Recognizing the need to modernize its IT systems, FBI proposed a major technology upgrade plan to Congress in September 2000. FBI’s Information Technology Upgrade Project, which FBI subsequently renamed Trilogy, was FBI’s largest automated information systems initiative to date. Trilogy consisted of three parts: (1) the Information Presentation Component (IPC) to upgrade FBI’s computer hardware and software, (2) the Transportation Network Component (TNC) to upgrade FBI’s communication network, and (3) the User Application Component (UAC) to upgrade and consolidate FBI’s five most important investigative applications. To expedite the contracting process, FBI entered into an interagency agreement with GSA to support FBI’s use of the FEDSIM Millennia governmentwide acquisition contract for the implementation of Trilogy’s three functional components, IPC, TNC, and UAC. FEDSIM, serving as contracting agency, was to provide all contract administrative services necessary to support the task orders. Because the Trilogy project was so large, DOJ required FBI to use two contractors for the three Trilogy components. FBI combined the IPC and TNC portions of Trilogy into one task order because both components involved physical infrastructure enhancements. IPC provided for new desktop computers, servers, and commercial-off-the-shelf automation software, including Web-browser and e-mail to enhance usability by the agents. TNC upgraded the complete communication infrastructure, including high-capacity wide-area and local- area networks, authorization security, and encryption of data transmission and storage. The IPC/TNC task order was awarded in May 2001 to DynCorp (now Computer Sciences Corporation (CSC)). The IPC/TNC upgrades would provide the physical infrastructure needed to run the applications developed under UAC, the third Trilogy component. The third component of Trilogy—the UAC task order—was awarded in June 2001 to Science Applications International Corporation (SAIC). The goal of UAC was to replace FBI’s paper case files with electronic files and improve efficiency. The heart of the UAC portion became the development of the VCF system to replace the obsolete Automated Case Support system, FBI’s primary investigative application that uploads and stores case files electronically. The above two Trilogy contracts were awarded on a cost-plus-award fee basis for labor charges, meaning that the contractor’s costs incurred are reimbursed and fees may be awarded to the contractor based on performance. The FAR states that cost-reimbursement type contracts may only be used if appropriate government surveillance during performance will provide reasonable assurance that efficient methods and effective cost controls are used. The aspects of these contracts related to the purchase of equipment were based on fixed-price arrangements, meaning that a set price for the equipment is agreed to up front. In addition to the two primary contracts discussed above, FBI awarded two additional contracts to assist with the technical oversight, monitoring, and integration of the two primary Trilogy contracts described above. The first of the two additional contracts was awarded in February 2001, also through GSA FEDSIM, to Mitretek for Systems Engineering and Technical Assistance (SETA) services. Under the SETA contract, Mitretek was required to assist FBI with a wide array of tasks, including program and contract management, fiscal and budgetary oversight, cost estimating, and several other technical aspects of the Trilogy project. The second of the two additional contracts was awarded to SAIC for the integration of the three Trilogy components. In July 2004, the VCF was scaled back to the Initial Operating Capability and the remaining deliverables were cancelled after the (1) initial deliverable was rejected by FBI and (2) VCF was determined to be infeasible and cost prohibitive to implement as originally envisioned. After a 90-day limited pilot that ended in March 2005, VCF offline and the pilot results were then to be analyzed by FBI for requirements development of its new electronic information management system initiative. In August 2005, FBI released a solicitation for proposals to develop FBI’s new electronic information management system, referred to as Sentinel. The solicitation was sent to more than 40 eligible companies under a National Institutes of Health governmentwide acquisition contract. Similar to VCF, the goal of Sentinel is to replace FBI’s legacy case management capabilities with an integrated, paperless file management and workflow system. According to FBI policy, assets valued at $1,000 or more, as well as certain sensitive items, such as firearms, laptop computers, and central processing units, are considered to be “accountable” assets, regardless of cost, and must be accounted for individually in FBI’s Property Management Application (PMA). PMA is an automated management system that allows FBI to track the cost, location, and history of its accountable assets. PMA includes a variety of data fields to identify each item, including the acquisition date, received date, acquisition cost, last inventory date, bar code number, serial number, cost center for the office where the item is located, description of the item, and other information. Ongoing deficiencies in FBI’s management of property have been identified by DOJ’s OIG and FBI’s independent financial statement auditor. In August 2002, the DOJ OIG issued a report that revealed significant problems with FBI’s management of laptop computers, including findings that FBI did not reconcile its property management data with purchase data from its accounting system, did not have an inventory record for accountable assets not in PMA that were lost or stolen, and could not verify whether the number of items purchased agreed with the number of items recorded in PMA. Additionally, in September 2004, the DOJ OIG reported on weaknesses in FBI’s controls over nonaccountable property at FBI’s Baltimore field office after an employee pleaded guilty to the theft and sale of FBI photography equipment. Annually, since fiscal year 1999, FBI’s independent financial statement auditors have identified internal control weaknesses in the area of property management. They specifically reported that FBI needed to improve its procedures related to the timely and accurate recording, reconciling, and reporting of property and equipment in PMA. Internal control is a major part of managing any organization. As required by 31 U.S.C. 3512(c),(d), commonly referred to as the Federal Managers’ Financial Integrity Act of 1982, the Comptroller General issues standards for internal control in the federal government. These standards provide the overall framework for establishing and maintaining internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. According to these standards, internal control comprises the plans, methods, and procedures used to meet missions, goals, and objectives. Internal control is the first line of defense in safeguarding assets and preventing and detecting fraud and errors. Internal control, which is synonymous with management control, helps government program managers achieve desired results through effective stewardship of public resources. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives and help ensure that actions are taken to address risks. Control activities are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and achieving effective results. They include a wide range of diverse activities. Some examples of control activities include (1) establishing physical controls over vulnerable assets to reduce the risk of loss or unauthorized use and periodically counting and comparing such assets to control records; (2) ensuring that documentation and records are properly managed and maintained and that transactions are appropriately documented and readily available for examination; (3) assigning accountability for the custody and use of resources and records to help reduce the risk of errors, fraud, misuse, or unauthorized alteration; and (4) implementing management level reviews at the functional level to ensure that appropriate control activities are being employed, such as reconciliations of summary information to supporting detail. FBI’s review and approval process for Trilogy contractor invoices, which was carried out by a review team consisting of officials from FBI, GSA, and Mitretek, did not provide an adequate basis to verify that goods and services billed were actually received by FBI or that payments were for allowable costs. This occurred in part because responsibility for the review and approval of invoices was not clearly defined in the Mitretek contract and in the interagency agreements related to Trilogy project oversight. In addition, contactor invoices frequently lacked detailed information required by the contracts and other additional information that would be needed to facilitate an adequate invoice review process. Despite this, invoices were paid without requests for additional supporting documentation necessary to determine the validity of the charges. These weaknesses in FBI’s review and approval process made the agency highly vulnerable to payment of unallowable or questionable contractor costs. While the review and approval process differed for each contractor and type of invoice charge, in general the process carried out by the review team lacked key procedures to reasonably ensure that goods and services billed were actually received by FBI or that the amounts billed and paid were for allowable costs. Internal control guidance requires agencies to establish controls that reasonably ensure, among other things, that funds, property, and other assets are safeguarded against waste, loss, unauthorized use, or misappropriation. Contractor invoices included costs for labor, including related overhead costs; travel; other direct costs (ODC); subcontractor labor; and purchased equipment. Table 1 provides a summary of total payments made to Trilogy contractors for these categories, as well as total Trilogy costs in each category. Each member of the review team—which included personnel from FBI; GSA, the contracting agency; and Mitretek—was to perform some level of review of the invoices submitted by the contractors for payment. During the project, each of the review team members, at times, worked on-site with the contractors.