Compliance with Standards Governing Combined DNA Index System Activities
at the Kansas Bureau of Investigation DNA Laboratory, Topeka, Kansas
Audit Report GR-60-06-008
Office of the Inspector General
The Office of the Inspector General, Audit Division, has completed an audit of compliance with standards governing Combined DNA Index System (CODIS) activities at the Kansas Bureau of Investigation, Topeka DNA Laboratory (Laboratory).1 The Federal Bureau of Investigation (FBI) began the CODIS Program as a pilot project in 1990. The DNA Identification Act of 1994 (Act) formalized the FBI’s authority to establish a national DNA index for law enforcement purposes.2 The Act authorized the FBI to establish an index of DNA identification records of persons convicted of crimes and analyses of DNA samples recovered from crime scenes. The Act further specified that the indices include only DNA information that is based on analyses performed in accordance with quality assurance standards issued by the FBI.
The FBI implemented CODIS as a distributed database with three hierarchical levels that enables federal, state, and local crime laboratories to compare DNA profiles electronically. The National DNA Index System (NDIS) is the highest level in the CODIS hierarchy and enables the laboratories participating in the CODIS Program to compare DNA profiles on a national level. NDIS became operational in 1998 and is managed by the FBI as the nation’s DNA database containing DNA profiles uploaded by participating states. DNA profiles originate at the local level, flow upward to the state and national levels, and are compared to determine if a convicted offender can be linked to a crime, or if crimes can be linked to each other. Thus, a laboratory’s profiles have to be uploaded to NDIS before the profiles benefit the system as a whole.
The FBI provides CODIS software free of charge to any state or local law enforcement laboratory performing DNA analysis. Before a laboratory is allowed to participate at the national level a Memorandum of Understanding (MOU) must be signed between the FBI and the applicable state laboratory. The MOU defines the responsibilities of each party, includes a sublicense for the use of the CODIS software, and delineates the standards laboratories must meet in order to utilize NDIS.3
The objective of the audit was to determine if the Laboratory was in compliance with standards governing CODIS activities. Specifically, we performed testing to determine if the: (1) Laboratory was in compliance with the NDIS participation requirements; (2) Laboratory was in compliance with the quality assurance standards issued by the FBI; and (3) Laboratory’s DNA profiles in CODIS databases were complete, accurate, and allowable.
We determined that the Laboratory was in compliance with the standards governing CODIS activities with some exceptions. Specifically, we noted the following.
One of the five CODIS users did not fill out an annual reminder form for 2005, as necessary under NDIS requirements. According to the CODIS Administrator the user was a part-time employee that must have missed completing the form for 2005.
We made three recommendations to address the Laboratory’s compliance with standards governing CODIS activities, which are discussed in detail in the Findings and Recommendations section of the report. We also suggested the Laboratory work with law enforcement on filling in all sections of the Physical Evidence Custody Receipt forms. This suggestion is placed under Other Reportable Matters because it is not required by the standards governing CODIS activities. We also discussed the results of our audit with Laboratory officials and have included their comments in the report as applicable. Our audit scope and methodology are detailed in Appendix I of the report and the audit criteria are detailed in Appendix II of the report.
In addition we requested a written response to a draft of our audit report from the FBI and the Laboratory. The Laboratories response can be seen in Appendix III and the FBI’s response can be seen in Appendix IV. Since the FBI’s response was received prior to receiving the Laboratory’s response, all recommendations are resolved pending the FBI’s review of the Laboratory’s response to determine if further action is warranted.