Inadequate IT Inventory Control and Accountability Pose Risk of Loss, Theft, and Misappropriation

Our tests of IT equipment inventory controls at four case study locations,  including three VA medical centers and VA headquarters, identified a weak  overall control environment and a pervasive lack of accountability for IT  equipment items across the four locations we tested. Because of the lack of user-level accountability and the failure to  consistently update inventory records for changes in inventory status and  user location, VA officials at our test locations could not determine the  user or type of data stored on the 53 missing IT equipment items that could  have stored sensitive personal information and, therefore, the risk posed  by the loss of these items. VA records management policy that implements  federal records management law and NARA guidance requires the  creation and maintenance of records of essential transactions, such as  creating a timely record of newly acquired IT equipment in the property  management system, and recording timely updates for changes in the  status of IT equipment, including transfers, turn-ins, and replacement of  equipment, and disposals. VA  property management policy requires that sensitive items, including  computer equipment, be subjected to annual physical inventories. As a result, our  statistical tests did not include these items. Physical Inventories by Case Study Locations Identified Thousands of Missing IT Equipment Items Valued at Millions of Dollars

To assess the effect of the lax control environment for IT equipment, we  asked VA officials at the case study locations covered in both our current  and previous audits to provide us with information on the results of their  physical inventories performed after issuance of recommendations in our  July 2004 report, including Reports of Survey information on identified  losses of IT equipment. As of      February 28, 2007, the four case study locations covered in our current  audit reported over 2,400 missing IT equipment items with a combined  original acquisition value of about $6.4 million as a result of inventories  they performed during fiscal years 2005 and 2006. Further, missing IT  equipment items were often not reported for several months and, in some  cases several years, because most of the nine case study locations had not  consistently performed required annual physical inventories or completed  Reports of Survey promptly. According to VA Police and security specialists, it is very difficult to  conduct an investigation at this point because the details of the incidents  cannot be determined. This weak overall control  environment presents an opportunity for theft, loss, or misappropriation to  occur without detection. Our standards for internal control require federal agencies to have policies  and procedures for ensuring that the findings of audits and other reviews  are promptly resolved. For  example, our tests of computer hard drives in the excess property disposal  process found that hard drives at two of the four case study locations that  had not yet been sanitized contained hundreds of names and Social  Security numbers. Weaknesses  in physical security heighten the risk of data breach related to sensitive  personal information residing on hard drives in the property disposal  process that have not yet been sanitized. Physical Security Weaknesses at IT Storage Locations Pose Risk of Data Breach

VA Handbook 0730/1, Security and Law Enforcement, prescribes physical  security requirements for storage of new and used IT equipment. Although VA management has taken some actions to  improve inventory controls, strengthening the overall control environment  and establishing and implementing specific IT equipment controls will  require a renewed focus, oversight, and continuing commitment  throughout the organization. Management actions taken or under way to address previously identified  IT equipment inventory control weaknesses.
Why GAO Did This Study

In July 2004, GAO reported that the six Department of Veterans Affairs (VA) medical centers it audited lacked a reliable property control database and had problems with implementation of VA inventory policies and procedures. Fewer than half the items GAO selected for testing could be located. Most of the missing items were information technology (IT ) equipment. Given recent thefts of laptops and data breaches, the requesters were concerned about the adequacy of physical inventory controls over VA IT equipment. GAO was asked to determine (1) the risk of theft, loss, or misappropriation of IT equipment at selected locations; (2) whether selected locations have adequate procedures in place to assure accountability and physical security of IT equipment in the excess property disposal process; and (3) what actions VA management has taken to address identified IT inventory control weaknesses. GAO statistically tested inventory controls at four case study locations.

What GAO Found

A weak overall control environment for VA IT equipment at the four locations GAO audited poses a significant security vulnerability to the nation's veterans with regard to sensitive data maintained on this equipment. GAO's Standards for Internal Control in the Federal Government requires agencies to establish physical controls to safeguard vulnerable assets, such as IT equipment, which might be vulnerable to risk of loss, and federal records management law requires federal agencies to record essential transactions. However, GAO found that current VA property management policy does not provide guidance for creating records of inventory transactions as changes occur. GAO also found that policies requiring annual inventories of sensitive items, such as IT equipment; adequate physical security; and immediate reporting of lost and missing items have not been enforced. GAO's statistical tests of physical inventory controls at four VA locations identified a total of 123 missing IT equipment items, including 53 computers that could have stored sensitive data. The lack of user-level accountability and inaccurate records on status, location, and item descriptions make it difficult to determine the extent to which actual theft, loss, or misappropriation may have occurred without detection. GAO also found that the four VA locations reported over 2,400 missing IT equipment items, valued at about $6.4 million, identified during physical inventories performed during fiscal years 2005 and 2006. Missing items were often not reported for several months and, in some cases, several years. It is very difficult to investigate these losses because information on specific events and circumstances at the time of the losses is not known. GAO's limited tests of computer hard drives in the excess property disposal process found hard drives at two of the four case study locations that contained personal information, including veterans' names and Social Security numbers. GAO's tests did not find any remaining data after sanitization procedures were performed. However, weaknesses in physical security at IT storage locations and delays in completing the data sanitization process heighten the risk of data breach. Although VA management has taken some actions to improve controls over IT equipment, including strengthening policies and procedures, improving the overall control environment for sensitive IT equipment will require a renewed focus, oversight, and continued commitment throughout the organization.