Financial Management: FBI Has Designed and Implemented Stronger Internal Controls over Sentinel Contractor Invoice Review and Equipment Purchases, but Additional Actions Are Needed

In February 2006, we reported on significant internal control deficiencies related to contractor payments and property accountability associated with the development of the Federal Bureau of Investigation's (FBI) Trilogy information technology (IT) modernization project. In that audit, we found FBI's invoice review and approval process did not provide an adequate basis to verify that goods and services billed were actually received and that amounts billed were appropriate. We also found that FBI relied extensively on Trilogy contractors to purchase and account for Trilogy equipment without controls or data to verify the accuracy and completeness of the contractor records. Additionally, once FBI took possession of the Trilogy equipment, it did not have adequate controls to safeguard those assets. FBI is now acquiring and deploying a new automated case management system, known as Sentinel, to replace the case management system that was to be delivered as part of the Trilogy project. Sentinel is being developed in four phases at an estimated cost of $425 million and is scheduled to be completed in May 2010. Phase 1 of the project was completed in June 2007. In light of the problems we found concerning the predecessor Trilogy project, Congress asked us to review the internal controls over expenditures related to the development and implementation of Sentinel. Specifically, Congress asked us to assess the design and implementation of FBI's internal controls over the Sentinel project for (1) preventing or detecting improper payments to project contractors and (2) maintaining proper accountability for equipment purchased for the project. Further, to the extent weaknesses were found, you asked us to determine whether those weaknesses resulted in improper payments or missing equipment.

FBI has designed and implemented internal controls over the review and approval of Sentinel contractor invoices that have reduced the risk of improper contractor payments. FBI established the Sentinel PMO to provide day-to-day oversight over both the technical and financial aspects of the project. The PMO designed policies and procedures that assign invoice-review responsibilities and require Sentinel contractors to provide detailed support for all invoiced amounts and to obtain advance approval from the PMO for travel, overtime, and other direct costs. The PMO's policies also require contractors to provide monthly progress reports that link invoiced amounts to tasks completed and explain any anomalies with the invoice. The PMO Business Management Team (BTM) is also assigned the task of assessing each submitted contractor invoice to determine whether invoiced costs are mathematically accurate and adequately supported. Our testing of these controls determined that the PMO had effectively implemented them. We did not identify any questionable contractor payments. The Sentinel PMO has also taken steps to improve the design and implementation of internal controls over purchased Sentinel equipment. In April 2007, the PMO hired a full-time Sentinel property manager to oversee the property management process. The property manager is responsible for maintaining accountability (physical and financial) over equipment purchased for the Sentinel project. The PMO established policies and procedures to help ensure equipment purchases are properly authorized and that received property is timely inspected and entered into FBI's Property Management Application (PMA) to be tracked and inventoried. Overall, with additional enhancements to these controls to address the issues noted below, the PMO's established policies and procedures would help ensure accountability over Sentinel equipment. Specifically, our testing of the implementation of the PMO property controls found opportunities for the PMO to improve controls by (1) establishing procedures to ensure the accuracy and completeness of the Lockheed Martin database used to establish the official FBI property record in PMA. Our initial testing of this contractor database found that it was corrupted and did not agree with either PMA or the supporting vendor invoices; (2)reconciling its asset records to the underlying source documents as part of the monthly invoice review and approval process. We found asset values had to be adjusted at the end of Phase 1 because assets were initially recorded in PMA using estimated costs rather than actual costs; (3) establishing policies and procedures to document the initial inspection of Sentinel assets and verification of the barcodes assigned to the property; and (4) capturing the date property was received so that the PMO could monitor compliance with its policy to record all accountable property in PMA within 27 days of receipt. Our testing did not identify any missing assets. However, we found 20 property records for which there were valuation discrepancies between the contractor database, PMA, and the supporting vendor invoices. We referred these records to the PMO to investigate and resolve.