Sensitive information on millions of U.S. military personnel and veterans remains at grave risk because of weak security controls that have not yet been fixed, government investigators said Wednesday. In testimony to Congress, the Government Accountability Office and Veterans Affairs inspector general detailed ignored warnings, weak management and lax rules in their review of VA information security following the theft of 26.5 million military personnel’s private data last month. They found that the Veterans Affairs Department routinely failed to control and monitor employee access to private information, did not restrict users to “need-to-know” data and often waited too long to terminate accounts when an employee quit or was fired.