Inadequate Oversight of Contractors’ Personal Identity Verification Cards Puts Veterans’ Sensitive Information and Facility Security at Risk

Report Information

Issue Date
Report Number
20-00345-77
VA Office
Veterans Health Administration (VHA)
Report Author
Office of Audits and Evaluations
Report Type
Review
Report Topic
Contract Integrity
Major Management Challenges
Leadership and Governance
Recommendations
10
Questioned Costs
$0
Better Use of Funds
$0
Congressionally Mandated
No

Summary

Summary
The VA Office of Inspector General (OIG) conducted this review to determine whether Veterans Health Administration (VHA) contracting officers complied with mandates to ensure contractors account for and return their personnel’s personal identity verification (PIV) cards as required, such as at the end of a contract or employment. PIV cards are federally issued credentials used by authorized individuals to gain access to federal facilities and information systems. The Federal Acquisition Regulation (FAR) establishes that it is the contracting officer’s responsibility to ensure that contractor employees return all PIV cards they are issued. Unreturned cards increase risks for unauthorized access to VA facilities and information systems. The review team examined a random sample of 46 professional service and healthcare resource contracts. None of the reviewed contracts had adequate evidence to demonstrate FAR requirements were met. VHA contracting officers’ noncompliance with PIV card requirements occurred because they were unaware of their responsibilities and the requirements. In addition, VHA did not have policies or procedures detailing supervisory oversight of contracting officers’ duties regarding PIV cards, the internal audit office did not review compliance, and there was no automated tool for continuous tracking and monitoring of PIV cards issued to contractors’ personnel. The OIG made 10 recommendations to the under secretary for health to address deficiencies related to compliance with requirements for PIV cards issued to contractors’ personnel. Recommendations include ensuring all PIV cards are returned prior to contract closeout, outlining specific supervisory responsibilities for contracting officer oversight, and periodically reviewing contract compliance. The OIG also recommended VHA assess whether the existing and planned information systems could have the functionality to allow effective and routine monitoring of contractors’ PIV cards or a new system is needed.

Open Recommendation Image, SquareOpenClosed and Implemented Recommendation Image, CheckmarkClosed-ImplementedNot Implemented Recommendation Image, X character'Closed-Not Implemented
No. 1
Open Recommendation Image, Square
to Veterans Health Administration (VHA)
The OIG recommended the acting under secretary for health collaborate, as necessary, with other offices within VA that have responsibilities regarding personal identity verification cards to ensure contracting officers obtain and maintain evidence of contractor-provided lists of all personal identity verification cards issued to contractor employees.
No. 2
Open Recommendation Image, Square
to Veterans Health Administration (VHA)
The OIG recommended the acting under secretary for health collaborate, as necessary, with other offices within VA that have responsibilities regarding personal identity verification cards to ensure contracting officers maintain evidence documenting personal identity verification cards were returned to the issuing or designated office when the cards were no longer required and prior to closing the contract.
No. 3
Open Recommendation Image, Square
to Veterans Health Administration (VHA)
The OIG recommended the acting under secretary for health collaborate, as necessary, with other offices within VA that have responsibilities regarding personal identity verification cards to evaluate the role of contracting officer’s representatives in the personal identity verification card process for contractor employees and assess whether updates to their letter of delegation and standard operating procedures are necessary.
No. 4
Closed and Implemented Recommendation Image, Checkmark
to Veterans Health Administration (VHA)
Closure Date: 10/3/2023
The OIG recommended the acting under secretary for health collaborate, as necessary, with other offices within VA that have responsibilities regarding personal identity verification cards to establish policies and procedures outlining specific supervisory responsibilities for contracting officer oversight in accordance with the Government Accountability Office Standards for Internal Controls in the Federal Government.
No. 5
Closed and Implemented Recommendation Image, Checkmark
to Veterans Health Administration (VHA)
Closure Date: 3/17/2025

The OIG recommended the acting under secretary for health collaborate, as necessary, with other offices within VA that have responsibilities regarding personal identity verification cards to assess the contract completion statement template to determine whether to include the contractor-related personal identity verification card requirements.

No. 6
Open Recommendation Image, Square
to Veterans Health Administration (VHA)
The OIG recommended the acting under secretary for health collaborate, as necessary, with other offices within VA that have responsibilities regarding personal identity verification cards to establish procedures within the Procurement Audit Office for periodic reviews of contract files to determine compliance with the personal identity verification card requirements established in the Federal Acquisition Regulation and the Veterans Health Administration procurement manual. Further, require the results of these reviews to be reported to senior management to help determine whether corrective actions are required.
No. 7
Closed and Implemented Recommendation Image, Checkmark
to Veterans Health Administration (VHA)
Closure Date: 6/12/2025

The OIG recommended the acting under secretary for health collaborate, as necessary, with other offices within VA that have responsibilities regarding personal identity verification cards to determine whether existing or planned systems can have the functionality to allow management to effectively and routinely monitor contractor employee personal identity verification cards or whether a new system should be established.

No. 8
Open Recommendation Image, Square
to Veterans Health Administration (VHA)
The OIG recommended the acting under secretary for health collaborate, as necessary, with other offices within VA that have responsibilities regarding personal identity verification cards to assess whether contracting officers should be required to include the contractor-provided list as an explicit requirement in all Veterans Health Administration contracts that require issuance of personal identity verification cards to contractor employees.
No. 9
Closed and Implemented Recommendation Image, Checkmark
to Veterans Health Administration (VHA)
Closure Date: 6/12/2025

The OIG recommended the acting under secretary for health collaborate, as necessary, with other offices within VA that have responsibilities regarding personal identity verification cards to establish procedures to ensure contracting officers include Federal Acquisition Regulation clause 52.204-9, “Personal Identity Verification of Contractor Personnel,” in contracts when required.

No. 10
Closed and Implemented Recommendation Image, Checkmark
to Veterans Health Administration (VHA)
Closure Date: 3/17/2025

The OIG recommended the acting under secretary for health collaborate, as necessary, with other offices within VA that have responsibilities regarding personal identity verification cards to consider directing contracting officers to delay final payment to contractors on future contracts until all personal identity verification cards have been returned.