Missing Children: DOJ Could Enhance Oversight to Help Ensure That Law Enforcement Agencies Report Cases in a Timely Manner
Published: 2011-06-21T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Missing children who are not found quickly are at an increased risk of victimization. The National Child Search Assistance Act, as amended, requires that within 2 hours of receiving a missing child report, law enforcement agencies (LEAs) enter the report into the Department of Justice's (DOJ) National Crime Information Center (NCIC), a clearinghouse of information instantly available to LEAs nationwide. DOJ's Criminal Justice Information Services (CJIS), the CJIS Advisory Policy Board (the Board), and state criminal justice agencies share responsibility for overseeing this requirement. As requested, GAO examined (1) CJIS's and the Board's efforts to implement and monitor compliance with the requirement; and (2) selected LEA-reported challenges with timely entry and DOJ's actions to assist LEAs in addressing them. GAO reviewed documents, such as agency guidelines, and interviewed officials from DOJ, six state criminal justice agencies, and nine LEAs selected in part based on missing children rates. The results are not generalizable to all states and LEAs, but provided insights on this issue.
section_title: What GAO Found
paragraphs: CJIS and the Board have taken steps to help ensure implementation of the 2-hour entry rule, but could strengthen their oversight to better assure compliance with the rule. Starting in 2007, CJIS: (1) informed all state criminal justice agencies that LEAs will have 2 hours to enter reports of missing children into NCIC once they have collected the required data (e.g., child's biographical information); (2) provided guidance on how LEAs could document compliance with the rule; and (3) informed state criminal justice agencies that the Board had authorized CJIS to begin assessing compliance with the rule in audits starting in 2009. To help ensure compliance among all NCIC users, CJIS and the Board require state criminal justice agencies to audit all LEAs in the state that enter data into NCIC. However, CJIS and the Board have not taken steps to establish minimum audit standards for state criminal justice agencies to use in assessing LEAs' compliance with the 2-hour rule. In the absence of such standards, the selected six state criminal justice agencies GAO contacted used varied approaches to assess LEAs' compliance. For example, two were not using the 2-hour criterion, and the number of missing children records the six agencies reviewed to assess timeliness ranged from all records in one state to no records in another. The fact that the state agencies did not consistently apply the 2-hour criterion to review a sample of missing children records raises questions about the reliability of the information the agencies collect on LEA compliance. Establishing minimum standards for state agency audits could help provide CJIS with reasonable assurance that the audits contain reliable information on LEA compliance. Officials from eight of nine LEAs GAO contacted reported challenges to entering information on missing children into NCIC within 2 hours; CJIS and the Office of Juvenile Justice and Delinquency Prevention (OJJDP) could use existing mechanisms to obtain and share information on challenges. Seven LEAs reported challenges determining whether a child is missing when there are custodial disputes. Six LEAs reported challenges obtaining information from child welfare agencies on missing children in the child welfare system. Officials from child welfare agencies in areas where LEAs reported this challenge said that they may not always have the information LEAs need, and are taking steps to ensure timely communication between their staff and LEAs. In association with the National Center for Missing and Exploited Children and other stakeholders, in 2006 OJJDP developed (1) a model policy stating that LEAs will accept reports of missing children even when custody has not been established and (2) sample self-assessments so LEAs could enhance their responses to missing children in the child welfare system. However, eight of the nine LEAs stated that these challenges persist. DOJ does not know the extent of these challenges across all LEAs and has limited capability to conduct such an assessment. By using existing CJIS and OJJDP mechanisms--such as CJIS's training for state agencies and OJJDP-funded training for LEAs--to obtain information on the extent to which LEAs face these and other challenges and provide examples of how some LEAs have mitigated the challenges, DOJ could be better positioned to carry out its oversight of NCIC with respect to assuring compliance with the 2-hour rule.
section_title: What GAO Recommends
paragraphs: GAO recommends that CJIS and the Board consider establishing minimum standards for states to use to monitor compliance with the 2-hour rule and CJIS and OJJDP use existing mechanisms to obtain and share information on LEA challenges and successful efforts to mitigate them. DOJ concurred.

section_title: Letter
paragraphs: According to the most comprehensive national survey to date, between 1  million and 1.5 million children go missing or run away each year. Federal  law requires that within 2 hours of receiving a report that an individual  under the age of 21 (a child) is missing, federal, state, and local law  enforcement agencies (LEAs) are to enter the report into the Federal  Bureau of Investigation’s (FBI) National Crime Information Center  (NCIC). NCIC is an electronic repository of data on crimes and criminals  of nationwide interest and a locator file for missing and unidentified  persons. NCIC helps law enforcement locate missing children by making  information on the child instantly available to law enforcement agencies  across the country. Timely entry of information on missing children into  NCIC by law enforcement is important to recovery efforts because,  according to a 2006 study by the Washington State Attorney General and  the Department of Justice’s (DOJ) Office of Juvenile Justice and  Delinquency Prevention (OJJDP), if an abducted child is murdered, the  murder occurs within 3 hours of abduction in 76 percent of cases. In  addition, timely entry into NCIC may play a role in law enforcement more  quickly locating, and providing support for, children who may be  victimized or suffer negative health consequences when they run away  from home. A national study of caretakers and children showed that up to  71 percent of children who run away may have been endangered during  their runaway episode by virtue of factors such as substance dependency,  use of hard drugs, sexual or physical abuse, their young age, or presence  in a place where criminal activity was occurring. Incidents of untimely  entry of reports of missing children into NCIC by law enforcement  agencies have been the subject of investigations by several news  publications, and have raised concerns about the ability of law  enforcement to initiate searches, locate, and provide support for missing  children.
The National Child Search Assistance Act of 1990 established reporting  requirements that addressed hindrances to the timely entry of missing  children into criminal information databases. Among other things, the act  required states to ensure (1) that LEAs do not impose a waiting period  before accepting reports of missing children and (2) that LEAs  immediately enter information on the missing child into the state’s law  enforcement database and NCIC. The Adam Walsh Child Protection and  Safety Act of 2006 (Adam Walsh Act) amended the National Child Search  Assistance Act by establishing requirements for handling reports of  missing children. Among other things, the Adam Walsh Act established a  measurable and more specific requirement that reports be entered in NCIC  “within 2 hours of receipt.” Congressional sponsors of the Adam Walsh Act  characterized this change as improving the chances of recovery for  missing children, because of research findings that showed that children  who were abducted and murdered were killed within 3 hours of being  kidnapped. The DOJ’s FBI Criminal Justice Information Services Division  (CJIS) and state criminal justice agencies (known as CJIS Systems  Agencies, or CSAs) share the responsibility of ensuring timely entry of  information on missing children into NCIC. The CJIS Advisory Policy  Board (the Board) is responsible for establishing policy and providing  advice and guidance on NCIC use by federal, state, and local LEAs.
You asked us to conduct a review of reporting methods LEAs used in  providing information to NCIC. In response to your request, we examined:  the extent to which CJIS and the Board have taken steps to help ensure  implementation of the 2-hour requirement for entering reports of missing  children into NCIC (referred to in this report as ‘the 2-hour entry  requirement’), and mechanisms they have put in place to monitor  compliance with the requirement; and    what challenges, if any, selected LEAs identify as affecting the ability of  law enforcement to enter reports of missing children into NCIC as  required and how DOJ is addressing these challenges.
To address the first objective, we reviewed relevant documentation,  including reporting requirements for missing children set forth in federal  and selected state legislation and FBI policies and guidelines detailing the  agency’s process for monitoring compliance with the 2-hour entry  requirement. We also reviewed written CSA audit policies and procedures.  We interviewed senior CJIS officials to discuss the FBI’s role in ensuring  timely entry of missing children reports into NCIC, including CJIS  requirements for CSA audits of LEAs. We also interviewed senior officials  overseeing audits and local NCIC usage in six selected CSAs. We selected  CSAs representing six states, based on a combination of factors, including  whether CJIS found the CSA to be in compliance with NCIC policy for  timely entry of missing children records in prior audits, and ensuring a mix  of high and low rates of missing children reported to NCIC by LEAs. The  states we selected were: California, Illinois, Nevada, New York, Virginia,  and West Virginia. We cannot generalize our work from these 6 entities to  CSAs in all 50 states and the District of Columbia, but the information we  obtained provides examples of the way in which these CSAs were  monitoring timely entry of missing children reports into NCIC by LEAs.  We compared CJIS’s audit policies and procedures with criteria in  Standards for Internal Control in the Federal Government to determine if  CJIS has control activities in place to enforce its directives and achieve  compliance objectives. To determine the extent to which CSA audits  collect consistent and reliable information on LEA compliance with the 2  hour entry requirement, we compared CSA audit approaches for assessing  LEAs’ compliance with available NCIC audit policy and guidance  articulated by CJIS.
To determine what challenges LEAs face, if any, in reporting to NCIC, we  interviewed senior officials in LEAs serving nine large and mid-sized cities  or counties in the six states we had selected for our first objective: Los  Angeles, Calif.; Visalia, Calif.; Chicago, Ill.; Peoria, Ill.,; Las Vegas, Nev.;  New York City, N.Y.; Poughkeepsie, N.Y.; Fairfax County, Va.; and  Morgantown, W.Va. We obtained perspectives on challenges in reporting  to NCIC from LEA officials responsible for the following activities:  implementing policies guiding the reporting of missing children into NCIC;  training law enforcement staff on responding to reports of missing  children;  taking reports of missing children from the public and entering  information into NCIC; and    conducting investigations of these reports.
We selected the nine locations based on a combination of factors,  including ensuring that we included both large and mid-sized cities or  counties located in several different geographic regions of the country. At  three of the nine locations where data were available to further identify  any challenges LEAs face in entering missing children reports into NCIC,  we discussed with law enforcement officials specific missing children  cases that CJIS had determined were not entered into NCIC in a timely  fashion when it conducted its most recent audit in that state. Additionally,  at six of the nine locations we inquired about cases reported by parents  and caregivers (as opposed to law enforcement) to the National Center for  Missing and Exploited Children (NCMEC) from June 2009 through March  2010, where NCMEC staff said they were not able to locate a record for the  missing child in NCIC. In California, Illinois, and New York, we also met  with officials from child welfare agencies to discuss their perspectives on  issues raised by law enforcement officials regarding reporting and  investigating cases involving missing children in the child welfare system.  We cannot generalize our work from these nine locations to LEAs  nationwide, but the information we obtained provides perspectives on the  challenges law-enforcement personnel face in entering reports of missing  children into NCIC.
To determine what steps DOJ has taken to address these challenges, we  reviewed guidance, standards, and model policies and practices for  responding to missing children developed from 2004 to 2011 with funding  from DOJ’s Office of Juvenile Justice and Delinquency Prevention (OJJDP)  and Office of Community Oriented Policing Services. We interviewed  senior officials from OJJDP’s Missing and Exploited Children Program,  and from NCMEC, which is also required by statute to disseminate on a  national basis, information relating to innovative and model programs,  services, and legislation that benefit missing and exploited children. We  reviewed DOJ’s actions to address these challenges and compared them to  criteria in Standards for Internal Control in the Federal Government to  determine the extent to which DOJ has identified and analyzed the risks  internal and external sources pose to the agency’s achieving its oversight  role over NCIC with respect to helping ensure compliance with the 2-hour  requirement.
We conducted this performance audit from January 2010 to June 2011, in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
subsections: section_title: Background
paragraphs: NCIC is an extensive computerized criminal justice information system  maintained by the FBI that serves as a repository of data on crimes and  criminals of nationwide interest and as a locator file for missing and  unidentified persons. Over 92,000 law enforcement agencies and other  criminal justice partners have access to NCIC, which includes  approximately 35,000 federal, state, and local law enforcement agencies in  the United States. As of January 1, 2011, NCIC contained 85,820 active  records in its missing persons file. See figure 1 for additional information  on the age of missing persons reported by law enforcement to NCIC.
subsections: section_title: NCIC Management
paragraphs: NCIC is managed cooperatively by FBI’s CJIS—the division within the FBI  that operates as the focal point and central repository for criminal justice  information services—and the state and local agencies that access the  system. An Advisory Process, consisting of an Advisory Policy Board (the  Board) with representatives from criminal justice and national security  agencies throughout the United States, and working groups are  responsible for establishing policy for NCIC use by federal, state, and local  agencies and providing advice and guidance on all CJIS Division  programs. In addition, the Board creates ad hoc subcommittees as  necessary to review policies and develop alternatives or recommendations  for the Board’s consideration. NCIC policies and procedures are  documented in the NCIC 2000 Operating Manual and the CJIS Security  Policy.
Local level governance of NCIC use is performed by the CSA. The CSA is a  criminal justice agency that has overall responsibility for the  administration and usage of NCIC, including providing quality assurance  and training and assuring LEA compliance with operating procedures  within its jurisdiction. Most CSAs are state agencies that oversee NCIC  use by all LEAs that enter data into NCIC in the state. A CSA may be a law  enforcement agency, such as a state police agency, that also enters data  into NCIC, in addition to overseeing the administration of the state’s NCIC  system. Furthermore, the Board requires that each local LEA appoint a  Terminal Agency Coordinator who serves as the representative and point  of contact for disseminating information on NCIC policies and procedures  to that agency.
section_title: NCIC Audits
paragraphs: CJIS shares with the CSAs the responsibility for monitoring compliance  with NCIC policy, as shown in figure 2. CJIS policy, as approved by the  Board, calls for triennial audits of each CSA to assess the CSA’s  compliance with NCIC policies, including the 2-hour entry requirement.  Further, CJIS relies on the CSAs to audit all LEAs that enter data into  NCIC in each state, to help ensure compliance among all NCIC users.
CJIS’s NCIC performance-based audit program tasks the CJIS Audit Unit  with conducting a compliance audit of each CSA to verify compliance with  federal laws, such as the 2-hour entry requirement for reports of missing  children, and other CJIS policies and regulations. The purpose of the audit  is to:    assess CSA compliance with NCIC system policy requirements;    assess the quality, integrity, and security of the data maintained in and  accessed from a variety of criminal justice information systems and  networks; and    ensure timely and relevant criminal justice information is made available  to authorized users.
As part of its audit of CSAs, CJIS reviews random samples of records of  missing persons in selected LEAs, and assesses all missing children  records contained in the sample to determine compliance with the 2-hour  entry requirement. During the current triennial audit cycle, the CJIS Audit  Unit plans to audit CSAs in all 50 states plus the District of Columbia from  October 1, 2009, through September 30, 2012. CJIS funding for conducting  NCIC audits was $207,570 in fiscal year 2009 and $309,854 in fiscal year  2010, and is projected to be $244,202 in fiscal year 2011.
CJIS’s audit of CSAs consists of a pre-audit questionnaire, on-site visit, and  follow-up report. The pre-audit questionnaire is sent to CSAs and selected  LEAs within the state to obtain written responses as well as assist CJIS in  gathering the relevant information to better inform the audit process. In  selecting LEAs, CJIS takes into account a number of factors, which may  include the number of records entered by each LEA, the total number of  records to be reviewed in the state, the LEA’s geographic location to  reduce the time and travel burden imposed on CJIS audit staff, whether  the LEA was previously found to have extensive and/or serious NCIC  noncompliance issues, and whether CSA officials request that CJIS include  the LEA in its audits based on CSA concerns from prior CSA audits. The  on-site visit consists of interviews of CSA and LEA personnel to determine  compliance with NCIC policies and procedures, and a data quality review  of selected LEA NCIC records. In designing its review of these records,  CJIS seeks to balance the need for a cost-effective, logistically feasible  approach, with the need to ensure the review obtains statistically valid  information on the accuracy, completeness, and timeliness of all missing  person records.
During the post-audit phase, CJIS prepares a draft audit report that  includes findings from the interviews with the agency personnel as well as  the data-quality reviews and recommendations for agency compliance. The  report is provided to the CSA for review, and the final report, including the  CSA’s responses to any recommendations, is forwarded to the Sanctions  Ad Hoc Subcommittee of the Board. This subcommittee is responsible for  evaluating the results of audits conducted of participants in the CJIS  Division programs. The subcommittee makes specific recommendations to  the Board concerning sanctions that should be imposed on agencies that  are not in compliance with the policies established by the Board for the  operation of the CJIS Division programs. Sanctions may be in the form of a  letter of concern from the subcommittee enumerating audit problems that  had not been resolved from previous audit cycles, or a letter of sanction,  which is similar to the letter of concern, but with stronger language and  specific compliance terms and procedures. If the CSA does not adequately  address noncompliance issues, the Board has the option of terminating the  state’s access to NCIC.
Each CSA is also required by CJIS and the Board to establish a system to,  at a minimum, triennially audit all LEAs that enter data into NCIC within  their jurisdiction, to ensure compliance with NCIC policy and regulations.  Each CSA is responsible for developing an audit program to meet this  requirement and the resulting audit approach can vary across CSAs. We  discuss the audit approaches used to assess the timeliness of missing  children records by the 6 selected CSAs later in this report. During its  audits, CJIS assesses the extent to which the CSAs are fulfilling the  requirement to audit all LEAs that enter data into NCIC under their  jurisdiction.
section_title: CJIS Has Disseminated Guidelines for Timely Entry into NCIC, but Establishing Minimum Standards for CSA Audits and Assessing Adherence to Standards Could Strengthen CJIS’s Oversight
subsections: section_title: CJIS and the Board Have Taken Steps to Help Ensure Compliance with the 2-hour Requirement and CJIS Has Issued Audit Recommendations to Non-Compliant CSAs
paragraphs: CJIS and the Board have taken a number of steps to help ensure that LEAs  implement the 2-hour entry requirement. Beginning in January 2007, CJIS:  informed CSAs and LEAs that the Adam Walsh Act of July 2006 required  all reports of missing persons under the age of 21 to be entered into NCIC  within 2 hours of receipt;    provided guidance to CSAs and LEAs regarding how LEAs might best  document compliance with the requirement; and  informed CSAs and LEAs that the Board had authorized it to begin  assessing noncompliance with the requirement in October 2009 and  possibly subject noncompliant CSAs to sanctions beginning in October  2012.
Starting with its CSA audits conducted in January 2007, CJIS provided  verbal and written information to all CSAs and the selected LEAs it  audited that LEAs will have 2 hours to enter reports of missing children  into NCIC from the time LEAs complete collecting 10 data elements  required by statute. As the Adam Walsh Act did not specify how  compliance was to be measured, CJIS started measuring the 2 hours once  the required data were obtained because this is how CJIS has measured  timely entry requirements for all other types of NCIC records, such as  missing persons age 21 and older and wanted persons. In addition, CJIS  recognized that law enforcement may face challenges obtaining complete  information at the time of the initial report, for example, from parents who  are traumatized by a child’s disappearance. If the elapsed time between  obtaining and entering the information on a missing child was equal to or  less than 2 hours, CJIS would deem the entry to be in compliance with the  2-hour entry requirement. Conversely, if the elapsed time was more than 2  hours, CJIS would deem the entry to be out of compliance with the 2-hour  entry requirement. Generally, according to CJIS officials, if CJIS finds  that 10 percent or more of missing children records reviewed are out of  compliance, CJIS would make an audit recommendation requiring the CSA  to take actions to address non-compliance. The officials also said that CJIS  provides and discusses all findings from its LEA reviews with the  cognizant LEAs.
CJIS more broadly disseminated information to CSAs and LEAs regarding  how timeliness would be assessed via (1) a January 2008 letter to the  heads of all CSAs and (2) a June 2009 update to NCIC’s Operating  Manual. In CJIS’s letter to the heads of the CSAs and in the update to the  NCIC Operating Manual, CJIS recommended that LEAs use a time and date  stamp to document when they completed collecting the required  information from the party or parties reporting the missing child. CJIS also  informed CSAs and LEAs that it would assess timeliness using the 2-hour  criterion and make audit recommendations that would require CSA  responses in the audit cycle beginning in October 2009. This start date was  selected because of the Board’s decision to grant a grace period to allow  agencies time to establish and institute procedures to accurately  document the receipt of the minimum data necessary for entry. CJIS did  not specifically require LEAs to use the recommended time and date  stamps, but if an audited LEA did not document the date and time it  received the minimum data, CJIS stated it would consider any unjustified  delay in entering information on a missing child into NCIC as untimely.  This could result in CJIS making an audit recommendation that the CSA  take action to address the noncompliance and the Sanctions Ad Hoc  Subcommittee applying sanctions in the future.
As of January 2011, CJIS had audited 22 CSAs using the 2-hour criterion  for entering reports of missing children into NCIC. Of the 22 audits, 10  audit reports were finalized and 12 were in draft form. Of the 10 CSAs  where audit reports were final, CJIS found 9 CSAs to be out of compliance  with the 2-hour entry requirement and issued audit recommendations to  them to take actions to ensure timely entry. As shown in figure 3, the  percentage of missing children records assessed by CJIS as having been  entered into NCIC within 2 hours ranged from 53 percent to 91 percent  across the 10 states; and the percentage of records entered into NCIC after  2 hours ranged from 9 percent to 47 percent.
During the audits, CJIS attempts to capture information on the reasons  missing children records are untimely to assist the CSAs in identifying  issues that they may need to address statewide in order to become  compliant with the 2-hour entry requirement. For each untimely missing  child record, CJIS audit staff asks the LEA personnel to provide a  description of the reason that led to the delay in entry. However, for 82  percent of the 432 untimely missing children records identified across the  10 states, CJIS officials told us they did not know the reason for the delay  because the LEAs could not provide them with information on the reasons  why the records were not entered within 2 hours. For the 79 untimely  missing children records where LEAs were able to provide CJIS  information on the causes for the delay in NCIC entry, two predominant  reasons were given:    LEA personnel did not know about the 2-hour entry requirement.    Responding officers did not provide the information on the missing child  in a timely manner. This could occur, for example, if officers began  investigating the case before submitting the report of the missing child,  waited until the end of the shift to submit a report, were dispatched to  another service call prior to submitting the report, or did not deem it  necessary to submit the report immediately for NCIC entry because they  considered the child to be a frequent run-away.
CJIS officials also said that in cases where CJIS auditors could not find  documentation of the date and time that the minimum data required for  NCIC entry were obtained, they deemed the entry to be untimely. In  written responses to CJIS’s findings of untimely entry, CSAs generally  focused on their plans to provide training to personnel responsible for  entering reports of missing children into NCIC and educate personnel  through the CSAs’ audits of LEAs.
CJIS informed CSAs that, in order to allow for an appropriate transition  period, the Board had decided that audit recommendations based on the 2- hour entry requirement would not be forwarded to the Board’s Sanctions  Ad Hoc Subcommittee until the audit cycle beginning in October 2012.  Thus, while CSAs must respond to CJIS audit recommendations regarding  non-compliance with the 2-hour entry requirement, non-compliance in this  area will not be a factor in the Board’s decisions about whether to impose  sanctions on a CSA until October 2012.
section_title: CJIS Could Better Ensure Compliance with the 2- Hour Entry Requirement by Working with CSAs and the Board to Establish Minimum Audit Standards
paragraphs: During its audits of CSAs, CJIS verifies that each CSA is conducting the  triennial audits that are required by CJIS and the Board. However, the  Board has not taken steps to establish audit standards that require CSAs to  assess compliance with the 2-hour entry requirement. Standards for  Internal Control in the Federal Government call for management to design  control activities to help ensure that its control objectives are met. Such  standards could better position CJIS and the Board to ensure that the CSA  audits accomplish CJIS’s specific oversight and compliance objectives for  timely entry of missing children records.
In the absence of standards, we found that audit approaches used by the 6  selected CSAs to assess compliance with the 2-hour entry requirement  varied. For example, lacking standards, two CSAs were not using the 2- hour criterion to assess timeliness and the six CSAs varied in the number  of missing children records reviewed. The number of missing children  records reviewed ranged from all active records in one state to no records  in another. The fact that CSAs were not consistently applying the 2-hour  criterion to review a sample of missing children records raises questions  about the reliability of CSA information on LEA compliance. The two  CSAs that were not using the 2-hour criterion had different approaches to  assessing timeliness:    Officials for one CSA stated they used an “immediate” criterion to assess  the timeliness of missing children records, which they said was stricter  than the 2-hour entry requirement. However, the CSA did not have  documentation on the time frame that was to be used for measuring  “immediate” entry or how it assessed compliance with this criterion. Thus,  CSA auditors could not demonstrate LEAs’ compliance with the 2-hour  entry requirement.
One CSA relied on LEAs to complete a questionnaire that asks, among  other things, if the agencies impose a waiting period before taking reports  of missing children and if there is a “large delay” between the time a  missing person report is taken and the time it is entered into NCIC.  However, the questionnaire does not define what the CSA considers to be  a “large delay,” and the CSA does not test for compliance. Therefore,  auditors for this CSA also could not demonstrate LEAs’ compliance with  the 2-hour entry requirement.
CSAs were also not consistent in the number of missing children records  they assessed for compliance with the 2-hour entry requirement,  specifically:    One CSA (the CSA mentioned above that relied on LEA responses to a  questionnaire) did not review any missing children records because the  state had over 500 LEAs and, according to CSA officials, a limited number  of auditing staff.
One CSA determined the number of missing children records to review at  each LEA based upon the LEA’s entry error rate—the portion of records  that were untimely, incomplete, or did not comply with other entry  requirements—from its past CSA audit. This approach resulted in the CSA  reviewing 2 missing person records out of about 400 at one LEA.
One CSA generally reviewed 4 to 10 missing children records from each  LEA it audited. This sampling approach resulted in the CSA reviewing  about the same number of records from an LEA with over 1,250 active  missing children records as from an LEA with about 100 active missing  children records.
One CSA generally reviewed 10 percent of all missing person records from  each LEA it audited, some portion of which would be missing children  records. The CSA also imposed a minimum of 20 missing person records  to be reviewed. If a LEA had fewer than 20 missing person records in  NCIC, then the CSA would review all records.
One CSA reviewed 10 percent of active missing children records from  large LEAs, such as one with over 800 missing children records in NCIC,  and all records from the remaining LEAs it audited.
One CSA reviewed all active missing children records from each LEA it  audited.
We do not know the extent to which the variability we identified in CSA  audit approaches exists across all CSAs. However, our findings that one  CSA did not assess any missing children records and other CSAs reviewed  a relatively small number of records raises questions about the CSAs’ and,  in turn, CJIS’s ability to draw conclusions regarding LEAs’ compliance  with the 2-hour entry requirement for missing children.
CJIS officials acknowledged that CSA audits would be more useful if they  measured LEAs’ compliance with the 2-hour criterion and reviewed a  sample of missing children records to assess compliance with the entry  requirement, but CJIS and the Board do not require CSAs to incorporate  either of these into their audits. CJIS officials said that when CSAs request  audit guidance, CJIS makes information available to them on its audit  methodology and protocols, which include applying the 2-hour criterion to  assess a sample of missing children records. Standards for Internal  Control in the Federal Government call for agencies to ensure control  activities are in place that enforce management’s directives and effectively  accomplish agencies’ control objectives. Without such minimum audit  standards for assessing compliance with the entry requirement—including  applying the 2-hour criterion and how to sample missing children  records—CSAs’ audits may not be collecting as consistent and reliable  information on LEA compliance with the requirement as they could.  Minimum standards could also help CJIS better accomplish its specific  oversight and compliance objectives for timely entry of reports of missing  children. We recognize that when CSAs conduct audits, they have multiple  responsibilities to ensure compliance with all NCIC policies and face  resource constraints that may limit their ability to review missing children  records for timeliness. Therefore, it could be helpful for CJIS, CSAs, and  the Board to collaborate in developing minimum standards that are both  feasible to implement and provide reliable information on LEA  compliance. Once standards are established, CJIS could help ensure that  CSA audits are meeting standards by reviewing the audit approaches that  CSAs use to assess timeliness. This type of review is another key internal  control activity that could help CJIS achieve its oversight and compliance  objectives for the 2-hour entry requirement for reports of missing children.
section_title: Selected LEAs Identified Challenges to Reporting Missing Children; Using Existing Mechanisms to Obtain and Share Information on Such Challenges Could Assist DOJ in Its Oversight Role
paragraphs: Officials from eight of the nine LEAs we contacted identified custody  disputes and coordination with child welfare agencies as potential  impediments to reporting missing children to NCIC in a timely manner or  investigating these cases. OJJDP has funded research and policy  development to produce guidance in these areas, but CJIS and OJJDP  could take additional steps to better position DOJ to carry out its oversight  role over NCIC, with respect to helping ensure compliance with the 2-hour  requirement.
subsections: section_title: Challenges Relating to Custody Determination May Delay Reporting or Investigating Missing Children
paragraphs: Custodial issues may come into play when a child is missing as a result of  having been removed from his or her usual place of residence by a family  member. Officials from all of the nine LEAs we met with reported that the  responding officer may need to ascertain the custodial arrangements for  the child and whether the report is the result of a misunderstanding  between family members or constitutes an abduction by a family member.  More specifically, officials from seven of the nine LEAs reported that  challenges in making this determination may delay reporting or  investigation of the case. Of the seven LEAs that raised custody- determination issues as a challenge, officials in five LEAs said that where a  missing child case may involve interference by a noncustodial family  member, the report cannot be taken by law enforcement unless a court  docket number or judge’s order establishing custody is first produced. In  one case in one of these LEAs, waiting for court paperwork resulted in a 2- day delay between receiving a report from the parent, and entering the  report into NCIC. Officials in two of the seven LEAs said that further steps  must be taken to determine custody when the missing child’s parents were  never married and do not have a custody agreement, or when there are  competing custody orders from different states that must be resolved.  These steps can delay reporting into NCIC or investigating the case.
OJJDP, NCMEC, and the International Association of Chiefs of Police have  taken steps to try to address these issues. For example, in 2006, NCMEC  and the International Association of Chiefs of Police, with funding from  OJJDP, developed a model missing children’s policy for law enforcement  agencies, which agencies could use to establish guidelines and  responsibilities for agency personnel in responding to reports of missing  children. The model policy contains a provision stating that the LEA will  accept reports of missing children when it can be demonstrated that the  child has been removed, without explanation, from the child’s usual place  of residence, even if custody has not been formally established. OJJDP  officials stated that NCMEC currently makes use of the model policy in its  Missing and Exploited Children Chief Executive Officer Seminars for  police chiefs, sheriffs, and communication center managers. NCMEC  requests that participants provide a copy of their agency’s policy on  missing children in advance of the seminar, and NCMEC will review the  policies and offer suggestions for improvement or refer the participants to  the model policy developed by NCMEC and the International Association  of Chiefs of Police. In 2009, NCMEC also updated guidance for parents and  attorneys addressing family abductions, emphasizing in several places the  necessity for law enforcement to report to NCIC within 2 hours, even if  custody has not yet been determined.
section_title: Challenges to Coordination between LEAs and Child Welfare Agencies May Delay Reporting or Investigating Missing Children
paragraphs: Officials from six of the nine LEAs we interviewed reported that difficulty  in obtaining information about missing children who are in the child  welfare system (which includes individuals in the care of foster-care  group homes) may delay reporting to NCIC or the investigation of the  episode. These officials stated that the foster-care group homes do not  always collect information—such as the child’s height and weight or  parental information—that law enforcement needs to complete a missing  person report or the mandatory fields in NCIC. Officials from three LEAs  stated that while the lack of such information from the foster-care group  home does not prevent the initial reporting to NCIC, the lack of additional  information—such as a recent photo of the child—may delay the  investigation of a missing child because law enforcement must spend time  obtaining the necessary information. Furthermore, officials from three of  the six LEAs that raised coordination with child welfare agencies as a  challenge said that certain practices of foster-care group homes may result  in reporting delays. For example, these officials stated that personnel from  foster-care group homes sometimes reported the same incident multiple  times to law enforcement, which would require law enforcement  personnel to determine whether the existing record in NCIC was closed  and could be removed from the system in order to enter the most recent  reported incident, or whether the new report was the same as the prior  report that had already been entered into NCIC. In one LEA, officials  stated that in one week, they had received approximately 10 such  duplicate reports of missing children, the majority coming from a single  foster-care group home. Officials from one LEA stated that some of the  foster-care group homes in the jurisdiction do not always inform law  enforcement when a child has been located, thus requiring law  enforcement, when receiving a new report for the same child, to conduct  research into whether a prior case should have been closed before  entering a new record.
Officials from the three child welfare agencies we contacted in three of the  four states where LEA officials reported challenges in coordinating with  child welfare agencies noted that in some cases, foster-care group homes  may not have the information law enforcement needs to enter reports of  missing children into NCIC, but stated that this situation does not occur  very frequently. The officials said that ensuring that a recent photograph of  a child is available has been a challenge and that they are working to have  a recent photograph available for each child under their care. The officials  also acknowledged that their law enforcement partners have raised  concerns about foster-care group homes filing multiple reports for the  same missing child episode and about some child welfare personnel not  informing law enforcement when a child has been located. Officials from  two of the child welfare agencies stated that high staff turnover among  child welfare personnel may be a reason why some personnel do not know  how to best coordinate with law enforcement. According to these officials,  child welfare agencies may need to provide additional training and  oversight to ensure that child welfare personnel understand clearly when a  child should be reported missing to law enforcement and communicate in  a timely manner with law enforcement officials to inform them when  children are located or return.
DOJ, NCMEC, and the Child Welfare League of America have taken steps  to try to assist LEAs and child welfare agencies in addressing these issues.  For example, concerns about timely reporting and investigation of  children missing from care were highlighted by NCMEC in guidance it  issued in 2006 with funding from OJJDP. The guidance states that  collaboration between LEAs and child welfare agencies is necessary to  ensure that children missing from care are reported to law enforcement,  and provides a sample self-assessment for LEAs to use to help them  develop policies and procedures to enhance LEAs’ responses to children  missing from care. The self-assessment recommends that LEAs discuss  with child welfare agencies the type of information LEAs need from child  welfare agencies in order to complete a missing person report, and ensure  that law enforcement officers have a way to access child welfare data or  caseworkers 24 hours a day, 7 days a week. The Child Welfare League of  America, in partnership with NCMEC in 2005, developed guidelines for  standardized child welfare intake forms to ensure information necessary  for NCIC entry is routinely maintained by foster-care providers. DOJ’s  Office of Community Oriented Policing Services in 2006 also funded  development of a guide focusing on juvenile runaways that recommended  that LEAs work with foster-care group home providers to develop joint  protocols for reporting and sharing information.
section_title: Existing CJIS and OJJDP Mechanisms Could Be Useful for Collecting and Sharing Information about LEA Challenges to Timely Reporting
paragraphs: The fact that officials from eight of the nine LEAs we contacted reported  facing challenges entering missing children information into NCIC within 2  hours due to custody disputes and coordination with child welfare  agencies—even in the context of efforts by DOJ to develop and  disseminate guidance regarding these issues—raises questions about the  extent to which LEAs are well-positioned to comply with the 2-hour entry  requirement. According to OJJDP officials, although guidance relating to  custody disputes and coordination with child welfare agencies was, for the  most part, developed prior to the passage of the 2-hour entry requirement  in 2006, OJJDP believes the guidance remains useful in helping LEAs  address these challenges, and has not undertaken additional efforts to  update it. According to the officials, the guidance is disseminated widely  to law enforcement personnel in the field, through national conferences  and other mechanisms, and is used in training courses funded by OJJDP  and provided by NCMEC.
DOJ does not know the extent to which the challenges we identified in our  LEA interviews exist across all LEAs. However, CJIS officials told us that  due to the limited scope of its audits and the limited investigative expertise  of its auditors, CJIS’s Audit Unit would not be in a position to assess local  challenges to reporting missing children to NCIC as part of CJIS’s triennial  audit cycle. We recognize that CJIS’s Audit Unit may be limited in its  ability to conduct a nationwide assessment of the challenges that LEAs  face in meeting the 2-hour reporting requirement. We also recognize that  when CSAs conduct local audits of each LEA in their respective states  every 3 years, they have multiple responsibilities to ensure compliance  with all NCIC policies and face resource constraints that may limit their  ability to assess local challenges to reporting. However, there are other  existing CJIS and OJJDP mechanisms that could be useful for collecting  and sharing information about LEA challenges to timely reporting and the  ways in which some LEAs have successfully addressed these challenges.  For example, the CJIS Advisory Policy Board’s working groups and  subcommittees and CJIS’s voluntary annual training for representatives of  all CSAs and selected LEAs in each state could be useful for obtaining  information on the extent and severity of challenges faced by LEAs. They  could also be useful for disseminating information on how LEAs have  successfully implemented forms or protocols or collaborated with foster- care group homes to ensure missing children are reported in a timely  fashion. In addition, OJJDP could obtain information on challenges to  timely reporting and disseminate information on successful efforts to  mitigate these challenges in OJJDP-funded training courses for local law  enforcement officials. Standards for Internal Control in the Federal  Government call for management to identify and analyze the relative risks  from internal and external sources associated with achieving the agency’s  objectives. Using existing CJIS and OJJDP mechanisms to (1) obtain  information on the extent to which LEAs face the types of challenges we  identified, as well as other challenges that may be prevalent or significant  and (2) share examples of LEA-reported successes to mitigating the  challenges, could better position DOJ to carry out its oversight role over  NCIC with respect to helping ensure compliance with the 2-hour  requirement.
section_title: Conclusions
paragraphs: CJIS has a responsibility to ensure that missing children records are  complete, accurate, and timely to comply with federal requirements and  promote law enforcement’s ability to investigate, locate, and provide  support to missing children. CJIS’s reliance on CSAs to ensure compliance  with the 2-hour entry requirement underscores the importance of CSAs’  triennial audits of all LEAs that enter data into NCIC within their  jurisdiction. Evidence from our review of six CSAs raises questions about  the consistency and reliability of information from CSA audits on LEA  compliance with the 2-hour entry requirement. Therefore, we believe it  could be helpful for CJIS and the Board to consider establishing minimum  audit standards for assessing compliance with the entry requirement. Such  minimum standards could better position CSAs to design audits of LEAs to  obtain more consistent and reliable information on LEA compliance with  the requirement. This could also help CJIS better accomplish its specific  oversight and compliance objectives for timely entry of reports of missing  children. Once these standards are established, by reviewing the CSA audit  approaches as part of CJIS’s own triennial audits of CSAs, CJIS could help  ensure the standards are being met.
Because some LEAs we visited continued to identify challenges due to  custody disputes and coordination with child welfare agencies that  affected their ability to meet the 2-hour entry requirement despite DOJ’s  previous efforts to address such challenges, it could be useful for CJIS and  OJJDP to consider using existing mechanisms to determine the extent to  which LEAs face these and other kinds of challenges and to share  approaches that LEAs have taken to mitigate these challenges. Such  actions could better position DOJ to carry out its oversight role over NCIC  with respect to helping ensure compliance with the 2-hour requirement.
section_title: Recommendations for Executive Action
paragraphs: We are making the following three recommendations:  To increase the likelihood that CJIS is positioned to oversee compliance  with the requirement that LEAs enter records of missing children into  NCIC within 2 hours, we recommend that the Director of the FBI direct  CJIS to consider:  In collaboration with CSAs and the Board, establishing minimum  standards that provide CSAs guidance on assessing compliance with  timely entry requirements, including applying the 2-hour criterion and how  to sample missing children records; and    Ensuring that in future triennial audits, CJIS assesses the extent to which  CSA audit programs adhere to the minimum standards.
To increase the likelihood that LEAs are better positioned to comply with  the requirement to enter missing children records into NCIC within 2  hours, we recommend that the Director of the FBI and the Administrator  of OJJDP consider opportunities to use existing mechanisms to obtain  information on the extent to which LEAs face challenges—such as  custodial determinations and coordination with child welfare agencies—in  reporting missing children to NCIC, and share examples of successful  efforts to mitigate these challenges.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DOJ for its review and comment. We  received written comments from the FBI, which are reproduced in full in  appendix I. The comments focused on actions the FBI plans to take, to  recommend that the CJIS Advisory Policy Board revise its policy so that  agencies found to be non-compliant with the 2-hour requirement are  referred immediately for sanctions. We did not recommend this as part of  our review, however, and so cannot address the extent to which it will  impact law enforcement’s ability to comply with the 2-hour requirement.  Because DOJ’s comment letter did not state DOJ’s position on our  recommendations, we engaged in discussions and e-mail exchanges with  DOJ officials and on June 7 the Department’s audit liaison confirmed that  the Department concurred with all three recommendations.
On May 12, the Unit Chief of CJIS’s Audit Unit provided oral comments  regarding our first two recommendations. Specifically, he stated that CJIS  plans to suggest that the Board consider and approve our first two  recommendations—establishing minimum audit standards for assessing  compliance with the 2-hour requirement and assessing adherence to the  standards in future CJIS audits. In a June 7 email, DOJ’s audit liaison  stated that during meetings in fall 2011, CJIS, through the Advisory Policy  Board, plans to solicit the law enforcement community’s input on our third  recommendation regarding challenges to timely entry. Specifically,  according to DOJ’s audit liaison, CJIS plans to obtain information  regarding the challenges of entering missing children reports into NCIC in  a timely manner, request examples of successful efforts to mitigate the  challenges presented and, among other things, document the lessons  learned so that they can be shared among the law enforcement  community. Furthermore, the liaison stated that OJJDP will include the  subject of timely reporting in at least six training sessions for local law  enforcement that OJJDP will sponsor over the next fiscal year. We believe  these steps would address the intent of our recommendations.
Because CJIS and OJJDP plan to take these steps, we redirected our first  two recommendations to the Director of the FBI, and our third  recommendation to both the Director of the FBI and the Administrator of  OJJDP, rather than the Attorney General. In commenting on the draft, the  Unit Chief of CJIS’s Audit Unit reported that CJIS shares responsibility for  implementing and monitoring compliance with the 2-hour requirement  with the Board. Thus, we have modified language in the objective and in  the body of the report to reflect this shared responsibility. Finally, the FBI  provided technical comments which we incorporated into the report, as  appropriate.
As agreed with your offices, we plan no further distribution of this report  until 30 days from its date, unless you publicly announce its contents  earlier. At that time, we will send copies of this report to the Attorney  General, selected congressional committees, and other interested parties.  In addition, this report will be available at no charge on the GAO Web site  at http://www.gao.gov.
If you or your staff have any further questions about this report, please  contact me at (202) 512-8777 or larencee@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on the  last page of this report. Key contributors to this report are listed in app. II.
section_title: Appendix I: Comments from the Federal Bureau of Investigation
section_title: Appendix II: GAO Contact and Staff Acknowledgments
paragraphs: Eileen R. Larence, (202) 512-8777 or larencee@gao.gov.
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Evi Rezmovic, Assistant Director;  Tom Jessor; Heather May; Susan Czachor; Keesha Egebrecht; Sharanjit  Singh; Bill Crocker; Janet Temko; Amanda Miller; Linda Miller; Labony  Chakraborty; and Cheron Green made significant contributions to this  report.