The Department of Veterans Affairs needs to continue to take actions to reduce the loss of IT equipment and correct control weaknesses, GAO has said.
In a follow up to a 2007 audit that found internal control weaknesses at several VA locations, GAO said the department has made significant progress.
Of the 18 recommendations GAO made in its two earlier reports, VA completed action on 14 recommendations, partially implemented action on two recommendations, and is working to address the two others, according to GAO-08-918.
It said the recommendations focused on strengthening policies and procedures to establish a framework for accountability and control of IT equipment.
The new policy addresses user-level accountability and requirements for strengthening physical security, and the department has performed physical inventory, though as of May it was unable to locate about 62,800 IT equipment items, 9,800 of which could hold sensitive information.
GAO’s statistical tests of IT equipment inventory controls from February through May 2008 at four locations identified continuing control weaknesses, including missing items, lack of accountability, and errors in IT equipment inventory records, according to the report.
It added that it identified missing items just a few months after VA locations had completed their physical inventories, which is an indication that underlying weaknesses in accountability over IT equipment have not yet been corrected.
