05/31/2006 TO: Richard A. McGeary Regional Audit Manager Office of the Inspector General   FROM: Charlene B. Thornton Assistant Director, Inspection Division Federal Bureau of Investigation   SUBJECT: The Federal Bureau of Investigation's (FBI) Response to the Office of the Inspector General's (OIG) Draft Report on the Implementation of the Laboratory Information Management System (LIMS)   In response to the findings and recommendations set forth in the OIG draft report entitled,"The Federal Bureau of Investigation's Implementation of the Laboratory Information Management System (LIMS)," the FBI has prepared and enclosed the following: Formal responses to recommendations #1 - 3 (Enclosure 1); and Sensitivity review form prepared after review of the draft LIMS report (Enclosure 2). In addition, this letter addresses concerns that the FBI has regarding assertions in the report that require clarification or requires additional information to place it in context. Accordingly, the FBI respectfully requests inclusion of this letter and the responses to the recommendations (Enclosure 1) in the final report prior to publication. After reviewing the conclusions and recommendations provided by the OIG on how the FBI can strengthen the information management process within the laboratory, the FBI is confident that the substantial modifications that have already been implemented in the laboratory's processes, and the further developments that will occur, will significantly enhance the laboratory's operations. The FBI concurs with the OIG's conclusion that the inability to implement LIMS can be attributed to both the FBI and the third-party vendor. However, with the advent of the FBI’s Life Cycle Management Directive (LCMD) and other improvements noted in the comments on the OIG’s recommendations, the FBI has made considerable progress in ensuring that all FBI projects, including laboratory projects, strictly adhere to updated policies and procedures. Overview In order to improve the FBI's management of the flow of evidence throughout the laboratory, an improved information system that would allow better tracking and provide statistical reporting was sought. As a result, a contract was awarded to a third-party vendor to establish a commercial off-the-shelf LIMS for the FBI's laboratory, which would allow the tracing and tracking of evidence and provide a variety of reporting capabilities. After several difficulties and delays encountered in the fulfillment of the contract, the FBI moved expeditiously to mitigate further costs associated with the contract for the LIMS. Accordingly, it was determined that the LIMS would not meet the FBI's requirements. The vendor was then notified and the contract was terminated. Pursuant to the terms of the contract, the FBI paid an additional sum of approximately $520,000,in order to terminate the contract. This payment was in addition to payments previously made on the contract. It is important to note that the payment to terminate the contract was far less than the $4.3 million total cost of the contract as awarded. In addition, FBI’s expenditures on the LIMS prior to its termination included payment for equipment purchases which can be used by the lab separately from LIMS. Comments on the Draft OIG Report As previously noted, the FBI has concerns regarding various statements in the report that we believe require clarification or are inaccurate. The OIG report indicates that by not implementing this system, "the FBI laboratory operates without an effective information system to adequately trace the flow of evidence through the laboratory." The purpose of LIMS was to enhance the processes and procedures currently in place in the laboratory by improving efficiencies and automation. The implication of the statement in the report is that the laboratory's operations are not effective or adequate, which is not supported by the fact that it is one of the largest and most comprehensive forensic laboratories in the world. Indeed, the lab annually conducts over one million examinations of physical evidence. To continue to successfully accomplish work of this quantity and caliber, improvements to an effective system, not the establishment of one, is required. The report states that the FBI lost "...nearly $1.2 million...," "...did not do its homework before awarding the contract...," and did not adequately ensure that the third-party vendor 1) understood the system requirements, 2) had the technical capacity to fulfill them, or 3) possessed the requisite security requirements for certification and accreditation of the LIMS software. The statements noted above imply that the FBI had singular control over the system development and process; however, the report acknowledges that the third-party vendor also bears a significant degree of responsibility for the project issues. As detailed in the recommendation responses and stated in other audits conducted by the OIG, the FBI has instituted practices to improve the process for and clarification of technical, contractual and/or security requirements for future system implementations. In addition, it should be noted that the contract termination settlement is far less than the full contract amount. It also reflects mitigation of the potential financial impact if further development had occurred on this system despite the technical and security requirements that were in place at that time. Throughout the report, the third-party vendor's name is provided. Since this report will be available to the public and accessible via internet, the FBI requests redaction of the vendor's name and specific dollar amounts to protect the future business opportunities of the vendor and future requests for proposal issued by the FBI on similar projects. The FBI Laboratory offers the following in response to the DOJ-OIG preliminary draft review of the Implementation of the Laboratory Information Management System (LIMS). Recommendation #1: Consider whether a COTS workflow system or laboratory information management system in use or under development within the federal government will meet the needs of the FBI laboratory. Response: The FBI Laboratory agrees with this recommendation and will continue to work with the FBI OCIO to ensure a laboratory management system is implemented. In December 2005, the FBI Laboratory in conjunction with the FBI OCIO began a Business Process Management (BPM) initiative to focus on the development, improvement, and reengineering of processes that govern the way laboratory services are provided. The BPM is an application that contains workflow tools, event triggers, business logic, and process automation. BPM will integrate with the portal, Business Activity Monitoring (BAM), which provides real-time feedback of key business performance indicators for BPM. The FBI Laboratory recognizes how significant this initiative will be in improving the overall processes of the FBI Laboratory by identifying potential process waste and inefficiencies, and also serving as an evidence tracking system. Recommendation #2: Ensure that any project to provide a laboratory information management system not only follows the FBI’s LCMD but is overseen by an experienced IT project manager. Response: The FBI Laboratory agrees with this recommendation and takes continuous action in this area. The FBI Laboratory is committed to ensuring all current and future Laboratory Division (LD) Information Technology (IT) projects comply with the FBI OCIO IT Management Process which includes the Life Cycle Management Directive (LCMD), IT Metrics, Earned Value Management System (EVMS) and IT Governance Boards. The FBI Laboratory will continue to work closely with the OCIO to ensure projects are designed and developed within the IT Enterprise Architecture (EA). Any future Laboratory information management system will also be presented for approval to the OCIO Investment Management Project Review Board, as well as undergo all the rigors of the FBI-wide IT project management processes established by the OCIO to ensure proper expenditure of funding and execution of the information technology requirements. In September 2004, a decision was made by FBI Laboratory Division senior management that standard Project Management (PM) practices would be implemented to consistently define, approve, plan, control, report, and archive a growing number of LD projects. The overall objectives of the LD PM initiatives are to: Provide a common infrastructure for implementing PM tools and techniques consistently, effectively, and efficiently Accommodate Project Leaders with varying levels of PM experience through centralized support and training Provide a standardized procedure for defining and approving proposed projects Provide a common process and suite of automated tools for managing and controlling projects once approved Provide a standardized methodology and automated vehicle for capturing, reporting, and archiving project information and performance data for management review, future reference, and audits Consistent with this decision, the LD established a Project Management Office (PMO) to provide PM services and implement PM standards. The PMO is responsible for: Project Management (PM) Consultation Process, Procedure, Template Definition/Enhancement Automated Tool Development/Administration/Enhancement Project Performance Analysis and Report Generation Control Product Assessment and Preparation Assistance Management (Phase) Review Coordination PM Training The PMO serves as the LD's focal point for defining, maintaining, and enhancing PM standards and tools. PM standards and tools are supported through the Project and Account Management System (PAMS). PAMS provides Laboratory managers and users with real-time, online financial information. PAMS is a centralized, remotely accessed, web-based system that captures, tracks and manages Laboratory investments. Recommendation #3: Establish cost controls to ensure that training or other expenses are not incurred prematurely in the development of a successor to the LIMS project. Response: The FBI Laboratory agrees with this recommendation and has implemented a process to ensure all FBI Laboratory projects are consistent with the Bureau’s PM policies and procedures. The FBI Laboratory is committed to ensuring all current and future Laboratory Division (LD) Information Technology (IT) projects comply with the FBI OCIO IT Management Process which includes the Life Cycle Management Directive (LCMD), IT Metrics, Earned Value Management System (EVMS) and IT Governance Boards. The FBI Laboratory will continue to work closely with the OCIO to ensure projects are designed and developed within the IT Enterprise Architecture (EA). Any future Laboratory information management system will also be presented for approval to the OCIO Investment Management Project Review Board, as well as undergo all the rigors of the FBI-wide IT project management processes established by the OCIO to ensure proper expenditure of funding and execution of the information technology requirements. In line with the Laboratory Division’s Project Management Office (PMO), the LD established a Major Acquisition Review Committee (MARC). This committee serves as the review entity for the PM Life Cycle Phased Reviews. In addition the MARC will review all acquisition requests totaling $250,000 or more, all Information Technology (IT) request totaling $50,000 or more and all LD projects totaling $100,000 or more. The MARC members include the LD’s Deputy Assistant Directors, Section Chiefs, and the Unit Chief of the Planning and Budget Unit.