In May 2001, the FBI initiated a major IT upgrade project known as Trilogy. Trilogy consisted of three parts: (1) the Information Presentation Component (IPC) to upgrade FBI’s computer hardware and software, (2) the Transportation Network Component (TNC) to upgrade the FBI’s communication network, and (3) the User Application Component (UAC) to upgrade and consolidate the FBI’s five most important investigative applications. The IPC component provided for new desktop computers, servers, and commercial-off-the-shelf automation software, including Web-browser and e-mail software to enhance usability by the agents. The TNC component called for upgrading the complete communication infrastructure. These upgrades were expected to provide the physical infrastructure that would run the applications that were to be developed under the UAC component of the Trilogy project to replace the FBI’s paper case files with electronic files and improve efficiency and replace the obsolete Automated Case Support system, the FBI’s primary investigative application that uploads and stores case files electronically. Our 2006 audit of the project’s costs identified significant internal control deficiencies over administration of contracts and interagency agreements, the processing (review, approval, and payment) of invoices, and the accountability over assets purchased under the project. More specifically, we reported that the FBI’s review and approval process for contractor invoices did not provide an adequate basis for verifying that goods and services billed were actually received by the FBI or that payments were for allowable costs. This occurred in part because responsibility for the review and approval of invoices was not clearly defined in the interagency agreements related to the Trilogy project and because contractors’ invoices frequently lacked the detailed supporting documentation necessary for an adequate review of invoice charges. During our audit, we identified more than $10 million in questionable contractor costs paid by the FBI for the Trilogy project. With respect to property, we reported that the FBI: (1) did not adequately maintain accountability for purchased computer equipment; (2) relied extensively on contractors to account for Trilogy assets while they were being purchased, warehoused, and installed; (3) did not establish controls to verify the accuracy and completeness of contractors’ records on which the FBI was relying; (4) did not ensure that only the items approved for purchase were acquired by the contractors, and that the bureau received all those items; and (5) did not establish adequate physical control over the assets. As a result of these deficiencies, we identified more than 1,200 pieces of missing equipment that we estimated to be worth more than $7.5 million. We made 22 recommendations to the FBI in our 2006 report on Trilogy. Of the 22 recommendations, 17 were focused on developing agencywide policies and procedures to address internal control weaknesses in the FBI’s procurement and contract administration processes. The remaining five recommendations were specific to the Trilogy project and were related to contractor overpayments and accountable property. The FBI discontinued the virtual case file component of its Trilogy project in March 2005, after it was determined to be infeasible and cost prohibitive to implement as originally envisioned. FBI’s Sentinel project was approved in July 2005 and was to succeed and expand on elements of the Trilogy project, namely to provide the FBI with a modern, automated investigative case-management system. The Sentinel project management office (PMO) had designed and implemented policies and procedures that assigned specific invoice-review responsibilities and required Sentinel contractors to provide detailed support for all invoiced amounts and to obtain advance approval from the Sentinel PMO for travel, overtime, and other direct costs. With respect to Sentinel equipment, we reported that the Sentinel PMO had established policies and procedures specific to the Sentinel project to ensure Sentinel’s equipment purchases were properly authorized and that received property was timely inspected and entered into the FBI’s Property Management Application (PMA). However, we did identify some additional opportunities for the Sentinel PMO to improve controls over purchased equipment for the Sentinel project. We made five recommendations to the FBI related to Sentinel. The corrective actions developed by the FBI were sufficient to address 21 of the 22 Trilogy recommendations and all 5 of the Sentinel recommendations we made in our prior reports. The FBI substantially addressed 17 Trilogy recommendations related to contract administration, invoice processing, and property accountability by establishing or revising policies and procedures, 4 by contracting for follow-up audits of the Trilogy costs, and the 5 Sentinel recommendations by revising Sentinel policies and procedures. Of the 27 prior recommendations, 17 focused on establishing, revising, or reinforcing policies and procedures with FBI- wide applicability. We found that the FBI had sufficiently developed, revised, or updated these policies and procedures as we recommended. For example, in response to our recommendation that the FBI revise its policies and procedures to require that accountable assets be entered into PMA immediately upon receipt rather than within the prior 30-day time frame, the FBI issued a new policy that required that accountable property be recorded in PMA within 48 hours of being received. Appendix II provides information on each of the 27 Trilogy and Sentinel recommendations and the specific corrective actions developed by the FBI. We also made four recommendations in our Trilogy report related to the recovery of overpayments and reimbursement of questionable costs from Trilogy contractors. In response to these recommendations, the Defense Contract Audit Agency (DCAA), an independent third party, was engaged to perform post audit reviews of contractor billings for the Trilogy project. DCAA conducted separate audits of the billings submitted by the two prime contractors, Computer Sciences Corporation (CSC) and Science Applications International Corporation (SAIC), as well as the billings submitted by the numerous subcontractors, and identified over $18 million in questioned costs. DCAA defines questioned costs as those costs that are not acceptable for negotiating a fair and reasonable contract price. DCAA’s audits included reviewing the areas with potential overpayments we had identified as well as assessing if other identified questionable costs should be reimbursed. The most significant questioned costs were costs incurred outside the effective dates of temporary labor agreements, missing supporting documentation, application of incorrect billing rates, unapproved timesheets, unapproved overtime, and subcontractor overbillings. The one recommendation that the FBI had not fully addressed from our Trilogy report recommended that the FBI investigate the 1,205 assets that we identified as missing, lost, or stolen and determine whether any confidential or sensitive information may be exposed to unauthorized users, and identify any patterns related to the equipment that could necessitate a change in FBI policies and procedures. These assets consisted of a variety of information technology items, including desktop computers, servers, and laptops that could potentially contain confidential or sensitive information that could be exposed to unauthorized users. In February 2011, FBI officials provided documentation accounting for the status of all but 134 assets, including desktop computers, laptops, and servers that could contain sensitive information. With regard to the 134 assets, the FBI stated that all of these assets had a useful life of 7 years or less and that if they were not already returned or destroyed, they are now obsolete and that spending more time or resources to search for the obsolete equipment would be wasteful. Instead the FBI is focused on implementing a new property management system, and incorporating property management lessons learned from the Trilogy project. However, FBI officials also stated they would make the necessary entries to properly record any of the remaining 134 assets for which they subsequently determine the status. Although the FBI developed or revised policies and procedures in response to 17 of our prior recommendations, our testing to assess their implementation FBI-wide identified possible issues in certain areas. In our testing of the four recommendations dealing with interagency agreements and contracts, we found that they were effectively implemented, but we identified a new issue unrelated to our prior recommendations. In our implementation testing for the remaining 13 corrective actions, we identified indications of implementation issues for 3 of them. As shown in table 1, our tests related to policies and procedures over interagency agreements and contracts indicated that the FBI had effectively implemented these corrective actions. In the course of testing the interagency agreement sample transactions, we identified a new issue unrelated to our prior recommendations. Specifically, the Federal Acquisition Regulation (FAR) requires that any interagency agreement entered into under the authority of the Economy Act, 31 U.S.C. § 1535, be supported by a Determination and Findings document. The Determination and Findings form identifies the responsible agencies to the agreement (requesting agency and servicing agency), is prepared by the requesting agency, and identifies the goods or services that are to be provided by the servicing agency. In addition, it documents the requesting agency’s determination that, among other things, the use of an interagency acquisition is in the best interest of the government, and the supplies or services cannot be obtained as conveniently or economically by contracting directly with a private source. The FAR also requires that the requesting agency complete the Determination and Findings form before placing an order for supplies or services with another government agency. In reviewing our statistical sample of 55 interagency agreements with regard to implementation of our prior recommendations, we identified 54 interagency agreements that were required to comply with FAR requirements related to Determination and Findings and found that 15 of them did not comply with these FAR requirements. For these 15 cases, the required Determination and Findings forms supporting the execution of interagency agreements between the FBI and other federal entities were prepared and signed after the interagency agreements were executed—in some cases more than a year later.  Three Determination and Findings forms were signed less than 3 months after the date of the related purchase orders were issued.  One Determination and Findings form was signed between 3 months and 6 months after the date of the related purchase order was issued.  Seven Determination and Findings forms were signed between 6 months and 1 year later.  Four Determination and Findings forms were signed more than a year after the date of the related purchase orders. Based on the results of our review, we are 95 percent confident that the total percentage of interagency agreements executed by the FBI in fiscal year 2009 that lacked a required Determination and Findings form prior to the FBI placing the order could be as much as 39.5 percent. FBI officials acknowledged that the Determination and Findings forms were not completed prior to placing orders for goods and services and provided two explanations. The interagency agreements and related documentation for some of them were executed by a new employee who was instructed to prepare and include the Determination and Findings forms after the files had been reviewed by the Unit Chief, and a contracting officer did not prepare and submit the interagency agreement documentation to the Unit Chief in a timely manner for the others. The FBI’s monitoring of the interagency agreement process did not identify that the Determination and Findings forms were not properly prepared as required. Internal controls should be designed to assure that ongoing monitoring occurs in the course of normal operations. By not completing a required Determination and Findings form prior to issuing a purchase order, obligating the agency for the purchase order amount, the requesting agency risks obligating funds for supplies and services or both that are not in the best interest of the government, and executing a contract that is not in compliance with federal laws or regulations. Of the remaining 13 corrective actions that involved the implementation of FBI-wide policies and procedures, our testing found indications that 3 of them may not have been fully or consistently implemented. As shown in table 2, our tests of non-statistically selected transactions identified implementation issues primarily in policies and procedures related to review of contractor invoices and accountability for purchased assets. As shown in table 2, our detailed testing found instances in which the FBI had not fully implemented the policies and procedures established in response to our prior recommendations in this area. Internal control standards require agencies to establish controls that reasonably ensure, among other things, that funds, property, and other assets are safeguarded against waste, loss, or unauthorized use. The FBI requires contractors bidding on contracts to submit proposals that include direct labor categories and rates, subcontractor labor categories and rates, and other direct costs used to calculate the total cost of their proposal. Contractor invoices must include key information such as employee name, labor classification, rate of pay, hours worked for billed labor charges and support for other charges. FBI guidance states that staff performing invoice reviews should compare the key data to the contractor proposal to verify the accuracy of amounts charged. During our review of a non-statistical sample of 37 contractor invoices, we found unsupported charges of $292,684 on five invoices submitted by three contractors for three separate contracts that totaled $6,293,046 for prime contractor and subcontractor direct labor, materials, and other direct costs. Specifically, these totals include:  We reviewed an invoice, dated October 5, 2009, submitted by one contractor that included direct labor charges of $16,963 for one labor group that was not included in the contractor’s cost proposal. The FBI acknowledged that the labor group was not listed in the original proposal by the contractor but stated that during the course of the contractual effort, the contractor determined there was a need for labor to be performed on the contract that required the skill set of a labor group that had not been included in the contractor’s cost proposal. In addition, the FBI stated that the rate charged resulted in a savings to the FBI under this contract without affecting the contract schedule or deliverables. However, the FBI did not provide us with documentation supporting the FBI’s approval of the new labor rate for the contract prior to the period billed on the invoice. In addition, the invoice included $50,000 for the work of a subcontractor. In our review of the contractor’s proposal related to subcontractor labor, we noted that it included, for this specific subcontractor, a proposed labor rate of $184.84 for 610 hours for a total of $112,752. However, the invoice documentation did not include any information such as the name of the subcontractor employee(s), the labor category, the hours worked, or the rate of pay under other direct costs that would allow the FBI to verify the accuracy and validity of the charges. In our review of two invoices submitted by another contractor, we found that the contractor had billed the FBI $97,851 for direct labor and subcontractor labor at rates, six for the contractor and three for a subcontractor, which were not included in the contractor’s proposal.  Similarly, in our review of two invoices submitted by a contractor for a third contract we found that they included labor charges of $127,870 at hourly labor rates, for four contractors and two subcontractors, which were not supported by the contractor’s proposal. We also discussed our findings related to the second and third contractor’s invoices with FBI officials, and they explained that in reviewing the invoices they focus on the status of the project and its various components or tasks. They also stated that both contractors submitted monthly reports to the FBI that included the actual costs of the project for each current month as well as the costs of the project to date and compared the costs to project’s budget. However, the FBI also stated that it did not require the contractors to provide analyses for cost variances except when variances exceed thresholds set for the two contracts. Without verifying labor groups and labor rates billed on contractor invoices against the contractor’s proposal as required by FBI policy, the FBI is at increased risk that it will not identify erroneous or improper billings and will disburse government funds for unallowable contractor charges. As shown in table 2, we also found instances in which the FBI did not record accountable property items in its system in a timely manner and did not accurately record key accountability information such as location and serial numbers as required by the FBI’s policies and procedures.  The FBI’s revised policy, which is in response to our prior recommendation, requires that accountable property be recorded into the Property Management Application (PMA) within 48 hours of receipt instead of within 30 days of receipt, which was the FBI’s policy at the time our 2006 report. Internal control standards require agencies to establish controls that reasonably ensure, among other things, that funds, property, and other assets are safeguarded against waste, loss, or unauthorized use. In our review, we found 406 pieces of accountable property out of the 674 we tested had not been recorded in PMA within 48 hours of being received as now required and that some had not been recorded until more than a month after being received. However, we also noted that the FBI, while not adhering to its more stringent current policy, had recorded 90.7 percent of the accountable property we tested within 30 days of receipt. This represents an improvement from the situation that existed at the time of our Trilogy work. During its agencywide upgrade of hardware and software under the Trilogy project, the FBI only recorded 28.4 percent of accountable property that we reviewed, within 30 days of receipt, as reported in our 2006 report. FBI management acknowledged that property was not being recorded in compliance with its policy. FBI management officials explained that this condition was due to property being ordered and received by numerous FBI divisions and field offices and that some of these divisions and field offices, did not have dedicated staff for recording purchased assets in PMA immediately upon receipt of the property. This situation serves to delay the recording of the assets in PMA. In addition, they explained that some accountable property ordered by the various FBI offices is delivered to FBI storage facilities and held for security reasons before being delivered to the end user and that these properties are not recorded in PMA until received by the end user. Recording of property in PMA is critical in establishing accountability. The longer it takes to record property in PMA, the greater the risk that property may be stolen or lost without detection by the FBI. In 2006, the FBI issued a policy to all FBI divisions that made recording the location field when accountable property is added to PMA or when corrections to records are made, mandatory. In addition, the policy stated that the information recorded in the location data field is the location of the property within the division or “legat.” In reviewing the data entry screens for recording assets in the FBI’s property management application we noted that there are fields that can be utilized by the property custodian to provide a location within the division or legat. In our review of the PMA screens for the selected property items we found that the information recorded in PMA for 80 of the 674 records did not provide sufficient information on the location of the property within the division as required. In addition, we found that the serial number field was either blank, incomplete, or had the entry “719TOBEADDED” in the PMA records for 14 of the 674 tested assets. In addition, the five records that had “719TOBEADDED” recorded, had not been updated for more than a year. We also found 45 PMA records in which the model description was entered as “TO BE ADDED.” The model description was missing for all 45 assets for more than a year, with 6 of these assets lacking this information for almost 2 years since they were first entered in PMA. We brought these findings above to the attention of FBI officials. With regard to the location information, the FBI stated that while the location field is mandatory, there is no requirement on the amount of detail to be listed. However, as mentioned previously, the 2006 policy issued by the Asset Management Unit clearly states that the information recorded in the location data field is the location of the property within the division or legat. The lack of key information such as model, manufacturer, description, serial number, and specific location information in PMA as required by FBI policy would limit its ability to investigate assets reported as missing during physical inventories. In addition, inadequate location information results in the lack of a systematic means of identifying where an asset is located or when it is moved, transferred, or disposed of. The FBI has taken action to address 26 of the 27 recommendations we made in our prior Trilogy and Sentinel reports. Many of these actions involved developing policies and procedures. Developing and communicating policies and procedures, while critical, is only the first step that the FBI must take to address the identified internal control weaknesses. Management must also ensure that the policies and procedures are effectively implemented throughout the agency. Although we found that the FBI had effectively implemented policies and procedures related to interagency agreements and contracts, our tests on the statistical selected transactions showed that additional action is needed to ensure that Determination and Findings forms are properly completed before the FBI enters into interagency agreements. With an estimated 40 percent of its interagency agreements lacking a properly completed Determination and Findings form, the FBI increases the risk that it is obligating funds for supplies and/or services that are not in the best interest of the government or executing a contract that is inconsistent with federal laws or regulations. Further, we identified several other areas where the implementation of policies and procedures, primarily related to review of contractor invoices and accountability for purchased assets, may need to be strengthened. Our testing of selected invoice transactions identified unsupported labor categories and rates billed by contractors. This situation points to a lack of thorough review of contractor invoices. This weakness puts the FBI at risk of making payments to contractors for questionable or improper charges. Additionally, our testing of selected accountable property items identified property items that were not timely or accurately recorded. This problem decreases the FBI’s ability to adequately safeguard its accountable property. Identifying and correcting any systemic weaknesses in these areas will be critical to achieving sustainable improvements in the FBI’s agencywide controls over its procurement activities. We recommend that the Director of the FBI direct the Chief Financial Officer take the following three actions.  Enhance the monitoring of the interagency agreements process to ensure that Determination and Findings forms are prepared, when applicable, in accordance with federal and agency requirements. In the area of contractor invoice review and approval, we recommend the Director of the FBI to direct the Chief Financial Officer to:  review agencywide implementation of the new or revised policies and procedures related to our prior recommendations to verify that invoice costs are in accordance with contract terms to determine if the indications of issues we identified in this report represent systemic, agencywide implementation deficiencies, and take appropriate, cost-effective actions to better ensure agencywide compliance with the applicable policies and procedures. In the area of property accountability, we recommend the Chief Financial Officer be directed to: review agencywide implementation of the new or revised policies and procedures related to our prior recommendations to record specific data for acquired assets within specified time frames to determine if indications of issues we identified in this report represent systemic, agencywide implementation deficiencies, and take appropriate, cost-effective actions to better ensure agencywide compliance with the applicable policies and procedures. In its written comments, FBI concurred with our recommendations and stated that it has already initiated changes to its processes and procedures to address our recommendations. FBI stated that it provided interagency agreement training to its contract specialists and is now testing an application to monitor, collect, and document information for all FBI interagency agreements. The FBI further stated that it is taking steps to ensure that invoices are properly reviewed, including strengthening its procurement training curriculum and modifying the current contract specialist file review checklist to include comparing invoiced labor categories and costs to labor categories and costs in supporting contracts. Additionally, the FBI stated that it has developed an accountable property officer training course intended to help ensure that its divisions have an effective and efficient property management program, and that actions are under way to configure a new property management application to include additional controls to better track physical location of purchased assets. If properly implemented, the activities outlined in FBI’s letter should help further improve FBI’s accountability for future interagency acquisitions and accountable property. FBI’s comments are reprinted in their entirety in appendix III. FBI also provided technical comments, which we have incorporated as appropriate. As we agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days from the report date. At that time, we will send copies to interested congressional committees. We will also send copies to the Attorney General, the Director of the Federal Bureau of Investigation, and other interested parties. The report will also be available at no charge on GAO’s Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9471 or franzelj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. To address our first objective to determine whether the FBI’s new or revised policies and procedures and other specific corrective actions were sufficient to address the 27 recommendations we made in our Trilogy and Sentinel reports, we performed an assessment of the FBI’s corrective action plans and reviewed additional supporting documentations received from the FBI. Specifically, in its required 60-day letter to Congress, the FBI explained the corrective actions it had taken or planned to take to address the issues we identified in our report. In addition, in mid-2006, the FBI submitted additional documentation to GAO which included revised or updated corrective action plans for each recommendation. Also, in the third quarter of 2009, the FBI submitted additional documentation to GAO for selected recommendations to support additional corrective action steps taken since 2006. We also identified key operations and management officials at the FBI responsible for the development of the corrective actions and conducted interviews and walk- throughs to ensure that we fully understood the corrective actions. We reviewed additional information and documentation identified during our interviews, as well as new and revised policies and procedures and training materials received from the FBI, and utilized this information to make a determination of whether the corrective actions were adequately designed to address our recommendations. To address our second objective to determine whether there were any indications of implementation issues related to the policies and procedures that the FBI developed to address 17 of the 27 recommendations, we selected statistical samples of interagency agreements and contracts. We then non-statistically selected purchase orders, invoices, and accountable property from the contracts selected in the statistical samples and performed a variety of detailed tests. In our review of the FBI’s corrective action plans, we determined that the agency had continued to take corrective actions to address our recommendations through fiscal year 2008. Therefore, in order to obtain a more representative population of transactions that had occurred after the last corrective actions had been put in place, we decided to select statistical samples from a population of transactions that occurred in fiscal year 2009. Because we selected statistical samples for testing implementation of certain new or revised policies and procedures, we assessed the reliability of the FBI’s contracting, interagency-agreement, and property- data files by first identifying and documenting the controls in place at the FBI for ensuring accurate and complete data is recorded into information systems during the FBI’s contracting, interagency-agreement, and property-acquisition processes and then assessing whether these controls appeared adequate. We inquired about the processes by which interagency agreements, contracts, and purchase orders are completed and recorded and developed an understanding of the controls designed to ensure data entered into FMS for interagency agreements and contracts is accurate and complete. In addition, we reviewed DOJ’s annual financial statement internal control reports for fiscal years 2007, 2008, and 2009 to identify any material weaknesses or reportable conditions related to the information systems identified in the step above. We also analyzed data listings to identify any anomalies in the data fields such as blank cells or inconsistent naming conventions for contracts and interagency agreements and obtained explanations for any anomalies noted. Based on these steps, we determined the FBI’s contract, interagency-agreement, and property-data files were sufficiently reliable to address the objectives of this report. We selected a statistical sample of 55 interagency agreements from a total population of 494 interagency agreements executed by the FBI during fiscal year 2009. In our testing of interagency agreements, we verified that all agreements clearly defined the roles and responsibilities relative to contract administration including invoice submission for both parties. During our testing, we also considered new guidance on interagency agreements issued by the Office of Management and Budget’s (OMB) Office of Federal Procurement Policy that the FBI disseminated to all of its procurement chiefs. We selected a statistical sample of 32 contracts from a population of 51 contracts executed in fiscal year 2009. In addition, for each of the 32 contracts in the sample, we selected all related purchase orders for testing. The total number of purchase orders selected for testing was 34. Our contract and purchase-order testing consisted of determining whether the contracts and/or purchase orders (1) clearly specified key cost determination provisions; (2) clearly reflected the appropriate Federal Acquisition Regulation travel cost requirements; and (3) contained provisions regarding the contractor’s review of subcontractor charges. In addition, for purchase orders only, we determined whether the purchase orders were sufficiently detailed to verify the receipt of property and other goods and services. We obtained a listing of all invoices that had been submitted to the FBI for the purchase orders we selected noting that invoices had not yet been submitted to FBI for 7 of the 34 purchase orders. A total of 110 invoices had been submitted for the other 27 purchase orders we selected—one invoice each had been submitted for 16 of the purchase orders, two invoices each for 3 of the purchase orders, and three or more invoices had been submitted for the remaining 8 purchase orders. In selecting invoices for testing, we selected all invoices for those purchase orders that only had either one or two invoices. For each of the 8 purchase orders with three or more invoices, we selected the invoice with the highest dollar value for testing and one other invoice on a non-judgmental basis. The total number of invoices selected for testing was 37. Our invoice testing consisted of determining whether the contractor’s invoice and supporting documentation (1) provided evidence of the FBI review and approval of the charges by the parties designated in the contract; (2) included evidence that goods and services billed on the invoice were received; (3) provided sufficient information to support the charges; (4) included amounts that were appropriate and in accordance with contract terms; and (5) provided evidence that the FBI properly documented the resolution of invoice discrepancies. We also asked the FBI to provide a listing of all accountable property included in its Property Management Application (PMA) for each of the 34 purchase orders we reviewed. According to the FBI’s listing, 20 of the 34 purchase orders included accountable property that had been recorded in the FBI’s PMA. There were a total of 674 individual items of accountable property for the 20 purchase orders. We included all 674 items of accountable property for our property testing. Our property testing consisted of determining whether the FBI (1) entered in PMA the appropriate purchase order number, asset description, and physical location of the accountable property purchased; (2) entered all accountable property in PMA within the time frame specified in the FBI’s policy; (3) assigned bar codes to the accountable property when received and annotated the assigned bar codes in the receiving reports and in PMA; (4) properly documented any accountable property rejected immediately upon delivery; and (5) properly updated the PMA records of all accountable property returned after being accepted. We requested comments on a draft of this report from the FBI. We received written comments from the FBI on August 11, 2011, and have summarized those comments in the Agency Comments section of this report. FBI’s comments are reprinted in appendix III. We conducted this performance audit from February 2010 through September 2011 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform our audits to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Interagency agreements and contract Administration 1. To improve FBI’s controls over its review and approval process for cost-reimbursement type contract invoices, the Director of FBI should instruct the Chief Financial Officer to establish policies and procedures so that future interagency agreements establish clear and well-defined roles and responsibilities for all parties included in the contract administration process, including those involved in the invoice review process, such as contracting officers, technical point of contacts, contracting officer’s technical representatives, and contractor personnel with oversight and administrative roles. In July 2008, FBI’s Senior Procurement Executive issued Procurement Guidance Document 08-10 to all Bureau Procurement Chiefs that incorporated a memorandum from the Office of Federal Procurement Policy (OFPP), Office of Management and Budget (OMB), which discussed new guidance on interagency agreements. The new OFPP guidance, issued in June 2008, requires the requesting agency and the servicing agency to assign specific roles for each agency and is to be fully implemented for all interagency agreements executed after November 3, 2008. The guidance discusses, among other things, the need for defining roles such as the COTR and establishing specific responsibilities for those roles. It further elaborates on responsibilities for identifying an appropriate invoice review official prior to submittal of the first invoice and inspecting and rejecting contract work as necessary. 2. To improve FBI’s controls over its review and approval process for cost-reimbursement type contract invoices, the Director of FBI should instruct the Chief Financial Officer to establish policies and procedures so that labor rates, ceiling prices, treatment of overtime hours, and other key terms for cost determination are clearly specified and documented for all contracts, task orders, and related agreements. In December 2008, FBI’s Policy Training Unit created an intranet site, the Contract Specialist Corner, to provide contract specialists/contract officers with procurement information and guidance. The site includes links to procurement guidance and directives issued by DOJ, the FBI’s Policy Training Unit, and Federal Acquisition Regulation (FAR) circulars issued by the FAR council, as well links to standard procurement forms used in the procurement process. The site also provides access to contract execution checklists for different contract types, as well as standard FAR clauses applicable to various types of acquisitions including clauses related to labor rates, ceiling prices, treatment of overtime hours, and other key contract terms. In addition, in 2009, the Policy Training Unit created a separate intranet site for contracting officer technical representatives (COTR) as well as one for field offices to provide on-line access to procurement guidance and documentation. In addition, since January 2009 the Policy Training Unit has held monthly training sessions for contract specialists/contracting officers to ensure that directives issued by DOJ and FBI are being implemented properly. Development of policies and procedures and other actions taken process for cost-reimbursement type contract invoices, the Director of FBI should instruct the Chief Financial Officer to establish policies and procedures so that an appropriate process is in place to assess the adequacy of contractor’s review and documentation of submitted subcontractor charges before such charges are paid by FBI. In December 2008, FBI’s Policy Training Unit created an intranet site, the Contract Specialist Corner, to provide contract specialist/contract officers with procurement information and guidance, including references (and hyperlinks) to all procurement guidance documents that have been issued by DOJ, the Policy Training Unit, and FAR circulars issued by the FAR council. In addition, the site includes a section, FAR Matrix of Clauses, which provides information on applicable FAR clauses, including guidance useful to contract specialists in determining whether subcontractor clauses are necessary. In addition, in 2009, the Policy Training Unit also created two other separate intranet sites for contracting officer technical representatives (COTR) and Field Offices. The COTR site includes links to procurement guidance that includes discussion of contract administration responsibilities related to the COTR, prime contractor and subcontractor, as well as provides access to the documentation related to the activities of the COTR. In addition, since January 2009, the Policy Training Unit has held monthly training sessions for contract specialists/contracting officers to ensure that directives issued by DOJ and FBI are being implemented properly. In December 2008, FBI’s Policy Training Unit created an intranet site, the Contract Specialist Corner, to provide contract specialist/contract officers with procurement information and guidance, including references to all procurement guidance documents issued by DOJ, the Policy Training Unit, and FAR circulars issued by the FAR council, including those related to travel cost requirements (i.e., using the lowest standard coach or equivalent airfare). Specifically, the site includes a section, FAR Matrix of Clauses, which provides information on applicable FAR clauses, including those related to travel cost requirements. In addition, since January 2009, the Policy Training Unit has held monthly training sessions for contract specialists/contracting officers to ensure that directives issued by DOJ and FBI are being implemented properly. process for cost-reimbursement type contract invoices, the Director of FBI should instruct the Chief Financial Officer to establish policies and procedures so that future contracts clearly reflect the appropriate Federal Acquisition Regulation travel cost requirements, including the purchase of the lowest standard, coach, or equivalent airfare. FBI has established policies and procedures designed to provide guidance on its invoice review and approval process. Specifically, FBI issued two electronic communications that provided guidance on the invoice review and approval process. The first electronic communication, titled “Invoice Processing - Purchase Orders and Contracts,” states that the Contracting Officer is responsible for ensuring that the requirements for a proper invoice are attached and incorporated as a condition of the purchase order and for contracts, ensuring that the applicable clause is included. The second electronic communication, titled “Vendor Invoice and Payment Matter,” provides guidance on the information that constitutes a proper invoice and on the documentation required to support the payment of invoices. FBI incorporated these electronic communications in its Manual of Administrative Operations and Procedures (MAOP) Part 2 - Section 6-5.2, titled “Invoices under Purchase Orders/Contracts,” issued in February 2007. The section states that prior to submitting an invoice to the FBI’s Contracting Officer (CO) for approval and payment, the FBI requesting division is responsible for ensuring that goods and services are received in accordance with contract terms. Section 6-5.2 of the MAOP also states that the FBI CO is responsible for verifying that all required information is on the invoice before approving it. process for cost-reimbursement type contract invoices, the Director of FBI should instruct the Chief Financial Officer to establish policies and procedures so that appropriate steps are taken during the invoice review and approval process for every invoice cost category (i.e., labor, travel, other direct costs, equipment, etc.) to verify that the (1) invoices provide the information required in the contract to support the charges, (2) goods and services billed on invoices have been received, and (3) amounts are appropriate and in accordance with contract terms. 6. To improve FBI’s controls over its review and approval process for cost-reimbursement type contract invoices, the Director of FBI should instruct the Chief Financial Officer to establish policies and procedures so that the resolution of any questionable or unsupported charges on contractor invoices identified during the review process is properly documented. FBI has established policies and procedures related to properly documenting the resolution of any questionable or unsupported charges on invoices identified during the invoice review process. Specifically, Part 2, Section 6-9.3.3 of FBI’s Manual of Administrative Operations and Procedures (MAOP), version dated 2/26/07, titled “Review of Invoices,” and FBI’s Electronic Communication titled “Vendor Invoice and Payment Matter” specifies requirements for FBI to properly document the reasons for determining that an invoice is improper, the date the invoice is returned to the vendor, and the date a corrected invoice is received from the vendor. Development of policies and procedures and other actions taken the Director of FBI should instruct the Chief Financial Officer to establish policies and procedures so that invoices are paid only after all verified purchase order and receipt documentation has been received by FBI payment officials and reconciled to the invoice package. In November 2006 FBI issued a policy titled, “Implementation of Invoice Submission Form for Invoices and Intragovernmental Payment and Collection Process by CPCSU,” 319E-HQ- A1487524-FD. This policy requires that all invoices sent to the commercial payment unit beginning in November 2006 must include a completed invoice submission form as the cover sheet. The new required form includes the following fields to be completed by the submitting division: vendor number, invoice date, acceptance date, purchase order number, purchase order line number, purchase order quantity, total amount, date the COTR and the contracting officer (1) received the invoice form, (2) approved it—with their signature, and (3) the date they sent it on to the next responsible party. Collectively, these actions to establish policies requiring confirmation of receipt of goods and services before payment addresses our recommendation. 8. To address issues on the Trilogy project that could represent opportunities for recovery of costs, the Administrator of General Services, in coordination with the Director of FBI, should determine whether other contractor costs identified as questionable in this report should be reimbursed to FBI by contractors. 9. To address issues on the Trilogy project that could represent opportunities for recovery of costs, the Administrator of General Services, in coordination with the Director of FBI, should further investigate whether DynCorp Information Systems’ labor rates exceeded ceiling rates and pursue recovery of any amounts determined to have been overpaid. 10. To address issues on the Trilogy project that could represent opportunities for recovery of costs, the Administrator of General Services, in coordination with the Director of FBI, should confirm the Science Applications International Corporation’s (SAIC) informal Extended Work Week policy and work with SAIC to determine and resolve any overpaid amounts. 11. To address issues on the Trilogy project that could represent opportunities for recovery of costs, the Administrator of General Services, in coordination with the Director of FBI, should consider engaging an independent third party to conduct follow-up audit work on contractor billings, particularly areas of vulnerability identified in this report. In January 2007 GSA requested, on behalf of the FBI, that Defense Contract Audit Agency (DCAA) perform post-award audits of direct costs incurred and billed by contractors under the FBI’s Trilogy project. In March 2008, DCAA reported the results of its audit related to SAIC reporting questioned costs of $3.7 million. As a result of this audit, FBI recovered $3.2 million from SAIC. In December 2008, DCAA reported the results of its audit of the direct costs incurred and billed by Computer Sciences Corporation (CSC) reporting questioned costs of $14.95 million, $9.7 of which was related to labor charges. In addition to questioned costs related to labor rates exceeding ceiling rates, DCAA reported additional CSC questioned costs of $1,825,952 related to airfare costs because the costs were inadequately supported and exceeded the lowest customary standard coach or equivalent airfare, and $979,187 of labor costs because of lack of personnel qualifications or lack of supporting documentation that shows the employees’ labor qualifications. DCAA’s report also incorporated evaluations of costs incurred by the largest subcontractors that performed under CSC’s task order. The report questioned costs for subcontractors CACI, DigitalNet, PlanetGov/Apptis, Inc. and others totaling $5.1 million. The types of subcontractor questioned costs reported by DCAA included 1) supporting timesheets that were either not certified by the consultant or not approved by an appropriate/approving authority 2) use of personnel that did not meet the minimum labor qualifications, and 3) unsupported or inadequately supported transactions. With regard to these questioned costs, in March 2009, the Department of Justice, Office of Inspector General, began an investigation to determine whether the billings were potentially fraudulent and involved criminal conduct by CSC and its subcontractors. In commenting on a draft of this report, the FBI informed GAO that the Inspector General’s report on this matter was under review by OIG management. Development of policies and procedures and other actions taken 12. To improve FBI’s accountability for purchased assets, the Director of FBI should instruct the Chief Financial Officer to reinforce existing policies and procedures so that when assets are delivered to FBI sites, they are verified against purchase orders and receiving reports. Copies of these documents should be forwarded to FBI officials responsible for reviewing invoices as support for payment. The FBI has reinforced policies and procedures related to verifying assets received to purchase orders and receiving reports. Specifically, FBI issued an Electric Communication to all divisions in November 2005 to reinforce FBI’s policy that all accountable property be entered in the Property Management Application (PMA) immediately upon receipt and that data recorded in FBI’s financial management system must include the purchase order number and the destination division. The information entered into the financial management system is to be immediately uploaded to PMA for verification of the accuracy of property being recorded in PMA with specific purchase orders. In addition, the FBI issued an electronic communication to all divisions in November 2006 to implement a new invoice submission form to be used with all commercial invoices to improve the information provided to the payment unit for invoices. The electronic communication required that the invoice submission form include various fields, including, purchase order line number - purchase order line number to charge the invoice, purchase order quantity – quantity to be paid for the invoice, and Total amount – total amount to be paid by purchase order line. 13. To improve FBI’s accountability for purchased assets, the Director of FBI should instruct the Chief Financial Officer to establish policies and procedures so that (1) purchase orders are sufficiently detailed so that they can be used to verify receipt of equipment at FBI sites, and (2) contractor invoices are formatted to tie directly to purchase orders and facilitate easy identification of equipment received at each FBI site. The FBI formed the Policy Training Unit in 2007 which is responsible for all acquisition policy and acquisition training within the FBI, including implementation, updates, and training of specialized acquisition matters. Since January 2009, the Policy Training Unit holds monthly contractor specialist training sessions at which participants discuss new procurement guidance issued by DOJ and procurement directives issued by FBI and implementation. According to FBI, during these procurement training sessions, the Policy Training Unit staff have stressed the importance to contracting officers of generating purchase orders with a sufficient level of detail so that the requesting division can use the purchase order to verify equipment receipt. In addition, the FBI formed the Acquisition Strategy and Planning Unit in March 2006. The Acquisition Strategy and Planning Unit developed training materials for acquisition planning that included guidance on the FD-369, the requisition form which is also used in generating purchase orders, which states that equipment and services be on separate lines. 14. To improve FBI’s accountability for purchased assets, the Director of FBI should instruct the Chief Financial Officer to establish a policy to require that upon receipt of property at FBI sites, FBI personnel immediately identify all accountable assets and affix bar codes to them. In order to record an asset on PMA it must have a bar code assigned. In November 2005, FBI issued an electric communication to reinforce accountable property policies and procedures by requiring that all divisions record accountable property in PMA within 48 hours of being received. If fully and effectively implemented, this policy should improve the FBI’s accountability over purchased assets. Development of policies and procedures and other actions taken the Director of FBI should instruct the Chief Financial Officer to revise FBI’s policies and procedures to require that all bar codes are centrally issued and tracked through periodic reconciliation of bar codes issued to those used and remaining available. Assigned bar codes should also be noted on a copy of the receiving report and forwarded to FBI’s Property Management Unit. FBI has taken action to strengthen controls that help ensure all accountable property is bar coded and properly recorded by issuing a March 2009 electronic communication (approved by the Chief Financial Officer) that requires all FBI offices to perform a weekly review of the On Order Report to ensure that all property that has been receipted in FBI’s financial management system is also added to PMA. The On Order Report lists all property items associated with a particular purchase order that do not show having been recorded in the PMA, thus providing FBI with the ability to identify and investigate potentially missing and/or unrecorded property items. Also, our September 2010 walk-through of the process to enter assets into PMA found that the bar code numbers are annotated on copies of the receiving reports that are forwarded to the property custodian as we had recommended. In addition, we noted that the FBI’s Asset Management Unit is solely responsible for issuing bar codes to FBI offices and the unit requires that all offices sign an FD-281 verifying receipt of bar codes. 16. To improve FBI’s accountability for purchased assets, the Director of FBI should instruct the Chief Financial Officer to revise FBI policies and procedures to require that accountable assets be entered into PMA immediately upon receipt rather than within the current 30-day time frame. In November 2005, FBI issued an electric communication to reinforce accountable property policies and procedures by requiring that all divisions record accountable property in PMA within 48 hours of being received. 17. To improve FBI’s accountability for purchased assets, the Director of FBI should instruct the Chief Financial Officer to require officials inputting data into PMA to enter (1) the actual purchase order number related to each accountable equipment item bought, (2) asset descriptions that are consistent with the purchase order description, and (3) the physical location of the property. The FBI has taken action to enhance its PMA to help ensure the accuracy and completeness of reporting on the status of property on order, the On Order Report, including installing a system edit limiting data entry to those transactions with valid purchase order numbers. Specifically, FBI issued an electric communication “Property Management Application Policy Change” on 02/15/2006 that provides that assets added to PMA must include data in the PMA location field. We confirmed that the FBI developed and put in place system edit checks that were effective in ensuring that only valid purchase order numbers were recorded into PMA and that related purchase order information was automatically and accurately uploaded from the financial management system into PMA. Development of policies and procedures and other actions taken the Director of FBI should instruct the Chief Financial Officer to establish policies and procedures related to the documentation of rejected or returned equipment so that the (1) equipment that is rejected immediately upon delivery is notated on the receiving report that is forwarded to FBI officials responsible for invoice payment and (2) equipment that is returned after being accepted at an FBI site (e.g., items returned due to defect) is annotated in PMA, including the serial number and location of any replacement equipment, under the appropriate purchase order number. In September 2006, FBI issued an electric communication to all divisions requiring that the Asset Management Unit be notified of any accountable property returned to vendors to ensure that the return of the property is recorded in PMA. If a replacement is provided by the vendor the Asset Management Unit is to revise the PMA records to provide descriptive information for the new property item (serial number and barcode) and show it as “Active” and show the barcode of the returned piece of property as “Inactive.” In addition, when a piece of accountable property delivered to FBI is returned and a replacement is to be provided by the vendor, the item is to remain on FBI’s On Order Report until a replacement is received and not to be recorded in PMA. We also noted, during our discussions with officials from the FBI’s commercial payment unit that FBI’s financial management system will not allow a disbursement of funds until the property has been recorded as received. FBI issued an electric communication “2009 Wall-to-Wall Inventory of Property, Plant, Equipment, and Issued Personal Property” that included additional directions to the inventory staff to ensure that, property information recorded in PMA was accurate. Specifically, the directive included detailed steps on how to request changes to correct errors in the manufacturer or model description fields in PMA for property identified during the inventory. The directive included as an attachment, a form titled “2009 INVENTORY CHANGES FOR MANUFACTURER & MODEL #s” to request a change or modification to these fields. the Director of FBI should instruct the Chief Financial Officer to expand the next planned physical inventory to include steps to verify the accuracy of asset identification information included in PMA. Development of policies and procedures and other actions taken the Director of FBI should instruct the Chief Financial Officer to reassess overall physical inventory procedures so that all accountable assets are properly inventoried and captured in the PMA system and that all unlocated assets are promptly investigated. FBI has reassessed its inventory procedures as reflected in changes to instructions provided to all divisions through electronic communications in advance of wall-to-wall inventories. The FBI issued an electronic communication in advance of the wall to wall inventory titled “2009 The Wall-to- Wall Inventory of Property, Plant, Equipment and Issued Personal Property” on 3/31/2009 for the wall-to-wall inventory to be held beginning 4/13/09. The electronic communication includes instructions that are related to findings we reported. For example, the 2009 electronic communication states that during the inventory, only the PMA custodians will have access to change only the serial number due to the fact that 95% of the manufacturer and/or model information has now been standardized on PMA. In addition, the 2009 electronic communication included additional language that stressed a complete inventory, stating that all additions must be added to the PMA during the inventory period in order to comply with a “fully completed” wall-to-wall inventory because failure to comply with the procedure would result in an “incomplete” inventory. The 2009 electronic communication also included new language on property issued to individual employees and contractors, which stated, Each office is to ensure that the issued personal property for each employee and contractor is inventoried. Discrepancies for issued personal property are to be forwarded to the appropriate FBIHQ Program Managers and the Asset Management Unit should be notified of these changes. Lastly, the electronic communication included a section titled “Required Procedures for Concluding Inventory” that included additional language related to lost and stolen property and additions. Beginning in 2008, the FBI’s Finance Division’s audit unit expanded its audit coverage to include conducting audits of compliance with FBI policies and procedures for review and approval of contractor invoices, government purchase card usage, and oversight for the semi-annual audits of property and equipment at the FBI field offices and divisions. Further, the Audit Unit Chief informed us that his unit expanded the scope of its audits to include audits of internal controls related to accountable property on a periodic basis as needed in response to significant events at FBI. For example, in fiscal year 2009 the FBI initiated the Next-Generation Workstation Tech Refresh program (NGW) to purchase approximately 47,000 new computers. The Finance Division audit unit performed on-site reviews at the Seattle field office and the Portland field office to determine whether required controls over property accountability were in place as the computers from the NGW program were being distributed throughout the agency. the Director of FBI should instruct the Chief Financial Officer to establish an internal review mechanism to periodically spot check whether the steps listed above- including verifications of purchase orders and receiving reports against received equipment, immediate identification and bar coding of accountable assets, maintenance of accurate asset listings, prompt entry of assets into PMA, documentation of rejected and returned equipment, and improved bar coding and inventory procedures- are being carried out. Development of policies and procedures and other actions taken the Director of FBI should instruct the Chief Financial Officer to investigate all missing, lost, and stolen assets identified in this report to (1) determine whether any confidential or sensitive information and data may be exposed to unauthorized users and (2) identify any patterns related to the equipment (e.g., by location, property custodian, etc.) that necessitates a change in FBI policies and procedures, such as assignment of new property custodians or additional training. In March 2011, the FBI provided us with documentation on the results of its investigation into the status of the over 1,200 assets that acknowledged that 134 assets remained unaccounted for. The assets that remain unaccounted for include some that could contain sensitive information, such as desktop computers, laptops, and servers.We initially identified 1,404 assets as missing, lost, or stolen, but prior to the issuance of our 2006 report the FBI provided additional documentation that enabled us to verify an additional 199 assets on PMA that we initially determined to be missing. lost, or stolen, reducing the number reported to 1,205. The FBI has not provided an analysis to identify any patterns related to these assets that would be helpful for identifying any needed changes to FBI policies and procedures. 23. We recommend that the Director of the FBI direct the Sentinel Program Manager to modify existing Sentinel policies and procedures to require the Sentinel property manager to verify for every property shipment that data in the Lockheed Martin database are complete and accurate before using these data to create or update FBI’s official property records in PMA. FBI modified its existing policies and procedures to include a policy of verifying accuracy and completeness of data in the Lockheed Martin database. Specifically, Section 2.2.3 of FBI’s Property Management Policy & Procedures, prepared by Office of IT Program Management, Sentinel Program and Business Management Team, version dated 9/3/2008, titled “Receipt of Property” policy specifies requirements of the Sentinel Property Manager to verify the accuracy of equipment data on the property list uploaded by the contractor before using this data to enter equipment to PMA upon receipt and verification of equipment. The equipment data on the property list refers to the Lockheed Martin database for Sentinel project. 24. We recommend that the Director of the FBI direct the Sentinel Program Manager to modify existing Sentinel policies and procedures to require that the Sentinel property manager perform monthly reconciliations of the key property records (i.e., the BOM, the vendor invoices, the Lockheed Martin database, and PMA) throughout each subsequent phase of Sentinel rather than a single close-out reconciliation at the completion of a phase. FBI modified its existing policies and procedures to include periodic reconciliation of the key property records. Specifically, Section 3.2 of FBI’s Property Management Policy & Procedures, prepared by Office of IT Program Management, Sentinel Program and Business Management Team, version dated 9/3/2008, titled “Data Requirements” specifies that the Sentinel Property Manager will perform at least monthly reconciliations of the key property records including Bill of Materials, invoices, contractor property list (Lockheed Martin database) and PMA throughout the Sentinel Program. Sentinel Program Manager to modify existing Sentinel policies and procedures to require the Sentinel property manager to document the initial inspection of property as it is received, including verification that the property was properly barcoded. FBI modified its existing policies and procedures to include initial inspection of property upon receipt, including verification that the property was properly barcoded. Specifically, Section 2.2.3 of FBI’s Property Management Policy & Procedures, prepared by Office of IT Program Management, Sentinel Program and Business Management Team, version dated 9/3/2008, titled “Receipt of Property” specifies that the Sentinel Property Manager will match quantity, manufacturer, make, model and serial number and barcode number on the shipping document, packing lists, or invoice to the physical inventory of equipment received, and after the verification the document will be annotated with receipt noted and signed by the Property Administrator and Sentinel Property Manager. 26. We recommend that the Director of the FBI direct the Sentinel Program Manager to modify existing Sentinel policies and procedures to require the Sentinel property manager to record in the Lockheed Martin database the date Sentinel property is received to allow for assessments of whether Sentinel property was timely recorded into PMA. FBI modified its existing policies and procedures to require the received date be tracked. Specifically, Section 3.2 of FBI’s Property Management Policy & Procedures, prepared by Office of IT Program Management, Sentinel Program and Business Management Team, version dated 9/3/2008, titled “Data Requirements” specifies that in order to be useful to both the PMO and contractor the key data points, including the date received and Shipping Document/Item Receipt Verification Date, should be tracked by either an electronic spreadsheet or listed on a locally devised inventory sheet. According to FBI’s Sentinel team, the “Date Received” column in the Lockheed Martin database now tracks the received date of each property. 27. We recommend that the Director of the FBI direct the Sentinel Program Manager to modify existing Sentinel policies and procedures to require the Sentinel property manager to follow up on and document actions taken with respect to the 20 property records we identified as having valuation discrepancies, including any adjustments to the valuations in either FBI’s or the contractor records. FBI followed up with the 20 items identified in our report and took necessary corrective action to eliminate valuation discrepancies. We reviewed accountable property records maintained in the PMA and the Lockheed Martin database provided by FBI for those 20 items and verified that FBI has made adequate adjustments to the valuation in PMA and the Lockheed Martin database. PMA that we initially determined to be missing. lost, or stolen, reducing the number reported to 1,205. Staff members who made key contributions to this report include: Phillip McIntyre, Assistant Director; William E. Brown; Sharon Byrd; Liliam Coronado; Joshua Edelman; Francine DelVecchio; Francis Dymond; Wendy Johnson; Galena Phillips; Lisa Reijula; and Seong Bin Park.

Summary: The FBI has spent over $900 million on the Trilogy and Sentinel information technology (IT) projects intended to provide FBI with an upgraded IT infrastructure and an automated case management system to support FBI agents and analysts. In February 2006 and July 2008, GAO reported on significant internal control weaknesses related to FBI's contract administration, processing of contractor invoices, and accountability for equipment acquired for these projects. GAO made 27 recommendations to the FBI to address these deficiencies. The FBI concurred with all 27 recommendations. This report provides an assessment of (1) the FBI's corrective actions to address GAO's 27 recommendations and (2) whether there were any indications of implementation issues related to the policies and procedures the FBI developed to address 17 of the 27 recommendations. GAO reviewed FBI policies and procedures, performed walk-throughs, and conducted detailed tests on statistically and nonstatistically selected samples of transactions. The corrective actions developed by FBI were sufficient to address 21 of the 22 Trilogy recommendations and all 5 Sentinel recommendations. The FBI substantially addressed: 17 Trilogy recommendations related to contract administration, invoice processing, and property accountability by establishing or revising policies and procedures; 4 by contracting for follow-up audits of the Trilogy costs; and the 5 Sentinel recommendations by revising Sentinel policies and procedures. The one Trilogy recommendation that FBI did not address completely was related to 1,205 missing, lost, or stolen Trilogy assets. As of February 2011, the FBI had researched and determined the status of all but 134 of these assets. FBI officials stated that almost all of these assets had a useful life of 7 years, and if they were not already returned or destroyed, they are now obsolete. There are diminishing returns to continue to pursue these assets, which included several information technology items that could potentially contain sensitive information. However, if the FBI is able to determine the status of any of these assets in the future, officials stated that they will make the entries to properly record them in FBI's property management application (PMA). In assessing implementation of the policies and procedures developed in response to GAO's 17 Trilogy recommendations related to contract administration, invoice processing, and property accountability, GAO found that policies and procedures related to the 4 recommendations dealing with contract administration, including interagency agreements, were effectively implemented but also identified a new issue. Specifically, GAO found that forms--required by the Federal Acquisition Regulation to support the use of interagency agreements to conveniently or economically obtain supplies and services--were not timely completed for 15 of 54 statistically selected interagency agreements tested, and found that FBI's monitoring did not identify this deficiency. GAO estimates that as much as 39.5 percent of FBI's fiscal year 2009 interagency agreements did not meet this requirement, increasing the risk that funds may have been disbursed for goods or services that were not in the best interest of the government. In addition, GAO's testing of FBI's implementation of polices and procedures for the remaining 13 recommendations that were related to invoice processing and property accountability found indications of implementation issues in 3 areas. (1) Regarding the review of contractors' invoices, 5 invoices (of the 37 tested) that had been reviewed and approved by FBI officials included labor rates that were not fully supported by the contract documentation. Without verifying labor charges against the contractor's proposal as required by FBI policy, there is an increased risk of disbursing funds for unallowable charges. (2) For property accountability, GAO found instances in which FBI (1) did not record accountable property items in its system in a timely manner and (2) did not accurately record key accountability information, such as location and serial numbers, as required by FBI's policies. These shortcomings increase the risk that assets could be lost or stolen and not be detected and investigated in a timely manner. GAO makes three new recommendations to improve interagency agreement controls and determine if additional actions are necessary to improve controls for invoice processing and property accountability. The FBI concurred with all three recommendations and discussed actions it has initiated to address GAO's recommendations.