Outdated Infrastructure

an outdated desktop computer displaying giraffes on the monitor

Why we did this audit

We completed a risk assessment of technology in several city agencies, resulting in this planned audit. This audit assessed the zoo’s management of technology approaching or having reached the end of its life — including examining the zoo’s strategies for outdated technology management and evaluating the timing and extent to which systems were maintained to reduce the risk of outdated technology.

Key facts

  • The Denver Zoo Conservation Alliance’s Information Technology team provides IT support and services to an 80-acre campus with over 2,500 animals, almost 400 staff, 600 volunteers, the board of governors, the leadership council, and nearly two million visitors a year.
  • In October 2024, US News and World Report ranked the Denver Zoo in the top 27 zoos in the United States.
  • The Denver Zoo received accreditation from the Association of Zoos and Aquariums — setting it apart as one of only 238 institutions in the world to achieve the certification.
  • The 22,000-sq.-ft. Helen and Arthur E. Johnson Animal Hospital was honored by the Association of Zoos and Aquariums with a 2023 significant achievement in facilities award.

Why this matters

IT hardware and software needs updating to help organizations innovate and use technology to better serve its stakeholders.

When vendors stop supporting the product, the product is not provided with security updates or spare parts, which may allow bad actors to perform cyberattacks.

Findings

FINDING – The Denver Zoo Conservation Alliance is managing the risk of outdated infrastructure, but processes can be improved

  • The Denver Zoo Conservation Alliance's IT team tracked and monitored its IT equipment inventory. Additionally the zoo identified IT equipment needing replacement before it reached its end of life.

  • The zoo replaced older equipment as needed or appropriately managed the limited use of outdated technology equipment.

  • Refinements in processes are needed to improve the documentation of tracked IT equipment. The risk associated with the use of outdated infrastructure needs to be documented and the IT database inventory should be reconciled with the IT management software inventory.

  • The zoo's IT team should update its risk acceptance procedures. A documented process to ensure risk acceptance is appropriately approved is needed. Documented processes will ensure the decisions are aligned with policy and risk tolerance.

Recommendations

1.1 Reconcile information technology equipment with inventory – The Denver Zoo Conservation Alliance should perform a reconciliation of its IT equipment database with its IT equipment management software records. Then decide whether any equipment not currently being managed should be retired or have the software installed — allowing it to be tracked by the management software.

Denver Zoo Conservation Alliance – Agree, Implementation Date– Sept. 30, 2025

1.2 Update policies and procedures – The Denver Zoo Conservation Alliance should update its policy by documenting the definition of what outdated infrastructure is and how the risk is accepted and documented for outdated infrastructure to reduce the risk of knowledge loss from staff turnover.

Denver Zoo Conservation Alliance  – Agree, Implementation Date – Sept. 1, 2025

Auditor's Letter

July 17, 2025

We audited the outdated infrastructure processes performed by the Denver Zoo Conservation Alliance to assess whether it is effectively managing the risks of outdated infrastructure. I now present the results of this audit. In addition, we audited three other city agencies. Due to their sensitive nature, our findings are confidential and were communicated to the relevant agencies separately.

The audit found the Denver Zoo Conservation Alliance is effectively managing the risk of outdated infrastructure in its technology environment and had minor process and policy enhancements to make to improve its processes and reduce the risk to a low level.

By implementing recommendations for stronger processes and policies, the Denver Zoo Conservation Alliance will be better able to identify and manage the risks of outdated infrastructure.

This performance audit is authorized pursuant to the City and County of Denver Charter, Article V, Part 2, Section 1, “General Powers and Duties of Auditor.” We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

We appreciate the leaders and team members at the Denver Zoo Conservation Alliance who shared its time and knowledge with us during the audit. Please contact me at 720-913-5000 with any questions.

Denver Auditor's Office

Auditor's Signature
Timothy O'Brien, CPA, Auditor

Timothy O'Brien Official Headshot

AUDITOR TIMOTHY O'BRIEN, CPA
Denver Auditor

Denver Auditor's Office

201 W. Colfax Ave. #705 Denver, CO 80202
Email: auditor@denvergov.org
Call: 720-913-5000
Follow us on Facebook     Connect with us on Twitter

Auditors Office Logos for Footer: Denver Auditor, Denver Labor

Back to top