Document View

While the public believes auditors examine costs and financial records, auditors can serve the public interest in another way-by helping prevent terrorist attacks. Performance audits provide information that can be used to improve operations, help decision-makers oversee or initiate corrective action and contribute to public accountability. The term performance audit is used generically to include program evaluations, program effectiveness and results audits, economy and efficiency audits, operational audits and value-for-money audits. In performing their duties, the auditors need to stay alert for ways to protect their organization's assets and recognize the effect those assets can have on the surrounding community and the nation at large. In examining this issue, this article will concentrate on the possibility that terrorists may use a "dirty bomb" and how auditors can help make access to the necessary materials more difficult for international terrorists.

Enlarge 200% Enlarge 400%

Enlarge 200% Enlarge 400%

Serving the Public Interest

While the public believes auditors examine costs and financial records, auditors can serve the public interest in another way-by helping prevent terrorist attacks. Performance audits provide information that can be used to improve operations, help decision-makers oversee or initiate corrective action and contribute to public accountability. The term performance audit is used generically to include program evaluations, program effectiveness and results audits, economy and efficiency audits, operational audits and value-for-money audits.2 In performing their duties, the auditors need to stay alert for ways to protect their organization's assets and recognize the effect those assets can have on the surrounding community and the nation at large. In examining this issue, we will concentrate on the possibility that terrorists may use a "dirty bomb" and how auditors can help make access to the necessary materials more difficult for international terrorists.

How real is the dirty bomb threat? The Associated Press, quoting a team of nuclear researchers, reported that "Terrorists are all but certain to set off a radiological weapon in the United States, since it will take authorities too many years to track and secure the radioactive materials of such dirty bombs." The June 18, 2004 report went on to say that "... thousands, possibly tens of thousands, of high-risk radioactive sources are already in use worldwide, with few accurate registries for tracing them.. ."3 Consequently, the threat is real, but what is a dirty bomb and what kind of radioactive materials are we talking about?

A dirty bomb, also known as a radiological dispersion bomb, consists of a conventional explosive packaged with radioactive material. It's cruder and cheaper than a nuclear bomb, and a lot less effective. Basically, the explosives produce a very hot, rapidly expanding gas that disperses the radioactive material over a wide area.4 The smaller the particles, the greater the dispersal. Also, depending on the type of nuclear material used, the longer the area is contaminated. Those radioactive materials with a very short half-life-the time it takes for half the radiation to decay-are probably not much of a threat. After all, the terrorists want the maximum damage, which means they want the radiation to last as long as possible. Mohamed El Baradei, director-general of the International Atomic Energy Agency stated in May 2004 "... to protect ourselves from nuclear terrorists... We need to adjust our defenses...The first line of defense is having adequate protection of nuclear material." Improving the protection of nuclear material is where the auditor comes in.

Orphan Sources

After World War II, the Atomic Energy Commission, a predecessor to the U.S. Department of Energy, wanted to create a market for radioactive material to ensure a ready supply for making nuclear bombs. It encouraged industry to find peaceful uses for radioactive material. At the time it seemed like a good idea: create a new industry, increase employment and help out national security at the same time. No one at that time dreamed what we would be facing almost 60 years later. The industry was created. Nuclear materials found their way into everyday life-medicines, construction and oil well-drilling equipment, food preservation, university research and smoke alarms. AU was well until this equipment grew obsolete. Industry started to dispose of the equipment in the way they disposed of everything else-they threw it away. Bad move. By throwing the equipment away we created orphan sources.

Orphan sources are sealed sources of radioactive material in a small volume container in any one or more of the following conditions:

* In an uncontrolled condition that requires removal to protect the public health and safety;

* Controlled or uncontrolled environment where the responsible party cannot be identified;

* Controlled environment, but the material's security cannot be assured;

* In the possession of a person, not licensed to possess the material; or

* In the possession of a state radiological protection program, but the state does not have the appropriate means to dispose of the material.5

So we are talking about radioactive sources that are not under the best control. But, how prevalent are they? How real is the threat?

According to the Environmental Protection Agency's website, if equipment containing these sealed sources is improperly disposed of or sent for recycling as scrap metal, the sources may be lost and end up in a metal recycling facility or in the possession of someone not licensed to handle the source. According to some estimates, there may be more than 30,000 orphan sources in the United States today. These orphan sources are one of the most frequently reported radioactive contaminates in shipments received by scrap metal facilities.6 Where do we find these sources? Everywhere.

* Hospitals use small quantities of radioactive material, such as cesium-137 in nuclear medicine;

Enlarge 200% Enlarge 400%

* Food irradiation plants use cobalt-60 to kill harmful bacteria on food;

* Portable thermoelectric generators, such as those abandoned and scattered around the former Soviet Union, used sizable amounts of strontium-90.7

Other sources of unwanted radioactive materials could contain isotopes such as Americium-241, Plutonium-238 and 239, and Curium-244.8 Figure 1 shows how long-lived some of these isotopes can be.9 Your Site's Supply of Dirty Bomb Materials

Some may think that we only have to worry about the security of nuclear materials in far-off locations such as Russia or in the other former Soviet Union states. That is not the case. Orphan sources have been recovered in the U.S. from places as diverse as universities and hospitals. The point is orphan sources can be anywhere, even where you work. This issue was brought up in a recent article published in The White Paper. According to this article, something as simple as automated gauging equipment used to measure the thickness of metal sheets could contain radioactive material. The article raised the question of accountability and protection. Did the organization know where all of these machines were located and if they were protected?10 Does your site know what machines or supplies contain radioactive isotopes? How long do you keep accountability over them? Remember, a machine containing Americium-241 sealed sources may be obsolete and fully depreciated after a few years, but the sealed source will remain radioactive and dangerous for hundreds of years. Does your site have a plan for properly disposing of the sealed sources? Do you know whom to contact? These are important questions that need to be seriously considered.

An auditor's job is to assess risk. The U.S. Government Accountability Office put it this way, "Auditors are increasingly called on ... to expand the variety of performance audits to include work that ... provides guidance ... or information on issues that affect multiple programs or entities. ... This work may also include an assessment of policy alternatives, identification of risk and risk mitigation efforts."11

Accountability for radiological-sources should not be ignored. Terrorists do not care where they get the material to make a dirty bomb. They will go where the sources are the least protected. Auditors should espouse a proactive approach. For example, during a property accountability audit, program steps should be included to address this issue. Some suggested audit steps would be:

* Does the organization have any equipment, whether or not fully depreciated, that contains radioactive isotopes?

* What measures are used to protect the equipment, especially obsolete equipment that still contains the radioactive isotopes?

* If the equipment is no longer needed, what procedures are in place to properly dispose of the radioactive isotopes? A way to mitigate the risk surrounding these radioactive isotopes is to ensure the site contacts the necessary authorities to dispose of it properly. One option for disposal may be the Los Alamos National Laboratory's Off-Site Source Recovery Project (http://osrp.lanl.gov). Other options may be to contact the Environmental Protection Agency or your local state environmental offices. The key is to make sure the sources go to the correct site for proper disposal and are not left unprotected. If proper disposal does not take place, a terrorist could use the sources to do a tremendous amount of damage. Estimates for cleaning up populated urban centers hit by a dirty bomb range up into the billions of dollars. Making it more difficult for terrorists to obtain the material can alleviate this risk.

What Should Auditors Do?

A recent get-out-the-vote commercial may help answer this question. In the commercial, young people are standing in a restroom watching the water run in one of the sinks. After standing around wondering what they should do about it, one person finally walks up and turns off the water. The commercial ends by saying, "Don't just take a stand, act." What should the auditor do? Two things-obtain knowledge and act.

Enlarge 200% Enlarge 400%

The auditor needs to become educated about terrorism. What do terrorists want? How do they operate? What are the risks? We are a profession that understands risk-we have taught management and the public about internal controls for years. The public understands that if you do not establish certain controls, then the likelihood exists that an individual may commit fraud. Here we are not talking about fraud; here we are talking about national defense. Your best weapon is information. Two good sources are the Interagency OPSEC Support Staff website (www.ioss.gov/) and the Committee on the Present Danger (www.fightingterror.orgl). Recent comments by U.S. Senator Joseph Lieberman underscore this point.

"... To win the war on terrorism, we must better understand ourselves and our enemies. ... Equality. Opportunity. Democracy. Unity. Liberty. These are the values America stands for, the ideas that we are fighting for ... around the world. Those are the bright stars we must always chart our national course by."

In his "Declaration of the World Islamic Front for Jihad," issued in February 1998, [Osama] bin Laden says that "to kill Americans and their allies, both civil and military, is an individual duty of every Muslim...every Muslim who believes in God and hopes for reward [must] obey God's command to kill the Americans and plunder their possessions whenever he finds them and whenever he can."12

One thing we as auditors can do is to make it more difficult for terrorists to use dirty bombs against Americans. The first step is knowing the key materials used in dirty bombs. Talk to experts. Research the literature and then think about the sites you audit. Researching the issue is not enough, however. Since the terrorists may already know if your site has something they can use, you need to play catch-up and obtain that same knowledge. What sort of work is done at your site? Is there a product there that can be used as a weapon? What information does your site have that could benefit an adversary? Does your site have a reactor? Does your site store any form of nuclear materials? Once you get these answers you need to act.

First, the auditor should share the knowledge of the terrorist threat and what they have learned about their site's operations with as many people as possible. Remember, knowledge is key. The more people know, the better they can watch for vulnerabilities. Next the auditor should do what auditors do best-audit. Propose and perform audits that will look into your site's vulnerabilities. Figure 2 shows some possible audits.

These are just examples of audit types. Depending on your site's operations, there may be others. Break new ground, find the issues, propose audits and recommend ways to correct the weaknesses. This is what auditors do. Some of you may think, I am just an auditor, not a soldier. On the first day of employment federal auditors take an oath of office:

"I will support and defend the Constitution of the United States against all enemies, foreign and domestic, that I will bear true faith and allegiance to do the same; that 1 take this obligation freely, without any mental reservation or purpose of evasion; and that I will well and faithfully discharge the duties of the office upon which I am about to enter. So help me God."13

The answer is in the first line-we must help defend our nation. State and local auditors may take similar oaths, but you don't need to take an oath to be vigilant. The words of Thomas Jefferson should be in the minds of all auditors-federal, state, local and private sector-"The price of freedom is eternal vigilance."14

Enlarge 200% Enlarge 400%