prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.

Report 1: CMS has four principal programs: Medicare, Medicaid, CHIP, and the health-insurance marketplaces  See table 1 for information about the four programs  As discussed earlier, Medicare and Medicaid are CMS’s largest programs and have been growing steadily (see fig  1)  CBO projects that, in 2026, under current law, Medicare spending will reach $1 3 trillion  Medicaid is also expected to continue to grow—program spending is projected to increase 66 percent to over $950 billion by fiscal year 2025, and more than half of the states have chosen to expand their Medicaid programs by covering certain low-income adults not historically eligible for Medicaid coverage, as authorized under the Patient Protection and Affordable Care Act of 2010 (PPACA)  The two programs’ use of managed-care delivery systems to provide care has also increased  For example, the number and percentage of Medicare beneficiaries enrolled in Medicare Part C has grown steadily over the past several years, increasing from 8 7 million (20 percent of all Medicare beneficiaries) in calendar year 2007 to 17 5 million (32 percent of all Medicare beneficiaries) in calendar year 2015  As of July 1, 2015, nearly two-thirds of all Medicaid beneficiaries were enrolled in managed- care plans and about 40 percent of expenditures in fiscal year 2015 were for health-care services delivered through managed care  CMS receives appropriations to carry out antifraud activities through several funds including the Health Care Fraud and Abuse Control (HCFAC) program and the Medicaid Integrity Program  The HCFAC program was established under the Health Insurance Portability and Accountability Act of 1996 to coordinate federal, state, and local law- enforcement efforts to address health-care fraud and abuse and to conduct investigations and audits, among other things  In fiscal year 2016, CMS received $560 million through the HCFAC program appropriations  The Medicaid Integrity Program, established by the Deficit Reduction Act of 2005, supports contracts to audit and identify overpayments in Medicaid claims, and provides technical assistance for states’ program-integrity efforts  According to CMS, it received $75 million every year since fiscal year 2009 through the Medicaid Integrity Program appropriations  According to CMS, in fiscal year 2016, total program-integrity obligations to address fraud, waste, and abuse for Medicare and Medicaid were $1 45 billion  As mentioned previously, we designated Medicare and Medicaid as high- risk programs starting in 1990 and 2003, respectively, because their size, scope, and complexity make them vulnerable to fraud, waste, and abuse  Similarly, the Office of Management and Budget (OMB) designated all parts of Medicare as well as Medicaid “high-priority” programs because these programs report $750 million or more in estimated improper payments in a given year  We also highlighted challenges associated with improper payments in Medicare and Medicaid in our annual report on duplication and opportunities for cost savings in federal programs  Improper payments are a significant risk to the Medicare and Medicaid programs and can include payments made as a result of fraud  Improper payments are payments that are either made in an incorrect amount (overpayments and underpayments) or those that should not be made at all  For example, CMS estimated in fiscal year 2016 that the Medicare fee-for-service (FFS) improper payment rate was 11 percent (approximately $41 billion) and the Medicaid improper payment rate was 10 5 percent (approximately $36 billion)  Improper payment measurement does not specifically identify or estimate improper payments due to fraud  Health-care fraud can take many forms, and a single case can involve more than one scheme  Schemes may include fraudulent billing for services not provided, services provided that were not medically necessary, and services intentionally billed at a higher level than appropriate  These fraud schemes may include compensating providers, beneficiaries, or others for participating in the fraud scheme  Fraud can be regionally focused or can target particular service areas such as home-health services, or durable medical equipment such as wheelchairs  Fraud may also have nonfinancial effects  For example, patients may be subjected to harmful or unnecessary services by fraudulent providers  Fraud can be perpetrated by different actors, such as providers, beneficiaries, health-insurance plans, as well as organized crime  Fraud and “fraud risk” are distinct concepts  Fraud is challenging to detect because of its deceptive nature  Additionally, once suspected fraud is identified, alleged fraud cases may be prosecuted  If the court determines that fraud took place, then fraudulent spending may be recovered  Fraud risk exists when individuals have an opportunity to engage in fraudulent activity, have an incentive or are under pressure to commit fraud, or are able to rationalize committing fraud  When fraud risks can be identified and mitigated, fraud may be less likely to occur  Although the occurrence of one or more cases of health-care fraud indicates there is a fraud risk, a fraud risk can exist even if fraud has not yet been identified or occurred  Suspicious billing patterns, certain types of health-care providers, or complexities in program design may indicate a risk of fraud  Information to help identify potential fraud risks may come from various sources, including whistleblowers, agency officials, contractors, law-enforcement agencies, beneficiaries, or providers  According to federal standards and guidance, executive-branch agency managers are responsible for managing fraud risks and implementing practices for combating those risks  Federal internal control standards call for agency management officials to assess the internal and external risks their entities face as they seek to achieve their objectives  The standards state that as part of this overall assessment, management should consider the potential for fraud when identifying, analyzing, and responding to risks  Risk management is a formal and disciplined practice for addressing risk and reducing it to an acceptable level  In July 2015, GAO issued the Fraud Risk Framework, which provides a comprehensive set of key components and leading practices that serve as a guide for agency managers to use when developing efforts to combat fraud in a strategic, risk-based way  The Fraud Risk Framework describes leading practices in four components: commit, assess, design and implement, and evaluate and adapt, as depicted in figure 2  The Fraud Reduction and Data Analytics Act of 2015, enacted in June 2016, requires OMB to establish guidelines for federal agencies to create controls to identify and assess fraud risks and design and implement antifraud control activities  The act further requires OMB to incorporate the leading practices from the Fraud Risk Framework in the guidelines  In July 2016, OMB published guidance about enterprise risk management and internal controls in federal executive departments and agencies  Among other things, this guidance affirms that managers should adhere to the leading practices identified in the Fraud Risk Framework  Further, the act requires federal agencies to submit to Congress a progress report each year for 3 consecutive years on the implementation of the controls established under OMB guidelines, among other things  CMS’s antifraud efforts for its four principal programs are part of the agency’s broader program-integrity approach to address fraud, waste, and abuse  CMS’s Center for Program Integrity (CPI) is the agency’s focal point for program integrity across the programs  According to CMS, its approach to program-integrity allows it to “address the whole spectrum of fraud, waste, and abuse ” For example, CMS describes its program- integrity activities as addressing unintentional errors resulting from providers being unaware of recent policy changes on one end of the spectrum, through somewhat more-serious patterns of abuse such as billing for a more-expensive service than was performed (known as upcoding), and finally up to serious fraudulent activities, such as billing for services that were not provided  CMS then aims to target its corrective actions to fit the risk  See figure 3 for CMS’s description of the spectrum of fraud, waste, and abuse that its program-integrity activities aim to address  Within its program-integrity activities, CMS has established several control activities that are specific to managing fraud risks, while others serve broader program-integrity purposes  According to CMS officials, the agency’s antifraud control activities mainly focus on providers in Medicare FFS  Officials told us that when CPI began operating, its primary focus was developing program integrity for Medicare FFS and, as a result, it is the most “mature” of all of CPI’s programs  CMS’s specific fraud control activities include, for example, the Fraud Prevention System (FPS), a predictive-analytics system that helps identify potentially fraudulent payments in Medicare FFS, and the Unified Program Integrity Contractors (UPIC), which detect and investigate aberrant provider behavior and potential fraud in Medicare and Medicaid  Other control activities serve broader program-integrity purposes such as to reduce improper payments resulting from error, waste, and abuse in addition to preventing or detecting potential fraud  For example, CMS provides education and outreach to Medicare providers and beneficiaries on issues identified through data analyses in order to reduce improper payments and to increase their awareness of fraud  HHS and CMS department- and agency-wide strategic plans guide CMS’s program-integrity activities—including antifraud activities  The program-integrity goals identified in the HHS strategic plan primarily focus on improper payments and are driven by statutory requirements  For example, the HHS strategic plan for fiscal years 2014–2018 includes performance goals of reducing the percentage of improper payments made under Medicare FFS and Medicare Parts C and D  One antifraud- focused goal in the HHS strategic plan is to increase the percentage of Medicare providers and suppliers identified as high risk that receive administrative actions, such as suspending payments to providers or revoking providers’ billing privileges  HHS and CMS department- and agency-wide strategic plans also include an emphasis on fraud prevention and early detection—a leading practice in the Fraud Risk Framework—and moving away from a “pay-and-chase” model  For example, the HHS strategic plan calls for “fostering early detection and prevention of improper payments by focusing on preventing bad actors from enrolling or remaining in Medicare and Medicaid” and to “use public-private partnerships to prevent and detect fraud across the health care industry by sharing fraud-related information and data between the public and private sectors ” As a part of this emphasis on prevention, CMS developed FPS in response to the Small Business Jobs Act of 2010, which required CMS to implement predictive-analytics technologies  Also, the Patient Protection and Affordable Care Act of 2010 (PPACA) included provisions to strengthen Medicare and Medicaid’s provider enrollment standards and procedures, among other program-integrity provisions  CMS works with an extensive and complex network of stakeholders to manage fraud risks in its four principal programs  In Medicaid and CHIP, CMS partners with and oversees the 50 states and the District of Columbia  Until the Deficit Reduction Act of 2005 expanded CMS’s role in Medicaid program integrity to provide effective federal support and assistance to states’ efforts to combat fraud, waste, and abuse, states were primarily responsible for Medicaid program integrity  Each state has its own Medicaid program-integrity unit, Medicaid Fraud Control Unit (MFCU), and state audit organization  CMS also uses numerous contractors to conduct the majority of its program-integrity activities  Since the enactment of Medicare in 1965, contractors have played an integral role in the administration of the program  The original Medicare program was designed so that the federal government contracted with health insurers or similar organizations experienced in handling physician and hospital claims to pay Medicare claims  Later, the Health Insurance Portability and Accountability Act of 1996 required the Secretary of Health and Human Services to enter into contracts to promote the integrity of the Medicare program  According to CMS officials, in fiscal year 2016 contractors received 92 percent of CMS’s program-integrity funding  Medicare and Medicaid program- integrity contractors play a variety of roles: (1) processing and reviewing claims, (2) conducting site visits of providers enrolling in Medicare, (3) auditing claims and recovering overpayments, (4) performing data analysis, and (5) investigating aberrant claims and provider behaviors, among other things  States also use contractors in many of these roles for managing program integrity  Additionally, multiple private health-insurance plans in Medicare Parts C and D and over 200 health-insurance plans in Medicaid managed care also carry out program-integrity activities  For the health-insurance marketplaces, CMS is responsible for operating the federally facilitated marketplace and overseeing the state-based marketplaces  CMS also developed the Federal Data Services Hub, which acts as a portal for exchanging information between state-based marketplaces, the federally facilitated marketplace, and state Medicaid agencies, among other entities, as well as other external partners, including other federal agencies, such as the Internal Revenue Service  Finally, law- enforcement groups, including the joint Department of Justice (DOJ) and HHS OIG Medicare Fraud Strike Force Teams, identify, investigate, and prosecute instances of fraud in CMS programs  See figure 4 for a depiction of CMS’s stakeholder network for managing fraud risks  This figure illustrates approximate numbers of stakeholders (through the concentration of dots), but not the extent of individual stakeholder roles  CMS provides oversight to, or partners with, these stakeholders to manage fraud risks  For oversight, CMS creates policies and guidance to direct stakeholders’ antifraud efforts, such as Medicare and Medicaid program-integrity manuals and the Medicaid Provider Enrollment Compendium  CMS also provides technical assistance to states in areas such as provider enrollment and data analysis  In areas where CMS does not have a primary role, it acts as a partner by collaborating and coordinating program-integrity and antifraud activities  For example, CMS is directly responsible for Medicare program integrity, but, in Medicaid and CHIP, states are the first line of program-integrity efforts  Similarly, CMS maintains control over Medicare FFS program integrity, but within Medicare managed care, it provides guidance for health- insurance plans to carry out their own program-integrity activities  In the health-insurance marketplaces, CMS reviews state-based marketplaces’ procedures for verifying applicant eligibility for coverage  For example, it conducts annual reviews of the state-based marketplaces, which include a review of states’ fraud, waste, and abuse policies  See figure 5 for a further description of CMS’s and various stakeholders’ roles and responsibilities in fraud risk management  CMS also facilitates collaboration among federal, state, and private entities for managing fraud risks  In 2012, CMS created the Healthcare Fraud Prevention Partnership (HFPP) to share information with public and private stakeholders and to conduct studies related to health-care fraud, waste, and abuse  According to CMS, as of October 2017, the HFPP included 89 public and private partners, including Medicare- and Medicaid-related federal and state agencies, law-enforcement agencies, private health-insurance plans (payers), and antifraud and other health- care organizations  The HFPP has conducted studies that pool and analyze multiple payers’ claims data to identify providers with patterns of suspect billing across payers  In a recent report, participants separately told us that the HFPP’s studies helped them to identify and take action against potentially fraudulent providers and payment vulnerabilities of which they might not otherwise have been aware, and fostered both formal and informal information sharing  CMS’s relationships with stakeholders were varied in terms of maturity and extent of information sharing, according to stakeholders we interviewed  While some relationships between CMS and stakeholders have been long-standing, some are developing, and others exist on an ad hoc basis  For example, CMS has had a long-standing relationship with state Medicaid program-integrity units, by collaborating through monthly meetings of the Medicaid Fraud and Abuse Technical Advisory Group, sending fraud alerts, and offering courses through the Medicaid Integrity Institute  However, in our interviews with state program-integrity units, and as we recently reported, some state Medicaid agencies shared concerns about the communication, level of policy guidance, and technical support provided by and received from CMS for managing fraud risks in Medicaid  This concern was echoed by state audit officials, with whom CMS recently initiated coordination to build relationships that would facilitate state auditing of Medicaid programs  CMS also has varying relationships with its law-enforcement partners  For example, the relationship between CMS and DOJ’s Health Care Fraud unit, which leads the DOJ and HHS OIG Medicare Fraud Strike Force Teams, has been ad hoc  According to CMS and DOJ officials, the interactions between the agencies have been based on specific fraud cases such as coordination of national takedowns when DOJ provided CMS with the names of providers committing fraud so that CMS could suspend them consistently with the timing of the enforcement efforts  According to CMS officials, they coordinate more with HHS OIG, working together on payment suspensions and revocations for OIG cases, or working with it to take administrative actions against large providers  CMS’s antifraud efforts partially align with the Fraud Risk Framework  Consistent with the framework, CMS has demonstrated commitment to combating fraud by creating a dedicated entity to lead antifraud efforts  It has also taken steps to establish a culture conducive to fraud risk management, although it could expand its antifraud training to include all employees  CMS has taken some steps to identify fraud risks in Medicare and Medicaid; however, it has not conducted a fraud risk assessment or developed a risk-based antifraud strategy for Medicare and Medicaid as defined in the Fraud Risk Framework  CMS has established monitoring and evaluation mechanisms for its program-integrity control activities that, if aligned with a risk-based antifraud strategy, could enhance the effectiveness of fraud risk management in Medicare and Medicaid  The commit component of the Fraud Risk Framework calls for an agency to commit to combating fraud by creating an organizational culture and structure conducive to fraud risk management  This component includes establishing a dedicated entity to lead fraud risk management activities  Within CMS, the Center for Program Integrity (CPI) serves as the dedicated entity for fraud, waste, and abuse issues in Medicare and Medicaid, which is consistent with the Fraud Risk Framework  CPI was established in 2010, in response to a November 2009 Executive Order on reducing improper payments and eliminating waste in federal programs  This formalized role, according to CMS officials, elevated the status of program-integrity efforts, which previously were carried out by other parts of CMS  As an executive-level Center—on the same level with five other executive-level Centers at CMS, such as the Center for Medicare and the Center for Medicaid and CHIP Services—CPI has a direct reporting line to executive-level management at CMS  The Fraud Risk Framework identifies a direct reporting line to senior-level managers within the agency as a leading practice  According to CMS officials, this elevated organizational status offers CPI heightened visibility across CMS, attention by CMS executive leadership, and involvement in executive- level conversations  Additionally, in 2014, CMS established a Program Integrity Board that has brought together senior officials across CMS Centers on a monthly basis to coordinate on fraud and program-integrity vulnerabilities  According to CPI officials, the board is one of the mechanisms through which CPI engages other executive-level offices at CMS  CPI chairs the meetings and typically develops meeting agendas to solicit information from and disseminate information to other CMS units or stakeholders  Further, the board may establish small working groups, known as integrated project teams, to address specific vulnerabilities  For example, according to CMS officials, in 2016 the board established a Marketplace integrated project team to resolve potential fraud eligibility and enrollment issues in the federally facilitated marketplace using the Fraud Risk Framework  CPI has further demonstrated commitment to addressing fraud, waste, and abuse through several organizational changes with the goal of improving coordination and communication of program-integrity activities across Medicare and Medicaid  Most recently, in 2014, CPI reorganized its structure to align functional areas across Medicare and Medicaid, where possible  Previously, separate units within CPI administered their own program-integrity activities for Medicare and Medicaid programs  For example, CPI established a Provider Enrollment and Oversight Group, responsible for provider screening and enrollment functions in both Medicare and Medicaid  According to CMS officials, if CPI employees identify an issue in provider enrollment in Medicare, the same CPI employees also consider how this issue applies to Medicaid  According to CMS officials, the reorganization has helped CPI to look at vulnerabilities in a crosscutting way and to facilitate communication across programs  Similarly, since 2016, CPI began shifting contracting functions from separate Medicare and Medicaid regional contractors that identify and investigate cases of potential fraud and conduct audits to five regional UPICs responsible for a range of program-integrity and fraud-specific activities in both Medicare FFS and Medicaid  According to CMS, the purpose of the UPICs is to coordinate provider investigations across Medicare and Medicaid, improve collaboration with states by providing a mutually beneficial service, and increase contractor accountability through coordinated oversight  CMS officials told us that UPIC integration is a cornerstone of CMS’s contract management strategy and would help to ensure communication and coordination across Medicare and Medicaid program-integrity efforts  CMS plans to award all the UPIC contracts by the end of 2017, ultimately phasing out the ZPICs and Medicaid Integrity Contractors  The commit component of the Fraud Risk Framework also includes creating an organizational culture to combat fraud at all levels of the agency  Consistent with the Fraud Risk Framework, CMS has promoted an antifraud culture by demonstrating a senior-level commitment to combating fraud through public statements, increased resource levels, and internal and external coordination  In addition to HHS and CMS strategic documents discussed earlier, CMS and CPI leaders have testified publicly about CMS’s commitment to preventing fraud and protecting taxpayers and beneficiaries  For example, CPI’s former Director testified in May 2016 before the House Committee on Energy and Commerce’s Subcommittee on Oversight and Investigations that “CMS is deeply committed to our efforts to prevent waste, fraud and abuse in Medicare and Medicaid programs, protecting both taxpayers and the beneficiaries that we serve ” More recently, CMS’s new Administrator testified in her February 2017 confirmation hearing regarding her intent to prioritize efforts around preventing fraud and abuse  CPI’s budget and resources have increased over time to support its ongoing program-integrity mission  According to CMS, program-integrity obligations for Medicare and Medicaid increased from about $1 02 billion in fiscal year 2010 to $1 45 billion in fiscal year 2016  According to CMS officials, the Health Care Fraud and Abuse Control (HCFAC) account, one of the primary sources of CPI funding, has never received a funding reduction  Additionally, in 2015, CPI received additional funding based on a discretionary cap adjustment to HCFAC  Similarly, CPI staff resources have increased over time  According to CMS, CPI’s full-time equivalent positions increased from 177 in 2011 to 419 in 2017  Consistent with leading practices in the Fraud Risk Framework to involve all levels of the agency in setting an antifraud tone, CPI has also worked collaboratively with other CMS Centers  In addition to engaging executive-level officials of other CMS Centers through the Program Integrity Board, CPI has worked collaboratively with other Centers within CMS to incorporate antifraud features into new program design or policy development and established regular communication at the staff level  For example: Center for Medicare and Medicaid Innovation (CMMI)  When developing the Medicare Diabetes Prevention Program, CMMI officials told us they worked with CPI’s Provider Enrollment and Oversight Group and Governance Management Group to develop risk-based screening procedures for entities that would enroll in Medicare to provide diabetes-prevention services, among other activities  The program was expanded nationally in 2016, and CMS determined that an entity may enroll in Medicare as a program supplier if it satisfies enrollment requirements, including that the supplier must pass existing high categorical risk-level screening requirements  Center for Medicaid and CHIP Services (CMCS)  CMCS officials told us they worked closely with CPI to issue Medicaid guidance and best practices to states on home and community-based services that incorporate program-integrity provisions  A senior CMCS official told us that, to address fraud, CMS has requested that states include provider information on claims to determine whether providers are meeting eligibility criteria  Center for Medicare (CM)  In addition to building safeguards into programs and developing policies, CM officials told us that there are several standing meetings, on monthly, biweekly, and weekly bases, between groups within CM and CPI that discuss issues related to provider enrollment, FFS operations, and contractor management  A senior CM official also told us that there are ad hoc meetings taking place between CM and CPI: “We interact multiple times daily at different levels of the organization  Working closely is just a regular part of our business ” CMS has also demonstrated its commitment to addressing fraud, waste, and abuse to its stakeholders  Representatives of CMS’s extensive stakeholder network whom we interviewed—state officials, contractors, and officials from public and private entities—generally recognized the agency’s commitment to combating fraud  In our interviews with stakeholders, officials observed CMS’s increased commitment over time to address fraud, waste, and abuse and cited examples of specific CMS actions  State officials, for example, told us that the Medicaid Integrity Institute, a training center coordinated jointly by CMS and DOJ, has been a helpful resource for states to build capacity to address fraud and program integrity  CMS contractors told us that CMS’s commitment to combating fraud is incorporated into contractual requirements, such as requiring (1) data analysis for potential fraud leads and (2) fraud- awareness training for providers  Officials from entities that are members of the HFPP, specifically, a health-insurance plan and the National Health Care Anti-Fraud Association, added that CMS’s effort to establish the HFPP and its ongoing collaboration and information sharing reflect CMS’s commitment to combat fraud in Medicare and Medicaid  The Fraud Risk Framework identifies training as one way of demonstrating an agency’s commitment to combating fraud  Training and education intended to increase fraud awareness among stakeholders, managers, and employees, serves as a preventive measure to help create a culture of integrity and compliance within the agency  The Fraud Risk Framework discusses requiring all employees to attend training upon hiring and on an ongoing basis thereafter  To increase awareness of fraud risks in Medicare and Medicaid, CMS offers and requires training for stakeholder groups such as providers, beneficiaries, and health-insurance plans  Specifically, through its National Training Program and Medicare Learning Network, CMS makes available training materials on combating Medicare and Medicaid fraud, waste, and abuse  These materials help to identify and report fraud, waste, and abuse in CMS programs and are geared toward providers, beneficiaries, as well as trainers and other stakeholders  Separately, CMS requires health-insurance plans working with CMS to provide annual fraud, waste, and abuse training to their employees  However, CMS does not offer or require similar fraud-awareness training for the majority of its workforce  For a relatively small portion of its overall workforce—specifically, contracting officer representatives who are responsible for certain aspects of the acquisition function—CMS requires completion of fraud and abuse prevention training every 2 years  According to CMS, 638 of its contracting officer representatives (or about 10 percent of its overall workforce) completed such training in 2016 and 2017  Although CMS offers fraud-awareness training to others, the agency does not require fraud-awareness training for new hires or on a regular basis for all employees because the agency has focused on providing process-based internal controls training for its employees  While fraud-awareness training for contracting officer representatives is an important step in helping to promote fraud risk management, fraud- awareness training specific to CMS programs would be beneficial for all employees  Such training would not only be consistent with what CMS offers to or requires of its stakeholders and some of its employees, but would also help to keep the agency’s entire workforce continuously aware of fraud risks and examples of known fraud schemes, such as those identified in successful OIG investigations  Such training would also keep employees informed as they administer CMS programs or develop agency policies and procedures  Considering the vulnerability of Medicare and Medicaid programs to fraud, waste, and abuse, without regular required training CMS cannot be assured that its workforce of over 6,000 employees is continuously aware of risks facing its programs  Although CMS has shown commitment to combating fraud, at times CPI’s efforts to combat fraud compete with other mission priorities, such as (1) ensuring beneficiary access to health-care services and (2) limiting provider burden  CPI leadership has been aware of this inherent challenge  For example, at a congressional hearing in May 2016, CPI’s Director stated that “our efforts strike an important balance: protecting beneficiary access to necessary health care services and reducing the administrative burden on legitimate providers and suppliers, while ensuring that taxpayer dollars are not lost to fraud, waste, and abuse ” Beneficiary access to care  In accordance with its mission statement, providing and improving beneficiaries’ access to health care is a CMS priority  CMS’s commitment to providing access to high-quality care and coverage is reflected in the agency’s mission statement and is one of its four strategic goals  As a result, before taking administrative actions against a Medicare Part A provider, such as a hospice, or providers in rural areas, CMS officials told us that they first look at whether there is a sufficient number of providers in an area by running a provider search by provider county and adjacent counties and considering how heavily populated an area is with Medicare beneficiaries  According to these officials, rather than taking an administrative action against a provider that would limit beneficiaries’ access to services, the agency may enter into a corrective action plan with the provider  CMS officials told us that revoking a provider’s enrollment in Medicare, an option available to CMS in cases of provider noncompliance or misconduct, is rare  Administrative burden on providers  According to CMS documents and officials, concern over placing undue burden on providers—the majority of whom are presumed to be honest—provides a counterforce to implementing program-integrity control activities  CMS’s web page entitled Reducing Provider Burden states: “CMS is committed to reducing improper payments but must be mindful of provider burden because medical review is a resource-intensive process for both the healthcare provider and the Medicare review contractor ” Two CMS contractors told us that they scaled back or did not pursue audits of providers’ documentation because of provider burden or sensitivity considerations  One contractor removed providers from audit samples after some providers opposed having to supply multiple medical records  CPI officials told us that they want to reduce provider burden in a logical manner  For example, according to CMS officials, in the Medicare FFS Recovery Audit Program, CMS established limits on Additional Documentation Requests, which are requests for medical documentation supporting a claim being reviewed  CMS requires such documentation adjustments so that they align with a providers’ claim denial rates  Providers with low denial rates will have lower documentation requirements, while providers with high denial rates will have higher documentation requirements, thus adjusting provider burden based on demonstrated compliance  The assess component of the Fraud Risk Framework calls for federal managers to plan regular fraud risk assessments and to assess risks to determine a fraud risk profile  Identifying fraud risks is one of the steps included in the Fraud Risk Framework for assessing risks to determine a fraud risk profile  CMS has taken steps to identify some fraud risks through several control activities that target areas the agency has designated as higher risk within Medicare and Medicaid, including specific provider types, such as home health agencies, and specific geographic locations  As discussed earlier, CMS officials told us that CPI initially focused on developing control activities for Medicare FFS and considers these activities to be the most mature of all CPI efforts to address fraud risks  CMS has identified fraud risks in the following selected examples, which are not an exhaustive list of its control activities  Data analytics to assist investigations in Medicare FFS  In 2011, CMS implemented FPS, a data-analytic system that screens all Medicare FFS claims to identify health-care providers with suspect billing patterns for further investigation  Medicare FFS contractors—ZPICs and UPICs— have used FPS to identify and prioritize leads for investigations of potential fraud by high-risk Medicare FFS providers  Contractors told us that FPS allows them to quickly identify and triage leads  CMS’s guidance requires contractors to prioritize investigations with the greatest program impact or urgency and identifies required criteria for prioritizing investigations, such as patient abuse or harm, multistate fraud, and high dollar amount of potential overpayments  One contractor we interviewed developed a risk-prioritization model that incorporated CMS’s required criteria, such as patient harm, as well as additional criteria, such as provider spikes in billing, into a tool that automatically creates a provider risk score to help the contractor focus and prioritize investigative resources  Prior authorization for Medicare FFS services or supplies  CMS published a final rule in December 2015 that identifies a master list of durable medical equipment, prosthetics, orthotics, and supplies for which CMS can require prior authorization before suppliers submit a Medicare FFS claim  In this rule, CMS identified 135 items that are frequently subject to unnecessary utilization and stated that the agency expects the final rule to result in savings in the form of reduced unnecessary utilization, fraud, waste, and abuse  Under this program, prior authorization is a condition of payment for claims  CMS can choose which items on the master list to subject to prior authorization  For example, in March 2017, it began requiring prior authorization for selected power wheelchairs in four states and expanded the prior authorization program for these items to all states in July 2017  CMS also began to test the use of prior authorization on a voluntary basis through a series of fixed-length demonstrations for items and services that have been associated with high levels of improper payments, including high incidences of fraud in some cases, and unnecessary utilization in certain geographic areas  For example, CMS began implementing a voluntary prior authorization demonstration in September 2012 for other power mobility devices, such as power scooters, in seven states where historically there has been extensive evidence of fraud and improper payments  CMS expanded the demonstration to an additional 12 states in October 2014, for a total of 19 states  According to the initial Federal Register notice, CMS planned to use the demonstration to develop improved methods for investigation and prosecution of fraud to protect federal funds from fraudulent actions and the resulting improper payments  Under the demonstration, providers and suppliers are encouraged—but not required—to submit a request for prior authorization for certain items before they provide the item to the beneficiary and submit a claim for payment  Revised provider screening and enrollment processes for Medicare FFS and Medicaid FFS  In response to PPACA, in 2011 CMS implemented a revised screening process for providers and suppliers who enroll in Medicare and Medicaid based on identified provider risk categories  CMS placed all Medicare provider and supplier types into one of three risk categories—limited, moderate, or high—based on its assessment of the potential risk of fraud, waste, and abuse each provider and supplier type poses  For example, CMS designated prospective (newly enrolling) home health agencies and prospective suppliers of durable medical equipment, prosthetics, orthotics, and supplies in the high-risk category  According to the final rule and our interviews with CMS officials, CMS developed these risk-based categories based on its review and synthesis of various information sources about the fraud risks posed by each provider and supplier type, including (1) the agency’s experience with claims data used to identify potentially fraudulent billing practices, (2) expertise of contractors responsible for investigating and identifying Medicare fraud, and (3) GAO and OIG reports  CMS designated specific screening activities for each risk category, with increased requirements for moderate- and high-risk provider and supplier types  For example, moderate- and high-risk providers and suppliers must receive preenrollment site visits, and high-risk providers and suppliers also are subject to fingerprint-based criminal-background checks  As part of the revised screening process, beginning in September 2011, CMS also undertook its first program-wide effort to rescreen, or revalidate, the enrollment records of about 1 5 million existing Medicare FFS providers and suppliers, to determine whether they remain eligible to bill Medicare  Temporary provider enrollment moratoriums for certain providers and geographic areas for Medicare FFS and Medicaid FFS  CMS identified certain provider types and geographic areas as high risk for fraud and used its authority under PPACA to implement temporary moratoriums to suspend enrollment of such Medicare and Medicaid providers in those areas  For example, in July 2016, CMS extended temporary moratoriums statewide on the enrollment of new Medicare Part B nonemergency ambulance suppliers and Medicare home health agencies statewide in six states, as applicable  The statewide moratoriums also apply to Medicaid  According to the Federal Register notice, CMS imposed the temporary moratoriums based on qualitative and quantitative factors suggesting a high risk of fraud, waste, or abuse, such as law-enforcement expertise with emerging fraud trends and investigations  CMS’s data analysis also confirmed the agency’s determination of a high risk of fraud, waste, and abuse for these provider and supplier types within certain geographic areas, according to the notice  Medicaid state program integrity reviews and desk reviews  CMS tailored state Medicaid program-integrity reviews to areas it identified as high risk for improper payments, such as personal care services, which may also be at high risk for fraud  In March 2017, we reported that, from fiscal years 2014 through 2016, CMS conducted focused reviews of state program-integrity efforts in 31 states, reviewing 10 or 11 states annually  For each state, CMS tailored its focused reviews to the state’s managed care plans and relevant other high-risk areas, including provider enrollment and screening, nonemergency medical transportation, and personal care services  CMS and state officials we spoke with as part of that work told us that the tailored oversight had been beneficial and helped identify areas for improvement  CMS has also initiated desk reviews of state program-integrity efforts  According to CMS, these desk reviews allow the agency to provide states with customized program- integrity oversight  Vulnerability tracking system for Medicare  CPI recently initiated an effort to centralize and formalize a vulnerability tracking process for Medicare, which could support identification of specific fraud risks, both in Medicare and possibly Medicaid  As described by CPI officials, the process aims to collect information on fraud-related vulnerabilities from CMS employees, contractors, and other sources, such as GAO and HHS OIG reports  The assess component of the Fraud Risk Framework calls for federal managers to plan regular fraud risk assessments and assess risks to determine a fraud risk profile  Furthermore, federal internal control standards call for agency management to assess the internal and external risks their entities face as they seek to achieve their objectives  The standards state that, as part of this overall assessment, management should consider the potential for fraud when identifying, analyzing, and responding to risks  The Fraud Risk Framework states that, in planning the fraud risk assessment, effective managers tailor the fraud risk assessment to the program by, among other things, identifying appropriate tools, methods, and sources for gathering information about fraud risks and involving relevant stakeholders in the assessment process  Fraud risk assessments that align with the Fraud Risk Framework involve (1) identifying inherent fraud risks affecting the program, (2) assessing the likelihood and impact of those fraud risks, (3) determining fraud risk tolerance, (4) examining the suitability of existing fraud controls and prioritizing residual fraud risks, and (5) documenting the results  (See fig  6 ) Although, as discussed earlier, CMS has identified some fraud risks posed by providers in Medicare FFS and, to a lesser degree, Medicaid FFS, the agency has not conducted a fraud risk assessment for either the Medicare or Medicaid program  Such a risk assessment would provide the detailed information and insights needed to create a fraud risk profile, which, in turn, is the basis for creating an antifraud strategy  According to CMS officials, CMS has not conducted a fraud risk assessment for Medicare or Medicaid because, within CPI’s broader approach of preventing and eliminating improper payments, its focus has been on addressing specific vulnerabilities among provider groups that have shown themselves particularly prone to fraud, waste, and abuse  With this approach, however, it is unlikely that CMS will be able to design and implement the most-appropriate control activities to respond to the full portfolio of fraud risks  A fraud risk assessment consists of discrete activities that build upon each other  Specifically: Identifying inherent fraud risks affecting the program  As discussed earlier, CMS has taken steps to identify fraud risks  However, CMS has not used a process to identify inherent fraud risks from the universe of potential vulnerabilities facing Medicare and Medicaid programs, including threats from various sources  According to CPI officials, most of the agency’s fraud control activities are focused on fraud risks posed by providers  The Fraud Risk Framework discusses fully considering inherent fraud risks from internal and external sources in light of fraud risk factors such as incentives, opportunities, and rationalization to commit fraud  For example, according to CMS officials, the inherent design of the Medicare Part C program may pose fraud risks that are challenging to detect  A fraud risk assessment would help CMS identify all sources of fraudulent behaviors, beyond threats posed by providers, such as those posed by health-insurance plans, contractors, or employees  Assessing the likelihood and impact of fraud risks and determining fraud risk tolerance  CMS has taken steps to prioritize fraud risks in some areas, but it has not assessed the likelihood or impact of fraud risks or determined fraud risk tolerance across all parts of Medicare and Medicaid  Assessing the likelihood and impact of inherent fraud risks would involve consideration of the impact of fraud risks on program finances, reputation, and compliance  Without assessing the likelihood and impact of risks in Medicare or Medicaid or internally determining which fraud risks may fall under the tolerance threshold, CMS cannot be certain that it is aware of the most-significant fraud risks facing these programs and what risks it is willing to tolerate based on the programs’ size and complexity  Examining the suitability of existing fraud controls and prioritizing residual fraud risks  CMS has not assessed existing control activities or prioritized residual fraud risks  According to the Fraud Risk Framework, managers may consider the extent to which existing control activities—whether focused on prevention, detection, or response—mitigate the likelihood and impact of inherent risks and whether the remaining risks exceed managers’ tolerance  This analysis would help CMS to prioritize residual risks and to determine mitigation approaches  For example, CMS has not established preventive fraud control activities in Medicare Part C  Using a fraud risk assessment for Medicare Part C and closely examining existing fraud control activities and residual risks, CMS could be better positioned to address fraud risks facing this growing program and develop preventive control activities  Further, without assessing existing fraud control activities and prioritizing residual fraud risks, CMS cannot be assured that its current control activities are addressing the most-significant risks  Such analysis would also help CMS determine whether additional, preferably preventive, fraud controls are needed to mitigate residual risks, make adjustments to existing control activities, and potentially scale back or remove control activities that are addressing tolerable fraud risks  Documenting the risk-assessment results in a fraud risk profile  CMS has not developed a fraud risk profile that documents key findings and conclusions of the fraud risk assessment  According to the Fraud Risk Framework, the risk profile can also help agencies decide how to allocate resources to respond to residual fraud risks  Given the large size and complexity of Medicare and Medicaid, a documented fraud risk profile could support CMS’s resource-allocation decisions as well as facilitate the transfer of knowledge and continuity across CMS staff and changing administrations  Senior CPI officials told us that the agency plans to start a fraud risk assessment for Medicare and Medicaid after it completes a separate fraud risk assessment of the federally facilitated marketplace  This fraud risk assessment for the federally facilitated marketplace eligibility and enrollment process is being conducted in response to a recommendation we made in February 2016  In April 2017, CPI officials told us that this fraud risk assessment was largely completed, although in September 2017 CPI officials told us that the assessment was undergoing agency review  CPI officials told us that they have informed CM and CMCS officials that there will be future fraud risk assessments for Medicare and Medicaid; however, they could not provide estimated timelines or plans for conducting such assessments, such as the order or programmatic scope of the assessments  Once completed, CMS could use the federally facilitated marketplace fraud risk assessment and apply any lessons learned when planning for and designing fraud risk assessments for Medicare and Medicaid  According to the Fraud Risk Framework, factors such as size, resources, maturity of the agency or program, and experience in managing risks can influence how the entity plans the fraud risk assessment  Additionally, effective managers tailor the fraud risk assessment to the program when planning for it  The large scale and complexity of Medicare and Medicaid as well as time and resources involved in conducting a fraud risk assessment underscore the importance of a well-planned and tailored approach to identifying the assessment’s programmatic scope  Planning and tailoring may involve decisions to conduct a fraud risk assessment for Medicare and Medicaid programs as a whole or divided into several subassessments to reflect their various component parts (e g , Medicare FFS, Medicaid managed care) as well as determining the timing and order of assessments (e g , concurrently or consecutively for Medicare and Medicaid)  CMS’s existing fraud risk identification efforts as well as communication channels with stakeholders could serve as a foundation for developing a fraud risk assessment for Medicare and Medicaid  The leading practices identified in the Fraud Risk Framework discuss the importance of identifying appropriate tools, methods, and sources for gathering information about fraud risks and involving relevant stakeholders in the assessment process  CMS’s fraud risk identification efforts discussed earlier could provide key information about fraud risks and their likelihood and impact  Further, existing relationships and communication channels across CMS and its extensive network of stakeholders could support building a comprehensive understanding of known and potential fraud risks for the purposes of a fraud risk assessment  For example, the fraud vulnerabilities identified through data analysis and information sharing with states, health-insurance plans, law-enforcement organizations, and contractors through the HFPP could inform a fraud risk assessment  CPI’s Command Center missions—facilitated collaboration sessions that bring together experts from various disciplines to improve the processes for fraud prevention in Medicare and Medicaid—could bring together experts to identify potential or emerging fraud vulnerabilities or to brainstorm approaches to mitigate residual fraud risks  As CMS makes plans to move forward with a fraud risk assessment for Medicare and Medicaid, it will be important to consider the frequency with which the fraud risk assessment would need to be updated  While, according to the Fraud Risk Framework, the time intervals between updates can vary based on the programmatic and operating environment, assessing fraud risks on an ongoing basis is important to ensure that control activities are continuously addressing fraud risks  The constantly evolving fraud schemes, the size of the programs in terms of beneficiaries and expenditures, as well as continual changes in Medicare and Medicaid programs—such as development of innovative payment models and increasing managed-care enrollment—call for constant vigilance and regular updates to the fraud risk assessment  The design and implement component of the Fraud Risk Framework calls for federal managers to design and implement a strategy with specific control activities to mitigate assessed fraud risks and collaborate to help ensure effective implementation  According to the Fraud Risk Framework, effective managers develop and document an antifraud strategy that describes the program’s approach for addressing the prioritized fraud risks identified during the fraud risk assessment, also referred to as a risk-based antifraud strategy  A risk- based antifraud strategy describes existing fraud control activities as well as any new fraud control activities a program may adopt to address residual fraud risks  In developing a strategy and antifraud control activities, effective managers focus on fraud prevention over detection, develop a plan for responding to identified instances of fraud, establish collaborative relationships with stakeholders, and create incentives to help effectively implement the strategy  Additionally, as part of a documented strategy, management identifies roles and responsibilities of those involved in fraud risk management activities; describes control activities as well as plans for monitoring and evaluation, creates timelines, and communicates the antifraud strategy to employees and stakeholders, among other things  As discussed earlier, CMS has some control activities in place to identify fraud risk in Medicare and Medicaid, particularly in the FFS program  However, CMS has not developed and documented a risk-based antifraud strategy to guide its design and implementation of new antifraud activities and to better align and coordinate its existing activities to ensure it is targeting and mitigating the most-significant fraud risks  Antifraud strategy  CMS officials told us that CPI does not have a documented risk-based antifraud strategy  Although CMS has developed several documents that describe efforts to address fraud, the agency has not developed a risk-based antifraud strategy for Medicare and Medicaid because, as discussed earlier, it has not conducted a fraud risk assessment that would serve as a foundation for such strategy  In 2016, CPI identified five strategic objectives for program integrity, which include antifraud elements and an emphasis on prevention  However, according to CMS officials, these objectives were identified from discussions with CMS leadership and various stakeholders and not through a fraud risk assessment process to identify inherent fraud risks from the universe of potential vulnerabilities, as described earlier and called for in the leading practices  These strategic objectives were presented at an antifraud conference in 2016, but were not announced publicly until the release of the Annual Report to Congress on the Medicare and Medicaid Integrity Programs for Fiscal Year 2015 in June 2017  Stakeholder relationships and communication  CMS has established relationships and communicated with stakeholders, but, without an antifraud strategy, stakeholders we spoke with lacked a common understanding of CMS’s strategic approach  Prior work on practices that can help federal agencies collaborate effectively calls for a strategy that is shared with stakeholders to promote trust and understanding  Once an antifraud strategy is developed, the Fraud Risk Framework calls for managers to collaborate to ensure effective implementation  Although some CMS stakeholders were able to describe various CMS program- integrity priorities and activities, such as home health being a fraud risk priority, the stakeholders could not communicate, articulate, or cite a common CMS strategic approach to address fraud risks in its programs  Incentives  The Fraud Risk Framework discusses creating incentives to help ensure effective implementation of the antifraud strategy once it is developed  Currently, some incentives within stakeholder relationships may complicate CMS’s antifraud efforts  As discussed earlier, CMS is a partner and provides oversight to states’ program-integrity functions  Officials from one state told us that they were reluctant to share their program vulnerabilities because CMS would use this information to later audit the state  Among contractors, CMS encourages information sharing through conferences and workshops; however, competition for CMS business among contractors can be a disincentive to information sharing  CMS officials acknowledged this concern and said that they expect contractors to share information related to fraud schemes, outcomes of investigations, and tips for addressing fraud, but not proprietary information such as algorithms to risk-score providers  Without developing and documenting an antifraud strategy based on a fraud risk assessment, as called for in the design and implement component of the Fraud Risk Framework, CMS cannot ensure that it has a coordinated approach to address the range of fraud risks and to appropriately target and allocate resources for the most-significant risks  Considering fraud risks to which the Medicare and Medicaid programs are most vulnerable, in light of the malicious intent of those who aim to exploit the programs, would help CMS to examine its current control activities and potentially design new ones with recognition of fraudulent behavior it aims to prevent  This focus on fraud is distinct from a broader view of program integrity and improper payments by considering the intentions and incentives of those who aim to deceive rather than well-intentioned providers who make mistakes  Also, continued growth of the programs, such as growth of Medicare Part C and Medicaid managed care, call for consideration of preventive fraud control activities across the entire network of entities involved  Further, considering the large size and complexity of Medicare and Medicaid and the extensive stakeholder network involved in managing fraud in the programs, a strategic approach to managing fraud risks within the programs is essential to ensure that a number of existing control activities and numerous stakeholder relationships and incentives are being aligned to produce desired results  Once developed, an antifraud strategy that is clearly articulated to various CMS stakeholders would help CMS to address fraud risks in a more coordinated and deliberate fashion  Thinking strategically about existing control activities, resources, tools, and information systems could help CMS to leverage resources while continuing to integrate Medicare and Medicaid program-integrity efforts along functional lines  A strategic approach grounded in a comprehensive assessment of fraud risks could also help CMS to identify future enhancements for existing control activities, such as new preventive capabilities for FPS or additional fraud factors in provider enrollment and revalidation, such as provider risk scoring, to stay in step with evolving fraud risks  The evaluate and adapt component of the Fraud Risk Framework calls for federal managers to evaluate outcomes using a risk-based approach and adapt activities to improve fraud risk management  Furthermore, according to federal internal control standards, managers should establish and operate monitoring activities to monitor the internal control system and evaluate the results, which may be compared against an established baseline  Ongoing monitoring and periodic evaluations provide assurances to managers that they are effectively preventing, detecting, and responding to potential fraud  CMS has established monitoring and evaluation mechanisms for its program-integrity activities that it could incorporate into an antifraud strategy  In Medicare, CMS has taken steps to measure the rate of fraud in a particular service area  We have previously reported that agencies may face challenges measuring outcomes of fraud risk management activities in a reliable way  These challenges include the difficulty of measuring the extent of deterred fraud, isolating potential fraud from legitimate activity or other forms of improper payments, and determining the amount of undetected fraud  Despite these challenges, CMS has taken steps to estimate a fraud baseline—meaning the rate of probable fraud—in the home health benefit  In fiscal year 2016, CMS conducted a pretest in the Miami-Dade area of Florida to evaluate its potential measurement approach that could later be used in a nationwide study of probable fraud among home health agencies  The pretest was not a random sample and was not intended to produce a rate of fraud, but instead was intended to test the interview instruments and data-collection methodology CMS might use in a study nationwide  CMS and its contractor collected information from home health agencies, the attending providers, and Medicare beneficiaries in the Miami-Dade area in order to test these interview instruments  CMS completed this pretest, but, according to CMS officials, the agency does not yet have plans to roll out a nationwide study that would estimate a probable fraud rate for the Medicare FFS home health benefit  In its 2015 annual report to Congress, CMS stated that “documenting the baseline amount of fraud in Medicare is of critical importance, as it allows officials to evaluate the success of ongoing fraud prevention activities ” CMS officials working on the pilot told us that having an estimate of the rate of fraud in home health benefits would allow CMS to reliably assess its efforts at eliminating or reducing fraud  Without a baseline, officials said, the agency cannot know whether its antifraud efforts are as effective as they could be  We previously reported that the lack of a baseline for the amount of health-care fraud that exists limits CMS’s ability to determine whether its activities are effectively reducing health care fraud and abuse  A baseline estimate could provide an understanding of the extent of fraud and, with additional information on program activities, could help to inform decision making related to allocation of resources to combat health-care fraud  As described in the Fraud Risk Framework, in the absence of a fraud baseline, agencies can gather additional information on the short-term or intermediate outcomes of some antifraud initiatives, which may be more readily measured  For example, CMS has developed some performance measures to provide a basis for monitoring its progress towards meeting the program-integrity goals set in the HHS Strategic Plan and Annual Performance Plan  Specifically, CMS measures whether it is meeting its goal of “increasing the percentage of Medicare FFS providers and suppliers identified as high risk that receive an administrative action ” CMS does not set specific antifraud goals for other parts of Medicare or Medicaid; other CMS performance measures relate to measuring or reducing improper payments in CHIP, Medicaid, and the various parts of Medicare  CMS uses return-on-investment and savings estimates to measure the effectiveness of its Medicare program-integrity activities and FPS  For example, CMS uses return-on-investment to measure the effectiveness of FPS and, in response to a recommendation we made in 2012, CMS developed outcome-based performance targets and milestones for FPS  CMS has also conducted individual evaluations of its program-integrity activities, such as an interim evaluation of the prior-authorization demonstration for power mobility devices that began in 2012 and is currently implemented in 19 states  Commensurate with greater maturity of control activities in Medicare FFS compared to other parts of Medicare and Medicaid, monitoring and evaluation activities for Medicare Parts C and D and Medicaid are more limited  For example, CMS calculates savings for its program-integrity activities in Medicare Parts C and D, but not a full return-on-investment  CMS officials told us that calculating costs for specific activities is challenging because of overlapping activities among contractors  CMS officials said they continue to refine methods and develop new savings estimates for additional program-integrity activities  According to the Fraud Risk Framework, effective managers develop a strategy and evaluate outcomes using a risk-based approach  In developing an effective strategy and antifraud activities, managers consider the benefits and costs of control activities  Ongoing monitoring and periodic evaluations provide reasonable assurance to managers that they are effectively preventing, detecting, and responding to potential fraud  Monitoring and evaluation activities can also support managers’ decisions about allocating resources, and help them to demonstrate their continued commitment to effectively managing fraud risks  As CMS takes steps to develop an antifraud strategy, it could include plans for refining and building on existing methods such as return-on- investment or savings measures, and setting appropriate targets to evaluate the effectiveness of all of CMS’s antifraud efforts  Such a strategy would help CMS to efficiently allocate program-integrity resources and to ensure that the agency is effectively preventing, detecting, and responding to potential fraud  For example, while doing so would involve challenges, CMS’s strategy could detail plans to advance efforts to measure a potential fraud rate through baseline and periodic measures  Fraud rate measurement efforts could also inform risk assessment activities, identify currently unknown fraud risks, align resources to priority risks, and develop effective outcome metrics for antifraud controls  Such a strategy would also help CMS ensure that it has effective performance measures in place to assess its antifraud efforts beyond those related to providers in Medicare FFS, and establish appropriate targets to measure the agency’s progress in addressing fraud risks  As CMS makes plans to move forward with a strategy and to further develop evaluation and monitoring mechanisms, it will be important to share its efforts with stakeholders  The Fraud Risk Framework states that effective managers communicate lessons learned from fraud risk management activities to stakeholders  For example, CMS could be a leader to states in measuring the effectiveness of program-integrity efforts  Officials in three of the four states we spoke with expressed interest in receiving CMS guidance on how to measure the effectiveness of their Medicaid program-integrity efforts, such as by providing models for how to calculate return-on-investment  Medicare and Medicaid provide health insurance to over 129 million Americans, but the size—in terms of number of beneficiaries and amount of expenditures—as well as complexity of these programs make them inherently susceptible to fraud and improper payments  CMS currently manages these risks across its programs as part of a broader approach to identifying and controlling for multiple sources of improper payments and by developing relationships with an extensive network of stakeholders  In Medicare and Medicaid specifically, we note that CMS has taken many important steps toward implementing a strategic approach for managing fraud  However, the agency could benefit by more fully aligning its efforts with the four components of the Fraud Risk Framework  CMS is well positioned to leverage its fraud risk management efforts— such as demonstrated leadership for combating fraud, existing control activities, and stakeholder relationships—to provide additional antifraud training, as well as to develop an antifraud strategy based on fraud risk assessments for Medicare and Medicaid  We recognize that the effort may be challenging, given the size and complexity of Medicare and Medicaid, and the need to balance antifraud activities with CMS’s other mission priorities  However, by not employing the actions identified in the Fraud Risk Framework and incorporating them in its approach to managing fraud risks, CMS is missing a significant opportunity to better ensure employee vigilance against fraud, and to organize and focus its many antifraud and program-integrity activities and related resources into a comprehensive strategy  Such a strategy would (1) provide reasonable assurance that CMS is targeting the most-significant fraud risks in its programs and (2) help protect the government’s substantial and growing investments in these programs  We are making the following three recommendations to CMS: The Administrator of CMS should provide fraud-awareness training relevant to risks facing CMS programs and require new hires to undergo such training and all employees to undergo training on a recurring basis  (Recommendation 1) The Administrator of CMS should conduct fraud risk assessments for Medicare and Medicaid to include respective fraud risk profiles and plans for regularly updating the assessments and profiles  (Recommendation 2) The Administrator of CMS should, using the results of the fraud risk assessments for Medicare and Medicaid, create, document, implement, and communicate an antifraud strategy that is aligned with and responsive to regularly assessed fraud risks  This strategy should include an approach for monitoring and evaluation  (Recommendation 3) We provided a draft of this report to HHS and DOJ for comment  HHS provided written comments, which are reprinted in appendix I  DOJ did not have comments  HHS and DOJ also provided technical comments, which we incorporated as appropriate  In commenting on this report, HHS agreed with our three recommendations  Specifically, in response to our first recommendation to provide required fraud-awareness training to all employees, HHS stated that it will develop and implement a fraud-awareness training plan to ensure all CMS employees receive training  Regarding our second recommendation to conduct fraud risk assessments for Medicare and Medicaid, HHS stated that it is currently conducting a fraud risk assessment on the federally facilitated marketplace and, when this assessment is complete, will apply the lessons learned in assessing this program to fraud risk assessments of Medicare and Medicaid  In response to our third recommendation to create, document, implement, and communicate an antifraud strategy that is aligned with and responsive to regularly assessed fraud risks, HHS stated that it will develop respective risk-based antifraud strategies after completing fraud risk assessments for Medicare and Medicaid  We are sending copies of this report to the Acting Secretary of Health and Human Services, the Administrator of CMS, the Assistant Attorney General for Administration at DOJ, as well as appropriate congressional committees and other interested parties  In addition, this report is available at no charge on the GAO website at http://www gao gov  If you or your staff members have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made contributions to this report are listed in appendix II  In addition to the contact named above, Tonita Gillich (Assistant Director), Irina Carnevale (Analyst-in-Charge), Michael Duane, Laura Sutton Elsberg, and Catrin Jones made key contributions to this report  Also contributing to the report were Lori Achman, James Ashley, Colin Fallon, Leslie V  Gordon, Maria McMullen, Sabrina Streagle, and Shana Wallace 


Report 2: DOD has defined various types of unwanted sexual behaviors, including sexual assault, sexual harassment, and domestic violence  Sexual assault: DOD defines sexual assault as intentional sexual contact, characterized by use of force, threats, intimidation, abuse of authority, or when the victim does not or cannot consent  The term includes a broad category of sexual offenses consisting of the following specific Uniform Code of Military Justice offenses: rape, sexual assault, aggravated sexual contact, abusive sexual contact, forcible sodomy (forced oral or anal sex), or attempts to commit these acts  Sexual harassment: DOD defines sexual harassment as a form of sex discrimination that involves unwelcome sexual advances, requests for sexual favors, and other verbal or physical conduct of a sexual nature when (1) submission to such conduct is made either explicitly or implicitly a term or condition of a person’s job, pay, or career; (2) submission to or rejection of such conduct by a person is used as a basis for career or employment decisions affecting that person; or (3) such conduct has the purpose or effect of unreasonably interfering with an individual’s work performance or creates an intimidating, hostile, or offensive working environment  However, as noted earlier, a provision of the NDAA for FY 2017 changed the definition of sexual harassment for the military for purposes of investigations by commanding officers so that it is no longer defined solely as a form of sex discrimination, but is recognized as an adverse behavior on the spectrum of behavior that can contribute to an increase in the incidence of sexual assault  We discuss this changed definition of sexual harassment later in this report  Domestic violence: DOD defines domestic violence as an offense under the United States Code, the Uniform Code of Military Justice, or state law involving the use, attempted use, or threatened use of force or violence against a person, or a violation of a lawful order issued for the protection of a person who is a current or former spouse, a person with whom the abuser shares a child in common or a current or former intimate partner with whom the abuser shares or has shared a common domicile  Sexual assault of spouses and intimate partners is a subset of domestic violence  Various offices and organizations within DOD play a role in addressing unwanted sexual behaviors in the military  The Under Secretary of Defense for Personnel and Readiness is responsible for developing the overall policy and guidance for the department’s efforts to prevent and respond to instances of sexual assault, except for criminal investigative policy matters assigned to the DOD Inspector General and legal processes in the Uniform Code of Military Justice  The Under Secretary of Defense for Personnel and Readiness oversees the Sexual Assault Prevention and Response Office (SAPRO), which serves as the department’s single point of authority, accountability, and oversight for its sexual assault prevention and response program  The responsibilities of the Under Secretary of Defense for Personnel and Readiness and SAPRO with regard to sexual assault prevention and response include providing the military services with guidance and technical support and facilitating the identification and resolution of issues; developing programs, policies, and training standards for the prevention of, reporting of, and response to sexual assault; developing strategic program guidance and joint planning objectives; overseeing the department’s collection and maintenance of data on reported alleged sexual assaults involving servicemembers; establishing mechanisms to measure the effectiveness of the department’s sexual assault prevention and response program; and preparing the department’s mandated annual reports to Congress on sexual assaults involving servicemembers  The Secretaries of the military departments are responsible for establishing policies for preventing and responding to sexual assault within their respective military service, and for ensuring compliance with DOD’s policy  Further, they are responsible for establishing policies that ensure commander accountability for program implementation and execution  Each military service has established an office that is responsible for overseeing and managing the military service’s sexual assault prevention and response program  Each military service also maintains a primary policy document on its sexual assault prevention and response program  Much like DOD’s directive and instruction on sexual assault prevention and response, the military service policies outline responsibilities of relevant stakeholders, including commanders, sexual assault response coordinators, and victim advocates and training requirements for all personnel  The Under Secretary of Defense for Personnel and Readiness has responsibility for developing the overall policy for DOD’s military equal opportunity program and monitoring compliance with the department’s policy  According to the policy, all servicemembers are afforded equal opportunity in an environment free from harassment, including sexual harassment, and unlawful discrimination on the basis of race, color, national origin, religion, sex (including gender), and sexual orientation  The chain of command is used as the primary and preferred channel to (1) identify and correct unlawful discrimination practices, (2) process and resolve complaints of unlawful discrimination or harassment, to include sexual, and (3) ensure that military equal opportunity matters are taken seriously and acted on as necessary  The Office of Diversity Management and Equal Opportunity (ODMEO) oversees the department’s efforts to promote equal opportunity, diversity, and inclusion management, and to help prevent unlawful discrimination and harassment throughout DOD  The Defense Equal Opportunity Management Institute develops training and studies on equal opportunity  Behaviors under the purview of the military equal opportunity program include unlawful discrimination on the basis of color, national origin, race, religion, or sex  The Secretaries of the military departments are responsible for developing policies to prevent unlawful discrimination and harassment, (including sexual harassment), ensuring compliance with DOD’s policy, and establishing both formal and informal means of resolving complaints  The chain of command is the primary and preferred channel for identifying and correcting discriminatory practices and resolving servicemembers’ complaints of sexual harassment  The military services encourage servicemembers to resolve any complaints of sexual harassment they may have at the lowest possible level first  For servicemembers who wish to report a complaint of sexual harassment, DOD provides two complaint options—formal and informal  A formal complaint is an allegation of sexual harassment that a complainant submits in writing to the authority designated for the receipt of such complaints in military service implementing guidance  Formal complaints require specific actions to be taken, are subject to timelines, and require documentation of the actions taken, in accordance with federal law  In contrast, an informal complaint is an allegation of sexual harassment, made either orally or in writing, which is not submitted as a formal complaint  Informal complaints may be resolved directly by the complainant, such as by confronting the individual or by involving another individual or the chain of command  Servicemembers who elect to resolve their complaints informally may submit a formal complaint if they are dissatisfied with the outcome of the informal process  In 2014, DOD directed the military services to develop implementing instructions and mechanisms for reporting instances of sexual harassment anonymously  The Deputy Assistant Secretary of Defense for Military Community and Family Policy under the Under Secretary of Defense for Personnel and Readiness is responsible for the development and oversight of policy for the military departments to implement a coordinated community response approach to addressing domestic abuse  The DOD Family Advocacy Program (FAP) office provides guidance and technical assistance to the military departments and DOD components to support their efforts to address, among other things, domestic abuse  The Secretaries of the military departments are responsible for developing military service-wide policies, supplementary standards, and instructions to provide for the requirements within their respective installations FAPs  Each military service has established a FAP that is responsible for overseeing and managing, among other things, the installation-level FAPs and the military service’s domestic violence and domestic abuse prevention and response programs  When domestic abuse does occur, the military service installation FAP conducts a risk assessment and works to ensure the safety of the victims and help military families overcome the effects as well as change destructive patterns  CDC is one of the major operating components of the Department of Health and Human Services, which serves as the federal government’s principal agency for protecting the health of U S  citizens  As part of its health-related mission, CDC serves as the national focal point for developing and applying disease prevention and control, environmental health, and health promotion and education activities  CDC, among other things, conducts research to enhance prevention, develops and advocates public health policies, implements prevention strategies, promotes healthy behaviors, fosters safe and healthful environments, and provides associated training  In 1992, CDC established the National Center for Injury Prevention and Control as the lead federal organization for violence prevention  The center’s Division of Violence Prevention focuses on stopping violence, including sexual violence, before it begins and works to achieve this by conducting research on the factors that put people at risk for violence, examining the effective adoption and dissemination of prevention strategies, and evaluating the effectiveness of violence prevention programs  In 2004, CDC published a framework for effective sexual violence prevention strategies  This framework includes prevention concepts and strategies, such as identifying risk and protective factors (i e , factors that may put a person at risk for committing sexual assault or that, alternatively, may prevent harm)  CDC’s framework defines sexual violence as including non-contact unwanted sexual behaviors, sexual harassment, and physical sexual assault  DOD has acknowledged that connections exist across the continuum of unwanted sexual behaviors including sexual harassment and sexual assault and that this continuum of harm is reflected in key documents that guide prevention and response activities  For example, SAPRO has also reported that certain behavior and activities, such as hazing, can lead to sexual assault  Additionally, DOD’s Prevention Roundtable and 2014- 2016 Sexual Assault Prevention Strategy have both adopted CDC’s definition of “prevention” as it applies to sexual violence  CDC defines sexual violence to include sexual harassment and sexual assault  In 2014 and 2017, DOD contracted with RAND to conduct independent assessments of behaviors across the continuum of harm, including sexual assault and sexual harassment  In its 2014 report, RAND found that (1) 34 percent of male servicemembers who were surveyed reported that the sexual assault was part of a hazing incident, (2) servicemembers who experienced sexual harassment or gender discrimination in the past year also experienced higher rates of sexual assault, and (3) approximately one-third of servicemembers who are sexually assaulted stated the offender sexually harassed them before the assault  In its 2017 report, RAND found that (1) people are more likely to engage in problematic behaviors, such as sexual harassment, if that person perceives that peers and leaders condone those actions and (2) some organizations responsible for addressing unlawful discrimination and sexual harassment lack adequate policies, plans, information systems, and resources needed to establish a departmental approach to certain behavioral issues, inform senior leadership about these problems, and ensure that leadership’s decisions about problematic behaviors are uniformly enforced  CDC research revealed that behaviors such as bullying and homophobic teasing in early adolescence are significant predictors of sexual harassment over time  According to the CDC, these youth are at an increased potential to perpetrate sexual violence and engage in sexually harassing behavior  In response, CDC recommends that communities work to prevent all types of violence from occurring and coordinate and integrate responses to violence in a way that recognizes these connections  CDC’s research has also established that survivors of one form of violence are more likely to be victims of other forms of violence, that survivors of violence are at higher risk for behaving violently, and that people who behave violently are more likely to commit other forms of violence  Further, CDC states that violence prevention and intervention efforts that focus on only one form of violence can be broadened to address multiple, connected forms of violence to increase the public health impact  DOD’s policies on sexual harassment include some but not all of CDC’s principles and most relevant legislative elements  OSD and military service-specific sexual harassment policies generally include prevention strategies that CDC has identified in its principles for sexual violence prevention but leave out risk and protective factors, as well as risk domains  Additionally, DOD’s sexual harassment policies include most elements identified in section 579 of the NDAA for FY 2013, but do not consistently include mechanisms for anonymous reporting  ODMEO officials stated that they plan to issue a new policy that is intended to focus on sexual harassment and other forms of harassment, but it is too early to know whether that policy will include all the CDC principles or mechanisms for anonymous reporting  We also noted during our review that most existing policies have not yet been updated to reflect a provision in the fiscal year 2017 NDAA that redefined sexual harassment for certain purposes so it is no longer defined solely as a form of sex discrimination but is recognized also as an adverse behavior on the spectrum of behaviors that can contribute to an increase in the incidence of sexual assault  DOD’s sexual harassment policies include some of the principles that have been developed by CDC as part of a framework for preventing sexual violence, but other principles are not included  OSD includes sexual harassment as part of its broader military equal opportunity policy  It addresses, among other things, processes for preventing and responding to cases of discrimination, including sexual harassment; education and training in equal opportunity; and complaints processing  The military services’ policies on sexual harassment cover similar topics, such as chain of command responsibilities, complaint processing, and definitions for sexual harassment; however, they have some differences  For example, while all policies include provisions on sexual harassment prevention training, the Army’s and the Navy’s policies include specific characteristics of effective training  Both policies also specify what should be included in trainings for different levels of the chain of command  The Marine Corps and Air Force policies simply state that commanders must conduct sexual harassment prevention training  CDC’s framework defines sexual violence as including non-contact unwanted sexual behaviors, sexual harassment, and physical sexual assault  We applied six principles for sexual violence prevention from CDC’s framework to DOD’s sexual harassment policies  These principles are: Risk factors: Factors that may put people at risk for sexual violence perpetration or victimization, such as an organizational climate that either explicitly or implicitly condones sexual harassment  Protective factors: Factors that may protect high-risk people from harm, such as an organizational climate that promotes respect amongst personnel at all levels  Primary strategies for prevention: Strategies that occur before sexual violence takes place to prevent initial perpetration, such as sexual harassment prevention training  Secondary strategies for prevention: Immediate responses after sexual violence has occurred to address the early identification of victims and the short-term consequences of violence, such as mechanisms for reporting instances of sexual harassment and immediate interventions  Tertiary strategies for prevention: Long-term responses after sexual violence has occurred to address the lasting consequences of violence and sex-offender treatment interventions, such as long-term treatment of the victim and perpetrator  Risk domains: Levels at which risk and protective factors should be categorized, including: individual, relationship, community, and societal  In its sexual assault prevention strategy, DOD adapted risk domains to the military population, using the levels of: individual, relationship, leaders at all levels, military community, and society  Our comparison of DOD sexual harassment policies with CDC’s framework for preventing sexual violence showed that the policies include some of the principles in the framework but not others (see table 1 ) Our analysis showed that the OSD and the Air Force policies each include two of the six principles in CDC’s framework, and the Army, the Navy, and the Marine Corps policies include three principles  Specifically, the policies generally identify sexual harassment prevention training for the armed forces, a primary strategy for prevention  In addition, the policies generally outline mechanisms for reporting and responding to sexual harassment, considered a secondary strategy for prevention  The Army, the Navy, and the Marine Corps policies outline counseling support and referral services, as well as specifying the options available for administrative or judicial punishment, including discharge from service for perpetrators, which can be considered to be tertiary strategies for prevention  Common elements missing from DOD’s sexual harassment policies are risk factors and protective factors, which identify conditions or behaviors that might heighten or lower the risk of sexual harassment victimization or perpetration, respectively  Examples of risk factors for sexual violence identified by the CDC include, but are not limited to, alcohol and drug use, hypermasculinity, emotionally unsupportive family environments, general tolerance of sexual violence within the community, and societal norms that support male superiority and sexual entitlement  Examples of protective factors from the CDC include emotional health and connectedness, and empathy and concern for how one’s actions affect others  Additionally, RAND identified an organizational climate that is oppositional to sexual violence as a protective factor  The policies also did not include risk domains, which would categorize risk and protective factors at the individual, relationship, community, and society levels  ODMEO officials told us that they are familiar with the CDC framework and are considering using it as a source of best practices for a new sexual harassment prevention strategy  DOD has previously used CDC’s sexual violence prevention framework to guide its sexual assault prevention strategy  In the absence of more comprehensive policies on sexual harassment that fully include principles in the CDC framework for sexual violence prevention, DOD may be missing opportunities to address and potentially reduce incidents of sexual harassment in the military population based on risk and protective factors and effective, tested strategies  Specifically, DOD may be missing the opportunity to identify risk factors, which would help to recognize situations where individuals and populations may be at a higher risk of sexual harassment perpetration or victimization; identify protective factors to lower the risk of sexual harassment; develop mechanisms to address sexual harassment across risk domains—at the individual, relationship, community, and society levels; and develop tertiary strategies, or long-term responses after sexual violence has occurred to address the lasting consequences of violence and sex- offender treatment interventions  DOD’s sexual harassment policies include three elements required by section 579 of the NDAA for FY 2013 but some do not include one element involving the anonymous reporting of incidents  Section 579 mandated that DOD, among other things, develop a comprehensive sexual harassment policy that includes the following elements: (1) prevention training for members of the armed forces; (2) mechanisms for reporting sexual harassment, including mechanisms for anonymous reporting; and (3) mechanisms for resolving sexual harassment that include the prosecution of perpetrators  In 2014, the Office of the Undersecretary of Defense for Personnel and Readiness issued a policy memorandum addressing the provisions of Section 579 and directed the military services to develop implementing instructions that include mechanisms for anonymous reporting  We compared DOD’s policies with the required elements in section 579 and found that OSD and military service policies generally include required elements except for the element focused on DOD including anonymous reporting in its policies for sexual harassment  The OSD, Army, and Marine Corps policies do not include anonymous reporting, while the Air Force policy and a new Navy policy do  Officials from ODMEO said that providing an option for anonymous reporting is important because it increases the odds that incidents will be reported  ODMEO officials also told us that the services have hotlines that servicemembers can use to anonymously report complaints of sexual harassment, and the Air Force and Navy policies note that their respective military servicemembers have options for anonymous reporting  While the military services may have mechanisms in place for anonymous reporting of sexual harassment, these mechanisms are not included in OSD’s policy—as required by section 579—or the policies of two of the Services, those of the Army and the Marine Corps  Without including anonymous reporting of sexual harassment complaints in DOD’s sexual harassment policies, the statutory requirement for anonymous reporting may be interpreted and applied inconsistently throughout the military services, or left unmet  OSD is developing a new policy—planned to be issued in fiscal year 2018—that will specifically focus on various forms of harassment, including sexual harassment, hazing, and bullying  ODMEO officials who are developing the new policy stated that it is intended, among other things, to enhance oversight of sexual harassment prevention and response within the department  However, because the policy is under development, it is too early to determine how the policy will address the CDC principles and anonymous reporting, as discussed earlier  Further, it is unclear how OSD plans to improve oversight and whether it intends to include performance goals, objectives, milestones, and metrics as we previously recommended in 2011  Although OSD in 2014 directed the military services to improve their oversight of sexual harassment, none of the military services were able to demonstrate that they had implemented all the required elements  Specifically, DOD’s 2014 policy memorandum addressing the provisions of section 579 also directs the military services to develop a sexual harassment oversight framework to be reviewed quarterly by a senior leadership forum that includes long-term goals, objectives, and milestones; criteria for measuring progress; results-oriented performance measures to assess effectiveness of service sexual harassment policies and programs; standards for holding leaders accountable for promoting, supporting, and enforcing policies, plans and programs; and strategies to implement the oversight framework  While some of the military services have included elements of the oversight framework directive from the 2014 policy memorandum, none of them were able to provide information that demonstrated that they had fulfilled all requirements set forth by that policy memorandum  For instance, when asked, none of the military services were able to provide details that they have senior leader forums that review their oversight efforts on a quarterly basis  Officials from the Air Force told us that they were waiting for ODMEO to release a new sexual harassment policy before establishing the oversight framework  Officials from the Navy referred us to their July 2017 sexual harassment policy, which instructs the Navy Sexual Harassment Prevention and Equal Opportunity Office to develop and implement standards for holding leaders accountable for promoting, supporting, and enforcing sexual harassment prevention and response policies, plans, and programs, and to develop results-oriented performance measures to assess the effectiveness of sexual harassment prevention and response policies and programs  Officials from the Army referred us to their SHARP Campaign Plan, which outlines methods to hold leaders accountable for taking appropriate action to address sexual harassment; goals and objectives for the program; and ways to measure program effectiveness  The Marine Corps did not respond to our request for information regarding an oversight framework for sexual harassment  A new department-wide policy on sexual harassment could be helpful to the military services as they review and update their respective policies  As noted earlier, military service policies have some differences in how they address aspects of sexual harassment  The Marine Corps told us that they have been waiting for additional guidance from OSD before updating their sexual harassment policies  However, following publicized incidents of Marines posting inappropriate photos on line of female servicemembers without their consent, the Marine Corps updated its guidance in May 2017 adding “the distribution or broadcasting of an intimate image, without consent” to its list of sexual harassment incidents that mandate separation processing  Additionally, in May 2017, a Marine Corps official said the service was revising its sexual harassment policy  The Navy updated its sexual harassment policy in July 2017 without additional guidance from OSD  We also noted during our review that most existing policies have not yet been updated to reflect a provision in the fiscal year 2017 NDAA that redefined sexual harassment for certain purposes so it is no longer defined solely as a form of sex discrimination but is recognized also as an adverse behavior on the spectrum of behavior that can contribute to an increase in the incidence of sexual assault  We asked DOD officials from several offices about the implications of this change  They identified some actions they will take, but the full implications, if any, of the change are unclear  Officials from the Assistant Secretary of Defense for Readiness said that there are no significant implications of the sexual harassment definition change beyond making conforming revisions to policy documents and guidance  ODMEO officials said that adjusting to the new definition of sexual harassment would not significantly affect their work at the OSD level, since they are already updating their sexual harassment policy to reflect this change and since sexual harassment is expected to remain within the responsibilities of ODMEO  They added that the military services will likely have to adjust to the new definition of sexual harassment, but did not offer details in how they would have to adjust  The Navy’s new policy dated July 2017 reflects the new definition, but the other military services have yet to incorporate the change  Officials from SAPRO said that they are working with ODMEO to revise surveys on unwanted sexual behaviors to reflect the new definition  SAPRO officials further stated that sexual harassment should remain under ODMEO’s purview since ODMEO personnel are trained specifically in sexual harassment response  Officials from the Army’s SHARP program said that the new definition means that sexual harassment will more often be considered misconduct, and taken more seriously  Since OSD is in the process of updating its policy, we are not making any recommendations  However, it will be important for OSD and the military services to address our prior recommendation regarding improving the oversight framework as well as incorporating the new definition of sexual harassment required by the fiscal year 2017 NDAA while updating their policies  DOD has processes for maintaining and reporting consistent data on sexual assault incidents and domestic violence incidents that involve sexual assault, but the department does not have similar assurance of consistent data on incidents of sexual harassment  SAPRO and FAP each use centralized databases that enable them to maintain and report consistent data on those incidents that fall under their purview  In contrast, DOD relies on military service-specific databases on sexual harassment incidents and does not have assurance of consistent data from these databases because it has not established standard data elements and definitions to guide the military services in maintaining and reporting these data  DOD uses centralized databases to maintain and report data on sexual assault incidents in the military and domestic violence incidents involving sexual assault  Specifically, SAPRO and the military services use the Defense Sexual Assault Incident Database (DSAID), and FAP uses the DOD Central Registry  These databases maintain data on incidents that are included in statutorily required annual reports to Congress on sexual assaults in the military  In 2011, Congress mandated that DOD provide annual reports that include: the number of sexual assaults committed against and by members of the armed forces that were reported to military officials, including unsubstantiated and substantiated reports with a synopsis of each substantiated case organized by offense and the action taken, including disciplinary actions; the policies, processes, and procedures implemented by the Secretary concerned during the year covered by the report in response to incidents of sexual assaults; the number of substantiated sexual assault cases in which the victim is deployed where the assailant is a foreign national; and a description of the implementation of the accessibility plan, including a description of the steps taken to ensure that trained personnel, appropriate supplies, and transportation resources are available to deployed units  The most recent DOD annual report on sexual assault was issued in May 2017 and covered fiscal year 2016  The report includes data on the number of both restricted and unrestricted reports of sexual assault involving servicemembers  The report also contains separate enclosures for the Army, the Navy (including the Marine Corps), the Air Force, and the National Guard, as well as annexes on the Workplace and Gender Relations Survey of Active Duty Members (WGRA) and the Military Investigation and Justice Experience Survey (MIJES)  The WGRA annex discusses topics including the continuum of harm and the MIJES annex contains information on closed cases of sexual assault  SAPRO and FAP both contributed sexual assault incident data to the fiscal year 2016 report, and our review of the underlying databases found that data elements and definitions were defined and management was able to process the data into consistent information  Specifically, the two databases used are the: DSAID Data on Sexual Assault Incidents: DSAID captures DOD-wide data on certain incidents of sexual assault that involve a servicemember or in some cases, when a sexual assault involves a servicemember’s spouse or adult family member or a DOD civilian or contractor  However, FAP-related sexual assault incidents are not captured in DSAID  Using information generated by DSAID, SAPRO includes both substantiated and unsubstantiated reports of sexual assault in its annual report  In 2017, we reviewed DSAID and found that DOD had taken steps to ensure the quality and consistency of data in DSAID as well as to monitor the data entered into the system  In addition, OSD had provided the military services with definitions for required data elements in the database, which include details on the incident, victim, and alleged offender  In addition, we identified several technical challenges with the system, including issues with the system’s speed and ease of use; interfaces with other external DOD databases; and users’ ability to query data and generate reports  At the time of the report’s release, DOD had plans to modify DSAID  As of July 2017, DOD officials told us that they are still in the process of making modifications to DSAID to resolve or alleviate the technical challenges for users  DOD Central Registry Data on Domestic Abuse Incidents Involving Sexual Assault: The DOD Central Registry captures DOD-wide data on reports of domestic abuse on populations within FAP’s purview, including on family members of servicemembers as well as on their intimate partners  The DOD Central Registry includes details of each case such as the status of cases, the demographics of the perpetrator and victim, the specific type of abuse, and other details surrounding the incident  FAP officials explained that they do not use the “substantiated” and “unsubstantiated” terminology like SAPRO does  Rather, FAP, which is not responsible for determining criminal or legal disposition, uses the terms “met criteria” and “not met criteria” for maltreatment  This difference in terminology has to do with FAP’s process for determining if an incident meets the clinical criteria to be classified as abuse for the purpose of developing an intervention/treatment plan for both the victim and the offenders involved in the allegations of domestic violence  Incidents that are determined as having met criteria are entered into the DOD Central Registry  We reviewed the DOD Central Registry and found that it includes well defined data elements and descriptions for collecting data on cases of domestic violence including those that involve sexual assault  The data in the DOD Central Registry includes 46 discrete data elements, including the relationship between the victim and perpetrator, the timeline of the case, and actions taken and treatments administered in response to the incident  The elements are defined and described in an OSD policy  In its annual reporting to Congress, FAP provides the number of domestic violence incidents involving sexual assault that met criteria and the total number of instances of domestic violence that did not meet criteria  However, FAP does not maintain or report data on the total number of reported domestic violence incidents that specifically involve sexual assault  That is because only the details of cases that meet criteria are recorded in the DOD Central Registry  A FAP official said that the military services likely have more detailed information about cases that did not meet the criteria, but it does not collect these data in the DOD Central Registry  A provision in the NDAA for FY 2017 requires DOD to submit an annual report on child abuse and domestic abuse incident data, including the number of incidents reported during the year involving the physical or sexual abuse of a spouse, intimate partner, or child  This report is to be submitted simultaneously with submission of DOD’s annual sexual assault report to Congress  FAP officials told us that they are currently working with SAPRO to ensure that all reported incidents of domestic violence involving sexual assault, including those that did not meet the criteria, are included in the annual sexual assault report  Though not required to do so, DOD has included sexual harassment incident data in an appendix of its annual report on sexual assault in the military  The appendix provides information on the total number of sexual harassment reports over the fiscal year and the total number of substantiated sexual harassment reports  It also breaks down complaints by sex, service, and pay grade  ODMEO generates the reported data through annual data calls to each military service; however, it does not have assurance that the services maintain consistent data on sexual harassment incidents consistent with federal standards of internal control  The military services maintain sexual harassment incident data in military service-specific databases, and there is no centralized database similar to DSAID or the Central Registry  The military service databases are intended to collect data on formal complaints  According to the military services, the Army, the Air Force, and the Marine Corps use web-based systems, and the Navy tracks data using an Excel spreadsheet  Each service has a discrete process for entering and performing quality checks on sexual harassment incident data in its respective database, as shown in table 2  Although the military services perform some data quality checks as shown in table 2, ODMEO does not have assurance the military services are maintaining consistent data because it has not defined standard data elements and definitions for the information in their databases  Rather, the individual military services have established their own data elements and definitions  We compared data elements and definitions from each of the military services and found that there are several data elements that remain consistent throughout the services  For example, each military service records whether the complainant and offender are in the same unit, what their relationship is to each other, and the disposition of cases  However, we also found inconsistencies in data fields and their definitions across the military services, and some of the military services have data fields and definitions that do not exist in other databases  For example, the Marine Corps records whether or not the incident involves alcohol or drug use, which the rest of the military services do not record, and the military services record dates differently between their respective databases  For example, the Air Force records an initial date, the date the complaint form was signed, the date the general court martial was sent, the date the legal review was completed, and the final review date  The Marine Corps records the date the incident was reported, the date the incident occurred and whether the incident occurred over multiple dates; the dates associated with notifications and status updates to general courts martial proceedings; the dates associated with steps in the investigation, including any extensions; the dates associated with dispositions; and the dates associated with appeals  Additionally, the military services have different ways of categorizing sexual harassment incidents, as shown in table 3  As shown in table 3, while some data descriptions are similar—for instance, each of the military services include crude/offensive behavior, unwanted sexual attention, and sexual coercion—there are differences as well  The Air Force also categorizes sexual harassment into verbal, nonverbal, physical, and other, for example, whereas the other military services’ top-level categories are different  The Navy has a “not applicable” category that it describes as sexual harassment complaints that do not fall under sexual harassment, and only the Air Force has an “other” category

ground_truth: CMS, an agency within the Department of Health and Human Services (HHS), provides health coverage for over 145 million Americans through its four principal programs, with annual outlays of about $1.1 trillion. GAO has designated the two largest programs, Medicare and Medicaid, as high risk partly due to their vulnerability to fraud, waste, and abuse. In fiscal year 2016, improper payment estimates for these programs totaled about $95 billion. GAO's Fraud Risk Framework and the subsequent enactment of the Fraud Reduction and Data Analytics Act of 2015 have called attention to the importance of federal agencies' antifraud efforts. This report examines (1) CMS's approach for managing fraud risks across its four principal programs, and (2) how CMS's efforts managing fraud risks in Medicare and Medicaid align with the Fraud Risk Framework. GAO reviewed laws and regulations and HHS and CMS documents, such as program-integrity manuals. It also interviewed CMS officials and a sample of CMS stakeholders, including state officials and contractors. GAO selected states based on fraud risk and other factors, such as geographic diversity. GAO selected contractors based on a mix of companies and geographic areas served. The approach that the Centers for Medicare & Medicaid Services (CMS) has taken for managing fraud risks across its four principal programs—Medicare, Medicaid, the Children's Health Insurance Program (CHIP), and the health-insurance marketplaces—is incorporated into its broader program-integrity approach. According to CMS officials, this broader program-integrity approach can help the agency develop control activities to address multiple sources of improper payments, including fraud. As the figure below shows, CMS views fraud as part of a spectrum of actions that may result in improper payments. CMS's efforts managing fraud risks in Medicare and Medicaid partially align with GAO's 2015 A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework). This framework describes leading practices in four components: commit , assess , design and implement , and evaluate and adapt . CMS has shown commitment to combating fraud in part by establishing a dedicated entity—the Center for Program Integrity—to lead antifraud efforts. Furthermore, CMS is offering and requiring antifraud training for stakeholder groups such as providers, beneficiaries, and health-insurance plans. However, CMS does not require fraud-awareness training on a regular basis for employees, a practice that the framework identifies as a way agencies can help create a culture of integrity and compliance. Regarding the assess and design and implement components, CMS has taken steps to identify fraud risks, such as by designating specific provider types as high risk and developing associated control activities. However, it has not conducted a fraud risk assessment for Medicare or Medicaid, and has not designed and implemented a risk-based antifraud strategy. A fraud risk assessment allows managers to fully consider fraud risks to their programs, analyze their likelihood and impact, and prioritize risks. Managers can then design and implement a strategy with specific control activities to mitigate these fraud risks, as well as an appropriate evaluation approach consistent with the evaluate and adapt component. By developing a fraud risk assessment and using that assessment to create an antifraud strategy and evaluation approach, CMS could better ensure that it is addressing the full portfolio of risks and strategically targeting the most-significant fraud risks facing Medicare and Medicaid. GAO recommends that CMS (1) provide and require fraud-awareness training to its employees, (2) conduct fraud risk assessments, and (3) create an antifraud strategy for Medicare and Medicaid, including an approach for evaluation. HHS concurred with GAO's recommendations.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.



Report 2:  Because the military services have different descriptors for similar data fields, DOD cannot ensure that the services are categorizing similar types of sexual harassment in the same way  In addition, we found that the Army is more detailed in characterizing different types of sexual harassment  Specifically, as shown in table 4, the Army has an additional data field that provides more detailed descriptions of three types of sexual harassment; the other military services’ respective databases do not have this level of detail  Because the Army has this additional data field, it can capture information on multiple types of harassment that may occur in a single incident  The other military services, in contrast, do not have this capability in their respective databases  To illustrate, if one case of sexual harassment involved both verbal and nonverbal forms of sexual harassment, the Army could choose a more specific characterization to describe the incident, while the other military services would characterize the incident in more general terms  ODMEO officials are considering adapting an existing system to track instances of sexual harassment department-wide  That system, called Force Risk Reduction (FR2), is currently used to track safety issues like military injuries, civilian workers’ compensation claims, and casualty notifications at DOD  ODMEO recently completed a pilot of the system with the Marine Corps, the Navy, and the Army to test whether it would be useable for adaptation for sexual harassment data, and is planning a second pilot to include the Air Force and the National Guard Bureau  According to ODMEO officials, their adaptation of FR2 is intended to collect aggregate-level sexual harassment data from the military services, and the military services will continue to operate and rely on their individual databases to maintain more detailed case-level information on incidents  For example, ODMEO’s adaptation of FR2 would not have details such as descriptions of specific incidents, or information on dates associated with investigations or appeals  These types of data will continue to be maintained in the service systems  ODMEO officials told us that their new data system, if implemented, is not designed to collect case-level details in order to avoid personally identifiable information  Federal internal control standards state that management should define the identified information requirements at the relevant level and requisite specificity for appropriate personnel  Management should also process the obtained data into quality information  Consistency of information meets the identified information requirements when relevant data from reliable sources are used  While DOD is exploring implementing a system to track instances of sexual harassment department-wide, as currently planned this system will not collect case-level details and individual military service systems will continue to be relied upon for this type of information  Inconsistencies in data elements and definitions among the military services generally mean that one military service may be maintaining sexual harassment data that are more or less detailed than sexual harassment data maintained by other military services, or that is simply different from the data maintained by other military services  Additionally, inconsistent data elements and definitions may create difficulties in reporting sexual harassment data from the military services to OSD for a department-wide report, since ODMEO has to adapt data from the services to fit reporting requirements  Without standard data elements and definitions for sexual harassment data, DOD will continue to lack assurance about the consistency of these data across the military services  DOD has several overarching efforts to address unwanted sexual behaviors across the continuum of harm  Specifically, the department established an office to oversee the integration and coordination of unwanted sexual behaviors in 2015 and is in the process of developing an overarching prevention strategy  However, because the strategy is under development, it is unclear whether it will contain key elements for long-term and results-oriented strategic planning  DOD also has ongoing collaborative efforts to address unwanted sexual behaviors along the continuum of harm  Specifically, we identified 15 collaborative efforts, including regular meetings, Integrated Product Teams, and working groups that involve multiple entities that address unwanted sexual behaviors  DOD has taken steps to integrate activities related to the continuum of harm and is in the process of developing an overarching prevention strategy  Based on its research, DOD has sought to understand and define the continuum of harm, including the shared characteristics that contribute to increased unwanted sexual behaviors along the continuum and implications for prevention and response efforts  Also, in November 2015, DOD established a new entity—the Office of the Executive Director for Force Resiliency, within the Office of the Assistant Secretary of Defense for Readiness—to oversee policies and initiatives related to the continuum of harm  Specifically, the Executive Director for Force Resiliency was expected to provide senior leader policy guidance and oversight on high visibility departments that include SAPRO and ODMEO  In November 2016, the Office of the Executive Director for Force Resiliency was absorbed under the Assistant Secretary of Defense for Readiness  According to the Assistant Secretary of Defense for Readiness, the functions of the Office of the Executive Director for Force Resiliency remain and coordination of the efforts of several offices that address the continuum of harm continues  Officials from the Assistant Secretary of Defense for Readiness and SAPRO told us that they are drafting an overarching prevention strategy to encompass behaviors along the continuum of harm  However, because the strategy is still under development, its contents and timelines are unclear  We have previously identified six elements of strategic management planning that are key for establishing a long-term, results- oriented strategic planning framework: (1) a mission statement, (2) long- term goals, (3) strategies to achieve goals, (4) external factors that could affect goals, (5) the use of metrics to gauge progress, and (6) evaluations of the plan to monitor goals and objectives  By incorporating the elements of a comprehensive and results-oriented strategy into its overarching prevention strategy, the department will be better positioned to effectively coordinate and integrate prevention activities and reduce unwanted sexual behaviors  A mission statement, along with long-term goals and strategies to achieve those goals, should help to focus efforts in integrating prevention activities, and metrics and evaluations will allow the department to gauge progress and make changes as necessary, while also accounting for external factors that may impact progress towards goals  Our review identified 15 collaborative efforts that DOD has used to address behaviors along the continuum of harm, including sexual harassment, sexual assault, and domestic violence involving sexual assault  Three of these efforts are cross-cutting between all three of the key OSD stakeholders—ODMEO, FAP, and SAPRO—and five involve cross-cutting efforts by at least two of the key stakeholders  Figure 1 lists DOD’s 15 collaborative efforts  Regarding the three cross-cutting efforts involving all three of the key stakeholders, The Sexual Assault Prevention and Response Integrated Product Team provides a forum for OSD, the military departments, and the National Guard Bureau to address sexual assault prevention efforts  The team meets bimonthly and serves as the implementation and oversight arm for DOD’s Sexual Assault Prevention and Response (SAPR) program  The team also coordinates new policies; reviews existing SAPR policies and programs to ensure they are consistent with applicable instructions; and monitors the progress of program elements including DOD’s SAPR strategic plan tasks, DOD’s sexual assault prevention strategy tasks, and implementation of NDAA- related sexual assault issues  SAPRO leads this effort  The Prevention Collaboration Forum and working group develops coordinated prevention approaches that address factors impacting personnel readiness such as sexual harassment, sexual assault, and domestic violence involving sexual assault  According to its proposed charter, the focus of the forum is on enhancing the health of military unit and family climates as well as strengthening and promoting the resiliency and readiness of the total force through a coordinated effort around integrated policies, collaborative direction of research, alignment of resources, analysis of gaps, and synchronization of activities  The Assistant Secretary of Defense for Readiness leads this effort with SAPRO providing administrative and facilitation support  The Victim Assistance Leadership Council advises the Under Secretary of Defense for Personnel and Readiness on policies and practices related to victim assistance across DOD  According to its charter, the council provides a forum for senior leaders to exchange information and collaborate on issues affecting victims of all forms of crime and harassment within DOD, including but not limited to victims of sexual harassment, sexual assault, and domestic violence involving sexual abuse  Leadership rotates between SAPRO, FAP, and ODMEO and other offices  Regarding the cross-cutting efforts involving two of the three key stakeholders, the Sexual Harassment Prevention and Response Working Group is led by ODMEO and includes SAPRO  The group was established to evaluate how to best position sexual harassment prevention and response policy and oversight and to leverage technology to automate annual reporting requirements  The four other cross-cutting efforts are (1) the hazing and bullying working group, (2) retaliation working groups created under the SAPR Integrated Process Team, (3) domestic abuse rapid improvement events, and (4) ODMEO and SHARP meetings  The remaining collaborative efforts we identified are specific to FAP, SAPRO, and ODMEO  For example, the Sexual Assault Prevention Roundtable is a forum for representatives from OSD, the military departments, and the National Guard Bureau to share information on sexual assault prevention efforts and requirements  According to its charter, the roundtable’s activities include, among other things, sharing promising practices and prevention updates; discussing challenges in prevention program implementation, including servicemember training, and identifying approaches to address them; identifying metrics to assess the impact and effectiveness of prevention efforts, and opportunities to collaborate on research projects; and tracking the implementation of prevention tasks identified in the DOD SAPR strategy  SAPRO leads this effort  The Defense Diversity Working Group is an ODMEO-specific group that collaborates with various OSD and military service offices on military and civilian diversity and inclusion issues and implements mandated diversity plans and programs  Studies by DOD and others have shown that unwanted sexual behaviors do not exist in isolation but are part of a range of interconnected, inappropriate behaviors that are connected to the occurrence of a sexual assault  While DOD has policies and procedures to prevent and respond to these types of unwanted behaviors, some of the policies do not include key elements like anonymous reporting of sexual harassment and principles in the CDC framework for sexual violence prevention  Fully including these elements in the department’s policies can help ensure that the military services are interpreting and applying prevention and response efforts consistently and may also decrease the risk of perpetration or victimization related to instances on unwanted sexual behaviors  Further, DOD has developed reliable data systems for collecting and reporting data on some of the unwanted sexual behaviors including sexual assault and instances of domestic violence with sexual assault  However, inconsistencies in sexual harassment data elements and definitions may be creating difficulties in developing department-wide reports on unwanted sexual behaviors  Improving and standardizing data collection efforts will not only improve the quality of data that DOD and the military services collect but may also increase the ability for DOD to further develop its understanding of the connection between unwanted sexual behaviors  Finally, DOD officials have stated that they are in the early stages of developing an overarching strategy to address the interconnected nature of the range of unwanted sexual behaviors  To ensure that the department is appropriately concentrating its efforts to prevent and respond to the full range of unwanted behaviors, it is important that DOD include elements of a long-term, results-oriented strategy into its overarching prevention strategy  In doing so, DOD will be in a better position to effectively coordinate and integrate prevention activities and ultimately reduce instances of unwanted sexual behaviors  We are making the following four recommendations to DOD: The Under Secretary of Defense for Personnel and Readiness should fully include in the new policy for sexual harassment the principles in the Centers for Disease Control’s framework for sexual violence prevention, including risk and protective factors, risk domains, and tertiary strategies  (Recommendation 1) The Under Secretary of Defense for Personnel and Readiness should include in the new policy for sexual harassment mechanisms for anonymous reporting of incidents consistent with section 579 of the National Defense Authorization Act for FY 2013  (Recommendation 2) The Under Secretary of Defense for Personnel and Readiness should (1) direct the Office of Diversity Management and Equal Opportunity to develop standard data elements and definitions for maintaining and reporting information on sexual harassment incidents at the military service level, and (2) direct the military services to incorporate these data elements and definitions into their military service-specific databases  (Recommendation 3) The Under Secretary of Defense for Personnel and Readiness should direct the Assistant Secretary of Defense for Readiness to incorporate in its continuum of harm prevention strategy all the elements that are key for establishing a long-term, results-oriented strategic planning framework  The elements are (1) a mission statement, (2) long-term goals, (3) strategies to achieve goals, (4) external factors that could affect goals, (5) use of metrics to gauge progress, and (6) evaluations of the plan to monitor goals and objectives  (Recommendation 4) We provided a draft of this report to DOD and CDC for review and comment  In its written comments, DOD concurred with three recommendations and partially concurred with one, noting planned actions to address this recommendation  DOD’s comments are reprinted in their entirety in appendix II  DOD and CDC also provided technical comments, which we incorporated into the report as appropriate  DOD concurred with our three recommendations that DOD fully include in the new policy for sexual harassment the principles in the CDC's framework for sexual violence prevention, that DOD also include in the new sexual harassment policy mechanisms for anonymous reporting, and that DOD incorporate in its continuum of harm strategy all the elements that are key for establishing a long-term, results-oriented strategic planning framework  With regard to our recommendation that DOD develop standard data elements and definitions for maintaining and reporting information on sexual harassment incidents and direct the military services to incorporate these into their databases, DOD partially concurred and stated that while a 2013 policy memorandum provides standard data elements and definitions, the services collect other data elements based on their unique needs  DOD stated that ODMEO will conduct a review to determine compliance with DOD reporting requirements and identify emerging policy modifications or changes/additions to standard definitions  We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, the Under Secretary of Defense for Personnel and Readiness, and the Director, Centers for Disease Control and Prevention  In addition, the report is available at no charge on the GAO website http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-3604 or farrellb@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix III  To determine the extent to which the Department of Defense (DOD) has policies on sexual harassment that include Centers for Disease Control and Prevention (CDC) principles and relevant legislative elements, we obtained and reviewed Office of the Secretary of Defense (OSD) and service-level sexual harassment policies  We compared the policies with a framework developed by the CDC for preventing sexual violence, which CDC defines as including non-contact unwanted sexual behaviors, sexual harassment, and physical sexual assault  CDC’s model is based on the concept of addressing the health of a given population based on common risk and protective factors and effective, tested strategies  We reviewed CDC’s framework for preventing sexual violence as well as our report on DOD’s sexual assault prevention strategy to identify six principles that an organization can include in a sexual violence prevention strategy or policy: Risk factors: Factors that may put people at risk for sexual violence perpetration or victimization, such as an organizational climate that either explicitly or implicitly condones sexual harassment; Protective factors: Factors that may protect high-risk people from harm, such as an organizational climate that promotes respect among personnel at all levels; Primary strategies for prevention: Strategies that occur before sexual violence takes place to prevent initial perpetration, such as sexual harassment prevention training; Secondary strategies for prevention: Immediate responses after sexual violence has occurred to address the early identification of victims and the short-term consequences of violence, such as reporting mechanisms and immediate interventions; Tertiary strategies for prevention: Long-term responses after sexual violence has occurred to address the lasting consequences of violence and sex-offender treatment interventions, such as the long- term treatment of the victim and perpetrator; and Risk domains: Levels at which risk and protective factors should be categorized, including: individual, relationship, community, and society  DOD has previously adapted risk domains to the military population, using the levels of: individual, relationship, leaders at all levels, military community, and society  DOD previously used CDC’s framework for preventing sexual violence in the department’s 2014-2016 Sexual Assault Prevention Strategy  In addition, we reviewed the OSD and service-level sexual harassment policies to determine the extent to which they included three elements identified in the National Defense Authorization Act (NDAA) for FY 2013, which directed DOD to develop a comprehensive policy that includes sexual harassment prevention training for the armed forces; mechanisms for reporting incidents, including mechanisms for anonymous reporting; and mechanisms for responding to and resolving instances of sexual harassment, including for the prosecution of perpetrators  Two GAO analysts independently reviewed the policies and determined whether or not each element was included  Any discrepancies were resolved through discussion and consultation with a third analyst  We interviewed officials in the Under Secretary of Defense for Personnel and Readiness’ Office of Diversity Management and Equal Opportunity, who oversee department- wide policy on sexual harassment, to obtain an understanding of their roles and processes regarding sexual harassment as well as the status of policy development in that area  We also interviewed officials from military equal opportunity offices in the Air Force, the Navy, and the Marine Corps, as well as officials from the Army’s Sexual Harassment/Assault Response and Prevention Office to obtain an understanding of the service sexual harassment offices and roles, as well as the status of updates to their respective policies  To determine the extent to which DOD has processes for maintaining and reporting consistent data on incidents of unwanted sexual behaviors, we reviewed DOD reports to Congress that provide incident data regarding unwanted sexual behaviors, including DOD’s most recent annual report on sexual assault in the military  We identified the databases that generate the reported data and evaluated the processes for assuring the quality and consistency of data in those databases—including the Defense Sexual Assault Incident Database, which maintains sexual assault data; the Central Registry database, which maintains data on domestic violence involving sexual assault; and various military service- level databases that maintain sexual harassment data  To evaluate DOD’s reported data we reviewed pertinent statutory provisions, DOD guidance, and the Standards for Internal Control in the Federal Government that address agencies’ use of quality data and our prior reports evaluating sexual assault data  In evaluating the reported data, we obtained and reviewed statutory provisions with reporting requirements, as well as DOD guidance on data collection for sexual harassment, sexual assault, and domestic violence involving sexual abuse  With regard to DOD efforts to collect and maintain sexual assault data, we met with OSD, Navy, Air Force, and Marine Corps officials in their respective Sexual Assault Prevention and Response offices as well as officials in the Army’s Sexual Harassment/Assault Response and Prevention office  We also reviewed our prior report on DOD’s Defense Sexual Assault Incident Database and our prior report that evaluated sexual assault data across agencies  To determine whether DOD has processes for collecting and maintaining consistent data for domestic violence with sexual assault, we obtained and compared data elements and processes from DOD’s Central Registry database, which contains data for domestic violence throughout the department  We also obtained and reviewed policies that outline processes for collecting and reporting domestic violence involving sexual abuse data, and interviewed officials from Family Advocacy Program offices in OSD and the Army, Navy, Marine Corps, and Air Force to determine data reliability and comprehensiveness  To determine the extent to which reports of sexual assault, including reports of sexual assault among servicemembers and reports of domestic abuse involving sexual assault, meet statutory requirements for reporting, we reviewed DOD reports to Congress that provide sexual assault incident data, including DOD’s most recent annual report on sexual assault in the military and compared those reports with requirements in the NDAA for FY 2011, which directs DOD to report the total number of substantiated and unsubstantiated sexual assault incidents, among other things  With regard to sexual harassment data, we interviewed officials in the Under Secretary of Defense for Personnel and Readiness’ Office of Diversity Management and Equal Opportunity, as well as officials from the Military Equal Opportunity offices in the Air Force, Marine Corps, and Navy, and officials from the Army Sexual Harassment/Assault Response and Prevention office  We collected and compared data fields and data definitions from the Army, Navy, Marine Corps, and Air Force offices that address sexual harassment  We compared the data elements to determine whether the data elements and definitions across the services are consistent  To identify the extent to which DOD has overarching efforts, including a prevention strategy, to address unwanted sexual behaviors across the continuum of harm, we met with officials in the Office of the Assistant Secretary of Defense for Readiness and DOD’s Sexual Assault Prevention and Response office  We reviewed our prior work and provisions from the Government Performance and Results Act to identify key elements that should be included in strategic plans as well as standards for coordinating within agencies  Key elements include (1) mission statement, (2) long-term goals, (3) strategies to achieve goals, (4) external factors that could affect goals, (5) use of metrics to gauge progress, and (6) evaluations of the plan to monitor goals and objectives  We identified and reviewed coordinating mechanisms used by OSD and the service offices that guide and oversee efforts to address unwanted sexual behaviors  We reviewed DOD, RAND Corporation, and CDC reports that addressed the continuum of harm and the relationship between the various forms of unwanted sexual behaviors  We interviewed officials from OSD and service-level Sexual Assault Prevention and Response, Family Advocacy, and Military Equal Opportunity offices and the Army’s Sexual Harassment/Assault Response and Prevention to identify the various efforts in which they participate  We also collected and reviewed charters and meeting notes for integrated product teams and working groups to identify their intended purposes, their activities, their membership, and whether they involved multiple offices addressing unwanted sexual behaviors  In identifying DOD’s collaborative efforts, we also reviewed our prior work on collaboration among federal agencies but we did not assess the effectiveness of department’s collaborative efforts  We conducted this performance audit from August 2016 to December 2017 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  In addition to the staff named above, key contributors to this report include Thomas Gosling (Assistant Director); Isabel Band; Matthew Bond; Vincent Buquicchio; Caroline DeCelles; Mae Jones; Kirsten Lauber; and Brian Pegram  Sexual Assault: Better Resource Management Needed to Improve Prevention and Response in the Army National Guard and Army Reserve  GAO-17-217  Washington, D C : February 27, 2017  Military Personnel: DOD Has Processes for Operating and Managing Its Sexual Assault Incident Database  GAO-17-99  Washington, D C : January 10, 2017  Sexual Violence Data: Actions Needed to Improve Clarity and Address Differences Across Federal Data Collection Efforts  GAO-16-546  Washington, D C : July 19, 2016  DOD and Coast Guard: Actions Needed to Increase Oversight and Management Information on Hazing Incidents Involving Servicemembers  GAO-16-226  Washington, D C : February 9, 2016  Sexual Assault: Actions Needed to Improve DOD’s Prevention Strategy and to Help Ensure It Is Effectively Implemented  GAO-16-61  Washington, D C : November 4, 2015  Military Personnel: Actions Needed to Address Sexual Assaults of Male Servicemembers  GAO-15-284  Washington, D C : March 19, 2015  Military Personnel: DOD Needs to Take Further Actions to Prevent Sexual Assault during Initial Military Training  GAO-14-806  Washington, D C : September 9, 2014  Military Personnel: DOD Has Taken Steps to Meet the Health Needs of Deployed Servicewomen, but Actions Are Needed to Enhance Care for Sexual Assault Victims  GAO-13-182  Washington, D C : January 29, 2013  Preventing Sexual Harassment: DOD Needs Greater Leadership Commitment and an Oversight Framework  GAO-11-809  Washington, D C : September 21, 2011  Military Justice: Oversight and Better Collaboration Needed for Sexual Assault Investigations and Adjudications  GAO-11-579  Washington, D C : June 22, 2011  Military Personnel: DOD’s and the Coast Guard’s Sexual Assault Prevention and Response Programs Need to Be Further Strengthened  GAO-10-405T  Washington, D C : February 24, 2010  Military Personnel: Additional Actions Are Needed to Strengthen DOD’s and the Coast Guard’s Sexual Assault Prevention and Response Programs  GAO-10-215  Washington, D C : February 3, 2010  Military Personnel: DOD’s and the Coast Guard’s Sexual Assault Prevention and Response Programs Face Implementation and Oversight Challenges  GAO-08-924  Washington, D C : August 29, 2008  Military Personnel: The DOD and Coast Guard Academies Have Taken Steps to Address Incidents of Sexual Harassment and Assault, but Greater Federal Oversight Is Needed  GAO-08-296  Washington, D C : January 17, 2008 
Report 2:  Egypt's policy toward Libya also is closely aligned with other foreign backers of the LNA, including France and the United Arab Emirates (UAE)  Reportedly, the three countries are working in concert to strengthen the position of Haftar in order to facilitate the eventual reunification of the Libyan army  A 2019 LNA offensive into southern Libya has placed additional pressure on the Government of National Accord and may complicate U S -backed efforts by the United Nations to facilitate a national dialogue, constitutional referendum, and elections in 2019  To Egypt's south, the government is embroiled in regional disputes with Nile Basin countries, such as Ethiopia, which is nearing completion of the $4 2 billion Grand Ethiopian Renaissance Dam, a major hydroelectric project  Egypt argues that the dam, once filled, will limit the flow of the Nile River below Egypt's agreed share  However, many analysts expect that Egypt will address the dispute by increasing water-use efficiency and investing in desalination, rather than using its military to bomb the dam  Reduced Nile flow into Egypt may exacerbate existing water shortages and cause short-term political problems for the Egyptian government, which faces extensive domestic water needs  In February 2019, President Sisi assumed the one-year chairmanship of the African Union, during which he is expected to promote closer relations with fellow African states  Egypt and Russia, close allies in early years of the Cold War, have again strengthened bilateral ties under President Sisi, who has promised to restore Egyptian stability and international prestige  His relationship with Russian President Vladimir Putin has rekindled, in the words of one observer, "a romanticized memory of relations with Russia during the Nasser era " President Sisi first turned to Russia during the Obama Administration, when U S -Egyptian ties were strained, and Egypt seemed intent on signaling its displeasure with U S  policy  Since 2014, Egypt and Russia have improved ties in a number of ways, including through arms deals  Reportedly, Egypt is upgrading its aging fleet of legacy Soviet MiG-21 aircraft to a fourth generation MiG-29M variant with additional deliveries to Egypt in 2018 (first delivered in April 2017)  Egypt also has purchased 46 standard Ka-52 Russian attack helicopters for its air force  Egypt reportedly also has purchased the naval version of the Ka-52 for use on Egypt's two French-procured Mistral-class helicopter dock vessels (see below), and the S-300VM surface-to-air missile defense system from Russia  In August 2018, Egyptian Defense Minister Mohamed Zaki visited Russia, where he attended a Russian arms exhibition  Additionally, Egypt and Russia reportedly have expanded their cooperation on nuclear energy  In 2015, Egypt reached a deal with Russian state energy firm Rosatom to construct a 4,800-megawatt nuclear power plant in the Egyptian Mediterranean coastal town of Daba'a, 80 miles northwest of Cairo  Russia is lending Egypt $25 billion over 35 years to finance the construction and operation of the nuclear power plant (this will cover 85% of the project's total costs)  The contract also commits Russia to supply the plant's nuclear fuel for 60 years and transfer and store depleted nuclear fuel from the reactors  As Egyptian and Russian foreign policies have become more closely aligned in conflict zones such as eastern Libya, bilateral military cooperation has expanded  One report suggests that Russian Special Forces based out of an airbase in Egypt's western desert (Sidi Barrani) may be aiding General Haftar  In November 2017, Egypt and Russia signed a draft agreement governing the use of each other's air space  While Egyptian-Russian ties have grown warmer in recent years, they are not without complications  In the aftermath of an October 2015 terrorist attack against a Russian passenger jet departing from Sharm El Sheikh, visits to Egypt by Russian tourists, previously the country's largest source of tourists, dropped significantly  Russian commercial aircraft have resumed direct flights to Cairo but not to Sharm El Sheikh  Egypt and Russia also engaged in a trade dispute in 2016 over Russian wheat imports  Egypt is the largest global importer of wheat, and the largest export market for Russian wheat  Aside from Russia, France stands out as a non-U S  country with which President Sisi has sought to build a diplomatic and military procurement relationship  In the last five years, as French-Egyptian ties have improved, Egypt has purchased major air and naval defense systems from French defense contractors, including the following: Four Gowind Corvettes (produced by Naval Group)—This deal was signed in July 2014  As part of the French-Egyptian arrangement, some of the Corvette construction has taken place at the Alexandria Shipyard in Egypt  One FREMM multi-mission Frigate (produced by Naval Group)—Named the Tahya Misr (Long Live Egypt), this vessel was delivered to Egypt in 2015  This ship has participated in an annual joint French-Egyptian naval exercise, known as Cleopatra  In February 2015, Egypt purchased 24 Rafale multirole fighters (produced by Dassault Aviation)  Under the initial agreement, Egypt and France may enter into a new procurement agreement for 12 additional Rafale fighters  According to the manufacturer, the Rafale has flown in combat in Afghanistan, Libya, Mali, Iraq, and Syria and is used by Egypt, Qatar, and India  In 2018, French officials said that the United States would not permit France to export the SCALP air-launched land-attack cruise missile used on the Rafale to Egypt under the International Trade in Arms Regulation (ITAR) agreement  The United States may have been concerned over the transfer of sensitive technology to Egypt  Two Mistral-class Helicopter Carriers (produced by Naval Group)—In the fall of 2015, France announced that it would sell Egypt two Mistral-class Landing Helicopter Dock (LHD) vessels (each carrier can carry 16 helicopters, 4 landing craft, and 13 tanks) for $1 billion  The LHDs (ENS Anwar El Sadat and ENS Gamal Abdel Nasser ) were delivered in 2016  In 2017, Egypt announced that it would purchase Russian 46 Ka-52 Alligator helicopters, which can operate on the LHDs  In January 2019, French President Emmanuel Macron paid a three-day visit to Egypt, where he raised human rights issues in public and with Egyptian authorities and civil society representatives  According to Macron, "I can't see how you can pretend to ensure long-term stability in this country, which was at the heart of the Arab Spring and showed its taste for freedom, and think you can continue to harden beyond what's acceptable or justified for security reasons " President Trump has praised the Egyptian government's counterterrorism efforts while his Administration has worked to restore high-level diplomatic engagement, joint military exercises, and arms sales  Many commentators initially expected President Trump to bring the United States and Egypt closer together, and that largely has been the case  The Administration has withheld some foreign assistance for policy reasons on at least one occasion, however, and the United States has not had an ambassador in Cairo since June 30, 2017  As evidence of improved bilateral ties, the U S  Defense Department notified Congress in November 2018 of a major $1 billion sale of defense equipment to Egypt, consisting of 10 AH-64E Apache Attack Helicopters, among other things  The Egyptian Air Force already possesses 45 less advanced versions of the Apache that were acquired between 2000 and 2014  In January 2019, U S  Secretary of State Michael Pompeo delivered a major policy speech at the American University in Cairo, where he stated: "And as we seek an even stronger partnership with Egypt, we encourage President Sisi to unleash the creative energy of Egypt's people, unfetter the economy, and promote a free and open exchange of ideas  The progress made to date can continue " U S  officials have not yet publicly criticized efforts by supporters of President Sisi to advance amendments to the constitution (see above) to extend the possibility of Sisi's continued presidency  Human rights advocates have called for Western governments to withhold assistance to Egypt if the amendments are approved  According to Human Rights Watch , "Al-Sisi's government is encouraged by the continued silence of its allies, and if the US, UK, and France want to avoid the destabilizing consequences of entrenching authoritarian rule in Egypt, they should act now " On February 22, 2019, a bipartisan group of national security experts called on U S  officials to "express strong concern about the amendments to the Egyptian constitution now moving through a rapid approval process " Egypt's poor record on human rights and democratization has sparked regular criticism from U S  officials and some Members of Congress  Since FY2012, Members have passed appropriations legislation that withholds the obligation of FMF to Egypt until the Secretary of State certifies that Egypt is taking various steps toward supporting democracy and human rights  With the exception of FY2014, lawmakers have included a national security waiver to allow the Administration to waive these congressionally mandated certification requirements under certain conditions  Over the last year, the Administration has obligated several tranches of FMF to Egypt, including the following: In September 2018, the Administration obligated $1 billion in FY2018 FMF  Per Section 7041(a)(3)(A) of P L  115-141 , the Consolidated Appropriations Act, FY2018, $300 million in FMF remains withheld from obligation until the Secretary of State certifies that Egypt is taking various steps toward supporting democracy and human rights  In previous acts, the amount withheld had been $195 million  FY2018 FMF for Egypt remains available to be expended until September 30, 2019  In August 2018, the Administration waived the certification requirement in Section 7041(a)(3)(B) of P L  115-31 , the Consolidated Appropriations Act, FY2017, allowing for the obligation of $195 million in FY2017 FMF, which occurred in September 2018  However, according to one report, Senator Patrick Leahy has placed a hold on $105 million in FY2017 FMF and is seeking more information on the plight of detained Egyptian-American Moustafa Kassem  In January 2018, the Administration notified Congress of its intent to obligate $1 039 billion in FY2017 FMF out of a total of $1 3 billion appropriated for FY2017  It chose not to obligate $65 7 million in FY2017 FMF  The remaining $195 million had been withheld until a national security waiver was issued in August 2018 (see above)  For FY2019, the President requested a total of $1 381 billion in foreign assistance for Egypt, the same amount requested for the previous year  Nearly all of the requested funds for Egypt are for the FMF account  For FY2020, the request is nearly identical from previous years, as the President is seeking a total of $1 382 billion in bilateral assistance for Egypt  The FY2019 Omnibus ( P L  116-6 ) provides the following for Egypt: a total of $1 419 billion in bilateral U S  foreign assistance for Egypt, of which $1 3 billion is in FMF, $112 5 million in ESF, $3 million in NADR, $2 million in INCLE, and $1 8 million in IMET; and a reauthorization of ESF to support future loan guarantees to Egypt; P L  116-6 sets the following conditions for Egypt: As in previous years, it requires that funds may only be made available when the Secretary of State certifies that the government of Egypt is sustaining the strategic relationship with the United States and meeting its obligations under the 1979 Egypt-Israel Peace Treaty  As in previous years, the act withholds ESF that "the Secretary determines to be equivalent to that expended by the United States Government for bail, and by nongovernmental organizations for legal and court fees, associated with democracy-related trials in Egypt until the Secretary certifies and reports to the Committees on Appropriations that the Government of Egypt has dismissed the convictions issued by the Cairo Criminal Court on June 4, 2013, in Public Prosecution Case No  1110 for the Year 2012 and has not subjected the defendants to further prosecution or if convicted they have been granted full pardons  " This last condition (bolded) was added in 2019 to account for the acquittal of the 43 foreign defendants in Case 173 (see above)  As in previous years, the FY2019 Omnibus also includes a limitation on ESF, stating that no FY2018 ESF or prior-year ESF "may be made available for a contribution, voluntary or otherwise, to the Civil Associations and Foundations Support Fund, or any similar fund, established pursuant to Law 70 on Associations and Other Foundations Working in the Field of Civil Work [informally known as the NGO law] " As in previous years, the act also includes a provision that withholds $300 million of FMF funds until the Secretary of State certifies that the Government of Egypt is taking effective steps to advance, among other things, democracy and human rights in Egypt  The Secretary of State may waive this certification requirement, though any waiver must be accompanied by, among other things, an assessment of the Government of Egypt's compliance with United Nations Security Council Resolution 2270 and other such resolutions regarding North Korea  There has been some concern in the Administration and Congress over Egypt's alleged weapons procurement from North Korea in recent years  P L  115-245 , the Department of Defense (DOD) and Labor, Health and Human Services, and Education Appropriations Act, 2019 and Continuing Appropriations Act, 2019, specifies that the Secretary of Defense may provide Egypt with funds from the Counter-ISIS Train and Equip Fund (CTEF) to enhance its border security  To date, Egypt has not received security assistance from DOD-managed accounts  Between 1946 and 2016, the United States provided Egypt with $78 3 billion in bilateral foreign aid (calculated in historical dollars—not adjusted for inflation)  The 1979 Peace Treaty between Israel and Egypt ushered in the current era of U S  financial support for peace between Israel and its Arab neighbors  In two separate memoranda accompanying the treaty, the United States outlined commitments to Israel and Egypt, respectively  In its letter to Israel, the Carter Administration pledged to "endeavor to take into account and will endeavor to be responsive to military and economic assistance requirements of Israel " In his letter to Egypt, former U S  Secretary of Defense Harold Brown wrote the following: In the context of the peace treaty between Egypt and Israel, the United States is prepared to enter into an expanded security relationship with Egypt with regard to the sales of military equipment and services and the financing of, at least a portion of those sales, subject to such Congressional review and approvals as may be required  All U S  foreign aid to Egypt (or any foreign recipient) is appropriated and authorized by Congress   The 1979 Egypt-Israel Peace Treaty is a bilateral peace agreement between Egypt and Israel, and the United States is not a legal party to the treaty  The treaty itself does not include any U S  aid obligations, and any assistance commitments to Israel and Egypt that could be potentially construed in conjunction with the treaty were through ancillary documents or other communications and were—by their terms—subject to congressional approval (see above)  However, as the peace broker between Israel and Egypt, the United States has traditionally provided foreign aid to both countries to ensure a regional balance of power and sustain security cooperation with both countries  In some cases, an Administration may sign a bilateral "Memorandum of Understanding" (MOU) with a foreign country pledging a specific amount of foreign aid to be provided over a selected time period subject to the approval of Congress  In the Middle East, the United States has signed foreign assistance MOUs with Israel and Jordan  Currently, there is no U S -Egyptian MOU specifying a specific amount of total U S  aid pledged to Egypt over a certain time period  Congress typically specifies a precise allocation of most foreign assistance for Egypt in the foreign operations appropriations bill  Egypt receives the bulk of foreign aid funds from three primary accounts: Foreign Military Financing (FMF), Economic Support Funds (ESF), and International Military Education and Training (IMET)  The United States offers IMET training to Egyptian officers in order to facilitate U S -Egyptian military cooperation over the long term  Since the 1979 Israeli-Egyptian Peace Treaty, the United States has provided Egypt with large amounts of military assistance  U S  policymakers have routinely justified this aid to Egypt as an investment in regional stability, built primarily on long-running military cooperation and sustaining the treaty—principles that are supposed to be mutually reinforcing  Egypt has used U S  military aid through the FMF to (among other things) purchase major U S  defense systems, such as the F-16 fighter aircraft, the M1A1 Abrams battle tank, and the AH-64 Apache attack helicopter  For decades, FMF grants have supported Egypt's purchases of large-scale conventional military equipment from U S  suppliers  However, as mentioned above, the Obama Administration announced that future FMF grants may only be used to purchase equipment specifically for "counterterrorism, border security, Sinai security, and maritime security" (and for sustainment of weapons systems already in Egypt's arsenal)  It is not yet clear how the Trump Administration will determine which U S -supplied military equipment would help the Egyptian military counter terrorism and secure its land and maritime borders  Overall, some defense experts continue to view the Egyptian military as inadequately prepared, both doctrinally and tactically, to face the threat posed by terrorist/insurgent groups such as Sinai Province  According to a former U S  National Security Council official, "they [the Egyptian military] understand they have got a problem in Sinai, but they have been unprepared to invest in the capabilities to deal with it " To reorient the military toward unconventional warfare, the Egyptian military needs, according to one assessment, "heavy investment into rapid reaction forces equipped with sophisticated infantry weapons, optics and communication gear     backed by enhanced intelligence, surveillance and reconnaissance platforms  In order to transport them, Egypt would also need numerous modern aviation assets " In addition to substantial amounts of annual U S  military assistance, Egypt has benefited from certain aid provisions that have been available to only a few other countries  For example Early Disbursal and Interest - Bearing Account : Between FY2001 and FY2011, Congress granted Egypt early disbursement of FMF funds (within 30 days of the enactment of appropriations legislation) to an interest-bearing account at the Federal Reserve Bank of New York  Interest accrued from the rapid disbursement of aid has allowed Egypt to receive additional funding for the purchase of U S -origin equipment  In FY2012, Congress began to condition the obligation of FMF, requiring the Administration to certify certain conditions had been met before releasing FMF funds, thereby eliminating their automatic early disbursal  However, Congress has permitted Egypt to continue to earn interest on FMF funds already deposited in the Federal Reserve Bank of New York  The Excess Defense Articles (EDA) program provides one means by which the United States can advance foreign policy objectives—assisting friendly and allied nations through provision of equipment in excess of the requirements of its own defense forces  The Defense Security Cooperation Agency (DSCA) manages the EDA program, which enables the United States to reduce its inventory of outdated equipment by providing friendly countries with necessary supplies at either reduced rates or no charge  As a designated "major non-NATO ally," Egypt is eligible to receive EDA under Section 516 of the Foreign Assistance Act and Section 23(a) of the Arms Export Control Act  Over the past two decades, U S  economic aid to Egypt has been reduced by over 90%, from $833 million in FY1998 to a request of $75 million for FY2019  Beginning in the mid to late 1990s, as Egypt moved from an impoverished country to a lower-middle-income economy, the United States and Egypt began to rethink the assistance relationship, emphasizing "trade not aid " Congress began to scale back economic aid both to Egypt and Israel due to a 10-year agreement reached between the United States and Israel in the late 1990s known as the "Glide Path Agreement," which gradually reduced U S  economic aid to Egypt to $400 million by 2008  U S  economic aid to Egypt stood at $200 million per year by the end of the George W  Bush Administration, whose relations with then-President Hosni Mubarak suffered over the latter's reaction to the Administration's democracy agenda in the Arab world  During the final years of the Obama Administration, distrust of U S  democracy promotion assistance led the Egyptian government to obstruct many U S -funded economic assistance programs  According to the Government Accountability Office (GAO), the Department of State and the U S  Agency for International Development (USAID) reported hundreds of millions of dollars ($460 million as of 2015) in unobligated prior year ESF funding  As these unobligated balances grew, it created pressure on the Obama Administration to reobligate ESF funds for other purposes  In 2016, the Obama Administration notified Congress that it was reprogramming $108 million of ESF that had been appropriated for Egypt in FY2015 but remained unobligated for other purposes  The Administration claimed that its actions were due to "continued government of Egypt process delays that have impeded the effective implementation of several programs " In 2017, the Trump Administration also reprogrammed FY2016 ESF for Egypt  U S  economic aid to Egypt is divided into two components: (1) USAID-managed programs (public health, education, economic development, democracy and governance); and (2) the U S -Egyptian Enterprise Fund  Both are funded primarily through the Economic Support Fund (ESF) appropriations account  

ground_truth: Unwanted sexual behaviors in the military—including sexual harassment, sexual assault, and domestic violence involving sexual assault—undermine core values, unit cohesion, combat readiness, and public goodwill. Recent studies suggest that these behaviors are part of a “continuum of harm,” which DOD defines as a range of interconnected, inappropriate behaviors that are connected to the occurrence of sexual assault and that support an environment that tolerates these behaviors. Senate Report 114-255 included a provision for GAO to review efforts by DOD to prevent unwanted sexual behaviors in the military. GAO assessed the extent to which DOD has (1) policies on sexual harassment that include CDC principles and relevant legislative elements; (2) processes for maintaining and reporting consistent data on incidents of unwanted sexual behaviors; and (3) overarching efforts, including a prevention strategy, to address unwanted sexual behaviors across the continuum of harm. GAO reviewed DOD policies and pertinent databases, and interviewed agency officials. The Department of Defense's (DOD) policies on sexual harassment include some but not all of the Centers for Disease Control's (CDC) principles for preventing sexual violence and include most relevant legislative elements. GAO identified six principles from CDC's framework for preventing sexual violence, which CDC defines as including sexual harassment. GAO found that Office of the Secretary of Defense (OSD) and military service policies generally include CDC's principles regarding prevention strategies, but none address risk and protective factors, which identify conditions or behaviors that might heighten or lower the risk of sexual harassment victimization or perpetration, respectively. Additionally, a statutory provision in fiscal year 2013 mandated that DOD, among other things, develop a comprehensive sexual harassment policy that includes prevention training, mechanisms for anonymous reporting, and mechanisms for resolving incidents of sexual harassment. OSD and service policies are generally consistent with those required elements except for the inclusion of anonymous reporting. DOD is developing a new department-wide policy that will address sexual harassment, but it is too early to determine how the policy will address these issues. Without policies that include CDC's principles and mechanisms for anonymous reporting, DOD may miss opportunities to address and potentially reduce incidents of unwanted sexual behaviors. Finally, a statutory change in fiscal year 2017 redefined sexual harassment for certain purposes so it is no longer defined solely as a form of sex discrimination but is recognized also as an adverse behavior on the spectrum of behavior that can contribute to an increase in the incidence of sexual assault. While officials indicated a need to update policies, they were unclear on the full implications, if any, of this change. DOD has processes for maintaining and reporting consistent data on incidents of unwanted sexual behaviors including sexual assault and incidents of domestic violence that involve sexual assault, but does not have similar processes for maintaining and reporting data on incidents of sexual harassment. Specifically, DOD uses centralized databases to maintain and report data on incidents of sexual assault and domestic violence that involve sexual assault, but relies on military service-specific databases for information on incidents of sexual harassment. DOD has not established standard data elements and definitions to guide the services in maintaining and reporting data on sexual harassment. Inconsistencies in data elements and definitions generally mean that one service may be maintaining data that is more or less detailed than, or that differs from, the data maintained by other services. Such inconsistencies may create difficulties in reporting department-wide sexual harassment data, since the individual service data must be adapted to fit reporting requirements. DOD has several overarching efforts to address unwanted sexual behaviors across the continuum of harm, including developing an overarching prevention strategy. However, it is unclear whether the strategy under development will contain key elements for long-term and results-oriented strategic planning such as long-term goals, strategies to achieve goals, and metrics to gauge progress. Without incorporating these elements into its overarching prevention strategy, DOD may not be in a position to effectively coordinate and integrate prevention activities and reduce instances of unwanted sexual behaviors. GAO recommends that DOD fully include in its new policy on sexual harassment CDC's principles for sexual violence prevention and mechanisms for anonymous reporting, develop standard data elements and definitions for reporting sexual harassment incidents, and incorporate in its overarching prevention strategy elements key for a long-term, results-oriented strategy. DOD generally concurred with the recommendations.