U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Subject: AUDIT OF THE QUALITY ASSURANCE PROCESS OVER BACKGROUND INVESTIGATIONS Report No. 4A-IS-OO-09-060 Date: June 22, 2010 --CAUTION- This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may contain proprietary data which is protected by Federal law (l8 U.S.C 1905). Therefore, while this audit report is available under the Freedom of Informalioo Act and madc available to the public olllhe orG wcbpage, caution needs to be exercised before releasing the report to the general public as it may contain proprietary information thM was redacted from the publicly distributed copy. UNITED STATES OFFICE OF PERSONNEL MANAGEMENT Washington, DC 20415 Office of the In~peClorGenera l AUDIT REPORT AUDIT OF THE QUALITY ASSURANCE PROCESS OVER BACKGROUND INVESTIGATIONS Report No. 4A-IS-OO-09-060 Date: June 22, 2010 Michael R. Esser Assistant Inspector General for Audits --------------.-~--.-------.----~~---- --_._----_._- www.opm.gov www.usajobs.gov UNITED STATES OFFICE OF PERSONNEL MANAGEMENT Washington, DC 204 [5 Office of the Inspector General EXECUTIVE SUMMARY AUDIT OF THE QUALITY ASSURANCE PROCESS OVER BACKGROUND INVESTIGATIONS Report No. 4A-IS-OO-09-060 Da~: June 22, 2010 The Office of the Inspector General has completed a performance audit of the Quality Assurance Process over Background Investigations. Our main objective was to determine whether the Federal Investigative Services (FrS) has effectively implemented controls for the quality assurance process over background investigations. In order to make this determination, our audit included the following specific objectives: (1) determine whether the FIS and the US Investigations Services, Inc. (USIS); KeyPoint Govenunent Solutions (KGS), fonnerly Kroll; and CACI International, Inc. (CAeI), hereafter referred to as the "Contractors", are following their respective case/quality review process; (2) detennine if the FrS and the Contractors have controls in place to ensure that their review personnel are trained to perform their duties; (3) determine if the FIS and the Contractors have controls in place to ensure that their investigative personnel are trained to perform their duties; and (4) determine if the FIS and the Contractors have adequate controls in place to identify falsification and/or integrity issues. Our audit was conducted from July 22, 2009 through October 22, 2009 at FrS offices located in the U.S. Office of Personnel Management's (OPM) headquarters in Washington D.C. and Boyers, Pennsylvania. In addition, we visited Contractors' sites located in Chantilly, Virginia; Loveland, Colorado; and Grove City, Pennsylvania. Our audit identified 15 areas requiring improvement. -------------_._---_._-------_._- www.opm.gov www.usajobs.gov A. General Observations 1. General Observations Procedural We have identified three areas we feel could have a positive impact on the quality assurance process over background investigations. The areas include: training, the quality case review initiative, and the use of an integrity statement. B. Case Quality Review Process 1. Random Review Process Procedural Random reviews of cases by the Quality Management Group, an internal control that helps identify potential problems with background investigations, were not in place for the last half of fiscal year 2009. 2. Oversigbt of tbe Closing Autborization and Support Team Procedural (CAST) Deficient cases are being closed in the CAST by the support contractor. C. Training for Investigative Personnel 1. Investigative Technician Training Procedural USIS and KGS did not provide an OPM approved training course to employees who conduct record checks. 2. Mentor Training Procedural Eighteen of the 20 mentors that we reviewed did not complete a mentor training course. 3. Investigator Training for Contractors Procedural Two of the 50 Background Investigators we sampled did not meet all qualifications needed to perform their duties as a Background Investigator. 11 4. Check Rides Not Conducted by Contractor Procedural USIS did not conduct check rides for 2 of the 25 new Background Investigators that we s,ampled, 5. Check Rides at FIS Not Conducted Procedural Seven of the 25 experienced Background Investigators we sampled did not have a check ride assessment conducted during the period October 1,2008 to September 4, 2009. 6. Evaluation Results Not Documented Procedural CAC! does not have a process in place to document the results of their evaluations of Background Investigators, 7. Oversight of Contractors' Evaluation Submissions Procedural FIS does not have controls in place to ensure that the Contractors are submitting their evaluation results to the Contracting Officer's Representati ve. D. FalsificationlIntegrity Issues 1. Misconduct Issues Not Submitted Timely ProceduraL USIS did not forward misconduct issues to OPM within the required timeframe for 7 of the 40 Background Investigators we sampled. 2. Record Source Validations Not Performed Procedural The Contractors did not have controLs in place to conduct record source validations. 3. Review of Record Checks Procedural FIS did not conduct the required number of record check reviews for aLL Investigative Assistants. 4. Re-Contact of Personal Sources by Contractors Procedural CAeI and KGS did not conduct re-contacts for 12 of the 50 new Background Investigators that we sampled. In addition, for CACI we were unable to determine whether the re-contacts that were performed were completed within 60 calendar days of the initial contact. 111 5. Re-Contact of Personal Sources by FIS Procedural FIS did not conduct the required three re-contacts for 11 of the 80 Background Investigators we sampled. IV TABLE OF CONTENTS I. INTRODUCTION AND BACKGROUND ...................................... .. II. OBJECTIVES, SCOPE, AND METHODOLOGY ......... ________ .... ____ ... 4 III. AUDIT FINDINGS AND RECOMMENDAnONS .. ____ ................... 7 A. General Observations 1. Training................................................................. 7 2. Quality Case Review Initiative ................................. __ ... 8 3. Integrity Statement ........................................ __ .... ..... 9 B. Case Quality Review Process 1. Random Review Process. . . . . . . . . . . . . . . . . . . . .... . . . . . . . . . . . . . . . . . . . . . 9 2. Oversight of the Closing Authorization and Support Team (CAST)................................................................. 10 C. Training for Investigative Personnel l. Investigative Technician Training ...., ... __ .. __ ..................... 12 2. Mentor Training .................................................. , . ... 13 3. Investigator Training for Contractors.............................. 14 4. Check Rides Not Conducted by Contractor.. ..... ................. 15 5. Check Rides at PIS Not Conducted................. ..... ........... 16 6. Evaluation Results Not Documented ................ __ ...... ,. ..... 17 7. Oversight of Contractors' Evaluation Submissions.............. 18 D. Falsification/Integrity Issues 1. Misconduct Issues Not Submitted Timely ................... __ ... 19 2. Record Source Validations Not Performed ____ .. __ ...... ' ...... __ 20 3. Review of Record Checks .. __ .... ____ .... __ ...... __ ........ __ ....... 21 4. Re-Contact of Personal Sources by Contractors.. ... . . .......... 23 5. Re-Contact of Personal Sources by FIS .......... __ .... __ .. __ __ __ __ 24 IV. MAJOR CONTRIBUTORS TO THIS REPORT ............................. 27 APPENDIX (Federal Investigative Services Response, received January 22,2010, to our draft report) I. INTRODUCTION AND BACKGROUND Introduction This final audit report details the findings, conclusions, and recommendations resulting from our performance audit of the Quality Assurance Process over Background Investigations. The audit was performed by OPM's Office of the Inspector General (OIG), as authorized by the Inspector General Act of 1978, as amended. Background OPM's Federal Investigative Services (FIS) is responsible for conducting background investigations on Federal applicants, employees, and contractor personnel to determine the fitness and suitability of these individuals to hold security clearances. Background investigations are conducted to resolve issues, enforce the civil service laws, rules, and regulations, and verify the qualifications of applicants for certain high level administrative and professional positions. FIS conducts approximately ninety percent of all personnel background investigations for the Federal Government. During fiscal year (FY) 2009, FrS contracted with three background investigative contractors: US Investigations Services, Inc. (US IS); KeyPoint Government Solutions (KGS), formerly Kroll; and CACl International, Inc. (CACI), hereafter referred to as the "Contractors", to assist with completing background investigations. FrS currently has almost 8,600 Federal and contract staff devoted to the background investigations program, including 6,800 Federal and contractor field Background Investigators, hereafter referred to as "Investigators". They are strategicaliy located throughout the United States and overseas to facilitate and expedite investigations. Case Review Process When completed background investigations are determined to be eligible for closing they are sent to PIS' Investigations Review Group (lRO) for full review or to the support contractor, known as the Closing Authorization and Support Team (CAST), for limited review and closing. FrS stated that on average, the CAST closes 140,127 cases per quarter. If the IRO finds problems with the background investigation that rise to the deficient level, they refer the case to the Quality Management Group (QMO) in FIS for action. Since the CAST only conducts a very limited review, they neither correct errors nor do they refer the investigation to QMO. If the CAST finds a problem of significance (i.e., quality issues), they will send the background investigation to the IRG for full review. FIS' Quality Assurance (QA) team oversees the quality assurance process for both the Federal and Contractor staff. Their duties include reviewing cases prior to closing the case and random case review for cases that have closed. In addition, FIS has a Contractor Oversight Program which monitors the quality, timeliness, productivity, and performance against contract requirements, identifies problem areas, and provides the results to the contractor. 1 One of the main groups in FrS involved in the quality assurance process over background investigations is the Quality Management Group (QMG). The QMG provides feedback to both the Federal and contractor field investigative elements as well as the Federal case review staff to ensure a consistent, high quality product to their customers, as well as to use their findings to enhance Investigator and reviewer training. Specifically, the QMG evaluates closed background investigations and provides feedback to the review staff. In addition, the QMG provides feedback to field investigators on investigations that the reviewers have referred to the QMG for review. The QMG also conducts a random review of background investigations. The random review process consists of selecting cases for review.after reviewers in FIS' IRG have completed the closing action in the Personnel Investigations Processing System (PIPS). These investigations are randomly selected by the QMG personnel and include cases that were never referred to the QMG as a deficiency; however, random review cases can also be selected through other mechanisms. The cases are evaluated to determine if there were any problems with the investigation that should have been caught by the reviewer and corrected. If there are problems, the QMG will prepare a quality feedback document outlining the problems and send the investigation back to the reviewer's supervisor to have the investigation reopened and corrected. The QMG maintains a database of this infonnation and supplies statistical reports to IRG documenting the quality problems that have been found. According to OPM's contract with the Contractors, each Contractor is required to have a quality assurance process in place. FIS does not mandate what the process should entail; instead, management for each of the Contractors decides what they want to review and how often. Training All Contractors and FIS employees conducting background investigations must be trained on FIS' requirements for background investigations. For Contractors, the contract outlines specialized training, experience, and/or education qualifications that an individual must have in order to hold a position as an Investigator, Reviewer, or Investigative Technician. Investigators initially receive classroom training prior to receiving their first case load as an Investigator. Required training is commensurate with prior experience. Falsification/Integrity Issue FIS' Integrity Assurance Group (lAG) validates information gathered during source interviews directly with that source via the Re-Contact Letter Program. The re-contact letters are done for Federal and Contractor Agents (US1S, CACI, and KGS). The Processing Support Branch (PSB) is responsible for mailing out the re-contact letters. They are supposed to send out three re contact letters per Investigator (Federal and Contractor) per month. The re-contact letters are generated based on a PIPS data dump of all Investigator leads. The re-contact letter is auto populated (i.e., investigator name, subject name, address, etc.) based on the information the Investigator entered into PIPS while the background investigation was being conducted. The responses to the letters are returned to PSB. The findings from re-contact letter results are processed by referring congratulatory comments to the field management staff to provide positive quality feedback to the Investigator workforce and refer potential integrity issues to the Integrity Assurance Group for further investigation and resolution. They also serve as a quality 2 assurance tool to evaluate Investigators' investigative teclmiques and overall professionalism and to assess training needs in the field. For the Contractors, the contract provisions require that at least two record sources per quarter per investigative personnel are rand~mly re-contacted to validate the fact that the search was conducted and the accuracy of the record information obtained. In addition, Contractors must conduct re-contacts of personal sources during the first year of the Investigator's employment. The contact must be done randomly and telephonically. On an annual basis, no less than three percent of all personal sources obtained by each background investigative personnel shall be re contacted within 60 calendar days of the initial contact. 3 II. OBJECTIVES, SCOPE, AND METHODOLOGY Objectives The primary objective of our audit was to determine whether FIS has effectively implemented controls for the quality assurance process over background investigations. In order to achieve our primary objective, our audit included the following specific objectives: 1. Determine whether FIS and the Contractors are following their respective case quality review process; 2. Determine if FIS and the Contractors have controls in place to ensure that their review personnel are trained to perform their duties; 3. Determine if FIS and the Contractors have controls in place to ensure that their investigative personnel are trained to perform their duties; and 4. Determine if FIS and the Contractors have adequate controls in place to identify falsification and/or integrity issues. The recommendations included in this final report address these objectives. Scope and Methodology We conducted this performance audit in accordance with generally accepted government auditing standards as established by the Comptroller General of the United States. Those standards required that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The scope of our audit covered FIS' and the Contractors' policies and procedures for fiscal year 2009, governing the quality assurance process over background investigations. We performed this audit from July 22, 2009 through October 22, 2009 at FIS offices located in OPM headquarters in Washington D.C. and Boyers, Pennsylvania. In addition, we visited Contractors' sites located in Chantilly, Virginia; Loveland, Colorado; and Grove City, Pennsyl vania. To accomplish the audit objectives noted above, we: • Sampled closed cases and tested FIS' and the Contractors' policies for reviewing cases to ensure they are adhering to their processes and to determine if the process was efficient; 4 • Sampled and tested FIS' and the Contractors' training records for their reviewers and Investigators; • Tested FIS' and the Contractors' falsification and integrity process, which included sampling and testing the re-c?ntact program for both personal and record sources; and • Interviewed FIS and Contractor employees. In planning our work and gaining an understanding of the internal controls over the quality control process over background investigations, we considered the internal control structure to the extent necessary to develop our audit procedures. These procedures were mainly substantive in nature, although we did gain an understanding of management procedures and controls to the extent necessary to achieve our audit objectives. The purpose of our audit is not to provide an opinion on internal controls, but merely to evaluate controls over the processes that were included in the scope of our audit. Our audit included such tests of FIS' and the Contractors' records and other procedures as we considered necessary under the circumstances. The results of our tests indicate that with respect to the items tested FIS has implemented controls to assure the quality of background investigations, except for the areas set forth in the details of this audit report. In conducting our audit, we tested FIS' and the Contractors' compliance with their policies and procedures, as well as the Contractors' compliance with the Conformed Fieldwork Contract by selecting samples of cases; Background Investigator, Reviewer, and Investigative Technician training records; integrity reports; and re-contact reports. Our sampling methodology consisted of the following: Case Review Process In order to verify that FrS and the Contractors are adhering to their case review process, we selected the following judgmental samples: • 25 out of 1 1,581 USIS closed cases from May 4 through 8, 2009; • 25 out of 1,086 KGS closed cases from May 4 through 8, 2009; and • 25 out of343 CACI closed cases from August 1 through 12,2009. We also judgmentally sampled 25 out of 48 new and 25 out of 1,417 experienced FIS Investigators and requested all cases reviewed for each of the Investigators for the month of May 2009 to verify that FIS is adhering to their case review process. In order to determine if FIS and USIS were following their internal polices and procedures for random case reviews, we selected the following judgmental samples: • 25 out of 73 cases randomly reviewed by Frs from March 1 through 31, 2009 and • 25 out of 719 cases randomly reviewed by USIS from May 1 through 31, 2009. KGS and CAeI do not perform random case reviews. 5 Reviewer Training We tested a judgmental sample of25 out of 325 FIS case reviewers; 25 out of232 USIS case reviewers; 25 out of 33 KGS case reviewers; and all 11 CACI case reviewers to determine if they have completed an OPM-approved reviewer training course. Investigator Training For new Investigators hired during June 2008 through June 2009, we judgmentally sampled 25 out of 48 FIS Investigators; 25 out of 137 USIS Investigators; and 25 out of299 KGS Investigators to determine if they have completed an OPM-approved Investigators training course. We also tested a random sample of25 out of68 CACI Investigators. For experienced Investigators, we judgmentally sampled 25 out of 1,417 FIS Investigators; 25 out of 2,292 USIS Investigators; and 25 out of 330 KGS Investigators to detennine if they have completed an OPM-approved Investigators training course. We also tested a random sample of 25 out of 240 CACI Investigators. Record Searcher Training We tested a judgmental sample of 25 out of 59 FIS record searchers; all 8 USIS record searchers; and all 14 KGS record searchers to deterrnine if they have completed an OPM-approved record searcher training course. CACI does not have official record searchers. AU Investigators at CAeI are able to do their own record checks. The remainder of our samples are discussed in the body of our findings. The results from the various samples were not projected to the population. 6 III. AUDIT FINDINGS AND RECOMMENDATIONS Our audit disclosed that, with respect to the items tested, FIS has an adequate quality control process over background investigations, except for the ~reas set forth in the details of this audit report. For those Contractors not specifically identified below in the detail of this report, it was determined that their process was adequate for that particular issue. The areas requiring improvements are described below. A. General Observations Over the course of our audit we were able to observe the quality assurance process for FIS and the Contractors. We have identified tluee overarching areas for which we feel improvements would have a positive impact on the overall quality assurance process for background investigations. The three areas that came to our attention are discussed below. 1. Training All Contractors and FIS employees conducting background investigations must be trained on FIS' requirements for background investigations. For the Contractors, the contract outlines specialized training, experience, and/or education qualifications that an individual must have in order to hold a position as an Investigator, Reviewer, or Investigative Technician. However, there is no standardized, universal training for personnel who perform the same job functions (e.g., Investigator, Reviewer) at FIS, USIS, CACI, and KGS. Even though each organization has its own, organization-specific training program that is approved by FIS, it is not consistent from contractor to contractor or with FIS. For example, there may be additional training modules that may be presented to Investigators that work for USIS that are not included in the training program used by CAC£. Not training all persollilel (whether FIS or Contractor) in the same manner may lead to a lack of uniformity in conducting background investigations. This may lead to work products being incomplete, inaccurate, and possibly compromised. The Government Accountability Office's (GAO) Standards/or Internal Control in the Federal Government state that "Management should ensure that skill needs are continually assessed and that the organization is able to obtain a workforce that has the required skills that match those necessary to achieve organizational goals. Training should be aimed at developing and retaining employee skill levels to meet changing organizational needs." Recommendation 1 We recommend that FIS implement a standardized universal training program that is required to be used by FIS and the Contractors for all persollilel who perform work completing background investigations (e.g., Investigators, Reviewers, and personnel completing record checks). 7 FIS' Response: "FIS concurs with this recommendation" and stated that "When the new contracts are awarded in 2011, FrS will mandate that all companies doing investigati ve work on behalf of OPM send their investigators to training classes conducted by OPM. In the interim, contractor companies can voluntarily send their investigators to the OPM Basic Investigators course. . .. With the issuance of new field contractors in 2011, FrS Training and Professional Development (TPD) will have adequate capacity to provide training to all field agent staff (Federal and contractor) that supports OPM's investigations program." 2. Quality Case Review Initiative The Standard Operating Procedures (SOP) Supporting the FY09 Quality Case Review Initiative for the Northern Region was issued as a single resource for supervisors and case reviewers in the Northern Region as a means of standardizing the methodology for evaluating, documenting, and analyzing the quality of background investigations conducted within the region. The SOP provides instruction, criteria, and guidance for quality reviews conducted in the region. The SOP addresses the need for objective, clearly defined criteria that reasonably separates an "Adequate" report of investigation from one that is "Deficient". The SOP identifies four core elements for an investigation to be rated as "Adequate". The SOP also includes the use of a standardized form, The Report a/Quality Review version 2.3, which is used by all reviewers to document the results of the quality review. A quality case review shall not be considered complete until the supervisor has entered the results of the review into the Quality Review Database (QRD) and provided a copy of the evaluative results to the Investigator. The QRD has been created to serve as the single resource for recording, documenting, and analyzing the results of all completed quality case reviews. As of September 2009, the Quality Case Review program had not been fully initialized throughout all of FIS' regions. Based on the documentation we reviewed concerning the Northern Region, it appears this will be a quality assurance asset once implemented nationally. This program will help to bring continuity and standardization to the review process which should help in identifying and fixing deficient background investigations prior to the case being provided to the customer agency. Recommendation 2 We recommend that FIS implement the Quality Case Review program throughout all of the reglOns. FIS' Response: "FIS concurs with this recommendation" and stated that "All regions have been provided with the standard review tools and tracking system developed by the Northern Region. FIS is reviewing this process to make additional changes and will continue to refine this tool as we move forward. All regions have received training on the automated tool that will allow 8 standard tracking of reviewed cases throughout the Federal field. Full implementation is expected by the end of January 2010." 3. Integrity Statement While conducting our audit work on FIS and its Contractors' integrity programs, we became aware of USIS' practice of having their employees sign an Integrity Pledge as a part of their Security Awareness Tool. . The pledge states that the employee understands that deliberate misrepresentation, misconduct, negligence, or falsification of any part of a personneL security investigation can . affect the individual, the customer agency, and the employee. The pledge also states that the employee is aware that there will be severe consequences, including possible termination, possible criminal prosecution and/or potential civil liability for damages if the employee commits any of these acts as adjudged by USIS, a customer agency, or an independent third party. We discussed this pledge with our investigative staff that has been working on falsification cases to determine what impact a signed statement like this could have on an investigation and found that in a prior case this statement was vital evidence for winning the case. As a result, we found this procedure to be a practice that should be considered by FIS and its Contractors. By requiring this pledge of all employees conducting background investigative work for FIS, it will serve as a reminder as to the roles and responsibilities individuals have while performing their job functions and would hopefully help to serve as a deterrent for those considering actions that may lead to fraud, waste, and abuse. Recommendation 3 We recommend that FIS implement the use of an annual Integrity Statement for its employees and Contractors to assist in any possible falsification cases. FIS' Response: "FIS cannot concur with this recommendation until the legality of such a statement is determined by OPM's Office of General Counsel (OGC). We will present this issue to OGe for an opinion before developing an action pian." B. Case Quality Review Process 1. Random Review Process The Quality Management Group's internal control that helps to identify potential problems with a background investigation was not in place for half of FY 2009. 9 Frs' QMG is made up of three branches: the Quality Management Branch, the Random Review Branch eRRB), and the Program Training Branch. We requested a list of all cases randomly reviewed by QMG from May 1 to May 31, 2009; however, QMG stated that they ceased the random reviews in April 2009. QMG ceased the random review process in order for them to focus on developing specific training modules based on errors discovered by the random reviews. They then conducted reviewer refresher training in May, June, and early July 2009. OMB Circular A-I23 (Introduction) indicates that "Management has a fundamental responsibility to develop and maintain effective internal controL The proper stewardship of Federal resources is an essential responsibility of agency managers and staff. Federal employees must ensure that Federal programs operate and Federal resources are used efficiently and effectively to achieve desired objectives." GAO's Standards for Internal Control in the Federal Government state that management is responsible for developing control activities, which are the policies, procedures, techniques and mechanisms that enforce management's directives. Control activities occur at all levels and functions of an entity and include a wide range of activities, such as approvals, authorizations, verifications, reconciliations, performance reviews, maintenance of security, and the creation and maintenance of related records which provide evidence of execution of these activities, as well as appropriate documentation. In addition, internal controls should be designed to assure that ongoing monitoring occurs in the course of normal operations. It should be performed continually and ingrained in the agency's operations. Without internal controls in place to identify potential problems in cases closed by the Federal review staff, there is an increased risk that these closed cases may be of poor quality and contain errors. Recommendation 4 We recommend that FIS resume the random case review process and ensure that internal controls are designed to assure that ongoing monitoring occurs in the course of nonnal operations. FIS' Response: "FIS concurs with this recommendation" and stated that they "resumed random review as of January 8, 2010." 2. Oversight of the Closing Authorization and Support Team (CAST) Deficient cases are being closed in the CAST by the support contractor. As of September 2, 2009, we requested the most recent audits of the CAST to determine ifFIS has proper oversight of the CAST. Based on the QMG audits in March 2009,28.24 percent of 10 the 85 sampled closed cases were unacceptable, and in June 200926.87 percent of the 67 sampled closed cases were unacceptable. FIS is not enforcing the CAST case cursory review requirements, which should be followed by the support contractor. On a quarterly basis, QMG conducts audits of the limited review and closing functionas performed by the CAST. This is an internal control that FIS has in place to evaluate the quality of the closing review process performed by the CAST. During the audit, QMG compares the review and closing work perfonned by the CAST to the requirements set forth in their contract. The results are provided to PIS' Capacity Development and Oversight Group, which forwards the results to the contractor. Depending on the nature of the problem with the background investigation, QMG may require the support contractor to correct it or it may be turned over to IRG for Federal review staff to correct the problem. The criteria for closing cases in the CAST are based upon section 36.2.3 of the Case Cursory Review document which states "Ensure that the fieldwork covers case requirements. If the fieldwork does not cover what is required for a particular case type, the case must go back to the Review Contractor for full review." The Support Services Contract, section c.l. 7.1, states that OPM will initiate a quality assurance program to monitor services provided which includes the contractor's quality. Section CA states that all work perfOlmed under the contract will be performed according to the operation manuals, instructions, memos, and as instructed by authorized OPM Personnel. The Case Cursory Review requirements are used to determine if a case has the correct documentation needed to be closed. GAO's Standards for Internal Control in the Federal Government state that management is responsible for developing control activities, which are the policies, procedures, teclmiques and mechanisms that enforce management's directives. Control activities occur at all levels and functions of an entity and include a wide range of activities, such as approvals, authorizations, verifications, reconciliations, performance reviews, and the creation and maintenance of related records which provide evidence of execution of these activities as well as appropriate documentation. Examples of control activities/techniques include top level reviews of actual perfonnance and reviews by management at the functional or activity leveL In addition, internal controls should be designed to assure that ongoing monitoring occurs in the course of normal operations. It should be performed continually and ingrained in the agency's operations. By not enforcing the CAST case cursory review requirements, there is an increased risk that the number of deficient cases being closed will continue to increase. 11 Recommendation 5 We recommend that FIS design internal controls to ensure that ongoing monitoring of the CAST occurs during the normal ~ourse of operations. FIS' Response: "FIS concurs with this recommendation" and stated that "The internal control of Quality Management auditing the contractor-conducted CAST process, on a quarterly basis, will remain in effect until the function is moved to the Federal staff. The most recent audit was completed on October 9,2009 for the first quarter of Fiscal Year 2010. QMG is in the process of scheduling an audit for the current quarter. Once the function moves to the Federal staff, Quality Management will audit this function as part of its random review process (daily basis)." C. Training for Investigative Personnel 1. Investigative Technician Training USIS and KGS did not provide an OPM-approved training course to Investigative Technicians who conduct record checks. We selected ail 8 new USIS Record Searchers and all 14 KGS Investigator Technicians to detennine if the employees that conduct record checks have met the qualifications to perform their duties. The results of our review disclosed that all 8 USIS Record Searchers and 13 out of 14 KGS Investigator Technicians had not received training, as required by the FIS contract. USIS did not provide a reason as to why seven individuals had not been trained. One Record Searcher had received training offered at the local/field level; however, the training has not been approved by OPM. USIS also stated that they were currently being audited by OPM's Program Training Branch and that they have not received approval or rejection for their Record Search training. KGS does not conduct formal training; instead, the Investigator Technicians that perform record checks have received on-the-job training related to the specific tasks that they complete. KGS stated that although they have an OPM-approved training program in place, tests are not given because KGS considers them to be unnecessary due to post-audits and reviews being performed on all cases after on-the-job training is completed. We noted that KGS could not provide documentation to support that they have an OPM-approved training course. The Conformed Fieldwork Contract, Attachment 4: QualificalionslTraining Standards, dated January 8,2009, states that the qualifications for an Investigative Teclmician include 12 "Successful completion of an IT/Record Courier training course which has been approved by aPM .... " The Contract also states that "OPM requires that certain personnel performing work under this contract possess minimum qualifications and training, ... and reserves the right to review these qualifications, determine if the minimum requirements are met, and whether the individual shall be permitted to perfonn work on the contract. All contract personnel conducting work on the contract must be trained through an aPM approved contractor training plan." As a result of USIS and KGS not providing employees that conduct record checks with formal OPM-approved training, there is an increased risk that the work performed by the technicians may be incomplete and inaccurate. Recommendation 6 We recommend that FIS require USIS and KGS to provide an OPM~approved training course to all employees who perform record checks. FIS' Response: "FIS concurs with this recommendation." FIS has been informed by USIS that the course is no longer being provided and they are working with KGS on an approved training course. OIG Comment: FIS' response that USIS is no longer providing this training does not satisfy our recommendation. It is our opinion that an OPM~approved training course is still needed for any employee who perform record checks, including the eight USIS employees identified above. We continue to recommend that FIS ensure that all employees who perform record checks complete an aPM~approved training course. 2. Mentor Training We found that 18 of the 20 mentors at FIS did not complete a mentor training course. The names of the mentors were provided to FIS separate from this report. Mentors are assigned to new Investigators and are responsible for helping the new Investigator become acclimated with their work life, their tasks, and their responsibilities. The mentor also evaluates the new Investigator to ensure they are developing the skills required to become an Investigator. We judgmentally sampled 25 out of 48 new Investigators to determine if each was assigned a mentor. We than selected the 20 mentors assigned to these Investigators for our review. We tested the training records of the 20 mentors and determined that training had only been provided to 2 of them. 13 GAO's Standards/or Internal Control in the Federal Government state that "All personnel need to posses and maintain a level of competence that allows them to accomplish their assigned duties, as well as under~tand the importance of developing and implementing good internal control. Management needs to identify appropriate knowledge and skills needed for various jobs and provide needed training ...." GAO's Standards/or Internal Control in the Federal Government also state that "Management should ensure that skill needs are continually assessed and that the organization is able to obtain a workforce that has the required skills that match those necessary to achieve organizational goals. Training should be aimed at developing and retaining employee skill levels to meet changing organizational needs." By not having all mentors attend mentor training, there is a risk that new Investigators may not receive the proper instruction to perfonn their duties, which may lead to a decrease in the quality of background investigations. Recommendation 7 We recommend that FIS have all mentors complete a mentor training course prior to serving as a mentor to new Background Investigators. FIS' Response: "FIS concurs with this recommendation" and stated that four mentors for each FISD Region participated in the first standard mentor training course that was conducted May 24 through 28,2010. 3. Investigator Training for Contractors We judgmentally selected 25 out of 330 experienced KGS Investigators and 25 out of 2,292 experienced USIS Investigators to determine if they met the qualifications to perfonn their duties. We concluded that: • KGS could not support that one Investigator passed the training course final exam with a score of at least 80 percent. • One USIS Investigator failed the New Investigator Training (NIT) final exam, but their training system showed that the Investigator passed the NIT course on the same date that the final exam was failed. No documentation was provided showing that the Investigator ever re-took and passed the NIT final exam. The Con/armed Fieldwork Contract, Attachment 4: Qualifications/Training Standards, dated January 8, 2009, states that "All contract personnel conducting work on the contract must be trained through an OPM approved contractor training plan. The plan must include, but is not limited to, in class instruction on all aspects of duties, mock interviews applicable to position, 14 an open book final exam that must be passed with at least an 80% score, a minimum of one week on-the-job training for all Investigative staff with experience and 3 weeks for those with no experience." In addition, the Contract states that "An incumbent (. .. investigator ... ) in good standing currently conducting investigations on OPM contracts may be transferred to another entity without any additional training. Training is left to the discretion of the investigative entity when the incumbent has 18 months of consecutive OPM experience (in the respective job title) and less than 8 months of inactivity working OPM investigations." The absence of documentation to support that all Investigators are properly qualified increases the risk that there are Investigators who have not been properly trained and cleared to perform background investigations on behalf of FIS. Unqualified individuals working on background investigations can lead to the investigation and related Personally Identifiable Information being compromised. Recommendation 8 We recommend that FIS require KGS and usrs to provide documentation to support that the Investigators have completed all qualifications necessary in order to perform background investigations on behalf of FrS. FIS' Response: FIS concurs with this recommendation and stated that, "OPM will conduct inspections to ensure that the contractor's are maintaining the qualifications as outlined in the contract." 4. Check Rides Not Conducted by Contractor USIS did not conduct check rides for 2 ofthe 25 new Investigators that we sampled. A check ride is an evaluation tool used to verify that Investigators are conducting background investigations according to field standards. We judgmentally sampled 25 out of 137 new Investigators to determine if USIS conducts a check ride at the conclusion of the new Investigator's field training process. usIS stated that check rides for the two identified Investigators had not yet been conducted this year. We noted that both Investigators completed field training prior to October 2008. For new Investigators, USIS' Check Ride Standards/Field Quality Assurance Policy states that "The investigator will complete their field training with the Field Training Officer (FTO), Certified Field Trainer (eFT), or Team Leader. The trainer will complete the initial check ride with the new investigator at the completion of the new investigator field training process." Not completing the required check ride for each new Investigator at the completion of their field training process increases the risk that USIS will not be able to ensure the new 15 Investigator is efficient, capable, andlor reveal any weaknesses that may compromise their investigations. There is also an increased risk that the information contained in the new Investigator's Report of Investigation may be incorrect or falsified. Recommendation 9 We recommend that FIS instruct USIS to update its Check Ride Standards/Field Quality Assurance Policy to include a defined timeframe as to when USIS must conduct check rides for their new Investigators once they have completed their field training. FIS' Response: "FIS concurs with this recommendation" and stated that they "will instruct USIS to review their internal check-ride policy and make a determination on a defined timeframe." 5. Check Rides at FIS Not Conducted We judgmentally sampled 25 out of 1,417 experienced FIS Investigators to determine if each Investigator received, at a minimum, one check ride in the last 12 months. Seven of the 25 experienced Investigators we sampled did not have a check ride assessment conducted during the period October 1,2008 to September 4,2009. The names of the Investigators were provided to FIS separate from this report. FIS' Check Ride Performance Standards state, "At a minimum, one supervisory check-ride shall be accomplished during the performance appraisal period. Two additional supervisory check-rides must be accomplished when the initial check-ride results in an unacceptable rating." As a result of FIS not conducting an arumal check ride of their experienced Investigators there is an increased risk that FIS is not identifying poor performers who need additional training and mentoring in order to properly perform their job. In addition, FIS may not be detecting instances of fraudulent background investigations since these check rides are used as a tool for supervisors to monitor and review the Investigator's work. Recommendation 10 We recommend that FIS ensure that all Background Investigators receive at least one supervisory check ride assessment per appraisal period. FIS'Response: "FIS has complied with this recommendation. In the case of <DELETED BY OPM-OIG, NOT RELEVANT TO THE AUDIT REPORT>, she was promoted to an Agent on April 12, 2009 from an Investigative Assistant position. Prior to becoming an agent there would have been no requirement or need for her to attend the BIC [Basic Investigative Course]. She completed the BIC on 10123/2009. Prior to that she would have been in training and 16 assigned a mentor. The documentation for the other six agents is attached showing they had a check ride conducted or were in training. FIS did meet all requirements for each agent" OIG Comment: Based on FIS' response, they have complied with the recommendation; however, we were not provided support that the agent did not complete the BIC until after the end of our fieldwork and therefore would not have had a check ride completed. In addition, we were not provided copies of the check rides in order to verify the dates that they were completed. 6. Evaluation Results Not Documented CAC! does not have a process in place to document the results of their evaluations of Investigators. We requested copies of the results of evaluations conducted under the CACI evaluation program which were submitted to FIS from October 1, 2008 through our audit site visit, which was August 10 through 14,2009. Based on this request, there was some uncertainty from CACI as to what specific documents should be sent to FIS. CACI stated that they do not conduct check rides with Investigators. CAeI currently has a mentoring program; however, it does not include any written evaluations of the Investigator candidate. FIS Fieldwork Contract Quality Assurance Provisions Applicable to CAC] (OPM040600012) fieldwork contracts, section C.6.1.8, states that "The Contractor shall establish a program for the evaluation of investigators and investigative technicians during the performance of their work to ensure compliance with the professional conduct requirements and investigative standards of this contract This may include, but is not limited to, such things as a mentoring program, a ride-along program, or similar evaluation programs. The results of evaluations conducted under the Contractor's evaluation program must be forwarded to the COR within 30 days of the date of the evaluation or, if otherwise appropriate, in accordance with the requirements of this contract." By not documenting the results of evaluations, CACI and FIS will not be able to ensure that field Investigators are maintaining professional conduct and investigative standards outlined in the contract. If Investigators are not adhering to professionalism and investigative standards, investigations may be compromised, leading to a decrease in their quality. Recommendation 11 We recommend that FIS require CACI to implement controls to ensure that the results of evaluations conducted under CACI's evaluation program are documented and forwarded to the COR within 30 days of the date ofthe evaluation. 17 FIS' Response: "FIS does not concur with this recommendation." FIS stated that "CACI has an established evaluation program. CACI sub~itted their evaluations on January 8, 2010 (attached), and will submit their evaluations no later than 30 days after the end of the rating period for future submissions. FrS has incorporated a review and validation of the report as part of the workload goals and FIS will conduct inspections for all contractors tbroughout the year to ensure compliance." . OIG Comment: As stated in our finding CACI did not have documentation to support the results of its evaluation program during our audit. Based on FIS' response, CACI submitted their evaluation results on January 8, 2010. FIS provided a copy ofCACI's spreadsheet which covered the period December 1,2008 through December 1,2009. Since there was no discussion during our audit that the rating period was still in progress or a discussion of how the ratings were in fact tracked, it appears that this is a new process that has been implemented since our audit work ended. 7. Oversight of Contractors' Evaluation Submissions FIS does not have controls in place to ensure that the Contractors are submitting their evaluation results to the Contracting Officer'S Representative (COR). We requested copies of the results of evaluations, which were submitted to FIS, conducted by each Contractor since October 1, 2008. As stated under finding C.6. above, we detennined that CAeI did not have a process in place to document the results of their evaluations of investigators. We also found that USIS and KGS conduct and document employee evaluations; however, they do not submit the evaluation results to FIS. KGS stated that they have not submitted evaluations to OPM because "the contract is vague about exactly what is supposed to be submitted and on whom. It does not specifically state if there are differences between full timers and contract investigators and whether they needed all documents. It does not state in what format they need to be submitted and OPM has never requested this infonnation. We can provide the data if we knew more parameters." USIS keeps their evaluations on file and they have been reviewed by OPM personnel during on-site visits; however, USIS has never received a request from FIS asking for the submission of employee evaluations. FIS has not issued any procedures or guidance to the Contractors as to what documentation regarding evaluation results should be submitted to the COR. In addition, FIS stated that they have not requested employee evaluations in the past year. The FIS Fieldwork Contract Quality Assurance Provisions Applicable to USIS (OPM040600013), CAeI (OPM040600012), and Kroll <KGS> (OPM040600011)jieidwork contracts, section C. 6.1. 8, states that "The Contractor shall establish a program for the 18 evaluation of investigators and investigative technicians during the performance of their work to ensure compliance with the professional conduct requirements and investigative standards of this contract. This may include, but is not limited to, such things as a mentoring program, a ride-along program, qr similar evaluation programs. The results of evaluations conducted under the Contractor's evaluation program must be forwarded to the COR within 30 days of the date of the evaluation or, if otherwise appropriate, in accordance with the requirements of this contract." As a result of FIS not overseeing that the results of Contractors' evaluations are submitted, FIS will not be able to ensure that Contractor personnel are maintaining professional conduct and investigative standards outlined in the contract and/or the Investigator's Handbook. If personnel are not adhering to professionalism and investigative standards, investigations may be compromised leading to a decrease in the quality of background investigations. Recommendation 12 We recommend that FIS issue guidance to clearly explain what documentation is expected from the Contractors related to their evaluation program for investigative personnel. FIS' Response: FIS concurs with this recommendation and stated that they "will immediately issue clarification to the contractor as to what is required to be submitted in accordance with the contract section C.6.1.8 and attachment 4." D. FalsificationlIntegrity Issues 1. Misconduct Issues Not Submitted Timely USIS did not forward misconduct issues to OPM within the required timeframe for 7 of the 40 Investigators reviewed. Details regarding the seven Investigators were provided to FIS separate from this report. We reviewed all 40 Investigators with misconduct issues identified from October 1,2008 to August 11, 2009 to determine if the information was properly referred to OPM. USIS stated that there is no formal procedure on when to record the times that the USIS Integrity Assurance Team receives a misconduct issue. The Conformed Fieldwork Contract dated January 8, 2009, Section Cll. O. 6, states, "in regard to notification of allegations of misconduct, the Contractor shall make such notification within one workday whenever possible but in no case exceed 3 workdays in doing so." Section H3 also states: "Any action or misconduct by a Contractor employee or subcontractor that might adversely affect (1) the integrity of an investigative product or 19 OPM's automated system, (2) OPM's access to source information, (3) a subject or source's privacy rights, (4) the security of investigative material or OPM equipment or facilities, or (5) the individual's basic suitability to perform work under this contract, or (6) workplace safety, is of concern to OPM. If qiscovered by the Contractor, the Contractor shall immediately notify OPM of the individual's identity, the nature of the alleged negligence or misconduct, and any investigations that may require review and/or reopening." The USIS Fieldwork Services Quality Assurance Surveillance Plan, Section B. 7, states, "The USIS Integrity Assurance Team will notify OPM within 24 hours of any integrity issue developed by the field." If misconduct issues are not forwarded to aPM in accordance with established timelines, there is an increased risk that an unethical Investigator may be performing background investigations, thus increasing the risk to national security. Recommendation 13 We recommend that FIS require USIS to establish procedures to ensure that misconduct issues are documented and reported to aPM within the timeliness standards outlined in the contract and USIS policy. FIS'Response: FIS concurs with this recommendation and stated that they "will require USIS to adhere to the time frame in section C.ll.06, Section H.3, and Section B.7 once a misconduct issue is identified. " 2. Record Source Validations Not Performed We requested documentation (i.e., reports, spreadsheets, etc.) to support that record validations were performed, from October 1,2008 through August 19,2009, on all investigative personnel who perform record searches. The results of our review disclosed that the Contractors did not have controls in place to conduct record source validations. Specifically we found that: • USIS and CACI do not re-contact and validate at least two record sources per quarter per investigative personnel. USIS stated that they were under the impression that FIS would complete all record source re-contacts similar to the personal source re contacts that FIS performs. • KGS could not provide support that record validations were completed prior to August 19,2009 for Investigator Technicians. In addition, they were unable to support that they completed two record validations per quarter for each Background Investigator. KGS stated that documentation to support record validations done for Investigator Technicians was destroyed after 120 days. In addition, KGS does not 20 maintain a system to demonstrate that a sufficient number of record validations are performed for each Background Investigator or Investigator Technician that performs record searches. FIS Fieldwork Contract Quality Assurance Provisions Applicable to CAeL USIS, and KGS (OPM040600012, OPM0406000J3, OPM04060001J) fieldwork contracts, section C.6.1.5, states that "The Contractor shall validate record sources; at least two record sources per quarter per investigative personnel must be randomly re-contacted to validate the fact that the search was conducted and the accuracy of the record information obtained." If record sources are not validated in accordance with the contract, there is an increased risk that if the initial record search was not conducted or the information reported is inaccurate, it will not be discovered. Recommendation 14 We recommend that FIS require the Contractors to develop and implement internal controls to ensure that at least two record sources per quarter per investigative personnel are randomly re-contacted to validate the fact that the search was conducted and the accuracy of the record information obtained. Internal controls should include a requirement for KGS to maintain documentation to support the completion of the re-contacts. FIS~ Response: "Frs concurs with this recommendation" and stated that they "will conduct inspections throughout the year to ensure contractor compliance." 3. Review of Record Checks FIS did not conduct the required number of record check reviews for all Investigative Assistants. FIS' Centralized Lead Branch (eLB) assists field resources in conducting certain investigative work. Specifically, this group can accomplish credit record reviews, law searches, Internal Revenue Service record reviews, as well as access bankruptcy, employment and education records. Mentors and Team Leaders within the CLB review record checks on a monthly basis to determine if the completed record search is acceptable, correct, and complete. In order to verify that record checks are being reviewed, we requested documentation (i.e., reports, spreadsheets, etc.) to support reviews/validations of record checks performed from October 1,2008 through August 25, 2009. FIS provided a spreadsheet that is used to record the results of the random reviews conducted on the 54 Investigative Assistants. The spreadsheet captures the numbers reviewed as deficient, acceptable, and acceptable with advisory; however, it does not provide details to support the ratings. That information is maintained by the Team Leader in the individual's folder. The spreadsheet also does not 21 contain the last name for each Investigative Assistant; therefore, we selected all Investigative Assistants for our review. Based on the results of our revie~ we found that: • The CLB Mentors did not complete any reviews of record checks. • Four of the six CLB Team Leaders (teams 1,4,5, and 6) have not perfonned their required random reviews for two Investigative Assistants per month. . • There were no record check reviews perfonned for 18 of the 54 Investigative Assistants in one or more quarters from October 1,2008 through August 25,2009. PIS stated that due to the number of new employees this fiscal year and the extensive time involved in a 100 percent review of these trainees' work, the two quality/training team personnel (the Mentors) were unable to assist with the random reviews. The Performance Standards Formfor aPM Employees states that Investigator GS-181O-12 (Team Leaders) "Maintains quality controls for those investigative leadslrecords checks that have been assigned as a primary responsibility. Conducts random review of the work of2 Investigative Assistants per month at a rate of 10 checks per Investigative Assistant." For the Mentors, the Performance Standards Formfor aPM Employees states that Investigator GS-181 0-12 (Quality/Training) "Maintains quality controls by contributing to the effort to ensure that random review of work is conducted at an overall rate of 10 per quarter per Investigative Assistant, GS-06 and above." GAO's Standards for Internal Control in the Federal Government state that management is responsible for developing control activities, which are the policies, procedures, techniques and mechanisms that enforce management's directives. Control activities occur at all levels and functions of an entity and include a wide range of activities, such as approvals, authorizations, verifications, reconciliations, performance reviews, and the creation and maintenance of related records which provide evidence of execution of these activities as well as appropriate documentation. Examples of control activities/techniques include top level reviews of actual performance and reviews by management at the functional or activity leveL In addition, internal controls should be designed to assure that ongoing monitoring occurs in the course of normal operations. It should be performed continually and ingrained in the agency's operations. If record sources are not reviewed and validated, there is an increased risk that future record searches may not be conducted or the information reported may be inaccurate. 22 Recommendation 15 We recommend that FIS develop and implement internal controls to ensure that at least 10 reviews of record checks per quarter per Investigative Assistant are completed to validate that the search was conducted and that the record information reported is accurate. FIS'Response: FIS concurs with this recommendation and stated that "The Centralized Leads unit has developed and implemented the recommended internal controls. In addition, we are planning this FY to include the review results in the unit's database to allow automated analysis of problems/trends. During the first qum1er of FY20 10, our random review efforts have improved greatly. The required audit will exceed the requested 10 checks per quarter (per IA) as recommended." 4. Re-Contact of Personal Sources by Contractors CACI and KGS did not conduct the required amount of re-contacts for all new Investigators that we sampled. In addition, for CACI we were unable to determine whether the re-contacts that were performed were completed within 60 calendar days of the initial contact. For the period of May 1 through 31, 2009, we selected 25 out of 68 new CACI Investigators and 25 out of 299 new KGS Investigators. We reviewed re-contact documentation to determine whether CAeI and KGS performed personal source re-contacts for each of the Investigators in accordance with contract provisions. The results of our review disclosed that seven of the CACI and five of the KGS Investigators had not received the appropriate number of re-contacts. Details about the Investigators were provided to FIS separate from this report. The re-contacts were not completed by CACI's Quality Assurance Department due to the following reasons: • Three re-contacts were not performed because two Investigators did not turn in their Source Listing Sheets; • One re-contact was not performed because the source only spoke Spanish~ and • Four re-contacts for four Investigators were not performed because QA did not complete them. We were unable to determine if re-contacts were made within 60 calendar days ofthe initial source interview because neither the Personnel Investigations Processing System nor CACI's iTRAX system (CACl's primary case management tool) tracks the dates of when initial source interviews are conducted. KGS' system only generates a re-contact when at least 34 sources are interviewed per investigator per year. KGS explained that doing one re-contact out of a sample of 26 source interviews would be asking too much since it is over three percent. 23 FIS Fieldwork Contract Quality Assurance Provisions Applicable to CAe! and Kroll <KGS> (OPM040600012, OPM040600011)jieldwork contracts, section C.6.1.5, states that "The Contractor shall conduct re~contacts of personal sources by mail, telephone, or in person on a random sampling basis. During the first year of the investigator's employment the contact will be done telephonically. Randomly, on an annual basis, no less than three (3) percent of all personal sources obtained by each investigative personnel shall be re-contacted within 60 calendar days of the initial contact." . Not completing the required re-contacts for each Investigator during their first year of employment increases the risk that CACI and KGS will not be able to ensure the new Background Investigator is efficient and capable and/or reveal any weaknesses that may compromise their background investigations. Recommendation 16 We recommend that FIS require CACI to strengthen their internal controls to ensure that during the first year of the Investigator's employment CACI randomly contacts no less than three percent of all personal sources obtained by each investigative personnel within 60 calendar days of the initial contact. Recommendation 17 We recommend that FIS require KGS to strengthen its policy/procedures over their re contact program to ensure that at least one re-contact is performed during the first year of the Investigator's employment. The re-contact programs should be conducted within 60 calendar days of the initial interview and should be no less than three percent of all personal sources obtained by each Investigator. FIS'Response: FIS concurs with these recommendations and stated that "In response to the sample taken and referenced in the 010 letter of 12122/09, FIS asserts the foHowing: The requirement for the 3% re-contact of all personal sources is based on a yearly requirement. A sampling taken during a portion ofthe year is not an adequate sampling method. To further ensure compliance is met for the year, FIS will conduct unannounced inspections to verify compliance. " 5. Re-Contact of Personal Sources by FIS FIS did not conduct the required 3 re-contacts for It of the 80 Investigators we sampled. Details regarding the Investigators that did not receive the required three re-contacts per month were provided to FIS separate from this repo11. We judgmentally sampled 80 out of 4,831 Investigators from both FIS and the Contractors. Our sample consisted of 10 new and 10 experienced Investigators from FIS and each of the 3 24 Contractors. For the period of May I through 31,2009, we reviewed re-contact documentation to determine whether FrS performed personal source re-contacts for each of the 80 Investigators. Re-contacts for seven Investigators were not performed because a database problem excluded all Investigators with a staff identification starting with the letter "W". FIS stated that the problem was not identified until we selected the sample and that it was localized to new Investigators. Re-contact letters for three Investigators were not perfonned because the database excludes all Investigators that did not complete the zip code field within the database. Lastly, no specific reason could be identified as to why a re-contact letter was not sent for one Investigator; however, FIS believes it may be due to an anomaly resulting from database modifications. FIS' Personnel Source Re-Contact Program includes conducting at least three source re contacts per Investigator (both Federal and Contractor) per month. OMB Circular A-123 (Introduction) indicates that "Management has a fundamental responsibility to develop and maintain effective internal controL The proper stewardship of Federal resources is an essential responsibility of agency managers and staff. Federal employees must ensure that Federal programs operate and Federal resources are used efficiently and effectively to achieve desired objectives." GAO's Standards for Internal Control in the Federal Government state that management is responsible for developing control activities, which are the policies, procedures, techniques and mechanisms that enforce management's directives. Control activities occur at all levels and functions of an entity and include a wide range of activities, such as approvals, authorizations, verifications, reconciliations, performance reviews, maintenance of security, and the creation and maintenance of related records which provide evidence of execution of these activities, as well as appropriate documentation. In addition, internal controls should be designed to assure that ongoing monitoring occurs in the course of normal operations. It should be performed continually and ingrained in the agency's operations. Not completing the required re-contacts for each Investigator results in an increased risk that FrS will not be able to ensure the Investigator is efficient, capable, and/or identifies any weaknesses that may compromise background investigations. Recommendation 18 We recommend that FIS strengthen their internal controls over their re-contact program to ensure that they complete the required number of re-contacts per Investigator each month. 25 FIS' Response: "FIS concurs with this recommendation" and stated that they have "implemented an audit of the information generated from tp.e re-contact letter database to ensure that the required numbers of re-contact letters are sent per investigator on a monthly basis. . .. The results of each monthly audit are filed and maintained by Investigations Support, .. ," 26 IV. MAJOR CONTRIBUTORS TO THIS REPORT Internal Audits Group Auditor Audi tor-in-Charge Senior Team Leader • • • • • •Chief 27 [January 22,2010] APPENDIX MEMORANDUM FOR Chief, Internal Audits Group FROM KATHYL. DILLAMAN Associate Director Federal Investigative Services SUBJECT: Draft Report on the Audit of the Quality Assurance Process over Background Investigations. Report No. 4A-IS-00-09-060 The Federal Investigative Service (FIS) has reviewed the draft audit report of the Quality Assurance Process over Background Investigations and we concur with the findings and recommendations (except as otherwise noted) identified in the report. FIS is responsible for resolving the issues raised and implementing the recommendations provided in this audit. The response to the recommendations and an action plan (when applicable) are included as indicated. We recognize that even the best performing programs benefit from an independent external evaluation and we appreciate the input of the Office of the Inspector General in an effort to ensure the effectiveness and efficiency of our Quality Assurance Process over Background Investigations. We will use your recommendations as part of our on-going effort and focus to improve our program and operations. Recommendation 1: We recommend that FIS implement a standardized universal training program that is required to be used by FIS and its Contractors for all personnel who perform work completing background investigations (i.e. Investigators, reviewers and personnel completing records checks). FIS Management Response FIS concurs with this recommendation. The current field contracts do not require the contractors to have their investigators training conducted by OPM. They are responsible for conducting their own training. However, their training plans must be approved by OPM in advance and their curriculum must be based on OPM's Investigator's Handbook. OPM/FrS staffregularly audits contractor-conducted training classes. When the new contracts are awarded in 2011, FrS will mandate that all companies doing investigative work on behalf of OPM send their investigators to training classes conducted by OPM. In the interim, contractor companies can voluntarily send their investigators to the OPM Basic Investigators course. To date, OPM/FIS has provided the full training course to four CACI investigators, and investigators/staff from USIS and CACI have monitored the course. Necessary modifications have been ~ade to training materials to ensure that they are suitable for Federal and contractor field agents. With the issuance of new field contractors in 2011, FIS Training and Professional Development (TPD) will have adequate capacity to provide training to all field agent staff (Federal and contractor) that supports OPM's investigations program. Recommendation 2: We recommend that Frs implement Quality Case review program throughout all of the regions. FIS Management Response FIS concurs with this recommendation. All regions have been provided with the standard review tools and tracking system developed by the Northern Region. FlS is reviewing this process to make additional changes and will continue to refine this tool as we move forward. All regions have received training on the automated tool that will allow standard tracking of reviewed cases throughout the Federal field. Full implementation is expected by the end of January 2010. Recommendation 3: We recommend that FIS implement the use of an annual Integrity Statement for its employees and Contractors to assist in any possible falsification cases. FIS Management Response FIS cannot concur with this recommendation until the legality of such a statement is determined by OPM's Office of General Counsel (OGC). We will present this issue to OGC for an opinion before developing an action plan. Recommendation 4: We recommend that FrS resume the random case review process and ensure that internal controls are designed to assure that ongoing monitoring occurs in the course of normal operations. FIS Management Response FIS concurs with this recommendation and has resumed random review as of January 8, 2010. It should be noted that the random review process was only temporarily suspended in order to develop a training refresher course based on the findings of the year-long random review pilot. Recommendation 5= We recommend that FIS design internal controls to ensure that ongoing monitoring of the CAST occur during the normal course of operations. FIS Management Response FIS concurs with this recommendation. The internal control of Quality Management auditing the contractor-conducted CAST process, on a quarterly basis, will remain in effect until the function is moved to the Federal staff. The most recent audit was completed on October 9, 2009 for the first quarter of Fiscal Year 2010. QMG is in the process of scheduling an audit for the current quarter. Once the function moves to the Federal staff, Quality Management will audit this function as part of its random review process (daily basis). Recommendation 6: We recommend that FIS require USIS and KGS to provide an OPM approved training course to all employees who perform record checks. FIS Management Response FIS concurs with this recommendation. FlS is currently working with USIS and KGS on an approved training course with an anticipated implementation date of March 1, 2010 Recommendation 7: We recommend that FIS have all mentors complete a mentor training course prior to them serving as a mentor to the Investigators. FIS Management Response FIS concurs with this recommendation. A standard mentor training course will be in place by March 1, 2010, and all new mentors will be required to successfully complete the training before serving as a mentor. Recommendation 8: We recommend that FIS require KGS, and USIS to provide documentation to support that the investigators have completed all qualifications necessary in order to perform background investigation on behalf of FIS. FIS Management Response FIS concurs with the recommendation of having the contractors provide documentation to support the investigators qualifications. In accordance with Attachment A and Section H.16 of the contract, the contractor is required to maintain documentation regarding the investigator's qualifications. OPM will conduct inspections to ensure that the contractor's are maintaining the qualifications as outlined in the contract. Recommendation 9: We recommend that FIS instruct USIS to update its Check-Ride Standards/Field Quality Assurance Policy to include a define,d timeframe as to when USIS must conduct check rides for their new investigators once they have completed their field training. FIS Management Response FIS concurs with this recommendation. FIS will instruct US IS to review their internal check-ride policy and make a determination on a defined timeframe. Recommendation 10: We recommend that FIS ensure that all Investigators receive at least one supervisory check-ride assessment per appraisal period. FIS Management Response FIS has complied with this recommendation, In the case of <DELETED BY OPM-OIG, NOT RELEVANT TO THE AUDIT REPORT>, she was promoted to an Agent on April 12,2009 from an Investigative Assistant position. Prior to becoming an agent there would have been no requirement or need for her to attend the BIC. She completed the BIC on 1012312009. Prior to that she would have been in training and assigned a mentor. The documentation for the other six agents is attached showing they had a check ride conducted or were in training. FIS did meet all requirements for each agent. Recommendation 11: We recommend that FIS require CACI to implement controls to ensure that the results of evaluations conducted under CACI's evaluation program are documented and forwarded to the COR within 30 days ofthe date of evaluation. FIS Management Response FIS does not concur with this recommendation. CACI has an established evaluation program. CAeI submitted their evaluations on January 8,2010 (attached), and will submit their evaluations no later than 30 days after the end of the rating period for future submissions. FIS has incorporated a review and validation of the report as part of the workload goals and FrS will conduct inspections for all contractors throughout the year to ensure compliance, Recommendation 12: We recommend that FIS issue guidance to clearly explain what is expected from the Contractors. FIS Management Response FIS concurs with this recommendation. FIS will immediately issue clarification to the contractor as to what is required to be submitted in accordance with the contract section C.6.1.8 and attachment 4. ' Recommendation 13: We recommend that FIS requires USIS to establish procedures to ensure that misconduct issues are documented and reported to OPM within the timeliness standards outlined in the contract and USIS policy. FIS Management Response Frs concurs with this recommendation. FIS will require USIS to adhere to the time frame in section C.ll.06, Section H.3, and Section B.7 once a misconduct issue is identified. Recommendation 14: We recommend that FIS require the Contractors to develop and implement internal controls to ensure that at least two record sources per quarter per investigators are randomly recontacted to validate the fact that the search was conducted and the accuracy of the record information obtained. Internal controls should include a requirement for KGS to maintain documentation to support the completion of the re-contacts. FIS Management Response FIS concurs with this recommendation. As outlined in Section C.6.1.S, the contractors are required to conduct and maintain documentation on the record source re-contacts. FIS will conduct inspections throughout the year to ensure contractor compliance. Recommendation 15: We recommend that Frs develop and implement internal controls to ensure that at least ten reviews of record checks per quarter per Investigative Assistant are completed to validate that the search was conducted and that the record information reported is accurate. FIS Management Response FIS concurs with this recommendation. The Centralized Leads unit has developed and implemented the recommended internal controls. In addition, we are planning this FY to include the review results in the unit's database to allow automated analysis of problems/trends. During the first quarter of FY20 10, our random review efforts have improved greatly. The required audit will exceed the requested 10 checks per quarter (per IA) as recommended. The field contracts do not state when during the year or how often source re-contacts be conducted. The contracts only specify that 3% of all sources interviewed by an investigator be re-contacted. Contracting can make a recommendation to the contractors that they spread the re contacts throughout the year. Recommendation 16: We recommend that FIS require CACI to strengthen their internal controls to ensure that during the first year of the investigator's employment, CAeI randomly contacts no less than three percent of all personal sources obtained by each investigative personnel within 60 calendar days of the initial contact. FIS Management Response FIS concurs with this recommendation presented above. In response to the sample taken and referenced in the OIG letter of 12122/09, FIS asserts the following: The requirement for the 3% re-contact of all personal sources is based on a yearly requirement. A sampling taken during a portion of the year is not an adequate sampling method. To further ensure compliance is met for the year, FIS will conduct unannounced inspections to . verify compliance. Recommendation 17: We recommend that FIS require KGS to strengthen its policy/procedures over their re-contact program to ensure that at least one re-contact is perfonned during the first year of the investigator's employment. The re-contact programs should be conducted within 60 calendar days of the initial interview and should be no less than three percent of all personal sources obtained by each investigator. FIS Management Response FIS concurs with this recommendation presented above. In response to the sample taken and referenced in the OIG letter of 12122/09, FIS asserts the following: The requirement for the 3% re-contact of all personal sources is based on a yearly requirement. A sampling taken during a portion of the year is not an adequate sampling method. To further ensure compliance is met for the year, FIS will conduct unannounced inspections to verify compliance. Recommendation 18: We recommend that frS strengthen their internal controls over their re-contact program to ensure that they complete the required number of re-contacts per Investigator each month. FIS Management Response FrS concurs with this recommendation. FIS has implemented an audit of the information generated from the re-contact letter database to ensure that the required numbers of re-contact letters are sent per investigator on a monthly basis. Investigations Support personnel perform a monthly database query that compares the number of sources interviewed by each investigator to the number of re-contact letters sent. In instances where less than three letters are sent, an analysis is performed to determine the reason. The reason may be legitimate (e.g., the sallie source interview was transmitted several times, the same source received a re-contact letter the previous year, an address field was blank, etc.) or the issue may require further research to determine if there is a database problem. In either case, the issue receives irmnediate attention and when possible, additional re-contact letters are sent as appropriate. The results of each monthly audit are filed and maintained by Investigations Support and include the following information: o Number of instances where Less than three letters were sent o Appropriate case numbers and investigator SIOs o Reason(s) Less than three letters were generated per investigator
Audit of the Quality Assurance Process Over Background Investigations
Published by the Office of Personnel Management, Office of Inspector General on 2010-06-22.
Below is a raw (and likely hideous) rendition of the original report. (PDF)