	Inadequate IT Inventory Control and Accountability Pose Risk of Loss, Theft, and Misappropriation

Our tests of IT equipment inventory controls at four case study locations,  including three VA medical centers and VA headquarters, identified a weak  overall control environment and a pervasive lack of accountability for IT  equipment items across the locations we tested. Our statistical tests identified a total of 123 lost and missing IT equipment  items across the four case locations, including 53 IT equipment items that  could have stored sensitive personal information. Under this lax  control environment, missing IT equipment items were often not reported  for several months and, in some cases several years, until the problem was  identified during a physical inventory. Our statistical tests of missing  equipment found that none of the four test locations had effective  controls. Although our Standards for Internal Control in the Federal Government  requires timely recording of transactions as part of an effective internal  control structure and safeguarding of sensitive assets, we found that VA’s  property management policy neither specified what transactions were to  be recorded for various changes in inventory status nor provided criteria  for timely recording. Physical Inventories by Case Study Locations Identified Thousands of Missing IT Equipment Items Valued at Millions of Dollars

To assess the effect of the lax control environment for IT equipment, we  asked VA officials at the case study locations covered in both our current  and previous audits to provide us with information on the results of their  physical inventories performed after issuance of recommendations in our  July 2004 report, including Reports of Survey information on identified  losses of IT equipment. As of February 28, 2007, the four case study  locations covered in our current audit reported over 2,400 missing IT  equipment items with a combined original acquisition value of about      $6.4 million as a result of inventories they performed during fiscal years  2005 and 2006. Because inventory records were not consistently updated  as changes in user organization or location occurred and none of the  locations we audited required accountability at the user level, it is not  possible to determine whether the missing IT equipment items represent  recordkeeping errors or the loss, theft, or misappropriation of IT  equipment. Physical Security Weaknesses Increase Risk of Loss, Theft, and Misappropriation of IT Equipment and Sensitive Data

Our investigator’s inspection of physical security at officially designated IT  warehouses and storerooms at our four case study locations that held new  and used IT equipment found that most of these storage facilities met the  requirements in VA Handbook 0730/1, Security and Law Enforcement. We also found numerous instances of informal IT storage areas  at VA headquarters that did not meet VA physical security requirements. In  addition, although VA requires that hard drives of IT equipment and  medical equipment be sanitized prior to disposal to prevent unauthorized  release of sensitive personal and medical information, we found  weaknesses in the disposal process that pose a risk of data breach related  to sensitive personal information residing on hard drives in the property  disposal process that have not yet been sanitized. The failure to provide  adequate security leaves the information stored on these computers  vulnerable to data breach. Although VA  management has taken some actions to improve inventory controls,  strengthening the overall control environment and establishing and  implementing specific IT equipment controls will require a renewed focus,  oversight, and continuing commitment throughout the organization.
Why GAO Did This Study

In July 2004, GAO reported that the six Department of Veterans Affairs (VA) medical centers it audited lacked a reliable property control database and had problems with implementation of VA inventory policies and procedures. Fewer than half the items GAO selected for testing could be located. Most of the missing items were information technology (IT) equipment. In light of these concerns and recent thefts of laptops and data breaches at VA, this testimony focuses on (1) the risk of theft, loss, or misappropriation of IT equipment at selected locations; (2) whether selected locations have adequate procedures in place to assure accountability and physical security of IT equipment in the excess property disposal process; and (3) what actions VA management has taken to address identified IT inventory control weaknesses. GAO statistically tested inventory controls at four case study locations.

What GAO Found

A weak overall control environment for VA IT equipment at the four locations GAO audited poses a significant security vulnerability to the nation's veterans with regard to sensitive data maintained on this equipment. GAO's Standards for Internal Control in the Federal Government requires agencies to establish physical controls to safeguard vulnerable assets, such as IT equipment, which might be vulnerable to risk of loss, and federal records management law requires federal agencies to record essential transactions. However, GAO found that current VA property management policy does not provide guidance for creating records of inventory transactions as changes occur. GAO also found that policies requiring annual inventories of sensitive items, such as IT equipment; adequate physical security; and immediate reporting of lost and missing items have not been enforced. GAO's statistical tests of physical inventory controls at four VA locations identified a total of 123 missing IT equipment items, including 53 computers that could have stored sensitive data. The lack of user-level accountability and inaccurate records on status, location, and item descriptions make it difficult to determine the extent to which actual theft, loss, or misappropriation may have occurred without detection. GAO also found that the four VA locations reported over 2,400 missing IT equipment items, valued at about $6.4 million, identified during physical inventories performed during fiscal years 2005 and 2006. Missing items were often not reported for several months and, in some cases, several years. It is very difficult to investigate these losses because information on specific events and circumstances at the time of the losses is not known. GAO's limited tests of computer hard drives in the excess property disposal process found hard drives at two of the four case study locations that contained personal information, including veterans' names and Social Security numbers. GAO's tests did not find any remaining data after sanitization procedures were performed. However, weaknesses in physical security at IT storage locations and delays in completing the data sanitization process heighten the risk of data breach. Although VA management has taken some actions to improve controls over IT equipment, including strengthening policies and procedures, improving the overall control environment for sensitive IT equipment will require a renewed focus, oversight, and continued commitment throughout the organization.