prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.

Report 1: Risk management, as applied to security of federal facilities, entails a continuous process of applying a series of mitigating actions—assessing risk through the evaluation of threats, vulnerabilities, and consequences; responding to risks with appropriate countermeasures; and monitoring risks using quality information (see fig  1)  In 1995, Executive Order 12977 established the ISC after the bombing of the Oklahoma City Alfred P  Murrah Federal Building in April 1995  The ISC’s mandate is to enhance the quality and effectiveness of security in and protection of federal facilities in the United States occupied by federal employees for nonmilitary activities  The order directs the ISC to develop and evaluate security standards for federal facilities, develop a strategy to ensure executive agencies and departments comply with such standards, and oversee the implementation of appropriate security measures in federal facilities  The ISC has released a body of standards, including the ISC Standard, designed to apply to the physical security efforts of all federal, non-military agencies  The ISC Standard prescribes a process for agencies to follow in developing their risk assessment methodologies (see fig  2)  Most federal departments and agencies are generally responsible for protecting their own facilities and have physical security programs in place to do so  The ISC Standard requires executive departments and agencies to follow the risk-management process when conducting risk assessments for each of their facilities  That process begins with determining the facility security level, ranging from level I (lowest risk) for facilities generally having 100 or fewer employees to level V (highest risk) for the most critical facilities and generally having greater than 750 employees  The security level designation determines the facility’s baseline countermeasures  For each facility, departments and agencies are required to (a) consider all of the “undesirable events” that could pose a risk to their facilities— such as active shooters, vandalism, and explosions—and (b) assess three factors of risk (threats, vulnerabilities, and consequences) to specific undesirable events  Subsequently, agencies are to combine all three factors to yield a measurable level of risk for each undesirable event (see app  III)  Based on the results of these assessments, agencies should customize (either increase or decrease) the countermeasures to adequately reflect the assessed level of risk  In addition, as part of planning for physical security resources within an agency’s budget process, the ISC has identified the need to balance allocations for countermeasures with other operational needs and with competing priorities  The ISC Best Practices have some similarities with leading practices in capital decision-making  For example, both state that the allocation of resources should be integrated into the agency’s mission, objectives, goals, and budget process  However, beyond the ISC Best Practices, the Office of Management and Budget and we have developed more comprehensive leading practices in capital decision- making that provide agencies with guidance for prioritizing budget decisions such as for countermeasure projects  The Office of Management and Budget and our guidance also emphasize evaluating a full range of alternatives, informed by agency asset inventories that contain condition information, to bridge any identified performance gap  Furthermore, the guidance calls for a comprehensive decision-making framework to review, rank, and select from among competing project proposals  Such a framework should include the appropriate levels of management review, and selections should be based on the use of established criteria  The following describes the mission and physical security program characteristics for the agencies in our review: CBP, the nation’s largest law enforcement agency, has responsibility for securing the country’s borders  It also has responsibility for conducting security assessments at about 1,200 facilities, including approximately 215 federally owned and agency-controlled higher-level facilities (facility security levels III and IV)  These facilities include border patrol stations with holding cells for people detained at the border, office buildings, and canine-training centers  CBP conducts these assessments  FAA’s mission is to provide a safe and efficient aerospace system for the country  According to agency data, FAA has 55 federally owned and agency-controlled higher-level facilities—including critical air traffic control towers  According to FAA officials, FAA specialists conduct security assessments  ARS conducts research related to agriculture and disseminates information to ensure high-quality safe food and to sustain a competitive agricultural economy  According to agency data, ARS has security responsibility for four domestic federally owned and agency- controlled higher-level facilities—including laboratories for research to improve food and crop quality, office buildings, and warehouses  ARS security personnel have responsibility for conducting security assessments  The Forest Service sustains the health, diversity, and productivity of the nation’s forests and grasslands  According to agency officials, the Forest Service has one federally owned and agency-controlled higher- level facility—a regional headquarters office building  The Forest Service’s security officials have responsibility for conducting security assessments, but at the time of our review, USDA security officials conducted the assessment at Forest Service’s one higher-level facility  None of the four selected agencies’ security assessment methodologies fully aligned with the ISC Standard  The ISC gives agencies some flexibility to design their own security-assessment methodologies for identifying necessary countermeasures as long as the chosen methodology adheres to fundamental principles of a sound risk- management methodology  Specifically, methodologies must: consider all of the undesirable events identified in the ISC Standard as possible risks to federal facilities, and assess three factors of risk (threats, vulnerabilities, and consequences) for each of the events  Furthermore, the ISC Standard requires executive departments and agencies to document decisions that deviate from the ISC Standard  Agencies’ policies and methodologies reference the ISC Standard  However, none of the agencies’ methodologies considered all of the undesirable events during assessments although they used some type of risk assessment methodology  In addition, the agencies did not always adhere to these principles of risk management (see table 1)  At the time of our review, CBP’s methodology did not fully align with the ISC Standard because it did not consider all of the 33 undesirable events nor assess threat and consequence  CBP security specialists assessed vulnerabilities at building entrances and exits, in interior rooms, and around the perimeter using a yes/no checklist during the assessment process  However, assessment reports showed that specialists did not assess the threats and consequences of undesirable events at each facility  According to security officials, the gap occurred because they designed the checklist to meet requirements in the 2009 CBP Security Policy and Procedures Handbook, which predates the first edition of the ISC Standard issued in 2010  CBP officials told us that as of January 2017, they began using an improved methodology to assess the threats, vulnerabilities, and consequences for 30 of 33 undesirable events— omitting three now identified in the November 2016 revision to the ISC Standard  However, CBP has not yet updated its handbook to align with the ISC Standard, even though it started this effort over 3 years ago in December 2013  CBP officials did not provide a draft of its updated handbook, but they provided a plan with milestone dates for issuing the handbook by September 2018  CBP officials also told us that updates to the handbook may have to wait due to competing priorities, including efforts to address the backlog of assessments (which we discuss later in this report)  Delays in updating the handbook mean that CBP’s policy will continue to not align with the ISC Standard  Furthermore, although CBP security officials told us that all of the agency’s security specialists have been trained to use the improved assessment methodology, without documentation of the methodology in agency policy, there may be greater risk of its inconsistent application  Standards for Internal Control emphasize the importance of agencies developing and documenting policies to ensure agency-wide objectives are met  Documentation serves to retain institutional knowledge over time when questions about previous decisions arise  Without an updated policy handbook that requires a methodology that assesses all undesirable events consistent with the ISC Standard, CBP cannot reasonably ensure that its facilities will have levels of protection commensurate to their risk  FAA’s methodology does not fully align with the ISC Standard because it does not consider all of the 33 undesirable events nor does it assess all three factors of risk  FAA security specialists assess vulnerabilities to the site perimeter, entryways, and interior rooms using a yes/no checklist, but the checklist does not assess the consequences from each of the undesirable events at each facility  With respect to threat, FAA applies the ISC’s baseline threat—a general federal facilities threat level that relates directly to a set of baseline countermeasures—across all its higher-level facilities because FAA policy states that there is no agency-specific threat that exceeds the current baseline threat  According to FAA officials, the baseline threat standardizes the security needs across their facilities rather than addressing the security needs of individual facilities from specific threats  When necessary, FAA policy allows specialists to modify countermeasures based on an evaluation of conditions at the facility  FAA realized that this approach was no longer appropriate given the agency-wide goal to make risk-based decisions, a review of the assessment process after a 2014 Chicago fire incident that destroyed critical FAA equipment, and an awareness of ISC initiatives to assess compliance  To address the resulting methodological gaps, FAA hired a contractor to design, develop, test, and validate an improved risk- assessment methodology  Subsequently, FAA improved its methodology in January 2017 to assess the threats, vulnerabilities, and consequences for 30 of the 33 undesirable events identified in the November 2016 revision to the ISC Standard —and tested the methodology at lower- and higher-level facilities  This revised methodology addresses the need to assess individual facility needs rather than using a standardized baseline approach  In April 2017, FAA officials told us of their plan for implementing this methodology and provided tentative milestone dates to conduct further testing, training, and analysis before deciding to use the improved methodology, which they expect to complete by January 2018  However, their plan lacks the necessary information to ensure successful implementation, such as detail on how many facilities they will test and how they will use the results of testing, training, and analysis to implement the improved methodology within the identified 9-month time frame  Furthermore, the improved methodology does not address undesirable events for which ISC issued countermeasures in May 2017  Without a detailed implementation plan to assess the methodology’s impact on its security program, FAA cannot reasonably ensure that its facilities have the proper countermeasures  With ongoing changes to its security program, FAA has an opportunity to fully align its improved methodology with the ISC Standard by including all 33 undesirable events and to update its policy requiring the use of such a methodology  Unlike CBP and FAA—which developed their own methodologies separate from their parent departments (Department of Homeland Security (DHS) and Department of Transportation (DOT), respectively)— ARS and the Forest Service follow an assessment methodology developed by USDA  USDA’s methodology does not fully align with the ISC Standard because it does not consider all of the 33 undesirable events for which ISC issued countermeasures in May 2017  Security specialists from USDA headquarters typically assess ARS’s and the Forest Service’s higher-level facilities using a risk-based methodology that considers the 31 undesirable events listed in the previous version of the ISC Standard dated August 2013  However, until recently, USDA did not assign ratings to each of the three risk factors—threat, vulnerability, and consequence—and then combine these ratings to yield a measurable level of risk for each undesirable event  USDA security officials said that they have revised the assessment-reporting format to include this risk calculation and trained their specialists to measure risk in this way  USDA officials provided us with a new assessment template that addresses all 33 undesirable events and includes measuring risk  Additionally, USDA officials said that they are revising their outdated physical security manual and expect to complete it by April 2018  With a revised manual and application of the new assessment template, USDA should be better positioned to assess risk at its facilities  When agencies do not use methodologies that fully align with the ISC Standard, they could face deleterious effects, ranging from facilities having inappropriate levels of protection to agencies having an inability to make informed resource allocation decisions for their physical security needs  Specifically, the ISC Standard states that facilities may face the effect of either having (1) less protection than needed resulting in inadequate security or (2) more protection than needed resulting in an unnecessary use of resources  The ISC Standard also states that these effects can be negated by determining the proper protection according to a risk assessment  Identified excess resources in one risk area then can be reallocated to underserved areas, thus ensuring the most cost- effective security program is implemented  As an illustration of such potential effects, we found that two agencies assessing two higher-level facilities came to two different conclusions in terms of their need for X-ray machines to screen for guns, knives, and other prohibitive items in federal facilities  Specifically, one agency based its decision on a policy that does not deviate from the ISC’s baseline set of countermeasures, and the other agency based its decision on professional judgement that deviated from the ISC’s baseline set of countermeasures  Neither agency based its decision on a risk assessment nor documented its decision—both ISC requirements, specifically: Without conducting a risk assessment, FAA recently expanded a policy requirement calling for all higher-level facilities to have X-ray machines and magnetometers  This new requirement poses a potentially sizeable investment for the agency with an estimated cost of X-ray machines of about $24,000 and magnetometers of about $4,000 each  FAA may need such equipment at all its higher-level facilities  However, the ISC Standard requires that agencies conduct risk assessments first to justify their needs  Without conducting risk assessments, FAA managers could unnecessarily use resources by installing such equipment in all higher-level air traffic facilities when there may be higher priority needs A USDA security specialist decided, despite an ISC baseline requirement that higher–level facilities have X-ray machines, not to recommend an X-ray machine at a higher-level Forest Service facility  The specialist reasoned that unlike other federal buildings with numerous unknown visitors, this facility receives mostly known individuals and a limited number of visitors  The ISC Standard allows for professional judgement; however, the ISC requires that agencies document deviations from the baseline set of countermeasures  Reducing the facility’s level of protection without documenting an assessment of risk could result in no record of the basis of the decision for current and future facility managers and security officials to review or use as justification in the case of a question of compliance  In another case, we found that one higher-level facility did not have access control for employees or visitors nor did it have armed guard patrols  The facility manager told us that intelligence and a history without incidents gave leadership reason to believe that these measures were not needed and that therefore the agency did not require and would not fund such protective measures for this facility—in effect, accepting the risks to the facility  Security officials said they also had the same understanding and did not document the matter in the assessment report even though agency policy and the ISC Standard require written documentation when officials deviate from the baseline requirement  Without security assessments that fully align with the ISC Standard and provide measureable levels of risk, agencies do not have the information they need to determine priorities and make informed resource allocation decisions  For example, they may not be able to assess whether to acquire or forego costly physical-security countermeasures—such as, X- ray machines, access control systems, and closed-circuit television systems—for facilities  Additionally, after determining the need to acquire a countermeasure, agencies must fund the countermeasure  As previously discussed, leading practices in capital decision-making include a comprehensive framework to review, rank, and select from competing project proposals for funding  In conducting risk assessments that do not fully align with the ISC Standard (i e , not assessing threats, vulnerabilities, and consequences and measuring risks), agencies miss the opportunity for more informed funding decisions  Three of the four agencies (CBP, ARS, and the Forest Service) currently prioritize funding for operational needs over physical security needs (see table 2) when agencies’ priorities might be different if they based their decisions on an aligned risk assessment  Standards for Internal Control state that agencies should use quality information on an ongoing basis as a means to monitor program activities and take corrective action, as necessary  The ISC requires that agencies assess higher-level facilities at least once every 3 years—an interval requirement to identify and address evolving risks  We found that three of the four agencies (CBP, ARS, and the Forest Service) did not meet this requirement  Officials reported various challenges including (1) assessments competing with other security activities, (2) an insufficient number of qualified staff to conduct assessments when compared to the number of facilities, or (3) not knowing of the required assessment schedule  An “information system” is the people, processes, data, and technology that management organizes to obtain, communicate, or dispose of information  that had not been reassessed since 2010  CBP security officials attributed the backlog to (1) having too few security specialists assigned to assess about 1,200 facilities and (2) the specialists working on competing priorities, such as revising the security handbook, conducting technical inspections, and reviewing new construction designs and renovation projects  According to CBP security officials, they have developed a plan to eliminate the backlog by the end of fiscal year 2018 by prioritizing the completion of assessments  While we found the plan comprehensive, the schedule did not seem feasible  For example, the plan assumes that one specialist can complete six assessments in 3 consecutive days and that another specialist can complete three assessments in 1 day  In contrast, security officials told us specialists take about 20 work hours (or 2½ days) to conduct an on-site assessment of one facility  CBP officials said that they believe they can meet the time frames of the plan because they have set aside other priorities and have a thorough understanding of the scope of work involved at the facilities  They added that it will not be easy to meet the timeline, but they can accomplish it with a motivated and committed workforce, adequate financial resources, and absent activities that would otherwise require shifting of resources  We question the feasibility of setting aside important priorities, such as updating the policy manual and reviewing physical security elements in new construction designs, as well as the workload assumptions for completing the assessments  Further, these other priorities are also key to securing facilities  Without balancing assessments with competing priorities, CBP’s time frames for completing the assessments by the end of fiscal year 2018 may not be feasible and may also result in the agency’s not addressing other important physical security responsibilities  Since the ISC issued its standard in 2010, ARS and the Forest Service have assessed their higher-level facilities at least once  However, these agencies have not reassessed all of their higher-level facilities within the 3-year interval requirement  Specifically, security specialists have not conducted required reassessments of two ARS and one Forest Service higher-level facilities  The ARS headquarters official explained that the agency had not reassessed the two facilities due to competing priorities and insufficient internal resources  During the course of our review, ARS headquarters officials said they began assessing one of the two ARS facilities in May 2017 and will begin assessing the second facility in October 2017  The Forest Service official explained that the agency missed its security reassessment of the regional office because the facility staff had not requested one  During our visit, facility staff responsible for security told us that they were not aware of the ISC’s 3- year interval requirement  Facility staff requested a reassessment, and security officials told us that they expected to complete it by mid-June 2017  Completing this one-time assessment may address the facility’s security needs temporarily  However, ARS and the Forest Service have not implemented a long-term schedule with key milestones and lack a means to monitor completion of assessments of higher-level facilities at least once every 3 years  Consequently, these agencies cannot reasonably ensure that they have full knowledge of the risks to their facilities  FAA data from 2010 through 2016 show that FAA has assessed its 55 higher-level facilities at least once every 3 years  FAA policy requires that specialists schedule assessments of higher-level facilities every 12– 18 months depending on whether the facility has met FAA physical security standards  The ISC Standard states that to make appropriate resource decisions, agencies need information, such as what is being accomplished, what needs management attention, and what is performing at expected levels  We found that agencies’ methods of collecting and storing security information had limitations that affected agency and facility officials’ oversight of the physical security of their facilities (see table 3)  Without having long-term, agency-wide information to monitor whether assessments are conducted on schedule, ARS and the Forest Service may not meet the ISC Standard, resulting in not adequately protecting their facilities and employees  The ISC Standard also states that agencies should measure their security program’s capabilities and effectiveness to demonstrate the need to fund facility security and to make appropriate decisions for allocating resources  However, the agencies in our review were unable to demonstrate appropriate oversight of their physical security programs because: CBP’s handbook does not include requirements for data collection and analysis for monitoring physical-security program activities  Facility managers and security officials do not enter assessment results, such as the countermeasures recommended for facilities, in the real property database  Consequently, they do not have comprehensive data to manage their security program, assess overall performance, and take any necessary corrective actions  A CBP official told us that a comprehensive database would allow CBP to set priorities for addressing countermeasures  Without including data collection and analysis requirements in its updated handbook, CBP may be unable to monitor the performance of its physical security program  FAA’s policy does not require ongoing monitoring of physical security information, such as the status of recommended countermeasures or assessment schedules  As a result, FAA officials do not proactively use physical security information to assess the overall performance of its physical security program and take corrective actions before an incident occurs  Without a policy requiring ongoing monitoring of information—an internal control activity, FAA may be unable to assess the overall performance of its security program and take necessary corrective actions  USDA has a decentralized security program and places the responsibility on agencies to create their physical security programs  Security officials from ARS and the Forest Service told us that USDA does not have a policy for collecting and managing agency-wide information; however, they said that USDA is drafting a new departmental regulation and manual that will specify (1) the roles and responsibilities of agency and facility managers and (2) electronic- data-reporting requirements for monitoring the performance of the physical security program  USDA officials provided a draft of USDA’s regulation and manual for our review  The draft regulation did not mention data reporting and monitoring, while the draft manual only contained a table of contents that included a section entitled “Facility Tracking Database ” USDA officials expect to issue new policies sometime between October 2017 and April 2018  In the absence of new departmental regulation and manual, USDA and Forest Service officials told us that they have begun to develop a Forest Service system for storing electronic copies of agency-wide assessments and that they plan to expand the use of this system to track site specific assessment dates and status of recommended countermeasures  Forest Service officials provided milestone dates and described the capabilities for a future information system, which they expect to complete in September 2017  However, we could not determine whether the manual will have information system requirements to monitor agencies’ physical security program, an internal control activity  Without USDA’s including data collection and analysis requirements in its manual, its agencies may not be able to monitor the performance of their physical security programs  Without agencies having information to monitor security activities, they were unable to provide us information on the status of countermeasures across their entire portfolio  In order to better understand the status of countermeasures implemented and facilities’ experiences when implementing countermeasures, we determined the status of countermeasures at 13 facilities we visited  As previously noted, risk management, as it pertains to physical security, involves agency officials monitoring their physical security programs  During our visits to 13 selected facilities, we found the four agencies differed in the number of countermeasures that they had not implemented  Facility officials provided us with some information on why countermeasures had not been implemented, specifically: CBP had a significant number of recommended countermeasures from 2010 through 2016 that remained open at the eight selected CBP facilities  CBP facility officials gave reasons why recommended countermeasures had not been implemented  At one facility, officials did not know about the recommended countermeasures from its last 2010 assessment because the individuals previously knowledgeable about the assessments left the organization without communicating the results  By taking action to improve facility security, they implemented some needed countermeasures  However, at the time of our review, a large number of the recommendations remained open  At another facility, officials told us that they too had not known (for the same reason mentioned above) of their 2010 assessment, which contained recommended countermeasures  However, these officials told us that they submitted a funding request a few weeks before our visit to address all except one of the open countermeasures  In other cases, facilities have not implemented needed countermeasures due to resource constraints or physical site limitations  FAA had a large number of recommended countermeasures from 2010 through 2016 that remained open at the time of our review for the two FAA facilities visited  In this case, the most recent security assessment, completed in late 2016, resulted in one facility’s having little time to implement countermeasures by the time we conducted our analysis  While ARS had closed almost all recommended countermeasures at two facilities at the time of our review, one Forest Service facility had not yet implemented a recommendation (to secure its entrance doors) that was identified in a 2013 security assessment (see bottom center photo, fig  3)  This countermeasure remained open because facility officials said they continued to explore alternatives to address the recommendation  Figure 3 shows examples of countermeasures not fully implemented at selected facilities we visited  During our site visits and discussions with facility staff, we found that physical site limitations or other priorities can make it difficult for facility managers to implement countermeasures  For example, a countermeasure might involve correcting a clear zone violation—that is, moving an object (such as a brick wall) a certain distance away from the facility’s perimeter fence to prevent a potential intruder from using the object to climb over the fence  However, when the object near the fence is a building and the property outside of the fence is not federally owned (see bottom right photo, fig  3), it may not be cost effective to correct the clear zone violation  In this situation, the agency bears the responsibility for exploring ways to address the vulnerability  In following the ISC Standard, as previously noted, managers are required to justify and document why they could not implement recommended countermeasures—what the ISC calls risk acceptance  Selected agencies carry a great responsibility for protecting facilities that support border protection activities, provide safe and efficient air traffic around the country, and protect the quality of the nation’s food supply  With this responsibility comes the need to appropriately assess risk to ensure the security of these agencies’ facilities  However, 7 years after the ISC issued its initial risk-management process standard, each of four selected agencies continued to use assessment methodologies that did not fully align with this standard  During our review, agencies improved their methodologies to better align with the ISC Standard, but the agencies had not yet incorporated the methodologies into their policies and procedures  Without updated policies and procedures requiring a methodology that adheres to the ISC Standard (including all 33 undesirable events now identified in the November 2016 revision to the ISC Standard), agencies may not collect the information needed to assess risk and determine priorities for improved security  This situation could hamper the agencies’ ability to make informed resource allocation decisions or to recommend countermeasures commensurate to the needs at specific facilities  To address challenges in conducting timely assessments, agencies that had a backlog developed plans to address them, but the assumptions used in CBP’s plans and time frames did not appear to fully reflect the agency’s competing priorities and actual experience  Additionally, ARS and Forest Service have not implemented a long-term assessment schedule with key milestones to ensure that higher-level facilities are reassessed at least once every 3 years  Further, in cases where the agencies may have had risk assessment information, CBP, ARS, and the Forest Service lack the means to collect, store, and analyze this information in order to monitor the status of a facility’s security  Without these key aspects of a comprehensive security program—a methodology that meets the standard, policies, and procedures that incorporate that methodology; the ability to complete assessments on time; and information to perform monitoring—agencies remain vulnerable to substantial security risks  To improve agencies’ physical security programs’ alignment with the ISC Risk Management Process for Federal Facilities and Standards for Internal Control in the Federal Government for information and monitoring, we recommend that the Commissioner of U S  Customs and Border Protection take the following three actions: with regard to the updated Security Policy and Procedures Handbook, the ISC’s Risk Management Process for Federal Facilities requirement to assess all undesirable events, consider all three factors of risk, and document deviations from the standard, and data collection and analysis requirements for monitoring the performance of CBP’s physical security program  revise the assumptions used in the plan to address the backlog to balance assessments with competing priorities, such as updating the policy manual and reviewing new construction design, to develop a feasible time frame for completing the assessment backlog  Secretary of Transportation direct the FAA Administrator to take the following three actions: develop a plan that provides sufficient details on the activities needed and time frames within the date when FAA will implement an improved methodology; update FAA’s policy to require the use of a methodology that fully aligns with the ISC’s Risk Management Process for Federal Facilities for assessing all undesirable events, considering all three factors of risk, and documenting all deviations from the standard countermeasures; and update FAA’s policy to include ongoing monitoring of physical security information  Secretary of Agriculture take the following two actions: include data collection and analysis requirements for monitoring the performance of agencies’ physical security programs, in the department’s revised physical-security manual, and direct the Administrator of the Agricultural Research Service and the Chief of the Forest Service to implement and monitor a long-term assessment schedule with key milestones to ensure that higher-level facilities are reassessed at least once every 3 years  We provided a draft of this report to the Departments of Homeland Security, Transportation, and Agriculture for review and comment  All three departments agreed with the findings and recommendations for their respective agencies  DHS agreed with our recommendations and provided actions and timeframes for completion  With regard to our recommendation to update the Security Policy and Procedures Handbook, DHS stated that CBP is updating the handbook to include: (1) a discussion and diagram of the ISC risk management process and its application within CBP’s assessment processes; (2) specific guidance for conducting risk assessments in accordance with the ISC’s Risk Management Process for Federal Facilities; and (3) a requirement and guidance for data collection and analysis in support of a robust physical security program  With regard to our recommendation to revise the assumptions used in the plan to address the assessment backlog, DHS stated that CBP has reevaluated current priorities and believes the current plan to eliminate the risk assessment backlog by the end of fiscal year 2018 is achievable  DHS also provided technical comments, which we incorporated as appropriate  DHS’s official written response is reprinted in appendix IV  DOT also agreed with our recommendations and by e-mail requested that we publish the response to the sensitive version of this report  DOT stated that FAA continues to refine its policy and develop processes that address the ISC threats, vulnerabilities, and consequences  Further, DOT stated that FAA would either validate that current mitigation strategies address those risks or apply additional appropriate countermeasures  DOT stated that it will provide a detailed response to each recommendation within 60 days from the date of this report  DOT’s official written response is reprinted in appendix V  USDA agreed with our recommendations and provided the agency-wide actions for completion  USDA provided a plan to ensure compliance with the ISC’s Risk Management Process for Federal Facilities by development of a standard physical-security assessment process and by initiation of a compliance program to track assessments and monitor the installation of countermeasures  In an e-mail, USDA provided milestone dates and planned completion by January 2019  USDA’s official written response is reprinted in appendix VI  If you or your staff has any questions about this report, please contact me at (202) 512-2834 or RectanusL@gao gov  GAO staff who made key contributions to this report are listed in appendix VI  This report examines: (1) how selected agencies’ assessment methodologies align with the Interagency Security Committee’s (ISC) risk management standard for identifying necessary countermeasures and (2) what management challenges, if any, selected agencies reported facing in conducting physical security assessments and monitoring the results  To determine how selected agencies’ assessment methodologies align with ISC standards for identifying the necessary countermeasures, we identified federal executive branch departments and agencies reported by the Department of Homeland Security (DHS) to have received delegations of authority to protect their own buildings  We reviewed the Federal Real Property Council’s data on the Federal Real Property Profile to identify federally owned and agency-controlled buildings  We determined that these data were sufficiently reliable for the purpose of our reporting objectives based upon our recent report that reviewed these data fields  We selected four agencies based upon their large quantity of reported federally owned and agency-controlled buildings: DHS, U S  Customs and Border Protection (CBP); Department of Transportation (DOT), Federal Aviation Administration (FAA); United States Department of Agriculture (USDA), Agricultural Research Service (ARS) and USDA’s United States Forest Service (Forest Service)  This methodology purposely does not include federal buildings protected by FPS and under the control of the General Services Administration as well as other agencies that we reported on in our previous work  We obtained and reviewed one particular ISC standard, The Risk Management Process for Federal Facilities (the ISC Standard) and its related appendices for assessing physical security and providing recommended countermeasures at federal facilities  We obtained and analyzed the selected departments’ and agencies’ facility-security policies and procedures for a risk assessment methodology  According to the ISC Standard, agencies’ risk assessment methodologies must: consider all of the undesirable events identified in the ISC Standard as possible risks to federal facilities as listed in appendix III; assess the threat, consequences, and vulnerability to specific produce similar or identical results when applied by various security provide sufficient justification for deviations from the ISC-defined security baseline  We limited the scope of this review to the first two standards above because agencies’ adherence to these standards could be objectively verified by reviewing and analyzing agency documentation and interviewing agency officials, and their adherence to the two additional standards could not be verified in this manner  We did not conduct risk assessments with independent security professionals to evaluate: 1) the results from prior agency evaluations and 2) the sufficiency of justifications for deviations from the ISC-defined security baseline, as both evaluations were outside of the scope of the engagement  Therefore, for the purposes of this report, risk assessment policies, procedures and resulting methodology that align with ISC standards are those that consider all of the undesirable events and assess the threats, consequences, and vulnerabilities to specific undesirable events  We reviewed and analyzed information to answer the following five questions: 1  Do the policies and procedures mention the ISC standards? 2  Do the policies and procedures consider all of the undesirable events? 3  Do the policies and procedures assess the threat of specific undesirable events? 4  Do the policies and procedures assess the consequences of specific undesirable events? 5  Do the policies and procedures assess the vulnerability to specific undesirable events? We answered each of these questions as either a “Yes” or “No” for our selected agencies  The “No” answer to questions 3, 4, and 5 includes the following two possibilities: (a) the agency’s threat, consequence, or vulnerability ratings are not tied to specific undesirable events, or (b) the agency does not have a framework or formalized steps within which it collects and analyzes threat-, consequence-, or vulnerability-related information  If the answer to each of the five questions was “Yes,” then the agency’s overall risk assessment methodology aligns with ISC risk assessment standards for the purposes of this report  If the answer to one or more of the five questions was “No”, then the agency’s methodology does not to align with ISC standards for the purposes of this report  We interviewed security officials at ISC; three departments (DHS, DOT, and USDA); and four agencies (CBP, FAA, ARS, and the Forest Service)  We obtained and analyzed agency guidance on prioritizing physical security needs and interviewed agencies’ facility maintenance and budget officials  We reviewed the ISC’s best practices for planning for physical security resources within an agency budget process  Additionally, we reviewed the Office of Management and Budget’s and our leading practices in capital decision-making that provide agencies with guidance for prioritizing budget decisions such as “countermeasure projects ” We also reviewed Standards for Internal Control in the Federal Government because internal controls play a significant role in helping agencies achieve their mission-related responsibilities  Our findings from our review of the selected agencies are not generalizable to all ISC member agencies, but provide insight into and illustrative examples about selected agencies’ facility risk-assessment methodologies  To determine what management challenges selected agencies reported facing in conducting physical security assessments and monitoring results, we interviewed agencies’ security, maintenance, and budget officials  We requested agency security officials to provide portfolio- wide data on facility security assessments for our review in order to select sites to visit and analyze data for dates of assessments and the status of findings  We assessed the reliability of this data through interviews with knowledgeable agency staff and a review for completeness and any unexpected values  We compiled information from physical security assessments when no portfolio-wide agency data were available  We determined that these data were sufficient for the purpose of our reporting objectives and selected geographically dispersed sites with buildings with higher reported security levels per the ISC Standard, as these higher security levels have greater requirements and therefore the potential for greater resource needs  See appendix II for the 13 sites we selected  For these selected sites, we interviewed agency staff concerning the assessment process, site-specific findings, recommendations, justification for deviations from ISC’s baseline standards, and management challenges faced in addressing physical security needs  We observed and photographed the status of the findings from the site physical security assessments  We did not independently determine what constitutes a management challenge or a physical security finding  Rather, we relied on these stakeholders to determine these physical security concerns as defined in their own standards and guidance  The information from our selected sites is illustrative and cannot be generalized to sites agency- wide  The performance audit upon which this report is based was conducted from June 2016 to August 2017 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate, evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  We subsequently worked with DHS, DOT and USDA from August 2017 to October 2017 to prepare this version of the original report for public release  This public version was also prepared in accordance with these standards  Error! No text of specified style in document  Error! No text of specified style in document  Appendix VII: GAO Contact and Staff Acknowledgments Error! No text of specified style in document  In addition to the contact named above, Amelia Shachoy (Assistant Director), Steve Martinez (Analyst-in-Charge), Jennifer Clayborne, George Depaoli, Geoffrey Hamilton, Joshua Ormond, Alison Snyder, Amelia Michelle Weathers, and Elizabeth Wood made key contributions to this report 


Report 2: The DRC is a vast, mineral-rich nation with an estimated population of about 83 million people and an area that is roughly one-quarter the size of the United States, according to the United Nations  Figure 1 shows the DRC’s provinces and adjoining countries  Since gaining its independence from Belgium in 1960, the DRC has undergone political upheaval and armed conflict  From 1998 to 2003, the DRC and eight other African countries were involved in what has become known as “Africa’s World War,” which resulted in a death toll of an estimated 5 million people in the DRC, according to the U S  Department of State (State)  The eastern DRC has continued to be plagued by violence, often perpetrated against civilians by illegal armed groups and some members of the Congolese national military  Notably, in 2012, an illegal armed group occupied the city of Goma and other cities in the eastern DRC and clashed with the Congolese national army  During this time, the United Nations reported numerous cases of sexual violence against civilians, including women and children, which were perpetrated by armed groups and some members of the Congolese national military  In 2017, the United Nations reported that serious violations of human rights remain widespread in the DRC, including continued acts of sexual violence by government security forces as well as nonstate armed groups  Various industries, particularly manufacturing industries, use the four conflict minerals specifically named in the Dodd-Frank Act—tin, tungsten, tantalum, and gold—in a wide variety of products  For example, tin is used to solder metal pieces and is also found in food packaging, steel coatings on automobile parts, and some plastics  Tungsten is used in automobile manufacturing, drill bits and cutting tools, and other industrial manufacturing tools and is the primary component of filaments in incandescent light bulbs  Most tantalum is used to manufacture capacitors that enable energy storage in electronic products such as cell phones and computers or to produce alloy additives used in turbines in jet engines  Gold is held as bullion by central bank reserves and used in making jewelry and also in the electronics industry, for example, to manufacture cell phones and laptops  In August 2012, SEC adopted its conflict minerals disclosure rule in response to Section 1502(b) of the Dodd-Frank Act  The act required that SEC promulgate disclosure and reporting regulations regarding the use of conflict minerals originating from the DRC and covered countries  In the summary section of the adopting release for the rule, SEC noted that to accomplish the goal of helping to end the human rights abuses in the DRC caused by the conflict, Congress chose to use the Dodd-Frank Act’s disclosure requirements to bring greater public awareness of the sources of companies’ conflict minerals and to promote the exercise of due diligence on conflict mineral supply chains  The SEC disclosure rule addresses the four conflict minerals named in the Dodd-Frank Act from the DRC and covered countries  The rule outlines a process for companies to follow, as applicable, to comply with the rule (see app  II)  The process broadly requires a company to 1  determine whether it manufactures, or contracts to be manufactured, products with “necessary” conflict minerals; 2  conduct a reasonable country-of-origin inquiry (RCOI) concerning the origin of those conflict minerals; and 3  exercise due diligence, if appropriate, to determine the source and chain of custody of those conflict minerals, adhering to a nationally or internationally recognized due diligence framework, if such a framework is available for these necessary conflict minerals  If companies choose to disclose that their products are “DRC conflict free,” the SEC disclosure rule requires companies to obtain an independent private-sector audit (IPSA)  Our review of companies’ conflict minerals disclosures filed with the SEC in 2017 found that, in general, they were similar to disclosures filed in the prior 2 years  In 2017, a similar number of companies filed conflict minerals disclosures as in 2015 and 2016  Based on our review of a generalizable sample, we found that almost all companies that filed conflict minerals disclosures in 2017 reported performing inquiries about their conflict minerals’ country of origin, similar to the results we previously reported for 2016 and 2015  In their 2017 disclosure reports, many companies described actions they took to improve data collection processes, and most companies indicated challenges in determining the country of origin  Our review of company filings found that almost all companies required to conduct due diligence, as a result of their country- of-origin inquires, reported performing it  SEC issued revised guidance in April 2017, indicating that the SEC’s Division of Corporation Finance would not recommend enforcement action if companies did not report on specified due diligence disclosure requirements  In 2017, 1,165 companies filed conflict minerals disclosures—almost as many companies as filed in 2016 and 2015 (1,230 and 1,281 respectively)  Our analysis of a generalizable sample of filings found that an estimated 90 percent of the companies that filed in 2017 were domestic and an estimated 10 percent were foreign companies, similar to the domestic-to-foreign ratio we found in 2016 and 2015  While not all companies reported the minerals used, of those that disclosed this information, an estimated 69 percent reported using tin, 54 percent reported using tantalum, 59 percent reported using tungsten, and 63 percent reported using gold, figures that are similar to the percentages reported in 2016  Our analysis of a generalizable sample of 2017 filings found that, as in 2016 and 2015, almost all companies that filed conflict minerals disclosures indicated that they performed country-of-origin inquiries  Specifically, an estimated 100 percent of the companies reported that they performed such an inquiry, similar to the percentages that we estimated reported doing so in 2016 and 2015  As a result of the inquiries they conducted, an estimated 53 percent of companies reported in 2017 whether the conflict minerals in their products came from covered countries—similar to the estimate of 49 percent in 2016 and in 2015 but significantly higher than the estimate of 30 percent in 2014 (see fig  2)  In the filings we reviewed, many companies indicated they had taken actions to improve their data collection processes, such as gathering missing information about their supply chains and working with suppliers to encourage conflict-free sourcing  In interviews, representatives of selected companies that filed conflict minerals disclosures in 2017 and other industry participants noted that (1) awareness among suppliers about the use of conflict minerals had continued to increase and (2) the process for collecting data on supply chains had become more routine and standardized  However, as in prior years, our review of filings found that most companies reported challenges in determining the country of origin of conflict minerals, in part due to lack of access to suppliers and complex supply chains involving many suppliers and processing facilities  Our review of company filings found that almost all companies that were required, as a result of their country-of-origin inquires, to conduct due diligence on the source and chain of custody of the conflict minerals in their products reported doing so  In 2017, an estimated 96 percent reported conducting due diligence, compared with 96 and 97 percent in 2016 and 2015 respectively  An estimated 87 percent of companies in 2017 reported using a due diligence framework prescribed by the Organization for Economic Co-operation and Development (OECD) guidance for conducting due diligence on the source and chain of custody of the conflict minerals in their products  That result is comparable to an estimated 92 percent that we reported in 2016 and an estimated 95 percent that we reported in 2015  The remaining 13 percent of the companies that reported conducting due diligence in 2017 did not specify a framework for their due diligence activities  After conducting due diligence, an estimated 37 percent of the companies reported in 2017 that they were able to determine that their conflict minerals came from covered countries or from scrap or recycled sources, compared with an estimated 39 and 23 percent in 2016 and 2015, respectively  An estimated 47 percent of the companies in 2017 reported that they could not definitively confirm the source of the conflict minerals in their products, compared with an estimated 55 and 67 percent in 2016 and 2015, respectively  However, as in previous years, almost all of the companies that reported conducting due diligence in 2017 reported that they could not determine whether the conflict minerals financed or benefited armed groups  Four companies in our sample reported determining that the minerals in their products did not finance or benefit armed groups in covered countries, and declared some products “DRC- conflict free ” Three of these companies included the required independent private-sector audit (IPSA) report, and one company did not include an IPSA report  Overall, a total of 16 companies filed an IPSA report in 2017, compared with 19 in 2016  In April 2017, the SEC’s Division of Corporation Finance issued revised guidance indicating that it would not recommend enforcement action to the Commission if companies did not report on specified due diligence disclosure requirements  The SEC disclosure rule requires companies, if applicable, to report on their due diligence in a conflict minerals report (see app  II for additional detail on the disclosure requirements)  SEC’s Division of Corporation Finance staff told us that they received inquiries from a small number of companies about the filing process for 2017  In response to these inquiries, these staff noted that they advised companies that the companies had the flexibility to determine whether or not to report on their due diligence and to report their country-of-origin inquiry findings in either the Form SD or in a conflict minerals report  However, the Division of Corporation Finance staff also told us that, regardless of the division’s revised guidance, the SEC could still initiate enforcement action if companies do not report on their due diligence, as required by the SEC disclosure rule  In our sample, three companies cited the updated guidance and other statements issued by the SEC in their filings as a rationale for not reporting on due diligence activities  In interviews, representatives of some companies and other industry participants told us that even though the revised guidance and other statements made by the SEC raised some uncertainty about the filing process, generally, companies plan to continue to report similar conflict minerals disclosure information  We identified two new population-based surveys since our last report related to sexual violence in Burundi and Uganda published in 2018; the most recent information for eastern DRC and Rwanda is from 2016  We also identified some new case-file data on sexual violence in the DRC; however, as we reported previously, case-file data on sexual violence are not suitable for estimating an overall rate of sexual violence  We identified two new population-based surveys related to sexual violence that were conducted in Uganda and Burundi in 2016 and 2017, respectively, and whose results were published in 2018  The Uganda Demographic and Health Survey was conducted from June to December 2016 by the Uganda Bureau of Statistics with technical assistance from ICF International  The survey estimated that 12 7 percent of women nationwide, ages 15-49, reported they had experienced sexual violence in the 12-month period preceding the survey, while 21 9 percent reported they had experienced sexual violence at some point in their lifetime  In addition, 4 percent of men nationwide, ages 15-49, reported they had experienced sexual violence in the 12-month period preceding the survey, while 8 3 percent reported they had experienced sexual violence at some point in their lifetime  The Burundi Demographic and Health Survey was conducted from October of 2016 to March of 2017 by the Burundi Institute of Statistics and Economic Studies with technical assistance from ICF International  The survey estimated that 12 7 percent of women nationwide, ages 15- 49, reported they had experienced sexual violence in the 12-month period preceding the survey, while 23 1 percent reported they had experienced sexual violence at some point in their lifetime  In addition, 1 9 percent of men nationwide, ages 15-49, reported they had experienced sexual violence in the 12-month period preceding the survey, while 6 1 percent reported they had experienced sexual violence at some point in their lifetime  The most recent information on the rate of sexual violence for eastern DRC and Rwanda is from 2016 and is discussed in our previous reports  Figure 3 shows the publication dates for the population-based surveys with data on rates of sexual violence in the eastern DRC, Rwanda, Uganda, and Burundi that have been published since 2007  State and United Nations entities have provided additional case-file information about instances of sexual violence in the DRC and adjoining countries  State’s annual country reports on human rights practices provided the following case-file data pertaining to sexual violence in the DRC and Burundi: DRC  In 2017, the UN documented 267 adult victims and 171 child victims, including two boys, of sexual violence in conflict  This violence was perpetrated by illegal armed groups as well as state security forces and civilians and was concentrated in North Kivu Province and in the Kasai region, according to State  Burundi  One government organization—Humara Center— responsible for investigating cases of sexual violence and rape received 197 cases of sexual and gender-based violence through early December 2017, according to State  Observers stated many women were reluctant to report rape, in part due to fear of reprisal, according to State  In addition, UN entities reported the following case-file data about sexual violence in the DRC: DRC  In 2017, the United Nations Organization Stabilization Mission in the DRC verified 195 cases of conflict-related sexual violence, with illegal armed groups responsible for 80 percent of the cases and DRC security forces responsible for the remaining 20 percent  United Nations officials we interviewed raised concerns about a resurgence of sexual violence in certain regions in the DRC due to a variety of factors, including political instability arising from the government’s postponement of the presidential election originally scheduled to take place in November 2016  We provided a draft of this report to the SEC, State, and the U S  Agency for International Development for comment  SEC provided technical comments, which we incorporated as appropriate  State and USAID did not provide comments  We are sending copies of this report to appropriate congressional committees and to the Chairman of the Securities and Exchange Commission, the Secretary of State, and the Administrator of the U S  Agency for International Development  The report is also available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-8612 or gianopoulosk@gao

ground_truth: Protecting federal employees and facilities from security threats is of critical importance. Most federal agencies are generally responsible for their facilities and have physical security programs to do so. GAO was asked to examine how federal agencies assess facilities' security risks. This report examines: (1) how selected agencies' assessment methodologies align with the ISC's risk management standard for identifying necessary countermeasures and (2) what management challenges, if any, selected agencies reported facing in conducting physical security assessments and monitoring the results. GAO selected four agencies—CBP, FAA, ARS, and the Forest Service—based on their large number of facilities and compared each agency's assessment methodology to the ISC Standard; analyzed facility assessment schedules and results from 2010 through 2016; and interviewed security officials. GAO also visited 13 facilities from these four agencies, selected based on geographical dispersion and their high risk level. None of the four agencies GAO reviewed—U.S. Customs and Border Protection (CBP), the Federal Aviation Administration (FAA), the Agricultural Research Service (ARS), and the Forest Service—used security assessment methodologies that fully aligned with the Interagency Security Committee's Risk Management Process for Federal Facilities standard (the ISC Standard). This standard requires that methodologies used to identify necessary facility countermeasures—such as fences and closed-circuit televisions—must: 1. Consider all of the undesirable events (i.e., arson and vandalism) identified by the ISC Standard as possible risks to facilities. 2. Assess three factors—threats, vulnerabilities, and consequences—for each of these events and use these three factors to measure risk. All four agencies used methodologies that included some ISC requirements when conducting assessments. CBP and FAA assessed vulnerabilities but not threats and consequences. ARS and the Forest Service assessed threats, vulnerabilities, and consequences, but did not use these factors to measure risk. In addition, the agencies considered many, but not all 33 undesirable events related to physical security as possible risks to their facilities. Agencies are taking steps to improve their methodologies. For example, ARS and the Forest Service now use a methodology that measures risk and plan to incorporate the methodology into policy. Although CBP and FAA have updated their methodologies, their policies do not require methodologies that fully align with the ISC standard. As a result, these agencies miss the opportunity for a more informed assessment of the risk to their facilities. All four agencies reported facing management challenges in conducting physical security assessments or monitoring assessment results. Specifically, CBP, ARS, and the Forest Service have not met the ISC's required time frame of every 3 years for conducting assessments. For example, security specialists have not conducted required reassessments of two ARS and one Forest Service higher-level facilities. While these three agencies have plans to address backlogs, CBP's plan does not balance conducting risk assessments with other competing security priorities, such as updating its policy manual, and ARS and the Forest Service lack a means to monitor completion of future assessments. Furthermore, CBP, ARS, and the Forest Service did not have the data or information systems to monitor assessment schedules or the status of countermeasures at facilities, and their policies did not specify such data requirements. For example, ARS and the Forest Service do not collect and analyze security-related data, such as countermeasures' implementation. FAA does not routinely monitor the performance of its physical security program. Without improved monitoring, agencies are not well equipped to prioritize their highest security needs, may leave facilities' vulnerabilities unaddressed, and may not take corrective actions to meet physical security program objectives. This is a public version of a sensitive report that GAO issued in August 2017. Information that the agencies under review deemed sensitive has been omitted. GAO recommends: (1) that CBP and FAA update policies to require the use of methodologies fully aligned with the ISC Standard; (2) that CBP revise its plan to eliminate the assessments backlog; and (3) that all four agencies improve monitoring of their physical security programs. All four agencies agreed with the respective recommendations.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.



Report 2: gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix III  In this report, we provide information about (1) companies’ disclosures filed with the U S  Securities and Exchange Commission (SEC) in 2017 compared with disclosures filed in the prior 2 years and (2) the rate of sexual violence in the eastern Democratic Republic of the Congo and neighboring countries published in 2017 and early 2018  To examine the fourth annual company disclosures filed with the SEC in 2017 in response to the SEC disclosure rule, we downloaded the specialized disclosure reports (Form SD) and conflict minerals reports (CMR) from SEC’s publically available Electronic Data Gathering, Analysis, and Retrieval (EDGAR) database in September 2017  We downloaded 1,165 filings identified as Form SDs and the CMRs included in EDGAR  To review the completeness and accuracy of the EDGAR database, we reviewed relevant documentation, interviewed knowledgeable SEC officials, and reviewed prior GAO reports on internal controls related to SEC’s financial systems  We determined that the EDGAR database was sufficiently reliable for identifying the universe of SD filings  We reviewed the conflict minerals section of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) and the requirements of the SEC disclosure rule to develop a data collection instrument (DCI) that guided our analysis of Form SDs and CMRs that contain the information disclosed by the filing companies  Our DCI was not a compliance review of the Form SDs and CMRs  The questions were written in both yes-no and multiple-choice formats  An analyst reviewed the Form SDs and CMRs and recorded responses to the DCI for all of the companies in the sample  A second analyst also reviewed the Form SDs and CMRs and verified the responses recorded by the first analyst  Analysts met to discuss and resolve any discrepancies  We randomly sampled 100 Form SDs from a population of 1,165 to create estimates generalizable to the population of all companies that filed  All estimates based on our sample have a margin of error of plus or minus 10 percentage points or less at the 95-percent confidence level  Because we followed a probability procedure based on random selections, our sample is only one of a large number of samples that we might have drawn  Since each sample could have provided different estimates, we express our confidence in the precision of our particular sample’s results as a 95-percent confidence interval  This is the interval that would contain the actual population value for 95 percent of the samples we could have drawn  We also attended an industry conference on conflict minerals and spoke with company representatives to provide additional perspective  To address our second objective, we identified and assessed any information on sexual violence in the eastern DRC and the three adjoining countries—Rwanda, Uganda, and Burundi—that had been published or otherwise had become available in 2017 and early 2018  We discussed the collection of sexual violence–related data in the DRC and adjoining countries, including population-based survey data and case-file data, during interviews with U S  Department of State and U S  Agency for International Development officials and with representatives of nongovernmental organizations and researchers whom we interviewed for our prior review of sexual violence rates in the eastern DRC and adjoining countries  We also interviewed officials from the United Nations Population Fund and the United Nations Special Representative of the Secretary-General in New York on Sexual Violence in Conflict  In addition, we conducted Internet searches to identify new academic articles containing any additional information on sexual violence published in 2017 and early 2018  We conducted this performance audit from September 2017 to June 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  The U S  Securities and Exchange Commission (SEC) conflict minerals disclosure rule requires certain companies to file a specialized disclosure report, known as the Form SD, if the company manufactures, or contracts to have manufactured, a product or products containing conflict minerals that are necessary to the functionality or the production of those products  The rule also requires each company, as applicable, to provide a description of the measures the company took to exercise due diligence in determining the source and chain of custody of the conflict minerals, the facilities used to process them, their country of origin, and the efforts made to determine the mine or location of origin with the greatest possible specificity  Form SD provides general instructions for filing conflict minerals disclosures and specifies the information that companies must provide  Companies were required to file under the rule for the first time by June 2, 2014, and annually thereafter on May 31  Figure 4 shows the SEC’s flowchart summarizing the conflict minerals disclosure rule  In addition to the individual named above, Godwin Agbara (Assistant Director), Farahnaaz Khakoo-Mausel (Analyst-in-Charge), Diana Blumenfeld, Andrew Kurtzman, Justin Fisher, Grace Lui, David Dayton, Christopher Keblitis, and Michael McAtee made key contributions to this report  Conflict Minerals: Information on Artisanal Mined Gold and Efforts to Encourage Responsible Sourcing in the Democratic Republic of the Congo  GAO-17-733  Washington, D C : August 23, 2017  SEC Conflict Minerals Rule: 2017 Review of Company Disclosures in Response to the U S  Securities and Exchange Commission Rule  GAO-17-517R  Washington, D C : April 26, 2017  Conflict Minerals: Insights from Company Disclosures and Agency Actions  GAO-17-544T  Washington, D C : April 5, 2017  SEC Conflict Minerals Rule: Companies Face Continuing Challenges in Determining Whether Their Conflict Minerals Benefit Armed Groups  GAO-16-805  Washington, D C : August 25, 2016  SEC Conflict Minerals Rule: Insights from Companies’ Initial Disclosures and State and USAID Actions in the Democratic Republic of the Congo Region  GAO-16-200T  Washington, D C : November 17, 2015  SEC Conflict Minerals Rule: Initial Disclosures Indicate Most Companies Were Unable to Determine the Source of Their Conflict Minerals  GAO-15-561  Washington, D C : August 18, 2015  Conflict Minerals: Stakeholder Options for Responsible Sourcing Are Expanding, but More Information on Smelters Is Needed  GAO-14-575  Washington, D C : June 26, 2014  SEC Conflict Minerals Rule: Information on Responsible Sourcing and Companies Affected  GAO-13-689  Washington D C : July 18, 2013  Conflict Minerals Disclosure Rule: SEC’s Actions and Stakeholder- Developed Initiatives  GAO-12-763  Washington, D C : July 16, 2012  The Democratic Republic of Congo: Information on the Rate of Sexual Violence in War-Torn Eastern DRC and Adjoining Countries  GAO-11-702  Washington, D C : July 13, 2011  The Democratic Republic of the Congo: U S  Agencies Should Take Further Actions to Contribute to the Effective Regulation and Control of the Minerals Trade in Eastern Democratic Republic of the Congo  GAO-10-1030  Washington, D C : September 30, 2010 
Report 2:  These centers, which can shelter as many as 20 youth, are generally supposed to be located in areas that are frequented or easily reached by runaway and homeless youth  BCP grantees must make efforts to contact the parents and relatives of runaway and homeless youth  Grantees are also required to establish relationships with law enforcement, health and mental health care, social service, welfare, and school district systems to coordinate services  Grantees maintain confidential statistical records of youth, including youth who are not referred to out-of-home shelter services  Further, grantees are required to submit an annual report to HHS detailing the program activities and the number of youth participating in such activities, as well as information about the operation of the centers  BCP grants are allocated directly to grantees for a three-year period  Funding is generally distributed to entities based on the proportion of the nation's youth under age 18 in the jurisdiction where the entities are located  The 50 states, the District of Columbia, and Puerto Rico each receive a minimum allotment of $200,000  Separately, the territories (currently, this includes American Samoa and Guam) each receive a minimum of $70,000  The amount of funding for each state or territory can further depend on whether grant applicants in that jurisdiction applied for funding, and if so, whether the applicant fulfilled the requirements in the authorizing law and grant application  For example, the authorizing law directs HHS to give priority to applicants who have demonstrated experience in providing services to runaway and homeless youth  HHS is to re-allot any funds designated for grantees in one state to grantees in other states that will not be obligated before the end of a fiscal year  See Table A-1 for the amount of funding allocated for each state in FY2017 and FY2018  The costs of the BCP are shared by the federal government (90%) and grantees (10%)  In FY2008, HHS began funding a three-year Rural Host Homes Demonstration Project , which was initiated to expand BCP shelter and support services to runaway and homeless youth who live in rural areas not served by shelter facilities  The project supported grantees that provided youth with shelter (via host home families who were recruited, screened, and trained) and preventive services, including transportation, counseling, educational assistance, and aftercare planning, among others  Over the course of the three years, the project served 781 youth, 411 of whom received shelter and 370 of whom received preventive services without shelter  Recognizing the difficulty that youth face in becoming self-sufficient adults, the Transitional Living Program provides longer-term shelter and assistance for youth ages 16 through 22 (or older if the youth entered the TLP prior to reaching age 22) who may leave their biological homes due to family conflict, or have left and are not expected to return home  Pregnant and/or parenting youth are eligible for TLP services  In FY2017, the TLP provided services to 3,517 youth  In FY2018, the program funded 229 organizations  Each TLP grantee may shelter up to 20 youth at various sites, such as host family homes, supervised apartments owned by a social service agency, scattered-site apartments, or single-occupancy apartments rented directly with the assistance of the grantee  Youth may remain at TLP sites for up to 540 days (18 months), or longer for youth under age 18  Youth ages 16 through 22 may remain in the program for a continuous period of 635 days (approximately 21 months) under "exceptional circumstances " This term means circumstances in which a youth would benefit to an unusual extent from additional time in the program  A youth in a TLP who has not reached age 18 on the last day of the 635-day period may, in exceptional circumstances and if otherwise qualified for the program, remain in the program until his or her 18 th birthday  Youth receive several types of services at TLP-funded programs: basic life-skills training, including consumer education and instruction in budgeting and the use of credit; parenting support and child care (as appropriate); building interpersonal skills; educational opportunities, such as GED courses and postsecondary training; assistance in job preparation and attainment; and mental and physical health care services  TLP grantees are required to develop a written plan designed to help youth transition to living independently or another appropriate living arrangement, and they are to refer youth to other systems that can help to meet their educational, health care, and social service needs  The grantees must also submit an annual report to HHS that includes information regarding the activities carried out with funds and the number and characteristics of the homeless youth  As part of the FY2002 budget request, the George W  Bush Administration proposed a $33 million initiative to fund maternity group homes—or centers that provide shelter to pregnant and parenting teens who are vulnerable to abuse and neglect—as a component of the TLP  Although the TLP authorized services for pregnant and parenting teens prior to FY2002, the Bush Administration sought funds specifically to serve this population  Increased funds were ultimately provided to enable these youth to access TLP services  The 2003 amendments to the Runaway and Homeless Youth Act ( P L  108-96 ) provided explicit authority to use TLP funds for this purpose  Since FY2004, funding for adult-supervised transitional living arrangements that serve pregnant or parenting women ages 16 to 21 and their children has been awarded to organizations that receive TLP grants  These organizations provide youth with parenting skills, including child development education, family budgeting, health and nutrition, and other skills to promote family well-being  TLP grants are distributed competitively by HHS to community-based public and private organizations throughout the country for a five-year period  Grantees must provide at least 10% of the total cost of the program  HHS is carrying out a study to learn more about the long-term outcomes of 1,250 youth who have used TLP services  The study seeks to describe the outcomes and to isolate and describe promising practices and other factors that may contribute to their successes or challenges  Of particular interest for the study is how services are delivered, the demographics of youth, and their socio-emotional wellness and life experiences  It involves both a process evaluation and impact evaluation, with youth randomly assigned to the treatment (i e , participation in the TLP) and control groups  The study seeks to address the following questions: (1) How do TLP programs operate, what types of program models are used to deliver services, and what services are delivered to homeless youth? (2) What are the long-term housing outcomes and protective factors for youth who participate in the TLP program immediately, six months, 12 months, and 18 months after exiting the program? (3) What interventions can be attributed to any positive outcomes experienced by youth who participate in the TLP? According to HHS, the pilot study revealed challenges "in collecting data from a large enough sample size of youth to detect any effects so that conclusions could be drawn about the impact of homeless youth served by TLPs " HHS is not certain how it will move forward with the study  In FY2016, HHS began the Transitional Living Program Special Population Demonstration project  The project funded nine grantees over a two-year period that tested approaches for serving populations that need additional support: LGBTQ runaway and homeless youth ages 16 to 21; and young adults who have left foster care because of emancipation  Grantees were expected to provide strategies that help youth build protective factors, such as connections with schools, employment, and appropriate family members and other caring adults  According to HHS, a process evaluation will assess how grantees are implementing the demonstration project  HHS separately funded a project from FY2012 through FY2014 to build the capacity of TLPs in serving LGBTQ youth  Known as the 3/40 Blueprint: Creating the Blueprint to Reduce LGBTQ Youth Homelessness , the purpose of the grant was develop information about serving the LGBTQ youth population experiencing homelessness, such as through efforts to identify innovative intervention strategies, determine culturally appropriate screening and assessment tools, and better understand the needs of LGBTQ youth served by RHY providers  The website developed by the grantee, the University of Illinois at Chicago, identifies promising practices that serve LGBTQ youth who are experiencing homelessness and publishes information about their challenges  In FY2009, HHS began the Support Systems for Rural Homeless Youth Demonstration Project   Six states received grants to support TLPs in rural communities in serving young adults who have few or no connections to a supportive family structure or community resources  The five-year project sought to provide services across three main areas: survival support, which includes housing, health care (including mental health), and substance abuse treatment and prevention; community, which includes community service, youth and adult partnerships, mentoring, and peer support groups; and education and employment, which includes high school or GED completion, postsecondary education, and job training and employment  The six states—Colorado, Iowa, Minnesota, Nebraska, Oklahoma, and Vermont—each received annual grants of $200,000  According to HHS, all of the sites engaged youth in positive youth development activities that included safe places for youth to go  In addition, they raised awareness about homelessness in rural areas and addressed some of the unique needs around employment, housing, and transportation  However, the sites also confirmed that there is a general lack of available housing for homeless youth and that transportation was the most critical impediment to serving these youth  The Street Outreach Program provides runaway and homeless youth living on the streets or in areas that increase their risk of using drugs or being subjected to sexual abuse, prostitution, sexual exploitation, and trafficking are eligible to receive services  The program's goal is to assist youth in transitioning to safe and appropriate living arrangements  SOP services include the following: treatment and counseling; crisis intervention; drug abuse and exploitation prevention and education activities; survival aid; street-based education and outreach; information and referrals; and follow-up support  Grants are awarded for a three-year period, and grantees must provide 10% of the funds to cover the cost of the program  In FY2018, 96 grantees were funded  In FY2017 grantees made contact with 24,366 youth  The Family and Youth Services Bureau initiated the Street Outreach Program Data Collection Project in 2012 to learn more about the lives and needs of homeless and runaway youth served by SOP grantees  The purpose of the project was to design services to better meet the needs of these youth  FYSB collected information through focus groups and computer-assisted personal interviews with 656 youth (ages 14 to 21 years) served by grantees in 11 cities  The project found that participants were homeless on average for nearly two years and had challenges with substance abuse, mental health, and exposure to trauma  Youth most identified that they were in need of job training or help finding a job, transportation assistance, and clothing  The top barriers to obtaining shelter were shelters being full, not knowing where to go for shelter, and lacking transportation to get to a shelter  The study researchers concluded that more emergency shelters could help prevent youth from sleeping on the street  Further, they noted that youth on the streets need more intensive case management (e g , careful assessment and treatment planning, linkages to community resources, etc ) and more intensive interventions  HHS funds the Runaway and Homeless Youth Training and Technical Assistance Center (RHYTTAC) to provide technical assistance to RHYP grantees  HHS awarded a five-year cooperative agreement, from September 30, 2017, through September 29, 2020, to National Safe Place to operate RHYTTAC  National Safe Place is a national youth outreach program that aims to educate young people about the dangers of running away or trying to resolve difficult, threatening situations on their own  RHYTTAC is designed to provide training and conference services to RHYP grantees that enhance and promote continuous quality improvement to services provided by RHYP grantees  Further, RHYTTAC offers resources and information through its website, tip sheets, a quarterly newsletter, toolkits, sample policies and procedures, and other resources  RHYTTAC also provides assistance to individual grantees in response to their questions or concerns, as well as concerns raised by HHS as part of the Runaway and Homeless Youth Program Monitoring System (see subsequent section)  A portion of the funds for the BCP, TLP, and related activities are allocated for a national communications system known as the National Runaway Safeline ("Safeline")  The Safeline is intended to help homeless and runaway youth (or youth who are contemplating running away) through counseling, referrals, and communicating with their families  Beginning with FY1974 and every year after, the Safeline, which until 2013 was called the National Runaway Switchboard, has been funded through the Basic Center Program grant or the Consolidated Runaway and Homeless Youth Program grant  The Safeline is located in Chicago and operates each day to provide services to youth and their families across the country  Services include (1) a channel through which runaway and homeless youth or their parents may leave messages; (2) 24-hour referrals to community resources, including shelter, community food banks, legal assistance, and social services agencies; and (3) crisis intervention counseling to youth  In calendar year 2017, the Safeline handled nearly 30,000 contacts with youth (via phone, computer, emails, and postings), of which nearly three-quarters were from youth and 9% were from parents; the other callers were relatives, friends, and others  Other services are also provided through the Safeline  Since 1995, the "Home Free" family reunification program has provided bus tickets for youth ages 12 to 21 to return home or to an alternative placement near their home through Home Free  HHS evaluates each RHYP grantee through the Runaway and Homeless Youth Monitoring System  Staff from regional ACF offices and other grant recipients (known as peer reviewers) inspect the program site, conduct interviews, review case files and other agency documents, and conduct entry and exit conferences  The monitoring team then prepares a written report that identifies the strengths of the program and areas that require corrective action  The Reconnecting Homeless Youth Act of 2008 required that within one year of its enactment (October 8, 2009), HHS was to issue rules that specified performance standards for public and nonprofit entities that receive BCP, TLP, and SOP grants  On April 14, 2014, HHS issued a notice of proposed rulemaking (NPRM) for the new performance standards and other requirements for the Runaway and Homeless youth program grantees  On December 20, 2016, HHS implemented a final rule that was similar to the provisions in the NPRM  These standards are used to monitor individual grantee performance  The Senate Committee on Health, Education, Labor, and Pensions (HELP) and the House Committee on Education and Labor have exercised jurisdiction over the Runaway and Homeless Youth Program  HHS must submit reports biennially to the committees on the status, activities, and accomplishments of program grant recipients and evaluations of the programs performed by HHS  The most recent report was submitted in January 2018, and covered FY2014 and FY2015  The 2003 reauthorization law ( P L  108-96 ) of the Runaway and Homeless Youth Act required that HHS, in consultation with the U S  Interagency Council on Homelessness, submit a report to Congress on the promising strategies to end youth homelessness within two years of the reauthorization, in October 2005  The report was submitted to Congress in June 2007  As mentioned above, the 2008 reauthorization law ( P L  110-378 ) required HHS, as of FY2010, to periodically submit to Congress an incidence and prevalence study of runaway and homeless youth ages 13 to 26, as well as the characteristics of a representative sample of these youth  As discussed, Congress appropriated funding to HUD for this purpose and the study, known as Voices of Youth Count , includes multiple publications about its findings  The 2008 law also directed the Government Accountability Office (GAO) to evaluate the process by which organizations apply for BCP, TLP, and SOP, including HHS's response to these applicants  GAO submitted a report to Congress in May 2010 on its findings  GAO found weaknesses in several of the procedures for reviewing grants, such as that peer reviewers for the grant did not always have expertise in runaway and homeless youth issues and feedback on grants was not provided in a permanent record  In addition, GAO found that HHS delayed telling successful grantees that the grant had been awarded to them  HHS has implemented the recommendations made in the report  Appendix A  Basic Center Program (BCP) Funding Appendix B  Additional Federal Support for Runaway and Homeless Youth Since the creation of the Runaway and Homeless Youth Program, other federal initiatives have also established services for such youth  Youth Homelessness Demonstration Program (YHDP): The omnibus appropriations laws for FY2016 through FY2018 enabled HUD to set aside up to $33 million (FY2016), $43 million (FY2017), and $80 million (FY2018) from the Homeless Assistance Grants account to implement projects that demonstrate how a "comprehensive approach" can "dramatically reduce" homelessness for youth through age 24  The appropriations laws each fiscal year direct this funding to up to 10 communities with the FY2016 funding; up to 11 communities with the FY2017 funding, including at least five rural communities; and up to 25 communities with the FY2018 funding, including at least eight rural communities  HUD has allocated $33 million to 10 communities for FY2016 and $43 million for FY2017  In addition, HUD is taking steps to evaluate the YHDP grantee communities in developing and carrying out a coordinated community approach to preventing and ending youth homelessness  100-Day Challenges to End Youth Homelessness : Since 2016, cities have partnered with public and private entities to accelerate efforts to prevent and end youth homelessness  A Way Home America and Rapid Results Institute, organizations that focus on pressing social problems, have provided support to the organizations  HHS provided training and technical assistance through RHYTTAC to the first three cities involved in the challenge: Los Angeles, CA; Cleveland, OH; and Austin, TX  In general, participating communities have housed homeless youth and have identified new housing options for this population  Youth with Child Welfare Involvement At-Risk of Homelessness (YAHR): HHS has funded grants to build evidence on what works to prevent homelessness among youth and young adults who have child welfare involvement  HHS awarded funds to 18 grantees for a two-year planning period (2013-2015)  Six of the grantees received additional funding to refine and test their service models during a second phase (2015-2018)  A subset of those grantees will then be selected to conduct a rigorous evaluation of their impact on homelessness  In school year 2016-2017, more than 1 3 million children and youth were homeless  Of these students, over 118,000 were homeless youth unaccompanied by their families  The Department of Education administers the Education for Homeless Children and Youth program, which was established under the McKinney-Vento Homeless Assistance Act of 1987 ( P L  100-77 ), as amended  This program assists state education agencies (SEAs) to ensure that all homeless children and youth have equal access to the same, appropriate education, including public preschool education, that is provided to other children and youth  Grants made by SEAs to local education agencies (LEAs) under this program must be used to facilitate the enrollment, attendance, and success in school of homeless children and youth  Program funds may be appropriated for activities such as tutoring, supplemental instruction, and referral services for homeless children and youth, as well as providing them with medical, dental, mental, and other health services  McKinney-Vento liaisons for homeless children and youth in each LEA is responsible for coordinating activities for these youth with other entities and agencies, including local Basic Center and Transitional Living Program grantees  States that receive McKinney-Vento funds are prohibited from segregating homeless students from non-homeless students, except for short periods of time for health and safety emergencies or to provide temporary, special, supplemental services  FY2019 funding for the program is $93 5 million  According to a 2017 survey of 43,000 college students at selected colleges and universities, 9% of those attending four-year universities and 12% of those attending community college had been homeless in the last year  In addition, 37% of university students and 46% of community college students were housing insecure in the past year, meaning that they had difficulty paying rent or lived with others beyond the expected capacity of the housing, among other scenarios  The Higher Education Act (HEA) authorizes financial aid and support programs that target homeless students and other vulnerable populations  For purposes of applying for federal financial aid, a student's expected family contribution (EFC) is the amount that can be expected to be contributed by a student and the student's family toward his or her cost of education  Certain groups of students are considered "independent," meaning that only the income and assets of the student (and not their parents or guardians) are counted  Individuals under age 24 who have been verified during the school year as either (1) unaccompanied and homeless or (2) unaccompanied, self-supporting, and risk of homelessness  This verification can come from a McKinney-Vento liaison for homeless children and youth in the local education agency; the director (or designee) of a program funded under the Runaway and Homeless Youth program; the director (or designee) of an emergency shelter or transitional housing program funded by HUD; or a financial aid administrator  Separately, HEA provides that homeless children and youth are eligible for what are collectively called the federal TRIO programs  This includes the following TRIO programs: Talent Search, Upward Bound, Student Support Services, and Educational Opportunity Centers  The TRIO programs are designed to identify potential postsecondary students from disadvantaged backgrounds, prepare these students for higher education, provide certain support services to them while they are in college, and train individuals who provide these services  HEA directs the Department of Education (ED), which administers the programs, to (as appropriate) require applicants seeking TRIO funds to identify and make services available, including mentoring, tutoring, and other services, to these youth  TRIO funds are awarded by ED on a competitive basis  In addition, HEA authorizes services for homeless youth through TRIO Student Support Services—a program intended to improve the retention and graduation rates of disadvantaged college students—that include temporary housing during breaks in the academic year  In FY2019, TRIO appropriations are $1 1 billion  Separately, HEA allows additional uses of funds through the Fund for the Improvement of Postsecondary Education (FIPSE) to establish demonstration projects that provide comprehensive support services for students who are or were homeless at age 13 or older  FIPSE is a grant program that seeks to support the implementation of innovative educational reform ideas and evaluate how well they work  As specified in the law, the projects can provide housing to the youth when housing at an educational institution is closed or unavailable to other students  FY2019 appropriations for FIPSE are $5 million  Recently emancipated foster youth are vulnerable to becoming homeless  In FY2017, nearly 20,000 youth "aged out" of foster care  The Chafee Foster Care Independence Program (CFCIP), created under the Chafee Foster Care Independence Act of 1999 ( P L  106-169 ), provides states with funding to support children and youth ages 14 to 21 who are in foster care and former foster youth ages 18 to 21 (and up to age 23 in states that extend foster care to age 21)  States are authorized to receive funds based on their share of the total number of children in foster care nationwide  However, the law's "hold harmless" clause precludes any state from receiving less than the amount of funds it received in FY1998 or $500,000, whichever is greater  The program specifies funding for transitional living services, and as much as 30% of the funds may be dedicated to room and board  The program is funded through mandatory spending, and as such $140 million ($143 million as of FY2020) is provided for the program each year through the annual appropriations process  The Family Violence Prevention and Services Act (FVPSA), Title III of the Child Abuse Amendments of 1984 ( P L  98-457 ), authorized funds for Family Violence Prevention and Service grants that work to prevent family violence, improve service delivery to address family violence, and increase knowledge and understanding of family violence  From FY2007 to FY2009, one of these projects focused on runaway and homeless youth in dating violence situations through HHS's Domestic Violence/Runaway and Homeless Youth Collaboration on the Prevention of Adolescent Dating Violence initiative  The initiative was created because many runaway and homeless youth come from homes where domestic violence occurs and may be at risk of abusing their partners or becoming victims of abuse  The initiative funded eight states and community-based organizations to address the issue of teen dating violence among runaway and homeless youth  The grants funded activities such as curriculum on dating violence, small groups for teens, and a sexual assault/dating violence reduction program  The initiative resulted in an online toolkit for advocates in the runaway and homeless youth and domestic and sexual assault fields to help programs better address relationship violence with runaway and homeless youth 

ground_truth: Over the past decade, the United States and the international community have sought to improve security in the DRC. In the eastern DRC, armed groups have committed severe human rights abuses, including sexual violence, and reportedly profit from the exploitation of “conflict minerals”— in particular, tin, tungsten, tantalum, and gold, according to the United Nations. Congress included a provision in the 2010 Dodd-Frank Wall Street Reform and Consumer Protection Act that, among other things, required the SEC to promulgate regulations regarding the use of conflict minerals from the DRC and adjoining countries. The SEC adopted these regulations in 2012. The act also included a provision for GAO to annually assess the SEC regulations' effectiveness in promoting peace and security and report on the rate of sexual violence in the DRC and adjoining countries. In this report, GAO provides information about (1) companies' conflict minerals disclosures filed with the SEC in 2017 compared with disclosures filed in the prior 2 years and (2) the rate of sexual violence in the eastern DRC and adjoining countries published in 2017 and early 2018. GAO analyzed a generalizable random sample of SEC filings and interviewed relevant officials. GAO reviewed U.S., United Nations, and international organizations' reports; interviewed DRC officials, and other stakeholders; and conducted fieldwork in New York at the United Nations headquarters. GAO is not making any recommendations. GAO's review of companies' conflict minerals disclosures filed with the U.S. Securities and Exchange Commission (SEC) in 2017 found that, in general, they were similar to disclosures filed in the prior 2 years. In 2017, 1,165 companies filed conflict minerals disclosures—about the same as in 2016 and 2015. Percentages of companies reporting country-of-origin inquiries in 2017 were also similar to the percentages from those 2 prior years. As a result of the inquiries they conducted, an estimated 53 percent of companies reported in 2017 whether the conflict minerals in their products came from the Democratic Republic of the Congo (DRC) and adjoining countries—similar to the estimated 49 percent in 2016 and 2015 but significantly higher than the estimate of 30 percent in 2014 (see figure). In their 2017 disclosure reports, many companies described actions they took to improve data collection processes, and most companies indicated some challenges in determining the country of origin. Similar to the prior 2 years, almost all companies required to conduct due diligence, as a result of their country-of-origin inquiries, reported doing so. After conducting due diligence to determine the source and chain of custody of any conflict minerals used, an estimated 37 percent of these companies reported in 2017 that they were able to determine that their conflict minerals came from covered countries or from scrap or recycled sources, compared with 39 and 23 percent in 2016 and 2015, respectively. Four companies in GAO's sample declared their products “DRC conflict-free,” and of those, three included the required Independent Private Sector Audit report (IPSA), and one did not. In 2017, 16 companies filed an IPSA; 19 did so in 2016. GAO found information on the rate of sexual violence in the 2017 Uganda and Burundi Demographic and Health Surveys. For Uganda, 22 percent of women and 9 percent of men reported they had experienced sexual violence at least once in their lifetime. For Burundi, 23 percent of women and 6 percent of men reported they had experienced sexual violence at least once in their lifetime. The most recent information on the rate of sexual violence for eastern DRC and Rwanda is from 2016 and is discussed in our previous GAO reports.