prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: As reported by the United Nations, the International Criminal Police Organization, and other organizations, wildlife trafficking networks span the globe  These organizations have attempted to measure the value of illegally traded wildlife, but available estimates are subject to uncertainty  In 2016, for example, the United Nations Environment Programme (UNEP) reported that various sources estimated the global scale of illegal wildlife trade to be from $7 billion to $23 billion annually  UNEP also estimated that the scale of wildlife crime has increased in recent years in part based on a rise in environmental crime  U S  trade in wildlife and related products includes a variety of species, such as live reptiles, birds, and mammals, as well as elephant ivory, according to law enforcement reports and government and nongovernmental officials  FWS and NOAA data on wildlife products seized at U S  ports provide examples of the diversity of illegally traded plants, fish, and wildlife imported into or exported from the United States  For example, from 2007 to 2016, the top 10 plant, fish, and wildlife shipments seized nationally by FWS were coral, crocodiles, conchs, deer, pythons, sea turtles, mollusks, ginseng, clams, and seahorses  During that time, FWS reported that more than one-third of the wildlife shipments it seized were confiscated while being imported from or exported to Mexico (14 percent), China (13 percent), or Canada (9 percent)  FWS and NOAA law enforcement offices are responsible for enforcing certain laws and treaties prohibiting wildlife trafficking  FWS Office of Law Enforcement  This office enforces certain U S  laws and regulations as well as treaties prohibiting the trafficking of terrestrial wildlife, freshwater species, and birds  Among other things, the office aims to prevent the unlawful import, export, and interstate commerce of foreign fish and wildlife, as well as to protect U S  plants, fish, and wildlife from unlawful exploitation  As of fiscal year 2016, the office had a budget of $74 7 million and employed 205 special agents to investigate wildlife crime, including international and domestic wildlife trafficking rings  Most of these special agents report to one of eight regional offices, which receive national oversight, support, training, and policy guidance from the FWS Office of Law Enforcement headquarters  The office’s headquarters houses a special investigative unit focused on conducting complex, large- scale criminal investigations of wildlife traffickers  In addition, the FWS Office of Law Enforcement has deployed special agents to serve as international attachés at seven U S  embassies  These attachés provide countertrafficking expertise to embassy staff, work with host government officials to build law enforcement capacity, and contribute directly to casework or criminal investigations of wildlife traffickers  According to FWS data, the FWS Office of Law Enforcement opened more than 7,000 investigations on wildlife trafficking and other illegal activities in fiscal year 2016, including nearly 5,000 cases involving Endangered Species Act violations and nearly 1,500 cases involving Lacey Act violations  FWS Office of Law Enforcement investigations have disrupted wildlife trafficking operations  For example, Operation Crash—an ongoing rhino horn and elephant ivory-trafficking investigation launched in 2011—has led to over 30 convictions and more than $2 million in fines  NOAA Office of Law Enforcement  This office enforces certain U S  laws and regulations as well as treaties prohibiting the trafficking of marine wildlife, including fish, as well as anadromous fish  Among other things, the office aims to prevent the illegal, unregulated, and unreported harvesting and trade of fish as well as the trafficking of protected marine wildlife  As of fiscal year 2016, the office had a budget of $68 6 million and employed 77 special agents to investigate wildlife crimes within its jurisdiction  These agents report to one of five regional offices, and those offices receive national oversight, support, and policy guidance from the NOAA Office of Law Enforcement headquarters  According to NOAA data, the NOAA Office of Law Enforcement initiated more than 5,000 investigations in fiscal year 2016  About half of those investigations involved violations of the Magnuson-Stevens Fishery Conservation and Management Act, as amended, and some of the 5,000 investigations involved violations of the Endangered Species Act or the Lacey Act  NOAA Office of Law Enforcement investigations have disrupted wildlife trafficking operations  For example, in fiscal year 2016, a NOAA Office of Law Enforcement investigation led to the conviction of a company and five individuals for illegally trafficking whale bone carvings, walrus ivory carvings, black coral carvings, and other products derived from protected species into the United States  The FWS and NOAA law enforcement offices collaborate with other government agencies and organizations to combat wildlife trafficking  Both agencies work with other federal, state, and tribal law enforcement officers as well as their international counterparts as needed during wildlife trafficking investigations  For example, FWS and NOAA work with U S  Customs and Border Protection, U S  Immigration and Customs Enforcement, and the U S  Department of Agriculture to maintain import and export controls and interdict smuggled wildlife and related products at U S  ports of entry  In addition, FWS and NOAA collaborate with Department of Justice prosecutors on criminal cases that result from agency investigations  Both agencies also collaborate with nongovernmental organizations to combat wildlife trafficking  For example, FWS and NOAA officials said that nongovernmental organizations have, in some cases, offered financial rewards (in addition to rewards offered by FWS and NOAA) for information on a wildlife crime  In addition, some nongovernmental organizations proactively provide information to FWS and NOAA on wildlife trafficking activities in the United States or foreign countries that violate U S  laws  For example, in 2017, a nongovernmental organization created a website to collect tips on wildlife crime and to connect the sources of those tips with relevant U S  authorities for potential financial rewards  FWS may pay financial rewards from moneys in two accounts  Law Enforcement Reward Account  FWS may pay rewards under the Endangered Species Act, the Lacey Act, and the Rhinoceros and Tiger Conservation Act from moneys in the agency’s Law Enforcement Reward Account  The moneys in this account come from fines, penalties, and proceeds from forfeited property for violations of these three laws  According to FWS officials, these moneys are available until expended  These moneys can be used to (1) pay financial rewards to those who provide information that leads to an arrest, criminal conviction, civil penalty assessment, or forfeiture of property for any violation of the Endangered Species Act, the Lacey Act, or the Rhinoceros and Tiger Conservation Act or (2) provide temporary care for plants, fish, or wildlife that are the subject of a civil or criminal proceeding under the Endangered Species Act, Lacey Act, or the Rhinoceros and Tiger Conservation Act  As of the beginning of fiscal year 2017, the balance of the Law Enforcement Reward Account was about $7 million  Law Enforcement Special Funds Account  FWS may also pay rewards from moneys in its law enforcement office’s Special Funds Account  The moneys in this account come from an annual line item appropriation and are available until expended  Since fiscal year 1988, this appropriation has provided FWS up to $400,000 each year to pay for information, rewards, or evidence concerning violations of laws FWS administers, as well as miscellaneous and emergency expenses of enforcement activity that the Secretary of the Interior authorized or approved  NOAA generally pays rewards from moneys available in the Fisheries Enforcement Asset Forfeiture Fund  The moneys in this account come from fines, penalties, and proceeds from forfeited property for violations of marine resource laws that NOAA enforces, including the Magnuson- Stevens Fishery Conservation and Management Act, the Endangered Species Act, and the Lacey Act  According to NOAA officials, moneys are available until expended and can be used to pay certain enforcement- related expenses, including travel expenses, equipment purchases, and the payment of financial rewards  As of the beginning of fiscal year 2017, the Fisheries Enforcement Asset Forfeiture Fund had a balance of about $18 million  Academic literature on the use of financial rewards to combat illegal activities and stakeholders we interviewed identified several advantages and disadvantages of using financial rewards to obtain information on wildlife trafficking  Potential advantages of using financial rewards include the following: Providing incentives  The potential for a financial reward can motivate people with information to come forward when they otherwise might not do so  Increasing public awareness  Financial rewards may bring greater public attention to the problem of wildlife trafficking, including federal efforts to combat wildlife trafficking  Saving resources  Using financial rewards may save agency resources by enabling agents to get information sooner and at a lower cost than they could have through their own efforts  Potential disadvantages of using financial rewards include the following: Eliciting false or unproductive leads  Financial rewards may generate false or unproductive leads  Affecting witness credibility  Financial rewards may lead to a source’s credibility being challenged at trial by defense attorneys since sources receive compensation for the information they provide  Consuming resources  The potential for a financial reward may create a flood of tips that take agency time and resources to follow up on or corroborate  Outside of wildlife trafficking, multiple federal agencies and federal courts are authorized to pay financial rewards for information on illegal activities under certain circumstances  For example, U S  Customs and Border Protection—which controls, regulates, and facilitates the import and export of goods through U S  ports of entry—is authorized, under certain circumstances, to pay rewards for original information about violations of any laws that it enforces  The Department of State may also pay rewards under certain circumstances, including for information leading to the disruption of financial mechanisms of a transnational criminal group  Similarly, the U S  Securities and Exchange Commission (SEC) and Internal Revenue Service (IRS) may pay rewards for information about violations of federal securities laws and the underpayment of taxes, respectively, if certain conditions are met  Federal judges may award money to persons who give information leading to convictions for violating treaties, laws, and regulations that prohibit certain pollution from ships, including oil and garbage discharges  FWS and NOAA officials identified multiple laws, such as the Endangered Species Act and the Lacey Act, that authorize the payment of financial rewards to people who provide information on wildlife trafficking  FWS and NOAA reported paying few financial rewards under these laws from fiscal years 2007 through 2017  However, agency officials could not provide sufficient assurance that the reward information they provided to us represented all of their reward payments for this period  FWS and NOAA officials identified over 10 laws prohibiting wildlife trafficking—including the Endangered Species Act, Lacey Act, and Bald and Golden Eagle Protection Act—that specifically authorize the payment of financial rewards in certain circumstances to people who provide information on violations of the law (see app  II for a complete list of the laws)  These laws provide discretion to the agencies to choose whether to pay rewards but have varying requirements for who is eligible to receive a reward and the payment amounts  For example, the Bald and Golden Eagle Protection Act caps rewards at $2,500 for information that leads to a conviction  In contrast, the Endangered Species Act does not cap reward amounts and authorizes rewards for information that leads to a conviction as well as to an arrest, civil penalty, or forfeiture of property  Table 1 identifies the laws that FWS and NOAA officials indicated they have used to pay financial rewards for information on wildlife trafficking from fiscal years 2007 through 2017, along with information on these laws’ requirements for payment of rewards  FWS and NOAA reported paying few financial rewards for information on wildlife trafficking from fiscal years 2007 through 2017, but agency officials could not provide sufficient assurance that this information was complete  Officials from both agencies said that their agencies have not prioritized the use of rewards, and they believed that the reward information they identified—such as the number, dollar amount, and year that rewards were paid—appropriately captured the few reward payments they made during this time frame  Based on the agencies’ reviews of their records, FWS reported paying 25 rewards for a total of $184,500 from fiscal years 2007 through 2017, and NOAA reported paying 2 rewards for a total of $21,000 during that same period (see table 2)  See appendix III for additional details on the cases where financial rewards were paid  FWS reported paying rewards in trafficking cases involving a variety of wildlife species, such as eagles, bears, reptiles, and mollusks, across the 11-year period  FWS officials said they generally paid rewards to thank sources who proactively provided information  For example, based on our review of a reward case, FWS paid a reward in 2010 because the source provided information that was crucial in uncovering an attempt to illegally traffic leopards into the United States from South Africa  FWS would not have known about this illegal activity if the source had not come forward with the information  In several cases we reviewed, FWS officials said that the sources did not know about the possibility of receiving a reward when they contacted the agency with information  The two rewards NOAA reported paying from fiscal years 2007 through 2017 involved the illegal trafficking of sea scallops and a green sea turtle  NOAA officials said that in both cases they paid a reward to thank the source who proactively provided information to law enforcement agents  For example, the agent who investigated the sea scallop case reported requesting the reward because the information the source proactively provided was timely, credible, and led to the criminal conviction of several individuals  FWS and NOAA officials could not provide sufficient assurance that the reward information they reported to us represented all of the rewards their agencies had paid from fiscal years 2007 through 2017, but they said the information was complete to the best of their knowledge  Specifically, FWS and NOAA officials said they track all their expenditures, including reward payments, in their financial databases  However, they are not able to readily identify reward payments because their financial systems do not include a unique identifier for such payments and their reward information is located in multiple databases and formats  As a result, FWS and NOAA officials said they identified the rewards they reported to us by manually reviewing their financial and law enforcement records  In particular, FWS officials said they reviewed their paper records to identify instances when the agency paid rewards and then retrieved additional information from their financial and law enforcement databases, such as final payment amounts  NOAA officials said they identified instances when the agency paid rewards by using a combination of paper and electronic records located at NOAA’s headquarters office  NOAA officials also contacted their regions to obtain additional information located at the regional offices to confirm information about the rewards NOAA had paid  Seventeen stakeholders we interviewed who had experience investigating wildlife trafficking or expertise in using financial rewards as a law enforcement tool said that it would be useful for FWS and NOAA to maintain comprehensive information on the rewards they paid  For example, two stakeholders said that maintaining comprehensive information and making that information available to law enforcement agents could motivate agents to make greater use of rewards as a law enforcement tool  Two other stakeholders said that maintaining information on and monitoring reward use would allow the agencies to make ongoing adjustments, such as adjusting payment amounts, to make the most effective use of rewards in combating wildlife trafficking  Federal internal control standards say that management should clearly document internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination  Control activities can be implemented in either an automated or a manual manner, but automated control activities tend to be more reliable because they are less susceptible to human error and are typically more efficient  FWS and NOAA officials agreed that maintaining reward information so that complete information is easily retrievable may be beneficial  FWS officials said having clearly documented and readily available reward information could improve how they manage rewards and enable them to monitor and examine their use of rewards more holistically  The officials said they may analyze options for creating a single repository for reward information but did not commit to doing so  They said that creating a single repository for reward information may involve some drawbacks, such as duplicating some data entry in separate databases  Similarly, NOAA officials said having clearly documented and readily available reward information would provide agency management with easier and more consistent access to that information  As a result, they said that they are exploring modifications to their financial and law enforcement databases to better identify and track rewards  For example, NOAA officials said they may be able to create a unique identifier to flag payments that are for rewards in their financial system to enable them to identify payment amounts more easily  NOAA officials did not provide a time frame for completing modifications to their financial system  By tracking reward information so that it is clearly documented and readily available for examination, FWS and NOAA can better ensure that they have complete information on the rewards they have paid to help manage their use of rewards as a law enforcement tool  FWS and NOAA have policies to guide their law enforcement agents on the process for preparing and submitting a request to pay a financial reward  Specifically, both agencies’ policies call for agents to include a description of the case, the nature of the information that the source provided, a justification for providing a reward, and an explanation of how a proposed reward amount was developed  These policies also outline the general review and approval process, how payments are to be made upon approval of a request, and eligibility criteria to receive a reward  For example, FWS and NOAA policies prohibit paying rewards to foreign government officials as well as paying rewards to any person whose receipt of a reward would create a conflict of interest or the appearance of impropriety  NOAA’s policy explicitly states that the NOAA Office of Law Enforcement is to use statutorily authorized rewards as a tool to obtain information from the public on resource violations and that rewards can help promote compliance with marine resource laws  NOAA’s policy suggests that agents consider advertising reward offers to assist investigations, encourages press releases, and describes the process agents should follow to do so  Moreover, NOAA’s policy specifies factors that agents might include in their reward requests to support the proposed reward, such as (1) the benefit to the marine resources that was furthered by the information provided; (2) the risk, if any, the individual took in collecting and providing the information; (3) the probability that the investigation would have been successfully concluded without the information provided; and (4) the relationship between any fines or other collections and the information provided  FWS’s policy specifies that rewards may be provided in situations in which an individual furnishes essential information leading to an arrest, conviction, civil penalty, or forfeiture of property  However, it does not discuss the usefulness of financial rewards as a law enforcement tool or the types of circumstances when rewards should be used or advertised to the public  Further, FWS’s policy does not communicate necessary quality information internally that agents may need when deciding to request the payment of rewards  In particular, it does not specify factors for agents to consider when developing proposed reward amounts  Instead, the policy leaves it to the discretion of field and regional agents to develop proposed reward amounts within any limitations specified in law  Some FWS agents we interviewed said that they developed proposed reward amounts on a case-by-case basis and did not know whether their proposed amounts were enough, too little, or too much  In addition, some agents said that because FWS’s policy does not specify factors for agents to consider, the reward approval process is subjective and unclear and this has made it challenging for the agents to develop proposed reward amounts  For example, one agent we interviewed said he submitted a request to his supervisor to pay a $10,000 reward to a source who provided information on a major wildlife trafficker  But, for reasons unknown to the agent, his supervisor reduced the amount to $1,000  FWS headquarters officials said field agents submit reward requests to headquarters for approval, and these officials were not aware of instances of proposed reward amounts being changed or denied during the review process  Seven of the 20 stakeholders we interviewed suggested that FWS augment its reward policy to specify factors for agents to consider when developing proposed reward amounts
Report 2:  The estimate accounts for all possible costs associated with a program, is structured in sufficient detail to ensure that costs are neither omitted nor double counted, and documents all cost-influencing assumptions  Well-documented  Supporting documentation explains the process, sources, and methods used to create the estimate; contains the underlying data used to develop the estimate; and is adequately reviewed and approved by management  Accurate  The estimate is not overly conservative or optimistic, is based on an assessment of the costs most likely to be incurred, and is regularly updated so that it always reflects the program’s current status  Credible  Discusses any limitations of the analysis because of uncertainty or sensitivity surrounding data or assumptions, the estimate’s results are cross-checked, and an independent cost estimate is conducted by a group outside the acquiring organization to determine whether other estimating methods produce similar results  In May 2017, DHS approved GMM’s lifecycle cost estimate of about $251 million for fiscal years 2015 through 2030  We found this initial estimate to be reliable because it fully or substantially addressed all the characteristics associated with a reliable cost estimate  For example, the estimate comprehensively included government and contractor costs, all elements of the program’s work breakdown structure, and all phases of the system lifecycle; and was aligned with the program’s technical documentation at the time the estimate was developed  GMM also fully documented the key assumptions, data sources, estimating methodology, and calculations for the estimate  Further, the program conducted a risk assessment and sensitivity analysis, and DHS conducted an independent assessment of the cost estimate to validate the accuracy and credibility of the cost estimate  However, key assumptions that FEMA made about the program changed soon after DHS approved the cost estimate in May 2017  Thus, the initial cost estimate no longer reflects the current approach for the program  For example, key assumptions about the program that changed include: Change in the technical approach: The initial cost estimate assumed that GMM would implement a software-as-a-service model, meaning that FEMA would rely on a service provider to deliver software applications and the underlying infrastructure to run them  However, in December 2017, the program instead decided to implement an infrastructure-as-a-service model, meaning that FEMA would develop and deploy its own software application and rely on a service provider to deliver and manage the computing infrastructure (e g , servers, software, storage, and network equipment)  According to program officials, this decision was made after learning from the Agile prototypes that the infrastructure-as-a-service model would allow GMM to develop the system in a more flexible environment  Increase in the number of system development personnel: A key factor with Agile development is the number of development teams (each consisting of experts in software development, testing, and cybersecurity) that are operating concurrently and producing separate portions of software functionality  Program officials initially assumed that they would need three to four concurrent Agile development teams, but subsequently realized that they would instead need to expend more resources to achieve GMM’s original completion date  Specifically, program officials now expect they will need to at least double, and potentially triple, the number of concurrent development teams to meet GMM’s original target dates  Significant delays and complexities with data migration: In 2016 and 2017, GMM experienced various technical challenges in its effort to transfer legacy system data to a data staging platform  This data transfer effort needed to be done to standardize the data before eventually migrating the data to GMM  These challenges resulted in significant delays and cost increases  Program officials reported that, by February 2018—at least 9 months later than planned—all legacy data had been transferred to a data staging platform so that FEMA officials could begin analyzing and standardizing the data prior to migrating it into GMM  FEMA officials reported that they anticipated the cost estimate to increase, and for this increase to be high enough to breach the $251 million threshold set in GMM’s May 2017 acquisition program baseline  Thus, consistent with DHS’s acquisition guidance, the program informed the DHS acquisition review board of this anticipated breach  The board declared that the program was in a cost breach status, as of September 12, 2018  As of October 2018, program officials stated that they were in the process of revising the cost estimate to reflect the changes in the program and to incorporate actual costs  In addition, the officials stated that the program was applying a new cost estimating methodology tailored for Agile programs that DHS’s Cost Analysis Division had been developing  In December 2018, program officials stated that they had completed the revised cost estimate but it was still undergoing departmental approval  Establishing an updated cost estimate should help FEMA better understand the expected costs to deliver GMM under the program’s current approach and time frames  The success of an IT program depends, in part, on having an integrated and reliable master schedule that defines when the program’s set of work activities and milestone events are to occur, how long they will take, and how they are related to one another  Among other things, a reliable schedule provides a roadmap for systematic execution of an IT program and the means by which to gauge progress, identify and address potential problems, and promote accountability  GAO’s Schedule Assessment Guide defines leading practices related to the following four characteristics that are vital to having a reliable integrated master schedule  Comprehensive  A comprehensive schedule reflects all activities for both the government and its contractors that are necessary to accomplish a program’s objectives, as defined in the program’s work breakdown structure  The schedule also includes the labor, materials, and overhead needed to do the work and depicts when those resources are needed and when they will be available  It realistically reflects how long each activity will take and allows for discrete progress measurement  Well-constructed  A schedule is well-constructed if all of its activities are logically sequenced with the most straightforward logic possible  Unusual or complicated logic techniques are used judiciously and justified in the schedule documentation  The schedule’s critical path represents a true model of the activities that drive the program’s earliest completion date and total float accurately depicts schedule flexibility  Credible  A schedule that is credible is horizontally traceable—that is, it reflects the order of events necessary to achieve aggregated products or outcomes  It is also vertically traceable—that is, activities in varying levels of the schedule map to one another and key dates presented to management in periodic briefings are consistent with the schedule  Data about risks are used to predict a level of confidence in meeting the program’s completion date  The level of necessary schedule contingency and high-priority risks are identified by conducting a robust schedule risk analysis  Controlled  A schedule is controlled if it is updated regularly by trained schedulers using actual progress and logic to realistically forecast dates for program activities  It is compared to a designated baseline schedule to measure, monitor, and report the program’s progress  The baseline schedule is accompanied by a baseline document that explains the overall approach to the program, defines ground rules and assumptions, and describes the unique features of the schedule  The baseline schedule and current schedule are subject to a configuration management control process  GMM’s schedule was unreliable because it minimally addressed three characteristics—comprehensive, credible, and controlled—and did not address the fourth characteristic of a reliable estimate—well-constructed  One of the most significant issues was that the program’s fast approaching, final delivery date of September 2020 was not informed by a realistic assessment of GMM development activities, and rather was determined by imposing an unsubstantiated delivery date  Table 4 summarizes our assessment of GMM’s schedule  In discussing the reasons for the shortfalls in these practices, program officials stated that they had been uncertain about the level of rigor that should be applied to the GMM schedule, given their use of Agile development  However, leading practices state that program schedules should meet all the scheduling practices, regardless of whether a program is using Agile development  As discussed earlier in this report, GMM has already experienced significant schedule delays  For example, the legacy data migration effort, the AFG pilot, and the Agile development contract have been delayed  Program officials also stated that the delay in awarding and starting the Agile contract has delayed other important activities, such as establishing time frames for transitioning legacy systems  A more robust schedule could have helped FEMA predict the impact of delays on remaining activities and identify which activities appeared most critical so that the program could ensure that any risks in delaying those activities were properly mitigated  In response to our review and findings, program officials recognized the need to continually enhance their schedule practices to improve the management and communication of program activities  As a result, in August 2018, the officials stated that they planned to add a master scheduler to the team to improve the program’s schedule practices and ensure that all of the areas of concern we identified are adequately addressed  In October 2018, the officials reported that they had recently added two master schedulers to GMM  According to the statement of objectives, the Agile contractor is expected to develop an integrated master schedule soon after it begins performance  However, program officials stated that GMM is schedule-driven—due to the Executive Steering Group’s expectation that the solution will be delivered by September 2020  The officials added that, if GMM encounters challenges in meeting this time frame, the program plans to seek additional resources to allow it to meet the 2020 target  GMM’s schedule-driven approach has already led to an increase in estimated costs and resources  For example, as previously mentioned, the program has determined that, to meet its original target dates, GMM needs to at least double, and possibly triple, the number of concurrent Agile development teams  In addition, we have previously reported that schedule pressure on federal IT programs can lead to omissions and skipping of key activities, especially system testing  In August 2018, program officials acknowledged that September 2020 may not be feasible and that the overall completion time frames established in the acquisition program baseline may eventually need to be rebaselined  Without a robust schedule to forecast whether FEMA’s aggressive delivery goal for GMM is realistic to achieve, leadership will be limited in its ability to make informed decisions on what additional increases in cost or reductions in scope might be needed to fully deliver the system  NIST’s risk management framework establishes standards and guidelines for agencies to follow in developing cybersecurity programs  Agencies are expected to use this framework to achieve more secure information and information systems through the implementation of appropriate risk mitigation strategies and by performing activities that ensure that necessary security controls are integrated into agencies’ processes  The framework addresses broad cybersecurity and risk management activities, which include the following: Categorize the system: Programs are to categorize systems by identifying the types of information used, selecting a potential impact level (e g , low, moderate, or high), and assigning a category based on the highest level of impact to the system’s confidentiality, integrity, and availability, if the system was compromised  Programs are also to document a description of the information system and its boundaries and should register the system with appropriate program management offices  System categorization is documented in a system security plan  Select and implement security controls: Programs are to determine protective measures, or security controls, to be implemented based on the system categorization results  These security controls are documented in a system security plan  For example, control areas include access controls, incident response, security assessment and authorization, identification and authentication, and configuration management  Once controls are identified, programs are to determine planned implementation actions for each of the designated controls  These implementation actions are also specified in the system security plan  Assess security controls: Programs are to develop, review, and approve a security assessment plan  The purpose of the security assessment plan approval is to establish the appropriate expectations for the security control assessment  Programs are to also perform a security control assessment by evaluating the security controls in accordance with the procedures defined in the security assessment plan, in order to determine the extent to which the controls were implemented correctly  The output of this process is intended to produce a security assessment report to document the issues, findings, and recommendations  Programs are to conduct initial remediation actions on security controls and reassess those security controls, as appropriate  Obtain an authorization to operate the system: Programs are to obtain security authorization approval in order to operate a system  Resolving weaknesses and vulnerabilities identified during testing is an important step leading up to achieving an authorization to operate  Programs are to establish corrective action plans to address any deficiencies in cybersecurity policies, procedures, and practices  DHS guidance also states that corrective action plans must be developed for every weakness identified during a security control assessment and within a security assessment report  Monitor security controls on an ongoing basis: Programs are to monitor their security controls on an ongoing basis after deployment, including determining the security impact of proposed or actual changes to the information system and assessing the security controls in accordance with a monitoring strategy that determines the frequency of monitoring the controls  For the GMM program’s engineering and test environment, which went live in February 2018, FEMA fully addressed three of the five key cybersecurity practices in NIST’s risk management framework and partially addressed two of the practices  Specifically, FEMA categorized GMM’s environment based on security risk, implemented select security controls, and monitored security controls on an ongoing basis  However, the agency partially addressed the areas of assessing security controls and obtaining an authorization to operate the system  Table 5 provides a summary of the extent to which FEMA addressed NIST’s key cybersecurity practices for GMM’s engineering and test environment  Consistent with NIST’s framework, GMM categorized the security risk of its engineering and test environment and identified it as a moderate- impact environment  A moderate-impact environment is one where the loss of confidentiality, integrity, or availability could be expected to have a serious or adverse effect on organizational operations, organizational assets, or individuals  GMM completed the following steps leading to this categorization: The program documented in its System Security Plan the various types of data and information that the environment will collect, process, and store, such as conducting technology research, building or enhancing technology, and maintaining IT networks  The program established three information types and assigned security levels of low, moderate, or high impact in the areas of confidentiality, availability, and integrity  A low-impact security level was assigned to two information types: (1) conducting technology research and (2) building or enhancing technology; and a moderate- impact security level was assigned to the third information type: maintaining IT networks  The engineering and test environment was categorized as an overall moderate-impact system, based on the highest security impact level assignment  GMM documented a description of the environment, including a diagram depicting the system’s boundaries, which illustrates, among other things, databases and firewalls  GMM properly registered its engineering and test environment with FEMA’s Chief Information Officer, Chief Financial Officer, and acting Chief Information Security Officer  By conducting the security categorization process, GMM has taken steps that should ensure that the appropriate security controls are selected for the program’s engineering and test environment  Consistent with NIST’s framework and the system categorization results, GMM appropriately determined which security controls to implement and planned actions for implementing those controls in its System Security Plan for the engineering and test environment  For example, the program utilized NIST guidance to select standard controls for a system categorized with a moderate-impact security level  These control areas include, for example, access controls, risk assessment, incident response, identification and authentication, and configuration management  Further, the program documented its planned actions to implement each control in its System Security Plan  For example, GMM documented that the program plans to implement its Incident Response Testing control by participating in an agency-wide exercise and unannounced vulnerability scans  As another example, GMM documented that the program plans to implement its Contingency Plan Testing control by testing the contingency plan annually, reviewing the test results, and preparing after action reports  By selecting and planning for the implementation of security controls, GMM has taken steps to mitigate its security risks and protect the confidentiality, integrity, and availability of the information system  Consistent with NIST’s framework, in January 2018, GMM program officials developed a security assessment plan for the engineering and test environment  According to GMM program officials, this plan was reviewed by the security assessment team  However, the security assessment plan lacked essential details  Specifically, while the plan included the general process for evaluating the environment’s security controls, the planned assessment procedures for all 964 security controls were not sufficiently defined  Specifically, GMM program officials copied example assessment procedures from NIST guidance and inserted them into its security assessment documentation for all of its 964 controls, without making further adjustments to explain the steps that should be taken specific to GMM  Table 6 shows an example of a security assessment procedure copied from the NIST guidance that should have been further adjusted for GMM  In addition, the actual assessment procedures that the GMM assessors used to evaluate the security controls were not documented  Instead, the program only documented whether each control passed or failed each test  GMM program officials stated that the planned assessment procedures are based on an agency template that was exported from a DHS compliance tool, and that FEMA security officials have been instructed by the DHS OCIO not to tailor or make any adjustments to the template language  However, the assessment procedures outlined in NIST’s guidance are to serve as a starting point for organizations preparing their program specific assessments  According to NIST, organizations are expected to select and tailor their assessment procedures for each security control from NIST’s list of suggested assessment options (e g , review, analyze, or inspect policies, procedures, and related documentation options)  DHS OCIO officials stated that, consistent with NIST’s guidance, they expect that components will ensure they are in compliance with the minimum standards and will also add details and additional rigor, as appropriate, to tailor the planned security assessment procedures to fit their unique missions or needs  In November 2018, in response to our audit, DHS OCIO officials stated that they were meeting with FEMA OCIO officials to understand why they did not document the planned and actual assessment procedures performed by the assessors for GMM  Until FEMA ensures that detailed planned evaluation methods and actual evaluation procedures specific to GMM are defined, the program risks assessing security controls incorrectly, having controls that do not work as intended, and producing undesirable outcomes with respect to meeting the security requirements  In addition, the security assessment plan was not approved by FEMA’s OCIO before proceeding with the security assessment  Program officials stated that approval was not required for the security assessment plan prior to the development of the security assessment report  However, NIST guidance states that the purpose of the security assessment plan approval is to establish the appropriate expectations for the security control assessment  By not getting the security assessment plan approved by FEMA’s OCIO before security assessment reviews were conducted, GMM risks inconsistencies with the plan and security objectives of the organization  Finally, consistent with NIST guidance, GMM performed a security assessment in December 2017 of the engineering and test environment’s controls, which identified 36 vulnerabilities (23 critical- and high-impact vulnerabilities and 13 medium- and low-impact vulnerabilities)  The program also documented these vulnerabilities and associated findings and recommendations in a security assessment report  GMM conducted initial remediation actions (i e , remediation of vulnerabilities that should be corrected immediately) for 12 of the critical- and high-impact vulnerabilities and a reassessment of those security controls confirmed that they were resolved by January 2018  Remediation of the remaining 11 critical- and high-impact vulnerabilities and 13 medium- and low- impact vulnerabilities were to be addressed by corrective action plans as part of the authorization to operate process, which is discussed in the next section  The authorization to operate GMM’s engineering and test environment was granted on February 5, 2018  Among other things, this decision was based on the important stipulation that the remaining 11 critical- and high- impact vulnerabilities associated with multifactor authentication would be addressed within 45 days, or by March 22, 2018  However, the program did not meet this deadline and, instead, approximately 2 months after this deadline passed, obtained a waiver to remediate these vulnerabilities by May 9, 2019  These vulnerabilities are related to a multifactor authentication capability  Program officials stated that they worked with FEMA OCIO officials to attempt to address these vulnerabilities by the initial deadline, but they were unsuccessful in finding a viable solution  Therefore, GMM program officials developed a waiver at the recommendation of the OCIO to provide additional time to develop a viable solution  However, a multifactor authentication capability is essential to ensuring that users are who they say they are, prior to granting users access to the GMM engineering and test environment, in order to reduce the risk of harmful actors accessing the system  In addition, as of September 2018, the program had not established corrective action plans for the 13 medium- and low-impact vulnerabilities  Program officials stated that they do not typically address low-impact vulnerabilities; however, this is in conflict with DHS guidance that specifies that corrective action plans must be developed for every weakness identified during a security control assessment and within a security assessment report  In response to our audit, in October 2018, GMM program officials developed these remaining corrective action plans  The plans indicated that these vulnerabilities were to be fully addressed by January 2019 and April 2019  While the program eventually took corrective actions in response to our audit by developing the missing plans, the GMM program initially failed to follow DHS’s guidance on preparing corrective actions plans for all security vulnerabilities  Until GMM consistently follows DHS’s guidance, it will be difficult for FEMA to determine the extent to which GMM’s security weaknesses identified during its security control assessments are remediated  Additionally, as we have reported at other agencies, vulnerabilities can be indicators of more significant underlying issues and, thus, without appropriate management attention or prompt remediation, GMM is at risk of unnecessarily exposing the program to potential exploits  Moreover, GMM was required to assess all untested controls by March 7, 2018, or no later than 30 days after the approval of the authorization to operate; however, it did not meet this deadline  Specifically, we found that, by October 2018, FEMA had not fully tested 190 security controls in the GMM engineering and test environment  These controls were related to areas such as security incident handling and allocation of resources required to protect an information system  In response to our findings, in October 2018, GMM program officials reported that they had since fully tested 27 controls and partially tested the remaining 163 controls  Program officials stated that testing of the 163 controls is a shared responsibility between GMM and other parties (e g , the cloud service provider)  They added that GMM had completed its portion of the testing but was in the process of verifying the completion of testing by other parties  Program officials stated that the untested controls were not addressed sooner, in part, because of errors resulting from configuration changes in the program’s compliance tool during a system upgrade, which have now been resolved  Until GMM ensures that all security controls have been tested, it remains at an increased risk of exposing programs to potential exploits  Consistent with the NIST framework, GMM established methods for assessing and monitoring security controls to be conducted after an authorization to operate has been approved  GMM has tailored its cybersecurity policies and practices for monitoring its controls to take into account the frequent and iterative pace with which system functionality is continuously being introduced into the GMM environment  Specifically, the GMM program established a process for assessing security impact changes to the system and conducting reauthorizations to operate within the rapid Agile delivery environment  As part of this process, GMM embedded cybersecurity experts on each Agile development team so that they are involved early and can impact security considerations from the beginning of requirements development through testing and deployment of system functionality  In addition, the process involves important steps for ensuring that the system moves from development to completion, while producing a secure and reliable system  For example, it includes procedures for creating, reviewing, and testing new system functionality  As the new system functionality is integrated with existing system functionality, it is to undergo automated testing and security scans in order to ensure that the integrity of the security of the system has not been compromised  Further, an automated process is to deploy the code if it passes all security scans, code tests, and code quality checks  GMM’s process for conducting a reauthorization to operate within the rapid delivery Agile development environment is to follow FEMA guidance that states that all high-level changes made to a FEMA IT system must receive approval from both a change advisory board and the FEMA Chief Information Officer  The board and FEMA Chief Information Officer are to focus their review and approval on scheduled releases and epics (i e , collections of user stories)  Additionally, the Information System Security Officer is to review each planned user story and, if it is determined that the proposed changes may impact the integrity of the authorization, the Information System Security Officer is to work with the development team to begin the process of updating the system authorization  Finally, GMM uses automated tools to track the frequency in which security controls are assessed and to ensure that required scanning data are received by FEMA for reporting purposes  Program officials stated that, in the absence of department-level and agency-level guidance, they have coordinated with DHS and FEMA OCIO officials to ensure that these officials are in agreement with GMM’s approach to continuous monitoring  By having monitoring control policies and procedures in place, FEMA management is positioned to more effectively prioritize and plan its risk response to current threats and vulnerabilities for the GMM program  Given FEMA’s highly complex grants management environment, with its many stakeholders, IT systems, and internal and external users, implementing leading practices for business process reengineering and IT requirements management is critical for success  FEMA has taken many positive steps, including ensuring executive leadership support for business process reengineering, documenting the agency’s grants management processes and performance improvement goals, defining initial IT requirements for the program, incorporating input from end user stakeholders into the development and implementation process, and taking recent actions to improve its delivery of planned IT requirements  Nevertheless, until the GMM program finalizes plans and time frames for implementing its organizational change management actions, plans and communicates system transition activities, and maintains clear traceability of IT requirements, FEMA will be limited in its ability to provide streamlined grants management processes and effectively deliver a modernized IT system to meet the needs of its large range of users  While GMM’s initial cost estimate was reliable, key assumptions about the program since the initial estimate had changed and, therefore, it no longer reflected the current approach for the program  The forthcoming updated cost schedule is expected to better reflect the current approach  However, the program’s unreliable schedule to fully deliver GMM by September 2020 is aggressive and unrealistic  The delays the program has experienced to date further compound GMM’s schedule issues  Without a robust schedule that has been informed by a realistic assessment of GMM’s development activities, leadership will be limited in its ability to make informed decisions on what additional increases in cost or reductions in scope might be needed to achieve their goals  Further, FEMA’s implementation of cybersecurity practices for GMM in the areas of system categorization, selection and implementation, and monitoring will help the program  However, GMM lacked essential details for evaluating security controls, did not approve the security assessment plan before proceeding with the security assessment, did not follow DHS’s guidance to develop corrective action plans for all security vulnerabilities, and did not fully test all security controls  As a result, the GMM engineering and test environment remains at an increased risk of exploitations  We are making eight recommendations to FEMA: The FEMA Administrator should ensure that the GMM program management office finalizes the organizational change management plan and time frames for implementing change management actions  (Recommendation 1) The FEMA Administrator should ensure that the GMM program management office plans and communicates its detailed transition activities to its affected customers before they transition to GMM and undergo significant changes to their processes  (Recommendation 2) The FEMA Administrator should ensure that the GMM program management office implements its planned changes to its processes for documenting requirements for future increments and ensures it maintains traceability among key IT requirements documents  (Recommendation 3) The FEMA Administrator should ensure that the GMM program management office updates the program schedule to address the leading practices for a reliable schedule identified in this report  (Recommendation 4) The FEMA Administrator should ensure that the FEMA OCIO defines sufficiently detailed planned evaluation methods and actual evaluation methods for assessing security controls  (Recommendation 5) The FEMA Administrator should ensure that the FEMA OCIO approves a security assessment plan before security assessment reviews are conducted  (Recommendation 6) The FEMA Administrator should ensure that the GMM program management office follows DHS guidance on preparing corrective action plans for all security vulnerabilities  (Recommendation 7) The FEMA Administrator should ensure that the GMM program management office fully tests all of its security controls for the system  (Recommendation 8) DHS provided written comments on a draft of this report, which are reprinted in appendix IV  In its comments, the department concurred with all eight of our recommendations and provided estimated completion dates for implementing each of them  For example, with regard to recommendation 4, the department stated that FEMA plans to update the GMM program schedule to address the leading practices for a reliable schedule by April 30, 2019  In addition, for recommendation 7, the department stated that FEMA plans to ensure that corrective action plans are prepared by July 31, 2019, to address all identified security vulnerabilities for GMM  If implemented effectively, the actions that FEMA plans to take in response to the recommendations should address the weaknesses we identified  We also received technical comments from DHS and FEMA officials, which we incorporated, as appropriate  We are sending copies of this report to the Secretary of Homeland Security and interested congressional committees  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-4456 or harriscc@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix V  Our objectives were to (1) determine the extent to which the Federal Emergency Management Agency (FEMA) is implementing leading practices for reengineering its grants management business processes and incorporating business needs into Grants Management Modernization (GMM) information technology (IT) requirements; (2) assess the reliability of the program’s estimated costs and schedule; and (3) determine the extent to which FEMA is addressing key cybersecurity practices for GMM  To address the first objective, we reviewed GAO’s Business Process Reengineering Assessment Guide and Software Engineering Institute’s Capability Maturity Model for Integration for Development to identify practices associated with business process reengineering and IT requirements management  We then selected six areas that, in our professional judgment, represented foundational practices that were of particular importance to the successful implementation of an IT modernization effort that is using Agile development processes  We also selected the practices that were most relevant based on where GMM was in the system development lifecycle and we discussed the practice areas with FEMA officials  The practices are: Ensuring executive leadership support for process reengineering Assessing the current and target business environment and business Establishing plans for implementing new business processes Establishing clear, prioritized, and traceable IT requirements Tracking progress in delivering IT requirements Incorporating input from end user stakeholders We also reviewed selected chapters of GAO’s draft Agile Assessment Guide (Version 6A), which is intended to establish a consistent framework based on best practices that can be used across the federal government for developing, implementing, managing, and evaluating agencies’ IT investments that rely on Agile methods  To develop this guide, GAO worked closely with Agile experts in the public and private sector; some chapters of the guide are considered more mature because they have been reviewed by the expert panel  We reviewed these chapters to ensure that our expectations for how FEMA should apply the six practices for business process reengineering and IT requirements management are appropriate for an Agile program and are consistent with the draft guidance that is under development  Additionally, since Agile development programs may use different terminology to describe their software development processes, the Agile terms used in this report (e g , increment, sprint, epic, etc ) are specific to the GMM program  We obtained and analyzed FEMA grants management modernization documentation, such as current and target grants management business processes, acquisition program baseline, operational requirements document, concept of operations, requirements analyses workbooks, Grants Management Executive Steering Group artifacts, stakeholder outreach artifacts, Agile increment- and sprint-level planning and development artifacts, and the requirements backlog  We assessed the program documentation against the selected practices to determine the extent to which the agency had implemented them  We then assessed each practice area as: fully implemented—FEMA provided complete evidence that showed it fully implemented the practice area; partially implemented—FEMA provided evidence that showed it partially implemented the practice area; not implemented—FEMA did not provide evidence that showed it implemented any of the practice area  Additionally, we observed Agile increment and sprint development activities at GMM facilities in Washington, D C  We also observed a demonstration of how the program manages its lower level requirements (i e , user stories and epics) and maintains traceability of the requirements using an automated tool at GMM facilities in Washington, D C  We also interviewed FEMA officials, including the GMM Program Executive, GMM Program Manager, GMM Business Transformation Team Lead, and Product Owner regarding their efforts to streamline grants management business processes, collect and incorporate stakeholder input, and manage GMM’s requirements  In addition, we interviewed FEMA officials from four out of 16 grant program offices and two out of 10 regional offices to obtain contextual information and illustrative examples of FEMA’s efforts to reengineer grants management business processes and collect business requirements for GMM  Specifically, We selected the four grant program offices based on a range of grant programs managed, legacy systems used, and the amount of grant funding awarded  We also sought to select a cross section of different characteristics, such as selecting larger grant program offices, as well as smaller offices  In addition, we ensured that our selection included the Assistance to Firefighters Grants (AFG) program office because officials in this office represent the first GMM users and, therefore, are more actively involved with the program’s Agile development practices  Based on these factors, we selected: Public Assistance Division, Individual Assistance Division, AFG, and National Fire Academy  Additionally, the four selected grant program offices are responsible for 16 of the total 45 grant programs and are users of five of the nine primary legacy IT systems  The four selected grant program offices also represent about 68 percent of the total grant funding awarded by FEMA from fiscal years 2005 through 2016  We selected two regional offices based on (1) the largest amount of total FEMA grant funding for fiscal years 2005 through 2016—Region 6 located in Denton, Texas; and (2) the highest percentage of AFG funding compared to the office’s total grant funding awarded from fiscal years 2005 through 2016—Region 5 located in Chicago, Illinois  To assess the reliability of data from the program’s automated IT requirements management tool, we interviewed knowledgeable officials about the quality control procedures used by the program to assure accuracy and completeness of the data  We also compared the data to other relevant program documentation on GMM requirements  We determined that the data used were sufficiently reliable for the purpose of evaluating GMM’s practices for managing IT requirements  For our second objective, to assess the reliability of GMM’s estimated costs and schedule, we reviewed documentation on GMM’s May 2017 lifecycle cost estimate and on the program’s schedule, dated May 2018  To assess the reliability of the May 2017 lifecycle cost estimate, we evaluated documentation supporting the estimate, such as the cost estimating model, the report on GMM’s Cost Estimating Baseline Document and Life Cycle Cost Estimate, and briefings provided to the Department of Homeland Security (DHS) and FEMA management regarding the cost estimate  We assessed the cost estimating methodologies, assumptions, and results against leading practices for developing a comprehensive, accurate, well-documented, and credible cost estimate, identified in GAO’s Cost Estimating and Assessment Guide  We also interviewed program officials responsible for developing and reviewing the cost estimate to understand their methodology, data, and approach for developing the estimate  We found that the cost data were sufficiently reliable  To assess the reliability of the May 2018 GMM program schedule, we evaluated documentation supporting the schedule, such as the integrated master schedule, acquisition program baseline, and Agile artifacts  We assessed the schedule documentation against leading practices for developing a comprehensive, well-constructed, credible, and controlled schedule, identified in GAO’s Schedule Assessment Guide  We also interviewed GMM program officials responsible for developing and managing the program schedule to understand their practices for creating and maintaining the schedule  We noted in our report the instances where the quality of the schedule data impacted the reliability of the program’s schedule  For both the cost estimate and program schedule, we assessed each leading practice as: fully addressed—FEMA provided complete evidence that showed it implemented the entire practice area; substantially addressed—FEMA provided evidence that showed it implemented more than half of the practice area; partially addressed—FEMA provided evidence that showed it implemented about half of the practice area; minimally addressed—FEMA provided evidence that showed it implemented less than half of the practice area; not addressed—FEMA did not provide evidence that showed it implemented any of the practice area  Finally, we provided FEMA with draft versions of our detailed analyses of the GMM cost estimate and schedule  This was done to verify that the information on which we based our findings was complete, accurate, and up-to-date  Regarding our third objective, to determine the extent to which FEMA is addressing key cybersecurity practices for GMM, we reviewed documentation regarding DHS and FEMA cybersecurity policies and guidance, and FEMA’s authorization to operate for the program’s engineering and test environment  We evaluated the documentation against all six cybersecurity practices identified in the National Institute of Standards and Technology’s (NIST) Risk Management Framework  While NIST’s Risk Management Framework identifies six total practices, for reporting purposes, we combined two interrelated practices—selection of security controls and implementation of security controls—into a single practice  The resulting five practices were: categorizing the system based on security risk, selecting and implementing security controls, assessing security controls, obtaining an authorization to operate the system, and monitoring security controls on an ongoing basis  We obtained and analyzed key artifacts supporting the program’s efforts to address these risk management practices, including the program’s System Security Plan, the Security Assessment Plan and Report, Authorization to Operate documentation, and the program’s continuous monitoring documentation  We also interviewed officials from the GMM program office and FEMA’s Office of the Chief Information Officer, such as the GMM Security Engineering Lead, GMM Information System Security Officer, and FEMA’s Acting Chief Information Security Officer, regarding their efforts to assess, document, and review security controls for GMM  We assessed the evidence against the five practices to determine the extent to which the agency had addressed them  We then assessed each practice area as: fully addressed—FEMA provided complete evidence that showed it fully implemented the practice area; partially addressed—FEMA provided evidence that showed it partially implemented the practice area; not addressed—FEMA did not provide evidence that showed it implemented any of the practice area  To assess the reliability of data from the program’s automated security controls management tool, we interviewed knowledgeable officials about the quality control procedures used by the program to assure accuracy and completeness of the data  We also compared the data to other relevant program documentation on GMM security controls for the engineering and test environment  We found that some of the security controls data we examined were sufficiently reliable for the purpose of evaluating FEMA’s cybersecurity practices for GMM, and we noted in our report the instances where the accuracy of the data impacted the program’s ability to address key cybersecurity practices  We conducted this performance audit from December 2017 to April 2019 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  The Federal Emergency Management Agency (FEMA) awards many different types of grants to state, local, and tribal governments and nongovernmental entities  These grants are to help communities prevent, prepare for, protect against, mitigate the effects of, respond to, and recover from disasters and terrorist attacks  Agile software development is a type of incremental development that calls for the rapid delivery of software in small, short increments  The use of an incremental approach is consistent with the Office of Management and Budget’s guidance as specified in its information technology (IT) Reform Plan, as well as the legislation commonly referred to as the Federal Information Technology Acquisition Reform Act  Many organizations, especially in the federal government, are accustomed to using a waterfall software development model, which typically consists of long, sequential phases, and differs significantly from the Agile development approach  Agile practices integrate planning, design, development, and testing into an iterative lifecycle to deliver software early and often  Figure 7 provides a depiction of software development using the Agile approach, as compared to a waterfall approach  The frequent iterations of Agile development are intended to effectively measure progress, reduce technical and programmatic risk, and respond to feedback from stakeholders in changes to IT requirements more quickly than traditional methods  Despite these intended benefits, organizations adopting Agile must overcome challenges in making significant changes to how they are accustomed to developing software  The significant differences between Agile and waterfall development impact how IT programs are planned, implemented, and monitored in terms of cost, schedule, and scope  For example, in waterfall development, significant effort is devoted upfront to document detailed plans and all IT requirements for the entire scope of work at the beginning of the program, and cost and schedule can be varied to complete that work  However, for Agile programs the precise details are unknown upfront, so initial planning of cost, scope, and timing would be conducted at a high level, and then supplemented with more specific plans for each iteration  While cost and schedule are set for each iteration, requirements for each iteration (or increment) can be variable as they are learned over time and revised to reflect experiences from completed iterations and to accommodate changing priorities of the end users  The differences in these two software development approaches are shown in figure 8  Looking at figure 8, the benefit provided from using traditional program management practices such as establishing a cost estimate or a robust schedule, is not obvious  However, unlike a theoretical environment, many government programs may not have the autonomy to manage completely flexible scope, as they must deliver certain minimal specifications with the cost and schedule provided  In those cases, it is vital for the team to understand and differentiate the IT requirements that are “must haves” from the “nice to haves” early in the planning effort  This would help facilitate delivery of the “must-haves” requirements first, thereby providing users with the greatest benefits as soon as possible  In addition to the contact named above, the following staff made key contributions to this report: Shannin G  O’Neill (Assistant Director), Jeanne Sung (Analyst in Charge), Andrew Beggs, Rebecca Eyler, Kendrick Johnson, Thomas J  Johnson, Jason Lee, Jennifer Leotta, and Melissa Melvin 

ground_truth: The misuse of prescription opioid pain relievers and illicit opioids, such as heroin, has contributed to increases in overdose deaths. According to the most recent Centers for Disease Control and Prevention data, in 2015 over 52,000 people died of drug overdose deaths, and about 63 percent of them involved an opioid. For those who are addicted to or misuse opioids, MAT has been shown to be an effective treatment. GAO was asked to review HHS and other efforts related to MAT for opioid use disorders. This report (1) describes HHS's key efforts to expand access to MAT, (2) examines HHS's evaluation, if any, of its efforts to expand access to MAT, and (3) describes efforts by selected stakeholders (states, private health insurers, and national associations) to expand access to MAT. GAO gathered information from HHS officials as well as a non-generalizable selection of 15 stakeholders selected based on their MAT expansion activities, among other factors. GAO also assessed HHS's evaluation plans using internal control standards for defining objectives and evaluating results. In an effort to reduce the prevalence of opioid misuse and the fatalities associated with it, the Department of Health and Human Services (HHS) established a goal to expand access to medication-assisted treatment (MAT). MAT is an approach that combines behavioral therapy and the use of certain medications, such as methadone and buprenorphine. HHS has implemented five key efforts since 2015 that focus on expanding access to MAT for opioid use disorders—four grant programs that focus on expanding access to MAT in various settings (including rural primary care practices and health centers) and regulatory changes that expand treatment capacity by increasing patient limits for buprenorphine prescribers and allowing nurse practitioners and physician assistants to prescribe buprenorphine. Some of the grant awards were made in 2015, while others were made as recently as May 2017. (See figure.) As of August 2017, efforts under all the grant programs were ongoing. Grant recipients can use funding to undertake a range of activities, such as hiring and training providers and supporting treatments involving MAT. In addition, certain providers and grant recipients are required to develop plans for preventing MAT medications from being diverted for nonmedical purposes. HHS officials told GAO that as of August 2017, the department was in the process of finalizing its plans to evaluate its efforts to address the opioid epidemic. In September 2016, HHS awarded a contract to conduct the evaluation. HHS officials told GAO that they are still working with the contractor to finalize the evaluation approach and that it will focus on whether HHS's efforts to address the opioid epidemic have been implemented as intended. HHS officials said that in the future, HHS may also evaluate whether, or to what extent, its efforts have been effective in expanding access to MAT, in addition to evaluating implementation. While HHS has some of the information that could be used in a future evaluation of the effectiveness of its efforts to expand access to MAT, it has not adopted specific performance measures with targets specifying the magnitude of the increases HHS hopes to achieve through its efforts to expand access to MAT, and by when. For example, HHS has not established a long-term target specifying the percentage increase in the number of prescriptions for buprenorphine HHS would like to achieve, which would help to show whether efforts by HHS and others are resulting in a sufficient number of prescriptions for MAT medications. HHS has also not chosen a specific method of measuring treatment capacity or established targets associated with it, which would help determine whether a sufficient number of providers are becoming available to evaluate and treat patients who may benefit from MAT. Without specifying these performance measures and associated targets, HHS will not have an effective means to determine whether its efforts are helping to expand access to MAT or whether new approaches are needed. Gauging this progress is particularly important given the large gap identified nationwide between the total number of individuals who could benefit from MAT and the limited number who can currently access it based on provider availability. In addition, GAO also found that as of August 2017, HHS had not finalized its approach for its planned evaluation activities, including timeframes. Without timeframes for the evaluation's activities, HHS increases the risk that the evaluation will not be completed as expeditiously as possible. In addition to HHS efforts to expand access to MAT, officials from selected states, private health insurers, and national associations reported using several efforts to expand patients' access to MAT for opioid use disorders. For example, several stakeholders provided GAO with the following examples of their efforts: States. State health officials from all five selected states have implemented or are planning approaches that focus on integrating the use of MAT into primary care, such as by providing services for centralized intake and initial management of patients or through telehealth that connects patients in rural areas with addiction specialists in a different location. Private health insurers. Three private health insurers reported removing prior authorization requirements for MAT medications so patients can avoid a waiting period before receiving the medications. National associations. Officials told GAO that they are conducting outreach and training for their members and developing tools and resource guides. For example, one association developed a road map with strategies that state policymakers can use to address the opioid epidemic, including strategies for reducing the stigma associated with MAT through educating the public and potential providers. GAO recommends that HHS take two actions: (1) establish performance measures with targets related to expanding access to MAT, and (2) establish timeframes for its evaluation of its efforts to expand access to MAT. HHS concurred with both recommendations.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: Health care practitioners prescribe opioid medications to treat pain and sometimes for other health problems, such as severe coughing  Opioid medications are available as immediate or extended release and in different forms, such as a pill, liquid, or a patch worn on the skin  Opioids slow down some processes of the body, such as breathing and heartbeat, by binding with certain receptors in the body  Over time, the body becomes tolerant to opioids, which means that larger doses of opioid medications are needed to achieve the same effect  People may use opioids in a manner other than as prescribed—that is, they can be misused  Because opioids are highly addictive substances, they can pose serious risks when they are misused, which can lead to addiction and death  Symptoms of an opioid use disorder include a strong desire for opioids, the inability to control or reduce use, and continued use despite interference with major obligations or social functioning  Another concern associated with prescribed opioids is the potential for diversion for illegal purposes, such as nonmedical use or financial gain  Research has shown that MAT—which combines behavioral therapy and the use of certain medications (methadone, buprenorphine, and naltrexone)—can be more effective in reducing opioid use and increasing retention (i e , reducing dropouts) compared to abstinence based treatment—that is when patients are treated without medication  Three medications are currently approved by FDA for use in MAT for opioid use disorders—methadone, buprenorphine, and naltrexone  Methadone: Methadone is a full opioid agonist, meaning it binds to and activates opioid receptors to help prevent withdrawal symptoms and reduce drug cravings  It has a long history of use for the treatment of opioid dependence in adults  Methadone suppresses withdrawal symptoms during detoxification therapy, which involves stabilizing patients who are addicted to opioids by withdrawing them in a controlled manner  Methadone also controls the craving for opioids during maintenance therapy, which is ongoing therapy meant to prevent relapse and increase treatment retention  Methadone can be administered to patients as an oral solution or in tablet form  Buprenorphine: Buprenorphine is a partial opioid agonist, meaning it binds to opioid receptors and activates them, but not to the same degree as full opioid agonists  It reduces or eliminates opioid withdrawal symptoms, including drug cravings  It can be used for detoxification treatment and maintenance therapy  It is available for MAT for opioid use disorder in tablet form for sublingual (under the tongue) administration, in film form for sublingual or buccal (inside the cheek) administration, and as a subdermal (under the skin) implant  Naltrexone: Naltrexone is an opioid antagonist, meaning it binds to opioid receptors but does not activate them  It is used for relapse prevention following complete detoxification from opioids  Naltrexone prevents opioid drugs from binding to and activating opioid receptors, thus blocking the euphoria the user would normally feel  It also results in withdrawal symptoms if recent opioid use has occurred  It can be taken daily in an oral tablet form or as a once-monthly injection given in a doctor’s office  Two of the three medications used to treat opioid use disorders— methadone and buprenorphine—are drugs that carry a potential for misuse  Under the Controlled Substances Act (CSA), treatment involving these medications can take place in certain authorized settings: as part of federally regulated OTPs or in other settings, such as a physician’s office, within certain restrictions  OTPs  OTPs provide MAT, including methadone and buprenorphine, for people diagnosed with an opioid use disorder  Methadone may generally only be administered or dispensed within an OTP, as prescriptions for methadone cannot be issued when used for opioid use disorder treatment  Buprenorphine may be administered or dispensed within an OTP, or may also be prescribed by a qualifying practitioner who has received a waiver from SAMHSA  Naltrexone is not a controlled substance and can be used in OTPs and other settings  Office-Based and Other Settings  Under a Drug Addiction Treatment Act of 2000 (DATA 2000) waiver, practitioners may prescribe buprenorphine to up to 30 patients in the first year of their waiver, 100 patients in the second year, and up to 275 patients in the third year  Practitioners at the 275-patient level must meet additional qualifications and requirements  Naltrexone does not have similar restrictions  HHS has implemented five key efforts from 2015 through August 2017 that focus on expanding access to MAT for opioid use disorders  Four of these are grant programs, including programs focused on health centers or primary care practices in rural areas  Targeted Capacity Expansion: Medication Assisted Treatment – Prescription Drug and Opioid Addiction (MAT-PDOA)  This grant program is administered by SAMHSA and provides funding to states to increase their capacity to provide MAT and recovery support services to individuals with opioid use disorders  Grant recipients are expected to identify a minimum of two high-risk communities within the state and partner with local government or community- based organizations to address the MAT-related treatment needs in these communities  Among other things, recipients are to use outreach and other engagement activities to increase participation in and access to MAT for diverse populations at risk for opioid use disorders  In August 2015, SAMHSA awarded 3-year grants to 11 states, under which each of the states will receive up to $1 million in each grant year  In September 2016, SAMHSA awarded 11 additional 3-year grants to other states  Total funding is expected to be up to $66 million for all 22 grants  SAMHSA announced the availability of up to 5 additional 3-year grants for fiscal year 2017  Applications for these grants of up to $2 million per year were due in July 2017 and as of August 2017 they had not been awarded  Substance Abuse Service Expansion Supplement to Health Centers  This grant program is administered by HRSA and provides funds for existing health centers to improve and expand their delivery of substance abuse services, including services with a specific focus on MAT for opioid use disorders in underserved populations  Health centers that receive these grants are required to increase the number of patients with health center-funded access to MAT for opioid use or for other substance abuse disorders treatment by adding at least one full-time substance abuse provider and supporting new or enhanced existing substance abuse services  HRSA awarded 2-year grants in March 2016 to 271 health centers  According to HRSA documents, total funding could be up to $200 million for all grants over 2 years  HRSA announced the availability of another set of grants to health centers for fiscal year 2017  Applications for these grants were due in July 2017, and as of August 2017 they had not been awarded  Increasing Access to Medication-Assisted Treatment in Rural Primary Care Practices  This grant program is administered by AHRQ and funds demonstration research projects that aim to expand access to MAT for opioid use disorders in primary care practices in rural areas of the United States  Grant recipients are expected to recruit and engage primary care providers and their practices, provide training, and support physicians and their practices in initiating treatment  The program also identifies and tests strategies for overcoming the challenges associated with implementing MAT in primary care settings and creates training and other resources for implementing MAT  AHRQ awarded these 3-year grants of up to $1 million per year to four recipients—the recipients are teams of state health departments, academic health centers, local community organizations, physicians, and others—with project start dates of September 30, 2016  According to AHRQ documents, total funding is expected to be up to $12 million for the four grants over 3 years  State Targeted Response to the Opioid Crisis Grants (Opioid STR)  This grant program is administered by SAMHSA and provides funding to states and others to increase access to treatment services for opioid use disorders, including MAT; reduce unmet treatment needs; and reduce opioid overdose deaths  Grant recipients are expected to implement or expand access to evidence-based practices, particularly the use of MAT, and to report on the number of people who receive opioid use disorder treatment, the number of providers implementing MAT, and the number of providers trained to use MAT  SAMHSA awarded 2-year grants starting in May 2017 to 50 states, the District of Columbia, four U S  territories and the free associated states of Micronesia and Palau  According to SAMHSA documents, total funding could be up to $970 million for all grants over 2 years  Figure 1 displays the implementation timeframes, the number of grants, and funding levels for the four HHS grant programs related to MAT  As the figure shows, some of these awards were made in fiscal year 2015, while others were made as recently as May 2017  As of August 2017, these efforts were ongoing  In addition to these four grant programs, HHS’s fifth key effort increases treatment capacity by expanding the waivers that practitioners may receive to prescribe buprenorphine  Specifically, SAMHSA issued a regulation that became effective August 8, 2016 increasing the number of patients that eligible practitioners can treat with buprenorphine outside of an OTP (e g , in an office-based setting)  Previously, qualified practitioners could request approval to treat up to 30 patients at a time, and after 1 year the limit could increase to 100 patients at a time upon SAMHSA approval  The new regulation expanded access to MAT by allowing eligible practitioners who have had waivers to prescribe buprenorphine to 100 patients for at least 1 year to request approval to treat up to 275 patients thereafter  Similarly, SAMHSA has implemented provisions of the Comprehensive Addiction and Recovery Act of 2016 (CARA) that expanded the types of practitioners who can receive a waiver to prescribe buprenorphine in an office-based setting to include qualifying nurse practitioners and physician assistants  CARA generally requires that these nurse practitioners and physician assistants complete 24 hours of training to be eligible for a waiver  According to HHS documents, as of early 2017, nurse practitioners and physician assistants who have completed this training could request a waiver from SAMHSA to treat up to 30 patients at a time  In addition to its five key efforts focused specifically on expanding access to MAT for opioid use disorders, HHS has other efforts with broader focuses, such as treating multiple types of substance abuse  While these efforts are not specifically focused on expanding access to MAT for opioid use disorders, they may result in expanded access to MAT  For example, CMS has approved section 1115 Medicaid demonstration projects to allow states to undertake comprehensive reforms of their delivery of substance abuse services, including provisions to enhance the use of MAT for opioid use disorders  In July 2015, CMS issued a state Medicaid Director letter informing states that they may seek approval of section 1115 demonstrations to undertake comprehensive substance use service reforms  According to CMS, all participating states are using the demonstration authority to develop a full continuum of care for individuals with substance abuse disorders, including coverage of short-term residential treatment services not otherwise covered by Medicaid  In addition, FDA has programs to help expedite development and to provide for faster review of marketing applications for certain drugs  According to FDA, it has conducted expedited reviews of Suboxone (buprenorphine and naloxone sublingual film), Vivitrol (extended release naltrexone injection) and Probuphine (buprenorphine subdermal implant)  According to some federal officials and other stakeholders that we interviewed, as part of efforts to expand access to MAT for opioid use disorder, steps are being taken to prevent the possibility that the MAT medications could, in some cases, be diverted for illicit use, misuse, or for purposes not intended by a prescriber  For example, OTPs and practitioners who request and receive a waiver to prescribe buprenorphine to treat up to 275 patients outside of an OTP setting are required under federal regulations to maintain a diversion control plan  In addition, the MAT-PDOA grant program explicitly requires grant recipients to implement a diversion control plan, though the other grant programs do not have similar additional requirements  (See appendix I for an overview of the diversion control plan requirements for OTPs and the practitioners who prescribe buprenorphine outside of an OTP ) The 2016 Surgeon General’s report on Alcohol, Drugs, and Health noted that decades of research have shown that the benefits of MAT greatly outweigh the risks associated with diversion, and that withholding these medications greatly increases the risk of relapse to illicit opioid use and overdose death  HHS officials told us that as of August 2017, the department is in the process of finalizing its approach for evaluating the implementation of its agencies’ collective efforts to address the opioid epidemic that were undertaken as part of the HHS Opioid Initiative and will continue under the new administration’s Opioid Strategy  HHS officials provided a draft of the evaluation’s schedule  According to the officials, the evaluation will include, but not be limited to, efforts to expand access to MAT  In September 2016, HHS awarded a 2-year contract to Research Triangle Institute International (RTI) to evaluate HHS agencies’ collective efforts  HHS officials told us that they are still working with RTI to finalize the evaluation approach given new leadership priorities  Specifically, in April 2017, the new Secretary of HHS announced a revised strategy for addressing the opioid epidemic that will continue to address access to MAT for opioid use disorders but also include additional priority areas  According to HHS officials, to be responsive to the new priorities, the evaluation will focus initially on whether HHS’s efforts have been implemented as intended, and officials expect the evaluation to also provide information on any challenges HHS has faced in implementing these efforts  According to HHS officials, while the evaluation of MAT expansion efforts will use information from several sources, they have not yet determined exactly which information will be used or how it will be used  This information may include, for example, results from a separate, planned evaluation of one of the grant programs, Opioid STR, as well as other information HHS agencies collect as part of their ongoing monitoring efforts for each of their individual MAT grant programs  While the reporting requirements vary across the four MAT grant programs, the grantees provide HHS with information related to expanding access to MAT  Specifically, Targeted Capacity Expansion: Medication Assisted Treatment – Prescription Drug and Opioid Addiction (MAT-PDOA): Every 6 months, grant recipients are expected to submit progress reports to SAMHSA on the planned and actual number of patients treated, as well as information on other performance measures  Increasing Access to Medication-Assisted Treatment in Rural Primary Care Practices: Grant recipients are expected to submit quarterly progress reports to AHRQ with various information, such as information on the number of physicians who have been certified to prescribe buprenorphine and the number of primary care practices successfully initiating the delivery of MAT services as a result of the grant project  Substance Abuse Service Expansion Supplement to Health Centers: Health centers that received these grants were expected to submit quarterly progress reports to HRSA through the second quarter of 2017 on the number of physicians who have obtained a DATA 2000 waiver and the number of patients who received MAT from these physicians  Health centers must now report these data elements in their annual performance reporting along with information on the number of certified nurse practitioners and physician assistants who have received a DATA 2000 waiver  State Targeted Response to the Opioid Crisis Grants (Opioid STR): Every 6 months, grant recipients are expected to submit progress reports to SAMHSA on the number of individuals who receive opioid use disorder treatment, the number who receive opioid use disorder recovery services, and the number of providers implementing MAT, among other measures  While HHS’s evaluation will focus on whether HHS’s efforts have been implemented as intended, officials told us that in the future an evaluation may also focus on the effectiveness of these efforts, including the effectiveness of efforts to expand access to MAT  Doing so would be consistent with federal standards for internal control, which call for agencies to evaluate results  HHS has some of the information that could be used in a future evaluation of the effectiveness of its efforts to expand access to MAT  In particular, an HHS document describing the department’s fiscal year 2016 – 2017 goals identifies expanding MAT access as an important strategy for the success of HHS’s longer-term goal of reducing opioid use disorders and opioid overdoses  In addition, HHS has identified three potential ways to measure access to MAT: the number of prescriptions for MAT medications, the treatment capacity of practitioners who are authorized to prescribe buprenorphine for opioid use disorders through a DATA 2000 waiver, and the treatment capacity of OTPs certified to administer methadone and other medications  In addition, HHS has data that could be useful for tracking progress in these areas (see table 1)  However, HHS has not adopted specific performance measures with targets specifying the magnitude of the increases HHS hopes to achieve through its efforts to expand access to MAT, and by when  For example, HHS has not established a long-term target specifying the percentage increase in the number of prescriptions for buprenorphine HHS would like to achieve, which would help to show whether efforts by HHS and others are resulting in sufficient progress in increasing prescriptions for this MAT medication  HHS has also not chosen a specific method of measuring treatment capacity or established targets associated with it, which would help to show whether a sufficient number of providers are becoming available to evaluate and treat patients who may benefit from MAT  Without specifying these performance measures and associated targets, HHS will not have an effective means to determine whether its efforts are helping to expand access to MAT  The lack of such performance measures with associated targets is inconsistent with federal internal control standards that specify that management should define objectives and evaluate results  According to these standards, using performance information such as performance measures can help agencies monitor results and determine progress in meeting program goals  In the context of HHS’s efforts to expand access to MAT, establishing appropriate performance measures with associated targets would allow HHS to determine whether its efforts are making sufficient progress or whether they need to be improved  Gauging this progress is particularly important, given the large nationwide MAT treatment gap identified in 2015 between the total number of individuals who could benefit from MAT and the limited number who can access it based on provider availability  This gap was estimated at nearly 1 million people as of 2012, and according to HHS officials and other stakeholders, lack of providers continues to be a challenge  Until HHS establishes performance measures with associated targets for the factors related to access to MAT, the department will be unable to evaluate its progress expanding access to MAT for opioid use disorders  In addition, as of August 2017, HHS has not finalized its approach for the planned evaluation activities, including timeframes  ASPE officials said that timeframes for a finalized evaluation approach had not been established because they were still working with RTI to finalize the evaluation approach given the new leadership priorities  When we spoke with the officials, they provided us with a draft evaluation schedule that covered the contract period ending September 2018  As of October 2017, HHS had not provided a finalized evaluation approach or schedule  Federal internal controls call for management to establish and operate monitoring activities and evaluate results  Without an implementation timeframe for the evaluation’s activities, HHS increases the risk that its evaluation of its agencies’ efforts will not be completed as expeditiously as possible, including an evaluation of HHS’s efforts to expand access to MAT  Officials from selected state health departments and behavioral health agencies, private health insurers, and national associations reported using several different efforts to help expand patients’ access to MAT for opioid use disorders  All of the stakeholders we interviewed reported conducting outreach efforts to communicate information about the importance of MAT and how to access it, or providing training to educate providers on prescribing MAT medications  Efforts by states  State health officials we spoke to described several planned or ongoing efforts to expand access to MAT, some of which are supported by federal funding, including federal grant programs  Officials from all five selected states told us that they are offering outreach to and training for providers to help expand access to MAT  For example, several state officials told us that they are promoting training to (1) encourage physicians to obtain authorization (DATA 2000 waivers) to prescribe buprenorphine and (2) encourage physicians with waivers to treat patients up to their patient limit or to request a higher patient limit  According to the stakeholders, all five selected states have implemented or are planning to implement a health care delivery model or approach that will expand access to MAT  Specifically, these models or approaches focus on integrating the use of MAT into primary care settings  For example, health officials from three states described use of a hub-and-spoke model  This model generally involves centralized intake and initial management of patients at a “hub” (e g , an OTP) and then connecting these patients to community providers at “spokes” (e g , primary care clinics) for ongoing care, with ongoing support provided by the hub as needed  Additionally, officials from two states described offering remote MAT-related consultations through telehealth that connects patients in rural areas with addiction specialists  According to a 2017 Healthcare Fraud Prevention and Partnership whitepaper, telehealth expands the reach of the addiction professional workforce and the existing pool of MAT providers, and it supports remote forms of behavioral therapy to make trained professionals more accessible to those in underserved or isolated communities  Officials from three states described focusing their MAT expansion efforts in various settings, such as in the criminal justice setting and emergency room departments  State health officials from four of the five states told us that programs in their states are using peer specialists (individuals who have successfully recovered from substance abuse disorders) in emergency rooms and other settings to engage with addicted patients and refer them to addiction specialists or behavioral health counselors  Officials from the selected states said that some of these and other efforts are funded through federal sources, such as MAT expansion grants awarded by SAMHSA, or with state funds to the extent they are available  Efforts by private health insurers  Officials from private health insurers reported that they are expanding access to MAT through outreach or training for providers and through the following three efforts: Eliminating the need for prior authorization to prescribe MAT medications  Officials from three insurers reported removing prior authorization requirements for MAT medications, thereby making it easier for patients to access needed MAT medications more readily, rather than undergoing a waiting period for approval to receive the medications  Other private health insurers told us that they continue to require prior authorization, intended for safety reasons and to reduce drug misuse, and officials from one insurer told us that they will allow a patient to access a limited amount of MAT medications for a period of 24 to 72 hours while making a determination about the appropriate treatment services for the patient  Modifying health benefit coverage  Officials from one private health insurance plan told us that the company is redesigning the benefit coverage for methadone and has removed member copays  This effort is intended to make MAT medications more affordable and allow members who are not able to use buprenorphine to have an alternative, such as methadone, that is not cost-prohibitive  Incentivizing providers and health insurance plan members to use MAT  Officials from four private health insurance plans described plans to offer incentives to providers or patients to use MAT  For example, officials from three health plans stated that they are offering alternative payment models or paying higher rates to providers that offer MAT, and another private health insurer is offering incentives to its members who are enrolled in behavioral health programs that provide access to MAT  Efforts by national associations  Officials we interviewed from the national associations—including the American Society of Addiction Medicine, the National Governors Association, and the Association of State and Territorial Health Officials—told us that they are helping to expand access to MAT through outreach and training for their members and by developing tools and resource guides for their members  An official from one association told us that it shares federal grant announcements, including those that are focused on expanding access to MAT, with its members  Officials from another association said it provides training to providers on how to appropriately prescribe MAT medications  In addition, officials from one association told us that they developed an opioid-related road map that identifies examples of strategies—including MAT—that state policymakers can use in their ongoing efforts to address the opioid epidemic  Examples of strategies include reducing the stigma associated with MAT through educating the public and potential providers  Another strategy in the road map is changing payment policies to expand access to MAT services, such as ensuring that Medicaid and other state health programs adequately cover all MAT medications and behavioral interventions and encouraging or requiring commercial health plans to adopt similar policies  HHS funds grant programs and has taken other steps to expand access to MAT, which has been shown to be effective in reducing the prevalence of opioid use disorders and with them, the likelihood of drug overdoses  HHS’s Opioid Initiative began in 2015, and the grants that support it are ongoing, so it is likely too early to determine how effective HHS’s efforts have been in expanding access to MAT and in meeting HHS’s other priorities related to addressing the opioid epidemic  According to HHS, access to MAT can be measured in terms of the number of prescriptions for MAT and by the treatment capacities of OTPs and practitioners who are authorized to prescribe buprenorphine  Our review suggests, however, that HHS may not be ready to perform this evaluation  While HHS told us that it may evaluate the effectiveness of its efforts in the future, the department has not established performance measures with targets that would specify the results that HHS hopes to achieve through its efforts, and by when  Furthermore, HHS has not established timeframes for the activities that will make up its planned evaluation of whether HHS’s efforts have been implemented as intended  Without performance measures with targets and evaluation timeframes, HHS increases the risk that the evaluation will not be completed in a timely manner or that HHS will not know whether its MAT- related efforts are successful or whether new approaches are needed  The evaluation is particularly important, given the hundreds of millions of dollars HHS has invested in its MAT-related grant programs  We are making the following two recommendations to HHS  The Assistant Secretary for Planning and Evaluation should establish performance measures with targets related to expanding access to MAT for opioid use disorders  (Recommendation 1) The Assistant Secretary for Planning and Evaluation should establish timeframes in its evaluation approach that specify when its evaluation of efforts to expand access to MAT will be implemented and completed  (Recommendation 2) We provided a draft of this report to HHS for review, and HHS provided written comments, which are reprinted in appendix II  HHS also provided technical comments, which we incorporated as appropriate  In its written comments, HHS concurred with both of our recommendations  Specifically, for our first recommendation to establish performance measures with targets related to expanding access to MAT for opioid use disorders, HHS stated that developing such measures is appropriate and that the department will continue to work to develop robust performance measures, including measures related to MAT, as part of its overall Opioid Strategy, which includes the department’s most recent efforts to address the opioid epidemic  For our second recommendation to establish timeframes in its evaluation approach that specify when its evaluation of efforts to expand access to MAT will be implemented and completed, HHS agreed that timeframes are important to any evaluation  HHS noted that its evaluation is being conducted under a 2-year contract that is scheduled to end in September 2018  HHS has also provided us with a draft evaluation schedule  We clarified in our report, however, that HHS has not yet provided a finalized approach for the planned evaluation or a finalized schedule establishing timeframes for the activities that will make up the evaluation  Until it finalizes its evaluation approach and establishes related timeframes, HHS increases the risk that it will not complete its planned evaluation by September 2018  We are sending copies of this report to the HHS, and appropriate congressional committees  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have questions about this report, please contact me at (202) 512-7114 or curdae@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  Major contributors to this report are listed in appendix III  According to the Department of Health and Human Services, a diversion control plan is a set of documented procedures intended to reduce the possibility that controlled substances will be transferred or used illicitly  Opioid treatment programs (OTPs) and practitioners who prescribe buprenorphine at the highest patient level through a Drug Addiction Treatment Act of 2000 (DATA 2000) waiver are required to have these plans  OTPs are programs that may administer or dispense medication- assisted treatment (MAT) for people diagnosed with an opioid use disorder, including the use of methadone and buprenorphine  In addition, under a DATA 2000 waiver, practitioners may prescribe buprenorphine for patients, up to a 30-, 100-, or 275 patient limit  An OTP must maintain a current diversion control plan that contains specific measures to reduce the possibility of diversion of controlled substances from legitimate treatment use  Per federal guidelines, the goal of the diversion control plan is to reduce the scope and significance of diversion and its impact on communities  The guidelines state that each OTP’s diversion control plan should make every effort to balance diversion control against the therapeutic needs of the individual patient  They also state that diversion control plans should address at least four general areas of concern: program environment, dosing and take-home medication, prevention of multiple program enrollment, and prescription medication misuse  The guidelines include details about each of these areas: Program environment: Diversion in the program environment can be deterred and detected by regular surveillance and the monitoring of areas in and around the program, where opportunities for diversion may exist  A visible human presence at a program’s location gives community members the opportunity to approach staff with concerns and communicates the program’s commitment to assuring a safe environment and a positive impact on the surrounding community  Dosing and take-home medication: In the area of dosing and take- home medication, diversion control encompasses careful control of inventory, attentive patient dosing, and close supervision of take- home medication  Observing a patient take his or her dose and having each of them drink and speak after dosing are fundamental components of diversion control  Take-home dosing should be provided with careful attention to regulatory compliance and the therapeutic benefit and safety these regulations are meant to promote  Prevention of multiple program enrollment: Reasonable measures should be taken to prevent patients from enrolling in treatment provided by more than one clinic or individual practitioner  An OTP, after obtaining patient consent, may contact other OTPs within a reasonable geographic distance (100 miles) to verify that a patient is not enrolled in another OTP  Misuse of prescription medication: The misuse of prescription medication has become an area of great concern nationally and impacts diversion control planning at OTPs  All OTP physicians and other healthcare providers, as permitted, should register to use their respective state’s prescription drug monitoring program (PDMP) and query it for each newly admitted patient prior to initiating dosing  The PDMP should be checked periodically (for example, quarterly) through the course of each individual’s treatment and, in particular, before ordering take-home doses as well as at other important clinical decision points  SAMHSA’s best-practice guidelines for using buprenorphine for treating opioid use disorders include multiple references to diversion, including monitoring for diversion, storage of this medication to minimize diversion, and use of formulations that may be less likely to be diverted  Specifically, the best practices state that, when possible, practitioners should use the combination buprenorphine/naloxone product, which increases safety and decreases the likelihood of diversion and misuse  Further, physicians who request and receive a waiver to prescribe buprenorphine to treat up to 275 patients outside of an OTP are required to have a diversion control plan  According to an HHS official, as of July 13, 2017, roughly 3,330 of the over 39,000 practitioners with a waiver had a 275-patient limit waiver  The majority of these practitioners, just over 27,000, have a 30-patient limit  According to SAMHSA guidance, the diversion plan should contain specific measures to reduce the possibility of diversion of buprenorphine from legitimate treatment use and should assign specific responsibilities of the medical and administrative staff of the practice setting for carrying out these measures  Further, the guidance states that the plan should address how: the environment at the practice setting can prevent onsite diversion; to prevent diversion with regard to dosing and take-home medication; and to prevent patients from receiving a prescription from more than one practitioner and later diverting some of the prescribed medication  Elizabeth H  Curda, Director, (202) 512-7114 or curdae@gao gov  In addition to the contact name above, Will Simerl, Assistant Director; Natalie Herzog, Analyst-in-Charge; La Sherri Bush; and Emily Wilson made key contributions to this report  Also contributing were Muriel Brown, Krister Friday, Sandra George, and Christina Ritchie 


Report 2:  For example, helpful factors to consider when developing a proposed reward amount may include (1) the number of hours the source dedicated to the case, (2) the risk the source took in providing the information, (3) the significance of the information provided by the source, and (4) the amount of fines or other penalties collected as a result of the information  Two stakeholders expressed concern that some of FWS’s reward payments were insufficient, especially when comparing the amount of time and effort or the risk a source faced in providing the information  A couple of stakeholders also said that without a policy that specifies factors for agents to consider, reward amounts may be subjective and could vary depending on which agent develops the reward proposal  Another stakeholder said that it was important to specify factors for agents to consider when developing proposed reward amounts so that the agency has a reasonable and defensible basis for the reward amounts it pays across cases  According to federal standards for internal control, management should internally communicate the necessary quality information to achieve an agency’s objectives  For example, management communicates quality information down and across reporting lines to enable personnel to make key decisions  FWS officials said they believe that their reward policy is sound, indicating they believe that law enforcement agents have the information they need to develop proposals for reward amounts in cases where rewards are warranted  However, they also agreed that it may be helpful to review their policy but did not commit to doing so  By augmenting its policy to specify factors for agents to consider when developing proposed reward amounts, FWS can better ensure that its agents have the necessary quality information to prepare defensible reward proposals  Based on our review of the agencies’ websites and other communications, we found that FWS and NOAA communicate little information to the public on financial rewards for reporting information on wildlife trafficking, such as the potential availability of rewards and eligibility criteria  Specifically, some FWS and NOAA law enforcement websites provided information to the public on ways to report violations of the laws that the agencies are responsible for enforcing, such as via tip lines  Some of the websites also provided examples of the types of information the public can report, such as photos or other documentation of illegal activities  However, most of the agencies’ websites did not indicate that providing information on illegal activities could result in a reward  In contrast, the FWS Alaska regional office’s website provided information on the potential availability of rewards and ways the public may submit information for a potential reward  For example, this website provided phone numbers and an e-mail address for the public to use when submitting information  Figure 1 shows the information available on FWS’s and NOAA’s national and regional websites relevant to reporting violations of the laws the agencies enforce in general and on receiving rewards in particular  In addition, FWS and NOAA headquarters officials said their field agents have used other means to communicate the potential availability of rewards in specific cases when the agents had no other information that could help solve those cases  For example, a FWS field official said that the agency advertised a reward offer for information on a case of bald eagle killings by distributing reward posters and posting news releases in the vicinity where the killings occurred  Similarly, NOAA officials said they have advertised reward offers through various means, including circulating reward posters in specific geographic areas after an illegal activity has occurred  Figure 2 shows a reward poster that NOAA distributed in Guam in 2017 advertising a $1,000 reward for information leading to the arrest and conviction of sea turtle poachers  Instead of having a plan for communicating general information to the public on rewards, FWS and NOAA grant discretion to their regional offices and law enforcement agents to determine the type and level of communication to provide, according to FWS and NOAA policies  FWS officials explained that because they typically use financial rewards to thank individuals who come forward on their own accord—rather than using rewards to incentivize individuals with information to come forward—they have not seen the need to communicate more information to the public on the potential availability of rewards  NOAA officials said they have targeted their communications on rewards by publicizing reward offers for specific cases where they do not have leads  They added that they want to receive quality information and already receive a substantial amount of information from sources who reach out to them proactively, so NOAA has not seen the need to communicate more information to the public on the potential availability of rewards  Sixteen of the 20 stakeholders we interviewed said that it would be useful for FWS and NOAA to advertise the potential availability of financial rewards  Several stakeholders said that if the public does not know about the possibility for rewards, then some people with information may not be incentivized to come forward  Two stakeholders added that agencies should carefully consider how and which reward information to communicate to the public so that people who are most likely to have information on illegal wildlife trafficking learn about the potential for rewards  For example, one stakeholder suggested advertising rewards at ports where international shipments are offloaded or placing advertisements at wildlife trafficking nodes, such as entrances to African wildlife refuges  This stakeholder suggested advertising rewards along with wildlife trafficking awareness-raising posters that nongovernment organizations place in some airports  In addition, 14 stakeholders suggested that it would be useful for FWS and NOAA to provide information to the public on the process for submitting information to potentially receive rewards  Several other stakeholders said that it is important for the public to understand whether they may be eligible for a reward, how to submit information, and whether or to what extent their confidentiality will be protected  Another stakeholder provided examples of how other agencies provide information about their reward programs on their websites  SEC and IRS, for instance, use their websites to communicate information to the public on the process for reporting illegal activity for financial rewards  This information includes the types of information to report, confidentiality rules, eligibility criteria, and the process for submitting information to obtain a reward  In addition, the Department of State posts instructions on its websites on how to submit information on an illegal activity and potentially receive a reward  Federal internal control standards say that management should externally communicate the necessary quality information to achieve an agency’s objectives  For example, using appropriate methods to communicate, management communicates quality information so that external parties, such as the public, can help the agency achieve its objectives  This could include communicating information to the public on the types of information and eligibility requirements for potentially receiving rewards for reporting information on wildlife trafficking  FWS officials said that making more reward information available could lead to a significant increase in the amount of information the agency receives, which, in turn, could strain FWS’s resources in following up on that information  However, FWS officials also agreed that it was reasonable to consider making more reward information available to relevant members of the public, particularly in targeted circumstances, but did not commit to doing so  Similarly, NOAA officials said they had some concerns about the additional resources it might take to investigate potentially unreliable or false tips that may result if they make reward information broadly available to the public, but they agreed that it would be reasonable for the agency to consider doing so  NOAA officials also said they may consider making more reward information publicly available at the conclusion of our audit but provided no plans for doing so  By determining the types of additional information to communicate to the public on rewards—such as providing information on the agency’s website on the potential availability of rewards—and then developing and implementing plans to do so, FWS and NOAA can improve their chances of obtaining information on wildlife trafficking activities that they otherwise might not receive  FWS and NOAA have not reviewed the effectiveness of their use of financial rewards or considered whether any changes might improve the usefulness of rewards as a tool for combating wildlife trafficking  FWS officials said their agency has not reviewed or considered changes to its use of rewards because the agency has not prioritized the use of rewards  NOAA officials said their agency has not focused on using rewards or identified the need to review its use of this tool, particularly in light of other, higher mission priorities  Nine of the 20 stakeholders we interviewed said that FWS and NOAA should review the effectiveness of their use of rewards and consider potential improvements  Several stakeholders said that it would be useful for FWS and NOAA to compare their respective approaches to those of federal agencies that use rewards in contexts outside of wildlife trafficking to identify best practices or lessons learned that might be applicable in the context of combating wildlife trafficking  For example, one stakeholder said that SEC has an effective whistleblower program and may have lessons learned that are relevant for FWS and NOAA to consider  Another stakeholder we interviewed separately indicated that in 2010, before SEC had a whistleblower program that publicized rewards and provided detailed instructions on how members of the public could report information on illegal activities, SEC received few tips  Once SEC implemented a whistleblower program that publicized rewards and provided detailed instructions on its public website, the agency’s use of the program grew substantially, according to the stakeholder  Other stakeholders said it would be useful for the agencies to consider potential improvements to their use of rewards, such as making a standing reward offer for information on wildlife trafficking targeted at high-priority endangered species or particular criminal networks  Two of these stakeholders said such an offer might improve FWS’s and NOAA’s use of rewards by generating more tips than reward offers focused on individual cases  At the same time, they said such an offer would likely filter out some of the false or unproductive tips that the agencies might receive if they made an untargeted standing reward offer  Federal internal control standards state that management should design control activities to achieve objectives and respond to risks by, for example, conducting reviews at the functional or activity level by comparing actual performance to planned or expected results and analyzing significant differences  Further, under the standards, management should periodically review policies, procedures, and related control activities for continued relevance and effectiveness in achieving an agency’s objectives or addressing related risks  FWS and NOAA officials agreed that reviewing the effectiveness of their use of rewards would be worthwhile  Specifically, FWS officials said that it would be useful to compare their approach to those of other federal agencies that use rewards in investigating crimes that involve interstate and foreign smuggling of goods  Similarly, NOAA officials said that reviewing the agency’s use of financial rewards would be worthwhile but cautioned that such a review would need to be balanced against the agency’s constrained resources and many mission requirements  FWS and NOAA officials said they may consider conducting such a review at the conclusion of our audit but provided no plans for doing so  By reviewing the effectiveness of their use of rewards, FWS and NOAA can identify opportunities to improve the usefulness of rewards as a tool for combating wildlife trafficking  Wildlife trafficking is a large and growing transnational criminal activity, with global environmental, security, and economic consequences  The federal government has emphasized strengthening law enforcement efforts to combat wildlife trafficking, and using financial rewards to obtain information on illegal activities is one tool that some federal agencies have used  However, to date, FWS and NOAA have not prioritized the use of rewards and were unable to provide sufficient assurance that the 27 rewards they paid during fiscal years 2007 through 2017 represented all of the rewards they provided during that period  By tracking reward information so that it is clearly documented and readily available for examination, FWS and NOAA can better ensure that they have complete information on the rewards they have paid to help manage their use of rewards as a law enforcement tool  Additionally, FWS and NOAA have policies outlining the processes their law enforcement agents are to use in making reward payments, and NOAA’s policy specifies factors for its agents to consider in developing proposed reward amounts, such as the risk the individual took in collecting the information  FWS’s policy does not specify such factors that could inform agents in achieving the agency’s objectives, which is not consistent with federal internal control standards  By augmenting its policy to specify factors for its agents to consider when developing proposed reward amounts, FWS can better ensure that its agents have the necessary quality information to prepare defensible reward proposals  Both agencies have also advertised the potential for rewards in specific cases when agents had no other information, but FWS and NOAA have otherwise communicated little information to the public on the potential availability of rewards  If the public does not know about the possibility of rewards, then some people with information may not be incentivized to come forward  By determining the types of additional information to communicate to the public on rewards—such as providing information on the agency’s website about the potential availability of rewards—and then developing and implementing plans to do so, FWS and NOAA can improve their chances of obtaining information on wildlife trafficking activities that they otherwise might not receive  Finally, FWS and NOAA have not reviewed the effectiveness of their use of financial rewards or considered whether any changes might improve the usefulness of rewards as a law enforcement tool  By undertaking such reviews, the agencies can identify opportunities to improve the usefulness of rewards as a tool for combating wildlife trafficking  We are making a total of seven recommendations, including four to FWS and three to NOAA  Specifically: The Assistant Director of the FWS Office of Law Enforcement should track financial reward information so that it is clearly documented and readily available for examination  (Recommendation 1) The Director of the NOAA Office of Law Enforcement should track financial reward information so that it is clearly documented and readily available for examination  (Recommendation 2) The Assistant Director of the FWS Office of Law Enforcement should augment FWS’s financial reward policy to specify factors law enforcement agents are to consider when developing proposed reward amounts  (Recommendation 3) The Assistant Director of the FWS Office of Law Enforcement should determine the types of additional information to communicate to the public on financial rewards and then develop and implement a plan for communicating that information  (Recommendation 4) The Director of the NOAA Office of Law Enforcement should determine the types of additional information to communicate to the public on financial rewards and then develop and implement a plan for communicating that information  (Recommendation 5) The Assistant Director of the FWS Office of Law Enforcement should review the effectiveness of the agency’s use of financial rewards and implement any changes that the agency determines would improve the usefulness of financial rewards as a law enforcement tool  (Recommendation 6) The Director of the NOAA Office of Law Enforcement should review the effectiveness of the agency’s use of financial rewards and implement any changes that the agency determines would improve the usefulness of financial rewards as a law enforcement tool  (Recommendation 7) We provided a draft of this report for review and comment to the Departments of Commerce and the Interior  The departments transmitted written comments, which are reproduced in appendixes IV and V of this report  The Department of Commerce concurred with the three recommendations directed to NOAA and stated that NOAA is developing procedures to ensure that its rewards are closely tracked, clearly documented, and better communicated  In written comments from NOAA, NOAA stated the report fairly and thoroughly reviews NOAA’s use of financial rewards  NOAA outlined the steps it plans to take in response to our recommendations, including developing a procedure to track financial reward information, reviewing information currently disseminated to the public and evaluating whether additional information may be useful, and reviewing the agency’s reward policy to determine whether changes are needed to enhance reward effectiveness  In its written comments, the Department of the Interior concurred with the four recommendations directed to FWS  Interior stated that it appreciated our review of the challenges faced by FWS’s Office of Law Enforcement in combating wildlife trafficking and identifying areas where FWS and NOAA can improve the use of financial rewards as a tool for combating wildlife trafficking  Interior also provided technical comments, which we incorporated as appropriate  As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date  At that time, we will send copies to the appropriate congressional committees, the Secretaries of Commerce and the Interior, and other interested parties  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-3841 or fennella@gao gov  Contact points for our Offices of Congressional Relations and of Public Affairs may be found on the last page of this report  GAO staff who made major contributions to this report are listed in appendix VI  The objectives of our review were to (1) identify laws that authorize the U S  Fish and Wildlife Service (FWS) and the National Oceanic and Atmospheric Administration (NOAA) to pay financial rewards for information on wildlife trafficking and the extent to which these agencies paid such rewards from fiscal years 2007 through 2017, (2) evaluate FWS’s and NOAA’s policies on financial rewards, (3) evaluate the information available to the public on financial rewards, and (4) determine the extent to which FWS and NOAA reviewed the effectiveness of their use of financial rewards in combating wildlife trafficking  To address these objectives, we reviewed academic literature on the use of financial rewards to combat illegal activities and United Nations Environment Programme reports on the scope and scale of wildlife trafficking  We also interviewed officials from federal agencies that play a role in combating wildlife trafficking or manage programs that pay financial rewards for information on illegal activities  Specifically, we interviewed officials from the Departments of Agriculture, Commerce, Homeland Security, the Interior, Justice, and State, as well as officials from the Internal Revenue Service, the U S  Securities and Exchange Commission, and the U S  Agency for International Development  In addition, we reviewed documentation that the Department of the Treasury provided on its role in paying financial rewards  We did not compare FWS’s and NOAA’s use of financial rewards in combating wildlife trafficking to federal agencies’ use of financial rewards in other contexts because the different contexts are not directly comparable  However, we reviewed information on other federal agencies’ use of financial rewards as examples of how financial rewards are used in contexts outside of wildlife trafficking  In addition, we interviewed representatives of six nongovernmental organizations that we selected based on those organizations’ knowledge or experience in combating wildlife trafficking  Specifically, we interviewed representatives from the Elephant Action League, the Environmental Investigation Agency, the National Association of Conservation Law Enforcement Chiefs, the National Whistleblower Center, TRAFFIC, and the World Wildlife Fund  To identify laws that authorize FWS and NOAA to pay financial rewards for information on wildlife trafficking, we asked FWS and NOAA attorneys to compile a list of laws that each of their agencies implements or enforces that prohibit wildlife trafficking and authorize the agency to pay rewards for providing information about trafficking  We then compared that list to the results of our search of the United States Code for such laws  We also reviewed FWS and NOAA documentation for accounts where the fines, penalties, and proceeds from forfeited property that are used to pay rewards are deposited as well as the accounts where appropriations available to pay rewards were deposited  To identify the extent to which FWS and NOAA have paid financial rewards for information on wildlife trafficking, we analyzed FWS and NOAA data on financial rewards the agencies reported paying from fiscal years 2007 through 2017  The data included information on, among other things, the fiscal years in which rewards were paid, laws under which rewards were paid, types of wildlife involved in those cases, the amounts of civil penalties or criminal fines imposed in those cases, the numbers of arrests and convictions as a result of those cases, and whether reward recipients were individuals or groups and U S  or foreign citizens  To assess the reliability of the data FWS and NOAA provided on financial rewards, we interviewed agency officials knowledgeable about the data and compared the data to case records the agencies provided  Specifically, FWS and NOAA officials said they track all expenditures, including reward payments, in their financial databases, but they are not able to readily identify reward payments because their financial systems do not include a unique identifier for such payments and their reward information is located in multiple databases and formats  As a result, FWS and NOAA officials said they identified the rewards that they reported to us by manually reviewing their financial and law enforcement records, and officials said the information was complete to the best of their knowledge  Based on these steps, we found the data that the agencies provided to us to be sufficiently reliable for reporting information on the rewards the agencies reported paying  However, as we discuss in the report, FWS and NOAA officials could not provide sufficient assurance that the data included all the financial rewards that they had paid from fiscal years 2007 through 2017  To obtain additional detail about cases where financial rewards were paid, we reviewed a nongeneralizable sample of 10 wildlife trafficking cases  We selected these cases based on the agency that investigated the case (to include both FWS and NOAA cases), the amount of the reward paid in the case (to reflect both low and high amounts), the year in which the reward was paid (to include rewards paid more recently), and the type of wildlife trafficked in the case (to include both fish and wildlife cases—there were no plant trafficking cases to select)  While the findings from our review cannot be generalized to cases we did not select and review, they illustrate how FWS and NOAA have used financial rewards in wildlife trafficking cases  To evaluate FWS and NOAA policies on financial rewards, we reviewed relevant FWS and NOAA policies and compared them to each other; interviewed FWS and NOAA officials about those policies; and compared the information in the policies with federal internal control standards on information and communication  To evaluate information available to the public on rewards, we reviewed relevant FWS and NOAA publications and examples of communications to the public on the availability of rewards in specific cases and interviewed FWS and NOAA officials  We also reviewed information available on FWS’s and NOAA’s national and regional websites as of December 2017 and January 2018, respectively, relevant to reporting violations of the laws that the agencies enforce in general and on receiving rewards in particular  We compared the agencies’ public communications on rewards with federal internal control standards on information and communication  To evaluate the extent to which FWS and NOAA reviewed the effectiveness of their use of financial rewards in combating wildlife trafficking, we interviewed FWS and NOAA officials and requested any reviews the agencies had conducted regarding their use of financial rewards to compare with federal internal control standards on control activities  FWS and NOAA did not have any such reviews to provide  In addition, for all four objectives, we interviewed a nongeneralizable sample of 20 stakeholders who had experience investigating wildlife trafficking or expertise in the use of financial rewards as a law enforcement tool  To select stakeholders to interview, we first identified a list of stakeholders by reviewing (1) FWS and NOAA data on law enforcement agents with at least 5 years of experience who had investigated wildlife trafficking cases and used financial rewards, (2) Department of Justice data on federal prosecutors who had prosecuted wildlife trafficking cases since fiscal year 2014, (3) literature search results identifying academics with expertise in the use of financial rewards as a law enforcement tool and federal programs that use financial rewards to combat illegal activities in contexts outside of wildlife trafficking, (4) the biographies of members of the federal Advisory Council on Wildlife Trafficking, and (5) recommendations from stakeholders we interviewed  From this list, we then used a multistep process to select the 20 stakeholders to interview  To ensure coverage and a range of perspectives, we selected stakeholders from the following groups: FWS and NOAA law enforcement agents, including field and federal prosecutors responsible for prosecuting wildlife trafficking cases; federal officials responsible for programs that use financial rewards to combat illegal activities in contexts outside of wildlife trafficking; academics with expertise in the use of financial rewards as a law members of the federal Advisory Council on Wildlife Trafficking; and representatives of nongovernmental organizations that investigate wildlife trafficking  We conducted semistructured interviews with the 20 selected stakeholders using a standard set of questions  We asked questions about stakeholder views on the usefulness of financial rewards in combating wildlife trafficking; the strength and weaknesses of the statutory provisions that authorize federal agencies to pay financial rewards for information on wildlife trafficking; FWS’s and NOAA’s use of financial rewards to combat wildlife trafficking; and how, if at all, the two agencies could improve their use of financial rewards to combat wildlife trafficking  We analyzed the stakeholders’ responses to our questions, grouping the responses into overall themes  We summarized the results of our analysis and then shared the summary with relevant FWS and NOAA officials to obtain their views  Views from these stakeholders cannot be generalized to those whom we did not select and interview  We conducted this performance audit from February 2017 to April 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  The Department of the Interior’s U S  Fish and Wildlife Service (FWS) and the Department of Commerce’s National Oceanic and Atmospheric Administration (NOAA) implement or enforce multiple laws that specifically authorize the payment, under specified circumstances, of financial rewards to persons for information about violations of laws that prohibit wildlife trafficking  The laws that FWS officials identified are listed and summarized in table 3, and the laws that NOAA officials identified are listed and summarized in table 4  In addition, as noted above, the reward provisions in the Magnuson- Stevens Fishery Conservation and Management Act as amended and the Fish and Wildlife Improvement Act as amended authorize the payment of rewards for information about violations of multiple laws  Specifically, the Magnuson-Stevens Fishery Conservation and Management Act as amended authorizes the payment of rewards for information about violations of the act as well as any other marine resource law that the Secretary of Commerce enforces  Further, the Fish and Wildlife Improvement Act as amended authorizes the payment of rewards for information about violations of any law administered by NOAA’s National Marine Fisheries Service relating to plants, fish, or wildlife  NOAA officials identified 14 such laws that prohibit wildlife trafficking (see table 5)  If a violation of the laws listed in table 5 occurs, NOAA officials said they could use the Magnuson-Stevens Fishery Conservation and Management Act or Fish and Wildlife Improvement Act reward provision to pay a reward for information on the violation  None of the laws listed in table 5 specifically authorize the payment of financial rewards  Table 6 provides information on U S  Fish and Wildlife Service and National Oceanic and Atmospheric Administration cases where these agencies reported paying rewards for information on wildlife trafficking from fiscal years 2007 through 2017  In addition to the contact named above, Alyssa M  Hundrup (Assistant Director), David Marroni (Analyst-in-Charge), Cindy Gilbert, Keesha Luebke, Jeanette Soares, Sheryl Stein, Sara Sullivan, and Judith Williams made key contributions to this report 

ground_truth: Wildlife trafficking—the poaching and illegal trade of plants, fish, and wildlife—is a multibillion-dollar, global criminal activity that imperils thousands of species. FWS and NOAA enforce laws prohibiting wildlife trafficking that authorize the agencies to pay financial rewards for information about such illegal activities. GAO was asked to review FWS's and NOAA's use of financial rewards to combat wildlife trafficking. This report examines (1) laws that authorize FWS and NOAA to pay rewards for information on wildlife trafficking and the extent to which the agencies paid such rewards from fiscal years 2007 through 2017, (2) the agencies' reward policies, (3) information available to the public on rewards, and (4) the extent to which the agencies reviewed the effectiveness of their use of rewards. GAO reviewed laws, examined FWS and NOAA policies and public communications on rewards, analyzed agency reward data for fiscal years 2007 through 2017 and assessed their reliability, interviewed FWS and NOAA officials, and compared agency policies and public communications on rewards to federal internal control standards. Multiple laws—such as the Endangered Species Act and Lacey Act—authorize the Departments of the Interior's U.S. Fish and Wildlife Service (FWS) and Commerce's National Oceanic and Atmospheric Administration (NOAA) to pay rewards for information on wildlife trafficking. FWS and NOAA reported paying few rewards from fiscal years 2007 through 2017. Specifically, the agencies collectively reported paying 27 rewards, totaling $205,500. Agency officials said that the information was complete to the best of their knowledge but could not sufficiently assure that this information represented all of their reward payments. FWS and NOAA have reward policies that outline the general process for preparing reward proposals, but FWS's policy does not specify factors for its agents to consider when developing proposed reward amounts. Some FWS agents GAO interviewed said that in developing proposals, they did not know whether their proposed reward amounts were enough, too little, or too much. By augmenting its policy to specify factors for agents to consider, FWS can better ensure that its agents have the necessary quality information to prepare proposed reward amounts, consistent with federal internal control standards. FWS and NOAA communicate little information to the public on rewards. For example, most agency websites did not indicate that providing information on wildlife trafficking could qualify for a reward. This is inconsistent with federal standards that call for management to communicate quality information so that external parties can help achieve agency objectives. FWS and NOAA officials said they have not communicated general reward information because of workload concerns, but they said it may be reasonable to provide more information in some instances. By developing plans to communicate more reward information to the public, the agencies can improve their chances of obtaining information on wildlife trafficking that they otherwise might not receive. FWS and NOAA have not reviewed the effectiveness of their use of rewards. The agencies have not done so because using rewards has generally not been a priority. FWS and NOAA officials agreed that such a review would be worthwhile but provided no plans for doing so. By reviewing the effectiveness of their use of rewards, FWS and NOAA can identify opportunities to improve the usefulness of rewards as a tool for combating wildlife trafficking. GAO is making seven recommendations, including that FWS and NOAA track reward information, FWS augment its reward policy to specify factors for agents to consider when developing proposed reward amounts, FWS and NOAA develop plans to communicate more reward information to the public, and FWS and NOAA review the effectiveness of their reward use. Both agencies concurred with these recommendations.