Veterans Affairs: Continued Action Needed to Reduce IT Equipment Losses and Correct Control Weaknesses
Published: 2008-07-31T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In July 2004, GAO reported that the six Department of Veterans Affairs (VA) medical centers it audited lacked a reliable property control database and effective inventory policies and procedures. In July 2007, GAO reported that continuing internal control weaknesses over IT equipment at four case study locations at VA resulted in an increased risk of theft, loss, and misappropriation of IT equipment assets. GAO's two reports included 18 recommendations to improve internal control over IT equipment. GAO was asked to perform a follow-up audit to determine (1) whether VA has made progress in implementing GAO's prior recommendations for improving internal control over IT equipment and (2) the effectiveness of VA's current internal controls to prevent theft, loss, or misappropriation of IT equipment. GAO reviewed policies and other pertinent documentation, statistically tested IT equipment inventory controls at four geographically disparate locations, and interviewed VA officials.
section_title: What GAO Found
paragraphs: VA has made significant progress in addressing prior GAO recommendations to improve controls over IT equipment. Of the 18 recommendations GAO made in its two earlier reports, VA completed action on 14 recommendations, partially implemented action on 2 recommendations, and is working to address the 2 remaining open recommendations. These recommendations focused on strengthening policies and procedures to establish a framework for accountability and control of IT equipment. If effectively implemented, VA's July 2008 policy changes would address many of the control weaknesses GAO identified. Mandated early implementation of this new policy addresses user-level accountability and requirements for strengthening physical security. In addition, to determine the extent of inventory control weaknesses over its IT equipment, VA performed a departmentwide physical inventory in 2007. However, as of May 15, 2008, VA reported that it could not locate about 62,800 IT equipment items, of which 9,800 could have stored sensitive information. Because VA does not know what, if any, sensitive information resided on the equipment, potentially affected individuals could not be notified. GAO's statistical tests of IT equipment inventory controls from February through May 2008 at four locations identified continuing control weaknesses, including missing items, lack of accountability, and errors in IT equipment inventory records. Although these control weaknesses may be addressed through early implementation of the July 2008 policies, the fact that GAO identified missing items only a few months after these locations had completed their physical inventories is an indication that underlying weaknesses in accountability over IT equipment have not yet been corrected. GAO's tests identified 50 missing items, of which 34 could have stored sensitive data, but again, notifications to individuals could not be made. Further, the lack of user-level accountability and inaccurate records on status, location, and item description of IT equipment items at the four case study locations make it difficult to determine the extent to which actual theft, loss, or misappropriation of IT equipment may have occurred. In addition, the four locations had weaknesses in controls over hard drives in the property disposal process as well as physical security weaknesses at IT storage facilities. These control weaknesses present a risk that VA could lose control over new, used, and excess IT equipment and that any sensitive personal and medical information residing on hard drives in this equipment could be compromised.

section_title: Letter
paragraphs: This report responds to your request that we perform a follow-up audit to  assess the Department of Veterans Affairs (VA) progress in strengthening  controls over information technology (IT) equipment. Past reports of  thefts of laptop computers and data breaches raised concerns about the  adequacy of controls over VA IT equipment. In July 2004, we reported that  the six VA medical centers we audited lacked a reliable property control  database and had problems with implementation of VA inventory policies  and procedures. In July 2007, we reported that a weak overall control  environment and pervasive weaknesses in inventory control and  accountability at four locations we audited put IT equipment at risk of  theft, loss, and misappropriation, including sensitive personal and medical  information maintained on this equipment. For example, our statistical  tests of IT equipment inventory controls at the four VA case study  locations identified a total of 123 missing IT equipment items, including 53  computers that could have stored sensitive information. Our 2004 and 2007  audits found that some medical centers did not account for IT equipment  valued under $5,000 during physical inventories. Our 2004 report made 6  recommendations and our 2007 report made 12 recommendations for VA  actions to improve accountability of IT equipment inventory and reduce  the risk of disclosure of sensitive personal and medical information.
VA’s mission is to promote the health, welfare, and dignity of all veterans  in recognition of their service to the nation by ensuring they receive  medical care, benefits, social support, and lasting memorials. The  department’s three major components are the Veterans Health  Administration (VHA), the Veterans Benefits Administration (VBA), and  the National Cemetery Administration (NCA). During 2007, VA employed  over 230,000 individuals and relied on an undetermined number of  contractors, volunteers, and students in carrying out its operations. VA  provided these individuals with a wide range of IT equipment, including  desktop and laptop computers, monitors and printers, personal digital  assistants, unit-level workstations, local area networking equipment, and  medical equipment capable of storing sensitive personal and medical  information. By the start of fiscal year 2008, VA had centralized its IT  function at all locations within its Office of Information and Technology  (OIT). OIT staff share responsibility for management of IT equipment  inventory with property management personnel. Accordingly, it is crucial  for the department’s Assistant Secretary for Information and Technology,  who serves as the Chief Information Officer (CIO), to have the cooperation  of property managers to ensure that well-established integrated processes  exist for controlling IT inventory. Given the continuing nature of IT  equipment inventory control problems and their significance, you asked us  to perform additional follow-up work to determine (1) whether VA has  made progress in implementing our prior recommendations for improving  internal control over IT equipment and (2) the effectiveness of VA’s  current internal controls to prevent theft, loss, or misappropriation of IT  equipment.
To achieve our first objective, we conducted interviews and obtained  documentation from VA property management and OIT officials on the  actions taken to address the 12 recommendations in our July 2007 report  and the 6 property-related recommendations in our July 2004 report. As  you requested, we also reviewed the process and results of VA’s 2007  departmentwide physical inventory of IT equipment and actions taken to  resolve discrepancies, including VA inventory results for locations tested  in our current and prior audits. In addition, we reviewed policy revisions  related to IT equipment controls based on our prior recommendations. To  achieve our second objective and determine the effectiveness of current  internal controls for preventing theft, loss, or misappropriation of IT  equipment, we used a case study approach, selecting three geographically  disparate VA health care systems (HCS) located in Dallas, Texas; Seattle,  Washington; and Boston, Massachusetts. We also selected VA  headquarters organizations as a means of assessing the overall control  environment, or “tone at the top,” as we did in our 2007 audit. At each of  the four case study locations, we statistically tested IT equipment  inventory control attributes for existence (meaning IT equipment items  listed in inventory records exist and can be located), user-level  accountability, and inventory record accuracy. As in our 2007 audit, at  each of our case study locations we also evaluated (1) VA’s Reports of  Survey on lost and stolen items, (2) controls over computer hard drives in  the excess property disposal process, and (3) physical security controls  for IT storage facilities. We performed sufficient procedures to determine  that inventory data at the test locations were reliable for the purpose of  our audit, including data analysis, interviews of key officials, and review  of VA procedures for assuring the reliability of data generated by key  property inventory systems.
We conducted this performance audit from January 2008 through July  2008 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. We performed our  investigative procedures in accordance with quality standards as set forth  by the President’s Council on Integrity and Efficiency. A detailed  discussion of our objectives, scope, and methodology is included in  appendix I.
subsections: section_title: Background
paragraphs: VA’s mission is to serve America’s veterans and their families and to be  their principal advocate in ensuring that they receive medical care,  benefits, and social support in recognition of their service to our nation.  VA, headquartered in Washington, D.C., is the second largest federal  department and reported it had over 230,000 employees as of September  30, 2007, including physicians, nurses, counselors, statisticians, computer  specialists, architects, and attorneys. VA has three major line  organizations—VHA, VBA, and NCA—and field facilities throughout the  United States. VHA has 21 Veterans Integrated Service Networks (VISN)  that oversee medical center activities within their areas, which may cover  one or more states. VA provides employees, contractors, volunteers, and  students with a wide range of IT equipment, including desktop and laptop  computers, monitors and printers, personal digital assistants, unit-level  workstations, local area networking equipment, and medical equipment  with memory and data processing/communication capabilities. By the start  of fiscal year 2008, VA had centralized its IT function at all locations within  the realigned OIT.
subsections: section_title: VA’s IT Property Management Process
paragraphs: The Assistant Secretary for Information and Technology heads VA’s OIT,  serves as the CIO for the department, and is the principal advisor to the  Secretary on matters relating to IT management in the department. OIT  staff share responsibility for management of IT equipment inventory with  property management personnel. Accordingly, it is crucial for the  department’s CIO to have the cooperation of property managers to ensure  that well-established integrated processes exist for controlling IT  inventory.
The steps in the IT property management process are key events, which  should be documented by an inventory transaction, a financial transaction,  or both, as appropriate. Federal records management law, as codified in  Title 44 of the U.S. Code and implemented through National Archives and  Records Administration (NARA) guidance, requires federal agencies to  adequately document and maintain proper records of essential  transactions and have effective controls for creating, maintaining, and  using records of these transactions. Table 1 provides an overview of VA’s  IT property management process.
section_title: VA Has Made Significant Progress in Addressing GAO Recommendations and Completing a VA- Wide IT Equipment Inventory
paragraphs: VA has made significant progress in addressing our previous  recommendations directed at improving policies and procedures for  control of IT equipment and reducing the risk of disclosure of sensitive  personal and medical information. As of the end of our field work in July  2008, VA had completed action on 10 of our 12 recommendations from our  July 2007 report. VA’s Assistant Secretary for Management and the CIO  worked together to draft a revised property management policy in a new  VA Handbook 7002, Logistics Management Procedures, which addresses 7  of our 2007 recommendations. This revised policy is an important step in  establishing a framework for control of IT equipment. On July 3, 2008, the  Assistant Secretary for Management mandated early implementation of  this policy, which includes requirements for user-level accountability, time  frames for completing Reports of Survey on missing and stolen property,  and requirements for strengthening physical security. VA also partially  implemented action on one other recommendation and has actions under  way to address the remaining recommendation from our 2007 report.  Successful implementation of these efforts will be key to improving  controls over VA’s IT equipment. VA also made progress implementing  recommendations from our 2004 report related to personal property and  equipment management. VA completed action on four of six property- related recommendations in our 2004 report and partially completed  action on a fifth recommendation. VA has plans to address the remaining  2004 recommendation. In addition, in response to your concerns about VA- wide controls based on our previous audits, VA required departmentwide  physical inventories of IT equipment to be completed by December 31,  2007. OIT monitored the 2007 physical inventory effort for IT equipment  and reported that as of May 15, 2008, VA was unable to locate  approximately 62,800 recorded IT equipment items, of which over 9,800  could have stored sensitive information. The CIO formed a “tiger team” to  monitor efforts under the Report of Survey system and to help ensure  that Reports of Survey are completed in a timely manner.
subsections: section_title: VA Has Made Significant Progress in Addressing GAO Recommendations
paragraphs: To address recommendations in our July 2007 report, VA completed action  on 10 of our 12 recommendations, partially implemented actions on one  other recommendation, and has actions under way to address the  remaining recommendation. VA actions on our 2007 report  recommendations included the establishment of specific time frames for  finalizing Reports of Survey, granting OIT personnel access to the central  property database, and holding employees financially liable for lost IT  equipment. In addition, VA completed action on four of the six  recommendations in our July 2004 report, partially completed action on a  fifth recommendation, and has plans to address the remaining  recommendation. For example, VA revised its policy through VA  Handbook 7127/4, Materiel Management Procedures, to state that  sensitive items include IT equipment and named several types of IT  equipment items. VA’s revised policy also stated that IT equipment items  valued under $5,000 are to be included in physical inventories. Further, VA  has drafted policies that provide a framework for strengthening controls  over IT equipment, including VA Handbook 7002, Logistics Management  Procedures. On July 3, 2008, VA’s Assistant Secretary for Management  mandated early implementation of this handbook. Effective  implementation of this new policy will be essential to ensuring adequate  control and accountability of VA’s IT equipment and any sensitive  information residing on that equipment. Table 2 provides a summary of  our 2007 and 2004 recommendations and the current status of VA actions.  For a more detailed explanation of VA’s actions taken and planned on our  recommendations, see appendix II.
section_title: VA’s 2007 Physical Inventory Effort Demonstrated Continuing Problems with Controls over IT Equipment
paragraphs: VA’s 2007 departmentwide inventory initially identified approximately  79,000 missing IT equipment items, underscoring the need to effectively  implement the new policies and procedures mandated on July 3, 2008. In  the 6 months following completion of the physical inventory, VA facilities  undertook efforts to locate or determine reasons for missing items. VA  was able to locate several thousand of the missing equipment items.  However, as summarized in table 3, on May 15, 2008, OIT reported that VA  was unable to locate approximately 62,800 recorded IT equipment items,  of which over 9,800 could have stored sensitive information. Because VA  does not know what, if any, sensitive information resided on the  equipment and when the equipment was lost, notifications to potentially  affected individuals could not be made in accordance with OMB  guidance. We interviewed VA officials and obtained documentation on  the VA-wide inventory; however, we did not validate the results. According  to VA, many of the missing items were old equipment and may have been  disposed of through VA’s excess property program. However, because VA  facilities had not always documented IT equipment disposal for many  years, there was no way to determine whether any of the missing items  were lost or stolen. Further, during our work, we discovered that not all IT  equipment items were included in the departmentwide inventory.  Consequently, the numbers of missing items could be higher. For example,  VA’s 2007 physical inventory did not include medical equipment with data  storage or processing capabilities. In addition, IT equipment items not  accounted for in the OIT equipment inventory listing (EIL) were not  subject to the 2007 physical inventory at some VA facilities. Further,  limited completeness tests we performed as part of our data reliability  procedures at case study locations identified some IT equipment items  recorded to EILs for organizations other than OIT. Prior to the  establishment of OIT, EILs were aligned organizationally and some IT  equipment assigned to other EILs had not yet been reassigned to the OIT  EIL and, therefore, were omitted from the 2007 physical inventory. We  discussed our finding with OIT officials, and they told us that they had met  in June 2008 to develop strategies for moving all IT equipment items  assigned to other EILs to the OIT EIL.
In compliance with VA Handbook 7125, General Procedures, VA personnel  submitted Reports of Survey for IT equipment items that were not located  during the departmentwide physical inventory and subsequent follow-up  investigation. A CIO tiger team was responsible for monitoring the Report  of Survey process and helping to ensure that it was completed in a timely  manner. Local Boards of Survey were responsible for investigating missing  items and approving write-offs of IT equipment items that could not be  located during the departmentwide physical inventory. However, as of  May 15, 2008, VA had over 43,000 items that were listed on open Reports of  Survey and facility personnel were continuing to search for missing items.  The 2007 physical inventories were a massive undertaking and required  significant effort over several months to resolve discrepancies. Although  we would have expected the VA locations that we previously tested to  have few, if any, missing items, as of May 15, 2008, 6 of the 12 locations  reported from 1,269 to 6,427 missing IT items; 4 locations had from 115 to  863 missing IT items; and only 2 locations had fewer than 100 missing  items. A summary of Reports of Survey data on missing IT equipment and  the reported original acquisition cost identified in VA’s 2007 physical  inventory related to sites we tested in our 2004, 2007, and 2008 audits are  presented in appendix IV.
section_title: Tests of IT Inventory Controls at Case Study Locations Identified Continuing Weaknesses
paragraphs: Our tests of IT equipment inventory controls at four case study locations,  including three VA HCS and VA headquarters, identified continuing control  weaknesses related to missing items, lack of accountability, and errors in  IT equipment inventory records. VA’s 2007 departmentwide physical  inventory effort was intended to establish a reliable IT equipment  inventory baseline going forward. Accordingly, our tests excluded from  the population of IT equipment thousands of items identified as missing  during VA’s 2007 IT physical inventory effort. Given the new baseline, if  adequate controls had been in place by the end of this inventory process,  we would not have expected to identify missing items, blank data fields, or  inaccurate inventory records at our test locations. As previously noted, in  July 2008 VA mandated early implementation of revised policy related to  control of IT equipment. Although the early implementation of July 2008  policy changes may address IT equipment control weaknesses, this policy  was not in effect at the time of our tests. Our Standards for Internal  Control in the Federal Government states that a positive control  environment provides discipline and structure as well as the climate that  influences the quality of internal control. Further, these standards require  agencies to establish physical control to secure and safeguard vulnerable  assets, such as equipment that might be vulnerable to risk of loss or  unauthorized use, including periodically counting the assets and  comparing the results to control records. However, our tests of IT  equipment inventory controls at the four case study locations, including  three VA HCS and VA headquarters, identified continuing problems with  (1) inventory control and accountability, (2) control over computer hard  drives in the excess property disposal process, and (3) physical security of  IT equipment storage locations. For example, our statistical tests at the  four locations from February through May of 2008 identified significant  numbers of missing items, several of which could have stored sensitive  personal and medical information. Overall, our statistical tests and data  analysis at the four locations found significant failures related to IT  inventory control and accountability including (1) missing items, (2) blank  serial numbers, (3) inaccurate information on user organization, (4)  inaccurate information on user location, and (5) other recordkeeping  errors. We also identified weaknesses in the controls over computer hard  drives in the property disposal process at the four test locations, involving  (1) lack of timely sanitization and disposal, (2) inadequate recordkeeping,  and (3) physical security. In addition, we found physical security  weaknesses at IT storage facilities at all four locations. These weaknesses  increase the risk that sensitive personal and medical information could be  compromised.
subsections: section_title: GAO’s IT Inventory Control Tests Found Continuing Problems
paragraphs: Our 2008 statistical tests of key IT equipment inventory controls and data  analysis found significant inventory control failures related to (1) missing  items, (2) blank serial numbers, (3) inaccurate information on user  organization, (4) inaccurate information on user location, and (5) other  recordkeeping errors. As noted previously, VA performed a 2007 physical  inventory of IT equipment. We excluded from our populations the missing  items identified during VA’s physical inventory at the four case study  locations. Table 4 shows the 2007 VA-wide inventory results related to  missing items at our four case study locations.
Given our exclusions of missing items from the VA inventories, if adequate  controls had been in place by the end of this inventory process, we would  not have expected to identify missing items, blank data fields, or  inaccurate inventory records at our test locations. Table 5 shows the  results of our statistical tests at the four case study locations. We present  our results as point estimates of control failure rates. Each point estimate  has a margin of error, based on a two-sided, 95 percent confidence  interval, of plus or minus 10 percent or less.
Serial number control is essential to accountability for sensitive items,  such as IT equipment, because it identifies unique items. The property bar  code label alone is not a sufficient identifier for sensitive items because  these labels are removable and can be replaced, if lost or damaged. In  addition, because VA has not yet put in place a control for user-level  accountability, accurate information on user organization and user  location is key to maintaining accountability for IT equipment items.  Further, recordkeeping errors impair the reliability of IT inventory  information for management decision making. For example, inaccurate  inventory records on item name, model number, and manufacturer impair  asset visibility and affect decision making on timing of IT equipment  upgrades.
As discussed previously, limited completeness testing performed as part of  our data reliability procedures identified IT equipment that was not  included in the populations of recorded IT equipment used for our control  tests. For example, our completeness tests at two of the four locations we  tested identified three IT equipment items that were recorded to EILs for  Psychology, Radiology, and Acquisition and Material Management rather  than the OIT EIL. Our completeness tests also identified one item not  recorded to an EIL. VA officials could not tell us the quantity of IT  equipment items that were not included in the four case study IT  equipment populations from which we selected our samples for testing.
subsections: section_title: GAO Tests Identified Significant Numbers of Missing IT Equipment Items
paragraphs: Our tests of physical inventory controls from February through May of  2008 identified 50 missing IT equipment items, including 9 medical  equipment items. Of the 50 missing items, 34 items could have stored  sensitive personal and medical information. Because VA does not know  what, if any, sensitive information resided on the equipment, notifications  to potentially affected individuals could not be made. Following the recent  completion of VA inventories of IT equipment and adjustment of inventory  records at the four test locations, we would not have expected to identify  any additional missing items. The continuing occurrences of missing items  indicate that underlying control weaknesses have not yet been corrected.  Lost and missing IT equipment pose both a financial risk as well as a  security risk associated with sensitive information maintained on  computer hard drives. The scope of our IT equipment inventory tests was  broader than VA’s IT inventory because we included medical items with  data storage capability. Medical equipment with data storage capability is  not currently included in VA’s definition of IT equipment. VA CIO officials  told us they are aware of the need to control medical equipment with data  storage capability and plan to address control of IT components of this  equipment. The following discussion summarizes the results of our  inventory control tests at the four case study locations.
North Texas HCS. As noted in table 5, our physical inventory testing of  the North Texas HCS—which covered the Dallas VA Medical Center and  Fort Worth Outpatient Clinic components—found high control failure  rates for all of our inventory control tests. Our existence test identified  seven missing items, including two that had the capability to store  sensitive information. One of the missing items was a piece of medical  equipment. As noted in table 5, we estimated a 6 percent failure rate  related to the missing items in the recorded population of 12,172 IT  equipment items from which we selected our sample. In addition, our  analysis of the population of recorded IT equipment found that 7,164, or  about 59 percent, did not have their serial numbers recorded in the  physical inventory records. Serial numbers are essential to proper  identification of sensitive computer equipment.
Boston HCS. Our physical inventory testing of the Boston HCS—which  covered the Brockton, Jamaica Plain, and West Roxbury Campuses— identified 10 missing items, including 7 that had the capability to store  sensitive information. The 7 missing items included four medical  analyzers, two microcomputers, and a radiology equipment item. As noted  in table 5, we estimated a 3 percent failure rate related to the missing  items in the recorded population of 15,706 IT equipment items from which  we selected our sample.
Puget Sound HCS. The Puget Sound HCS had an estimated failure rate of  1 percent related to missing items in the recorded population of 11,474 IT  equipment items, allowing us to conclude that the HCS’s controls over  existence of IT equipment inventory are effective. Further, the one item  we determined to be missing related to a computer monitor which did not  have the capability to store data. However, the Puget Sound HCS had high  failure rates for the user information and recordkeeping tests.
VA Headquarters Organizations. Our physical inventory testing of VA  headquarters organizations IT equipment items identified an estimated  failure rate of 12 percent related to missing items in the recorded  population of 34,735 items. Our population included strata for VHA, VBA,  OIT, Acquisition and Materiel Management, General Counsel, Policy and  Planning, and a seventh strata with all other headquarters organizations.  Table 6 identifies missing IT equipment items in our stratified sample by  VA headquarters organization.
As was the case with our 2007 audit of VA IT equipment inventory  controls, we found a lack of user-level accountability at the four case  study locations in our current tests. As shown in table 7, VA has not yet  assured accurate IT inventory records with regard to user organization  and location. Information on organization and location are key to  maintaining visibility and accountability for IT equipment items. VA  property management policy and VA Handbook 7002 include guidelines  for holding employees and supervisors pecuniarily (financially) liable for  loss, damage, or destruction because of negligence or misuse of  government property. Several VA facilities have provided us with current  examples where VA employees have been held liable for lost and missing  IT equipment. Since the completion of our tests, VA has mandated early  implementation of Handbook 7002 which also requires assignment of user- level accountability for most IT equipment items. To be effective, the new  policy will need to be adequately implemented and enforced.
The following discussion summarizes the results of our tests for user-level  accountability.
North Texas HCS. The North Texas HCS components we tested had very  high failure rates related to accountability—an estimated 91 percent for  correct user organization and an estimated 46 percent for correct user  location. North Texas HCS staff provided us with evidence of sign-out  sheets and hand receipts for some IT equipment items such as pagers,  cellular telephones, and personal digital assistants. However, for a  majority of IT equipment items, the North Texas HCS did not assign user- level accountability through hand receipts or record user information in  the inventory system. For medical IT equipment items, the inventory  system included user organizations (e.g., radiology or anesthesiology), but  did not assign the items to unit heads.
Boston HCS. The Boston HCS campuses we tested also had high failure  rates related to accountability—an estimated 60 percent for correct user  organization and an estimated 17 percent for correct user location. At our  exit briefing in May 2008, Boston HCS staff reported that they are working  with engineering personnel to better identify physical locations to aid in  the tracking of mobile IT equipment items. For traditional IT equipment  items, the Boston HCS generally did not record user organization in its IT  equipment inventory records. Further, the Boston HCS generally did not  assign user-level accountability through recorded user information or  hand-receipts with the exception of pagers, cell phones, and laptops that  have been assigned to specific users. For medical IT equipment items, the  inventory system included user organizations (e.g., radiology or  anesthesiology). However, the inventory records for some of the  equipment listed the user as “Medical” or “Nursing” and did not specify  what unit in the hospital was accountable for the equipment.
Puget Sound HCS. The Puget Sound HCS components we tested also had  high failure rates related to accountability—an estimated 76 percent for  correct user organization and an estimated 14 percent for correct user  location. The Puget Sound HCS staff provided us with evidence of a locally  developed supplemental application for AEMS/MERS, known as the  Equipment Loan Form (ELF). Puget Sound HCS staff use the ELF to  record user-level information for mobile IT equipment items (e.g., laptop  computers) or IT equipment items taken off-site (e.g., a desktop computer  at an employee’s home). However, for traditional IT equipment items (e.g.,  desktop computers, printers, and monitors at HCS facilities), the HCS did  not assign user-level accountability with recorded user information or  hand-receipts. For traditional IT equipment items, the inventory records  generally did not identify the user organizations. For medical IT equipment  items, the inventory system included user organizations (e.g., radiology or  anesthesiology), but did not assign accountability for shared items to unit  heads.
VA Headquarters Organizations. Our statistical tests for accurate user  organization information identified an estimated 12 percent error rate for  VA headquarters organizations. In addition, our statistical tests for correct  user information identified an estimated 52 percent error rate. Out tests  included IT equipment coordinators—who are responsible for control of  equipment shared by multiple users—and individual user employees. In  situations where equipment, such as a printer, was shared by multiple  employees, we based our tests on whether the inventory records correctly  listed the equipment coordinator. In other situations where equipment was  in possession and use by an individual employee, we tested to see if that  employee was listed in the property record. Overall, we found 147 errors  out of a sample of 349 records tested. Regarding user location, our  statistical tests found an estimated 33 percent error rate related to  situations where inventory records were not updated to reflect the transfer  or relocation of IT equipment.
We also identified inconsistencies in the use of hand receipts for assigning  user-level accountability of mobile IT equipment that can be removed from  VA offices for use by employees who are on travel or are working at home.  For example, we requested hand receipts for 38 mobile IT equipment items  in our statistical sample that were being used by VA headquarters  employees. These items either could be or were taken off-site. We received  20 hand receipts—4 that were dated after the date of our request and 16  that were valid. We did not receive hand receipts for the other 18 devices.
section_title: Recordkeeping Errors in IT Equipment Inventory Status and Item Description Information
paragraphs: As shown in table 8, we found some problems with the accuracy of IT  equipment inventory records, ranging from an estimated 4 percent at VA  headquarters to an estimated 41 percent at the Boston HCS.  Recordkeeping errors included inaccurate information on the status (in  use, turned-in, disposal), serial numbers, and item descriptions. Although  the estimated overall failure rates for these tests were lower than the  failure rates for the other control attributes we tested, they were  significant for the various recordkeeping attributes we tested at the four  locations.
Accurate IT equipment inventory records are important to management  decision making because these records are used to determine the types,  quantities, and age of equipment as well as life cycle and replacement time  frames. Inaccurate information on the status of items—in service, sent for  repair, turned in for disposal—masks visibility of items that are not  available for use and may need to be replaced. Serial number errors, such  as typographical errors, can impair accountability. Further, inaccurate  inventory information can cause significant waste and inefficiency during  physical inventories because it may require additional time to locate and  verify the status of the items.
Our review of the data submissions from all four test locations we visited  identified data consistency and standardization issues with recorded  names, models, and manufacturers of IT equipment. As a result,  management at facilities we tested could not tell how many items of a  certain model they had in service. Because property system data fields for  item description are free-form and do not provide for data standardization,  accurate data entry is critical to the identification of like items. For  example, North Texas HCS inventory data showed one Solar 8000  physiological monitor listed as model “soalr 8000,” one listed as “Solar  800,” 26 listed as “Solar 8000,” and 70 listed as “Solar8000.” Although some  of these differences appear to be typographical errors, when searching for  Solar 8000 equipment in the database, there is no assurance that other  variations of the item name would appear in the search results. Further,  this situation hindered the North Texas HCS staff’s identification of  medical IT equipment items that store or process patient data, requiring us  to select a second sample and make an additional site visit. At the Boston  HCS, we found that Samsung monitor model number 150N was referred to  inconsistently as a “Monitor” 4 times, “Neoware” 3 times, “Samsung 15  Inch” 33 times, and a “Samsung Monitor” 58 times. VA’s policy does not  address data consistency and standardization. Our Internal Control  Management and Evaluation Tool states that an agency should    establish a variety of control activities suited to information processing  systems to ensure accuracy and completeness,   consider whether edit checks are used in controlling data entry, and    consider accuracy control in relation to data entry design features.
Although this tool is not required to be used, it is intended to provide a  systematic, organized, and structured approach for federal agency use in  assessing internal control structure. The failure to maintain consistent  information on identical items or classes of items impairs visibility over IT  assets as well as analysis and management decision making on existing IT  equipment and replacements.
section_title: Weaknesses in Controls over Hard Drives in the Disposal Process
paragraphs: Although VA requires that hard drives of IT equipment and medical  equipment be sanitized prior to disposal to prevent unauthorized release  of sensitive personal and medical information, we found weaknesses in  the disposal process at each of our test locations that pose a risk that  sensitive personal and medical information could be compromised.  Specifically, we found weaknesses related to (1) timeliness of data  sanitization, (2) adequacy of inventory recordkeeping for hard drives  removed from their host computers, and (3) physical security controls.  Currently, VA OIT personnel are not cleansing all hard drives in the  property disposal process because of the guidance from VA’s Office of  General Counsel to preserve electronic information relevant to a class  action lawsuit filed against VA in 2007 (the litigation hold), which  heightens the need to maintain control over the hard drives in the property  disposal process. However, two case study locations had not performed  timely sanitization and disposal of hard drives prior to the effective date of  the litigation hold. Specifically, one of our HCS test locations had stored  excess hard drives for 3 to 4 years and another HCS test location indicated  some of its excess hard drives dated back to the 1980s. Two HCS locations  did not record dates that all hard drives were received. VA headquarters  organizations did not keep records on hard drives in the disposal process  prior to February 2008. In addition, adequate control over computer hard  drives in the property disposal process requires accurate and complete  recordkeeping, such as recording the hard drive serial number along with  property identification and serial numbers of the original host computer.  The ability to identify hard drives with the host computer inventory  records also provides a means to determine the type of data that may have  been stored on the hard drives. However, two of our four test locations did  not record sufficient information to identify hard drives with host  computers, and VA did not have a standard procedure to address this  issue. Moreover, although storage locations used for excess hard drives  are subject to access controls in VA Handbook 0730/1, Security and Law  Enforcement, including motion detection intrusion alarm systems and  special key (access) controls, three of our four case study locations did  not comply with these requirements. Weaknesses in the controls over hard  drives in the property disposal process create an unnecessary risk that  sensitive personal information protected under the Privacy Act of 1974  and health information accorded additional protections under the Health  Insurance Portability and Accountability Act of 1996 (HIPAA) could be  compromised. The following discussion summarizes our findings at the  four case study locations.
North Texas HCS. We found that the North Texas HCS had weaknesses  in controls over hard drives in the property disposal process related to  timely sanitization, inadequate recordkeeping, and lack of access controls.  According to North Texas HCS staff, they were not sanitizing data from  any hard drives in the property disposal process at the time of our site visit  because of the litigation hold related to the class action lawsuit. The North  Texas HCS also indicated that not all hard drives received for sanitization  and disposal had been logged in their tracking system. However, for those  drives that were recorded, we found that the hard drive disposal records  contained sufficient information for identifying hard drives with their  original host computers. In addition, the disposal records contained the  dates on which the hard drives were removed from their original host  computers. The North Texas HCS also maintained a file on certifications  of drives that had been cleansed. Further, we observed that one of the two  storage locations storing hard drives had inadequate physical security  because of the absence of an access control system and intrusion  detection alarm system, as required by VA Handbook 0730/1.
Boston HCS. Our work identified recordkeeping weaknesses in the hard  drive disposal process at the Boston HCS. Specifically, we found that the  hard drive disposal records did not contain sufficient information for  identifying hard drives with their original host computers. Further, these  records did not indicate the dates on which OIT personnel removed hard  drives from their original host computers, which would impede an  assessment of timely sanitization or disposal. The Boston HCS also had a  practice of storing used hard drives in unsecured locations, such as closets  and cabinets, and indicated that it had hard drives dating back to the  1980’s. The Boston HCS Information Security Officer is in the process of  establishing a centralized storage facility for computer hard drives.
Puget Sound HCS. We identified control weaknesses in the hard drive  disposal process at the Puget Sound HCS related to a lack of timely  sanitization and disposal and inadequate recordkeeping. Although Puget  Sound HCS officials are holding drives because of the litigation hold  related to the class action lawsuit, they told us that approximately 100 of  the hard drives we observed had been in storage for approximately 3 or 4  years, and therefore are not related to the litigation hold. In addition, the  hard drive disposal records at the Puget Sound HCS did not contain  sufficient information for identifying hard drives with their original host  computers. After our site visit, Puget Sound HCS staff provided us with  revised hard drive records that include property identification numbers  and hard drive serial numbers and identify hard drives with their original  host computers. The Puget Sound HCS stored hard drives in a location  that was in full compliance with physical security requirements in VA  Handbook 0730/1.
VA Headquarters Organizations. Weaknesses we identified in controls  involved the lack of recordkeeping prior to February 2008 and the lack of  access controls of hard drive storage facilities. We found that the current  hard drive disposal records at VA headquarters contain sufficient  information for identifying hard drives with their original host computers.  Specifically, OIT records hard drive information in a log that requires,  among other elements, the bar code and serial numbers of the original  host computer from which OIT personnel removed the hard drive and the  serial number of the hard drive. OIT also records the dates on which hard  drives are removed from original host computers. However, according to  OIT officials and our review of the hard drive records, VA headquarters did  not maintain a central record of hard drives prior to February 2008.  Further, one of the two hard drive storage locations that we observed at  VA headquarters had inadequate physical security because of the absence  of an access control system and intrusion detection alarm system, as  required by VA Handbook 0730/1.
section_title: Physical Security Weaknesses Increase Risk of Loss, Theft, and Misappropriation
paragraphs: VA Handbook 0730/1, Security and Law Enforcement, prescribes physical  security requirements for storage of new and used IT equipment.  Specifically, the handbook requires warehouse-type storerooms to have  walls to ceiling height with either masonry or gypsum wall board reaching  the underside of the slab (floor) above. OIT storerooms are required to  have overhead barricades that prevent “up and over” access from adjacent  rooms. Warehouse, OIT, and medical equipment storerooms are all  required to have motion intrusion detection alarm systems that detect  entry and broadcast an alarm of sufficient volume to cause an illegal  entrant to abandon a burglary attempt. Finally, OIT storerooms also are  required to have special key control, meaning room door lock keys and  day lock combinations that are not master keyed for use by others.
Our investigator’s inspection of physical security at officially designated IT  warehouses and storerooms that held new and used IT equipment at the  four case study locations found that most of these storage facilities met  the requirements in VA Handbook 0730/1. However, we identified some  deficiencies. For example, our investigator found at least one room at all  four case study locations that did not have an electronic access control  system or an intrusion detection system. Designated IT equipment storage  locations at the Seattle Division of the Puget Sound HCS met the physical  security requirements in VA Handbook 0730/1. However, IT workrooms  and other informal, undesignated storage facilities did not.
Despite the established physical security requirements, we found  numerous informal, undesignated IT equipment storage locations that did  not meet VA physical security requirements. For example, we observed an  excess property storage room at the North Texas HCS that contained  boxes of 86 hard drives that needed to be disposed of or sanitized. This  room lacked a motion detection alarm system and the type of locking  system prescribed in VA policy. North Texas HCS staff believed this room  was not subject to the security provisions of VA Handbook 0730/1 because  it was not formally designated as a storeroom or warehouse. Our  investigator also identified an IT equipment work room at the North Texas  HCS that lacked adequate physical security measures and was considered  temporary in nature. In addition, at the Boston HCS, our investigator  found that security personnel were unaware of several temporary storage  rooms that contained IT equipment. Some of these rooms were initially  established by OIT personnel as temporary storage areas, but had been in  use for several years. Because these storerooms had not been formally  designated as IT storage facilities, they were not subjected to required  physical security inspections. Weaknesses in physical security heighten  the risk that sensitive information contained on IT equipment stored in  unsecured warehouses and storerooms could be compromised.
section_title: Conclusions
paragraphs: Our audits and VA’s departmentwide physical inventory of IT equipment  identified pervasive control weaknesses that resulted in tens of thousands  of missing IT equipment items that were purchased with taxpayer dollars.  About 9,800 of these items have data storage capabilities and therefore  pose a risk of improper disclosure of veterans’ personal and medical  information. Further, VA’s lack of user-level accountability and its failure  to maintain accurate and complete IT inventory records have hindered  efforts to locate missing items. In the past year, VA has made significant  progress in implementing its realigned OIT organization and strengthening  policies for control over IT equipment. However, ensuring that IT  inventory records are complete and that they are updated as changes in  status occur will be key to maintaining accuracy and accountability over  IT equipment items. VA’s continued efforts to establish and maintain  control over IT assets will be essential if VA is to adequately safeguard  those assets from theft, loss, and misappropriation and protect sensitive  personal and medical information of the nation’s veterans.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Secretary of Veterans Affairs require the CIO, with  the support of medical centers and VA headquarters organizations we  tested and other VA organizations, as appropriate, to take the following  five actions to improve accountability of IT equipment inventory and  reduce the risk of disclosure or compromise of sensitive personal and  medical information:    Review property inventory records and confirm that all IT equipment,  regardless of the organizational equipment inventory listing, is identified in  the property system.
Establish and implement a policy requiring development of standardized  naming classifications for IT equipment—including item name,  manufacturer, and model—for recording IT equipment into local property  inventory systems.
Develop a list of medical equipment with data storage capability that  should be considered as IT equipment for inventory control purposes.
Develop a procedure for identifying hard drive serial numbers with both  the property identification numbers and serial numbers of host computers.
Revise the definition of IT storage locations in VA’s Handbook 0730/1,  Security and Law Enforcement, to include informal IT storage locations,  such as OIT work rooms, and require these locations to be included in  physical security inspections.
section_title: Agency Comments and Our Evaluation
paragraphs: In its July 28, 2008, written comments on our report, which are reprinted  in appendix III, VA generally agreed with four of our five  recommendations.  VA initially disagreed with our recommendation  concerning inventory control over medical equipment because it  interpreted our recommendation as requiring them to redefine (i.e.,  reclassify) medical equipment with data storage capability as IT  equipment. Instead, our recommendation was directed at developing a list  of medical equipment with data storage capability and including this  equipment in physical inventories of IT equipment to provide for CIO  oversight of these items. We followed up with VA officials to clarify the  intent of our recommendation.  We also made appropriate changes to our  report to clarify the intent of our recommendation.
In addition, while agreeing with the intent of our recommendation  concerning the development of standard naming classifications for its IT  equipment, VA initially commented that it differed with part of our  recommendation concerning who should be responsible for the  development of standardized naming classifications. However, VA’s  comments indicate that it interpreted this recommendation as requiring  classification action to occur on a decentralized basis at each VA facility.  This was not our intent. In follow-up discussions with VA officials, we  explained that our recommendation was directed at taking action to  establish VA-wide naming conventions that would be used by all VA  facilities in recording property information in their local inventory  systems. We clarified the wording in our recommendation accordingly.
Based on our follow-up meeting, VA officials said they agreed with all five  of our recommendations.  They reiterated actions noted in VA’s comment  letter on steps taken as well as planned actions to improve the accuracy  and consistency of information in VA’s property inventory systems.
We are sending copies of this report to interested congressional  committees; the Secretary of Veterans Affairs; the Veterans Affairs Chief  Information Officer; the Under Secretary of Health, Veterans Health  Administration; and the Director of the Office of Management and Budget.  We will make copies available to others upon request. In addition, this  report will be available at no charge on the GAO Web site at  http://www.gao.gov.
Please contact me at (202) 512-9095 or dalykl@gao.gov, if you of your staff  have any questions concerning this report. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last   page of this report. Major contributors to this report are acknowledged in  appendix V.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Given the continuing nature of information technology (IT) equipment  inventory control problems and their significance, the Chairman and  Ranking Member of the House Committee on Veterans’ Affairs,  Subcommittee on Oversight and Investigations asked us to perform  additional follow-up work to determine (1) whether the Department of  Veterans Affairs (VA) has made progress in implementing our prior  recommendations for improving internal control over IT equipment and  (2) the effectiveness of VA’s current internal controls to prevent theft, loss,  or misappropriation of IT equipment.
We evaluated VA’s progress in implementing our previously reported  recommendations by reviewing agency documentation and interviewing  property management and Office of Information Technology (OIT)  officials on actions taken in response to recommendations in our 2007 and  2004 reports. In concert with the Subcommittee request that VA perform a  departmentwide physical inventory of IT assets, we reviewed the results of  VA’s 2007 physical inventory of IT equipment items and VA’s process for  completing Reports of Survey on lost and stolen items. We also evaluated  policies that include guidance for improving accountability of IT  equipment and accuracy of inventory records, related memorandums, and  other documentation, such as action summaries. In addition, we  interviewed cognizant VA officials about specific actions under way or  completed, the component organizations responsible for those actions,  and the status and targeted completion dates of those actions.
Our assessment of the effectiveness of current VA IT equipment inventory  controls included statistical tests of key control attributes at four case  study locations, including the health care systems (HCS) in North Texas,  Boston, and Puget Sound, and VA headquarters organizations. We also  assessed controls over hard drives in the excess property disposal  process, and our investigators made physical security inspections of IT  storage locations at our four case study locations.
We used as our criteria applicable law and VA policy, as well as our  Standards for Internal Control in the Federal Government and our  Internal Control Management and Evaluation Tool. We reviewed  applicable program guidance provided by the test locations and  interviewed officials about their IT inventory processes and controls.
In selecting our case study locations, we chose three geographically  disparate VA HCS. We also tested inventory at VA headquarters  organizations as a means of assessing the overall control environment, or  “tone at the top,” as we did in our 2007 audit. Table 9 shows the VA  locations selected for IT equipment inventory control testing, the sample  size, and the reported number and value of IT equipment items at each  location.
We performed appropriate data reliability procedures, including an  assessment of each VA test location’s procedures for assuring data  reliability, reasonableness checks on electronic data, and tests to assure  that IT equipment inventory was sufficiently complete for the purposes of  our work. As in our 2007 work, we relied on biomedical engineers to  provide lists of medical equipment with the ability to store or process  electronic data. We performed analytical procedures to confirm  reasonableness of the medical equipment listings provided by the three  HCS. Our analysis determined that the original listing submitted by the  North Texas HCS staff was incomplete regarding medical equipment  meeting our definition as IT equipment. We revisited our criteria for  identifying medical equipment with data storage and processing capability  with North Texas HCS officials and asked them to provide us a new  medical equipment listing to support our sampling and control tests. Our  procedures and test work also identified a limitation related to the  completeness of IT equipment inventory at our four test locations. The VA  North Texas and Boston HCS maintained some IT equipment records  outside of their central listings of IT equipment. We also identified  evidence that the VA Puget Sound and VA headquarters did not record all  IT equipment items in the official property records. Further, our statistical  tests determined that some IT equipment was recorded in inventory  categories other than IT. We disclosed this limitation in the discussion of  our test results. As a result of these limitations, the population of IT  equipment is not known for VA overall or by location and we were not  able to project our test results to the population of IT equipment inventory  at each of our four test locations. However, we determined that these data  were sufficiently reliable for us to project our test results to the population  of current, recorded IT equipment inventory at each of the four locations.
From the population of current, recorded IT equipment inventory at the  time of our tests, we selected stratified random probability samples of IT  equipment, including medical equipment with data storage capability, at  each of the three HCS locations. For the 19 VA headquarters organizations,  we stratified our sample by 6 major offices and used a seventh stratum for  the remaining 13 organizations. With these statistically valid samples, each  item in the population for the four case study locations had a nonzero  probability of being included, and that probability could be computed for  any item. Each sample item for a test location was subsequently weighted  in our analysis to account statistically for all items in the population for  that location, including those that were not selected.
We performed tests on statistical samples of IT equipment inventory  transactions at each of the four case study locations to assess whether the  system of internal control over physical IT equipment inventory was  effective (i.e., provided reasonable assurance of the reliability of inventory  information and accountability of the individual items). For each IT  equipment item in our statistical sample, we assessed whether (1) the item  existed (meaning that the item recorded in the inventory records could be  located), (2) inventory records and processes provided adequate  accountability, and (3) identifying information (property number, serial  number, model number, and location) was accurate. We explain the  results of our existence tests in terms of control failures related to missing  items and recordkeeping errors. The results of our statistical samples are  specific to each of the four test locations and cannot be projected to the  population of VA IT inventory as a whole. We present the results of our  statistical samples for each population as point estimates representing     (1) our projection of the estimated error overall for each control attribute  and (2) the two-sided, 95 percent confidence intervals for the failure rates.
To assess VA’s controls over computer hard drives in the property disposal  process, at each HCS and VA headquarters we interviewed OIT officials,  observed hard drive storage locations, and obtained copies of VA  documentation related to hard drives in the disposal process at the time of  our site visits.
Our investigators supported our tests of IT physical inventory controls by  assessing the physical security of various IT equipment storage facilities at  each of our four case study locations. As part of our assessment, one of  our investigators interviewed VA Police at the three HCS locations and  federal agency law enforcement officers at VA headquarters and met with  physical security specialists at each of the test locations to discuss the  results of our physical security inspections and the status of VA actions on  identified weaknesses.
We briefed VA managers at our three HCS test locations and VA  headquarters, including VA HCS directors and OIT and property  management officials, on the details of our audit, our findings, and their  implications. On July 15, 2008, we requested comments on a draft of this  report. We received comments from the Secretary of Veterans Affairs on  July 28, 2008, and we had follow-up discussions with cognizant VA  officials.  We have summarized VA’s comments and our follow-up  discussions in the Agency Comments and Our Evaluation section of this  report. We conducted this performance audit from January 2008 through  July 2008 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. We performed our  investigative work in accordance with standards prescribed by the  President’s Council on Integrity and Efficiency.
section_title: Appendix II: Status of VA Actions on Recommendations in GAO’s July 2007 and 2004 Reports
paragraphs: Table 10 lists the 12 recommendations from our 2007 report, summarizes  VA’s actions, and presents the status of each recommendation. VA  property officials from the Office of Acquisition and Logistics (OAL) and  officials in the Office of Information and Technology (OIT) worked  together to create a new VA Handbook 7002, Logistics Management  Procedures, which updates VA policy for property management, including  specific policy pertaining to information technology (IT) equipment. The  Assistant Secretary for Management mandated early implementation of VA  Handbook 7002 on July 3, 2008.
Table 11 lists the 6 property-related recommendations from our 2004  report, summarizes VA’s actions, and presents the status of each  recommendation.
section_title: Appendix III: Comments from the Department of Veterans Affairs
section_title: Appendix IV: Reports of Survey on Missing IT Equipment for VA Case Study Locations
paragraphs: Table 12 summarizes Report of Survey information related to VA’s 2007  physical inventories of IT equipment for the 12 case study locations  covered in our 2004, 2007, and 2008 audits. We used the original  acquisition value as the best available data for the cost of IT equipment  items that could not be located during VA’s 2007 physical inventory.
section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: Acknowledgments
paragraphs: In addition to the contact named above, Gayle L. Fischer, Assistant  Director; Andrew O’Connell, Assistant Director and Supervisory Special  Agent; F. Abe Dymond, Assistant General Counsel; Doreen S. Eng,  Assistant Director; Bamidele A. Adesina; James D. Ashley; Deyanna J.  Beeler; Francine M. DelVecchio; Lauren S. Fassler; Steven M. Koons;    Kelly A. Richburg; Ramon J. Rodriguez, Special Agent; Daniel E. Silva;  Chevalier C. Strong; Danietta S. Williams; and Matthew L. Wood made key  contributions to this report.