VA Police Information Management System Needs Improvement

Report Information

Issue Date
Closure Date
Report Number
19-05798-107
VISN
State
District
VA Office
Veterans Health Administration (VHA)
Report Author
Office of Audits and Evaluations
Report Type
Audit
Report Topic
VA Police
Major Management Challenges
Leadership and Governance
Recommendations
7
Questioned Costs
$0
Better Use of Funds
$0
Congressionally Mandated
No

Summary

Summary
This report presents the findings of an audit that examined whether VA’s police information systems provided program leaders and the workforce with adequate information to manage operations and in turn support effective governance. It builds on a December 2018 Office of Inspector General (OIG) publication that recommended improvements to VA’s national governance of its police program. The OIG found that VA lacked an effective strategy or action plan to update its police information system. In September 2015, the VA Law Enforcement Training Center (LETC) acquired Report Exec, a replacement records management system, for police officers at all medical facilities. Inadequate planning and contract administration mismanagement caused the system implementation to stall for more than two years. LETC spent approximately $2.8 million on the system by fiscal year 2019, but police officers experienced frequent performance issues and had to use different systems that did not share information. As of April 2019, only 63 percent of medical facility police units were reportedly using the Report Exec system, while 37 percent were still using an incompatible legacy system. As a result, administrators and law enforcement personnel at multiple levels could not adequately track and oversee facility incidents involving VA police or make informed decisions on risks and resource allocations. The audit also revealed that information security controls were not in place for the Report Exec system that put individuals’ sensitive personal information at risk. The OIG made seven recommendations that included evaluating which entity should oversee the records management systems for VA police, establishing a working group to assess whether the Report Exec system meets the needs of VA police, and developing a strategy to fully implement the system or its replacement. The OIG also recommended that an information security officer be consistently responsible for the Report Exec system.

Open Recommendation Image, SquareOpenClosed and Implemented Recommendation Image, CheckmarkClosed-ImplementedNot Implemented Recommendation Image, X character'Closed-Not Implemented
No. 1
Closed and Implemented Recommendation Image, Checkmark
to Human Resources and Administration/Operations, Security, and Preparedness (HRA/OSP)
Closure Date: 4/14/2022
The OIG recommends that the Assistant Secretary for Human Resources and Administration/Operations, Security, and Preparedness in consultation with the Under Secretary for Health evaluate the appropriateness of having the Law Enforcement Training Center serve as the manager of the records management systems for VA police.
No. 2
Closed and Implemented Recommendation Image, Checkmark
to Human Resources and Administration/Operations, Security, and Preparedness (HRA/OSP)
Closure Date: 7/21/2021
The OIG recommended the Assistant Secretary for Human Resources and Administration/Operations, Security, and Preparedness in consultation with the Assistant Secretary for Information and Technology, as well as the Under Secretary for Health establish a working group of subject matter experts and evaluate whether the Report Exec system meets the needs of VA police. The group should evaluate if the system meets police needs and whether contract requirements have been fully achieved, then develop a strategy to ensure that police units at all medical facilities have a reliably performing records management system to report and track activities.
No. 3
Closed and Implemented Recommendation Image, Checkmark
to Human Resources and Administration/Operations, Security, and Preparedness (HRA/OSP)
Closure Date: 10/22/2021
The OIG recommended the Assistant Secretary for Human Resources and Administration/Operations, Security, and Preparedness in consultation with the Principal executive Director for the Office of Acquisition, Logistics and Construction; the Assistant Secretary for Information and Technology; and the Under Secretary for Health develop and implement a plan describing how, when, and to whom information about issues for the police records management system will be disseminated and resolved.
No. 4
Closed and Implemented Recommendation Image, Checkmark
to Human Resources and Administration/Operations, Security, and Preparedness (HRA/OSP)
Closure Date: 4/14/2022
The OIG recommended the Assistant Secretary for Human Resources and Administration/Operations, Security, and Preparedness, in consultation with the Under Secretary for Health, update security and law enforcement program procedures to ensure they meet information management needs and requirements.
No. 5
Closed and Implemented Recommendation Image, Checkmark
to Human Resources and Administration/Operations, Security, and Preparedness (HRA/OSP)
Closure Date: 12/18/2020
The OIG recommended the Assistant Secretary for Human Resources and Administration/Operations, Security, and Preparedness in consultation with the Assistant Secretary for Information and Technology and Principal Executive Director for the Office of Acquisition, Logistics and Construction initiate an agreement with the contractor to ensure information security measures are in place for the VA police records that were stored on the contractor’s server to prevent unauthorized use and their proper disposal.
No. 6
Closed and Implemented Recommendation Image, Checkmark
to Human Resources and Administration/Operations, Security, and Preparedness (HRA/OSP)
Closure Date: 10/22/2021
The OIG recommended the Assistant Secretary for Human Resources and Administration/Operations, Security, and Preparedness in consultation with the General Counsel and the Assistant Secretary for Office of Accountability and Whistleblower Protection determine the appropriate administrative action to take, if any, against personnel involved in bypassing the requirement that the Report Exec system be hosted at the Austin Information Technology Center and the VA information security process be completed before operation.
No. 7
Closed and Implemented Recommendation Image, Checkmark
to Information and Technology (OIT)
Closure Date: 10/20/2020
The OIG recommended the Assistant Secretary for Information and Technology in coordination with the Assistant Secretary for Human Resources and Administration/Operations, Security, and Preparedness ensure an Information Security Officer is consistently responsible for the Report Exec system and properly notified.