In May 2001, the FBI initiated a major IT upgrade project known as Trilogy. Trilogy consisted of three parts: (1) the Information Presentation Component (IPC) to upgrade FBI’s computer hardware and software, (2) the Transportation Network Component (TNC) to upgrade the FBI’s communication network, and (3) the User Application Component (UAC) to upgrade and consolidate the FBI’s five most important investigative applications. The IPC component provided for new desktop computers, servers, and commercial-off-the-shelf automation software, including Web-browser and e-mail software to enhance usability by the agents. The TNC component called for upgrading the complete communication infrastructure. These upgrades were expected to provide the physical infrastructure that would run the applications that were to be developed under the UAC component of the Trilogy project to replace the FBI’s paper case files with electronic files and improve efficiency and replace the obsolete Automated Case Support system, the FBI’s primary investigative application that uploads and stores case files electronically. Our 2006 audit of the project’s costs identified significant internal control deficiencies over administration of contracts and interagency agreements, the processing (review, approval, and payment) of invoices, and the accountability over assets purchased under the project. More specifically, we reported that the FBI’s review and approval process for contractor invoices did not provide an adequate basis for verifying that goods and services billed were actually received by the FBI or that payments were for allowable costs. This occurred in part because responsibility for the review and approval of invoices was not clearly defined in the interagency agreements related to the Trilogy project and because contractors’ invoices frequently lacked the detailed supporting documentation necessary for an adequate review of invoice charges. During our audit, we identified more than $10 million in questionable contractor costs paid by the FBI for the Trilogy project. With respect to property, we reported that the FBI: (1) did not adequately maintain accountability for purchased computer equipment; (2) relied extensively on contractors to account for Trilogy assets while they were being purchased, warehoused, and installed; (3) did not establish controls to verify the accuracy and completeness of contractors’ records on which the FBI was relying; (4) did not ensure that only the items approved for purchase were acquired by the contractors, and that the bureau received all those items; and (5) did not establish adequate physical control over the assets. As a result of these deficiencies, we identified more than 1,200 pieces of missing equipment that we estimated to be worth more than $7.5 million. We made 22 recommendations to the FBI in our 2006 report on Trilogy. Of the 22 recommendations, 17 were focused on developing agencywide policies and procedures to address internal control weaknesses in the FBI’s procurement and contract administration processes. The remaining five recommendations were specific to the Trilogy project and were related to contractor overpayments and accountable property. The FBI discontinued the virtual case file component of its Trilogy project in March 2005, after it was determined to be infeasible and cost prohibitive to implement as originally envisioned. FBI’s Sentinel project was approved in July 2005 and was to succeed and expand on elements of the Trilogy project, namely to provide the FBI with a modern, automated investigative case-management system. The Sentinel project management office (PMO) had designed and implemented policies and procedures that assigned specific invoice-review responsibilities and required Sentinel contractors to provide detailed support for all invoiced amounts and to obtain advance approval from the Sentinel PMO for travel, overtime, and other direct costs. With respect to Sentinel equipment, we reported that the Sentinel PMO had established policies and procedures specific to the Sentinel project to ensure Sentinel’s equipment purchases were properly authorized and that received property was timely inspected and entered into the FBI’s Property Management Application (PMA). However, we did identify some additional opportunities for the Sentinel PMO to improve controls over purchased equipment for the Sentinel project. We made five recommendations to the FBI related to Sentinel. The corrective actions developed by the FBI were sufficient to address 21 of the 22 Trilogy recommendations and all 5 of the Sentinel recommendations we made in our prior reports. The FBI substantially addressed 17 Trilogy recommendations related to contract administration, invoice processing, and property accountability by establishing or revising policies and procedures, 4 by contracting for follow-up audits of the Trilogy costs, and the 5 Sentinel recommendations by revising Sentinel policies and procedures. Of the 27 prior recommendations, 17 focused on establishing, revising, or reinforcing policies and procedures with FBI- wide applicability. We found that the FBI had sufficiently developed, revised, or updated these policies and procedures as we recommended. For example, in response to our recommendation that the FBI revise its policies and procedures to require that accountable assets be entered into PMA immediately upon receipt rather than within the prior 30-day time frame, the FBI issued a new policy that required that accountable property be recorded in PMA within 48 hours of being received. Appendix II provides information on each of the 27 Trilogy and Sentinel recommendations and the specific corrective actions developed by the FBI. We also made four recommendations in our Trilogy report related to the recovery of overpayments and reimbursement of questionable costs from Trilogy contractors. In response to these recommendations, the Defense Contract Audit Agency (DCAA), an independent third party, was engaged to perform post audit reviews of contractor billings for the Trilogy project. DCAA conducted separate audits of the billings submitted by the two prime contractors, Computer Sciences Corporation (CSC) and Science Applications International Corporation (SAIC), as well as the billings submitted by the numerous subcontractors, and identified over $18 million in questioned costs. DCAA defines questioned costs as those costs that are not acceptable for negotiating a fair and reasonable contract price. DCAA’s audits included reviewing the areas with potential overpayments we had identified as well as assessing if other identified questionable costs should be reimbursed. The most significant questioned costs were costs incurred outside the effective dates of temporary labor agreements, missing supporting documentation, application of incorrect billing rates, unapproved timesheets, unapproved overtime, and subcontractor overbillings. The one recommendation that the FBI had not fully addressed from our Trilogy report recommended that the FBI investigate the 1,205 assets that we identified as missing, lost, or stolen and determine whether any confidential or sensitive information may be exposed to unauthorized users, and identify any patterns related to the equipment that could necessitate a change in FBI policies and procedures. These assets consisted of a variety of information technology items, including desktop computers, servers, and laptops that could potentially contain confidential or sensitive information that could be exposed to unauthorized users. In February 2011, FBI officials provided documentation accounting for the status of all but 134 assets, including desktop computers, laptops, and servers that could contain sensitive information. With regard to the 134 assets, the FBI stated that all of these assets had a useful life of 7 years or less and that if they were not already returned or destroyed, they are now obsolete and that spending more time or resources to search for the obsolete equipment would be wasteful. Instead the FBI is focused on implementing a new property management system, and incorporating property management lessons learned from the Trilogy project. However, FBI officials also stated they would make the necessary entries to properly record any of the remaining 134 assets for which they subsequently determine the status. Although the FBI developed or revised policies and procedures in response to 17 of our prior recommendations, our testing to assess their implementation FBI-wide identified possible issues in certain areas. In our testing of the four recommendations dealing with interagency agreements and contracts, we found that they were effectively implemented, but we identified a new issue unrelated to our prior recommendations. In our implementation testing for the remaining 13 corrective actions, we identified indications of implementation issues for 3 of them. As shown in table 1, our tests related to policies and procedures over interagency agreements and contracts indicated that the FBI had effectively implemented these corrective actions. In the course of testing the interagency agreement sample transactions, we identified a new issue unrelated to our prior recommendations. Specifically, the Federal Acquisition Regulation (FAR) requires that any interagency agreement entered into under the authority of the Economy Act, 31 U.S.C. § 1535, be supported by a Determination and Findings document. The Determination and Findings form identifies the responsible agencies to the agreement (requesting agency and servicing agency), is prepared by the requesting agency, and identifies the goods or services that are to be provided by the servicing agency. In addition, it documents the requesting agency’s determination that, among other things, the use of an interagency acquisition is in the best interest of the government, and the supplies or services cannot be obtained as conveniently or economically by contracting directly with a private source. The FAR also requires that the requesting agency complete the Determination and Findings form before placing an order for supplies or services with another government agency. In reviewing our statistical sample of 55 interagency agreements with regard to implementation of our prior recommendations, we identified 54 interagency agreements that were required to comply with FAR requirements related to Determination and Findings and found that 15 of them did not comply with these FAR requirements. For these 15 cases, the required Determination and Findings forms supporting the execution of interagency agreements between the FBI and other federal entities were prepared and signed after the interagency agreements were executed—in some cases more than a year later.  Three Determination and Findings forms were signed less than 3 months after the date of the related purchase orders were issued.  One Determination and Findings form was signed between 3 months and 6 months after the date of the related purchase order was issued.  Seven Determination and Findings forms were signed between 6 months and 1 year later.  Four Determination and Findings forms were signed more than a year after the date of the related purchase orders.