This revised policy is an important step in  establishing a framework for control of IT equipment. Successful implementation of these efforts will be key to improving  controls over VA’s IT equipment. OIT monitored the 2007 physical inventory effort for IT equipment  and reported that as of May 15, 2008, VA was unable to locate  approximately 62,800 recorded IT equipment items, of which over 9,800  could have stored sensitive information. VA Has Made Significant Progress in Addressing GAO Recommendations

To address recommendations in our July 2007 report, VA completed action  on 10 of our 12 recommendations, partially implemented actions on one  other recommendation, and has actions under way to address the  remaining recommendation. Effective  implementation of this new policy will be essential to ensuring adequate  control and accountability of VA’s IT equipment and any sensitive  information residing on that equipment. Tests of IT Inventory Controls at Case Study Locations Identified Continuing Weaknesses

Our tests of IT equipment inventory controls at four case study locations,  including three VA HCS and VA headquarters, identified continuing control  weaknesses related to missing items, lack of accountability, and errors in  IT equipment inventory records. As previously noted, in  July 2008 VA mandated early implementation of revised policy related to  control of IT equipment. Although the early implementation of July 2008  policy changes may address IT equipment control weaknesses, this policy  was not in effect at the time of our tests. In addition, we found physical security  weaknesses at IT storage facilities at all four locations. GAO Tests Identified Significant Numbers of Missing IT Equipment Items

Our tests of physical inventory controls from February through May of  2008 identified 50 missing IT equipment items, including 9 medical  equipment items. Because VA does not know  what, if any, sensitive information resided on the equipment, notifications  to potentially affected individuals could not be made. The continuing occurrences of missing items  indicate that underlying control weaknesses have not yet been corrected. Weaknesses in Controls over Hard Drives in the Disposal Process

Although VA requires that hard drives of IT equipment and medical  equipment be sanitized prior to disposal to prevent unauthorized release  of sensitive personal and medical information, we found weaknesses in  the disposal process at each of our test locations that pose a risk that  sensitive personal and medical information could be compromised. Further, VA’s lack of user-level accountability and its failure  to maintain accurate and complete IT inventory records have hindered  efforts to locate missing items. Major contributors to this report are acknowledged in  appendix V.

Appendix I: Objectives, Scope, and Methodology

Given the continuing nature of information technology (IT) equipment  inventory control problems and their significance, the Chairman and  Ranking Member of the House Committee on Veterans’ Affairs,  Subcommittee on Oversight and Investigations asked us to perform  additional follow-up work to determine (1) whether the Department of  Veterans Affairs (VA) has made progress in implementing our prior  recommendations for improving internal control over IT equipment and  (2) the effectiveness of VA’s current internal controls to prevent theft, loss,  or misappropriation of IT equipment. In concert with the Subcommittee request that VA perform a  departmentwide physical inventory of IT assets, we reviewed the results of  VA’s 2007 physical inventory of IT equipment items and VA’s process for  completing Reports of Survey on lost and stolen items. We also  assessed controls over hard drives in the excess property disposal  process, and our investigators made physical security inspections of IT  storage locations at our four case study locations.
Why GAO Did This Study

In July 2004, GAO reported that the six Department of Veterans Affairs (VA) medical centers it audited lacked a reliable property control database and effective inventory policies and procedures. In July 2007, GAO reported that continuing internal control weaknesses over IT equipment at four case study locations at VA resulted in an increased risk of theft, loss, and misappropriation of IT equipment assets. GAO's two reports included 18 recommendations to improve internal control over IT equipment. GAO was asked to perform a follow-up audit to determine (1) whether VA has made progress in implementing GAO's prior recommendations for improving internal control over IT equipment and (2) the effectiveness of VA's current internal controls to prevent theft, loss, or misappropriation of IT equipment. GAO reviewed policies and other pertinent documentation, statistically tested IT equipment inventory controls at four geographically disparate locations, and interviewed VA officials.

What GAO Found

VA has made significant progress in addressing prior GAO recommendations to improve controls over IT equipment. Of the 18 recommendations GAO made in its two earlier reports, VA completed action on 14 recommendations, partially implemented action on 2 recommendations, and is working to address the 2 remaining open recommendations. These recommendations focused on strengthening policies and procedures to establish a framework for accountability and control of IT equipment. If effectively implemented, VA's July 2008 policy changes would address many of the control weaknesses GAO identified. Mandated early implementation of this new policy addresses user-level accountability and requirements for strengthening physical security. In addition, to determine the extent of inventory control weaknesses over its IT equipment, VA performed a departmentwide physical inventory in 2007. However, as of May 15, 2008, VA reported that it could not locate about 62,800 IT equipment items, of which 9,800 could have stored sensitive information. Because VA does not know what, if any, sensitive information resided on the equipment, potentially affected individuals could not be notified. GAO's statistical tests of IT equipment inventory controls from February through May 2008 at four locations identified continuing control weaknesses, including missing items, lack of accountability, and errors in IT equipment inventory records. Although these control weaknesses may be addressed through early implementation of the July 2008 policies, the fact that GAO identified missing items only a few months after these locations had completed their physical inventories is an indication that underlying weaknesses in accountability over IT equipment have not yet been corrected. GAO's tests identified 50 missing items, of which 34 could have stored sensitive data, but again, notifications to individuals could not be made. Further, the lack of user-level accountability and inaccurate records on status, location, and item description of IT equipment items at the four case study locations make it difficult to determine the extent to which actual theft, loss, or misappropriation of IT equipment may have occurred. In addition, the four locations had weaknesses in controls over hard drives in the property disposal process as well as physical security weaknesses at IT storage facilities. These control weaknesses present a risk that VA could lose control over new, used, and excess IT equipment and that any sensitive personal and medical information residing on hard drives in this equipment could be compromised.