Audit of VA’s Enrollment Centers’ Implementation of Personal Identity Verification Requirements

We assessed whether VA’s Enrollment Centers met Homeland Security Presidential Directive 12 (HSPD 12) and other Government-wide requirements when providing Personal Identity Verification (PIV) credentials. We found significant control lapses and missing procedures that compromised the integrity of the credentialing process. VA’s PIV credentialing operations was never evaluated and certified to Government standards. VA may have issued thousands of PIV credentials without determining whether applicants are known or suspected terrorists; the authenticity of applicants’ documents were not verified; some applicant background investigations were uninitiated or results were incomplete; and staff compromised system integrity by disregarding separation of duties. We recommended the Enrollment Centers stop issuing PIV credentials until control deficiencies in the credentialing process are addressed, and VA assesses and accredits the existing processes to meet Government-wide requirements. The Assistant Secretary for Operations, Security, and Preparedness concurred with our findings and recommendations and took immediate actions to mitigate risk associated with the program.