bearing an identification number.
The difficulties in controlling the IT estate also stem from the creation, by some components, of locally managed Wi‑Fi networks, with no control by the DSI.
In this context, the Court of Auditors calls for more formalization of procedures. And to centralize them by routing them through a single entity, such as the CARI.
* The University of Évry is an associated member of the University Paris-Saclay, of which it adopted the statutes in 2019. It was initially slated to merge with this EPE, but will ultimately move toward the status of an integrated university, preserving its legal personality.
