NCIC is an extensive computerized criminal justice information system maintained by the FBI that serves as a repository of data on crimes and criminals of nationwide interest and as a locator file for missing and unidentified persons. Over 92,000 law enforcement agencies and other criminal justice partners have access to NCIC, which includes approximately 35,000 federal, state, and local law enforcement agencies in the United States. As of January 1, 2011, NCIC contained 85,820 active records in its missing persons file. See figure 1 for additional information on the age of missing persons reported by law enforcement to NCIC. NCIC is managed cooperatively by FBI’s CJIS—the division within the FBI that operates as the focal point and central repository for criminal justice information services—and the state and local agencies that access the system. An Advisory Process, consisting of an Advisory Policy Board (the Board) with representatives from criminal justice and national security agencies throughout the United States, and working groups are responsible for establishing policy for NCIC use by federal, state, and local agencies and providing advice and guidance on all CJIS Division programs. In addition, the Board creates ad hoc subcommittees as necessary to review policies and develop alternatives or recommendations for the Board’s consideration. NCIC policies and procedures are documented in the NCIC 2000 Operating Manual and the CJIS Security Policy. Local level governance of NCIC use is performed by the CSA. The CSA is a criminal justice agency that has overall responsibility for the administration and usage of NCIC, including providing quality assurance and training and assuring LEA compliance with operating procedures within its jurisdiction. Most CSAs are state agencies that oversee NCIC use by all LEAs that enter data into NCIC in the state. A CSA may be a law enforcement agency, such as a state police agency, that also enters data into NCIC, in addition to overseeing the administration of the state’s NCIC system. Furthermore, the Board requires that each local LEA appoint a Terminal Agency Coordinator who serves as the representative and point of contact for disseminating information on NCIC policies and procedures to that agency. CJIS shares with the CSAs the responsibility for monitoring compliance with NCIC policy, as shown in figure 2. CJIS policy, as approved by the Board, calls for triennial audits of each CSA to assess the CSA’s compliance with NCIC policies, including the 2-hour entry requirement. Further, CJIS relies on the CSAs to audit all LEAs that enter data into NCIC in each state, to help ensure compliance among all NCIC users. CJIS’s NCIC performance-based audit program tasks the CJIS Audit Unit with conducting a compliance audit of each CSA to verify compliance with federal laws, such as the 2-hour entry requirement for reports of missing children, and other CJIS policies and regulations. The purpose of the audit is to: assess CSA compliance with NCIC system policy requirements; assess the quality, integrity, and security of the data maintained in and accessed from a variety of criminal justice information systems and networks; and ensure timely and relevant criminal justice information is made available to authorized users. As part of its audit of CSAs, CJIS reviews random samples of records of missing persons in selected LEAs, and assesses all missing children records contained in the sample to determine compliance with the 2-hour entry requirement. During the current triennial audit cycle, the CJIS Audit Unit plans to audit CSAs in all 50 states plus the District of Columbia from October 1, 2009, through September 30, 2012. CJIS funding for conducting NCIC audits was $207,570 in fiscal year 2009 and $309,854 in fiscal year 2010, and is projected to be $244,202 in fiscal year 2011. CJIS’s audit of CSAs consists of a pre-audit questionnaire, on-site visit, and follow-up report. The pre-audit questionnaire is sent to CSAs and selected LEAs within the state to obtain written responses as well as assist CJIS in gathering the relevant information to better inform the audit process. In selecting LEAs, CJIS takes into account a number of factors, which may include the number of records entered by each LEA, the total number of records to be reviewed in the state, the LEA’s geographic location to reduce the time and travel burden imposed on CJIS audit staff, whether the LEA was previously found to have extensive and/or serious NCIC noncompliance issues, and whether CSA officials request that CJIS include the LEA in its audits based on CSA concerns from prior CSA audits. The on-site visit consists of interviews of CSA and LEA personnel to determine compliance with NCIC policies and procedures, and a data quality review of selected LEA NCIC records. In designing its review of these records, CJIS seeks to balance the need for a cost-effective, logistically feasible approach, with the need to ensure the review obtains statistically valid information on the accuracy, completeness, and timeliness of all missing person records. During the post-audit phase, CJIS prepares a draft audit report that includes findings from the interviews with the agency personnel as well as the data-quality reviews and recommendations for agency compliance. The report is provided to the CSA for review, and the final report, including the CSA’s responses to any recommendations, is forwarded to the Sanctions Ad Hoc Subcommittee of the Board. This subcommittee is responsible for evaluating the results of audits conducted of participants in the CJIS Division programs. The subcommittee makes specific recommendations to the Board concerning sanctions that should be imposed on agencies that are not in compliance with the policies established by the Board for the operation of the CJIS Division programs. Sanctions may be in the form of a letter of concern from the subcommittee enumerating audit problems that had not been resolved from previous audit cycles, or a letter of sanction, which is similar to the letter of concern, but with stronger language and specific compliance terms and procedures. If the CSA does not adequately address noncompliance issues, the Board has the option of terminating the state’s access to NCIC. Each CSA is also required by CJIS and the Board to establish a system to, at a minimum, triennially audit all LEAs that enter data into NCIC within their jurisdiction, to ensure compliance with NCIC policy and regulations. Each CSA is responsible for developing an audit program to meet this requirement and the resulting audit approach can vary across CSAs. We discuss the audit approaches used to assess the timeliness of missing children records by the 6 selected CSAs later in this report. During its audits, CJIS assesses the extent to which the CSAs are fulfilling the requirement to audit all LEAs that enter data into NCIC under their jurisdiction. CJIS and the Board have taken a number of steps to help ensure that LEAs implement the 2-hour entry requirement. Beginning in January 2007, CJIS: informed CSAs and LEAs that the Adam Walsh Act of July 2006 required all reports of missing persons under the age of 21 to be entered into NCIC within 2 hours of receipt; provided guidance to CSAs and LEAs regarding how LEAs might best document compliance with the requirement; and informed CSAs and LEAs that the Board had authorized it to begin assessing noncompliance with the requirement in October 2009 and possibly subject noncompliant CSAs to sanctions beginning in October 2012. Starting with its CSA audits conducted in January 2007, CJIS provided verbal and written information to all CSAs and the selected LEAs it audited that LEAs will have 2 hours to enter reports of missing children into NCIC from the time LEAs complete collecting 10 data elements required by statute. As the Adam Walsh Act did not specify how compliance was to be measured, CJIS started measuring the 2 hours once the required data were obtained because this is how CJIS has measured timely entry requirements for all other types of NCIC records, such as missing persons age 21 and older and wanted persons. In addition, CJIS recognized that law enforcement may face challenges obtaining complete information at the time of the initial report, for example, from parents who are traumatized by a child’s disappearance. If the elapsed time between obtaining and entering the information on a missing child was equal to or less than 2 hours, CJIS would deem the entry to be in compliance with the 2-hour entry requirement. Conversely, if the elapsed time was more than 2 hours, CJIS would deem the entry to be out of compliance with the 2-hour entry requirement. Generally, according to CJIS officials, if CJIS finds that 10 percent or more of missing children records reviewed are out of compliance, CJIS would make an audit recommendation requiring the CSA to take actions to address non-compliance. The officials also said that CJIS provides and discusses all findings from its LEA reviews with the cognizant LEAs. CJIS more broadly disseminated information to CSAs and LEAs regarding how timeliness would be assessed via (1) a January 2008 letter to the heads of all CSAs and (2) a June 2009 update to NCIC’s Operating Manual. In CJIS’s letter to the heads of the CSAs and in the update to the NCIC Operating Manual, CJIS recommended that LEAs use a time and date stamp to document when they completed collecting the required information from the party or parties reporting the missing child. CJIS also informed CSAs and LEAs that it would assess timeliness using the 2-hour criterion and make audit recommendations that would require CSA responses in the audit cycle beginning in October 2009. This start date was selected because of the Board’s decision to grant a grace period to allow agencies time to establish and institute procedures to accurately document the receipt of the minimum data necessary for entry. CJIS did not specifically require LEAs to use the recommended time and date stamps, but if an audited LEA did not document the date and time it received the minimum data, CJIS stated it would consider any unjustified delay in entering information on a missing child into NCIC as untimely. This could result in CJIS making an audit recommendation that the CSA take action to address the noncompliance and the Sanctions Ad Hoc Subcommittee applying sanctions in the future. As of January 2011, CJIS had audited 22 CSAs using the 2-hour criterion for entering reports of missing children into NCIC. Of the 22 audits, 10 audit reports were finalized and 12 were in draft form. Of the 10 CSAs where audit reports were final, CJIS found 9 CSAs to be out of compliance with the 2-hour entry requirement and issued audit recommendations to them to take actions to ensure timely entry. As shown in figure 3, the percentage of missing children records assessed by CJIS as having been entered into NCIC within 2 hours ranged from 53 percent to 91 percent across the 10 states; and the percentage of records entered into NCIC after 2 hours ranged from 9 percent to 47 percent. During the audits, CJIS attempts to capture information on the reasons missing children records are untimely to assist the CSAs in identifying issues that they may need to address statewide in order to become compliant with the 2-hour entry requirement. For each untimely missing child record, CJIS audit staff asks the LEA personnel to provide a description of the reason that led to the delay in entry. However, for 82 percent of the 432 untimely missing children records identified across the 10 states, CJIS officials told us they did not know the reason for the delay because the LEAs could not provide them with information on the reasons why the records were not entered within 2 hours. For the 79 untimely missing children records where LEAs were able to provide CJIS information on the causes for the delay in NCIC entry, two predominant reasons were given: LEA personnel did not know about the 2-hour entry requirement. Responding officers did not provide the information on the missing child in a timely manner. This could occur, for example, if officers began investigating the case before submitting the report of the missing child, waited until the end of the shift to submit a report, were dispatched to another service call prior to submitting the report, or did not deem it necessary to submit the report immediately for NCIC entry because they considered the child to be a frequent run-away. CJIS officials also said that in cases where CJIS auditors could not find documentation of the date and time that the minimum data required for NCIC entry were obtained, they deemed the entry to be untimely. In written responses to CJIS’s findings of untimely entry, CSAs generally focused on their plans to provide training to personnel responsible for entering reports of missing children into NCIC and educate personnel through the CSAs’ audits of LEAs. CJIS informed CSAs that, in order to allow for an appropriate transition period, the Board had decided that audit recommendations based on the 2- hour entry requirement would not be forwarded to the Board’s Sanctions Ad Hoc Subcommittee until the audit cycle beginning in October 2012. Thus, while CSAs must respond to CJIS audit recommendations regarding non-compliance with the 2-hour entry requirement, non-compliance in this area will not be a factor in the Board’s decisions about whether to impose sanctions on a CSA until October 2012. During its audits of CSAs, CJIS verifies that each CSA is conducting the triennial audits that are required by CJIS and the Board. However, the Board has not taken steps to establish audit standards that require CSAs to assess compliance with the 2-hour entry requirement. Standards for Internal Control in the Federal Government call for management to design control activities to help ensure that its control objectives are met. Such standards could better position CJIS and the Board to ensure that the CSA audits accomplish CJIS’s specific oversight and compliance objectives for timely entry of missing children records. In the absence of standards, we found that audit approaches used by the 6 selected CSAs to assess compliance with the 2-hour entry requirement varied. For example, lacking standards, two CSAs were not using the 2- hour criterion to assess timeliness and the six CSAs varied in the number of missing children records reviewed. The number of missing children records reviewed ranged from all active records in one state to no records in another. The fact that CSAs were not consistently applying the 2-hour criterion to review a sample of missing children records raises questions about the reliability of CSA information on LEA compliance. The two CSAs that were not using the 2-hour criterion had different approaches to assessing timeliness: Officials for one CSA stated they used an “immediate” criterion to assess the timeliness of missing children records, which they said was stricter than the 2-hour entry requirement. However, the CSA did not have documentation on the time frame that was to be used for measuring “immediate” entry or how it assessed compliance with this criterion. Thus, CSA auditors could not demonstrate LEAs’ compliance with the 2-hour entry requirement. One CSA relied on LEAs to complete a questionnaire that asks, among other things, if the agencies impose a waiting period before taking reports of missing children and if there is a “large delay” between the time a missing person report is taken and the time it is entered into NCIC. However, the questionnaire does not define what the CSA considers to be a “large delay,” and the CSA does not test for compliance. Therefore, auditors for this CSA also could not demonstrate LEAs’ compliance with the 2-hour entry requirement. CSAs were also not consistent in the number of missing children records they assessed for compliance with the 2-hour entry requirement, specifically: One CSA (the CSA mentioned above that relied on LEA responses to a questionnaire) did not review any missing children records because the state had over 500 LEAs and, according to CSA officials, a limited number of auditing staff. One CSA determined the number of missing children records to review at each LEA based upon the LEA’s entry error rate—the portion of records that were untimely, incomplete, or did not comply with other entry requirements—from its past CSA audit. This approach resulted in the CSA reviewing 2 missing person records out of about 400 at one LEA. One CSA generally reviewed 4 to 10 missing children records from each LEA it audited. This sampling approach resulted in the CSA reviewing about the same number of records from an LEA with over 1,250 active missing children records as from an LEA with about 100 active missing children records. One CSA generally reviewed 10 percent of all missing person records from each LEA it audited, some portion of which would be missing children records. The CSA also imposed a minimum of 20 missing person records to be reviewed. If a LEA had fewer than 20 missing person records in NCIC, then the CSA would review all records. One CSA reviewed 10 percent of active missing children records from large LEAs, such as one with over 800 missing children records in NCIC, and all records from the remaining LEAs it audited. One CSA reviewed all active missing children records from each LEA it audited. We do not know the extent to which the variability we identified in CSA audit approaches exists across all CSAs. However, our findings that one CSA did not assess any missing children records and other CSAs reviewed a relatively small number of records raises questions about the CSAs’ and, in turn, CJIS’s ability to draw conclusions regarding LEAs’ compliance with the 2-hour entry requirement for missing children. CJIS officials acknowledged that CSA audits would be more useful if they measured LEAs’ compliance with the 2-hour criterion and reviewed a sample of missing children records to assess compliance with the entry requirement, but CJIS and the Board do not require CSAs to incorporate either of these into their audits. CJIS officials said that when CSAs request audit guidance, CJIS makes information available to them on its audit methodology and protocols, which include applying the 2-hour criterion to assess a sample of missing children records. Standards for Internal Control in the Federal Government call for agencies to ensure control activities are in place that enforce management’s directives and effectively accomplish agencies’ control objectives. Without such minimum audit standards for assessing compliance with the entry requirement—including applying the 2-hour criterion and how to sample missing children records—CSAs’ audits may not be collecting as consistent and reliable information on LEA compliance with the requirement as they could. Minimum standards could also help CJIS better accomplish its specific oversight and compliance objectives for timely entry of reports of missing children. We recognize that when CSAs conduct audits, they have multiple responsibilities to ensure compliance with all NCIC policies and face resource constraints that may limit their ability to review missing children records for timeliness. Therefore, it could be helpful for CJIS, CSAs, and the Board to collaborate in developing minimum standards that are both feasible to implement and provide reliable information on LEA compliance. Once standards are established, CJIS could help ensure that CSA audits are meeting standards by reviewing the audit approaches that CSAs use to assess timeliness. This type of review is another key internal control activity that could help CJIS achieve its oversight and compliance objectives for the 2-hour entry requirement for reports of missing children. Officials from eight of the nine LEAs we contacted identified custody disputes and coordination with child welfare agencies as potential impediments to reporting missing children to NCIC in a timely manner or investigating these cases. OJJDP has funded research and policy development to produce guidance in these areas, but CJIS and OJJDP could take additional steps to better position DOJ to carry out its oversight role over NCIC, with respect to helping ensure compliance with the 2-hour requirement. Custodial issues may come into play when a child is missing as a result of having been removed from his or her usual place of residence by a family member. Officials from all of the nine LEAs we met with reported that the responding officer may need to ascertain the custodial arrangements for the child and whether the report is the result of a misunderstanding between family members or constitutes an abduction by a family member. More specifically, officials from seven of the nine LEAs reported that challenges in making this determination may delay reporting or investigation of the case. Of the seven LEAs that raised custody- determination issues as a challenge, officials in five LEAs said that where a missing child case may involve interference by a noncustodial family member, the report cannot be taken by law enforcement unless a court docket number or judge’s order establishing custody is first produced. In one case in one of these LEAs, waiting for court paperwork resulted in a 2- day delay between receiving a report from the parent, and entering the report into NCIC. Officials in two of the seven LEAs said that further steps must be taken to determine custody when the missing child’s parents were never married and do not have a custody agreement, or when there are competing custody orders from different states that must be resolved. These steps can delay reporting into NCIC or investigating the case. OJJDP, NCMEC, and the International Association of Chiefs of Police have taken steps to try to address these issues. For example, in 2006, NCMEC and the International Association of Chiefs of Police, with funding from OJJDP, developed a model missing children’s policy for law enforcement agencies, which agencies could use to establish guidelines and responsibilities for agency personnel in responding to reports of missing children. The model policy contains a provision stating that the LEA will accept reports of missing children when it can be demonstrated that the child has been removed, without explanation, from the child’s usual place of residence, even if custody has not been formally established. OJJDP officials stated that NCMEC currently makes use of the model policy in its Missing and Exploited Children Chief Executive Officer Seminars for police chiefs, sheriffs, and communication center managers. NCMEC requests that participants provide a copy of their agency’s policy on missing children in advance of the seminar, and NCMEC will review the policies and offer suggestions for improvement or refer the participants to the model policy developed by NCMEC and the International Association of Chiefs of Police. In 2009, NCMEC also updated guidance for parents and attorneys addressing family abductions, emphasizing in several places the necessity for law enforcement to report to NCIC within 2 hours, even if custody has not yet been determined. Officials from six of the nine LEAs we interviewed reported that difficulty in obtaining information about missing children who are in the child welfare system (which includes individuals in the care of foster-care group homes) may delay reporting to NCIC or the investigation of the episode. These officials stated that the foster-care group homes do not always collect information—such as the child’s height and weight or parental information—that law enforcement needs to complete a missing person report or the mandatory fields in NCIC. Officials from three LEAs stated that while the lack of such information from the foster-care group home does not prevent the initial reporting to NCIC, the lack of additional information—such as a recent photo of the child—may delay the investigation of a missing child because law enforcement must spend time obtaining the necessary information. Furthermore, officials from three of the six LEAs that raised coordination with child welfare agencies as a challenge said that certain practices of foster-care group homes may result in reporting delays. For example, these officials stated that personnel from foster-care group homes sometimes reported the same incident multiple times to law enforcement, which would require law enforcement personnel to determine whether the existing record in NCIC was closed and could be removed from the system in order to enter the most recent reported incident, or whether the new report was the same as the prior report that had already been entered into NCIC. In one LEA, officials stated that in one week, they had received approximately 10 such duplicate reports of missing children, the majority coming from a single foster-care group home. Officials from one LEA stated that some of the foster-care group homes in the jurisdiction do not always inform law enforcement when a child has been located, thus requiring law enforcement, when receiving a new report for the same child, to conduct research into whether a prior case should have been closed before entering a new record. Officials from the three child welfare agencies we contacted in three of the four states where LEA officials reported challenges in coordinating with child welfare agencies noted that in some cases, foster-care group homes may not have the information law enforcement needs to enter reports of missing children into NCIC, but stated that this situation does not occur very frequently. The officials said that ensuring that a recent photograph of a child is available has been a challenge and that they are working to have a recent photograph available for each child under their care. The officials also acknowledged that their law enforcement partners have raised concerns about foster-care group homes filing multiple reports for the same missing child episode and about some child welfare personnel not informing law enforcement when a child has been located. Officials from two of the child welfare agencies stated that high staff turnover among child welfare personnel may be a reason why some personnel do not know how to best coordinate with law enforcement. According to these officials, child welfare agencies may need to provide additional training and oversight to ensure that child welfare personnel understand clearly when a child should be reported missing to law enforcement and communicate in a timely manner with law enforcement officials to inform them when children are located or return. DOJ, NCMEC, and the Child Welfare League of America have taken steps to try to assist LEAs and child welfare agencies in addressing these issues. For example, concerns about timely reporting and investigation of children missing from care were highlighted by NCMEC in guidance it issued in 2006 with funding from OJJDP. The guidance states that collaboration between LEAs and child welfare agencies is necessary to ensure that children missing from care are reported to law enforcement, and provides a sample self-assessment for LEAs to use to help them develop policies and procedures to enhance LEAs’ responses to children missing from care. The self-assessment recommends that LEAs discuss with child welfare agencies the type of information LEAs need from child welfare agencies in order to complete a missing person report, and ensure that law enforcement officers have a way to access child welfare data or caseworkers 24 hours a day, 7 days a week. The Child Welfare League of America, in partnership with NCMEC in 2005, developed guidelines for standardized child welfare intake forms to ensure information necessary for NCIC entry is routinely maintained by foster-care providers. DOJ’s Office of Community Oriented Policing Services in 2006 also funded development of a guide focusing on juvenile runaways that recommended that LEAs work with foster-care group home providers to develop joint protocols for reporting and sharing information. The fact that officials from eight of the nine LEAs we contacted reported facing challenges entering missing children information into NCIC within 2 hours due to custody disputes and coordination with child welfare agencies—even in the context of efforts by DOJ to develop and disseminate guidance regarding these issues—raises questions about the extent to which LEAs are well-positioned to comply with the 2-hour entry requirement. According to OJJDP officials, although guidance relating to custody disputes and coordination with child welfare agencies was, for the most part, developed prior to the passage of the 2-hour entry requirement in 2006, OJJDP believes the guidance remains useful in helping LEAs address these challenges, and has not undertaken additional efforts to update it. According to the officials, the guidance is disseminated widely to law enforcement personnel in the field, through national conferences and other mechanisms, and is used in training courses funded by OJJDP and provided by NCMEC. DOJ does not know the extent to which the challenges we identified in our LEA interviews exist across all LEAs. However, CJIS officials told us that due to the limited scope of its audits and the limited investigative expertise of its auditors, CJIS’s Audit Unit would not be in a position to assess local challenges to reporting missing children to NCIC as part of CJIS’s triennial audit cycle. We recognize that CJIS’s Audit Unit may be limited in its ability to conduct a nationwide assessment of the challenges that LEAs face in meeting the 2-hour reporting requirement. We also recognize that when CSAs conduct local audits of each LEA in their respective states every 3 years, they have multiple responsibilities to ensure compliance with all NCIC policies and face resource constraints that may limit their ability to assess local challenges to reporting. However, there are other existing CJIS and OJJDP mechanisms that could be useful for collecting and sharing information about LEA challenges to timely reporting and the ways in which some LEAs have successfully addressed these challenges. For example, the CJIS Advisory Policy Board’s working groups and subcommittees and CJIS’s voluntary annual training for representatives of all CSAs and selected LEAs in each state could be useful for obtaining information on the extent and severity of challenges faced by LEAs. They could also be useful for disseminating information on how LEAs have successfully implemented forms or protocols or collaborated with foster- care group homes to ensure missing children are reported in a timely fashion. In addition, OJJDP could obtain information on challenges to timely reporting and disseminate information on successful efforts to mitigate these challenges in OJJDP-funded training courses for local law enforcement officials. Standards for Internal Control in the Federal Government call for management to identify and analyze the relative risks from internal and external sources associated with achieving the agency’s objectives. Using existing CJIS and OJJDP mechanisms to (1) obtain information on the extent to which LEAs face the types of challenges we identified, as well as other challenges that may be prevalent or significant and (2) share examples of LEA-reported successes to mitigating the challenges, could better position DOJ to carry out its oversight role over NCIC with respect to helping ensure compliance with the 2-hour requirement. CJIS has a responsibility to ensure that missing children records are complete, accurate, and timely to comply with federal requirements and promote law enforcement’s ability to investigate, locate, and provide support to missing children. CJIS’s reliance on CSAs to ensure compliance with the 2-hour entry requirement underscores the importance of CSAs’ triennial audits of all LEAs that enter data into NCIC within their jurisdiction. Evidence from our review of six CSAs raises questions about the consistency and reliability of information from CSA audits on LEA compliance with the 2-hour entry requirement. Therefore, we believe it could be helpful for CJIS and the Board to consider establishing minimum audit standards for assessing compliance with the entry requirement. Such minimum standards could better position CSAs to design audits of LEAs to obtain more consistent and reliable information on LEA compliance with the requirement. This could also help CJIS better accomplish its specific oversight and compliance objectives for timely entry of reports of missing children. Once these standards are established, by reviewing the CSA audit approaches as part of CJIS’s own triennial audits of CSAs, CJIS could help ensure the standards are being met. Because some LEAs we visited continued to identify challenges due to custody disputes and coordination with child welfare agencies that affected their ability to meet the 2-hour entry requirement despite DOJ’s previous efforts to address such challenges, it could be useful for CJIS and OJJDP to consider using existing mechanisms to determine the extent to which LEAs face these and other kinds of challenges and to share approaches that LEAs have taken to mitigate these challenges. Such actions could better position DOJ to carry out its oversight role over NCIC with respect to helping ensure compliance with the 2-hour requirement. We are making the following three recommendations: To increase the likelihood that CJIS is positioned to oversee compliance with the requirement that LEAs enter records of missing children into NCIC within 2 hours, we recommend that the Director of the FBI direct CJIS to consider: In collaboration with CSAs and the Board, establishing minimum standards that provide CSAs guidance on assessing compliance with timely entry requirements, including applying the 2-hour criterion and how to sample missing children records; and Ensuring that in future triennial audits, CJIS assesses the extent to which CSA audit programs adhere to the minimum standards. To increase the likelihood that LEAs are better positioned to comply with the requirement to enter missing children records into NCIC within 2 hours, we recommend that the Director of the FBI and the Administrator of OJJDP consider opportunities to use existing mechanisms to obtain information on the extent to which LEAs face challenges—such as custodial determinations and coordination with child welfare agencies—in reporting missing children to NCIC, and share examples of successful efforts to mitigate these challenges. We provided a draft of this report to DOJ for its review and comment. We received written comments from the FBI, which are reproduced in full in appendix I. The comments focused on actions the FBI plans to take, to recommend that the CJIS Advisory Policy Board revise its policy so that agencies found to be non-compliant with the 2-hour requirement are referred immediately for sanctions. We did not recommend this as part of our review, however, and so cannot address the extent to which it will impact law enforcement’s ability to comply with the 2-hour requirement. Because DOJ’s comment letter did not state DOJ’s position on our recommendations, we engaged in discussions and e-mail exchanges with DOJ officials and on June 7 the Department’s audit liaison confirmed that the Department concurred with all three recommendations. On May 12, the Unit Chief of CJIS’s Audit Unit provided oral comments regarding our first two recommendations. Specifically, he stated that CJIS plans to suggest that the Board consider and approve our first two recommendations—establishing minimum audit standards for assessing compliance with the 2-hour requirement and assessing adherence to the standards in future CJIS audits. In a June 7 email, DOJ’s audit liaison stated that during meetings in fall 2011, CJIS, through the Advisory Policy Board, plans to solicit the law enforcement community’s input on our third recommendation regarding challenges to timely entry. Specifically, according to DOJ’s audit liaison, CJIS plans to obtain information regarding the challenges of entering missing children reports into NCIC in a timely manner, request examples of successful efforts to mitigate the challenges presented and, among other things, document the lessons learned so that they can be shared among the law enforcement community. Furthermore, the liaison stated that OJJDP will include the subject of timely reporting in at least six training sessions for local law enforcement that OJJDP will sponsor over the next fiscal year. We believe these steps would address the intent of our recommendations. Because CJIS and OJJDP plan to take these steps, we redirected our first two recommendations to the Director of the FBI, and our third recommendation to both the Director of the FBI and the Administrator of OJJDP, rather than the Attorney General. In commenting on the draft, the Unit Chief of CJIS’s Audit Unit reported that CJIS shares responsibility for implementing and monitoring compliance with the 2-hour requirement with the Board. Thus, we have modified language in the objective and in the body of the report to reflect this shared responsibility. Finally, the FBI provided technical comments which we incorporated into the report, as appropriate. As agreed with your offices, we plan no further distribution of this report until 30 days from its date, unless you publicly announce its contents earlier. At that time, we will send copies of this report to the Attorney General, selected congressional committees, and other interested parties. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any further questions about this report, please contact me at (202) 512-8777 or larencee@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in app. II. Eileen R. Larence, (202) 512-8777 or larencee@gao.gov. In addition to the contact named above, Evi Rezmovic, Assistant Director; Tom Jessor; Heather May; Susan Czachor; Keesha Egebrecht; Sharanjit Singh; Bill Crocker; Janet Temko; Amanda Miller; Linda Miller; Labony Chakraborty; and Cheron Green made significant contributions to this report.

Summary: Missing children who are not found quickly are at an increased risk of victimization. The National Child Search Assistance Act, as amended, requires that within 2 hours of receiving a missing child report, law enforcement agencies (LEAs) enter the report into the Department of Justice's (DOJ) National Crime Information Center (NCIC), a clearinghouse of information instantly available to LEAs nationwide. DOJ's Criminal Justice Information Services (CJIS), the CJIS Advisory Policy Board (the Board), and state criminal justice agencies share responsibility for overseeing this requirement. As requested, GAO examined (1) CJIS's and the Board's efforts to implement and monitor compliance with the requirement; and (2) selected LEA-reported challenges with timely entry and DOJ's actions to assist LEAs in addressing them. GAO reviewed documents, such as agency guidelines, and interviewed officials from DOJ, six state criminal justice agencies, and nine LEAs selected in part based on missing children rates. The results are not generalizable to all states and LEAs, but provided insights on this issue. CJIS and the Board have taken steps to help ensure implementation of the 2-hour entry rule, but could strengthen their oversight to better assure compliance with the rule. Starting in 2007, CJIS: (1) informed all state criminal justice agencies that LEAs will have 2 hours to enter reports of missing children into NCIC once they have collected the required data (e.g., child's biographical information); (2) provided guidance on how LEAs could document compliance with the rule; and (3) informed state criminal justice agencies that the Board had authorized CJIS to begin assessing compliance with the rule in audits starting in 2009. To help ensure compliance among all NCIC users, CJIS and the Board require state criminal justice agencies to audit all LEAs in the state that enter data into NCIC. However, CJIS and the Board have not taken steps to establish minimum audit standards for state criminal justice agencies to use in assessing LEAs' compliance with the 2-hour rule. In the absence of such standards, the selected six state criminal justice agencies GAO contacted used varied approaches to assess LEAs' compliance. For example, two were not using the 2-hour criterion, and the number of missing children records the six agencies reviewed to assess timeliness ranged from all records in one state to no records in another. The fact that the state agencies did not consistently apply the 2-hour criterion to review a sample of missing children records raises questions about the reliability of the information the agencies collect on LEA compliance. Establishing minimum standards for state agency audits could help provide CJIS with reasonable assurance that the audits contain reliable information on LEA compliance. Officials from eight of nine LEAs GAO contacted reported challenges to entering information on missing children into NCIC within 2 hours; CJIS and the Office of Juvenile Justice and Delinquency Prevention (OJJDP) could use existing mechanisms to obtain and share information on challenges. Seven LEAs reported challenges determining whether a child is missing when there are custodial disputes. Six LEAs reported challenges obtaining information from child welfare agencies on missing children in the child welfare system. Officials from child welfare agencies in areas where LEAs reported this challenge said that they may not always have the information LEAs need, and are taking steps to ensure timely communication between their staff and LEAs. In association with the National Center for Missing and Exploited Children and other stakeholders, in 2006 OJJDP developed (1) a model policy stating that LEAs will accept reports of missing children even when custody has not been established and (2) sample self-assessments so LEAs could enhance their responses to missing children in the child welfare system. However, eight of the nine LEAs stated that these challenges persist. DOJ does not know the extent of these challenges across all LEAs and has limited capability to conduct such an assessment. By using existing CJIS and OJJDP mechanisms--such as CJIS's training for state agencies and OJJDP-funded training for LEAs--to obtain information on the extent to which LEAs face these and other challenges and provide examples of how some LEAs have mitigated the challenges, DOJ could be better positioned to carry out its oversight of NCIC with respect to assuring compliance with the 2-hour rule. GAO recommends that CJIS and the Board consider establishing minimum standards for states to use to monitor compliance with the 2-hour rule and CJIS and OJJDP use existing mechanisms to obtain and share information on LEA challenges and successful efforts to mitigate them. DOJ concurred.