oversight

Audit of the Quality Assurance Process Over Background Investigations

Published by the Office of Personnel Management, Office of Inspector General on 2010-06-22.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                                                     U.S. OFFICE OF PERSONNEL MANAGEMENT
                                                           OFFICE OF THE INSPECTOR GENERAL
                                                                            OFFICE OF AUDITS




Final Audit Report
Subject:



       AUDIT OF THE QUALITY ASSURANCE PROCESS 

          OVER BACKGROUND INVESTIGATIONS 



                                            Report No. 4A-IS-OO-09-060


                                           Date:       June 22,            2010




                                                           --CAUTION-­
This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit
report may contain proprietary data which is protected by Federal law (l8 U.S.C 1905). Therefore, while this audit report is available
under the Freedom of Informalioo Act and madc available to the public olllhe orG wcbpage, caution needs to be exercised before
releasing the report to the general public as it may contain proprietary information thM was redacted from the publicly distributed copy.
                         UNITED STATES OFFICE OF PERSONNEL MANAGEMENT 

                                            Washington, DC 20415 



  Office of the
In~peClorGenera l



                                        AUDIT REPORT




              AUDIT OF THE QUALITY ASSURANCE PROCESS OVER 

                       BACKGROUND INVESTIGATIONS 





                      Report No. 4A-IS-OO-09-060       Date: June 22, 2010




                                                                 Michael R. Esser
                                                                 Assistant Inspector General
                                                                   for Audits




        --------------.-~--.-------.----~~----                                 --_._----_._-­
        www.opm.gov                                                                      www.usajobs.gov
                         UNITED STATES OFFICE OF PERSONNEL MANAGEMENT
                                               Washington, DC 204 [5


  Office of the
Inspector General




                                     EXECUTIVE SUMMARY 




                    AUDIT OF THE QUALITY ASSURANCE PROCESS OVER 

                             BACKGROUND INVESTIGATIONS 





                      Report No. 4A-IS-OO-09-060           Da~:        June 22, 2010


      The Office of the Inspector General has completed a performance audit of the Quality Assurance
      Process over Background Investigations. Our main objective was to determine whether the
      Federal Investigative Services (FrS) has effectively implemented controls for the quality
      assurance process over background investigations. In order to make this determination, our audit
      included the following specific objectives: (1) determine whether the FIS and the US
      Investigations Services, Inc. (USIS); KeyPoint Govenunent Solutions (KGS), fonnerly Kroll;
      and CACI International, Inc. (CAeI), hereafter referred to as the "Contractors", are following
      their respective case/quality review process; (2) detennine if the FrS and the Contractors have
      controls in place to ensure that their review personnel are trained to perform their duties; (3)
      determine if the FIS and the Contractors have controls in place to ensure that their investigative
      personnel are trained to perform their duties; and (4) determine if the FIS and the Contractors
      have adequate controls in place to identify falsification and/or integrity issues.

      Our audit was conducted from July 22, 2009 through October 22, 2009 at FrS offices located in
      the U.S. Office of Personnel Management's (OPM) headquarters in Washington D.C. and
      Boyers, Pennsylvania. In addition, we visited Contractors' sites located in Chantilly, Virginia;
      Loveland, Colorado; and Grove City, Pennsylvania. Our audit identified 15 areas requiring
      improvement.




                               -------------_._---_._-------_._-­
        www.opm.gov                                                                          www.usajobs.gov
A.   General Observations

      1.   General Observations                                                   Procedural

           We have identified three areas we feel could have a positive impact
           on the quality assurance process over background investigations.
           The areas include: training, the quality case review initiative, and
           the use of an integrity statement.


B.   Case Quality Review Process

      1.   Random Review Process                                                  Procedural

           Random reviews of cases by the Quality Management Group, an
           internal control that helps identify potential problems with
           background investigations, were not in place for the last half of
           fiscal year 2009.

      2.   Oversigbt of tbe Closing Autborization and Support Team                Procedural
           (CAST)

           Deficient cases are being closed in the CAST by the support
           contractor.


C.   Training for Investigative Personnel

      1.   Investigative Technician Training                                      Procedural

           USIS and KGS did not provide an OPM approved training course to
           employees who conduct record checks.

      2.   Mentor Training                                                        Procedural

           Eighteen of the 20 mentors that we reviewed did not complete a
           mentor training course.

     3.    Investigator Training for Contractors                                  Procedural

           Two of the 50 Background Investigators we sampled did not meet
           all qualifications needed to perform their duties as a Background
           Investigator.




                                             11
     4.    Check Rides Not Conducted by Contractor                                Procedural

           USIS did not conduct check rides for 2 of the 25 new Background
           Investigators that we s,ampled,
     5.    Check Rides at FIS Not Conducted                                       Procedural

           Seven of the 25 experienced Background Investigators we sampled
           did not have a check ride assessment conducted during the period
           October 1,2008 to September 4, 2009.

      6.   Evaluation Results Not Documented                                      Procedural

           CAC! does not have a process in place to document the results of
           their evaluations of Background Investigators,

      7.   Oversight of Contractors' Evaluation Submissions                       Procedural

           FIS does not have controls in place to ensure that the Contractors
           are submitting their evaluation results to the Contracting Officer's
           Representati ve.


D.   FalsificationlIntegrity Issues

      1.   Misconduct Issues Not Submitted Timely                                 ProceduraL

           USIS did not forward misconduct issues to OPM within the required
           timeframe for 7 of the 40 Background Investigators we sampled.

      2.   Record Source Validations Not Performed                                Procedural

           The Contractors did not have controLs in place to conduct record
           source validations.

      3.   Review of Record Checks                                                Procedural

           FIS did not conduct the required number of record check reviews
           for aLL Investigative Assistants.

      4.   Re-Contact of Personal Sources by Contractors                          Procedural

           CAeI and KGS did not conduct re-contacts for 12 of the 50 new
           Background Investigators that we sampled. In addition, for CACI
           we were unable to determine whether the re-contacts that were
           performed were completed within 60 calendar days of the initial
           contact.


                                             111
5.   Re-Contact of Personal Sources by FIS                                   Procedural

     FIS did not conduct the required three re-contacts for 11 of the 80 

     Background Investigators we sampled. 





                                       IV 

                                            TABLE OF CONTENTS




  I. INTRODUCTION AND BACKGROUND ...................................... .. 


 II.   OBJECTIVES, SCOPE, AND METHODOLOGY ......... ________ .... ____ ... 
                                                4

III.   AUDIT FINDINGS AND RECOMMENDAnONS .. ____ ...................                                                        7


       A. General Observations
          1. Training.................................................................                                      7

          2. Quality Case Review Initiative ................................. __ ...                                        8

          3. Integrity Statement ........................................ __ .... .....                                     9


       B. Case Quality Review Process
          1. Random Review Process. . . . . . . . . . . . . . . . . . . . .... . . . . . . . . . . . . . . . . . . . . .    9

          2. Oversight of the Closing Authorization and Support Team 

             (CAST).................................................................                                       10 


       C. Training for Investigative Personnel
          l. Investigative Technician Training ...., ... __ .. __ .....................                                    12 

          2. Mentor Training .................................................. , . ...                                    13 

          3. Investigator Training for Contractors..............................                                           14 

          4. Check Rides Not Conducted by Contractor.. ..... .................                                             15 

          5. Check Rides at PIS Not Conducted................. ..... ...........                                           16 

          6. Evaluation Results Not Documented ................ __ ...... ,. .....                                         17 

          7. Oversight of Contractors' Evaluation Submissions..............                                                18 


       D. Falsification/Integrity Issues
          1. Misconduct Issues Not Submitted Timely ................... __ ...                                             19 

          2. Record Source Validations Not Performed ____ .. __ ...... ' ...... __                                         20 

          3. Review of Record Checks .. __ .... ____ .... __ ...... __ ........ __ .......                                 21 

          4. Re-Contact of Personal Sources by Contractors.. ... . . ..........                                            23 

          5. Re-Contact of Personal Sources by FIS .......... __ .... __ .. __ __ __ __                                    24 


IV.    MAJOR CONTRIBUTORS TO THIS REPORT ............................. 
                                                   27


       APPENDIX                     (Federal Investigative Services Response, received January 22,2010,
                                     to our draft report)
                     I. INTRODUCTION AND BACKGROUND 


Introduction

This final audit report details the findings, conclusions, and recommendations resulting from our
performance audit of the Quality Assurance Process over Background Investigations. The audit
was performed by OPM's Office of the Inspector General (OIG), as authorized by the Inspector
General Act of 1978, as amended.

Background

OPM's Federal Investigative Services (FIS) is responsible for conducting background
investigations on Federal applicants, employees, and contractor personnel to determine the
fitness and suitability of these individuals to hold security clearances. Background investigations
are conducted to resolve issues, enforce the civil service laws, rules, and regulations, and verify
the qualifications of applicants for certain high level administrative and professional positions.
FIS conducts approximately ninety percent of all personnel background investigations for the
Federal Government.

During fiscal year (FY) 2009, FrS contracted with three background investigative contractors:
US Investigations Services, Inc. (US IS); KeyPoint Government Solutions (KGS), formerly
Kroll; and CACl International, Inc. (CACI), hereafter referred to as the "Contractors", to assist
with completing background investigations. FrS currently has almost 8,600 Federal and contract
staff devoted to the background investigations program, including 6,800 Federal and contractor
field Background Investigators, hereafter referred to as "Investigators". They are strategicaliy
located throughout the United States and overseas to facilitate and expedite investigations.

Case Review Process

When completed background investigations are determined to be eligible for closing they are
sent to PIS' Investigations Review Group (lRO) for full review or to the support contractor,
known as the Closing Authorization and Support Team (CAST), for limited review and closing.
FrS stated that on average, the CAST closes 140,127 cases per quarter. If the IRO finds
problems with the background investigation that rise to the deficient level, they refer the case to
the Quality Management Group (QMO) in FIS for action. Since the CAST only conducts a very
limited review, they neither correct errors nor do they refer the investigation to QMO. If the
CAST finds a problem of significance (i.e., quality issues), they will send the background
investigation to the IRG for full review.

FIS' Quality Assurance (QA) team oversees the quality assurance process for both the Federal
and Contractor staff. Their duties include reviewing cases prior to closing the case and random
case review for cases that have closed. In addition, FIS has a Contractor Oversight Program
which monitors the quality, timeliness, productivity, and performance against contract
requirements, identifies problem areas, and provides the results to the contractor.




                                                 1

One of the main groups in FrS involved in the quality assurance process over background
investigations is the Quality Management Group (QMG). The QMG provides feedback to both
the Federal and contractor field investigative elements as well as the Federal case review staff to
ensure a consistent, high quality product to their customers, as well as to use their findings to
enhance Investigator and reviewer training. Specifically, the QMG evaluates closed background
investigations and provides feedback to the review staff. In addition, the QMG provides
feedback to field investigators on investigations that the reviewers have referred to the QMG for
review. The QMG also conducts a random review of background investigations. The random
review process consists of selecting cases for review.after reviewers in FIS' IRG have completed
the closing action in the Personnel Investigations Processing System (PIPS). These
investigations are randomly selected by the QMG personnel and include cases that were never
referred to the QMG as a deficiency; however, random review cases can also be selected through
other mechanisms. The cases are evaluated to determine if there were any problems with the
investigation that should have been caught by the reviewer and corrected. If there are problems,
the QMG will prepare a quality feedback document outlining the problems and send the
investigation back to the reviewer's supervisor to have the investigation reopened and corrected.
The QMG maintains a database of this infonnation and supplies statistical reports to IRG
documenting the quality problems that have been found.

According to OPM's contract with the Contractors, each Contractor is required to have a quality
assurance process in place. FIS does not mandate what the process should entail; instead,
management for each of the Contractors decides what they want to review and how often.

Training

All Contractors and FIS employees conducting background investigations must be trained on
FIS' requirements for background investigations. For Contractors, the contract outlines
specialized training, experience, and/or education qualifications that an individual must have in
order to hold a position as an Investigator, Reviewer, or Investigative Technician. Investigators
initially receive classroom training prior to receiving their first case load as an Investigator.
Required training is commensurate with prior experience.

Falsification/Integrity Issue

FIS' Integrity Assurance Group (lAG) validates information gathered during source interviews
directly with that source via the Re-Contact Letter Program. The re-contact letters are done for
Federal and Contractor Agents (US1S, CACI, and KGS). The Processing Support Branch (PSB)
is responsible for mailing out the re-contact letters. They are supposed to send out three re­
contact letters per Investigator (Federal and Contractor) per month. The re-contact letters are
generated based on a PIPS data dump of all Investigator leads. The re-contact letter is auto
populated (i.e., investigator name, subject name, address, etc.) based on the information the
Investigator entered into PIPS while the background investigation was being conducted. The
responses to the letters are returned to PSB. The findings from re-contact letter results are
processed by referring congratulatory comments to the field management staff to provide
positive quality feedback to the Investigator workforce and refer potential integrity issues to the
Integrity Assurance Group for further investigation and resolution. They also serve as a quality



                                                 2

assurance tool to evaluate Investigators' investigative teclmiques and overall professionalism and
to assess training needs in the field.

For the Contractors, the contract provisions require that at least two record sources per quarter
per investigative personnel are rand~mly re-contacted to validate the fact that the search was
conducted and the accuracy of the record information obtained. In addition, Contractors must
conduct re-contacts of personal sources during the first year of the Investigator's employment.
The contact must be done randomly and telephonically. On an annual basis, no less than three
percent of all personal sources obtained by each background investigative personnel shall be re­
contacted within 60 calendar days of the initial contact.




                                                 3

               II. OBJECTIVES, SCOPE, AND METHODOLOGY 


Objectives

The primary objective of our audit was to determine whether FIS has effectively implemented
controls for the quality assurance process over background investigations.

In order to achieve our primary objective, our audit included the following specific objectives:

    1. 	 Determine whether FIS and the Contractors are following their respective case quality
         review process;

   2. 	 Determine if FIS and the Contractors have controls in place to ensure that their review
        personnel are trained to perform their duties;

   3. 	 Determine if FIS and the Contractors have controls in place to ensure that their 

        investigative personnel are trained to perform their duties; and 


   4. 	 Determine if FIS and the Contractors have adequate controls in place to identify 

        falsification and/or integrity issues. 


The recommendations included in this final report address these objectives.

Scope and Methodology

We conducted this performance audit in accordance with generally accepted government 

auditing standards as established by the Comptroller General of the United States. Those 

standards required that we plan and perform the audit to obtain sufficient, appropriate evidence 

to provide a reasonable basis for our findings and conclusions based on our audit objectives. We 

believe that the evidence obtained provides a reasonable basis for our findings and conclusions 

based on our audit objectives. 


The scope of our audit covered FIS' and the Contractors' policies and procedures for fiscal year 

2009, governing the quality assurance process over background investigations. 


We performed this audit from July 22, 2009 through October 22, 2009 at FIS offices located in 

OPM headquarters in Washington D.C. and Boyers, Pennsylvania. In addition, we visited 

Contractors' sites located in Chantilly, Virginia; Loveland, Colorado; and Grove City, 

Pennsyl vania. 


To accomplish the audit objectives noted above, we: 


   • 	 Sampled closed cases and tested FIS' and the Contractors' policies for reviewing cases to
       ensure they are adhering to their processes and to determine if the process was efficient;




                                                 4

   • 	 Sampled and tested FIS' and the Contractors' training records for their reviewers and
       Investigators;
   • 	 Tested FIS' and the Contractors' falsification and integrity process, which included
       sampling and testing the re-c?ntact program for both personal and record sources; and
   • 	 Interviewed FIS and Contractor employees.

In planning our work and gaining an understanding of the internal controls over the quality
control process over background investigations, we considered the internal control structure to
the extent necessary to develop our audit procedures. These procedures were mainly substantive
in nature, although we did gain an understanding of management procedures and controls to the
extent necessary to achieve our audit objectives. The purpose of our audit is not to provide an
opinion on internal controls, but merely to evaluate controls over the processes that were
included in the scope of our audit. Our audit included such tests of FIS' and the Contractors'
records and other procedures as we considered necessary under the circumstances. The results of
our tests indicate that with respect to the items tested FIS has implemented controls to assure the
quality of background investigations, except for the areas set forth in the details of this audit
report.

In conducting our audit, we tested FIS' and the Contractors' compliance with their policies and
procedures, as well as the Contractors' compliance with the Conformed Fieldwork Contract by
selecting samples of cases; Background Investigator, Reviewer, and Investigative Technician
training records; integrity reports; and re-contact reports.

Our sampling methodology consisted of the following:

Case Review Process

In order to verify that FrS and the Contractors are adhering to their case review process, we
selected the following judgmental samples:

   • 	 25 out of 1 1,581 USIS closed cases from May 4 through 8, 2009;
   • 	 25 out of 1,086 KGS closed cases from May 4 through 8, 2009; and
   • 	 25 out of343 CACI closed cases from August 1 through 12,2009.

We also judgmentally sampled 25 out of 48 new and 25 out of 1,417 experienced FIS
Investigators and requested all cases reviewed for each of the Investigators for the month of May
2009 to verify that FIS is adhering to their case review process.

In order to determine if FIS and USIS were following their internal polices and procedures for
random case reviews, we selected the following judgmental samples:

   • 	 25 out of 73 cases randomly reviewed by Frs from March 1 through 31, 2009 and
   • 	 25 out of 719 cases randomly reviewed by USIS from May 1 through 31, 2009.

KGS and CAeI do not perform random case reviews.



                                                 5
Reviewer Training

We tested a judgmental sample of25 out of 325 FIS case reviewers; 25 out of232 USIS case
reviewers; 25 out of 33 KGS case reviewers; and all 11 CACI case reviewers to determine if they
have completed an OPM-approved reviewer training course.

Investigator Training

For new Investigators hired during June 2008 through June 2009, we judgmentally sampled 25
out of 48 FIS Investigators; 25 out of 137 USIS Investigators; and 25 out of299 KGS
Investigators to determine if they have completed an OPM-approved Investigators training
course. We also tested a random sample of25 out of68 CACI Investigators.

For experienced Investigators, we judgmentally sampled 25 out of 1,417 FIS Investigators; 25
out of 2,292 USIS Investigators; and 25 out of 330 KGS Investigators to detennine if they have
completed an OPM-approved Investigators training course. We also tested a random sample of
25 out of 240 CACI Investigators.

Record Searcher Training

We tested a judgmental sample of 25 out of 59 FIS record searchers; all 8 USIS record searchers;
and all 14 KGS record searchers to deterrnine if they have completed an OPM-approved record
searcher training course. CACI does not have official record searchers. AU Investigators at
CAeI are able to do their own record checks.

The remainder of our samples are discussed in the body of our findings. The results from the
various samples were not projected to the population.




                                               6

                III. AUDIT FINDINGS AND RECOMMENDATIONS 


Our audit disclosed that, with respect to the items tested, FIS has an adequate quality control process over
background investigations, except for the ~reas set forth in the details of this audit report. For those
Contractors not specifically identified below in the detail of this report, it was determined that their process
was adequate for that particular issue. The areas requiring improvements are described below.

A. General Observations

         Over the course of our audit we were able to observe the quality assurance process for FIS
         and the Contractors. We have identified tluee overarching areas for which we feel
         improvements would have a positive impact on the overall quality assurance process for
         background investigations. The three areas that came to our attention are discussed below.

    1.   Training

         All Contractors and FIS employees conducting background investigations must be trained on
         FIS' requirements for background investigations. For the Contractors, the contract outlines
         specialized training, experience, and/or education qualifications that an individual must have
         in order to hold a position as an Investigator, Reviewer, or Investigative Technician.
         However, there is no standardized, universal training for personnel who perform the same job
         functions (e.g., Investigator, Reviewer) at FIS, USIS, CACI, and KGS.

         Even though each organization has its own, organization-specific training program that is
         approved by FIS, it is not consistent from contractor to contractor or with FIS. For example,
         there may be additional training modules that may be presented to Investigators that work for
         USIS that are not included in the training program used by CAC£. Not training all persollilel
         (whether FIS or Contractor) in the same manner may lead to a lack of uniformity in
         conducting background investigations. This may lead to work products being incomplete,
         inaccurate, and possibly compromised.

         The Government Accountability Office's (GAO) Standards/or Internal Control in the
         Federal Government state that "Management should ensure that skill needs are continually
         assessed and that the organization is able to obtain a workforce that has the required skills
         that match those necessary to achieve organizational goals. Training should be aimed at
         developing and retaining employee skill levels to meet changing organizational needs."

          Recommendation 1

         We recommend that FIS implement a standardized universal training program that is required
         to be used by FIS and the Contractors for all persollilel who perform work completing
         background investigations (e.g., Investigators, Reviewers, and personnel completing record
         checks).



                                                        7
     FIS' Response:

     "FIS concurs with this recommendation" and stated that "When the new contracts are
     awarded in 2011, FrS will mandate that all companies doing investigati ve work on behalf of
     OPM send their investigators to training classes conducted by OPM. In the interim,
     contractor companies can voluntarily send their investigators to the OPM Basic Investigators
     course. . .. With the issuance of new field contractors in 2011, FrS Training and
     Professional Development (TPD) will have adequate capacity to provide training to all field
     agent staff (Federal and contractor) that supports OPM's investigations program."

2.   Quality Case Review Initiative

     The Standard Operating Procedures (SOP) Supporting the FY09 Quality Case Review
     Initiative for the Northern Region was issued as a single resource for supervisors and case
     reviewers in the Northern Region as a means of standardizing the methodology for
     evaluating, documenting, and analyzing the quality of background investigations conducted
     within the region. The SOP provides instruction, criteria, and guidance for quality reviews
     conducted in the region. The SOP addresses the need for objective, clearly defined criteria
     that reasonably separates an "Adequate" report of investigation from one that is "Deficient".
     The SOP identifies four core elements for an investigation to be rated as "Adequate". The
     SOP also includes the use of a standardized form, The Report a/Quality Review version 2.3,
     which is used by all reviewers to document the results of the quality review. A quality case
     review shall not be considered complete until the supervisor has entered the results of the
     review into the Quality Review Database (QRD) and provided a copy of the evaluative
     results to the Investigator. The QRD has been created to serve as the single resource for
     recording, documenting, and analyzing the results of all completed quality case reviews.

     As of September 2009, the Quality Case Review program had not been fully initialized
     throughout all of FIS' regions. Based on the documentation we reviewed concerning the
     Northern Region, it appears this will be a quality assurance asset once implemented
     nationally. This program will help to bring continuity and standardization to the review
     process which should help in identifying and fixing deficient background investigations prior
     to the case being provided to the customer agency.

     Recommendation 2

     We recommend that FIS implement the Quality Case Review program throughout all of the
     reglOns.

     FIS' Response:

     "FIS concurs with this recommendation" and stated that "All regions have been provided
     with the standard review tools and tracking system developed by the Northern Region. FIS is
     reviewing this process to make additional changes and will continue to refine this tool as we
     move forward. All regions have received training on the automated tool that will allow

                                                 8
         standard tracking of reviewed cases throughout the Federal field. Full implementation is
         expected by the end of January 2010."

   3.    Integrity Statement

         While conducting our audit work on FIS and its Contractors' integrity programs, we became
         aware of USIS' practice of having their employees sign an Integrity Pledge as a part of their
         Security Awareness Tool.                                                              .

          The pledge states that the employee understands that deliberate misrepresentation,
          misconduct, negligence, or falsification of any part of a personneL security investigation can
        . affect the individual, the customer agency, and the employee. The pledge also states that the
          employee is aware that there will be severe consequences, including possible termination,
          possible criminal prosecution and/or potential civil liability for damages if the employee
          commits any of these acts as adjudged by USIS, a customer agency, or an independent third
          party. We discussed this pledge with our investigative staff that has been working on
          falsification cases to determine what impact a signed statement like this could have on an
          investigation and found that in a prior case this statement was vital evidence for winning the
          case.

         As a result, we found this procedure to be a practice that should be considered by FIS and its
         Contractors. By requiring this pledge of all employees conducting background investigative
         work for FIS, it will serve as a reminder as to the roles and responsibilities individuals have
         while performing their job functions and would hopefully help to serve as a deterrent for
         those considering actions that may lead to fraud, waste, and abuse.

         Recommendation 3

         We recommend that FIS implement the use of an annual Integrity Statement for its
         employees and Contractors to assist in any possible falsification cases.

         FIS' Response:

         "FIS cannot concur with this recommendation until the legality of such a statement is
         determined by OPM's Office of General Counsel (OGC). We will present this issue to OGe
         for an opinion before developing an action pian."


B. Case Quality Review Process

   1.    Random Review Process

         The Quality Management Group's internal control that helps to identify potential problems
         with a background investigation was not in place for half of FY 2009.


                                                      9
     Frs' QMG is made up of three branches: the Quality Management Branch, the Random
     Review Branch eRRB), and the Program Training Branch. We requested a list of all cases
     randomly reviewed by QMG from May 1 to May 31, 2009; however, QMG stated that they
     ceased the random reviews in April 2009. QMG ceased the random review process in order
     for them to focus on developing specific training modules based on errors discovered by the
     random reviews. They then conducted reviewer refresher training in May, June, and early
     July 2009.

     OMB Circular A-I23 (Introduction) indicates that "Management has a fundamental
     responsibility to develop and maintain effective internal controL The proper stewardship of
     Federal resources is an essential responsibility of agency managers and staff. Federal
     employees must ensure that Federal programs operate and Federal resources are used
     efficiently and effectively to achieve desired objectives."

     GAO's Standards for Internal Control in the Federal Government state that management is
      responsible for developing control activities, which are the policies, procedures, techniques
      and mechanisms that enforce management's directives. Control activities occur at all levels
      and functions of an entity and include a wide range of activities, such as approvals,
      authorizations, verifications, reconciliations, performance reviews, maintenance of security,
     and the creation and maintenance of related records which provide evidence of execution of
     these activities, as well as appropriate documentation.

     In addition, internal controls should be designed to assure that ongoing monitoring occurs in
     the course of normal operations. It should be performed continually and ingrained in the
     agency's operations.

     Without internal controls in place to identify potential problems in cases closed by the
     Federal review staff, there is an increased risk that these closed cases may be of poor quality
     and contain errors.

     Recommendation 4

     We recommend that FIS resume the random case review process and ensure that internal
     controls are designed to assure that ongoing monitoring occurs in the course of nonnal
     operations.

     FIS' Response:

     "FIS concurs with this recommendation" and stated that they "resumed random review as of
     January 8, 2010."

2.   Oversight of the Closing Authorization and Support Team (CAST)

     Deficient cases are being closed in the CAST by the support contractor. As of
     September 2, 2009, we requested the most recent audits of the CAST to determine ifFIS has
     proper oversight of the CAST. Based on the QMG audits in March 2009,28.24 percent of
                                                10
the 85 sampled closed cases were unacceptable, and in June 200926.87 percent of the 67
sampled closed cases were unacceptable.

FIS is not enforcing the CAST case cursory review requirements, which should be followed
by the support contractor.

On a quarterly basis, QMG conducts audits of the limited review and closing functionas
performed by the CAST. This is an internal control that FIS has in place to evaluate the
quality of the closing review process performed by the CAST. During the audit, QMG
compares the review and closing work perfonned by the CAST to the requirements set forth
in their contract. The results are provided to PIS' Capacity Development and Oversight
Group, which forwards the results to the contractor. Depending on the nature of the problem
with the background investigation, QMG may require the support contractor to correct it or it
may be turned over to IRG for Federal review staff to correct the problem.

The criteria for closing cases in the CAST are based upon section 36.2.3 of the Case Cursory
Review document which states "Ensure that the fieldwork covers case requirements. If the
fieldwork does not cover what is required for a particular case type, the case must go back to
the Review Contractor for full review."

The Support Services Contract, section c.l. 7.1, states that OPM will initiate a quality
assurance program to monitor services provided which includes the contractor's quality.
Section CA states that all work perfOlmed under the contract will be performed according to
the operation manuals, instructions, memos, and as instructed by authorized OPM Personnel.
The Case Cursory Review requirements are used to determine if a case has the correct
documentation needed to be closed.

GAO's Standards for Internal Control in the Federal Government state that management is
responsible for developing control activities, which are the policies, procedures, teclmiques
and mechanisms that enforce management's directives. Control activities occur at all levels
and functions of an entity and include a wide range of activities, such as approvals,
authorizations, verifications, reconciliations, performance reviews, and the creation and
maintenance of related records which provide evidence of execution of these activities as
well as appropriate documentation. Examples of control activities/techniques include top
level reviews of actual perfonnance and reviews by management at the functional or activity
leveL

In addition, internal controls should be designed to assure that ongoing monitoring occurs in
the course of normal operations. It should be performed continually and ingrained in the
agency's operations.

By not enforcing the CAST case cursory review requirements, there is an increased risk that
the number of deficient cases being closed will continue to increase.




                                            11
        Recommendation 5

        We recommend that FIS design internal controls to ensure that ongoing monitoring of the
        CAST occurs during the normal ~ourse of operations.

        FIS' Response:

        "FIS concurs with this recommendation" and stated that "The internal control of Quality
        Management auditing the contractor-conducted CAST process, on a quarterly basis, will
        remain in effect until the function is moved to the Federal staff. The most recent audit was
        completed on October 9,2009 for the first quarter of Fiscal Year 2010. QMG is in the
        process of scheduling an audit for the current quarter. Once the function moves to the Federal
        staff, Quality Management will audit this function as part of its random review process (daily
        basis)."


C. Training for Investigative Personnel

   1.   Investigative Technician Training

        USIS and KGS did not provide an OPM-approved training course to Investigative
        Technicians who conduct record checks.

        We selected ail 8 new USIS Record Searchers and all 14 KGS Investigator Technicians to
        detennine if the employees that conduct record checks have met the qualifications to perform
        their duties. The results of our review disclosed that all 8 USIS Record Searchers and 13 out
        of 14 KGS Investigator Technicians had not received training, as required by the FIS
        contract.

        USIS did not provide a reason as to why seven individuals had not been trained. One Record
        Searcher had received training offered at the local/field level; however, the training has not
        been approved by OPM. USIS also stated that they were currently being audited by OPM's
        Program Training Branch and that they have not received approval or rejection for their
        Record Search training.

        KGS does not conduct formal training; instead, the Investigator Technicians that perform
        record checks have received on-the-job training related to the specific tasks that they
        complete. KGS stated that although they have an OPM-approved training program in place,
        tests are not given because KGS considers them to be unnecessary due to post-audits and
        reviews being performed on all cases after on-the-job training is completed. We noted that
        KGS could not provide documentation to support that they have an OPM-approved training
        course.

        The Conformed Fieldwork Contract, Attachment 4: QualificalionslTraining Standards, dated
        January 8,2009, states that the qualifications for an Investigative Teclmician include

                                                    12
     "Successful completion of an IT/Record Courier training course which has been approved by
     aPM .... "

     The Contract also states that "OPM requires that certain personnel performing work under
     this contract possess minimum qualifications and training, ... and reserves the right to review
     these qualifications, determine if the minimum requirements are met, and whether the
     individual shall be permitted to perfonn work on the contract. All contract personnel
     conducting work on the contract must be trained through an aPM approved contractor
     training plan."

     As a result of USIS and KGS not providing employees that conduct record checks with
     formal OPM-approved training, there is an increased risk that the work performed by the
     technicians may be incomplete and inaccurate.

     Recommendation 6

     We recommend that FIS require USIS and KGS to provide an OPM~approved training course
     to all employees who perform record checks.

     FIS' Response:

     "FIS concurs with this recommendation." FIS has been informed by USIS that the course is
     no longer being provided and they are working with KGS on an approved training course.

     OIG Comment:

     FIS' response that USIS is no longer providing this training does not satisfy our
     recommendation. It is our opinion that an OPM~approved training course is still needed for
     any employee who perform record checks, including the eight USIS employees identified
     above. We continue to recommend that FIS ensure that all employees who perform record
     checks complete an aPM~approved training course.

2.   Mentor Training

     We found that 18 of the 20 mentors at FIS did not complete a mentor training course. The
     names of the mentors were provided to FIS separate from this report.

     Mentors are assigned to new Investigators and are responsible for helping the new
     Investigator become acclimated with their work life, their tasks, and their responsibilities.
     The mentor also evaluates the new Investigator to ensure they are developing the skills
     required to become an Investigator.

     We judgmentally sampled 25 out of 48 new Investigators to determine if each was assigned a
     mentor. We than selected the 20 mentors assigned to these Investigators for our review. We
     tested the training records of the 20 mentors and determined that training had only been
     provided to 2 of them.
                                                  13
     GAO's Standards/or Internal Control in the Federal Government state that "All personnel
     need to posses and maintain a level of competence that allows them to accomplish their
     assigned duties, as well as under~tand the importance of developing and implementing good
     internal control. Management needs to identify appropriate knowledge and skills needed for
     various jobs and provide needed training ...."

     GAO's Standards/or Internal Control in the Federal Government also state that
     "Management should ensure that skill needs are continually assessed and that the
     organization is able to obtain a workforce that has the required skills that match those
     necessary to achieve organizational goals. Training should be aimed at developing and
     retaining employee skill levels to meet changing organizational needs."

     By not having all mentors attend mentor training, there is a risk that new Investigators may
     not receive the proper instruction to perfonn their duties, which may lead to a decrease in the
     quality of background investigations.

     Recommendation 7

     We recommend that FIS have all mentors complete a mentor training course prior to serving
     as a mentor to new Background Investigators.

     FIS' Response:

     "FIS concurs with this recommendation" and stated that four mentors for each FISD Region
     participated in the first standard mentor training course that was conducted May 24
     through 28,2010.

3.   Investigator Training for Contractors

     We judgmentally selected 25 out of 330 experienced KGS Investigators and 25 out of 2,292
     experienced USIS Investigators to determine if they met the qualifications to perfonn their
     duties. We concluded that:

         • 	 KGS could not support that one Investigator passed the training course final exam
             with a score of at least 80 percent.
         • 	 One USIS Investigator failed the New Investigator Training (NIT) final exam, but
             their training system showed that the Investigator passed the NIT course on the same
             date that the final exam was failed. No documentation was provided showing that
             the Investigator ever re-took and passed the NIT final exam.

     The Con/armed Fieldwork Contract, Attachment 4: Qualifications/Training Standards, dated
     January 8, 2009, states that "All contract personnel conducting work on the contract must be
     trained through an OPM approved contractor training plan. The plan must include, but is not
     limited to, in class instruction on all aspects of duties, mock interviews applicable to position,

                                                  14 

     an open book final exam that must be passed with at least an 80% score, a minimum of one
     week on-the-job training for all Investigative staff with experience and 3 weeks for those
     with no experience."

     In addition, the Contract states that "An incumbent (. .. investigator ... ) in good standing
     currently conducting investigations on OPM contracts may be transferred to another entity
     without any additional training. Training is left to the discretion of the investigative entity
     when the incumbent has 18 months of consecutive OPM experience (in the respective job
     title) and less than 8 months of inactivity working OPM investigations."

     The absence of documentation to support that all Investigators are properly qualified
     increases the risk that there are Investigators who have not been properly trained and cleared
     to perform background investigations on behalf of FIS. Unqualified individuals working on
     background investigations can lead to the investigation and related Personally Identifiable
     Information being compromised.

     Recommendation 8

     We recommend that FIS require KGS and usrs to provide documentation to support that the
     Investigators have completed all qualifications necessary in order to perform background
     investigations on behalf of FrS.

     FIS' Response:

     FIS concurs with this recommendation and stated that, "OPM will conduct inspections to
     ensure that the contractor's are maintaining the qualifications as outlined in the contract."

4.   Check Rides Not Conducted by Contractor

     USIS did not conduct check rides for 2 ofthe 25 new Investigators that we sampled. A
     check ride is an evaluation tool used to verify that Investigators are conducting background
     investigations according to field standards. We judgmentally sampled 25 out of 137 new
     Investigators to determine if USIS conducts a check ride at the conclusion of the new
     Investigator's field training process.

     usIS stated that check rides for the two identified Investigators had not yet been conducted
     this year. We noted that both Investigators completed field training prior to October 2008.

     For new Investigators, USIS' Check Ride Standards/Field Quality Assurance Policy states
     that "The investigator will complete their field training with the Field Training Officer
     (FTO), Certified Field Trainer (eFT), or Team Leader. The trainer will complete the initial
     check ride with the new investigator at the completion of the new investigator field training
     process."

     Not completing the required check ride for each new Investigator at the completion of their
     field training process increases the risk that USIS will not be able to ensure the new
                                                    15
     Investigator is efficient, capable, andlor reveal any weaknesses that may compromise their
     investigations. There is also an increased risk that the information contained in the new
     Investigator's Report of Investigation may be incorrect or falsified.

     Recommendation 9

     We recommend that FIS instruct USIS to update its Check Ride Standards/Field Quality
     Assurance Policy to include a defined timeframe as to when USIS must conduct check rides
     for their new Investigators once they have completed their field training.

     FIS' Response:

     "FIS concurs with this recommendation" and stated that they "will instruct USIS to review
     their internal check-ride policy and make a determination on a defined timeframe."

5.   Check Rides at FIS Not Conducted

     We judgmentally sampled 25 out of 1,417 experienced FIS Investigators to determine if each
     Investigator received, at a minimum, one check ride in the last 12 months. Seven of the 25
     experienced Investigators we sampled did not have a check ride assessment conducted during
     the period October 1,2008 to September 4,2009. The names of the Investigators were
     provided to FIS separate from this report.

     FIS' Check Ride Performance Standards state, "At a minimum, one supervisory check-ride
     shall be accomplished during the performance appraisal period. Two additional supervisory
     check-rides must be accomplished when the initial check-ride results in an unacceptable
     rating."

     As a result of FIS not conducting an arumal check ride of their experienced Investigators
     there is an increased risk that FIS is not identifying poor performers who need additional
     training and mentoring in order to properly perform their job. In addition, FIS may not be
     detecting instances of fraudulent background investigations since these check rides are used
     as a tool for supervisors to monitor and review the Investigator's work.

     Recommendation 10

     We recommend that FIS ensure that all Background Investigators receive at least one
     supervisory check ride assessment per appraisal period.

     FIS'Response:

     "FIS has complied with this recommendation. In the case of <DELETED BY OPM-OIG,
     NOT RELEVANT TO THE AUDIT REPORT>, she was promoted to an Agent on April 12,
     2009 from an Investigative Assistant position. Prior to becoming an agent there would have
     been no requirement or need for her to attend the BIC [Basic Investigative Course]. She
     completed the BIC on 10123/2009. Prior to that she would have been in training and
                                                 16
     assigned a mentor. The documentation for the other six agents is attached showing they had
     a check ride conducted or were in training. FIS did meet all requirements for each agent"

     OIG Comment:

     Based on FIS' response, they have complied with the recommendation; however, we were
     not provided support that the agent did not complete the BIC until after the end of our
     fieldwork and therefore would not have had a check ride completed. In addition, we were
     not provided copies of the check rides in order to verify the dates that they were completed.

6.   Evaluation Results Not Documented

     CAC! does not have a process in place to document the results of their evaluations of
     Investigators.

     We requested copies of the results of evaluations conducted under the CACI evaluation
     program which were submitted to FIS from October 1, 2008 through our audit site visit,
     which was August 10 through 14,2009. Based on this request, there was some uncertainty
     from CACI as to what specific documents should be sent to FIS.

     CACI stated that they do not conduct check rides with Investigators. CAeI currently has a
     mentoring program; however, it does not include any written evaluations of the Investigator
     candidate.

     FIS Fieldwork Contract Quality Assurance Provisions Applicable to CAC]
     (OPM040600012) fieldwork contracts, section C.6.1.8, states that "The Contractor shall
     establish a program for the evaluation of investigators and investigative technicians during
     the performance of their work to ensure compliance with the professional conduct
     requirements and investigative standards of this contract This may include, but is not limited
     to, such things as a mentoring program, a ride-along program, or similar evaluation
     programs. The results of evaluations conducted under the Contractor's evaluation program
     must be forwarded to the COR within 30 days of the date of the evaluation or, if otherwise
     appropriate, in accordance with the requirements of this contract."

     By not documenting the results of evaluations, CACI and FIS will not be able to ensure that
     field Investigators are maintaining professional conduct and investigative standards outlined
     in the contract. If Investigators are not adhering to professionalism and investigative
     standards, investigations may be compromised, leading to a decrease in their quality.

     Recommendation 11

     We recommend that FIS require CACI to implement controls to ensure that the results of
     evaluations conducted under CACI's evaluation program are documented and forwarded to
     the COR within 30 days of the date ofthe evaluation.


                                                 17
     FIS' Response:

     "FIS does not concur with this recommendation." FIS stated that "CACI has an established
     evaluation program. CACI sub~itted their evaluations on January 8, 2010 (attached), and
     will submit their evaluations no later than 30 days after the end of the rating period for future
     submissions. FrS has incorporated a review and validation of the report as part of the
     workload goals and FIS will conduct inspections for all contractors tbroughout the year to
     ensure compliance."                                                                       .

     OIG Comment:

     As stated in our finding CACI did not have documentation to support the results of its
     evaluation program during our audit. Based on FIS' response, CACI submitted their
     evaluation results on January 8, 2010. FIS provided a copy ofCACI's spreadsheet which
     covered the period December 1,2008 through December 1,2009. Since there was no
     discussion during our audit that the rating period was still in progress or a discussion of how
     the ratings were in fact tracked, it appears that this is a new process that has been
     implemented since our audit work ended.

7.   Oversight of Contractors' Evaluation Submissions

     FIS does not have controls in place to ensure that the Contractors are submitting their
     evaluation results to the Contracting Officer'S Representative (COR).

     We requested copies of the results of evaluations, which were submitted to FIS, conducted by
     each Contractor since October 1, 2008. As stated under finding C.6. above, we detennined
     that CAeI did not have a process in place to document the results of their evaluations of
     investigators. We also found that USIS and KGS conduct and document employee
     evaluations; however, they do not submit the evaluation results to FIS.

     KGS stated that they have not submitted evaluations to OPM because "the contract is vague
     about exactly what is supposed to be submitted and on whom. It does not specifically state if
     there are differences between full timers and contract investigators and whether they needed
     all documents. It does not state in what format they need to be submitted and OPM has never
     requested this infonnation. We can provide the data if we knew more parameters." USIS
     keeps their evaluations on file and they have been reviewed by OPM personnel during on-site
     visits; however, USIS has never received a request from FIS asking for the submission of
     employee evaluations.

     FIS has not issued any procedures or guidance to the Contractors as to what documentation
     regarding evaluation results should be submitted to the COR. In addition, FIS stated that
     they have not requested employee evaluations in the past year.

     The FIS Fieldwork Contract Quality Assurance Provisions Applicable to USIS
     (OPM040600013), CAeI (OPM040600012), and Kroll <KGS> (OPM040600011)jieidwork
     contracts, section C. 6.1. 8, states that "The Contractor shall establish a program for the
                                                     18
         evaluation of investigators and investigative technicians during the performance of their
         work to ensure compliance with the professional conduct requirements and investigative
         standards of this contract. This may include, but is not limited to, such things as a mentoring
         program, a ride-along program, qr similar evaluation programs. The results of evaluations
         conducted under the Contractor's evaluation program must be forwarded to the COR within
         30 days of the date of the evaluation or, if otherwise appropriate, in accordance with the
         requirements of this contract."

         As a result of FIS not overseeing that the results of Contractors' evaluations are submitted,
         FIS will not be able to ensure that Contractor personnel are maintaining professional conduct
         and investigative standards outlined in the contract and/or the Investigator's Handbook. If
         personnel are not adhering to professionalism and investigative standards, investigations may
         be compromised leading to a decrease in the quality of background investigations.

         Recommendation 12

         We recommend that FIS issue guidance to clearly explain what documentation is expected
         from the Contractors related to their evaluation program for investigative personnel.

         FIS' Response:

         FIS concurs with this recommendation and stated that they "will immediately issue
         clarification to the contractor as to what is required to be submitted in accordance with the
         contract section C.6.1.8 and attachment 4."


D. FalsificationlIntegrity Issues

   1.    Misconduct Issues Not Submitted Timely

         USIS did not forward misconduct issues to OPM within the required timeframe for 7 of the
         40 Investigators reviewed. Details regarding the seven Investigators were provided to FIS
         separate from this report.

         We reviewed all 40 Investigators with misconduct issues identified from October 1,2008 to
         August 11, 2009 to determine if the information was properly referred to OPM. USIS stated
         that there is no formal procedure on when to record the times that the USIS Integrity
         Assurance Team receives a misconduct issue.

         The Conformed Fieldwork Contract dated January 8, 2009, Section Cll. O. 6, states, "in
         regard to notification of allegations of misconduct, the Contractor shall make such
         notification within one workday whenever possible but in no case exceed 3 workdays in
         doing so."

        Section H3 also states: "Any action or misconduct by a Contractor employee or
        subcontractor that might adversely affect (1) the integrity of an investigative product or
                                                    19
     OPM's automated system, (2) OPM's access to source information, (3) a subject or source's
     privacy rights, (4) the security of investigative material or OPM equipment or facilities, or
     (5) the individual's basic suitability to perform work under this contract, or (6) workplace
     safety, is of concern to OPM. If qiscovered by the Contractor, the Contractor shall
     immediately notify OPM of the individual's identity, the nature of the alleged negligence or
     misconduct, and any investigations that may require review and/or reopening."

     The USIS Fieldwork Services Quality Assurance Surveillance Plan, Section B. 7, states, "The
     USIS Integrity Assurance Team will notify OPM within 24 hours of any integrity issue
     developed by the field."

     If misconduct issues are not forwarded to aPM in accordance with established timelines,
     there is an increased risk that an unethical Investigator may be performing background
     investigations, thus increasing the risk to national security.

     Recommendation 13

     We recommend that FIS require USIS to establish procedures to ensure that misconduct
     issues are documented and reported to aPM within the timeliness standards outlined in the
     contract and USIS policy.

     FIS'Response:

     FIS concurs with this recommendation and stated that they "will require USIS to adhere to
     the time frame in section C.ll.06, Section H.3, and Section B.7 once a misconduct issue is
     identified. "

2.   Record Source Validations Not Performed

     We requested documentation (i.e., reports, spreadsheets, etc.) to support that record
     validations were performed, from October 1,2008 through August 19,2009, on all
     investigative personnel who perform record searches. The results of our review disclosed
     that the Contractors did not have controls in place to conduct record source validations.
     Specifically we found that:

        • 	 USIS and CACI do not re-contact and validate at least two record sources per quarter
            per investigative personnel. USIS stated that they were under the impression that FIS
            would complete all record source re-contacts similar to the personal source re­
            contacts that FIS performs.

        • 	 KGS could not provide support that record validations were completed prior to
            August 19,2009 for Investigator Technicians. In addition, they were unable to
            support that they completed two record validations per quarter for each Background
            Investigator. KGS stated that documentation to support record validations done for
            Investigator Technicians was destroyed after 120 days. In addition, KGS does not

                                                 20 

             maintain a system to demonstrate that a sufficient number of record validations are
             performed for each Background Investigator or Investigator Technician that performs
             record searches.

     FIS Fieldwork Contract Quality Assurance Provisions Applicable to CAeL USIS, and KGS
     (OPM040600012, OPM0406000J3, OPM04060001J) fieldwork contracts, section C.6.1.5,
     states that "The Contractor shall validate record sources; at least two record sources per
     quarter per investigative personnel must be randomly re-contacted to validate the fact that the
     search was conducted and the accuracy of the record information obtained."

     If record sources are not validated in accordance with the contract, there is an increased risk
     that if the initial record search was not conducted or the information reported is inaccurate, it
     will not be discovered.

     Recommendation 14

     We recommend that FIS require the Contractors to develop and implement internal controls
     to ensure that at least two record sources per quarter per investigative personnel are randomly
     re-contacted to validate the fact that the search was conducted and the accuracy of the record
     information obtained. Internal controls should include a requirement for KGS to maintain
     documentation to support the completion of the re-contacts.

     FIS~   Response:

     "Frs concurs with this recommendation" and stated that they "will conduct inspections
     throughout the year to ensure contractor compliance."

3.   Review of Record Checks

     FIS did not conduct the required number of record check reviews for all Investigative
     Assistants.

     FIS' Centralized Lead Branch (eLB) assists field resources in conducting certain
     investigative work. Specifically, this group can accomplish credit record reviews, law
     searches, Internal Revenue Service record reviews, as well as access bankruptcy,
     employment and education records. Mentors and Team Leaders within the CLB review
     record checks on a monthly basis to determine if the completed record search is acceptable,
     correct, and complete.

     In order to verify that record checks are being reviewed, we requested documentation (i.e.,
     reports, spreadsheets, etc.) to support reviews/validations of record checks performed from
     October 1,2008 through August 25, 2009. FIS provided a spreadsheet that is used to record
     the results of the random reviews conducted on the 54 Investigative Assistants. The
     spreadsheet captures the numbers reviewed as deficient, acceptable, and acceptable with
     advisory; however, it does not provide details to support the ratings. That information is
     maintained by the Team Leader in the individual's folder. The spreadsheet also does not
                                                   21
contain the last name for each Investigative Assistant; therefore, we selected all Investigative
Assistants for our review.

Based on the results of our revie~ we found that:

   • 	 The CLB Mentors did not complete any reviews of record checks.
   • 	 Four of the six CLB Team Leaders (teams 1,4,5, and 6) have not perfonned their
       required random reviews for two Investigative Assistants per month.         .
   • 	 There were no record check reviews perfonned for 18 of the 54 Investigative
       Assistants in one or more quarters from October 1,2008 through August 25,2009.

PIS stated that due to the number of new employees this fiscal year and the extensive time
involved in a 100 percent review of these trainees' work, the two quality/training team
personnel (the Mentors) were unable to assist with the random reviews.

The Performance Standards Formfor aPM Employees states that Investigator GS-181O-12
(Team Leaders) "Maintains quality controls for those investigative leadslrecords checks that
have been assigned as a primary responsibility. Conducts random review of the work of2
Investigative Assistants per month at a rate of 10 checks per Investigative Assistant."

For the Mentors, the Performance Standards Formfor aPM Employees states that
Investigator GS-181 0-12 (Quality/Training) "Maintains quality controls by contributing to the
effort to ensure that random review of work is conducted at an overall rate of 10 per quarter per
Investigative Assistant, GS-06 and above."

GAO's Standards for Internal Control in the Federal Government state that management is
responsible for developing control activities, which are the policies, procedures, techniques
and mechanisms that enforce management's directives. Control activities occur at all levels
and functions of an entity and include a wide range of activities, such as approvals,
authorizations, verifications, reconciliations, performance reviews, and the creation and
maintenance of related records which provide evidence of execution of these activities as
well as appropriate documentation. Examples of control activities/techniques include top
level reviews of actual performance and reviews by management at the functional or activity
leveL

In addition, internal controls should be designed to assure that ongoing monitoring occurs in
the course of normal operations. It should be performed continually and ingrained in the
agency's operations.

If record sources are not reviewed and validated, there is an increased risk that future record
searches may not be conducted or the information reported may be inaccurate.




                                             22 

     Recommendation 15

     We recommend that FIS develop and implement internal controls to ensure that at least 10
     reviews of record checks per quarter per Investigative Assistant are completed to validate
     that the search was conducted and that the record information reported is accurate.

     FIS'Response:

     FIS concurs with this recommendation and stated that "The Centralized Leads unit has
     developed and implemented the recommended internal controls. In addition, we are planning
     this FY to include the review results in the unit's database to allow automated analysis of
     problems/trends. During the first qum1er of FY20 10, our random review efforts have
     improved greatly. The required audit will exceed the requested 10 checks per quarter (per
     IA) as recommended."

4.   Re-Contact of Personal Sources by Contractors

     CACI and KGS did not conduct the required amount of re-contacts for all new Investigators
     that we sampled. In addition, for CACI we were unable to determine whether the re-contacts
     that were performed were completed within 60 calendar days of the initial contact.

     For the period of May 1 through 31, 2009, we selected 25 out of 68 new CACI Investigators
     and 25 out of 299 new KGS Investigators. We reviewed re-contact documentation to
     determine whether CAeI and KGS performed personal source re-contacts for each of the
     Investigators in accordance with contract provisions. The results of our review disclosed that
     seven of the CACI and five of the KGS Investigators had not received the appropriate
     number of re-contacts. Details about the Investigators were provided to FIS separate from
     this report.

     The re-contacts were not completed by CACI's Quality Assurance Department due to the
     following reasons:
            • 	 Three re-contacts were not performed because two Investigators did not turn in
                their Source Listing Sheets;
            • 	 One re-contact was not performed because the source only spoke Spanish~ and
            • 	 Four re-contacts for four Investigators were not performed because QA did not
                complete them.

     We were unable to determine if re-contacts were made within 60 calendar days ofthe initial
     source interview because neither the Personnel Investigations Processing System nor CACI's
     iTRAX system (CACl's primary case management tool) tracks the dates of when initial
     source interviews are conducted.

     KGS' system only generates a re-contact when at least 34 sources are interviewed per
     investigator per year. KGS explained that doing one re-contact out of a sample of 26 source
     interviews would be asking too much since it is over three percent.

                                                 23
     FIS Fieldwork Contract Quality Assurance Provisions Applicable to CAe! and Kroll
     <KGS> (OPM040600012, OPM040600011)jieldwork contracts, section C.6.1.5, states that
     "The Contractor shall conduct re~contacts of personal sources by mail, telephone, or in
     person on a random sampling basis. During the first year of the investigator's employment
     the contact will be done telephonically. Randomly, on an annual basis, no less than three (3)
     percent of all personal sources obtained by each investigative personnel shall be re-contacted
     within 60 calendar days of the initial contact."                                       .

     Not completing the required re-contacts for each Investigator during their first year of
     employment increases the risk that CACI and KGS will not be able to ensure the new
     Background Investigator is efficient and capable and/or reveal any weaknesses that may
     compromise their background investigations.

     Recommendation 16

     We recommend that FIS require CACI to strengthen their internal controls to ensure that
     during the first year of the Investigator's employment CACI randomly contacts no less than
     three percent of all personal sources obtained by each investigative personnel within 60
     calendar days of the initial contact.

     Recommendation 17

     We recommend that FIS require KGS to strengthen its policy/procedures over their re­
     contact program to ensure that at least one re-contact is performed during the first year of the
     Investigator's employment. The re-contact programs should be conducted within 60 calendar
     days of the initial interview and should be no less than three percent of all personal sources
     obtained by each Investigator.

     FIS'Response:

     FIS concurs with these recommendations and stated that "In response to the sample taken and
     referenced in the 010 letter of 12122/09, FIS asserts the foHowing: The requirement for the
     3% re-contact of all personal sources is based on a yearly requirement. A sampling taken
     during a portion ofthe year is not an adequate sampling method. To further ensure
     compliance is met for the year, FIS will conduct unannounced inspections to verify
     compliance. "

5.   Re-Contact of Personal Sources by FIS

     FIS did not conduct the required 3 re-contacts for It of the 80 Investigators we sampled.
     Details regarding the Investigators that did not receive the required three re-contacts per
     month were provided to FIS separate from this repo11.

     We judgmentally sampled 80 out of 4,831 Investigators from both FIS and the Contractors.
     Our sample consisted of 10 new and 10 experienced Investigators from FIS and each of the 3
                                              24
Contractors. For the period of May I through 31,2009, we reviewed re-contact
documentation to determine whether FrS performed personal source re-contacts for each of
the 80 Investigators.

Re-contacts for seven Investigators were not performed because a database problem excluded
all Investigators with a staff identification starting with the letter "W". FIS stated that the
problem was not identified until we selected the sample and that it was localized to new
Investigators. Re-contact letters for three Investigators were not perfonned because the
database excludes all Investigators that did not complete the zip code field within the
database. Lastly, no specific reason could be identified as to why a re-contact letter was not
sent for one Investigator; however, FIS believes it may be due to an anomaly resulting from
database modifications.

FIS' Personnel Source Re-Contact Program includes conducting at least three source re­
contacts per Investigator (both Federal and Contractor) per month.

OMB Circular A-123 (Introduction) indicates that "Management has a fundamental
responsibility to develop and maintain effective internal controL The proper stewardship of
Federal resources is an essential responsibility of agency managers and staff. Federal
employees must ensure that Federal programs operate and Federal resources are used
efficiently and effectively to achieve desired objectives."

GAO's Standards for Internal Control in the Federal Government state that management is
responsible for developing control activities, which are the policies, procedures, techniques
and mechanisms that enforce management's directives. Control activities occur at all levels
and functions of an entity and include a wide range of activities, such as approvals,
authorizations, verifications, reconciliations, performance reviews, maintenance of security,
and the creation and maintenance of related records which provide evidence of execution of
these activities, as well as appropriate documentation.

In addition, internal controls should be designed to assure that ongoing monitoring occurs in
the course of normal operations. It should be performed continually and ingrained in the
agency's operations.

Not completing the required re-contacts for each Investigator results in an increased risk that
FrS will not be able to ensure the Investigator is efficient, capable, and/or identifies any
weaknesses that may compromise background investigations.

Recommendation 18

We recommend that FIS strengthen their internal controls over their re-contact program to
ensure that they complete the required number of re-contacts per Investigator each month.




                                            25 

FIS' Response:

"FIS concurs with this recommendation" and stated that they have "implemented an audit of
the information generated from tp.e re-contact letter database to ensure that the required
numbers of re-contact letters are sent per investigator on a monthly basis. . .. The results of
each monthly audit are filed and maintained by Investigations Support, .. ,"




                                            26 

         IV.    MAJOR CONTRIBUTORS TO THIS REPORT 


Internal Audits Group




                      Auditor
               Audi tor-in-Charge
                     Senior Team Leader
• • • • • •Chief




                                          27 

                             [January 22,2010]                                    APPENDIX



MEMORANDUM FOR 

                Chief, Internal Audits Group

FROM                     KATHYL. DILLAMAN
                         Associate Director
                         Federal Investigative Services

SUBJECT:                 Draft Report on the Audit of the Quality Assurance Process over
                         Background Investigations.
                         Report No. 4A-IS-00-09-060


The Federal Investigative Service (FIS) has reviewed the draft audit report of the Quality
Assurance Process over Background Investigations and we concur with the findings and
recommendations (except as otherwise noted) identified in the report. FIS is responsible for
resolving the issues raised and implementing the recommendations provided in this audit. The
response to the recommendations and an action plan (when applicable) are included as indicated.

We recognize that even the best performing programs benefit from an independent external
evaluation and we appreciate the input of the Office of the Inspector General in an effort to
ensure the effectiveness and efficiency of our Quality Assurance Process over Background
Investigations. We will use your recommendations as part of our on-going effort and focus to
improve our program and operations.


Recommendation 1:

We recommend that FIS implement a standardized universal training program that is required to
be used by FIS and its Contractors for all personnel who perform work completing background
investigations (i.e. Investigators, reviewers and personnel completing records checks).

FIS Management Response

FIS concurs with this recommendation. The current field contracts do not require the contractors
to have their investigators training conducted by OPM. They are responsible for conducting
their own training. However, their training plans must be approved by OPM in advance and their
curriculum must be based on OPM's Investigator's Handbook. OPM/FrS staffregularly audits
contractor-conducted training classes. When the new contracts are awarded in 2011, FrS will
mandate that all companies doing investigative work on behalf of OPM send their investigators
to training classes conducted by OPM. In the interim, contractor companies can voluntarily send
their investigators to the OPM Basic Investigators course. To date, OPM/FIS has provided the
full training course to four CACI investigators, and investigators/staff from USIS and CACI have
monitored the course.

Necessary modifications have been ~ade to training materials to ensure that they are suitable for
Federal and contractor field agents. With the issuance of new field contractors in 2011, FIS
Training and Professional Development (TPD) will have adequate capacity to provide training to
all field agent staff (Federal and contractor) that supports OPM's investigations program.

Recommendation 2:

We recommend that Frs implement Quality Case review program throughout all of the regions.

FIS Management Response

FIS concurs with this recommendation. All regions have been provided with the standard review
tools and tracking system developed by the Northern Region. FlS is reviewing this process to
make additional changes and will continue to refine this tool as we move forward. All regions
have received training on the automated tool that will allow standard tracking of reviewed cases
throughout the Federal field. Full implementation is expected by the end of January 2010.

Recommendation 3:

We recommend that FIS implement the use of an annual Integrity Statement for its employees
and Contractors to assist in any possible falsification cases.

FIS Management Response

FIS cannot concur with this recommendation until the legality of such a statement is determined
by OPM's Office of General Counsel (OGC). We will present this issue to OGC for an opinion
before developing an action plan.

Recommendation 4:

We recommend that FrS resume the random case review process and ensure that internal controls
are designed to assure that ongoing monitoring occurs in the course of normal operations.

FIS Management Response

FIS concurs with this recommendation and has resumed random review as of January 8, 2010. It
should be noted that the random review process was only temporarily suspended in order to
develop a training refresher course based on the findings of the year-long random review pilot.

Recommendation 5=

We recommend that FIS design internal controls to ensure that ongoing monitoring of the CAST
occur during the normal course of operations.
FIS Management Response

FIS concurs with this recommendation. The internal control of Quality Management auditing the
contractor-conducted CAST process, on a quarterly basis, will remain in effect until the function
is moved to the Federal staff. The most recent audit was completed on October 9, 2009 for the
first quarter of Fiscal Year 2010. QMG is in the process of scheduling an audit for the current
quarter. Once the function moves to the Federal staff, Quality Management will audit this
function as part of its random review process (daily basis).

Recommendation 6:

We recommend that FIS require USIS and KGS to provide an OPM approved training course to
all employees who perform record checks.

FIS Management Response

FIS concurs with this recommendation. FlS is currently working with USIS and KGS on an
approved training course with an anticipated implementation date of March 1, 2010

Recommendation 7:

We recommend that FIS have all mentors complete a mentor training course prior to them
serving as a mentor to the Investigators.

FIS Management Response

FIS concurs with this recommendation. A standard mentor training course will be in place by
March 1, 2010, and all new mentors will be required to successfully complete the training before
serving as a mentor.

Recommendation 8:

We recommend that FIS require KGS, and USIS to provide documentation to support that the
investigators have completed all qualifications necessary in order to perform background
investigation on behalf of FIS.


FIS Management Response

FIS concurs with the recommendation of having the contractors provide documentation to
support the investigators qualifications. In accordance with Attachment A and Section H.16 of
the contract, the contractor is required to maintain documentation regarding the investigator's
qualifications. OPM will conduct inspections to ensure that the contractor's are maintaining the
qualifications as outlined in the contract.
Recommendation 9:

We recommend that FIS instruct USIS to update its Check-Ride Standards/Field Quality
Assurance Policy to include a define,d timeframe as to when USIS must conduct check rides for
their new investigators once they have completed their field training.

FIS Management Response

FIS concurs with this recommendation. FIS will instruct US IS to review their internal check-ride
policy and make a determination on a defined timeframe.

Recommendation 10:

We recommend that FIS ensure that all Investigators receive at least one supervisory check-ride
assessment per appraisal period.

FIS Management Response

FIS has complied with this recommendation, In the case of <DELETED BY OPM-OIG, NOT
RELEVANT TO THE AUDIT REPORT>, she was promoted to an Agent on April 12,2009
from an Investigative Assistant position. Prior to becoming an agent there would have been no
requirement or need for her to attend the BIC. She completed the BIC on 1012312009. Prior to
that she would have been in training and assigned a mentor. The documentation for the other six
agents is attached showing they had a check ride conducted or were in training. FIS did meet all
requirements for each agent.

Recommendation 11:

We recommend that FIS require CACI to implement controls to ensure that the results of
evaluations conducted under CACI's evaluation program are documented and forwarded to the
COR within 30 days ofthe date of evaluation.

FIS Management Response

FIS does not concur with this recommendation. CACI has an established evaluation program.
CAeI submitted their evaluations on January 8,2010 (attached), and will submit their
evaluations no later than 30 days after the end of the rating period for future submissions. FIS
has incorporated a review and validation of the report as part of the workload goals and FrS will
conduct inspections for all contractors throughout the year to ensure compliance,

Recommendation 12:

We recommend that FIS issue guidance to clearly explain what is expected from the Contractors.
FIS Management Response

FIS concurs with this recommendation. FIS will immediately issue clarification to the contractor
as to what is required to be submitted in accordance with the contract section C.6.1.8 and
attachment 4.                        '

Recommendation 13:

We recommend that FIS requires USIS to establish procedures to ensure that misconduct issues
are documented and reported to OPM within the timeliness standards outlined in the contract and
USIS policy.

FIS Management Response

Frs concurs with this recommendation. FIS will require USIS to adhere to the time frame in
section C.ll.06, Section H.3, and Section B.7 once a misconduct issue is identified.

Recommendation 14:

We recommend that FIS require the Contractors to develop and implement internal controls to
ensure that at least two record sources per quarter per investigators are randomly recontacted to
validate the fact that the search was conducted and the accuracy of the record information
obtained. Internal controls should include a requirement for KGS to maintain documentation to
support the completion of the re-contacts.

FIS Management Response

FIS concurs with this recommendation. As outlined in Section C.6.1.S, the contractors are
required to conduct and maintain documentation on the record source re-contacts. FIS will
conduct inspections throughout the year to ensure contractor compliance.

Recommendation 15:

We recommend that Frs develop and implement internal controls to ensure that at least ten
reviews of record checks per quarter per Investigative Assistant are completed to validate that the
search was conducted and that the record information reported is accurate.
FIS Management Response

FIS concurs with this recommendation. The Centralized Leads unit has developed and
implemented the recommended internal controls. In addition, we are planning this FY to include
the review results in the unit's database to allow automated analysis of problems/trends. During
the first quarter of FY20 10, our random review efforts have improved greatly. The required
audit will exceed the requested 10 checks per quarter (per IA) as recommended.

The field contracts do not state when during the year or how often source re-contacts be
conducted. The contracts only specify that 3% of all sources interviewed by an investigator be
 re-contacted. Contracting can make a recommendation to the contractors that they spread the re­
 contacts throughout the year.

 Recommendation 16:

 We recommend that FIS require CACI to strengthen their internal controls to ensure that during
 the first year of the investigator's employment, CAeI randomly contacts no less than three
 percent of all personal sources obtained by each investigative personnel within 60 calendar days
 of the initial contact.

 FIS Management Response

 FIS concurs with this recommendation presented above.

  In response to the sample taken and referenced in the OIG letter of 12122/09, FIS asserts the
  following: The requirement for the 3% re-contact of all personal sources is based on a yearly
  requirement. A sampling taken during a portion of the year is not an adequate sampling method.
  To further ensure compliance is met for the year, FIS will conduct unannounced inspections to
. verify compliance.

 Recommendation 17:

 We recommend that FIS require KGS to strengthen its policy/procedures over their re-contact
 program to ensure that at least one re-contact is perfonned during the first year of the
 investigator's employment. The re-contact programs should be conducted within 60 calendar
 days of the initial interview and should be no less than three percent of all personal sources
 obtained by each investigator.

 FIS Management Response

 FIS concurs with this recommendation presented above.

 In response to the sample taken and referenced in the OIG letter of 12122/09, FIS asserts the
 following: The requirement for the 3% re-contact of all personal sources is based on a yearly
 requirement. A sampling taken during a portion of the year is not an adequate sampling method.
 To further ensure compliance is met for the year, FIS will conduct unannounced inspections to
 verify compliance.

 Recommendation 18:

 We recommend that frS strengthen their internal controls over their re-contact program to ensure
 that they complete the required number of re-contacts per Investigator each month.
FIS Management Response

FrS concurs with this recommendation. FIS has implemented an audit of the information
generated from the re-contact letter database to ensure that the required numbers of re-contact
letters are sent per investigator on a monthly basis. Investigations Support personnel perform a
monthly database query that compares the number of sources interviewed by each investigator to
the number of re-contact letters sent. In instances where less than three letters are sent, an
analysis is performed to determine the reason. The reason may be legitimate (e.g., the sallie
source interview was transmitted several times, the same source received a re-contact letter the
previous year, an address field was blank, etc.) or the issue may require further research to
determine if there is a database problem. In either case, the issue receives irmnediate attention
and when possible, additional re-contact letters are sent as appropriate. The results of each
monthly audit are filed and maintained by Investigations Support and include the following
information:
              o Number of instances where Less than three letters were sent
              o Appropriate case numbers and investigator SIOs
              o Reason(s) Less than three letters were generated per investigator