VA Has Opportunities To Strengthen Program Implementation of Homeland Security Presidential Directive 12

This audit evaluated VA’s progress in implementing a reliable and effective system of personal identity verification (PIV) in compliance with Homeland Security Presidential Directive 12 (HSPD-12). This Directive mandates the use of Government-wide identification credentials for employees and contractors. While VA has made little progress in implementing a reliable and effective program in compliance with HSPD-12, management efforts are underway to strengthen program implementation. VA is almost two years behind the Government-wide October 2008 deadline for full compliance with HSPD-12. As of June 2010, VA had only issued approximately nine percent of the necessary credentials to its workforce, including contractors. In addition, VA issued some credentials without the required background investigations. The PIV System used to support the credentialing process and HSPD-12 Program operations do not meet all critical mission requirements, and controls needed to track and provide accountability over program costs are weak. VA’s lack of progress in implementing HSPD-12 occurred because it did not make it a priority or have an effective management structure in place to direct this Department-wide effort adequately. Although a Program Management Office (PMO) has been in place since October 2009, the PMO lacks the resources and critical management tools necessary to direct and operate a VA-wide program. We recommend the Assistant Secretary for Operations, Security, and Preparedness ensure that the PMO has the necessary resources and management tools in place to direct and implement the HSPD-12 Program. In addition, we recommend that the Assistant Secretary for Operations, Security, and Preparedness and the Assistant Secretary for Information Technology address PIV System and other operational deficiencies related to critical HSPD-12 Program requirements. The Assistant Secretary for Operations, Security, and Preparedness concurred with our findings and recommendations and provided target dates to complete planned actions. We consider their planned actions acceptable and will follow up on their implementation.