IHS, an operating division of HHS, is responsible for providing health services to federally recognized tribes of American Indians and Alaska Natives. According to IHS, in 2008, it provided health services to approximately 1.9 million American Indians and Alaska Natives from more than 562 federally recognized tribes. As an operating division of HHS, IHS is included in the agency’s consolidated financial statement and has not been audited independently since 2002. IHS is divided into 12 regions with 161 service units throughout the country. Service units may contain one or more health facilities, including hospitals, health centers, village clinics, health stations, and school health centers. There are 124 IHS-operated health facilities and 522 tribally operated health facilities. The IHS budget appropriation in 2008 was $3.39 billion. Overall, over 40 percent of the IHS budget authority appropriation is administered by tribes, primarily through various contracts and compacts with the federal government. We found that property continues to be lost or stolen at IHS at an alarming rate. From October 2007 through January 2009, IHS identified about 1,400 items with an acquisition value of about $3.5 million that were lost or stolen agencywide. These property losses are in addition to what we identified in our June 2008 report. Our full headquarters inventory testing and our random sample testing of six field offices estimated that over a million dollars worth of IT equipment was lost, stolen, or unaccounted for, confirming that property management weaknesses continue at IHS. Also, IHS headquarters and many IHS regions continue to reconcile 2008 inventory as of March 2009. In addition to the $3.5 million reported as lost or stolen, IHS also had thousands of unreconciled and unaccounted for property items with an acquisition value of $14.5 million missing about 2 months after conducting its 2008 inventory. These unreconciled and unaccounted for items had largely been located at four field locations that had over 40 percent of inventory items missing. Some of these items will likely be reported as lost or stolen. We analyzed IHS Report of Survey documents from fiscal years 2008 and 2009 covering the period of October 2007 through January 2009 for IHS headquarters, National Programs, and the 12 regions. These reports identified that about 1,400 items with an acquisition value of about $3.5 million were reported lost or stolen in little over a year. Some of the more egregious examples of lost or stolen property during October 2007 through January 2009 on reports of survey include the following: An audiometer—a machine used for evaluating hearing loss—with an acquisition value of $961 was “put out for trash” at an Oklahoma location that was new and listed in “UNUSED-GOOD” condition. A laboratory analyzer at a Navajo health care facility with an acquisition value of $37,000. A defibrillator with an acquisition value of $7,000 and over $13,000 in desktop and laptop computers that were new in June 2007 at a Tucson location. A telephone switch from National Programs in Albuquerque with an acquisition value of $25,500. A trailer with an acquisition value of $7,300 stolen from a Nashville Region Office parking lot over the weekend when the security gates were broken and remained open. We also found that about 2 months after conducting its 2008 inventory, IHS was still looking for about $14.5 million in items it identified as missing. Items that IHS continued to search for include the following: A 2002 ultrasound unit valued at $170,000, a 2003 X-ray mammography machine valued at $100,795, and a 2004 medication dispensing system valued at $168,285. A new pharmacy tablet counter with an acquisition value of $4,000 from a Washington location. A new electrocardiograph—a machine used to record the electrical activity of the heart—with an acquisition value of $4,000. Seven vital sign monitors from a South Dakota Hospital purchased at $731 each. Multiple dental chairs from a Kansas location with acquisition values of $3,200 each. High-dollar-value IT equipment purchased in 2006 including a Central Processing Unit with an acquisition value over $30,000 and two servers worth $29,000 and $12,000. A $14,000 John Deere tractor purchased in 2005. Unused IT equipment purchased in 2007 including laptops, desktops, an $11,000 server, and a television. Our physical inventory testing results were similar to IHS’s inventory results and confirmed lost, stolen, or unaccounted for property. Our full inventory testing at IHS headquarters identified that out of the 1,518 items tested that were on IHS’s inventory records as of December 5, 2008, 126 items with an acquisition value of $216,000 (or about 8 percent of the items tested) were lost, stolen, or unaccounted for—including 13 computers purchased in the summer of 2008. These 126 missing items were in addition to the 35 assets that IHS stated were missing in their physical inventory ending September 2008. The types of equipment missing included digital cameras, laptops, PDAs, and cell phones. Furthermore, we performed limited testing on new purchases made in fiscal year 2008 at IHS headquarters. We analyzed 19 new purchases to determine if the items existed and were on IHS books. We found that 10 of the 19 items that we tested were not in IHS’s inventory records as of December 2008. In addition, IHS could not account for 7 of the 19 items— 37 percent of the newly purchased equipment. We also identified examples of waste that we observed during our audit of IHS headquarters. During our exit conference discussions, IHS agreed some equipment may be underutilized. We identified the following examples of waste: One employee was issued a PDA but told GAO that he had not used it in 2 years. Another employee was issued a laptop and never used the laptop. One user was assigned three laptops but only used one of them. The employee stated that one of the laptops was to be disposed of but provided no explanation for the third laptop. We selected a probability sample of IT equipment inventory at six IHS field offices to determine whether the lack of accountability for inventory was confined to headquarters or present elsewhere within the agency. Our estimates are based on a probability sample of 250 items from a population of 6,085 IT equipment items worth over $19 million recorded in property records for IT equipment at the six field locations. Similar to our finding at IHS headquarters, our sample results indicate that a substantial number of pieces of IT equipment such as laptops, desktops, and printers were lost, stolen, or unaccounted for. Specifically, we estimate that for the six locations, about 800 equipment items with an acquisition value of $1.7 million were lost, stolen, or unaccounted for. This amounts to about 13 percent of all the IT equipment at these six locations. Table 1 below summarizes the disposition of the 250 sampled IT items. Weak “tone at the top” persists at IHS, with senior leadership failing to fully implement and enforce 8 of the 10 recommendations we made in June 2008. These failures strongly contribute to the continued loss and theft of property at IHS. Aside from issuing a memorandum from the IHS Director that restated and refined existing IHS policies, IHS has taken little action to provide assurance that employees are aware of and complying with property policies. One way to enforce policies involves holding individuals accountable. However, we found little evidence that IHS has held employees accountable for thousands of lost or stolen items worth millions of dollars. For example, in December 2008, the IHS executive in charge of the property group and other areas received a $13,000 performance award (8 percent of the executive’s salary) from IHS senior leadership. This award was granted 5 months after the July 2008 hearing exposed mismanagement of property under the executive’s purview. By failing to hold this key property management official accountable, the IHS Director and senior managers missed an opportunity to communicate the seriousness of IHS property problems to the responsible official. Although IHS has taken steps to update policy and perform physical inventories, most of our recommendations were only partially implemented. Of the 10 recommendations, IHS has fully implemented 2 and has begun taking steps to implement the remaining items. Table 2 shows the IHS action and status of implementing our recommendations. Although IHS took some steps in implementing our recommendations such as changing their policy on handling sensitive items to include Blackberries regardless of the threshold, we identified the following examples of problems fully implementing these corrective actions. Investigating circumstances surrounding missing property. We saw little improvement in investigating incidents of lost or stolen property. Without these investigations, IHS remains unable to hold individuals financially liable. Out of 1,400 items with an acquisition value of $3.5 million reported as lost or stolen in IHS Reports of Survey for fiscal year 2008 through January 2009, IHS could only provide one example in which an employee was found to be financially liable for lost or stolen property. However, as of February 2009, the individual has still not reimbursed the government for the loss—4 months after he was found financially liable. We identified other examples where individuals were not held accountable: One employee who was assigned a laptop that was missing told IHS property managers that she could not remember what happened to the laptop. IHS wrote the laptop off its books in September 2008 without holding the employee responsible. A laptop was given to an employee in Oklahoma to use at home but IHS did not issue a hand receipt. The employee left the agency and did not return the laptop. According to the Report of Survey, IHS did not hold the employee accountable because the employee left the agency. A Phoenix employee’s cellular phone was stolen after he left the phone on his desk overnight. The board of survey concluded that the individual was negligent in not properly safeguarding his cellular phone, but recommended that no assessment of liability be held against the employee. According to a Portland property officer, a laptop was stolen from an employee’s workstation. The workstation was accessible to the public and was not secured in accordance with HHS regulations. According to an IHS property official, the employee had several laptops assigned to him and he did not know that the computer was missing. However, the board did not hold the employee financially liable for the missing laptop. Enforcing annual physical inventories. Although IHS made progress by conducting a 100 percent physical inventory at IHS headquarters, National Programs, and all 12 regions for the first time in at least 4 years, improvements are needed in timely reconciliation of shortages and updating of its inventory records. Although physical inventories should be performed over a finite period, IHS officials performed extensive searches in an attempt to locate missing items before preparing Reports of Survey to write them off. As of March 2009, IHS headquarters property officials stated that IHS headquarters and many of the regions were still in the process of reconciling their 2008 physical inventory which they stated they completed in September 2008. For example, we verified in December 2008 that IHS was able to find the Jaws of Life medical equipment reported as lost or stolen in September 2006, but for about 2 years these items were unaccounted for. Furthermore, according to IHS property officials, a board of survey was recently established in March 2009 at IHS headquarters, but has not yet determined what actions should be taken to finalize Reports of Survey in order to update inventory records. In fact, IHS headquarters has not completed a Report of Survey to finalize inventories since 2004. Enforcing the use of hand receipts. HHS requires the use of hand receipts, known as HHS form 439, any time property is issued to an employee. This form should be retained by a property official so that property can be tracked at the time of transfer, separation, change in duties, or when requested by the proper authority. By signing this form, an IHS employee takes responsibility for the government-issued equipment. In our last audit, we found IHS headquarters did not use the HHS form 439, nor did they use any other type of hand receipt. To enforce this policy, the Director of IHS issued a memorandum in November 2008 which stated that a hand receipt should be signed by employees for all property issued in order to acknowledge receipt and assign responsibility. Based on our limited testing of hand receipts, we confirmed that IHS has begun to implement hand receipts at headquarters and a majority of the field locations where we performed site visits for items such as PDAs and laptops but has not yet started issuing hand receipts for all issued items such as desktops. Also, we found that some of the items we tested did not have hand receipts and one field location has not yet started issuing hand receipts for any type of property. Maintaining information on users and location. HHS requires IHS to document information on the user and the location of equipment, including building and room number, in order to easily track and locate property. Although the IHS Director included in his November 2008 memorandum a requirement to designate user information for each asset in PMIS, not all of the IHS field locations that we tested maintained specific user and location information in PMIS. Also, our tests of user and location data in PMIS at IHS headquarters and at the six field location shows that PMIS user and location information is not accurate. More specifically, IHS headquarters had user and location errors of 21 percent and 28 percent, respectively; these errors were much higher at the tested field locations at about 87 and 89 percent, respectively. As a result of inaccurate user and location information, field staff took several days to locate items that were included in our sample inventory, and IHS headquarters had delays in finding remaining inventory items during GAO’s full physical inventory. Inaccurate user and location information also contributes to the lengthy duration of IHS physical inventories— taking several months to reconcile and locate items. Enforcing the use of PMIS to create reliable inventory records. In a November 2008 memorandum, the IHS director mandated the use of PMIS and removal of all legacy systems. Despite this memorandum, our inquiries at field locations found that legacy systems are still being used. Training has not been completed at the property custodial officer level and not all service units have full access to edit and add items to PMIS. IHS’s database is incomplete—at IHS headquarters property officials identified over 500 items during their fiscal year 2008 inventory that need to be added to the PMIS database. This was also the case at one of the field locations where we performed our sample testing; the Aberdeen, South Dakota location has not entered any inventory assets into PMIS since 2007 (about 1,000 items) and stated that they have not been updating any system of record (neither their legacy nor PMIS) since August 2008. Another field location added that they only migrated about 60 percent of their inventory from their legacy system to PMIS. Our testing further verified the incompleteness of IHS’s inventory records identifying nearly half of the items selected at the six field locations as not recorded in PMIS. In addition to ensuring that inventory assets are included in PMIS, a reliable database also should remove from inventory records items that have been disposed of. Our tests showed that at IHS headquarters there was a 63 percent failure rate and the six field locations where we performed testing had an estimated 100 percent failure rate of removing disposed items from property records. We found examples of property items that had been disposed of as far back as 2003 still on the inventory records. IHS property officials said that some of the difficulty in removing the items arises in coordinating with the Program Support Center (PSC) which maintains the PMIS system and reviews and approves items to be removed from the records. Improved communication and procedures are needed to expedite removing disposal items from the inventory records. Because it has not entered all property information into PMIS or removed all assets that have been disposed of, IHS does not have reliable inventory records for management to be able to make sound purchase decisions. Physically securing assets. The IHS Director’s memorandum issued in November of 2008 stated explicitly the responsibility of supervisors and users of equipment to safeguard property from loss and misuse. However, during our inventory tests of IHS headquarters and selected field locations we still identified examples showing that the policy is not enforced. For example, we identified new IT equipment stored in unlocked vacant offices—see figure 1. Physical security weaknesses increase the risk of loss and theft. For example, we identified that a laptop, digital camera, and digital voice recorder, with a total acquisition value of $3,510, were stolen in April 2008 from an office at IHS headquarters. Failure to secure assets also leaves IHS vulnerable to data breaches. For example, in August 2008, a USB stick that contained personally identifiable information on six patients was stolen from IHS’s Phoenix health office. This theft has already been referred to HHS through their breach response process. We also identified a security vulnerability in which the lock for the computer server room in one of the region offices was broken. Rather than repair the door, IHS attempted to restrict access by posting a memorandum on the door—an ineffective means of securing expensive server equipment which could potentially contain sensitive information. See figure 2. A 1997 memorandum issued by the former IHS Director shows that problems related to lost and stolen property have existed at IHS for over 12 years. Although the memorandum indicates that individuals will be held financially liable for missing items, we found no evidence that IHS has ever taken such steps. As a result, property management problems have continued, and IHS property managers are now faced with the large challenge of gaining control under a decentralized and wide-ranging service structure. Although IHS has taken some steps to improve property management since our June 2008 report, our work shows that these steps are incomplete and that serious attention and effort is required to stop the alarming rate of property loss. Ultimately these problems hinder IHS’s mission to deliver health care to American Indians and Alaska Natives. We recommend that the Director of IHS strengthen IHS’s overall control environment and “tone at the top” by fully implementing our prior recommendations and enforcing and updating its property management policies and procedures. As part of this effort, the Director of IHS should direct IHS property officials to take the following six additional actions: Develop and enforce procedures and deadlines to reconcile and update inventory records in a timely manner. Establish specific deadlines and enforce them for finalizing a Report of Survey once an inventory has been completed so that research on missing items is completed expeditiously and does not continue indefinitely. Enforce policy to dispose of unused inventory in a timely manner. Establish an approach to stop loss of property to include addressing region-specific inventory shortages. Work with PSC to develop procedures to remove disposed items from inventory records in a timely manner. Work with PSC to develop procedures to enter overages in PMIS in a timely manner. We provided HHS with a draft of this report for review and comment. The Acting Assistant Secretary for Legislation of HHS provided written comments that are reprinted in appendix II. HHS agreed with all six of our recommendations to strengthen property management at IHS. As part of its response, HHS outlined actions it plans to take or has taken to address current and prior recommendations. The following represents a summary and overall evaluation of the HHS response. We also summarize and evaluate the actions IHS plans to take to address our recommendations. We provide comments on specific sections of the HHS response letter in appendix II. In its response, HHS stated that IHS is committed to proper and accountable property management. According to the response, IHS has spent thousands of hours to respond to our requests and to implement our recommendations. Further, IHS is confident that most, if not all, inventory currently unaccounted for will be identified as a result of the implementation of the PMIS system. HHS also highlighted that training on an agencywide scale has begun on PMIS and that employees are being educated on both the use of this system as well as on agency property policies and guidelines for accountability. A number of actions IHS has taken or plans to take to address our prior recommendations were summarized, including plans to address our current recommendations. We are pleased that IHS has devoted considerable time and resources to fixing its property management system and to respond to our audit requests. However, we are concerned that numerous significant issues raised by our report were not addressed in the response. Specifically, we are concerned that HHS did not acknowledge the rate of property loss at IHS and the continuing lack of employee accountability for millions of dollars of lost and stolen property. The response indicated that the implementation of PMIS will allow IHS to locate the property that it could not find during the 2008 annual inventory, but we note that completing annual physical inventories is key to identifying missing property. Therefore, IHS should focus on addressing our recommendation to reconcile and update inventory records in a timely manner in order to locate missing property. Further, we note that the accuracy of a system is only as good as the data that is put into it, and that our work has found ongoing, significant errors with the completeness and accuracy of the data input into the PMIS system. IHS has been attempting to implement the PMIS system for nearly 2 years, and our work shows that it continues to experience significant problems. While IHS struggles to implement PMIS, property losses continue. Regarding our recommendations, HHS agreed with all six of our new recommendations and cited actions that IHS will take to address them. However, the response to some of our recommendations provided little specificity on actions and timing. Further, for two of our recommendations, the HHS response listed actions with no clear link to our recommendations. GAO Recommendation #1. We recommended that IHS develop and enforce procedures and deadlines to reconcile and update inventory records in a timely manner. This recommendation resulted from our finding that IHS was unable to complete its 2008 inventory due to reconciliation issues and that millions of dollars in missing items cannot be found. To be effective, an annual inventory needs to be resolved quickly. However, the HHS response addressed inventory overages and indicated that policies regarding receiving and inspection, inventory management, reports of survey, and property disposal were “in process.” The link between this response and our recommendation is not clear and the issue of how IHS will hold staff accountable for completing the inventory in a timely manner is unresolved. This is a particularly important issue given that IHS will need to prepare for its 2009 inventory soon. GAO Recommendation #2. We recommended that IHS establish specific deadlines and enforce them for finalizing a Report of Survey once an inventory has been completed. The response to our recommendation indicates that IHS is enhancing the Report of Survey process to include timelines and guidance on Board of Survey requirements, but provides no specific details for when this process will be complete. IHS also does not address how it plans to enforce the new guidelines once they are in place. GAO Recommendation #3. We recommended that IHS enforce the policy to dispose of unused inventory in a timely manner. In response, HHS indicates that IHS has a number of agreements with other agencies to assist it in disposing of property. It also lists several actions it plans to take to address our recommendation, including establishing specific timeframes in a new policy to address timely disposal. HHS indicates that IHS will also “emphasize” a policy to conduct walk-through surveys of IHS facilities and remind staff that proper and adequate justifications must be provided for new acquisitions. Although these actions will help address our recommendation, many of the problems we identified with missing property related to a lack of enforcement of existing disposal policies. The IHS response does not include specific details on enforcement. GAO Recommendation #4. We recommended that IHS establish an approach to stop the loss of property to include addressing region- specific inventory shortages. This recommendation directly resulted from our finding that property loss continued at an alarming rate, and that some regions had substantial numbers of missing property. However, the HHS response did not address property loss and instead addressed the IHS policy for issuing hand receipts. The link between this response and our recommendation is not clear. The issuance of hand receipts is only part of the solution to stopping property loss and addressing region-specific inventory shortages. A more appropriate response would have involved the development of a strategic plan to stop property loss with a focus on specific regions, outlining the specific controls and enforcement procedures that should be put in place. GAO Recommendation #5. We recommended that IHS work with PSC to develop procedures to remove disposed items from inventory records in a timely manner. In response to our recommendation IHS stated that PSC distributed a procedures guide to all PMIS users in March 2009 and that PSC discussed the guide at an April meeting. According to HHS, the guide outlines the specific requirements and forms needed to process all final events in the property management system. These actions are a step forward, but they do not address how disposal will be completed in a timely manner. Further, HHS stated that a revised property disposal policy will also assist IHS property managers; however IHS provides no detail on what the new disposal policy entails, how it will improve inventory records, or when this policy will be updated. GAO Recommendation #6. We recommended that IHS work with PSC to develop procedures to enter overages in PMIS in a timely manner. In their response, HHS stated that the new Purchase Order interface between the Unified Financial Management System and the PMIS will reduce the number of inventory overages that are currently being recorded. In addition, the response stated that IHS can utilize the PSC on a fee basis to add their overages to PMIS. We agree that this new process is likely to help decrease the number of future overages needing to be recorded. However, IHS must still work with PSC to ensure that all current overages are added to PMIS in a timely manner. If you or your staffs have any questions concerning this report, please contact Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. To determine whether property loss, property theft, and wasteful spending continues at the Indian Health Service (IHS) and to what extent IHS made progress in implementing our prior recommendations, we analyzed IHS documents that identified lost or stolen property from fiscal year 2008 through January 2009, reviewed IHS and Department of Health & Human Services (HHS) responses to our recommendations and updated policies and procedures, conducted a full physical inventory of property at IHS headquarters, and statistically tested information technology (IT) equipment inventory at six selected IHS field locations. To identify specific cases of lack of accountability, lost or stolen property, and wasteful spending, we analyzed IHS documents and made observations during our physical inventory and statistical tests. We evaluated IHS’s progress in implementing our previously reported recommendations by reviewing agency documentation and interviewing property management officials on actions taken in response to recommendations in our June 2008 report. To identify management actions taken in response to previously identified control weaknesses, we obtained and reviewed copies of new and revised IHS and HHS policies and procedures. We reviewed training certificates and property custodial designations, and randomly selected and tested for hand receipts on a limited number of assets at both IHS headquarters and some of the selected field locations. To determine if IHS physical inventory testing identified continuing weaknesses in property management, we obtained and reviewed information on IHS physical inventory results from all IHS headquarters, National Programs, and 12 IHS regions. We also performed a full physical inventory at IHS where we identified problems disclosed in our June 2008 report. Specifically, we tested all 1,518 headquarters property items—largely these items were IT equipment that IHS had recorded in its property records as of December 5, 2008. We physically observed each item and its related IHS-issued bar code and verified that the serial number related to the bar code was consistent with IHS property records. In addition, we selected a nonrepresentative sample of new purchases made in fiscal year 2008 for testing at IHS headquarters from documents provided by an IHS vendor and IHS officials. We tested each sample item by either (1) physically observing the asset or (2) obtaining a picture of the asset with a visible bar code and serial number. Although IHS property at the field locations includes inventory items such as medical equipment and heavy machinery, we performed a statistical test of only IT equipment inventory at six IHS field locations. We limited our scope to testing only IT equipment items that are highly pilferable or can be easily converted to personal use such as laptops, desktop computers, digital cameras and personal data assistants. We selected the six field locations based on the book value of inventory and geographic proximity to other testing locations. We retested five sites that we sampled last year and added the Aberdeen, South Dakota location because of the high dollar value of assets. Our findings at these six locations can not be generalized to IHS’s other locations. To estimate the extent of lost or stolen property at these six locations, we selected a simple random sample of 250 items from a population of 6,085 IT items valued at over $19 million. Because we followed a probability procedure based on random selections with each item having an equal chance of being selected, our sample is only one of a large number of samples that we might have drawn. Because each sample could have provided different estimates, we express our confidence in the precision of our particular sample’s results as a 95 percent confidence interval. This is the interval that would contain the actual population value for 95 percent of the samples we could have drawn. As a result, we are 95 percent confident that each of the confidence intervals in this report will include the true values in the study population. Based on this sample, we estimate the percentage missing or with other errors, the number of and the dollar amount of lost, stolen, or unaccounted for property for these six IHS locations. The following table summarizes the estimates used in this report along with their corresponding 95 percent confidence intervals. We considered equipment to be lost, stolen, or unaccounted for if (1) we could not physically observe the item during the inventory; (2) IHS could not provide us with a picture of the item, with a visible bar code and serial number, within 1 week of our initial request; or (3) IHS could not provide us with adequate documentation to support the disposal of the equipment. To evaluate IHS’s progress in implementing GAO’s recommendation that IHS maintain information on users of accountable property including their building and room numbers, we tested each asset for user and location accuracy for IHS headquarters and the random sample testing at the six field locations. Once an item was determined to exist in current inventory, we assessed whether the asset’s principal user and physical location matched what was recorded in the inventory property database. We also tested the inventory status accuracy in IHS’s property database. If adequate disposal documentation was provided for an asset, the asset was identified as an Inventory Status Error rather than missing. We performed appropriate data reliability procedures for our physical inventory testing at IHS headquarters and sample testing at the six field locations including (1) testing the existence of items in the database by observing physical existence of all items at the IHS headquarters and IT equipment selected in our sample; (2) testing the accuracy of the database by comparing user, location and inventory status; and (3) testing the completeness of the database by performing a 100 percent floor-to-book inventory at IHS headquarters and judgmentally selecting up to two items in the same or adjacent rooms of the randomly selected items tested for existence to determine if these items were maintained in IHS inventory records. Although our testing of the existence, accuracy, and completeness of IHS property records determined that IHS inventory records are neither accurate nor complete, we determined that the data were sufficient to perform these tests and project our results to the population of IT equipment. In addition, we interviewed IHS agency officials, property management staff, and other IHS employees. We also interviewed officials at the Program Support Center (PSC) and individuals from the HHS Office of Inspector General. Although we did not perform a systematic review of IHS internal controls, we identified key causes of lost and stolen property and wasteful spending at IHS by examining IHS and HHS policies and procedures, conducting interviews with IHS officials and our observations of property through our inventory testing. We conducted this forensic audit from October 2008 through March 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Our comments on the Department of Health & Human Services (HHS) letter dated May 1, 2009, follow. 1. Time spent responding to GAO requests and recommendations. In its response, HHS emphasizes a commitment to proper and accountable property management and stresses that IHS has spent thousands of hours responding to GAO requests and recommendations. We are pleased to see that IHS has begun devoting resources to addressing the chronic issue of lost and stolen property. As we reported in June of 2008, IHS property management problems date back to at least 1997. Given the chronic nature of the problem, IHS should be prepared to spend additional hours in the future, and should dedicate resources to enforcement and compliance when, and if, the significant challenges it faces have been resolved. 2. PMIS. In its response, IHS states that it is confident that implementation of its new property management system will eliminate “most, if not all, inventory currently unaccounted for.” This widespread property management problem will not simply be resolved as a result of implementing a new system. IHS must actively manage its property and enforce existing HHS property management policies, to include annual inventories, the issuance of hand receipts, physical security measures, and, critically, a commitment to holding IHS employees accountable for lost or stolen property. 3. Referrals from Prior Report. In our first report, we found evidence that an IHS property employee had fabricated documents and that a “yard sale” of IHS equipment had occurred in Nevada. We referred these incidents to the HHS Office of Inspector General (OIG) for further investigation. In its response to this report, HHS indicated that the OIG had concluded an investigation and that referrals of charges against IHS employees for fabrication of documents and a yard sale could not be substantiated. Concerning the allegations of fabricated documents, the OIG presented the case to the United States Attorney’s Office (USAO) for the District of Maryland—Southern District. Based on the lack of evidence, a criminal prosecution was declined by the USAO. We reported on this incident because an IHS property official admitted to GAO to fabricating documents in order to satisfy our request for the disposition of property. Concerning the yard sale, the OIG reported that no criminal activity was found to have occurred. We reported on this “yard sale” based on the confirmation of eight IHS property officials, including the Phoenix Area executive officer. Although criminal charges could not be substantiated in these cases, we believe that administrative action could still be warranted. We believe these cases are important because they represent opportunities for IHS to improve accountability for property management. 4. Physical Inventory. IHS stated that it completed an “agencywide 100 percent physical inventory.” We are pleased that IHS has conducted inventories at all locations as of the end of fiscal year 2008. However, conducting and completing inventories are separate matters. Specifically, reconciliation of missing items, to include the use of reports of survey to hold employees accountable for missing property, is the final step in completing an annual inventory. As of April 2009, IHS had not completed the reconciliation process. 5. Hand Receipts. We found that IHS had not fully implemented the use of hand receipts agencywide. In its response, IHS attributes this to the fact that it has issued a new policy and given Area Directors until September 2009 to have the policy fully implemented. Further, IHS mentions that “performance will be monitored in FY 2009.” The proper use and enforcement of hand receipts is a critical issue for IHS and it remains to be seen whether IHS will effectively manage its hand receipt program. 6. Determination of Lost, Stolen or Unaccounted For Property. We provided IHS with three options for proving that property was not lost, stolen, or otherwise unaccounted for during our field tests; these options were (1) direct physical observation; (2) for items not readily available for inspection, photographs with a visible bar code and serial number, to be provided within 1 week; and (3) for items represented as being disposed of, supporting documentation (e.g., disposal records). In response to our draft, HHS stated that these options were not sufficient because, “in many cases these items are temporarily unavailable to be inspected… because they are in use by employees who are out in the field.” We understand that IHS is a decentralized organization with numerous field locations. We believe that we provided a reasonable amount of time for a federal agency such as IHS to locate the items we selected, given its access to digital photography, mobile phones, and the Internet. The fact that IHS was unable to readily identify and provide support for the location of numerous items during our audit is consistent with the results of its 2008 annual inventory. 7. Physical Security of Property. We have identified physical security of property as an ongoing issue for IHS. We disagree with the statement that “IHS continues to safeguard all property.” We understand that property security was addressed in a memorandum from the IHS Director in November 2008, but without an enforcement mechanism to ensure that a policy or procedure is implemented and operating effectively, IHS has no assurance that it is safeguarding property effectively. Further, we did not systematically evaluate perimeter security, but we found examples where a lack of perimeter security facilitated a loss of property. For example, one Report of Survey indicated a trailer with an acquisition value of $7,300 was stolen from a Nashville Region Office parking lot when the security gates were broken and remained open. In another Report of Survey, a laptop was stolen from an employee’s workstation in Portland. The workstation was accessible to the public and was not secured. Further, we identified additional examples of unsecured equipment including an unsecured server room at one IHS area office. 8. Status of Prior Year Recommendations. In its response, HHS includes a table showing the status of progress made in implementing our prior year recommendations. However, the findings in our report contradict some of the statements made in this table: Regarding our recommendation to designate property custodial officers in writing, IHS states that “property custodial officers are designated by each Area Property Management Officer.” Designating property custodial officers in writing is important because it establishes clear responsibility and accountability for property. However, as discussed previously, we found that IHS designated property custodial officers in writing for some of the regions but there were still gaps of written designations at IHS headquarters and at 4 of the 12 regions. This creates uncertainty over property management responsibilities and fosters a lack of accountability at IHS headquarters and the 4 regions. Regarding our recommendation to enforce barcoding of accountable property, IHS states that all accountable and sensitive property items were reviewed and barcode tags affixed as part of the 2008 inventory. However, our inventory testing identified over 50 accountable items with no barcode at IHS headquarters. These tests began 2 months after the IHS 2008 annual inventory, indicating that IHS still faces challenges ensuring that all accountable property is affixed with barcodes. Regarding our prior recommendation to maintain information on the users of all accountable property, IHS states that it reviewed this information during the 2008 annual inventory and that “this is an ongoing process.” However, as previously discussed, we tested inventory at IHS headquarters and found user and location errors of 21 percent and 28 percent, respectively. These errors were much higher at the tested field locations, where we found errors of 87 and 89 percent, respectively. These tests were performed 2 months after the IHS annual inventory, indicating that IHS still faces significant challenges in keeping PMIS accurate. Regarding the comment that “this is an ongoing process,” we agree; for as long as IHS continues to purchase property, enter it into PMIS, and assign it to staff, property managers must remain vigilant to ensure that records are accurate. In addition to the contact named above, Cindy Brown Barnes, Assistant Director; John Ahern, Donald Brown, Arturo Cornejo, Jennifer Costello, Paul Desaulniers, Dennis Fauber, Heather Hill, Christopher Howard, Elizabeth Isom, Leslie Kirsch, Barbara Lewis, Andrew McIntosh, Sandra Moore, James Murphy, Andy O’Connell, George Ogilvie, Lerone Reid, Phil Reiff, Verginie Tarpinian, and Emily Wold made key contributions to this report.

Summary: In 2008, GAO issued a report and testimony revealing gross mismanagement of property at the Indian Health Service (IHS). GAO found that 5,000 items with an acquisition value of $15.8 million were reported lost or stolen for fiscal years 2004 through 2007. GAO attributed the property mismanagement and waste to weak internal controls. GAO made 10 recommendations to IHS. IHS ultimately agreed to implement all 10 recommendations. Given the extent and seriousness of the property management problems at IHS, GAO was asked to determine (1) whether property loss, property theft, and wasteful spending continue at IHS; and (2) to what extent IHS made progress in implementing GAO's prior recommendations. GAO analyzed IHS property records from fiscal year 2008 through January 2009, conducted a full physical inventory at IHS headquarters, and performed a probability sample of information technology equipment inventory at six IHS field locations. GAO also examined IHS policies, analyzed documents, and conducted interviews with IHS officials. IHS continues to lose property at an alarming rate, reporting lost or stolen property with an acquisition value of about $3.5 million dollars in little over a year, including new medical equipment. IHS management's failure to implement most of our June 2008 recommendations and hold staff accountable for losses contributes significantly to ongoing property problems. These property losses at IHS are in addition to what GAO identified in its June 2008 report. GAO completed a full audit of IHS headquarters and found that 126 items worth $216,000 (or 8 percent of the items tested) had been lost, stolen, or were otherwise unaccounted for. GAO also estimates that about 800 equipment items at six field locations with an acquisition value of about $1.7 million were lost, stolen, or unaccounted for. Furthermore, although IHS performed an annual inventory as GAO recommended, as of March 2009, it had not finished reconciling the inventory and cannot locate many items, including medical equipment. These items include a 2002 ultrasound unit valued at $170,000; a 2003 X-ray mammography machine valued at $100,795; dental chairs, cardiac and vital sign monitors; and a pharmacy tablet counter machine. Aside from issuing a memorandum from the IHS Director that restated and refined existing policies, IHS has taken little action to ensure that employees are aware of and complying with property policies. One way to enforce policies involves holding individuals accountable; however, GAO found that the Senior Service Executive in charge of the IHS property group and other areas was given a $13,000 bonus after GAO's report exposed mismanagement of property under the executive's purview. Furthermore, IHS could only provide one example of an individual held financially liable for lost or stolen property over a 1-year period; but at the time of our audit, the individual still had not reimbursed the government for the loss. GAO also identified the following examples where IHS investigated the loss of property but did not hold anyone accountable.