U.S. Department of Energy 

Office of Inspector General 

Office of Audit Services 

Audit Report 

The Department's Audit Resolution 

and Follow-up Process 

DOE/IG-0766 May 2007 
Department sf Energy 

WasliingTon, DC 20585 

May 24, 2007 

MEMORANDUM FOR THMECRE5-TARY 

FROM: 

SUBJECT: 

Greg ry +* . Friedman 

Inspector General 

INFORMATION: Audit Report on "The Department's Audit 

Resolution and Follow-up Process" 

-- 

BACKGROUND 

Over the years, the Office of Inspector General has issued findings and recoinmendations 

addressing numerous aspects of the Department of Energy's programs, operations and 

management hnctions. In many cases, the Department has concurred with the findings 

and reported that corrective actions to resolve problems or improve the efficiency of its 

operations have been implemented. Clearly, ensuring that identified internal control 

weaknesses are addressed and corrected is essential to improving the effectiveness and 

efficiency of Departmental operations. 

The Office of Inspector General is tasked with periodically evaluating the Department's 

audit follow-up systems and assessing whether the systems result in effective, prompt, 

:rnd proper resolution of audit recommendations. As such, in February 2003, we 

reviewed The Department's Audit Resolution Process (DOE/IG-0639) and found that: 

(1) target dates for completion of corrective actions had not been established in all cases; 

(2) where target dates had been established, corrective actions taken had exceeded 

milestones; and, (3) recommendations had been closed even though corrective actions 

had not been taken. Shortly thereafter, as a result of the 2003 audit, the Department 

strengthened its audit resolution requirements, including requiring the establishment of 

target dates, timely closure of audit recommendations, and the implementation of 

corrective actions. We initiated the current audit to evaluate the Department's progress in 

correcting prior audit follow-up issues and to determine whether issues identified through 

recent Office of Inspector General audits had been resolved. 

RESULTS OF AUDIT 

We found that the Department had made significant improvemeilts to many aspects of its 

follow-up system. In particular, it had ensured that target closure dates were established 

for all agreed-upon recommendations and that, in most cases, audit recommendations 

were closed in a timely manner. However, we found that, in some cases, agreed-upon 

recommendations had been closed, but corrective actions had either not been completed 

or were ineffective. 

@ I'rnnlcd wilh soy inl: on rcryrled paper 
Our review of "closed" recommendations contained in six selected reports found 

significant continuing management issues relating to: 

Ensuring that employee badges were returned and security clearances were 

terminated as required; 

Tracking visits and assignments by foreign nationals; 

Consolidating duplicative nuclear material tracking systems; and, 

Resolving information technology security weaknesses. 

Effective corrective actions had not been taken, at least in part, because the Department's 

Program Offices and the National Nuclear Security Administration had not given 

sufficient management attention to the audit resolution and follow-up process. In some 

cases, corrective action plans developed at Headquarters and/or the National Nuclear 

Security Administration had not been communicated to sites or subordinate organizations 

for implementation. In other cases, the Department had not verified that all planned 

actions had been implemented or that officials had fully addressed and corrected the root 

causes of previously issued. Inspector General findings. In addition, although specifically 

required, Departmental elements that had not been parties to the initial reviews had not 

been examining OIG reports to determine whether the same or similar problems existed 

within their own organizations. 

As is more fully described in the report itself, progress was noted in several areas. 

Further, in a separate review on the Status of Prior E.xport Control Recomnzerzdatioizs ai 

the Department of Energy (INS-0-07-01), we found that recommendations specific to this 

program had been appropriately closed. IVonetheless, additional actions are needed. 

Consistent with the statutory mission of the Office of Inspector General, the audit process 

provides an important mechanism for assisting management in improving the 

performance of the Department and its programs. The audit follow-up and resolution 

process is critical to achieving this goal. Consequently, based on the findings in this 

report, we have provided several recommendations designed to make this process as 

effective and useful as possible. 

MANAGEMENT COMMENTS 

The Department and the National Nuclear Security Administration provided joint 

comments on the draft report and concurred with the recommendations. In particular, 

management agreed to issue guidance reemphasizing the requirements of the audit 

resolution and follow-up program and perform periodic follow-up activities to help 

ensure effective implementation of the guidance. The National Nuclear Security 

Administration added that it would formalize its certification methodologies for use by 

the site managers, the Service Center Director, and senior program officials in its 

organization. Management's comments have been incorporated into the report and 

included verbatim as Appendix 4. 
Aitaclment 

cc: Deputy Secretary 

Acting Under Secretary of Energy 

Under Secretary for Science 

Principle Deputy Administrator, National Nuclcar Security Administration 

Chief Financial Officer 

Chief Information Officer 

Chief of Staff 
REPORT ON THE DEPARTMENT'S AUDIT RESOLUTION AND 

FOLLOW-UP PROCESS 

TABLE OF 

CONTENTS 

Audit Resolution and Follow-up Process 

Details of Finding .............................................................................................. 1 

Recommendations and Comments ............................................................... I I 

Appendices 

1. Objective, Scope, and Methodology ........................................................... 14 

2. Audit Reports Reviewed. ............................................................................ 16 

? - 0 

2. rrior Reporis ............................................................................................... 1 o 

4. Management Comments ............................................................................ -20 
Audit Resolution Since our 2004 report was issued, the Department of 

Activities Energy (Department) has made significant ilnproveinents in 

establishing target dates designed to guide the co~npletion 

of corrective actions and in ensuring timely closure of audit 

recommendations. Our current review of all audit reports 

issued during the first half of 2005 disclosed that: 

Target dates for completion of corrective actions 

had been established in the Departmental Audit 

Report Tracking System (DARTS) for all 

recommendations we reviewed; and, 

Only 17 percent of the planned corrective actions 

exceeded closure milestones. 

Tbis is in c'ontrast to thr results identified In 3vr 3004 

report where target dates for completion of corrective 

actions had been established for only 56 percent of the 

recommendations and 57 percent of the corrective actions 

taken exceeded closure milestones. 

However, similar to our 2004 report, our analysis found 

that the Department continued to close certain 

recommendations even though corrective actions had not 

been taken. Specifically, for each of the six reports with 

"-lp~ndlt -o,-prnp,n-rl-t;--c 2. -Trh;rh rrr, -n r.V.,i- I rVVIILIIILAIUrlLIULLd *, v v - Lrfcmz? izdepth reviews, we found that at least one previously 

identified issue had not been resolved. F& example, we 

found continuing issues with employee badging and 

clearances, foreign national visitor access controls, project 

management, nuclear material tracking systems, and 

information technology security. 

Badging and Security Clearances 

Our audit of Persorznel Security Cleara~zces and Badge 

Access Controls at Selected Field Locations (DOEIIG0582, January 2003) identified significant error rates in the 

Departnlent's official clearance information database 

(Central Personnel Clearance Index, or CPCI) for Savannah 

River Site (Savannah River) and Sandia National 

Laboratories (Sandia). We also identified that a 

statistically significant number of badges had not been 

recovered from former contractor and other non-federal 

workers at the Oak Ridge Reservation (Oak Ridge). 

Management generally concurred with the 

recommendations in this report, agreed 

Page 1 ~etails of Finding 
to take corrective actions, and certified the effectiveness of 

those corrective actions in accordance with Department 

requirements. 

However, our recent analysis of CPCI indicates that these 

issues persist at three of the Department sites included in 

our January 2003 review. For example, 17 1 employees at 

the Y- 12 National Security Complex (Y - 12) were 

designated as "active" in the Department's CPCI system, 

but had been identified as "separated fiom duty" in the 

corresponding Y- 12 Human Resource system as of May 

2006. After allowing for potential timing differences and 

items that may have been discovered during quarterly 

reconciliations, we identified 142 employees who were no 

longer associated with the Department but still maintained 

an active security clearance. All except two of these 142 

individuals had "Q" clearances. 

Security clearances at East Tennessee Technology Park 

(ETTP) were also not always terminated fiom the CPCI 

system in a timely manner. Our analysis showed that, as of 

May 2006,34 employees (18 with "Q" clearances) who had 

reportedly worked at ETTP and should have had their 

security clearances terminated or transferred were still 

listed as active in the CPCI system. Of these employees, 

20 individuals had active security clearances in the CPCI 

system for over six months after their termination fiom 

ETTP. 

ETTP, in responding to the results of our testing, stated that 

they had been granted a variance allowing security 

clearances to be retained for 180 days beyond termination 

and this situation accounted for some of the termination 

discrepancies we identified. We noted, however, that the 

variance expired in January 2005, prior to the date many of 

these employees left ETTP. For seven of the cases, ETTP 

indicated that en~ployees had been transferred to 

subcontractors or other Department locations, however, we 

found that the clearance sponsor code in CPCI had not been 

changed as required. Finally, ETTP stated that nine of the 

employees we determined to have improperly retained 

clearances had never worked there - despite being listed in 

ETTP's human resources system and identified in CPCI as 

holding clearances sponsored by ETTP. 

Despite our findings, ETTP officials told us that their 

current security clearance administration process and 

Page 2 ~etails of Finding 
tracking activities were appropriate. They based their 

coi~clusion, in part, on a security survey completed by Oak 

hdge Operations that rated their program as satisfactory. 

The survey was completed in February 2007, just over four 

years after the completion of our January 2003 review. 

Finally, the previously reported issue of not recovering 

badges from former employees has also not been 

conlpletely resolved by the Department's contractors. For 

example, two recently issued Office of Inspector General 

(OIG) reports found that a number of terminated employees 

had not returned their security badges to Sandia and Los 

Alamos National Laboratories (Los ~lamos)' as required. 

Similarly, the Oak Ridge Operations Security Survey noted 

above included a finding that ETTP was not immediately 

regortins lost. stolen. missing. and non-recovered badzes to 

the Department. 

Foreign National Visitor Access 

Our audit of The Depa~tlnent's Unclass~jied Foreign Visits 

and Assignnzelzts Progranz (DOEIIG-0579, December 

2002) d~tellliiiled tlist ihe Depai-tiiieiit llad ilot adcqilzitelj; 

controlled unclassified visits and assignments by foreign 

nationals at two national laboratories. Specifically, we 

fniind that not all fnr~ign nationals had ciirrent ~ass~orts 

and visas and that sites had not reported sufficient 

information to enable the Department to properly track all 

foreign visitors and assignees in the Foreign Access Central 

Tracking System (FACTS). FACTS is the Department's 

official national database of information on unclassified 

foreign visits and assignments. The Department generally 

agreed with our findings, conclusions, and 

recommendations; initiated immediate corrective actions; 

and ultimately certified the effectiveness of those corrective 

actions. However, our current review found evidence that 

these issues persist at at least one of the Department sites. 

Our current review of the same Office of Science-managed 

national laboratory analyzed in our prior report identified that 

the local foreign national visits and assignments system still 

did not have sufficient information. For example, a total of 

4,911 of its 7,802 (63 percent) foreign national visits and 

I Badge Retrieval and Security Clearance Termiizatioiz at Sandia National Laboratoiy-New Mexico 

(DOEIIG-0724, April 2006) 

Security and Other Issues Related to Out-Processing of Ei7zployees at Los Alanzos National Laboratoiy 

(DOEJIG-0677, February 2005) 

Page 3 Details of Finding 
assignments from January 2005 through April 2006 did not 

have complete or valid information related to passports and 

visas. In addition, our comparative analysis revealed that 

FACTS records from that same time period indicated that 

the national laboratory had 8,340 visits and assignments, 

while the laboratory's local system only listed 7,802. 

Additionally, the Department has identified similar issues 

during its own site-specific reviews of foreign national 

access controls. During reviews conducted by the Chicago 

Operations Office in September 2003 and September 2005, 

officials found that the same national laboratory was not 

consistently entering visits and assignments information 

into FACTS and was not closing out visits and assignments 

as specified in Departmental directives. While the 

existence of the Departmental reviews indicates that this 

area is periodically being evaluated, the consistently 

negative results also tend to demonstrate that the national 

laboratory is not effectively correcting the issues we 

reported in December 2002. Due to the complex nature of 

this issue and potential national security implications, we 

have initiated a separate audit of the Department's Foreign 

Visits and Assignments program. 

Project Management 

In our February 2001 audit of the U.S. Department of 

Energy's Corporate Human Resource Information Systeiiz 

(DOEIIG-0494), we determined that the Department had 

not adhered to project planning requirements for system 

development projects - including updating its cost benefit 

analyses to reflect project delays, cost increases, and scope 

changes. While the Department agreed to revise its cost 

benefit analysis to address the associated recommendation, 

a follow-up audit, 7ke Department's Development and 

Implementation of the Corporate Human Resource 

Information System (OAS-L-06- 14, May 2006), determined 

that it did not do so. Even though management officials 

performed analyses on one component of this system and 

on Fiscal Year (FY) 2006 and out-year costs and benefits, 

the effort did not provide an overall picture of the project's 

costfbenefit or its return on investment from inception. 

Without such analyses, management lacked the tools 

necessary to closely monitor project cost (approximately 

$37 million through FY 2005), schedule, and performance. 

Page 4 Details of Finding 
Nuclear Materials Tracking Systems 

Our report on Nz~clear Materials Accountirlg Sysfelns 

Modernization Initiative (DOEIIG-0556, June 2002) 

identified that the Department had not adequately managed 

its activities to redesign or modenlize its nuclear materials 

accounting systems. Moreover, planned and on-going 

system development efforts were not hlly consistent with 

the Corporate Systems Infom~ation Architecture. We 

recommended, among other things, that the Department 

develop a coordinated approach and select a final 

alternative for modernizing nuclear materials accounting 

information systems that was consistent with the 

Department's Corporate Systems Information Archtecture 

as well as security and program specific operational needs. 

However, in September 2002, the recomnlendations were 

closed in DARTS because of the Department's decision to 

track the status of the recommendations as part of the 

e-Gov Presidential Initiative (Initiative). According to a 

National Nuclear Security Administration (NNSA) official, 

tracking the reconlrnendations in DARTS was no longer 

needed because it would cause duplicative reporting on the 

status of these recomendztjons. 

In October 2002, an assurance letter was signed by a 

NNSA official that certified that all necessary actions had 

been taken for audit follow-up assessment and corrective 

actions pertaining to ths report's recommendations were 

complete even though the recommendations were still 

being addressed and tracked through the Initiative. 

However, almost three years and over $1.2 million later, 

the Nuclear Material Accountability (Nh4A) Project was 

terminated under the Initiative. In spite of management's 

assertion regarding closure, there was no final resolution of 

our recommendations. In addition, we could not locate or 

obtain fom~al documentation on the NMA Project's close 

out. As a result of the Initiative, management told us that 

some process improvements have been implemented while 

some are still on-going. Wle the improvements are a 

positive step, we do not believe that the Department has 

fully resolved the problen~s outlined over four years ago. 

NNSA provided technical comments to a draft of this 

report indicating that the method of resolution for this 

report was rare, if not unique. NNSA stated that they did 

work to resolve the concerns raised by the report through 

the e-Gov initiative, but that management made a decision 

Page 5 Details of Finding 
to terminate the initiative prior to resolution. While NNSA 

agrees that the recommendations made in the original 

report had not been addressed, they believe that they were 

not remiss in their duties. However, the issues identified in 

the report continue to exist. 

Information Technology Security 

We also observed that findings and recommendations made 

in our annual reports on The Department's Unclasszfied 

Cyber Security Program are often repeated from site-to-site 

or program-to-program. For example, our evaluation of the 

Information Technology Management Letter on the Audit of 

the Department of Energy's Consolidated Financial 

Statements for Fiscal Year 2005 revealed that 13 of the 25 

findings identified were the same or similar to findings in 

the FY 2004 management letter. This includes one finding 

related to computer security certification and accreditation 

that has been reported since 2002 at the Argonne National 

Laboratory and has been issued again as a repeated finding 

in FY 2006. Finally, a recent OIG report, Certzfication and 

Accreditation of Unclassz3ed Information Systenzs 

(DOEIIG-0752, January 2007) also identified that the 

Department's systems were not properly certified and 

accredited for operation. The report found that many sites 

had not properly assessed the potential risk to their systems. 

Portsmouth Conversion Line 

In our March 2004 audit on Depleted Uranium 

Hexafluoride Conversion (DOEIIG-0642), we concluded 

that the Department's plan for converting depleted uranium 

hexafluoride inventories could be improved by adding an 

additional conversion line to the Portsmouth facility. We 

recommended that the Manager at the site conduct a costbenefit analysis to determine the optimum size and 

operation of the Portsmouth depleted uranium hexafluoride 

conversion facility and based on the results of the review, 

implement the most cost-effective approach. While the 

Department performed a cost-benefit analysis in May 2005 

which showed that adding the fourth line to the Portsmouth 

facility could save $55 million, it had not implemented the 

most cost-effective approach to converting depleted 

uranium hexafluoride to a more stable form. A recent 

follow-up OIG report, Follow-up of Depleted Uranium 

Hexajluoride Conversion (DOEIIG-075 1, December 2006) 

noted that, as of August 2006, the Department had not 

Page 6 Details of Finding 
added the fourth conversion line even though it had begun 

construction of the facility eleven months earlier. 

Operational efficiencies and cost savings from an 

additional conversion line at the facility were still viable. 

Specifically, the Department could still save at least $35 

million in life-cycle costs by reducing the operations 

schedule by nearly five years if the fourth line is added to 

the project. 

Sufficient Management Previously identified deficiencies were not resolved, 

Attention at least in part, because the Department's program offices 

and NNSA did not give sufficient management attention to 

the audit resolution and follow-up process. In some cases, 

corrective action plans developed at the Headquarters level 

were not communicated to applicable sites for 

implementation. In other cases, the Department had not 

effectively verified that all planned actions had been 

implemented or that they had fully correctedaddressed the 

root causes of previously issued findings. In addition, 

Departmental elements not included in the initial review 

had not been reviewing OIG reports to determine whether 

there were "lessons learned" which could be applicable to 

their own organizations. 

Corrective Action Plans 

In some cases, corrective action plans developed by 

Headquarters program offices andor NNSA had not been 

communicated to applicable sites for implementation. 

Department policy requires that a corrective action plan be 

developed by the primary organization within the 

Department to address each open recommendation. 

Communication between Headquarters organizations and 

their applicable sites regarding implementation of 

developed corrective action plans is a vital part of the audit 

resolution and follow-up process. However, we identified 

some instances where this communication did not occur. 

For example, the January 2003 OIG report on badging and 

security clearances included recommendations addressed to 

NNSA Headquarters. However, NNSA Headquarters 

officials stated that they did not have a formal corrective 

action plan other than the actions in DARTS. We 

contacted an official from Los Alamos, one of the sites 

included in our original report, to deternine whether that 

site had developed a formal corrective action plan to 

address the open recommendations. The Los Alamos 

Page 7 Details of Finding 
official stated that NNSA Headquarters would have the 

responsibility for developing a corrective action plan for 

the Los Alamos site since the recommendations were 

addressed to Headquarters. At the time of our review, 

NNSA Headquarters had not transmitted a corrective action 

plan to Los Alamos and that site had not developed their 

own corrective action plan to address the issues identified 

in 2003. In this case, the problems related to badging and 

clearances were still occurring at Los Alamos in February 

2005, as demonstrated by the previously identified 

inspection report on this subject. 

For the same 2003 OIG audit report on badging and 

clearances, the Office of Environmental Management (EM) 

also never provided the necessary guidance to the ETTP 

site. In a response to the original draft report, the Assistant 

Secretary for EM stated that a letter of guidance for ETTP 

would be prepared concerning the major issues covered in 

our report. This was to be followed, in early 2003, with the 

implementation of corrective actions and validation reviews 

conducted every three months to ensure acceptable 

implementation. However, due to the Office of Science's 

landlord responsibilities over the entire Oak Ridge 

Reservation, which includes ETTP, there was conhsion 

over which program office ultimately needed to direct 

ETTP on corrective actions. Our review revealed that 

neither program office provided ETTP with a letter of 

guidance nor were validation reviews ever performed. In 

fact, the corrective actions that were to be implemented at 

ETTP were never included in the DARTS tracking system. 

Both our current review, and a self assessment conducted 

by ETTP in June 2006, indicated that problems still 

remained in this area, even though the recommendations 

from our original report were closed over two years ago. 

Effectiveness of Actions Taken 

While we found written assurances from each of the 

program offices andlor NNSA certifying the effectiveness 

of the corrective actions taken, none of the Department 

offices had performed formal audit follow-up assessments 

or reviews as required by Departmental Order. These 

reviews were designed to verify that actions had actually 

been taken or that weaknesses reported in OIG audits had 

been corrected. According to the Order, only after these 

Page 8 Details of Finding 
assessments or reviews are completed should the 

recommendatioi~s be certified for closure by the head of the 

program office or NNSA. 

Officials from the Office of Science (Science) told us that 

instead of formally verifying the implementation of 

corrective actions, they hold site managers accountable for 

audit resolution by including it in their performance 

appraisals. However, the officials were unable to provide 

us with sufficient documentation that audit resolution and 

follow-up was actually included in site managers' 

performance appraisals and, as evidenced by our recent 

findings, this approach has not been completely effective. 

In addition, NNSA and EM officials told us that formal 

audit follow-up assessments or reviews had not been 

performed. 

Applicability of Findings and Recommendations 

Departmental organizations not included in OIG audits did 

not always review published reports for potential "lessons 

learned." In response to a recommendation from our 2004 

report on audit resolution and follow-up, the relevant 

Department Order was revised to require each primary 

Departmental organization to review audit report findings 

and recommendations assigned to other organizations for 

applicability and to determine whether actions needed to be 

taken to resolve the issues identified. 

We found, however, that the requirement to perform such 

reviews had not been implemented at the Departmental 

organizations we reviewed. For example, our 2003 report 

on personnel clearances and badge access controls was 

conducted at three NNSA sites - Sandia, Los Alamos, and 

Y-12. The recommendations in that report were directed to 

the Associate Administrator for Facilities and Operations 

within NNSA. Since NNSA concurred with the 

recommendations and planned to take corrective actions to 

address the conditions cited, all NNSA facilities should 

have examined their badging programs for problems; 

however, that was not done. The absence of a process to 

review audits for applicability at other sites may have also 

contributed to the issues identified in a recent inspection 

report2 on Lawrence Livermore National Laboratory 

Security Clearance Terminations and Badge Retrieval at the Lawrence Livermore National Laboratory 

(DOEITG-07 16, January 2006) 

Page 9 Details of Finding 
Improvement 

Opportunities 

(Livermore). Similar to the 2003 report mentioned above, 

the inspection determined that Livermore had not retrieved 

security badges at the time of employees' departure and had 

not terminated security clearances of departing employees 

in a timely manner. 

In contrast, we found that the Strategic Petroleum Reserve 

(SPR) had a process where they review all OIG reports to 

determine whether issues identified may be applicable to 

the SPR. In April 2004, SPR analyzed our 2004 report on 

audit resolution and determined that it had local 

implications. Specifically, there had been a few instances 

at SPR where audit findings were not resolved in a timely 

manner. The contractor's management responded by 

tracking the status of open recommendations each quarter 

and stressing timely close-out in discussions with impacted 

personnel. SPR's review of our report ultimately 

strengthened their process of tracking open 

recommendations. 

Without effectively implementing existing audit resolution 

requirements, the Department has not taken full advantage 

of opportuilities to improve program perfoimance, 

accountability, and achieve cost savings. This is especially 

critical in key areas such as those listed annually in our 

report on Management Challenges at the Department of 

Energy. As noted above, we identified audit follow-up 

deficiencies on reports related to national security and 

project management, both of which have been included as 

significant management challenges since November 2000. 

The importance of the Department's operations and the 

continuous and changing nature of threats, make national 

security a challenge that requires management's continued 

vigilance and emphasis. Once identified, it is imperative 

that security weaknesses are corrected immediately to 

protect the Department's facilities and classified 

information. In this case, failure to implement effective 

corrective actions in response to our audit reports on 

personnel security clearances and badging, and foreign 

visits and assignments increased the risk that security could 

be breached at Departmental sites. 

In this report, we cite three examples of audit reports that 

questioned the Department's management of specific 

projects (Corporate Human Resource Information System, 

Nuclear Materials Accounting System Modernization 

Page 10 Details of Finding 
Initiative, and Depleted Uranium Hexafluoride 

Conversion). These were all multi-million dollar projects, 

each of which included practices that linlited management's 

ability to closely monitor project costs, schedules, and 

performance. These issues should have been corrected in 

response to the recommendations included in our audit 

reports. Unfortunately, subsequent reviews indicated that 

the problems originally reported were never completely 

resolved and continued to impact the Department's ability 

to successfully complete these projects. An effective audit 

resolution and follow-up program should have noted these 

examples and not permitted closure of the 

recommendations until action was completed. 

RECOMMENDATIONS We recommend that either Program Secretarial Officers, 

in coordination with the Chief Financial Officer or the 

Administrator, NNSA, as appropriate, reinforce existing 

requirements by: 

1. Ensuring that fonnal corrective action plans are 

communicated to all applicable sites for 

implementation; 

2. Developing formal audit follow-up assessment 

review orocedures as required by Departmental 

Order, to verify and document that actions taken 

have corrected the issues identified through audits 

prior to the submission of the assurance 

certification; 

3. Ensuring that appropriate officials are held 

accountable for carrying out formal assessments and 

reviews; and, 

4. Reviewing all 01G findings and recornlendations 

to determine the applicability of the issues 

identified and whether actions need to be taken at 

sites/programs other than those specifically 

mentioned in the audit. 

MANAGEMENT 

REACTION 

The Department and the NNSA provided consolidated 

conments to the draft report and concurred with the 

reconmendations. The Department agreed to issue 

guidance to program offices reemphasizing the 

requirements of the audit resolution and follow-up 

Page 11 Recommendations and Comments 
AUDITOR 

COMMENTS 

program. This guidance, according to the Department, will 

focus on the efficient and effective resolution of audit 

findings and recommendations; the assignment of 

accountability to senior program element managers for the 

management of their respective audit resolution processes; 

and senior management requirements for providing 

corporate oversight, review, and resolution of audit issues. 

In addition, the Department indicated that it will perform 

periodic follow-up activities to help ensure effective 

implementation of the guidance. Also, NNSA has agreed 

to formalize its certification methodologies for use by the 

site managers, the Service Center Director, and senior 

program officials in its organization. 

Even though NNSA concurred, it noted that it did not 

believe that additional action was required for 

Recommendations 1 and 4 because its current audit 

resolution process was sufficient to address those 

recommendations. Specifically, in response to 

Recommendation 1, NNSA indicated that corrective action 

plans are already distributed to all appropriate elements 

within NNSA. These plans are provided through the 

formal Management Decision process andlor through 

DARTS. Furthermore, in response to Recommendation 4, 

NNSA added that it had an established process to allow all 

elements to review all issues raised in audit reports for 

applicability. 

Separate technical comments were also provided by NNSA, 

the Offices of Health, Safety and Security, EM, and 

Science. 

Comments from the Department and NNSA acknowledge 

that improvements are needed in the audit resolution and 

follow-up process area. Management's planned actions, 

where provided, were responsive to the report's 

recommendations. 

We do not, however, agree with NNSA's assertion that two 

of the recommendations have already been addressed as 

they apply to NNSA. NNSA stated that under its current 

audit resolution process, corrective action plans are 

provided to all appropriate elements under NNSA. As we 

noted in our report, however, such was not always the case. 

Specifically, we noted that NNSA's resolution of our 

January 2003 OIG report (DOE/IG-0582) on badging and 

Page 12 Comments 
security clearances did not ensure that a corrective action 

plan was coinmunicated to Los Alamos, one of the sites 

included in the report, for implementation. As a result, 

these issues were still occurring at Los Alamos in February 

2005, as demonstrated by an OIG inspection report. As 

part of the management decision process, we hope to 

review NNSA's documented procedures for the creation 

and distribution of corrective action plans to each of the 

organizations under its control. 

Finally, NNSA stated that it has an established process in 

place to allow all elements to review for applicability to 

their specific sites or programs those issues that are being 

raised in audit reports. However, according to a 

management official, NNSA's current process excludes 

OIG reports that do not include NNSA as part of the audit. 

We believe this approach could cause NNSA to miss 

opportunities to review certain report findings and 

recommendations that may be applicable. It may also be 

beneficial for NNSA to use an Audit Trends/Crosscutting 

Issue analysis similar to the one mentioned in 

management's comments as a tool to facilitate NNSA's 

assessments of applicability. 

Management's comments have been incorporated into the 

reno0 ~xrher~, annlirahl~ and inrlild~rl v~rhatim as A??~ndix 4 A A 

Page 13 Comments 
Appendix I 

OBJECTIVE To evaluate the Department of Energy's (Department) progress 

on correcting prior audit follow-up issues and to determine 

whether issues identified through recent Office of Inspector 

General (OIG) audits had been resolved. 

SCOPE 

METHODOLOGY 

The audit was performed between February 2006 and May 

2007. We conducted work at Headquarters and received 

information fi-om Oak Ridge National Laboratory, Y-12 

National Security Complex, East Tennessee Technology Park, 

Savannah River Site, Brookhaven National Laboratory, Los 

Alamos National Laboratory, and the Strategic Petroleum 

Reserve Project Management Office. 

To accomplish our audit objective, we: 

Reviewed applicable Departmental orders and policies 

and procedures implemented at the Department; 

Held discussions with Headquarters program and site 

officials regarding audit resolution and follow-up 

process; 

Selected and analyzed ail OIG audit reports and 

associated recommendations fi-om the first half of 2005 

to determine if target closure dates were established and 

ensured timely closure of audit recommendations; 

Reviewed Departmental Audit Report Tracking System 

data to determine status of selected OIG audit 

recommendations; 

Reviewed six judgmentally-selected OIG audit reports 

dated fi-om February 200 1 to November 2005 with 

"closed" recommendations to determine whether 

corrective action plans had been developed and 

implemented, and whether actions taken actually 

corrected the weaknesses; 

Obtained data files of active badges fi-om site badge 

systems and active clearances fi-om the Central 

Personnel Clearance Index (CPCI) system at 

Headquarters; 

Page 14 Objective, Scope, and Methodology 
Appendix I (continued) 

Used Audit Colnilland Language (ACL), a data-mining 

software tool, to compare contractor human resource 

listings of e~nployees to CPCI to determine whether 

they still had an active clearance in the CPCI; 

Held discussions with Headquarters and field site 

officials to gain an understanding of roles, 

responsibilities, and procedures concerning CPCI and 

local site badge systems; 

Used ACL to compare the Department's Foreign Access 

Central Tracking System (FACTS) to a site's foreign 

visits and assignments tracking system; and, 

Held discussions with Headquarters and field site 

officials to gain an understanding of roles, 

responsibilities, and procedures concerning FACTS and 

the local foreign visits and assignments tracking 

systems. 

The audit was performed in accordance with generally 

accepted Govenunent auditing standards for performance 

audits and included tests of internal controls and compliance 

with laws and regulations to the extent necessary to satisfy the 

audit objective. Accordingly, we assessed the significant 

internal controls and performance measures established under 

the Government Performance and Results Act of 1993. 

Specific performance measures concerning the audit resolution 

and follow-up process were established in the area of meeting 

audit recommendations closure milestone targets. Because our 

review was limited, it would not necessarily disclose all 

internal control deficiencies that may have existed at the time 

of our audit. We obtained and reviewed the computer 

processed data made available to us in order to achieve our 

audit objective. We validated the reliability of such data, to the 

extent necessary to satisfy our audit objective, by tracing it to 

source documents or other supporting information. 

We held an exit conference with management on May 3,2007. 

Page 15 Objective, Scope, and Methodology 
Appendix 2 

AUDIT REPORTS REVIEWED 

The following are the six audits selected for review to determine whether corrective action 

plans had been developed and implemented, and whether actions taken actually corrected the 

weaknesses. 

Information Technology Managenlent Letter on the Audit of the Department of 

Energy's Consolidated Financial Statements for Fiscal Year 2005 (OAS-FS-06-02, 

November 2005). The results of the Fiscal Year 2005 Information Technology 

control reviews indicated that network and information systems security control 

weaknesses continue to exist in the Department of Energy's (Department) unclassified 

information systems. 

Depleted Urnniur~z Hexafluoride Corzver.siorz (DOEIIG-0642, March 2004). This 

audit concluded that the Department's plan for converting depleted uranium 

hexafluoride inventories could be improved by adding an additional conversion line 

to the Portsmouth facility. At the time of the audit, plans called for three conversion 

lines, which were capable of processing 13,500 metric tons of depleted uranium 

hexafluoride per year. By adding another conversion line, Portsmouth could have 

processed 4,500 metric tons of additional material annually and completed the project 

nearly five years earlier than planned. The facility size was not optimized because 

the Department's acquisition strategy emphasized initial capital costs rather than 

minimizing life-cycle costs. By increasing the production capacity at Portsmouth, the 

Departilleilt could have shoitened the duration of the Portsinouth co~lversioil project 

by about 5 years and saved about $55 million. 

Personnel Security Clearances and Badge Access Controls at Selected Field 

Locations (DOEIIG-0582, January 2003). This audit identified that at the Oak Ridge 

Reservation (Oak Ridge), 26 (8 percent) of our sample of 309 coiltractor and other 

non-federal workers retained badge authority after they terminated their association 

with the Department. Additionally, at Savannah River Site, 34 of 177 (19 percent) 

individuals improperly retained the authority to hold security clearances after they 

terminated their association with the Department. Similarly, at Sandia National 

Laboratories, 14 of 108 (1 3 percent) former workers inappropriately maintained 

active clearances and, at Oak Ridge, 15 (about 6 percent) individuals improperly held 

active clearances. Processes in place at the time of the review did not ensure that 

authorizations were promptly removed f?om systems and could have permitted those 

who improperly retained a clearance or badge with a window of opportunity to enter 

or access sites without authority. Recommendations were made to help the 

Department strengthen controls over badge recovery and clearance termination within 

the Central Personnel Clearance Index (CPCI). 

Page 16 Audit Reports Reviewed 
Appendix 2 (continued) 

The Departnzent's Ur7classzJied For-eign Jfisits and Assig~lnzents Progrum (DOEIIG0579, December 2002). Ths audit found that the Department had not adequately 

controlled unclassified visits and assignments by foreign nationals at two national 

laboratories. Specifically, one Office of Science (Science) laboratory had not 

required or maintained accurate passport and visa information for 91 of the 187 (49 

percent) randomly selected visitors or assignees reviewed. Forty-one of the 91 had 

active badges and could have accessed most of the site's facilities. Thrty-four of the 

91 were fi-om sensitive countries such as the People's Republic of China, India, and 

Russia. Similar problems were noted at the NIVSA-managed laboratory. Passport 

and visa data were missing or incomplete for 37 of the 188 (20 percent) individuals 

selected. Twelve of those with incomplete or missing information had an active 

badge. Of the 37 individuals, 17 were from sensitive countries. In addition, the 

Science laboratory permitted foreign nationals to access its facilities prior to approval 

of their visit or assignment. We found that 74 of 187 (40 percent) visitors and 

assignees from the Science-managed laboratory had been issued badges and allowed 

site access before their visit or assignment was approved. Finally, neither laboratory 

provided sufficient information to the Department's centralized tracking system 

(Foreign Access Central Tracking System), which was designated to facilitate 

complex-wide tracking of the status of foreign nationals. Weaknesses occurred 

because of the lack of specificity in policy guidance, problems with implementation, 

and a lack of clear and quantifiable performance measures. Recommendations were 

made to help the Department strengthen management practices for controlling 

unclassified visits and assignments by foreign nationals. 

Nuclear Materials Accounting Systems Modernization Initiative (DOELG-0556, June 

2002). This audit found that the Department had not adequately managed its 

activities to redesign or modernize its nuclear materials accounting systems. 

Moreover, planned and ongoing system development efforts were not fully consistent 

with the Corporate Systems Information Architecture. 

Tlze US. Depart~nent ofEnel-gy's Corporate Human Resource Information System 

(DOEJIG-0494, February 2001). This audit found that the U.S. Department of 

Energy's Corporate Human Resource Information System (CHRIS) had not satisfied 

all Federal and Departmental requirements and had not met certain Departmental 

goals and objectives. For example, (1) several system development activities were 

inadequate or had not been completed; (2) Departmental initiatives to reengineer 

certain Human Resources processes and eliminate over 50 redundant systems had not 

been satisfied; and, (3) CHRIS had computer security weaknesses that increased the 

risk of unauthorized access or malicious damage to the system. 

Page 17 Audit Reports Reviewed 
Appendix 3 

PRIOR REPORTS 

Office of Inspector General Reports 

Badge Retrieval and Security Clearance Termination at Sandia National LaboratoryNew Mexico (DOEIIG-0724, April 2006). This inspection concluded that Sandia 

National Laboratory-New Mexico's (Sandia) internal controls were not adequate to 

ensure that, in accordance with applicable policies and procedures, security badges 

assigned to terminating Sandia and subcontractor employees were retrieved at the 

time of departure or that security clearances of terminating Sandia and subcontractor 

employees were terminated in a timely manner. 

Security Clearance Terminations and Badge Retrieval at the Lawrence Livermore 

National Laboratory (DOEAG-07 16, January 2006). This inspection concluded that 

Lawrence Livermore National Laboratory's internal control structure was not 

adequate to ensure that security badges were retrieved at the time of employee 

departure or that security clearances of departing employees were terminated in a 

timely manner. 

Security and Other Issues Related to Out-Processing of Employees at Los Alamos 

National Laboratory (DOEIIG-0677, February 2005). This inspection identified that 

Los Alarnos National Laboratory's (Los Alamos) out-processing procedures were not 

followed by more than 40 percent of the 305 terminating employees included in our 

sample. Consequently, Property Administrators, Classified Document Custodians, 

and Badge Office personnel frequently did not receive timely notification that 

employees were terminating. Given this and the results of additional sampling, we 

found that there was no assurance that, prior to departure, Los Alamos terminating 

employees turned in security badges, completed the required Security Termination 

Statement, or had their security clearances and access authorizations to classified 

matter andlor special nuclear material terminated in a timely manner. 

Management of the Department's Personnel Security and Access Control Information 

Systems (DOEIIG-065 1, June 2004). This audit found that the Department of 

Energy's (Department) information systems modernization initiatives would not: (1) 

significantly improve the ability of its corporate personnel security system to track 

visitor site access, reconcile with contractor clearance tracking systems, enable field 

sites to generate customized reports, or increase user system access; (2) eliminate 

costly development and maintenance of numerous separate, site-level personnel 

security information systems; and, (3) reduce overlapping or redundant physical 

access control systems that do not communicate with each other, including those at 

some facilities located in close proximity to one another. This occurred because the 

Department had not developed a comprehensive framework for modernizing its 

personnel security and access control information systems, and did not always follow 

sound system development practices. 

Page 18 Prior Reports 
Tlze Depal-t~~ze~zt's Audit Resolution P~*ocess (DOEIIG-0639, February 2004). Tl-Lis 

audit observed that: (1 ) target dates for colnpletion of corrective actions had not been 

established for 44 percent of the 104 recommendations we reviewed; (2) where target 

dates were established, 57 percent of the corrective actions taken exceeded closure 

milestones; (3) in several cases, recoinmendations were closed even though corrective 

actions had not been taken; and, (4) the Department did not take advantage of 

potential savings of about $26 million due to delays in corrective action 

implementation. 

Personnel Security Clearances and Badge .4 ccess Contl-01s at Department 

Headqua]-ters (DOEIIG-0548, March 2002). This audit disclosed that the Department 

had either not terminated former federal and contractor employees' clearances or had 

not recovered their badges. Errors occurred because program offices had not always 

provided employment termination illformation to Headquarters Security Operations 

or held contractors accountable for adherence to Departmental policy. 

Page 19 Prior ~e~orts 
Appendix 4 

Department of Energy 

National Nuclear Security Administration 

Washington. DC 20585 

February 15, 2007 

MEMORANDUM FOR Rickey R. Hass 

hsistant Inspector General 

FROM: 

SUBJECT: 

Associate ~dministrator / /* 

for Management and Administration 

Comments to Audit Resolution and Follow-up 

Process Draft Report; A06PT0 1 4 

The Department of Energy (Department) and the National Nuclear 

Security Administration (NNSA) appreciate the opportunity to review 

the Inspector General's (IG) draft report, "The Department's Audit 

Resolution and Follow-up Process." We understand that this audit was 

conducted to evaluate the Department's progress on correcting prior 

audit follow-up issues and to determine whether the Department has 

taken appropriate actions to resolve issues identified through recent IG 

audits. 

Although the Department and NNSA concur with the recommendations, 

NNSA has concerns, as attached, with the report as it is written. 

Additionally, we are providing technical comments on the report from the 

following Departmental organizations: Office of Health, Safety and 

Security; Office of Environmental Management, Office of Science; and 

Bechtel Jacobs Company LLC-East Tennessee Technology Park. 

Should you have any questions, please contact Richard Speidel or Dean 

Childs on 202-586-5009 or 301 -9Q3-2560, respectively. 

Attachments 

Page 20 Management Comments 
Appendix 4 (continued) 

Attachment 1 

Comments on 

Inspector General Draft Report 

"The Department's Audit Resolution and Follow-up Process" 

We suggest that the introduction to the recommendations be restated as follows: 

We recommend that either the Program Secretarial Officers, in coordination with the Chief 

Financial Officer or the Administrator, NNSA, as appropriate, reinforce existing requirements by: 

1. Recommendation 

Ensuring that formal corrective action plans are communicated to all applicable sites for 

implementation; 

Concur 

The Department will issue guidance to reemphasize the requirements of the audit resolution and 

follow-up program. This guidance will focus on the efficient and effective resolution of audit 

findings and recommendations; the assignment of accountability to senior program element 

managers for the management of their respective audit resolution processes; and senior manager 

requirements for providing corporate oversight, review and resolution of audit issues. 

Additionally, the Office of the Chief Financial Officer will be issuing a revised Audit 

Coordinator's Handbook which identifies the roles and responsibilities of the Program Secretarial 

Offices' (PSO) designated audit coordinators in supporting this objective. This action is 

scheduled for closure by December 2007. 

For NNSA, corrective action plans are provided to all appropriate elements within NNSA as part 

oi its current audit resolution process. These plans are provided through the formal Management 

Decision process andlor through the Departmental Audit Report Tracking System. Therefore, 

ths recommendation is considered to be closed as it applies to NNSA. 

2. Recommendation 

Developing formal audit follow-up assessment review procedures as required by Departmental 

Order, to verify and document actions taken have corrected issues identified through audits prior 

to the submission of the assurance certification; 

Page 21 Management Comments 
Appendix 4 (continued) 

Management Comment 

Concur. 

The Department will issue guidance to reemphasize the requirements of the audit resolution and 

follow-up program. This guidance will provide specific clarification of requirements for PSOs to 

maintain operating procedures and systems for audit resolution and follow-up, and ensure 

corrective actions have been implemented to effectively address audit report recommendations 

prior to submission of assurance certificates. The Office of the Chief Financial Officer will 

conduct periodic validations to ensure that these procedures are in place. This action is scheduled 

for closure by December 2007. 

NNSA currently has a variety of methods to accomplish the intent of this recommendation. 

However, these methodologies will be formalized and provided to the site managers, Service 

Center Director and senior program officials for their appropriate use. Some of the various 

methods for assessment currently utilized include: 

Verification of corrective action by the Contractors' internal auditors as part of the 

Cooperative Audit Strategy, with certification submitted to the appropriate Federal 

manager; 

Incorporation of audit follow-up into annual topical surveys, such as the annual site 

specific security survey; 

Verifications conducted by the Financial Internal Controls element as part of A-123 

process repodng; 

Inclusion into the Contractor Assurance System [this is an item that is important since 

NNSA is moving into a risk management/contractor assurance system as opposed to a 

compliance system of controls]; 

Verifications conducted by NNSA's Internal Affairs element; andlor 

Inclusion into Program Reviews until open findings are completed/corrected. 

NNSA has also implemented a review and approval step at Headquarters for those reports that are 

managed by the various programmaticladministrative elements. The senior fimctionalAine 

manager (Associate Administrator for Defense Nuclear Security or the Deputy Administrator for 

Defense Programs, for example) will conduct an appropriate review and will concur with the 

certification package prior to submission to the Director, Policy and Internal Controls 

Management for final review. The Director makes the final recommendation for Certification of 

Completeness to the Associate Administrator for Management and Adrmnistration. NNSA's 

formalization of certification will be completed by the end of September 2007. 

3. Recommendation 

Ensuring that appropriate officials are held accountable for carrying out formal assessments and 

reviews; and, 

Page 22 Management Comments 
Appendix 4 (continued) 

Management Comment 

Concur 

Current Departmental guidelines define clear lines of accountability for audit resolution activities, 

including assessments and reviews. The Department will issue guidance to reemphasize the 

requirements of the audit resolution and follow-up program, including the conduct of audit 

follow-up assessments or reviews on the implementation of corrective actions to address all audit 

report recommendations prior to providing an Assurance of Effectiveness of Corrective Actions 

Taken. Periodic validations of PSO procedures to accomplish these assessments will help 

enhance that accountability. This action is scheduled for closure by December 2007. 

NNSA also has formal lines of accountability incorporated into its methodology of 

operations. Managers are accountable and are held accountable by the Administrator as 

appropriate. For audit resolution, the lines of accountability run from the contractor to 

the site office or from the Headquarters program element prior to final certification by the 

Associate Administrator for Management and Administration. This recommendation is 

considered closed as it applies to NNSA. 

4. Recommendation 

Reviewing all OIG findings and recommendations to determine the applicability of the issues 

identified and whether actions need to be taken to resolve identified issues. 

Management Comment 

Concur. 

The Department will issue guidance to reemphasize primary responsibilities of the head of each 

Departmental organization to review all audit report fmdings and recommendations assigned to 

oiher organizations to determine whether they may be applicable withln their own organizations. 

To help facilitate the programs' assessments of applicability, the Office of the Chief Financial 

Officer recently implemented an Audit Trends/Crosscutting Issues Analysis, which identifies 

significant audit issues that may impact multiple programs and sites. Departmental actions are 

scheduled for closure by December 2007. 

NNSA has an established process to allow all elements to review for applicability to their 

specific sites or programs those issues that are being raised in audit reports. This process 

includes the following steps: 

All draft reports, regardless of topical area audited or site visited, are provided to the 

NNSA complex. This communications process includes senior NNSA managers 

(Administrator, Deputy and Associate Administrators, Service Center Director, and 

appropriate site managers), senior program managers, the Federal internal controls 

community, and internal auditors. 

All final reports are provided to the entire NNSA complex as described above. 

The NNSA internal controls community is informed, on a weekly basis during a 

conference call, of draft andlor final reports that have been issued. 

Therefore, this recommendation is considered to be closed as it applies to NNSA 

Page 23 Management Comments 
IG Report No. DOEIIG-0766 

CUSTOMER RESPONSE FORM 

The Office of Inspector General has a continuing interest in improving the usefulness of 

its products. We wish to make our reports as responsive as possible to our customers' 

requirements, and, therefore, ask that you consider sharing your thoughts with us. On the 

back of this form, you may suggest improvements to enhance the effectiveness of future 

reports. Please include answers to the following questions 'if they are applicable to you: 

1. What additional background information about the selection, scheduling, scope, or 

procedures of the inspection would have been helpful to the reader in understanding 

this report? 

3. 'Nhat additioiial information related to findings and recomnlendatio~ls could have 

been included in the report to assist management in implementing corrective actions? 

3. What format, stylistic, or organizational changes might have made this report's 

overall message more clear to the reader? 

4. What additional actions could the Office of lnspector General have taken on the 

issues discussed in this report which would have been helpful? 

5. Please include your name and telephone number so that we may rnrt~ct ;,nx :hs;:d 

h.2 lla~~ ally questions about your comments. 

Nain e Date 

Telephone Organization 

When you have completed this form, you may telefax it to the Office of Inspector 

General at (202) 586-0948, or you may mail it to: 

Office of Inspector General (IG- I) 

Department of Energy 

Washington, DC 20585 

ATTN: Customer Relations 

If you wish to discuss this report or your comments with a staff member of the Office of 

Inspector General, please contact Judy Garland-Smith (202) 586-7828. 
The Office of Inspector General wants to make the distribution of its reports as customer friendly 

and cost effective as possible. Therefore, this report will be available electronically through the 

Internet at the folloxing address: 

U.S. Department of Energy Office of Inspector General Home Page 

hg~://www.i~.ener~v.oov 

Your conments would be appreciated and can be provided on the Customer Response Form.