VA’s mission is to serve America’s veterans and their families and to be their principal advocate in ensuring that they receive medical care, benefits, and social support in recognition of their service to our nation. VA, headquartered in Washington, D.C., is the second largest federal department and reported it had over 230,000 employees as of September 30, 2007, including physicians, nurses, counselors, statisticians, computer specialists, architects, and attorneys. VA has three major line organizations—VHA, VBA, and NCA—and field facilities throughout the United States. VHA has 21 Veterans Integrated Service Networks (VISN) that oversee medical center activities within their areas, which may cover one or more states. VA provides employees, contractors, volunteers, and students with a wide range of IT equipment, including desktop and laptop computers, monitors and printers, personal digital assistants, unit-level workstations, local area networking equipment, and medical equipment with memory and data processing/communication capabilities. By the start of fiscal year 2008, VA had centralized its IT function at all locations within the realigned OIT. The Assistant Secretary for Information and Technology heads VA’s OIT, serves as the CIO for the department, and is the principal advisor to the Secretary on matters relating to IT management in the department. OIT staff share responsibility for management of IT equipment inventory with property management personnel. Accordingly, it is crucial for the department’s CIO to have the cooperation of property managers to ensure that well-established integrated processes exist for controlling IT inventory. The steps in the IT property management process are key events, which should be documented by an inventory transaction, a financial transaction, or both, as appropriate. Federal records management law, as codified in Title 44 of the U.S. Code and implemented through National Archives and Records Administration (NARA) guidance, requires federal agencies to adequately document and maintain proper records of essential transactions and have effective controls for creating, maintaining, and using records of these transactions. Table 1 provides an overview of VA’s IT property management process. VA has made significant progress in addressing our previous recommendations directed at improving policies and procedures for control of IT equipment and reducing the risk of disclosure of sensitive personal and medical information. As of the end of our field work in July 2008, VA had completed action on 10 of our 12 recommendations from our July 2007 report. VA’s Assistant Secretary for Management and the CIO worked together to draft a revised property management policy in a new VA Handbook 7002, Logistics Management Procedures, which addresses 7 of our 2007 recommendations. This revised policy is an important step in establishing a framework for control of IT equipment. On July 3, 2008, the Assistant Secretary for Management mandated early implementation of this policy, which includes requirements for user-level accountability, time frames for completing Reports of Survey on missing and stolen property, and requirements for strengthening physical security. VA also partially implemented action on one other recommendation and has actions under way to address the remaining recommendation from our 2007 report. Successful implementation of these efforts will be key to improving controls over VA’s IT equipment. VA also made progress implementing recommendations from our 2004 report related to personal property and equipment management. VA completed action on four of six property- related recommendations in our 2004 report and partially completed action on a fifth recommendation. VA has plans to address the remaining 2004 recommendation. In addition, in response to your concerns about VA- wide controls based on our previous audits, VA required departmentwide physical inventories of IT equipment to be completed by December 31, 2007. OIT monitored the 2007 physical inventory effort for IT equipment and reported that as of May 15, 2008, VA was unable to locate approximately 62,800 recorded IT equipment items, of which over 9,800 could have stored sensitive information. The CIO formed a “tiger team” to monitor efforts under the Report of Survey system and to help ensure that Reports of Survey are completed in a timely manner. To address recommendations in our July 2007 report, VA completed action on 10 of our 12 recommendations, partially implemented actions on one other recommendation, and has actions under way to address the remaining recommendation. VA actions on our 2007 report recommendations included the establishment of specific time frames for finalizing Reports of Survey, granting OIT personnel access to the central property database, and holding employees financially liable for lost IT equipment. In addition, VA completed action on four of the six recommendations in our July 2004 report, partially completed action on a fifth recommendation, and has plans to address the remaining recommendation. For example, VA revised its policy through VA Handbook 7127/4, Materiel Management Procedures, to state that sensitive items include IT equipment and named several types of IT equipment items. VA’s revised policy also stated that IT equipment items valued under $5,000 are to be included in physical inventories. Further, VA has drafted policies that provide a framework for strengthening controls over IT equipment, including VA Handbook 7002, Logistics Management Procedures. On July 3, 2008, VA’s Assistant Secretary for Management mandated early implementation of this handbook. Effective implementation of this new policy will be essential to ensuring adequate control and accountability of VA’s IT equipment and any sensitive information residing on that equipment. Table 2 provides a summary of our 2007 and 2004 recommendations and the current status of VA actions. For a more detailed explanation of VA’s actions taken and planned on our recommendations, see appendix II. VA’s 2007 departmentwide inventory initially identified approximately 79,000 missing IT equipment items, underscoring the need to effectively implement the new policies and procedures mandated on July 3, 2008. In the 6 months following completion of the physical inventory, VA facilities undertook efforts to locate or determine reasons for missing items. VA was able to locate several thousand of the missing equipment items. However, as summarized in table 3, on May 15, 2008, OIT reported that VA was unable to locate approximately 62,800 recorded IT equipment items, of which over 9,800 could have stored sensitive information. Because VA does not know what, if any, sensitive information resided on the equipment and when the equipment was lost, notifications to potentially affected individuals could not be made in accordance with OMB guidance. We interviewed VA officials and obtained documentation on the VA-wide inventory; however, we did not validate the results. According to VA, many of the missing items were old equipment and may have been disposed of through VA’s excess property program. However, because VA facilities had not always documented IT equipment disposal for many years, there was no way to determine whether any of the missing items were lost or stolen. Further, during our work, we discovered that not all IT equipment items were included in the departmentwide inventory. Consequently, the numbers of missing items could be higher. For example, VA’s 2007 physical inventory did not include medical equipment with data storage or processing capabilities. In addition, IT equipment items not accounted for in the OIT equipment inventory listing (EIL) were not subject to the 2007 physical inventory at some VA facilities. Further, limited completeness tests we performed as part of our data reliability procedures at case study locations identified some IT equipment items recorded to EILs for organizations other than OIT. Prior to the establishment of OIT, EILs were aligned organizationally and some IT equipment assigned to other EILs had not yet been reassigned to the OIT EIL and, therefore, were omitted from the 2007 physical inventory. We discussed our finding with OIT officials, and they told us that they had met in June 2008 to develop strategies for moving all IT equipment items assigned to other EILs to the OIT EIL. In compliance with VA Handbook 7125, General Procedures, VA personnel submitted Reports of Survey for IT equipment items that were not located during the departmentwide physical inventory and subsequent follow-up investigation. A CIO tiger team was responsible for monitoring the Report of Survey process and helping to ensure that it was completed in a timely manner. Local Boards of Survey were responsible for investigating missing items and approving write-offs of IT equipment items that could not be located during the departmentwide physical inventory. However, as of May 15, 2008, VA had over 43,000 items that were listed on open Reports of Survey and facility personnel were continuing to search for missing items. The 2007 physical inventories were a massive undertaking and required significant effort over several months to resolve discrepancies. Although we would have expected the VA locations that we previously tested to have few, if any, missing items, as of May 15, 2008, 6 of the 12 locations reported from 1,269 to 6,427 missing IT items; 4 locations had from 115 to 863 missing IT items; and only 2 locations had fewer than 100 missing items. A summary of Reports of Survey data on missing IT equipment and the reported original acquisition cost identified in VA’s 2007 physical inventory related to sites we tested in our 2004, 2007, and 2008 audits are presented in appendix IV. Our tests of IT equipment inventory controls at four case study locations, including three VA HCS and VA headquarters, identified continuing control weaknesses related to missing items, lack of accountability, and errors in IT equipment inventory records. VA’s 2007 departmentwide physical inventory effort was intended to establish a reliable IT equipment inventory baseline going forward. Accordingly, our tests excluded from the population of IT equipment thousands of items identified as missing during VA’s 2007 IT physical inventory effort. Given the new baseline, if adequate controls had been in place by the end of this inventory process, we would not have expected to identify missing items, blank data fields, or inaccurate inventory records at our test locations. As previously noted, in July 2008 VA mandated early implementation of revised policy related to control of IT equipment. Although the early implementation of July 2008 policy changes may address IT equipment control weaknesses, this policy was not in effect at the time of our tests.