VA provides health care and other benefits to veterans in recognition of their service to our country. As of July 1, 1997, 26 percent of the nation’s population—approximately 70 million persons who are veterans, veterans’ dependents, or survivors of deceased veterans—was potentially eligible for VA benefits and services, such as health care delivery, benefit payments, life insurance protection, and home mortgage loan guarantees. VA operates the largest health care delivery system in the United States and guarantees loans on about 20 percent of the homes in the country. In fiscal year 1997, VA spent more than $17 billion on medical care and processed more than 40 million benefit payments totaling more than $20 billion. The department also provided life insurance protection through more than 2.5 million policies that represented about $24 billion in coverage at the end of fiscal year 1997. In providing these benefits and services, VA collects and maintains sensitive medical record and benefit payment information for millions of veterans and their dependents and survivors. VA also maintains medical information for both inpatient and outpatient care. For example, the department records admission, diagnosis, surgical procedure, and discharge information for each stay in a VA hospital, nursing home, or domiciliary. VA also stores information concerning health care provided to and compensation received by ex-prisoners of war. In addition, VA maintains information concerning each of the guaranteed or insured loans closed by VA since 1944, including about 3.5 million active loans. VA relies on a vast array of computer systems and telecommunication networks to support its operations and store the sensitive information it collects in carrying out its mission. Three centralized data centers—located in Austin, Texas; Hines, Illinois; and Philadelphia, Pennsylvania—maintain the department’s financial management systems; process compensation, pension, and other veteran benefit payments; and manage the veteran life insurance programs. In addition to the three centralized data centers, the Veterans Health Administration (VHA) operates 172 hospitals at locations across the country that operate local financial management and medical support systems on their own computer systems. The Austin Automation Center maintains VA’s departmentwide systems, including centralized accounting, payroll, vendor payment, debt collection, benefits delivery, and medical systems. In fiscal year 1997, VA’s payroll was almost $11 billion and the centralized accounting system generated more than $7 billion in additional payments. The Austin Automation Center also provides, for a fee, information technology services to other government agencies. The center currently processes a workers compensation computer application for other federal agencies and plans to expand the computing services it provides to federal agencies. The other two centralized data centers support VA’s Veterans Benefits Administration (VBA) programs. The Hines Benefits Delivery Center processes information from VA systems that support the compensation, pension, and education applications for VBA’s 58 regional offices. The Philadelphia Benefits Delivery Center is primarily responsible for supporting VA’s life insurance program. In addition, VHA hospitals operate local financial management and medical support systems on their own computer systems. The medical support systems manage information on veteran inpatient and outpatient care, as well as admission and discharge information, while the main medical financial system—the Integrated Funds Distribution, Control Point Activity, Accounting and Procurement (IFCAP) system—controls most of the $17 billion in funds that VA spent on medical care in fiscal year 1997. The IFCAP system also transmits financial and inventory information daily to the Financial Management System in Austin. The three VA data centers, as well as the 172 VHA hospitals, 58 VBA regional offices, and the VA headquarters office, are all interconnected through a wide area network. All together, VA’s network serves more than 40,000 on-line users. Our objective was to evaluate and test the effectiveness of general computer controls over the financial systems maintained and operated by VA at its Austin, Hines, and Philadelphia data centers as well as selected VA medical centers. General computer controls, however, also affect the security and reliability of nonfinancial information, such as veteran medical, loan, and insurance data, maintained at these processing centers. At the Austin Automation Center and VA medical centers in Dallas and Albuquerque, we evaluated controls intended to protect data and application programs from unauthorized access; prevent the introduction of unauthorized changes to application and provide segregation of duties involving application programming, system programming, computer operations, security, and quality assurance; ensure recovery of computer processing operations in case of a disaster or other unexpected interruption; and ensure that an adequate computer security planning and management program is in place. The scope of our work at the Hines and Philadelphia benefits delivery centers was limited to (1) evaluating the appropriateness of access granted to selected individuals and computer resources, (2) assessing efforts to monitor access activities, and (3) examining the computer security administration structure. We restricted our evaluation at the Hines and Philadelphia benefits delivery centers because VA’s OIG was planning to perform a review of other general computer controls at these sites during fiscal year 1997. To evaluate computer controls, we identified and reviewed VA’s information system general control policies and procedures. Through this review and discussions with VA staff, including programming, operations, and security personnel, we determined how the general computer controls were intended to work and the extent to which center personnel considered them to be in place. We also reviewed the installation and implementation of VA’s operating system and security software. Further, we tested and observed the operation of general computer controls over VA’s information systems to determine whether they were in place, adequately designed, and operating effectively. To assist in our evaluation and testing of general computer controls, we contracted with Ernst & Young LLP. We determined the scope of our contractor’s audit work, monitored its progress, and reviewed the related work papers to ensure that the resulting findings were adequately supported. We performed our work at the VA data centers in Austin, Hines, and Philadelphia; the VA medical centers in Dallas and Albuquerque; and VA headquarters in Washington, D.C., from October 1997 through January 1998. Our work was performed in accordance with generally accepted government auditing standards. VA provided us with written comments on a draft of this report, which are discussed in the “Agency Comments” section and reprinted in appendix I. A basic management objective for any organization is to protect data supporting its critical operations from unauthorized access, which could lead to improper modification, disclosure, or deletion. Our review of VA’s general computer controls found that the department was not adequately protecting financial and sensitive veteran medical and benefit information. Specifically, VA did not adequately limit the access granted to authorized VA users, properly manage user IDs and passwords, or routinely monitor access activity. As a result, VA’s computer systems, programs, and data are at risk of inadvertent or deliberate misuse, fraudulent use, and unauthorized alteration or destruction occurring without detection. We also found that VA had not adequately protected its systems from unauthorized access from remote locations or through the VA network. The risks created by these security issues are serious because in VA’s interconnected environment, the failure to control access to any system connected to the network also exposes other systems and applications on the network. Due to the sensitive nature of the remote access and network control weaknesses we identified, these issues are described in a separate report with limited distribution issued to you today. A key weakness in VA’s internal controls was that the department was not adequately limiting the access of VA employees. Organizations can protect information from unauthorized changes or disclosures by granting employees authority to read or modify only those programs and data that are necessary to perform their duties. VA, however, allowed thousands of users to have broad authority to access financial and sensitive veteran medical and benefit information. At Austin, for example, the security software was implemented in a manner that provided all of the more than 13,000 users with the ability to access and change sensitive data files, read system audit information, and execute powerful system utilities. Such broad access authority increased the risk that users could circumvent the security software, and presented users with an opportunity to alter or delete any computer data or program. The director of the Austin Automation Center told us that his staff had restricted access to the sensitive data files, system audit information, and powerful system utilities that we identified. In addition, we found several other examples where VA did not adequately restrict the access of legitimate users, including the following. At both the Hines and Philadelphia centers, we found that system programmers had access to both system software and financial data. This access could allow the programmers to make changes to financial information without being detected. At the Hines center, we also identified 18 users in computer operations who could update sensitive computer libraries. Update access to these libraries could result in the security software being circumvented with the use of certain programs to alter or delete sensitive data. At the Dallas center, we determined that 12 computer support personnel had access to all financial and payroll programs and data. Although these support staff need access to certain programs, providing complete access weakens the organization’s ability to ensure that only authorized changes are allowed. At the Austin center, we found more than 100 users who had an access privilege that provided the ability to bypass security controls and enabled them to use any command or transaction. Access to this privilege should be limited to use in emergencies or for special purposes because it creates a potential security exposure. The director of the Austin Automation Center told us that the privilege that provided users the opportunity to bypass security controls had been removed from all individual user IDs. The VBA CIO also said that a task force established to address control weaknesses had evaluated the inappropriate access that we identified at the Hines and Philadelphia benefits delivery centers and made recommendations for corrective measures. We also found that VA was not promptly removing access authority for terminated or transferred employees or deleting unused or unneeded IDs. At the Dallas and Albuquerque centers, we found that IDs belonging to terminated and transferred employees were not being disabled. We identified over 90 active IDs belonging to terminated or transferred employees at Dallas and 50 at Albuquerque.