Veterans Affairs: Continued Action Needed to Reduce IT Equipment Losses and Correct Control Weaknesses
Released: 2008-07-31T00:00:00

Letter

Background

VA’s mission is to serve America’s veterans and their families and to be their principal advocate in ensuring that they receive medical care, benefits, and social support in recognition of their service to our nation. VA, headquartered in Washington, D.C., is the second largest federal department and reported it had over 230,000 employees as of September 30, 2007, including physicians, nurses, counselors, statisticians, computer specialists, architects, and attorneys. VA has three major line organizations—VHA, VBA, and NCA—and field facilities throughout the United States. VHA has 21 Veterans Integrated Service Networks (VISN) that oversee medical center activities within their areas, which may cover one or more states. VA provides employees, contractors, volunteers, and students with a wide range of IT equipment, including desktop and laptop computers, monitors and printers, personal digital assistants, unit-level workstations, local area networking equipment, and medical equipment with memory and data processing/communication capabilities. By the start of fiscal year 2008, VA had centralized its IT function at all locations within the realigned OIT.

VA’s IT Property Management Process

The Assistant Secretary for Information and Technology heads VA’s OIT, serves as the CIO for the department, and is the principal advisor to the Secretary on matters relating to IT management in the department. OIT staff share responsibility for management of IT equipment inventory with property management personnel. Accordingly, it is crucial for the department’s CIO to have the cooperation of property managers to ensure that well-established integrated processes exist for controlling IT inventory.

The steps in the IT property management process are key events, which should be documented by an inventory transaction, a financial transaction, or both, as appropriate. Federal records management law, as codified in Title 44 of the U.S. Code and implemented through National Archives and Records Administration (NARA) guidance, requires federal agencies to adequately document and maintain proper records of essential transactions and have effective controls for creating, maintaining, and using records of these transactions. Table 1 provides an overview of VA’s IT property management process.

VA Has Made Significant Progress in Addressing GAO Recommendations and Completing a VA- Wide IT Equipment Inventory

VA has made significant progress in addressing our previous recommendations directed at improving policies and procedures for control of IT equipment and reducing the risk of disclosure of sensitive personal and medical information. As of the end of our field work in July 2008, VA had completed action on 10 of our 12 recommendations from our July 2007 report. VA’s Assistant Secretary for Management and the CIO worked together to draft a revised property management policy in a new VA Handbook 7002, Logistics Management Procedures, which addresses 7 of our 2007 recommendations. This revised policy is an important step in establishing a framework for control of IT equipment. On July 3, 2008, the Assistant Secretary for Management mandated early implementation of this policy, which includes requirements for user-level accountability, time frames for completing Reports of Survey on missing and stolen property, and requirements for strengthening physical security. VA also partially implemented action on one other recommendation and has actions under way to address the remaining recommendation from our 2007 report. Successful implementation of these efforts will be key to improving controls over VA’s IT equipment. VA also made progress implementing recommendations from our 2004 report related to personal property and equipment management. VA completed action on four of six property- related recommendations in our 2004 report and partially completed action on a fifth recommendation. VA has plans to address the remaining 2004 recommendation. In addition, in response to your concerns about VA- wide controls based on our previous audits, VA required departmentwide physical inventories of IT equipment to be completed by December 31, 2007. OIT monitored the 2007 physical inventory effort for IT equipment and reported that as of May 15, 2008, VA was unable to locate approximately 62,800 recorded IT equipment items, of which over 9,800 could have stored sensitive information. The CIO formed a “tiger team” to monitor efforts under the Report of Survey system and to help ensure that Reports of Survey are completed in a timely manner.

VA Has Made Significant Progress in Addressing GAO Recommendations

To address recommendations in our July 2007 report, VA completed action on 10 of our 12 recommendations, partially implemented actions on one other recommendation, and has actions under way to address the remaining recommendation. VA actions on our 2007 report recommendations included the establishment of specific time frames for finalizing Reports of Survey, granting OIT personnel access to the central property database, and holding employees financially liable for lost IT equipment. In addition, VA completed action on four of the six recommendations in our July 2004 report, partially completed action on a fifth recommendation, and has plans to address the remaining recommendation. For example, VA revised its policy through VA Handbook 7127/4, Materiel Management Procedures, to state that sensitive items include IT equipment and named several types of IT equipment items. VA’s revised policy also stated that IT equipment items valued under $5,000 are to be included in physical inventories. Further, VA has drafted policies that provide a framework for strengthening controls over IT equipment, including VA Handbook 7002, Logistics Management Procedures. On July 3, 2008, VA’s Assistant Secretary for Management mandated early implementation of this handbook. Effective implementation of this new policy will be essential to ensuring adequate control and accountability of VA’s IT equipment and any sensitive information residing on that equipment. Table 2 provides a summary of our 2007 and 2004 recommendations and the current status of VA actions. For a more detailed explanation of VA’s actions taken and planned on our recommendations, see appendix II.

VA’s 2007 Physical Inventory Effort Demonstrated Continuing Problems with Controls over IT Equipment

VA’s 2007 departmentwide inventory initially identified approximately 79,000 missing IT equipment items, underscoring the need to effectively implement the new policies and procedures mandated on July 3, 2008. In the 6 months following completion of the physical inventory, VA facilities undertook efforts to locate or determine reasons for missing items. VA was able to locate several thousand of the missing equipment items. However, as summarized in table 3, on May 15, 2008, OIT reported that VA was unable to locate approximately 62,800 recorded IT equipment items, of which over 9,800 could have stored sensitive information. Because VA does not know what, if any, sensitive information resided on the equipment and when the equipment was lost, notifications to potentially affected individuals could not be made in accordance with OMB guidance. We interviewed VA officials and obtained documentation on the VA-wide inventory; however, we did not validate the results. According to VA, many of the missing items were old equipment and may have been disposed of through VA’s excess property program. However, because VA facilities had not always documented IT equipment disposal for many years, there was no way to determine whether any of the missing items were lost or stolen. Further, during our work, we discovered that not all IT equipment items were included in the departmentwide inventory. Consequently, the numbers of missing items could be higher. For example, VA’s 2007 physical inventory did not include medical equipment with data storage or processing capabilities. In addition, IT equipment items not accounted for in the OIT equipment inventory listing (EIL) were not subject to the 2007 physical inventory at some VA facilities. Further, limited completeness tests we performed as part of our data reliability procedures at case study locations identified some IT equipment items recorded to EILs for organizations other than OIT. Prior to the establishment of OIT, EILs were aligned organizationally and some IT equipment assigned to other EILs had not yet been reassigned to the OIT EIL and, therefore, were omitted from the 2007 physical inventory. We discussed our finding with OIT officials, and they told us that they had met in June 2008 to develop strategies for moving all IT equipment items assigned to other EILs to the OIT EIL.

In compliance with VA Handbook 7125, General Procedures, VA personnel submitted Reports of Survey for IT equipment items that were not located during the departmentwide physical inventory and subsequent follow-up investigation. A CIO tiger team was responsible for monitoring the Report of Survey process and helping to ensure that it was completed in a timely manner. Local Boards of Survey were responsible for investigating missing items and approving write-offs of IT equipment items that could not be located during the departmentwide physical inventory. However, as of May 15, 2008, VA had over 43,000 items that were listed on open Reports of Survey and facility personnel were continuing to search for missing items. The 2007 physical inventories were a massive undertaking and required significant effort over several months to resolve discrepancies. Although we would have expected the VA locations that we previously tested to have few, if any, missing items, as of May 15, 2008, 6 of the 12 locations reported from 1,269 to 6,427 missing IT items; 4 locations had from 115 to 863 missing IT items; and only 2 locations had fewer than 100 missing items. A summary of Reports of Survey data on missing IT equipment and the reported original acquisition cost identified in VA’s 2007 physical inventory related to sites we tested in our 2004, 2007, and 2008 audits are presented in appendix IV.

Tests of IT Inventory Controls at Case Study Locations Identified Continuing Weaknesses

Our tests of IT equipment inventory controls at four case study locations, including three VA HCS and VA headquarters, identified continuing control weaknesses related to missing items, lack of accountability, and errors in IT equipment inventory records. VA’s 2007 departmentwide physical inventory effort was intended to establish a reliable IT equipment inventory baseline going forward. Accordingly, our tests excluded from the population of IT equipment thousands of items identified as missing during VA’s 2007 IT physical inventory effort. Given the new baseline, if adequate controls had been in place by the end of this inventory process, we would not have expected to identify missing items, blank data fields, or inaccurate inventory records at our test locations. As previously noted, in July 2008 VA mandated early implementation of revised policy related to control of IT equipment. Although the early implementation of July 2008 policy changes may address IT equipment control weaknesses, this policy was not in effect at the time of our tests. Our Standards for Internal Control in the Federal Government states that a positive control environment provides discipline and structure as well as the climate that influences the quality of internal control. Further, these standards require agencies to establish physical control to secure and safeguard vulnerable assets, such as equipment that might be vulnerable to risk of loss or unauthorized use, including periodically counting the assets and comparing the results to control records. However, our tests of IT equipment inventory controls at the four case study locations, including three VA HCS and VA headquarters, identified continuing problems with (1) inventory control and accountability, (2) control over computer hard drives in the excess property disposal process, and (3) physical security of IT equipment storage locations. For example, our statistical tests at the four locations from February through May of 2008 identified significant numbers of missing items, several of which could have stored sensitive personal and medical information. Overall, our statistical tests and data analysis at the four locations found significant failures related to IT inventory control and accountability including (1) missing items, (2) blank serial numbers, (3) inaccurate information on user organization, (4) inaccurate information on user location, and (5) other recordkeeping errors. We also identified weaknesses in the controls over computer hard drives in the property disposal process at the four test locations, involving (1) lack of timely sanitization and disposal, (2) inadequate recordkeeping, and (3) physical security. In addition, we found physical security weaknesses at IT storage facilities at all four locations. These weaknesses increase the risk that sensitive personal and medical information could be compromised.

GAO’s IT Inventory Control Tests Found Continuing Problems

Our 2008 statistical tests of key IT equipment inventory controls and data analysis found significant inventory control failures related to (1) missing items, (2) blank serial numbers, (3) inaccurate information on user organization, (4) inaccurate information on user location, and (5) other recordkeeping errors. As noted previously, VA performed a 2007 physical inventory of IT equipment. We excluded from our populations the missing items identified during VA’s physical inventory at the four case study locations. Table 4 shows the 2007 VA-wide inventory results related to missing items at our four case study locations.

Given our exclusions of missing items from the VA inventories, if adequate controls had been in place by the end of this inventory process, we would not have expected to identify missing items, blank data fields, or inaccurate inventory records at our test locations. Table 5 shows the results of our statistical tests at the four case study locations. We present our results as point estimates of control failure rates. Each point estimate has a margin of error, based on a two-sided, 95 percent confidence interval, of plus or minus 10 percent or less.

Serial number control is essential to accountability for sensitive items, such as IT equipment, because it identifies unique items. The property bar code label alone is not a sufficient identifier for sensitive items because these labels are removable and can be replaced, if lost or damaged. In addition, because VA has not yet put in place a control for user-level accountability, accurate information on user organization and user location is key to maintaining accountability for IT equipment items. Further, recordkeeping errors impair the reliability of IT inventory information for management decision making. For example, inaccurate inventory records on item name, model number, and manufacturer impair asset visibility and affect decision making on timing of IT equipment upgrades.

As discussed previously, limited completeness testing performed as part of our data reliability procedures identified IT equipment that was not included in the populations of recorded IT equipment used for our control tests. For example, our completeness tests at two of the four locations we tested identified three IT equipment items that were recorded to EILs for Psychology, Radiology, and Acquisition and Material Management rather than the OIT EIL. Our completeness tests also identified one item not recorded to an EIL. VA officials could not tell us the quantity of IT equipment items that were not included in the four case study IT equipment populations from which we selected our samples for testing.

GAO Tests Identified Significant Numbers of Missing IT Equipment Items

Our tests of physical inventory controls from February through May of 2008 identified 50 missing IT equipment items, including 9 medical equipment items. Of the 50 missing items, 34 items could have stored sensitive personal and medical information. Because VA does not know what, if any, sensitive information resided on the equipment, notifications to potentially affected individuals could not be made. Following the recent completion of VA inventories of IT equipment and adjustment of inventory records at the four test locations, we would not have expected to identify any additional missing items. The continuing occurrences of missing items indicate that underlying control weaknesses have not yet been corrected. Lost and missing IT equipment pose both a financial risk as well as a security risk associated with sensitive information maintained on computer hard drives. The scope of our IT equipment inventory tests was broader than VA’s IT inventory because we included medical items with data storage capability. Medical equipment with data storage capability is not currently included in VA’s definition of IT equipment. VA CIO officials told us they are aware of the need to control medical equipment with data storage capability and plan to address control of IT components of this equipment. The following discussion summarizes the results of our inventory control tests at the four case study locations.

North Texas HCS. As noted in table 5, our physical inventory testing of the North Texas HCS—which covered the Dallas VA Medical Center and Fort Worth Outpatient Clinic components—found high control failure rates for all of our inventory control tests. Our existence test identified seven missing items, including two that had the capability to store sensitive information. One of the missing items was a piece of medical equipment. As noted in table 5, we estimated a 6 percent failure rate related to the missing items in the recorded population of 12,172 IT equipment items from which we selected our sample. In addition, our analysis of the population of recorded IT equipment found that 7,164, or about 59 percent, did not have their serial numbers recorded in the physical inventory records. Serial numbers are essential to proper identification of sensitive computer equipment.

Boston HCS. Our physical inventory testing of the Boston HCS—which covered the Brockton, Jamaica Plain, and West Roxbury Campuses— identified 10 missing items, including 7 that had the capability to store sensitive information. The 7 missing items included four medical analyzers, two microcomputers, and a radiology equipment item. As noted in table 5, we estimated a 3 percent failure rate related to the missing items in the recorded population of 15,706 IT equipment items from which we selected our sample.

Puget Sound HCS. The Puget Sound HCS had an estimated failure rate of 1 percent related to missing items in the recorded population of 11,474 IT equipment items, allowing us to conclude that the HCS’s controls over existence of IT equipment inventory are effective. Further, the one item we determined to be missing related to a computer monitor which did not have the capability to store data. However, the Puget Sound HCS had high failure rates for the user information and recordkeeping tests.

VA Headquarters Organizations. Our physical inventory testing of VA headquarters organizations IT equipment items identified an estimated failure rate of 12 percent related to missing items in the recorded population of 34,735 items. Our population included strata for VHA, VBA, OIT, Acquisition and Materiel Management, General Counsel, Policy and Planning, and a seventh strata with all other headquarters organizations. Table 6 identifies missing IT equipment items in our stratified sample by VA headquarters organization.

As was the case with our 2007 audit of VA IT equipment inventory controls, we found a lack of user-level accountability at the four case study locations in our current tests. As shown in table 7, VA has not yet assured accurate IT inventory records with regard to user organization and location. Information on organization and location are key to maintaining visibility and accountability for IT equipment items. VA property management policy and VA Handbook 7002 include guidelines for holding employees and supervisors pecuniarily (financially) liable for loss, damage, or destruction because of negligence or misuse of government property. Several VA facilities have provided us with current examples where VA employees have been held liable for lost and missing IT equipment. Since the completion of our tests, VA has mandated early implementation of Handbook 7002 which also requires assignment of user- level accountability for most IT equipment items. To be effective, the new policy will need to be adequately implemented and enforced.

The following discussion summarizes the results of our tests for user-level accountability.

North Texas HCS. The North Texas HCS components we tested had very high failure rates related to accountability—an estimated 91 percent for correct user organization and an estimated 46 percent for correct user location. North Texas HCS staff provided us with evidence of sign-out sheets and hand receipts for some IT equipment items such as pagers, cellular telephones, and personal digital assistants. However, for a majority of IT equipment items, the North Texas HCS did not assign user- level accountability through hand receipts or record user information in the inventory system. For medical IT equipment items, the inventory system included user organizations (e.g., radiology or anesthesiology), but did not assign the items to unit heads.

Boston HCS. The Boston HCS campuses we tested also had high failure rates related to accountability—an estimated 60 percent for correct user organization and an estimated 17 percent for correct user location. At our exit briefing in May 2008, Boston HCS staff reported that they are working with engineering personnel to better identify physical locations to aid in the tracking of mobile IT equipment items. For traditional IT equipment items, the Boston HCS generally did not record user organization in its IT equipment inventory records. Further, the Boston HCS generally did not assign user-level accountability through recorded user information or hand-receipts with the exception of pagers, cell phones, and laptops that have been assigned to specific users. For medical IT equipment items, the inventory system included user organizations (e.g., radiology or anesthesiology). However, the inventory records for some of the equipment listed the user as “Medical” or “Nursing” and did not specify what unit in the hospital was accountable for the equipment.

Puget Sound HCS. The Puget Sound HCS components we tested also had high failure rates related to accountability—an estimated 76 percent for correct user organization and an estimated 14 percent for correct user location. The Puget Sound HCS staff provided us with evidence of a locally developed supplemental application for AEMS/MERS, known as the Equipment Loan Form (ELF). Puget Sound HCS staff use the ELF to record user-level information for mobile IT equipment items (e.g., laptop computers) or IT equipment items taken off-site (e.g., a desktop computer at an employee’s home). However, for traditional IT equipment items (e.g., desktop computers, printers, and monitors at HCS facilities), the HCS did not assign user-level accountability with recorded user information or hand-receipts. For traditional IT equipment items, the inventory records generally did not identify the user organizations. For medical IT equipment items, the inventory system included user organizations (e.g., radiology or anesthesiology), but did not assign accountability for shared items to unit heads.

VA Headquarters Organizations. Our statistical tests for accurate user organization information identified an estimated 12 percent error rate for VA headquarters organizations. In addition, our statistical tests for correct user information identified an estimated 52 percent error rate. Out tests included IT equipment coordinators—who are responsible for control of equipment shared by multiple users—and individual user employees. In situations where equipment, such as a printer, was shared by multiple employees, we based our tests on whether the inventory records correctly listed the equipment coordinator. In other situations where equipment was in possession and use by an individual employee, we tested to see if that employee was listed in the property record. Overall, we found 147 errors out of a sample of 349 records tested. Regarding user location, our statistical tests found an estimated 33 percent error rate related to situations where inventory records were not updated to reflect the transfer or relocation of IT equipment.

We also identified inconsistencies in the use of hand receipts for assigning user-level accountability of mobile IT equipment that can be removed from VA offices for use by employees who are on travel or are working at home. For example, we requested hand receipts for 38 mobile IT equipment items in our statistical sample that were being used by VA headquarters employees. These items either could be or were taken off-site. We received 20 hand receipts—4 that were dated after the date of our request and 16 that were valid. We did not receive hand receipts for the other 18 devices.

Recordkeeping Errors in IT Equipment Inventory Status and Item Description Information

As shown in table 8, we found some problems with the accuracy of IT equipment inventory records, ranging from an estimated 4 percent at VA headquarters to an estimated 41 percent at the Boston HCS. Recordkeeping errors included inaccurate information on the status (in use, turned-in, disposal), serial numbers, and item descriptions. Although the estimated overall failure rates for these tests were lower than the failure rates for the other control attributes we tested, they were significant for the various recordkeeping attributes we tested at the four locations.

Accurate IT equipment inventory records are important to management decision making because these records are used to determine the types, quantities, and age of equipment as well as life cycle and replacement time frames. Inaccurate information on the status of items—in service, sent for repair, turned in for disposal—masks visibility of items that are not available for use and may need to be replaced. Serial number errors, such as typographical errors, can impair accountability. Further, inaccurate inventory information can cause significant waste and inefficiency during physical inventories because it may require additional time to locate and verify the status of the items.

Our review of the data submissions from all four test locations we visited identified data consistency and standardization issues with recorded names, models, and manufacturers of IT equipment. As a result, management at facilities we tested could not tell how many items of a certain model they had in service. Because property system data fields for item description are free-form and do not provide for data standardization, accurate data entry is critical to the identification of like items. For example, North Texas HCS inventory data showed one Solar 8000 physiological monitor listed as model “soalr 8000,” one listed as “Solar 800,” 26 listed as “Solar 8000,” and 70 listed as “Solar8000.” Although some of these differences appear to be typographical errors, when searching for Solar 8000 equipment in the database, there is no assurance that other variations of the item name would appear in the search results. Further, this situation hindered the North Texas HCS staff’s identification of medical IT equipment items that store or process patient data, requiring us to select a second sample and make an additional site visit. At the Boston HCS, we found that Samsung monitor model number 150N was referred to inconsistently as a “Monitor” 4 times, “Neoware” 3 times, “Samsung 15 Inch” 33 times, and a “Samsung Monitor” 58 times. VA’s policy does not address data consistency and standardization. Our Internal Control Management and Evaluation Tool states that an agency should establish a variety of control activities suited to information processing systems to ensure accuracy and completeness, consider whether edit checks are used in controlling data entry, and consider accuracy control in relation to data entry design features.

Although this tool is not required to be used, it is intended to provide a systematic, organized, and structured approach for federal agency use in assessing internal control structure. The failure to maintain consistent information on identical items or classes of items impairs visibility over IT assets as well as analysis and management decision making on existing IT equipment and replacements.

Weaknesses in Controls over Hard Drives in the Disposal Process

Although VA requires that hard drives of IT equipment and medical equipment be sanitized prior to disposal to prevent unauthorized release of sensitive personal and medical information, we found weaknesses in the disposal process at each of our test locations that pose a risk that sensitive personal and medical information could be compromised. Specifically, we found weaknesses related to (1) timeliness of data sanitization, (2) adequacy of inventory recordkeeping for hard drives removed from their host computers, and (3) physical security controls. Currently, VA OIT personnel are not cleansing all hard drives in the property disposal process because of the guidance from VA’s Office of General Counsel to preserve electronic information relevant to a class action lawsuit filed against VA in 2007 (the litigation hold), which heightens the need to maintain control over the hard drives in the property disposal process. However, two case study locations had not performed timely sanitization and disposal of hard drives prior to the effective date of the litigation hold. Specifically, one of our HCS test locations had stored excess hard drives for 3 to 4 years and another HCS test location indicated some of its excess hard drives dated back to the 1980s. Two HCS locations did not record dates that all hard drives were received. VA headquarters organizations did not keep records on hard drives in the disposal process prior to February 2008. In addition, adequate control over computer hard drives in the property disposal process requires accurate and complete recordkeeping, such as recording the hard drive serial number along with property identification and serial numbers of the original host computer. The ability to identify hard drives with the host computer inventory records also provides a means to determine the type of data that may have been stored on the hard drives. However, two of our four test locations did not record sufficient information to identify hard drives with host computers, and VA did not have a standard procedure to address this issue. Moreover, although storage locations used for excess hard drives are subject to access controls in VA Handbook 0730/1, Security and Law Enforcement, including motion detection intrusion alarm systems and special key (access) controls, three of our four case study locations did not comply with these requirements. Weaknesses in the controls over hard drives in the property disposal process create an unnecessary risk that sensitive personal information protected under the Privacy Act of 1974 and health information accorded additional protections under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) could be compromised. The following discussion summarizes our findings at the four case study locations.

North Texas HCS. We found that the North Texas HCS had weaknesses in controls over hard drives in the property disposal process related to timely sanitization, inadequate recordkeeping, and lack of access controls. According to North Texas HCS staff, they were not sanitizing data from any hard drives in the property disposal process at the time of our site visit because of the litigation hold related to the class action lawsuit. The North Texas HCS also indicated that not all hard drives received for sanitization and disposal had been logged in their tracking system. However, for those drives that were recorded, we found that the hard drive disposal records contained sufficient information for identifying hard drives with their original host computers. In addition, the disposal records contained the dates on which the hard drives were removed from their original host computers. The North Texas HCS also maintained a file on certifications of drives that had been cleansed. Further, we observed that one of the two storage locations storing hard drives had inadequate physical security because of the absence of an access control system and intrusion detection alarm system, as required by VA Handbook 0730/1.

Boston HCS. Our work identified recordkeeping weaknesses in the hard drive disposal process at the Boston HCS. Specifically, we found that the hard drive disposal records did not contain sufficient information for identifying hard drives with their original host computers. Further, these records did not indicate the dates on which OIT personnel removed hard drives from their original host computers, which would impede an assessment of timely sanitization or disposal. The Boston HCS also had a practice of storing used hard drives in unsecured locations, such as closets and cabinets, and indicated that it had hard drives dating back to the 1980’s. The Boston HCS Information Security Officer is in the process of establishing a centralized storage facility for computer hard drives.

Puget Sound HCS. We identified control weaknesses in the hard drive disposal process at the Puget Sound HCS related to a lack of timely sanitization and disposal and inadequate recordkeeping. Although Puget Sound HCS officials are holding drives because of the litigation hold related to the class action lawsuit, they told us that approximately 100 of the hard drives we observed had been in storage for approximately 3 or 4 years, and therefore are not related to the litigation hold. In addition, the hard drive disposal records at the Puget Sound HCS did not contain sufficient information for identifying hard drives with their original host computers. After our site visit, Puget Sound HCS staff provided us with revised hard drive records that include property identification numbers and hard drive serial numbers and identify hard drives with their original host computers. The Puget Sound HCS stored hard drives in a location that was in full compliance with physical security requirements in VA Handbook 0730/1.

VA Headquarters Organizations. Weaknesses we identified in controls involved the lack of recordkeeping prior to February 2008 and the lack of access controls of hard drive storage facilities. We found that the current hard drive disposal records at VA headquarters contain sufficient information for identifying hard drives with their original host computers. Specifically, OIT records hard drive information in a log that requires, among other elements, the bar code and serial numbers of the original host computer from which OIT personnel removed the hard drive and the serial number of the hard drive. OIT also records the dates on which hard drives are removed from original host computers. However, according to OIT officials and our review of the hard drive records, VA headquarters did not maintain a central record of hard drives prior to February 2008. Further, one of the two hard drive storage locations that we observed at VA headquarters had inadequate physical security because of the absence of an access control system and intrusion detection alarm system, as required by VA Handbook 0730/1.

Physical Security Weaknesses Increase Risk of Loss, Theft, and Misappropriation

VA Handbook 0730/1, Security and Law Enforcement, prescribes physical security requirements for storage of new and used IT equipment. Specifically, the handbook requires warehouse-type storerooms to have walls to ceiling height with either masonry or gypsum wall board reaching the underside of the slab (floor) above. OIT storerooms are required to have overhead barricades that prevent “up and over” access from adjacent rooms. Warehouse, OIT, and medical equipment storerooms are all required to have motion intrusion detection alarm systems that detect entry and broadcast an alarm of sufficient volume to cause an illegal entrant to abandon a burglary attempt. Finally, OIT storerooms also are required to have special key control, meaning room door lock keys and day lock combinations that are not master keyed for use by others.

Our investigator’s inspection of physical security at officially designated IT warehouses and storerooms that held new and used IT equipment at the four case study locations found that most of these storage facilities met the requirements in VA Handbook 0730/1. However, we identified some deficiencies. For example, our investigator found at least one room at all four case study locations that did not have an electronic access control system or an intrusion detection system. Designated IT equipment storage locations at the Seattle Division of the Puget Sound HCS met the physical security requirements in VA Handbook 0730/1. However, IT workrooms and other informal, undesignated storage facilities did not.

Despite the established physical security requirements, we found numerous informal, undesignated IT equipment storage locations that did not meet VA physical security requirements. For example, we observed an excess property storage room at the North Texas HCS that contained boxes of 86 hard drives that needed to be disposed of or sanitized. This room lacked a motion detection alarm system and the type of locking system prescribed in VA policy. North Texas HCS staff believed this room was not subject to the security provisions of VA Handbook 0730/1 because it was not formally designated as a storeroom or warehouse. Our investigator also identified an IT equipment work room at the North Texas HCS that lacked adequate physical security measures and was considered temporary in nature. In addition, at the Boston HCS, our investigator found that security personnel were unaware of several temporary storage rooms that contained IT equipment. Some of these rooms were initially established by OIT personnel as temporary storage areas, but had been in use for several years. Because these storerooms had not been formally designated as IT storage facilities, they were not subjected to required physical security inspections. Weaknesses in physical security heighten the risk that sensitive information contained on IT equipment stored in unsecured warehouses and storerooms could be compromised.

Conclusions

Our audits and VA’s departmentwide physical inventory of IT equipment identified pervasive control weaknesses that resulted in tens of thousands of missing IT equipment items that were purchased with taxpayer dollars. About 9,800 of these items have data storage capabilities and therefore pose a risk of improper disclosure of veterans’ personal and medical information. Further, VA’s lack of user-level accountability and its failure to maintain accurate and complete IT inventory records have hindered efforts to locate missing items. In the past year, VA has made significant progress in implementing its realigned OIT organization and strengthening policies for control over IT equipment. However, ensuring that IT inventory records are complete and that they are updated as changes in status occur will be key to maintaining accuracy and accountability over IT equipment items. VA’s continued efforts to establish and maintain control over IT assets will be essential if VA is to adequately safeguard those assets from theft, loss, and misappropriation and protect sensitive personal and medical information of the nation’s veterans.

Recommendations for Executive Action

We recommend that the Secretary of Veterans Affairs require the CIO, with the support of medical centers and VA headquarters organizations we tested and other VA organizations, as appropriate, to take the following five actions to improve accountability of IT equipment inventory and reduce the risk of disclosure or compromise of sensitive personal and medical information: Review property inventory records and confirm that all IT equipment, regardless of the organizational equipment inventory listing, is identified in the property system.

Establish and implement a policy requiring development of standardized naming classifications for IT equipment—including item name, manufacturer, and model—for recording IT equipment into local property inventory systems.

Develop a list of medical equipment with data storage capability that should be considered as IT equipment for inventory control purposes.

Develop a procedure for identifying hard drive serial numbers with both the property identification numbers and serial numbers of host computers.

Revise the definition of IT storage locations in VA’s Handbook 0730/1, Security and Law Enforcement, to include informal IT storage locations, such as OIT work rooms, and require these locations to be included in physical security inspections.

Agency Comments and Our Evaluation

In its July 28, 2008, written comments on our report, which are reprinted in appendix III, VA generally agreed with four of our five recommendations. VA initially disagreed with our recommendation concerning inventory control over medical equipment because it interpreted our recommendation as requiring them to redefine (i.e., reclassify) medical equipment with data storage capability as IT equipment. Instead, our recommendation was directed at developing a list of medical equipment with data storage capability and including this equipment in physical inventories of IT equipment to provide for CIO oversight of these items. We followed up with VA officials to clarify the intent of our recommendation. We also made appropriate changes to our report to clarify the intent of our recommendation.

In addition, while agreeing with the intent of our recommendation concerning the development of standard naming classifications for its IT equipment, VA initially commented that it differed with part of our recommendation concerning who should be responsible for the development of standardized naming classifications. However, VA’s comments indicate that it interpreted this recommendation as requiring classification action to occur on a decentralized basis at each VA facility. This was not our intent. In follow-up discussions with VA officials, we explained that our recommendation was directed at taking action to establish VA-wide naming conventions that would be used by all VA facilities in recording property information in their local inventory systems. We clarified the wording in our recommendation accordingly.

Based on our follow-up meeting, VA officials said they agreed with all five of our recommendations. They reiterated actions noted in VA’s comment letter on steps taken as well as planned actions to improve the accuracy and consistency of information in VA’s property inventory systems.

We are sending copies of this report to interested congressional committees; the Secretary of Veterans Affairs; the Veterans Affairs Chief Information Officer; the Under Secretary of Health, Veterans Health Administration; and the Director of the Office of Management and Budget. We will make copies available to others upon request. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov.

Please contact me at (202) 512-9095 or dalykl@gao.gov, if you of your staff have any questions concerning this report. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors to this report are acknowledged in appendix V.

Appendix I: Objectives, Scope, and Methodology

Given the continuing nature of information technology (IT) equipment inventory control problems and their significance, the Chairman and Ranking Member of the House Committee on Veterans’ Affairs, Subcommittee on Oversight and Investigations asked us to perform additional follow-up work to determine (1) whether the Department of Veterans Affairs (VA) has made progress in implementing our prior recommendations for improving internal control over IT equipment and (2) the effectiveness of VA’s current internal controls to prevent theft, loss, or misappropriation of IT equipment.

We evaluated VA’s progress in implementing our previously reported recommendations by reviewing agency documentation and interviewing property management and Office of Information Technology (OIT) officials on actions taken in response to recommendations in our 2007 and 2004 reports. In concert with the Subcommittee request that VA perform a departmentwide physical inventory of IT assets, we reviewed the results of VA’s 2007 physical inventory of IT equipment items and VA’s process for completing Reports of Survey on lost and stolen items. We also evaluated policies that include guidance for improving accountability of IT equipment and accuracy of inventory records, related memorandums, and other documentation, such as action summaries. In addition, we interviewed cognizant VA officials about specific actions under way or completed, the component organizations responsible for those actions, and the status and targeted completion dates of those actions.

Our assessment of the effectiveness of current VA IT equipment inventory controls included statistical tests of key control attributes at four case study locations, including the health care systems (HCS) in North Texas, Boston, and Puget Sound, and VA headquarters organizations. We also assessed controls over hard drives in the excess property disposal process, and our investigators made physical security inspections of IT storage locations at our four case study locations.

We used as our criteria applicable law and VA policy, as well as our Standards for Internal Control in the Federal Government and our Internal Control Management and Evaluation Tool. We reviewed applicable program guidance provided by the test locations and interviewed officials about their IT inventory processes and controls.

In selecting our case study locations, we chose three geographically disparate VA HCS. We also tested inventory at VA headquarters organizations as a means of assessing the overall control environment, or “tone at the top,” as we did in our 2007 audit. Table 9 shows the VA locations selected for IT equipment inventory control testing, the sample size, and the reported number and value of IT equipment items at each location.

We performed appropriate data reliability procedures, including an assessment of each VA test location’s procedures for assuring data reliability, reasonableness checks on electronic data, and tests to assure that IT equipment inventory was sufficiently complete for the purposes of our work. As in our 2007 work, we relied on biomedical engineers to provide lists of medical equipment with the ability to store or process electronic data. We performed analytical procedures to confirm reasonableness of the medical equipment listings provided by the three HCS. Our analysis determined that the original listing submitted by the North Texas HCS staff was incomplete regarding medical equipment meeting our definition as IT equipment. We revisited our criteria for identifying medical equipment with data storage and processing capability with North Texas HCS officials and asked them to provide us a new medical equipment listing to support our sampling and control tests. Our procedures and test work also identified a limitation related to the completeness of IT equipment inventory at our four test locations. The VA North Texas and Boston HCS maintained some IT equipment records outside of their central listings of IT equipment. We also identified evidence that the VA Puget Sound and VA headquarters did not record all IT equipment items in the official property records. Further, our statistical tests determined that some IT equipment was recorded in inventory categories other than IT. We disclosed this limitation in the discussion of our test results. As a result of these limitations, the population of IT equipment is not known for VA overall or by location and we were not able to project our test results to the population of IT equipment inventory at each of our four test locations. However, we determined that these data were sufficiently reliable for us to project our test results to the population of current, recorded IT equipment inventory at each of the four locations.

From the population of current, recorded IT equipment inventory at the time of our tests, we selected stratified random probability samples of IT equipment, including medical equipment with data storage capability, at each of the three HCS locations. For the 19 VA headquarters organizations, we stratified our sample by 6 major offices and used a seventh stratum for the remaining 13 organizations. With these statistically valid samples, each item in the population for the four case study locations had a nonzero probability of being included, and that probability could be computed for any item. Each sample item for a test location was subsequently weighted in our analysis to account statistically for all items in the population for that location, including those that were not selected.

We performed tests on statistical samples of IT equipment inventory transactions at each of the four case study locations to assess whether the system of internal control over physical IT equipment inventory was effective (i.e., provided reasonable assurance of the reliability of inventory information and accountability of the individual items). For each IT equipment item in our statistical sample, we assessed whether (1) the item existed (meaning that the item recorded in the inventory records could be located), (2) inventory records and processes provided adequate accountability, and (3) identifying information (property number, serial number, model number, and location) was accurate. We explain the results of our existence tests in terms of control failures related to missing items and recordkeeping errors. The results of our statistical samples are specific to each of the four test locations and cannot be projected to the population of VA IT inventory as a whole. We present the results of our statistical samples for each population as point estimates representing (1) our projection of the estimated error overall for each control attribute and (2) the two-sided, 95 percent confidence intervals for the failure rates.

To assess VA’s controls over computer hard drives in the property disposal process, at each HCS and VA headquarters we interviewed OIT officials, observed hard drive storage locations, and obtained copies of VA documentation related to hard drives in the disposal process at the time of our site visits.

Our investigators supported our tests of IT physical inventory controls by assessing the physical security of various IT equipment storage facilities at each of our four case study locations. As part of our assessment, one of our investigators interviewed VA Police at the three HCS locations and federal agency law enforcement officers at VA headquarters and met with physical security specialists at each of the test locations to discuss the results of our physical security inspections and the status of VA actions on identified weaknesses.

We briefed VA managers at our three HCS test locations and VA headquarters, including VA HCS directors and OIT and property management officials, on the details of our audit, our findings, and their implications. On July 15, 2008, we requested comments on a draft of this report. We received comments from the Secretary of Veterans Affairs on July 28, 2008, and we had follow-up discussions with cognizant VA officials. We have summarized VA’s comments and our follow-up discussions in the Agency Comments and Our Evaluation section of this report. We conducted this performance audit from January 2008 through July 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We performed our investigative work in accordance with standards prescribed by the President’s Council on Integrity and Efficiency.

Appendix II: Status of VA Actions on Recommendations in GAO’s July 2007 and 2004 Reports

Table 10 lists the 12 recommendations from our 2007 report, summarizes VA’s actions, and presents the status of each recommendation. VA property officials from the Office of Acquisition and Logistics (OAL) and officials in the Office of Information and Technology (OIT) worked together to create a new VA Handbook 7002, Logistics Management Procedures, which updates VA policy for property management, including specific policy pertaining to information technology (IT) equipment. The Assistant Secretary for Management mandated early implementation of VA Handbook 7002 on July 3, 2008.

Table 11 lists the 6 property-related recommendations from our 2004 report, summarizes VA’s actions, and presents the status of each recommendation.

Appendix III: Comments from the Department of Veterans Affairs

Appendix IV: Reports of Survey on Missing IT Equipment for VA Case Study Locations

Table 12 summarizes Report of Survey information related to VA’s 2007 physical inventories of IT equipment for the 12 case study locations covered in our 2004, 2007, and 2008 audits. We used the original acquisition value as the best available data for the cost of IT equipment items that could not be located during VA’s 2007 physical inventory.

Appendix V: GAO Contact and Staff Acknowledgments

Acknowledgments

In addition to the contact named above, Gayle L. Fischer, Assistant Director; Andrew O’Connell, Assistant Director and Supervisory Special Agent; F. Abe Dymond, Assistant General Counsel; Doreen S. Eng, Assistant Director; Bamidele A. Adesina; James D. Ashley; Deyanna J. Beeler; Francine M. DelVecchio; Lauren S. Fassler; Steven M. Koons; Kelly A. Richburg; Ramon J. Rodriguez, Special Agent; Daniel E. Silva; Chevalier C. Strong; Danietta S. Williams; and Matthew L. Wood made key contributions to this report.