Federal Bureau of Investigation: Actions Taken to Address Most Procurement Recommendations
Published: 2011-09-06T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The FBI has spent over $900 million on the Trilogy and Sentinel information technology (IT) projects intended to provide FBI with an upgraded IT infrastructure and an automated case management system to support FBI agents and analysts. In February 2006 and July 2008, GAO reported on significant internal control weaknesses related to FBI's contract administration, processing of contractor invoices, and accountability for equipment acquired for these projects. GAO made 27 recommendations to the FBI to address these deficiencies. The FBI concurred with all 27 recommendations. This report provides an assessment of (1) the FBI's corrective actions to address GAO's 27 recommendations and (2) whether there were any indications of implementation issues related to the policies and procedures the FBI developed to address 17 of the 27 recommendations. GAO reviewed FBI policies and procedures, performed walk-throughs, and conducted detailed tests on statistically and nonstatistically selected samples of transactions.
section_title: What GAO Found
paragraphs: The corrective actions developed by FBI were sufficient to address 21 of the 22 Trilogy recommendations and all 5 Sentinel recommendations. The FBI substantially addressed: 17 Trilogy recommendations related to contract administration, invoice processing, and property accountability by establishing or revising policies and procedures; 4 by contracting for follow-up audits of the Trilogy costs; and the 5 Sentinel recommendations by revising Sentinel policies and procedures. The one Trilogy recommendation that FBI did not address completely was related to 1,205 missing, lost, or stolen Trilogy assets. As of February 2011, the FBI had researched and determined the status of all but 134 of these assets. FBI officials stated that almost all of these assets had a useful life of 7 years, and if they were not already returned or destroyed, they are now obsolete. There are diminishing returns to continue to pursue these assets, which included several information technology items that could potentially contain sensitive information. However, if the FBI is able to determine the status of any of these assets in the future, officials stated that they will make the entries to properly record them in FBI's property management application (PMA). In assessing implementation of the policies and procedures developed in response to GAO's 17 Trilogy recommendations related to contract administration, invoice processing, and property accountability, GAO found that policies and procedures related to the 4 recommendations dealing with contract administration, including interagency agreements, were effectively implemented but also identified a new issue. Specifically, GAO found that forms--required by the Federal Acquisition Regulation to support the use of interagency agreements to conveniently or economically obtain supplies and services--were not timely completed for 15 of 54 statistically selected interagency agreements tested, and found that FBI's monitoring did not identify this deficiency. GAO estimates that as much as 39.5 percent of FBI's fiscal year 2009 interagency agreements did not meet this requirement, increasing the risk that funds may have been disbursed for goods or services that were not in the best interest of the government. In addition, GAO's testing of FBI's implementation of polices and procedures for the remaining 13 recommendations that were related to invoice processing and property accountability found indications of implementation issues in 3 areas. (1) Regarding the review of contractors' invoices, 5 invoices (of the 37 tested) that had been reviewed and approved by FBI officials included labor rates that were not fully supported by the contract documentation. Without verifying labor charges against the contractor's proposal as required by FBI policy, there is an increased risk of disbursing funds for unallowable charges. (2) For property accountability, GAO found instances in which FBI (1) did not record accountable property items in its system in a timely manner and (2) did not accurately record key accountability information, such as location and serial numbers, as required by FBI's policies. These shortcomings increase the risk that assets could be lost or stolen and not be detected and investigated in a timely manner.
section_title: What GAO Recommends
paragraphs: GAO makes three new recommendations to improve interagency agreement controls and determine if additional actions are necessary to improve controls for invoice processing and property accountability. The FBI concurred with all three recommendations and discussed actions it has initiated to address GAO's recommendations.

section_title: Letter
paragraphs: Since 2001, the Federal Bureau of Investigation (FBI), an agency of the  United States Department of Justice, has spent more than $700 million,  as of August 2010, on two projects to develop an automated investigative  case management system to support FBI agents, analysts, and other  management officials, and more than $200 million on upgrading its  information technology (IT) infrastructure. Our February 2006 report on  the FBI’s Trilogy project and July 2008 report on its subsequent Sentinel  project focused on whether the FBI’s internal controls provided  reasonable assurance that payments to the Trilogy and Sentinel  contractors were for allowable costs and properly supported, and that  accountability was maintained over equipment purchased for the  projects.  We identified internal control weaknesses, some significant,  related to the FBI’s contract administration, processing of contractor  invoices, and accountability for equipment acquired during these projects.  We made 27 recommendations to the FBI to address the identified  deficiencies. Many of these recommendations focused on developing or  revising policies and procedures, which had broad applicability to the  FBI’s procurement processes, while others focused on specific Trilogy or  Sentinel project weaknesses.
Because the FBI continues to enter into contracts to acquire goods and  services and disburses millions annually related to these contracts, it is  critical that the FBI fully address the internal control deficiencies identified  in our Trilogy and Sentinel reports. In accordance with your request and  as agreed to with your staff, our objectives are to assess whether:  (1)  the FBI’s new or revised policies and procedures and other specific  corrective actions were sufficient to address the recommendations we  made in our Trilogy and Sentinel reports and  (2)  there were any indications of implementation issues related to the  policies and procedures FBI developed to address 17 of the 27  recommendations.
To assess if the FBI’s new or revised policies and procedures and other  corrective actions were sufficient to address the recommendations in our  prior reports, we (1) reviewed the FBI’s documented corrective actions for  each recommendation and supporting documentation; (2) held interviews  with FBI personnel responsible for the development of the corrective  actions; (3) reviewed documentation related to new or revised policies  and procedures as well as related training materials; and (4) requested  and reviewed additional relevant documentation identified during our  interviews.
To assess whether there were any indications of FBI-wide implementation  issues related to the policies and procedures that FBI developed in  response to 17 of our 27 recommendations, we performed several types  of procedures. Depending on the nature of the policy and procedure  being implemented, or other corrective action being taken, our follow-up  work consisted of detailed testing of certain statistically and  nonstatistically selected transactions, walk-throughs, document reviews,  and interviews. For example, we performed detailed testing of  interagency agreements and contracts statistically selected from the  universe of interagency agreements and contracts executed by the FBI  during fiscal year 2009. We then nonstatistically selected purchase  orders, invoices, and accountable property associated with the selected  contracts and performed detailed testing to determine whether there were  any indications that the FBI did not fully or consistently perform the  activities prescribed in its new or revised policies and procedures. We  evaluated these selected transactions against the FBI’s documented  policies and procedures and considered the Federal Acquisition  Regulation (FAR), Office of Management and Budget’s (OMB) guidance  for interagency agreements, our Standards for Internal Control in the  Federal Government, and the Federal Accounting Standards Advisory  Board’s (FASAB) accounting standards for accountable property.    Further details on our scope and methodology are included in appendix I.
We provided the FBI with a draft of this report for review and comment.  The FBI provided written comments, which are reprinted in appendix III.  The FBI also provided technical comments, which we have incorporated  as appropriate. We conducted this performance audit from February 2010  through September 2011 in accordance with generally accepted  government auditing standards. Those standards require that we plan  and perform our audits to obtain sufficient, appropriate evidence to  provide a reasonable basis for our findings and conclusions based on our  audit objectives. We believe that the evidence obtained provides a  reasonable basis for our findings and conclusions based on our audit  objectives.
subsections: section_title: Background
paragraphs: In May 2001, the FBI initiated a major IT upgrade project known as  Trilogy. Trilogy consisted of three parts: (1) the Information Presentation  Component (IPC) to upgrade FBI’s computer hardware and software, (2)  the Transportation Network Component (TNC) to upgrade the FBI’s  communication network, and (3) the User Application Component (UAC)  to upgrade and consolidate the FBI’s five most important investigative  applications.
The IPC component provided for new desktop computers, servers, and  commercial-off-the-shelf automation software, including Web-browser and  e-mail software to enhance usability by the agents. The TNC component  called for upgrading the complete communication infrastructure. These  upgrades were expected to provide the physical infrastructure that would  run the applications that were to be developed under the UAC component  of the Trilogy project to replace the FBI’s paper case files with electronic  files and improve efficiency and replace the obsolete Automated Case  Support system, the FBI’s primary investigative application that uploads  and stores case files electronically.
Our 2006 audit of the project’s costs identified significant internal control  deficiencies over administration of contracts and interagency agreements,  the processing (review, approval, and payment) of invoices, and the  accountability over assets purchased under the project. More  specifically, we reported that the FBI’s review and approval process for  contractor invoices did not provide an adequate basis for verifying that  goods and services billed were actually received by the FBI or that  payments were for allowable costs. This occurred in part because  responsibility for the review and approval of invoices was not clearly  defined in the interagency agreements related to the Trilogy project and  because contractors’ invoices frequently lacked the detailed supporting  documentation necessary for an adequate review of invoice charges.  During our audit, we identified more than $10 million in questionable  contractor costs paid by the FBI for the Trilogy project. With respect to  property, we reported that the FBI: (1) did not adequately maintain  accountability for purchased computer equipment; (2) relied extensively  on contractors to account for Trilogy assets while they were being  purchased, warehoused, and installed; (3) did not establish controls to  verify the accuracy and completeness of contractors’ records on which  the FBI was relying; (4) did not ensure that only the items approved for  purchase were acquired by the contractors, and that the bureau received  all those items; and (5) did not establish adequate physical control over  the assets. As a result of these deficiencies, we identified more than  1,200 pieces of missing equipment that we estimated to be worth more  than $7.5 million.
We made 22 recommendations to the FBI in our 2006 report on Trilogy.  Of the 22 recommendations, 17 were focused on developing agencywide  policies and procedures to address internal control weaknesses in the  FBI’s procurement and contract administration processes. The remaining  five recommendations were specific to the Trilogy project and were  related to contractor overpayments and accountable property.
The FBI discontinued the virtual case file component of its Trilogy project  in March 2005, after it was determined to be infeasible and cost  prohibitive to implement as originally envisioned. FBI’s Sentinel project  was approved in July 2005 and was to succeed and expand on elements  of the Trilogy project, namely to provide the FBI with a modern,  automated investigative case-management system. The Sentinel project  management office (PMO) had designed and implemented policies and  procedures that assigned specific invoice-review responsibilities and  required Sentinel contractors to provide detailed support for all invoiced  amounts and to obtain advance approval from the Sentinel PMO for  travel, overtime, and other direct costs.
With respect to Sentinel equipment, we reported that the Sentinel PMO  had established policies and procedures specific to the Sentinel project to  ensure Sentinel’s equipment purchases were properly authorized and that  received property was timely inspected and entered into the FBI’s  Property Management Application (PMA). However, we did identify some  additional opportunities for the Sentinel PMO to improve controls over  purchased equipment for the Sentinel project. We made five  recommendations to the FBI related to Sentinel.
section_title: FBI Developed Policies and Procedures and Took Other Specific Corrective Actions Sufficient to Address 26 of 27 Prior Recommendations
paragraphs: The corrective actions developed by the FBI were sufficient to address 21  of the 22 Trilogy recommendations and all 5 of the Sentinel  recommendations we made in our prior reports. The FBI substantially  addressed 17 Trilogy recommendations related to contract administration,  invoice processing, and property accountability by establishing or revising  policies and procedures, 4 by contracting for follow-up audits of the  Trilogy costs, and the 5 Sentinel recommendations by revising Sentinel  policies and procedures. Of the 27 prior recommendations, 17 focused on  establishing, revising, or reinforcing policies and procedures with FBI- wide applicability. We found that the FBI had sufficiently developed,  revised, or updated these policies and procedures as we recommended.  For example, in response to our recommendation that the FBI revise its  policies and procedures to require that accountable assets be entered  into PMA immediately upon receipt rather than within the prior 30-day  time frame, the FBI issued a new policy that required that accountable  property be recorded in PMA within 48 hours of being received. Appendix  II provides information on each of the 27 Trilogy and Sentinel  recommendations and the specific corrective actions developed by the  FBI.
We also made four recommendations in our Trilogy report related to the  recovery of overpayments and reimbursement of questionable costs from  Trilogy contractors. In response to these recommendations, the Defense  Contract Audit Agency (DCAA), an independent third party, was engaged  to perform post audit reviews of contractor billings for the Trilogy project.  DCAA conducted separate audits of the billings submitted by the two  prime contractors, Computer Sciences Corporation (CSC) and Science  Applications International Corporation (SAIC), as well as the billings  submitted by the numerous subcontractors, and identified over $18 million  in questioned costs.  DCAA defines questioned costs as those costs that  are not acceptable for negotiating a fair and reasonable contract price.  DCAA’s audits included reviewing the areas with potential overpayments  we had identified as well as assessing if other identified questionable  costs should be reimbursed. The most significant questioned costs were  costs incurred outside the effective dates of temporary labor agreements,  missing supporting documentation, application of incorrect billing rates,  unapproved timesheets, unapproved overtime, and subcontractor  overbillings.
The one recommendation that the FBI had not fully addressed from our  Trilogy report recommended that the FBI investigate the 1,205 assets that  we identified as missing, lost, or stolen and determine whether any  confidential or sensitive information may be exposed to unauthorized  users, and identify any patterns related to the equipment that could  necessitate a change in FBI policies and procedures. These assets  consisted of a variety of information technology items, including desktop  computers, servers, and laptops that could potentially contain confidential  or sensitive information that could be exposed to unauthorized users.
In February 2011, FBI officials provided documentation accounting for the  status of all but 134 assets, including desktop computers, laptops, and  servers that could contain sensitive information. With regard to the 134  assets, the FBI stated that all of these assets had a useful life of 7 years  or less and that if they were not already returned or destroyed, they are  now obsolete and that spending more time or resources to search for the  obsolete equipment would be wasteful. Instead the FBI is focused on  implementing a new property management system, and incorporating  property management lessons learned from the Trilogy project. However,  FBI officials also stated they would make the necessary entries to  properly record any of the remaining 134 assets for which they  subsequently determine the status.
section_title: Potential Issues Identified in Certain Areas Related to Implementation of FBI-Wide Policies and Procedures
paragraphs: Although the FBI developed or revised policies and procedures in  response to 17 of our prior recommendations, our testing to assess their  implementation FBI-wide identified possible issues in certain areas. In our  testing of the four recommendations dealing with interagency agreements  and contracts, we found that they were effectively implemented, but we  identified a new issue unrelated to our prior recommendations. In our  implementation testing for the remaining 13 corrective actions, we  identified indications of implementation issues for 3 of them.
subsections: section_title: Tests Show Effective Implementation of Actions Related to Interagency Agreements and Contracts, but One New Issue Identified
paragraphs: As shown in table 1, our tests related to policies and procedures over  interagency agreements and contracts indicated that the FBI had  effectively implemented these corrective actions.
In the course of testing the interagency agreement sample transactions,  we identified a new issue unrelated to our prior recommendations.  Specifically, the Federal Acquisition Regulation (FAR) requires that any  interagency agreement entered into under the authority of the Economy  Act, 31 U.S.C. § 1535, be supported by a Determination and Findings  document. The Determination and Findings form identifies the  responsible agencies to the agreement (requesting agency and servicing  agency), is prepared by the requesting agency, and identifies the goods  or services that are to be provided by the servicing agency. In addition, it  documents the requesting agency’s determination that, among other  things, the use of an interagency acquisition is in the best interest of the  government, and the supplies or services cannot be obtained as  conveniently or economically by contracting directly with a private source.  The FAR also requires that the requesting agency complete the  Determination and Findings form before placing an order for supplies or  services with another government agency.
In reviewing our statistical sample of 55 interagency agreements with  regard to implementation of our prior recommendations, we identified 54  interagency agreements that were required to comply with FAR  requirements related to Determination and Findings and found that 15 of  them did not comply with these FAR requirements. For these 15 cases,  the required Determination and Findings forms supporting the execution  of interagency agreements between the FBI and other federal entities  were prepared and signed after the interagency agreements were  executed—in some cases more than a year later.    Three Determination and Findings forms were signed less than 3  months after the date of the related purchase orders were issued.    One Determination and Findings form was signed between 3  months and 6 months after the date of the related purchase order  was issued.    Seven Determination and Findings forms were signed between 6  months and 1 year later.    Four Determination and Findings forms were signed more than a  year after the date of the related purchase orders.
Based on the results of our review, we are 95 percent confident that the  total percentage of interagency agreements executed by the FBI in fiscal  year 2009 that lacked a required Determination and Findings form prior to  the FBI placing the order could be as much as 39.5 percent.
FBI officials acknowledged that the Determination and Findings forms  were not completed prior to placing orders for goods and services and  provided two explanations. The interagency agreements and related  documentation for some of them were executed by a new employee who  was instructed to prepare and include the Determination and Findings  forms after the files had been reviewed by the Unit Chief, and a  contracting officer did not prepare and submit the interagency agreement  documentation to the Unit Chief in a timely manner for the others. The  FBI’s monitoring of the interagency agreement process did not identify  that the Determination and Findings forms were not properly prepared as  required. Internal controls should be designed to assure that ongoing  monitoring occurs in the course of normal operations. By not completing a  required Determination and Findings form prior to issuing a purchase  order, obligating the agency for the purchase order amount, the  requesting agency risks obligating funds for supplies and services or both  that are not in the best interest of the government, and executing a  contract that is not in compliance with federal laws or regulations.
section_title: Other Tests Identified Issues with Implementation of Certain FBI-wide Policies and Procedures
paragraphs: Of the remaining 13 corrective actions that involved the implementation of  FBI-wide policies and procedures, our testing found indications that 3 of  them may not have been fully or consistently implemented. As shown in  table 2, our tests of non-statistically selected transactions identified  implementation issues primarily in policies and procedures related to  review of contractor invoices and accountability for purchased assets.
As shown in table 2, our detailed testing found instances in which the FBI  had not fully implemented the policies and procedures established in  response to our prior recommendations in this area. Internal control  standards require agencies to establish controls that reasonably ensure,  among other things, that funds, property, and other assets are  safeguarded against waste, loss, or unauthorized use. The FBI requires  contractors bidding on contracts to submit proposals that include direct  labor categories and rates, subcontractor labor categories and rates, and  other direct costs used to calculate the total cost of their proposal.  Contractor invoices must include key information such as employee  name, labor classification, rate of pay, hours worked for billed labor  charges and support for other charges. FBI guidance states that staff  performing invoice reviews should compare the key data to the contractor  proposal to verify the accuracy of amounts charged.
During our review of a non-statistical sample of 37 contractor invoices, we  found unsupported charges of $292,684 on five invoices submitted by  three contractors for three separate contracts that totaled $6,293,046 for  prime contractor and subcontractor direct labor, materials, and other  direct costs. Specifically, these totals include:    We reviewed an invoice, dated October 5, 2009, submitted by one  contractor that included direct labor charges of $16,963 for one  labor group that was not included in the contractor’s cost  proposal. The FBI acknowledged that the labor group was not  listed in the original proposal by the contractor but stated that  during the course of the contractual effort, the contractor  determined there was a need for labor to be performed on the  contract that required the skill set of a labor group that had not  been included in the contractor’s cost proposal. In addition, the  FBI stated that the rate charged resulted in a savings to the FBI  under this contract without affecting the contract schedule or  deliverables. However, the FBI did not provide us with  documentation supporting the FBI’s approval of the new labor rate  for the contract prior to the period billed on the invoice. In addition,  the invoice included $50,000 for the work of a subcontractor. In  our review of the contractor’s proposal related to subcontractor  labor, we noted that it included, for this specific subcontractor, a  proposed labor rate of $184.84 for 610 hours for a total of  $112,752. However, the invoice documentation did not include  any information such as the name of the subcontractor  employee(s), the labor category, the hours worked, or the rate of  pay under other direct costs that would allow the FBI to verify the  accuracy and validity of the charges.
In our review of two invoices submitted by another contractor, we  found that the contractor had billed the FBI $97,851 for direct  labor and subcontractor labor at rates, six for the contractor and  three for a subcontractor, which were not included in the  contractor’s proposal.    Similarly, in our review of two invoices submitted by a contractor  for a third contract we found that they included labor charges of  $127,870 at hourly labor rates, for four contractors and two  subcontractors, which were not supported by the contractor’s  proposal.
We also discussed our findings related to the second and third  contractor’s invoices with FBI officials, and they explained that in  reviewing the invoices they focus on the status of the project and its  various components or tasks. They also stated that both contractors  submitted monthly reports to the FBI that included the actual costs of the  project for each current month as well as the costs of the project to date  and compared the costs to project’s budget. However, the FBI also stated  that it did not require the contractors to provide analyses for cost  variances except when variances exceed thresholds set for the two  contracts. Without verifying labor groups and labor rates billed on  contractor invoices against the contractor’s proposal as required by FBI  policy, the FBI is at increased risk that it will not identify erroneous or  improper billings and will disburse government funds for unallowable  contractor charges.
As shown in table 2, we also found instances in which the FBI did not  record accountable property items in its system in a timely manner and  did not accurately record key accountability information such as location  and serial numbers as required by the FBI’s policies and procedures.    The FBI’s revised policy, which is in response to our prior  recommendation, requires that accountable property be recorded into  the Property Management Application (PMA) within 48 hours of  receipt instead of within 30 days of receipt, which was the FBI’s policy  at the time our 2006 report. Internal control standards require  agencies to establish controls that reasonably ensure, among other  things, that funds, property, and other assets are safeguarded against  waste, loss, or unauthorized use. In our review, we found 406 pieces  of accountable property out of the 674 we tested had not been  recorded in PMA within 48 hours of being received as now required  and that some had not been recorded until more than a month after  being received. However, we also noted that the FBI, while not  adhering to its more stringent current policy, had recorded 90.7  percent of the accountable property we tested within 30 days of  receipt. This represents an improvement from the situation that  existed at the time of our Trilogy work. During its agencywide upgrade  of hardware and software under the Trilogy project, the FBI only  recorded 28.4 percent of accountable property that we reviewed,  within 30 days of receipt, as reported in our 2006 report.
FBI management acknowledged that property was not being recorded  in compliance with its policy. FBI management officials explained that  this condition was due to property being ordered and received by  numerous FBI divisions and field offices and that some of these  divisions and field offices, did not have dedicated staff for recording  purchased assets in PMA immediately upon receipt of the property.  This situation serves to delay the recording of the assets in PMA. In  addition, they explained that some accountable property ordered by  the various FBI offices is delivered to FBI storage facilities and held  for security reasons before being delivered to the end user and that  these properties are not recorded in PMA until received by the end  user. Recording of property in PMA is critical in establishing  accountability. The longer it takes to record property in PMA, the  greater the risk that property may be stolen or lost without detection  by the FBI.
In 2006, the FBI issued a policy to all FBI divisions that made  recording the location field when accountable property is added to  PMA or when corrections to records are made, mandatory. In  addition, the policy stated that the information recorded in the location  data field is the location of the property within the division or “legat.”  In reviewing the data entry screens for recording assets in the FBI’s  property management application we noted that there are fields that  can be utilized by the property custodian to provide a location within  the division or legat. In our review of the PMA screens for the selected  property items we found that the information recorded in PMA for 80  of the 674 records did not provide sufficient information on the  location of the property within the division as required.
In addition, we found that the serial number field was either blank,  incomplete, or had the entry “719TOBEADDED” in the PMA records  for 14 of the 674 tested assets. In addition, the five records that had  “719TOBEADDED” recorded, had not been updated for more than a  year. We also found 45 PMA records in which the model description  was entered as “TO BE ADDED.” The model description was missing  for all 45 assets for more than a year, with 6 of these assets lacking  this information for almost 2 years since they were first entered in  PMA.
We brought these findings above to the attention of FBI officials. With  regard to the location information, the FBI stated that while the location  field is mandatory, there is no requirement on the amount of detail to be  listed. However, as mentioned previously, the 2006 policy issued by the  Asset Management Unit clearly states that the information recorded in the  location data field is the location of the property within the division or  legat. The lack of key information such as model, manufacturer,  description, serial number, and specific location information in PMA as  required by FBI policy would limit its ability to investigate assets reported  as missing during physical inventories. In addition, inadequate location  information results in the lack of a systematic means of identifying where  an asset is located or when it is moved, transferred, or disposed of.
section_title: Conclusions
paragraphs: The FBI has taken action to address 26 of the 27 recommendations we  made in our prior Trilogy and Sentinel reports. Many of these actions  involved developing policies and procedures. Developing and  communicating policies and procedures, while critical, is only the first step  that the FBI must take to address the identified internal control  weaknesses. Management must also ensure that the policies and  procedures are effectively implemented throughout the agency. Although  we found that the FBI had effectively implemented policies and  procedures related to interagency agreements and contracts, our tests on  the statistical selected transactions showed that additional action is  needed to ensure that Determination and Findings forms are properly  completed before the FBI enters into interagency agreements. With an  estimated 40 percent of its interagency agreements lacking a properly  completed Determination and Findings form, the FBI increases the risk  that it is obligating funds for supplies and/or services that are not in the  best interest of the government or executing a contract that is inconsistent  with federal laws or regulations. Further, we identified several other areas  where the implementation of policies and procedures, primarily related to  review of contractor invoices and accountability for purchased assets,  may need to be strengthened. Our testing of selected invoice transactions  identified unsupported labor categories and rates billed by contractors.  This situation points to a lack of thorough review of contractor invoices.  This weakness puts the FBI at risk of making payments to contractors for  questionable or improper charges. Additionally, our testing of selected  accountable property items identified property items that were not timely  or accurately recorded. This problem decreases the FBI’s ability to  adequately safeguard its accountable property. Identifying and correcting  any systemic weaknesses in these areas will be critical to achieving  sustainable improvements in the FBI’s agencywide controls over its  procurement activities.
section_title: Recommendations
paragraphs: We recommend that the Director of the FBI direct the Chief Financial  Officer take the following three actions.    Enhance the monitoring of the interagency agreements process to  ensure that Determination and Findings forms are prepared, when  applicable, in accordance with federal and agency requirements.
In the area of contractor invoice review and approval, we recommend  the Director of the FBI to direct the Chief Financial Officer to:    review agencywide implementation of the new or revised policies  and procedures related to our prior recommendations to verify that  invoice costs are in accordance with contract terms to determine if  the indications of issues we identified in this report represent  systemic, agencywide implementation deficiencies, and  take appropriate, cost-effective actions to better ensure  agencywide compliance with the applicable policies and  procedures.
In the area of property accountability, we recommend the Chief  Financial Officer be directed to:  review agencywide implementation of the new or revised policies  and procedures related to our prior recommendations to record  specific data for acquired assets within specified time frames to  determine if indications of issues we identified in this report  represent systemic, agencywide implementation deficiencies, and  take appropriate, cost-effective actions to better ensure  agencywide compliance with the applicable policies and  procedures.
section_title: Agency Comments
paragraphs: In its written comments, FBI concurred with our recommendations and  stated that it has already initiated changes to its processes and  procedures to address our recommendations. FBI stated that it provided  interagency agreement training to its contract specialists and is now  testing an application to monitor, collect, and document information for all  FBI interagency agreements. The FBI further stated that it is taking steps  to ensure that invoices are properly reviewed, including strengthening its  procurement training curriculum and modifying the current contract  specialist file review checklist to include comparing invoiced labor  categories and costs to labor categories and costs in supporting  contracts. Additionally, the FBI stated that it has developed an  accountable property officer training course intended to help ensure that  its divisions have an effective and efficient property management  program, and that actions are under way to configure a new property  management application to include additional controls to better track  physical location of purchased assets. If properly implemented, the  activities outlined in FBI’s letter should help further improve FBI’s  accountability for future interagency acquisitions and accountable  property. FBI’s comments are reprinted in their entirety in appendix III.  FBI also provided technical comments, which we have incorporated as  appropriate.
As we agreed with your office, unless you publicly announce the contents  of this report earlier, we plan no further distribution of it until 30 days from  the report date. At that time, we will send copies to interested  congressional committees. We will also send copies to the Attorney  General, the Director of the Federal Bureau of Investigation, and other  interested parties. The report will also be available at no charge on GAO’s  Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-9471 or franzelj@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made major contributions to this report  are listed in appendix IV.
section_title: Appendix I: Scope and Methodology
paragraphs: To address our first objective to determine whether the FBI’s new or  revised policies and procedures and other specific corrective actions were  sufficient to address the 27 recommendations we made in our Trilogy and  Sentinel reports, we performed an assessment of the FBI’s corrective  action plans and reviewed additional supporting documentations received  from the FBI. Specifically, in its required 60-day letter to Congress, the  FBI explained the corrective actions it had taken or planned to take to  address the issues we identified in our report. In addition, in mid-2006,  the FBI submitted additional documentation to GAO which included  revised or updated corrective action plans for each recommendation.  Also, in the third quarter of 2009, the FBI submitted additional  documentation to GAO for selected recommendations to support  additional corrective action steps taken since 2006. We also identified key  operations and management officials at the FBI responsible for the  development of the corrective actions and conducted interviews and walk- throughs to ensure that we fully understood the corrective actions. We  reviewed additional information and documentation identified during our  interviews, as well as new and revised policies and procedures and  training materials received from the FBI, and utilized this information to  make a determination of whether the corrective actions were adequately  designed to address our recommendations.
To address our second objective to determine whether there were any  indications of implementation issues related to the policies and  procedures that the FBI developed to address 17 of the 27  recommendations, we selected statistical samples of interagency  agreements and contracts. We then non-statistically selected purchase  orders, invoices, and accountable property from the contracts selected in  the statistical samples and performed a variety of detailed tests. In our  review of the FBI’s corrective action plans, we determined that the agency  had continued to take corrective actions to address our recommendations  through fiscal year 2008. Therefore, in order to obtain a more  representative population of transactions that had occurred after the last  corrective actions had been put in place, we decided to select statistical  samples from a population of transactions that occurred in fiscal year  2009.
Because we selected statistical samples for testing implementation of  certain new or revised policies and procedures, we assessed the  reliability of the FBI’s contracting, interagency-agreement, and property- data files by first identifying and documenting the controls in place at the  FBI for ensuring accurate and complete data is recorded into information  systems during the FBI’s contracting, interagency-agreement, and  property-acquisition processes and then assessing whether these  controls appeared adequate. We inquired about the processes by which  interagency agreements, contracts, and purchase orders are completed  and recorded and developed an understanding of the controls designed  to ensure data entered into FMS for interagency agreements and  contracts is accurate and complete. In addition, we reviewed DOJ’s  annual financial statement internal control reports for fiscal years 2007,  2008, and 2009 to identify any material weaknesses or reportable  conditions related to the information systems identified in the step above.  We also analyzed data listings to identify any anomalies in the data fields  such as blank cells or inconsistent naming conventions for contracts and  interagency agreements and obtained explanations for any anomalies  noted. Based on these steps, we determined the FBI’s contract,  interagency-agreement, and property-data files were sufficiently reliable  to address the objectives of this report.
We selected a statistical sample of 55 interagency agreements from a  total population of 494 interagency agreements executed by the FBI  during fiscal year 2009. In our testing of interagency agreements, we  verified that all agreements clearly defined the roles and responsibilities  relative to contract administration including invoice submission for both  parties. During our testing, we also considered new guidance on  interagency agreements issued by the Office of Management and  Budget’s (OMB) Office of Federal Procurement Policy that the FBI  disseminated to all of its procurement chiefs.
We selected a statistical sample of 32 contracts from a population of 51  contracts executed in fiscal year 2009. In addition, for each of the 32  contracts in the sample, we selected all related purchase orders for  testing. The total number of purchase orders selected for testing was 34.  Our contract and purchase-order testing consisted of determining whether  the contracts and/or purchase orders (1) clearly specified key cost  determination provisions; (2) clearly reflected the appropriate Federal  Acquisition Regulation travel cost requirements; and (3) contained  provisions regarding the contractor’s review of subcontractor charges. In  addition, for purchase orders only, we determined whether the purchase  orders were sufficiently detailed to verify the receipt of property and other  goods and services.
We obtained a listing of all invoices that had been submitted to the FBI for  the purchase orders we selected noting that invoices had not yet been  submitted to FBI for 7 of the 34 purchase orders. A total of 110 invoices  had been submitted for the other 27 purchase orders we selected—one  invoice each had been submitted for 16 of the purchase orders, two  invoices each for 3 of the purchase orders, and three or more invoices  had been submitted for the remaining 8 purchase orders. In selecting  invoices for testing, we selected all invoices for those purchase orders  that only had either one or two invoices. For each of the 8 purchase  orders with three or more invoices, we selected the invoice with the  highest dollar value for testing and one other invoice on a non-judgmental  basis. The total number of invoices selected for testing was 37. Our  invoice testing consisted of determining whether the contractor’s invoice  and supporting documentation (1) provided evidence of the FBI review  and approval of the charges by the parties designated in the contract; (2)  included evidence that goods and services billed on the invoice were  received; (3) provided sufficient information to support the charges; (4)  included amounts that were appropriate and in accordance with contract  terms; and (5) provided evidence that the FBI properly documented the  resolution of invoice discrepancies.
We also asked the FBI to provide a listing of all accountable property  included in its Property Management Application (PMA) for each of the 34  purchase orders we reviewed. According to the FBI’s listing, 20 of the 34  purchase orders included accountable property that had been recorded in  the FBI’s PMA. There were a total of 674 individual items of accountable  property for the 20 purchase orders. We included all 674 items of  accountable property for our property testing. Our property testing  consisted of determining whether the FBI (1) entered in PMA the  appropriate purchase order number, asset description, and physical  location of the accountable property purchased; (2) entered all  accountable property in PMA within the time frame specified in the FBI’s  policy; (3) assigned bar codes to the accountable property when received  and annotated the assigned bar codes in the receiving reports and in  PMA; (4) properly documented any accountable property rejected  immediately upon delivery; and (5) properly updated the PMA records of  all accountable property returned after being accepted.
We requested comments on a draft of this report from the FBI. We  received written comments from the FBI on August 11, 2011, and have  summarized those comments in the Agency Comments section of this  report. FBI’s comments are reprinted in appendix III. We conducted this  performance audit from February 2010 through September 2011 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform our audits to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Status of Trilogy and Sentinel Recommendations and Actions Taken by the FBI
subsections: section_title: Recommendation area/recommendations Trilogy recommendations
paragraphs: Interagency agreements and contract Administration  1.  To improve FBI’s controls over its review and approval  process for cost-reimbursement type contract  invoices, the Director of FBI should instruct the Chief  Financial Officer to establish policies and procedures  so that future interagency agreements establish clear  and well-defined roles and responsibilities for all  parties included in the contract administration  process, including those involved in the invoice review  process, such as contracting officers, technical point  of contacts, contracting officer’s technical  representatives, and contractor personnel with  oversight and administrative roles.
In July 2008, FBI’s Senior Procurement Executive issued  Procurement Guidance Document 08-10 to all Bureau  Procurement Chiefs that incorporated a memorandum from the  Office of Federal Procurement Policy (OFPP), Office of  Management and Budget (OMB), which discussed new  guidance on interagency agreements. The new OFPP  guidance, issued in June 2008, requires the requesting agency  and the servicing agency to assign specific roles for each  agency and is to be fully implemented for all interagency  agreements executed after November 3, 2008. The guidance  discusses, among other things, the need for defining roles such  as the COTR and establishing specific responsibilities for those  roles. It further elaborates on responsibilities for identifying an  appropriate invoice review official prior to submittal of the first  invoice and inspecting and rejecting contract work as  necessary.
2.  To improve FBI’s controls over its review and approval  process for cost-reimbursement type contract  invoices, the Director of FBI should instruct the Chief  Financial Officer to establish policies and procedures  so that labor rates, ceiling prices, treatment of  overtime hours, and other key terms for cost  determination are clearly specified and documented  for all contracts, task orders, and related agreements.
In December 2008, FBI’s Policy Training Unit created an  intranet site, the Contract Specialist Corner, to provide contract  specialists/contract officers with procurement information and  guidance. The site includes links to procurement guidance and  directives issued by DOJ, the FBI’s Policy Training Unit, and  Federal Acquisition Regulation (FAR) circulars issued by the  FAR council, as well links to standard procurement forms used  in the procurement process. The site also provides access to  contract execution checklists for different contract types, as  well as standard FAR clauses applicable to various types of  acquisitions including clauses related to labor rates, ceiling  prices, treatment of overtime hours, and other key contract  terms. In addition, in 2009, the Policy Training Unit created a  separate intranet site for contracting officer technical  representatives (COTR) as well as one for field offices to  provide on-line access to procurement guidance and  documentation. In addition, since January 2009 the Policy  Training Unit has held monthly training sessions for contract  specialists/contracting officers to ensure that directives issued  by DOJ and FBI are being implemented properly.
Development of policies  and procedures and other actions taken  process for cost-reimbursement type contract  invoices, the Director of FBI should instruct the Chief  Financial Officer to establish policies and procedures  so that an appropriate process is in place to assess  the adequacy of contractor’s review and  documentation of submitted subcontractor charges  before such charges are paid by FBI.
In December 2008, FBI’s Policy Training Unit created an  intranet site, the Contract Specialist Corner, to provide contract  specialist/contract officers with procurement information and  guidance, including references (and hyperlinks) to all  procurement guidance documents that have been issued by  DOJ, the Policy Training Unit, and FAR circulars issued by the  FAR council. In addition, the site includes a section, FAR  Matrix of Clauses, which provides information on applicable  FAR clauses, including guidance useful to contract specialists  in determining whether subcontractor clauses are necessary.  In addition, in 2009, the Policy Training Unit also created two  other separate intranet sites for contracting officer technical  representatives (COTR) and Field Offices. The COTR site  includes links to procurement guidance that includes  discussion of contract administration responsibilities related to  the COTR, prime contractor and subcontractor, as well as  provides access to the documentation related to the activities  of the COTR. In addition, since January 2009, the Policy  Training Unit has held monthly training sessions for contract  specialists/contracting officers to ensure that directives issued  by DOJ and FBI are being implemented properly.
In December 2008, FBI’s Policy Training Unit created an  intranet site, the Contract Specialist Corner, to provide contract  specialist/contract officers with procurement information and  guidance, including references to all procurement guidance  documents issued by DOJ, the Policy Training Unit, and FAR  circulars issued by the FAR council, including those related to  travel cost requirements (i.e., using the lowest standard coach  or equivalent airfare). Specifically, the site includes a section,  FAR Matrix of Clauses, which provides information on  applicable FAR clauses, including those related to travel cost  requirements. In addition, since January 2009, the Policy  Training Unit has held monthly training sessions for contract  specialists/contracting officers to ensure that directives issued  by DOJ and FBI are being implemented properly. process for cost-reimbursement type contract  invoices, the Director of FBI should instruct the Chief  Financial Officer to establish policies and procedures  so that future contracts clearly reflect the appropriate  Federal Acquisition Regulation travel cost  requirements, including the purchase of the lowest  standard, coach, or equivalent airfare.
FBI has established policies and procedures designed to  provide guidance on its invoice review and approval process.  Specifically, FBI issued two electronic communications that  provided guidance on the invoice review and approval process.  The first electronic communication, titled “Invoice Processing -  Purchase Orders and Contracts,” states that the Contracting  Officer is responsible for ensuring that the requirements for a  proper invoice are attached and incorporated as a condition of  the purchase order and for contracts, ensuring that the  applicable clause is included. The second electronic  communication, titled “Vendor Invoice and Payment Matter,”  provides guidance on the information that constitutes a proper  invoice and on the documentation required to support the  payment of invoices. FBI incorporated these electronic  communications in its Manual of Administrative Operations and  Procedures (MAOP) Part 2 - Section 6-5.2, titled “Invoices  under Purchase Orders/Contracts,” issued in February 2007.  The section states that prior to submitting an invoice to the  FBI’s Contracting Officer (CO) for approval and payment, the  FBI requesting division is responsible for ensuring that goods  and services are received in accordance with contract terms.  Section 6-5.2 of the MAOP also states that the FBI CO is  responsible for verifying that all required information is on the  invoice before approving it. process for cost-reimbursement type contract  invoices, the Director of FBI should instruct the Chief  Financial Officer to establish policies and procedures  so that appropriate steps are taken during the invoice  review and approval process for every invoice cost  category (i.e., labor, travel, other direct costs,  equipment, etc.) to verify that the (1) invoices provide  the information required in the contract to support the  charges, (2) goods and services billed on invoices  have been received, and (3) amounts are appropriate  and in accordance with contract terms.   6.  To improve FBI’s controls over its review and approval  process for cost-reimbursement type contract  invoices, the Director of FBI should instruct the Chief  Financial Officer to establish policies and procedures  so that the resolution of any questionable or  unsupported charges on contractor invoices identified  during the review process is properly documented.
FBI has established policies and procedures related to properly  documenting the resolution of any questionable or unsupported  charges on invoices identified during the invoice review  process. Specifically, Part 2, Section 6-9.3.3 of FBI’s Manual of  Administrative Operations and Procedures (MAOP), version  dated 2/26/07, titled “Review of Invoices,” and FBI’s Electronic  Communication titled “Vendor Invoice and Payment Matter”  specifies requirements for FBI to properly document the  reasons for determining that an invoice is improper, the date  the invoice is returned to the vendor, and the date a corrected  invoice is received from the vendor.
Development of policies  and procedures and other actions taken  the Director of FBI should instruct the Chief Financial  Officer to establish policies and procedures so that  invoices are paid only after all verified purchase order  and receipt documentation has been received by FBI  payment officials and reconciled to the invoice  package.
In November 2006 FBI issued a policy titled, “Implementation  of Invoice Submission Form for Invoices and Intragovernmental  Payment and Collection Process by CPCSU,” 319E-HQ- A1487524-FD. This policy requires that all invoices sent to the  commercial payment unit beginning in November 2006 must  include a completed invoice submission form as the cover  sheet. The new required form includes the following fields to be  completed by the submitting division: vendor number, invoice  date, acceptance date, purchase order number, purchase  order line number, purchase order quantity, total amount, date  the COTR and the contracting officer (1) received the invoice  form, (2) approved it—with their signature, and (3) the date  they sent it on to the next responsible party. Collectively, these  actions to establish policies requiring confirmation of receipt of  goods and services before payment addresses our  recommendation.
8.  To address issues on the Trilogy project that could  represent opportunities for recovery of costs, the  Administrator of General Services, in coordination with  the Director of FBI, should determine whether other  contractor costs identified as questionable in this  report should be reimbursed to FBI by contractors.   9.  To address issues on the Trilogy project that could  represent opportunities for recovery of costs, the  Administrator of General Services, in coordination with  the Director of FBI, should further investigate whether  DynCorp Information Systems’ labor rates exceeded  ceiling rates and pursue recovery of any amounts  determined to have been overpaid.   10.  To address issues on the Trilogy project that could  represent opportunities for recovery of costs, the  Administrator of General Services, in coordination with  the Director of FBI, should confirm the Science  Applications International Corporation’s (SAIC)  informal Extended Work Week policy and work with  SAIC to determine and resolve any overpaid  amounts.   11.  To address issues on the Trilogy project that could  represent opportunities for recovery of costs, the  Administrator of General Services, in coordination with  the Director of FBI, should consider engaging an  independent third party to conduct follow-up audit  work on contractor billings, particularly areas of  vulnerability identified in this report.
In January 2007 GSA requested, on behalf of the FBI, that  Defense Contract Audit Agency (DCAA) perform post-award  audits of direct costs incurred and billed by contractors under  the FBI’s Trilogy project. In March 2008, DCAA reported the  results of its audit related to SAIC reporting questioned costs of  $3.7 million. As a result of this audit, FBI recovered $3.2 million  from SAIC. In December 2008, DCAA reported the results of its  audit of the direct costs incurred and billed by Computer  Sciences Corporation (CSC) reporting questioned costs of  $14.95 million, $9.7 of which was related to labor charges. In  addition to questioned costs related to labor rates exceeding  ceiling rates, DCAA reported additional CSC questioned costs  of $1,825,952 related to airfare costs because the costs were  inadequately supported and exceeded the lowest customary  standard coach or equivalent airfare, and $979,187 of labor  costs because of lack of personnel qualifications or lack of  supporting documentation that shows the employees’ labor  qualifications. DCAA’s report also incorporated evaluations of  costs incurred by the largest subcontractors that performed  under CSC’s task order. The report questioned costs for  subcontractors CACI, DigitalNet, PlanetGov/Apptis, Inc. and  others totaling $5.1 million. The types of subcontractor  questioned costs reported by DCAA included 1) supporting  timesheets that were either not certified by the consultant or  not approved by an appropriate/approving authority 2) use of  personnel that did not meet the minimum labor qualifications,  and 3) unsupported or inadequately supported transactions.  With regard to these questioned costs, in March 2009, the  Department of Justice, Office of Inspector General, began an  investigation to determine whether the billings were potentially  fraudulent and involved criminal conduct by CSC and its  subcontractors. In commenting on a draft of this report, the FBI  informed GAO that the Inspector General’s report on this  matter was under review by OIG management.
section_title: Recommendation area/recommendations Accountability for purchased assets
paragraphs: Development of policies  and procedures and other actions taken  12.  To improve FBI’s accountability for purchased assets,  the Director of FBI should instruct the Chief Financial  Officer to reinforce existing policies and procedures so  that when assets are delivered to FBI sites, they are  verified against purchase orders and receiving  reports. Copies of these documents should be  forwarded to FBI officials responsible for reviewing  invoices as support for payment.
The FBI has reinforced policies and procedures related to  verifying assets received to purchase orders and receiving  reports. Specifically, FBI issued an Electric Communication to  all divisions in November 2005 to reinforce FBI’s policy that all  accountable property be entered in the Property Management  Application (PMA) immediately upon receipt and that data  recorded in FBI’s financial management system must include  the purchase order number and the destination division. The  information entered into the financial management system is to  be immediately uploaded to PMA for verification of the  accuracy of property being recorded in PMA with specific  purchase orders. In addition, the FBI issued an electronic  communication to all divisions in November 2006 to implement  a new invoice submission form to be used with all commercial  invoices to improve the information provided to the payment  unit for invoices. The electronic communication required that  the invoice submission form include various fields, including,  purchase order line number - purchase order line number to  charge the invoice, purchase order quantity – quantity to be  paid for the invoice, and Total amount – total amount to be paid  by purchase order line.
13.  To improve FBI’s accountability for purchased assets,  the Director of FBI should instruct the Chief Financial  Officer to establish policies and procedures so that (1)  purchase orders are sufficiently detailed so that they  can be used to verify receipt of equipment at FBI  sites, and (2) contractor invoices are formatted to tie  directly to purchase orders and facilitate easy  identification of equipment received at each FBI site.
The FBI formed the Policy Training Unit in 2007 which is  responsible for all acquisition policy and acquisition training  within the FBI, including implementation, updates, and training  of specialized acquisition matters. Since January 2009, the  Policy Training Unit holds monthly contractor specialist training  sessions at which participants discuss new procurement  guidance issued by DOJ and procurement directives issued by  FBI and implementation. According to FBI, during these  procurement training sessions, the Policy Training Unit staff  have stressed the importance to contracting officers of  generating purchase orders with a sufficient level of detail so  that the requesting division can use the purchase order to  verify equipment receipt. In addition, the FBI formed the  Acquisition Strategy and Planning Unit in March 2006. The  Acquisition Strategy and Planning Unit developed training  materials for acquisition planning that included guidance on the  FD-369, the requisition form which is also used in generating  purchase orders, which states that equipment and services be  on separate lines.
14.  To improve FBI’s accountability for purchased assets,  the Director of FBI should instruct the Chief Financial  Officer to establish a policy to require that upon  receipt of property at FBI sites, FBI personnel  immediately identify all accountable assets and affix  bar codes to them.
In order to record an asset on PMA it must have a bar code  assigned. In November 2005, FBI issued an electric  communication to reinforce accountable property policies and  procedures by requiring that all divisions record accountable  property in PMA within 48 hours of being received. If fully and  effectively implemented, this policy should improve the FBI’s  accountability over purchased assets.
Development of policies  and procedures and other actions taken  the Director of FBI should instruct the Chief Financial  Officer to revise FBI’s policies and procedures to  require that all bar codes are centrally issued and  tracked through periodic reconciliation of bar codes  issued to those used and remaining available.  Assigned bar codes should also be noted on a copy of  the receiving report and forwarded to FBI’s Property  Management Unit.
FBI has taken action to strengthen controls that help ensure all  accountable property is bar coded and properly recorded by  issuing a March 2009 electronic communication (approved by  the Chief Financial Officer) that requires all FBI offices to  perform a weekly review of the On Order Report to ensure that  all property that has been receipted in FBI’s financial  management system is also added to PMA. The On Order  Report lists all property items associated with a particular  purchase order that do not show having been recorded in the  PMA, thus providing FBI with the ability to identify and  investigate potentially missing and/or unrecorded property  items. Also, our September 2010 walk-through of the process  to enter assets into PMA found that the bar code numbers are  annotated on copies of the receiving reports that are forwarded  to the property custodian as we had recommended. In addition,  we noted that the FBI’s Asset Management Unit is solely  responsible for issuing bar codes to FBI offices and the unit  requires that all offices sign an FD-281 verifying receipt of bar  codes.
16.  To improve FBI’s accountability for purchased assets,  the Director of FBI should instruct the Chief Financial  Officer to revise FBI policies and procedures to  require that accountable assets be entered into PMA  immediately upon receipt rather than within the  current 30-day time frame.
In November 2005, FBI issued an electric communication to  reinforce accountable property policies and procedures by  requiring that all divisions record accountable property in PMA  within 48 hours of being received.
17.  To improve FBI’s accountability for purchased assets,  the Director of FBI should instruct the Chief Financial  Officer to require officials inputting data into PMA to  enter (1) the actual purchase order number related to  each accountable equipment item bought, (2) asset  descriptions that are consistent with the purchase  order description, and (3) the physical location of the  property.
The FBI has taken action to enhance its PMA to help ensure  the accuracy and completeness of reporting on the status of  property on order, the On Order Report, including installing a  system edit limiting data entry to those transactions with valid  purchase order numbers. Specifically, FBI issued an electric  communication “Property Management Application Policy  Change” on 02/15/2006 that provides that assets added to  PMA must include data in the PMA location field. We confirmed  that the FBI developed and put in place system edit checks  that were effective in ensuring that only valid purchase order  numbers were recorded into PMA and that related purchase  order information was automatically and accurately uploaded  from the financial management system into PMA.
Development of policies  and procedures and other actions taken  the Director of FBI should instruct the Chief Financial  Officer to establish policies and procedures related to  the documentation of rejected or returned equipment  so that the (1) equipment that is rejected immediately  upon delivery is notated on the receiving report that is  forwarded to FBI officials responsible for invoice  payment and (2) equipment that is returned after  being accepted at an FBI site (e.g., items returned  due to defect) is annotated in PMA, including the  serial number and location of any replacement  equipment, under the appropriate purchase order  number.
In September 2006, FBI issued an electric communication to all  divisions requiring that the Asset Management Unit be notified  of any accountable property returned to vendors to ensure that  the return of the property is recorded in PMA. If a replacement  is provided by the vendor the Asset Management Unit is to  revise the PMA records to provide descriptive information for  the new property item (serial number and barcode) and show it  as “Active” and show the barcode of the returned piece of  property as “Inactive.” In addition, when a piece of accountable  property delivered to FBI is returned and a replacement is to be  provided by the vendor, the item is to remain on FBI’s On  Order Report until a replacement is received and not to be  recorded in PMA. We also noted, during our discussions with  officials from the FBI’s commercial payment unit that FBI’s  financial management system will not allow a disbursement of  funds until the property has been recorded as received.
FBI issued an electric communication “2009 Wall-to-Wall  Inventory of Property, Plant, Equipment, and Issued Personal  Property” that included additional directions to the inventory  staff to ensure that, property information recorded in PMA was  accurate. Specifically, the directive included detailed steps on  how to request changes to correct errors in the manufacturer or  model description fields in PMA for property identified during  the inventory. The directive included as an attachment, a form  titled “2009 INVENTORY CHANGES FOR MANUFACTURER  & MODEL #s” to request a change or modification to these  fields. the Director of FBI should instruct the Chief Financial  Officer to expand the next planned physical inventory  to include steps to verify the accuracy of asset  identification information included in PMA.
Development of policies  and procedures and other actions taken  the Director of FBI should instruct the Chief Financial  Officer to reassess overall physical inventory  procedures so that all accountable assets are properly  inventoried and captured in the PMA system and that  all unlocated assets are promptly investigated.
FBI has reassessed its inventory procedures as reflected in  changes to instructions provided to all divisions through  electronic communications in advance of wall-to-wall  inventories. The FBI issued an electronic communication in  advance of the wall to wall inventory titled “2009 The Wall-to- Wall Inventory of Property, Plant, Equipment and Issued  Personal Property” on 3/31/2009 for the wall-to-wall inventory  to be held beginning 4/13/09. The electronic communication  includes instructions that are related to findings we reported.  For example, the 2009 electronic communication states that  during the inventory, only the PMA custodians will have access  to change only the serial number due to the fact that 95% of  the manufacturer and/or model information has now been  standardized on PMA. In addition, the 2009 electronic  communication included additional language that stressed a  complete inventory, stating that all additions must be added to  the PMA during the inventory period in order to comply with a  “fully completed” wall-to-wall inventory because failure to  comply with the procedure would result in an “incomplete”  inventory. The 2009 electronic communication also included  new language on property issued to individual employees and  contractors, which stated, Each office is to ensure that the  issued personal property for each employee and contractor is  inventoried. Discrepancies for issued personal property are to  be forwarded to the appropriate FBIHQ Program Managers  and the Asset Management Unit should be notified of these  changes. Lastly, the electronic communication included a  section titled “Required Procedures for Concluding Inventory”  that included additional language related to lost and stolen  property and additions.
Beginning in 2008, the FBI’s Finance Division’s audit unit  expanded its audit coverage to include conducting audits of  compliance with FBI policies and procedures for review and  approval of contractor invoices, government purchase card  usage, and oversight for the semi-annual audits of property  and equipment at the FBI field offices and divisions. Further,  the Audit Unit Chief informed us that his unit expanded the  scope of its audits to include audits of internal controls related  to accountable property on a periodic basis as needed in  response to significant events at FBI. For example, in fiscal  year 2009 the FBI initiated the Next-Generation Workstation  Tech Refresh program (NGW) to purchase approximately  47,000 new computers. The Finance Division audit unit  performed on-site reviews at the Seattle field office and the  Portland field office to determine whether required controls  over property accountability were in place as the computers  from the NGW program were being distributed throughout the  agency. the Director of FBI should instruct the Chief Financial  Officer to establish an internal review mechanism to  periodically spot check whether the steps listed  above- including verifications of purchase orders and  receiving reports against received equipment,  immediate identification and bar coding of  accountable assets, maintenance of accurate asset  listings, prompt entry of assets into PMA,  documentation of rejected and returned equipment,  and improved bar coding and inventory procedures-  are being carried out.
Development of policies  and procedures and other actions taken  the Director of FBI should instruct the Chief Financial  Officer to investigate all missing, lost, and stolen  assets identified in this report to (1) determine  whether any confidential or sensitive information and  data may be exposed to unauthorized users and (2)  identify any patterns related to the equipment (e.g., by  location, property custodian, etc.) that necessitates a  change in FBI policies and procedures, such as  assignment of new property custodians or additional  training.
In March 2011, the FBI provided us with documentation on the  results of its investigation into the status of the over 1,200  assets that acknowledged that 134 assets remained  unaccounted for. The assets that remain unaccounted for  include some that could contain sensitive information, such as  desktop computers, laptops, and servers.We initially identified  1,404 assets as missing, lost, or stolen, but prior to the  issuance of our 2006 report the FBI provided additional  documentation that enabled us to verify an additional 199  assets on PMA that we initially determined to be missing. lost,  or stolen, reducing the number reported to 1,205. The FBI has  not provided an analysis to identify any patterns related to  these assets that would be helpful for identifying any needed  changes to FBI policies and procedures.
section_title: Sentinel recommendations
paragraphs: 23.  We recommend that the Director of the FBI direct the  Sentinel Program Manager to modify existing Sentinel  policies and procedures to require the Sentinel  property manager to verify for every property  shipment that data in the Lockheed Martin database  are complete and accurate before using these data to  create or update FBI’s official property records in  PMA.
FBI modified its existing policies and procedures to include a  policy of verifying accuracy and completeness of data in the  Lockheed Martin database. Specifically, Section 2.2.3 of FBI’s  Property Management Policy & Procedures, prepared by Office  of IT Program Management, Sentinel Program and Business  Management Team, version dated 9/3/2008, titled “Receipt of  Property” policy specifies requirements of the Sentinel Property  Manager to verify the accuracy of equipment data on the  property list uploaded by the contractor before using this data  to enter equipment to PMA upon receipt and verification of  equipment. The equipment data on the property list refers to  the Lockheed Martin database for Sentinel project.
24.  We recommend that the Director of the FBI direct the  Sentinel Program Manager to modify existing Sentinel  policies and procedures to require that the Sentinel  property manager perform monthly reconciliations of  the key property records (i.e., the BOM, the vendor  invoices, the Lockheed Martin database, and PMA)  throughout each subsequent phase of Sentinel rather  than a single close-out reconciliation at the completion  of a phase.
FBI modified its existing policies and procedures to include  periodic reconciliation of the key property records. Specifically,  Section 3.2 of FBI’s Property Management Policy &  Procedures, prepared by Office of IT Program Management,  Sentinel Program and Business Management Team, version  dated 9/3/2008, titled “Data Requirements” specifies that the  Sentinel Property Manager will perform at least monthly  reconciliations of the key property records including Bill of  Materials, invoices, contractor property list (Lockheed Martin  database) and PMA throughout the Sentinel Program.
Sentinel Program Manager to modify existing Sentinel  policies and procedures to require the Sentinel  property manager to document the initial inspection of  property as it is received, including verification that the  property was properly barcoded.
FBI modified its existing policies and procedures to include  initial inspection of property upon receipt, including verification  that the property was properly barcoded. Specifically, Section  2.2.3 of FBI’s Property Management Policy & Procedures,  prepared by Office of IT Program Management, Sentinel  Program and Business Management Team, version dated  9/3/2008, titled “Receipt of Property” specifies that the Sentinel  Property Manager will match quantity, manufacturer, make,  model and serial number and barcode number on the shipping  document, packing lists, or invoice to the physical inventory of  equipment received, and after the verification the document will  be annotated with receipt noted and signed by the Property  Administrator and Sentinel Property Manager.
26.  We recommend that the Director of the FBI direct the  Sentinel Program Manager to modify existing Sentinel  policies and procedures to require the Sentinel  property manager to record in the Lockheed Martin  database the date Sentinel property is received to  allow for assessments of whether Sentinel property  was timely recorded into PMA.
FBI modified its existing policies and procedures to require the  received date be tracked. Specifically, Section 3.2 of FBI’s  Property Management Policy & Procedures, prepared by Office  of IT Program Management, Sentinel Program and Business  Management Team, version dated 9/3/2008, titled “Data  Requirements” specifies that in order to be useful to both the  PMO and contractor the key data points, including the date  received and Shipping Document/Item Receipt Verification  Date, should be tracked by either an electronic spreadsheet or  listed on a locally devised inventory sheet. According to FBI’s  Sentinel team, the “Date Received” column in the Lockheed  Martin database now tracks the received date of each property.
27.  We recommend that the Director of the FBI direct the  Sentinel Program Manager to modify existing Sentinel  policies and procedures to require the Sentinel  property manager to follow up on and document  actions taken with respect to the 20 property records  we identified as having valuation discrepancies,  including any adjustments to the valuations in either  FBI’s or the contractor records.
FBI followed up with the 20 items identified in our report and  took necessary corrective action to eliminate valuation  discrepancies. We reviewed accountable property records  maintained in the PMA and the Lockheed Martin database  provided by FBI for those 20 items and verified that FBI has  made adequate adjustments to the valuation in PMA and the  Lockheed Martin database.
PMA that we initially determined to be missing. lost, or stolen, reducing the number reported to 1,205.
section_title: Appendix III: Comments from the Federal Bureau of Investigation
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: Staff members who made key contributions to this report include: Phillip  McIntyre, Assistant Director; William E. Brown; Sharon Byrd; Liliam  Coronado; Joshua Edelman; Francine DelVecchio; Francis Dymond;  Wendy Johnson; Galena Phillips; Lisa Reijula; and Seong Bin Park.