VA’s mission is to serve America’s veterans and their families and to be their principal advocate in ensuring that they receive medical care, benefits, and social support in recognition of their service to our nation. VA, headquartered in Washington, D.C., is the second largest federal department and has over 235,000 employees, including physicians, nurses, counselors, statisticians, computer specialists, architects, and attorneys. VA carries out its mission through three major line organizations—VHA, Veterans Benefits Administration, and National Cemetery Administration—and field facilities throughout the United States. VA provides services and benefits through a nationwide network of 156 hospitals, 877 outpatient clinics, 136 nursing homes, 43 residential rehabilitation treatment programs, 207 readjustment counseling centers, 57 veterans’ benefits regional offices, and 122 national cemeteries. Our July 2004 report found significant property management weaknesses, including weaknesses in controls over IT equipment items valued at under $5,000 that are required to have inventory control. In that report, we made several recommendations for improving property management, including actions to (1) clarify existing policy regarding sensitive items that are required to be accounted for in the property control records, (2) provide a more comprehensive list of the type of personal property assets that are considered sensitive for accountability purposes, and (3) reinforce VA’s requirement to attach bar code labels to agency personal property. The Assistant Secretary for Information and Technology serves as the CIO for the department and is the principal advisor to the Secretary on matters relating to IT management in the department. Key functions in VA’s IT property management process are performed by IRM and property management personnel. These functions include identifying requirements; ordering, receiving, and installing IT equipment; performing periodic inventories; and identifying, removing, and disposing of obsolete and unneeded IT equipment. Figure 1 illustrates the IT property management process. In general, this is the process we observed at the four VA locations we audited. The steps in the IT property management process are key events, which should be documented by an inventory transaction, financial transaction, or both, as appropriate. Federal records management law, as codified in Title 44 of the U.S. Code and implemented through National Archives and Records Administration (NARA) guidance, requires federal agencies to adequately document and maintain proper records of essential transactions and have effective controls for creating, maintaining, and using records of these transactions. IRM personnel determine IT equipment requirements for a particular VA medical center or headquarters office based on strategic planning, medical center or office needs, specific requests, and budgetary resources. IRM personnel then submit requests to the cognizant Veterans Integrated Service Network (VISN), the CIO, and VA headquarters in Washington, D.C., for approval. For VA medical centers, the VISN generally purchases or leases IT equipment to realize economies of scale, but individual medical centers also may place incidental orders to meet their needs. In addition, headquarters offices may place individual orders or use purchase cards to acquire IT equipment. Medical equipment with IT capability is generally acquired through procurement contracts. When contracting personnel create a purchase order and submit it to the vendor, contracting personnel are required to send a copy of the purchase order to the appropriate property management personnel to notify them of a new order. When the vendor delivers ordered IT equipment to the loading dock, property management warehouse personnel inspect the boxes for visible signs of damage, and after accepting delivery, store IT equipment until they can transfer it to IRM personnel. Warehouse personnel confirm receipt and acceptance in the Integrated Funds Distribution Control Point Activity, Accounting, and Procurement System (IFCAPS), which then notifies the Financial Management System so that payment can be made to the vendor. Once the receipt is confirmed within IFCAPS, warehouse personnel notify IRM personnel of the delivery and arrange a transfer of the equipment to them. Upon transfer, an IRM official signs the receipt document, signifying acceptance of custody for the IT equipment. VA medical center property management personnel use information from the purchase order, including item name, item description, model number, manufacturer, vendor, and acquisition cost, to create property record(s) in the Automated Equipment Management System/Medical Equipment Repair Service (AEMS/MERS) for new IT equipment acquisitions. AEMS/MERS is a general inventory management system that is local to each VA medical center. Headquarters personnel also use purchase order information to enter records of new IT equipment in the Inte-GreatTM Property Manager system. Property management personnel also identify the department responsible for the IT equipment by recording an equipment inventory listing (EIL) code at VA medical centers and a consolidated memorandum receipt (CMR) code at headquarters. Once property records are created, property management personnel generate a bar code label for each piece of IT equipment. IRM personnel may prepare the equipment for issuance to specific users by installing VA-specific software and configurations prior to installation. In addition, VA medical center biomedical engineering personnel may test medical equipment for electrical safety before placing it in service. IRM personnel or, in some cases, contractor personnel deliver new IT equipment to the appropriate service or location for installation. IRM or contractor personnel also remove and replace old IT equipment that has been approved for replacement. At some VA facilities, a bar code label is affixed to a door jam or other physical element of the specific location in which the IT equipment has been installed to document item locations in the property management system. Once the new equipment is installed, IRM or contractor personnel transfer the replaced equipment to an IRM storage room pending disposal. VA policy mandates that each VA facility take physical inventory of its accountable property using one of two methods. The first method determines when the next inventory will be taken based on the accuracy rate for each EIL or CMR during the previous inventory. If an EIL or CMR was found to have an accuracy rate of 95 percent or above, the VA facility may inventory that EIL or CMR in 12 months. If the EIL or CMR has an accuracy rate of less than 95 percent, the VA facility must inventory that EIL or CMR within 6 months. The second method permits physical inventories to be performed on an exception basis. Under this method, a VA facility uses property management system data to identify the item bar codes that were scanned since the last inventory. If items have been scanned since the last inventory, they may be excluded from the current physical inventory. When a VA facility determines that items listed in inventory cannot be located, those items are listed on a Report of Survey and facility personnel convene a Board of Survey. Reports of Survey are provided to medical center VA Police or the Federal Protective Service officers at VA headquarters, as appropriate. The Report of Survey documents the circumstances of loss, damage, or destruction of government property. VA policy mandates that a Board of Survey be appointed when there is a possibility that a VA employee may be assessed pecuniary liability or disciplinary action as a result of loss, damage, or destruction of property and the value of the property involved is $5,000 or more. The Board of Survey reviews the Report of Survey, which identifies IT equipment that is unaccounted for and explains efforts made to account for the missing items. An approved Report of Survey provides necessary support for writing off lost and missing items. For items on the Report of Survey, VA personnel are supposed to update the use status in the property management system from “in-use” to “lost.” Updating the use status allows for the generation of an exception report in case any of the items unaccounted for are subsequently located. An IRM technician originates the request for turn-in of old IT equipment using VA Form 2237, “Request, Turn-In, and Receipt for Property or Services,” or users may submit an electronic form 2237. Pending final approval of VA Form 2237, electronic notification is given to property management and IRM personnel, who use this documentation to ensure that they are removing and disposing of the correct item(s). IRM or contractor personnel transfer the old IT equipment to an IRM storage room for hard drive sanitization and subsequent reuse or disposal. Medical equipment with IT capability is generally traded in to the vendor for upgraded models after medical center IRM personnel have documented that data sanitization procedures were completed. Federal agencies, such as VA, are required to protect sensitive data stored on their IT equipment against the risk of data breaches and thus the improper disclosure of personal identification information, such as names and Social Security numbers. Such information is regulated by privacy protections under the Privacy Act of 1974 and, when information concerns an individual’s health, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and implementing regulations. VA facilities have two options for removing data from hard drives of IT equipment in the excess property disposal process. Under the first option, the VA medical center removes the hard drives from the IT equipment and ships them to a vendor for sanitization (data erasing). The vendor physically destroys any hard drives it cannot successfully erase. The vendor submits certification of hard drive sanitization or destruction to IRM personnel and ships the sanitized hard drives back to the VA facility for disposal. Under the second option, VA IRM personnel perform the procedures to sanitize the hard drives using VA-approved software, such as Data EraserTM. IRM personnel complete VA Form 0751, “Information Technology Equipment Sanitization Certification,” to document the erasing of the hard drives. Hard drives that Data EraserTM software cannot successfully sanitize are held at the VA facility in IRM storage for physical destruction by another contractor at various intervals throughout the year. After data have been removed from the hard drives, the hard drives can be placed back into the IT equipment from which they were previously removed so that the computers can be reused or shipped directly to a VA IT equipment disposal vendor.