We reviewed information system general controls' at the Department of Veterans Affairs (VA) in connection with VA's required annual consolidated financial statement audit for fiscal year 1998. Our evaluation included follow-up on departmentwide computer security planning and management weaknesses and specific computer security weaknesses we identified at the Austin Automation Center (AAC) in conjunction with the audit of VA's fiscal year 1997 financial statements. On June 8, 1999, we issued a separate report to the acting VA Chief Information Officer (CIO) and the director of AAC that details the results of our review at AAC. We also reviewed VA Office of Inspector General (OIG) and consultant reports regarding computer security at Veterans Benefits Administration (VBA) and Veterans Health Administration (VHA) facilities. These site reports included recommendations to correct the security weaknesses identified. The results of our underlying reviews were shared with VAs Office of Inspector General (OIG) for its use in auditing VA's consolidated financial statements for fiscal year 1998.