prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.

Report 1: While no commonly accepted definition of a community bank exists, they are generally smaller banks that provide banking services to the local community and have management and board members who reside in the local community  In some of our past reports, we often defined community banks as those with under $10 billion in total assets  However, many banks have assets well below $10 billion as data from the financial condition reports that institutions submit to regulators (Call Reports) indicated that of the more than 6,100 banks in the United States, about 90 percent had assets below about $1 2 billion as of March 2016  Based on our prior interviews and reviews of documents, regulators and others have observed that small banks tend to differ from larger banks in their relationships with customers  Large banks are more likely to engage in transactional banking, which focuses on the provision of highly standardized products that require little human input to manage and are underwritten using statistical information  Small banks are more likely to engage in what is known as relationship banking in which banks consider not only data models but also information acquired by working with the banking customer over time  Using this banking model, small banks may be able to extend credit to customers such as small business owners who might not receive a loan from a larger bank  Small business lending appears to be an important activity for community banks  As of June 2017, community banks had almost $300 billion outstanding in loans with an original principal balance of under $1 million (which banking regulators define as small business lending), or about 20 percent of these institutions’ total lending  In that same month, non- community banks had about $390 billion outstanding in business loans under $1 million representing 5 percent of their total lending  Credit unions are nonprofit member-owned institutions that take deposits and make loans  Unlike banks, credit unions are subject to limits on their membership because members must have a “common bond”—for example, working for the same employer or living in the same community  Financial reports submitted to NCUA (the regulator that oversees federally-insured credit unions) indicated that of the more than 6,000 credit unions in the United States, 90 percent had assets below about $393 million as of March 2016  In addition to providing consumer products to their members, credit unions are also allowed to make loans for business activities subject to certain restrictions  These member business loans are defined as a loan, line of credit, or letter of credit that a credit union extends to a borrower for a commercial, industrial, agricultural, or professional purpose, subject to certain exclusions  In accordance with rules effective January 2017, the total amount of business lending credit unions can do is not to generally exceed 1 75 times the actual net worth of the credit union  Federal banking and credit union regulators have responsibility for ensuring the safety and soundness of the institutions they oversee, protecting federal deposit insurance funds, promoting stability in financial markets, and enforcing compliance with applicable consumer protection laws  All depository institutions that have federal deposit insurance have a federal prudential regulator  The regulator responsible for overseeing a community bank or credit union varies depending on how the institution is chartered, whether it is federally insured, and whether it is a Federal Reserve member (see table 1)  Other federal agencies also impose regulatory requirements on banks and credit unions  These include rules issued by CFPB, which has supervision and enforcement authority for various federal consumer protection laws for depository institutions with more than $10 billion in assets and their affiliates  The Federal Reserve, OCC, FDIC, and NCUA continue to supervise for consumer protection compliance at institutions that have $10 billion or less in assets  Although community banks and credit unions with less than $10 billion in assets typically would not be subject to CFPB examinations, they generally are required to comply with CFPB rules related to consumer protection  In addition, FinCEN also issues requirements that financial institutions, including banks and credit unions, must follow  FinCEN is a component of Treasury’s Office of Terrorism and Financial Intelligence that supports government agencies by collecting, analyzing, and disseminating financial intelligence information to combat money laundering  It is responsible for administering the Bank Secrecy Act, which, with its implementing regulations, generally requires banks, credit unions, and other financial institutions, to collect and retain various records of customer transactions, verify customers’ identities in certain situations, maintain AML programs, and report suspicious and large cash transactions  FinCEN relies on financial regulators and others to examine U S  financial institutions to determine compliance with these requirements  In addition, financial institutions also have to comply with requirements by Treasury’s Office of Foreign Asset Control to review transactions to ensure that business is not being done with sanctioned countries or individuals  In response to the 2007-2009 financial crisis, Congress passed the Dodd- Frank Act, which became law on July 21, 2010  The act includes numerous reforms to strengthen oversight of financial services firms, including consolidating consumer protection responsibilities within CFPB  Under the Dodd-Frank Act, federal financial regulatory agencies were directed to or granted authority to issue hundreds of regulations to implement the act’s reforms  Many of the provisions in the Dodd-Frank Act target the largest and most complex financial institutions, and regulators have noted that much of the act is not meant to apply to community banks  Although the Dodd-Frank Act exempts small institutions, such as community banks and credit unions, from several of its provisions, and authorizes federal regulators to provide small institutions with relief from certain regulations, it also contains provisions that impose additional restrictions and compliance costs on these institutions  As we reported in 2012, federal regulators, state regulatory associations, and industry associations collectively identified provisions within 7 of the act’s 16 titles that they expected to affect community banks and credit unions  The provisions they identified as likely to affect these institutions included some of the act’s mortgage reforms, such as those requiring institutions to ensure that a consumer obtaining a residential mortgage loan has the reasonable ability to repay the loan at the time the loan is consummated; comply with a new CFPB rule that combines two different mortgage loan disclosures that had been required by the Truth-in-Lending Act and the Real Estate Settlement Procedures Act of 1974; and ensure that property appraisers are sufficiently independent  In addition to the regulations that have arisen from provisions in the Dodd-Frank Act, we reported that other regulations have created potential burdens for community banks  For example, the depository institution regulators also issued changes to the capital requirements applicable to these institutions  Many of these changes were consistent with the Basel III framework, which is a comprehensive set of reforms to strengthen global capital and liquidity standards issued by an international body consisting of representatives of many nations’ central banks and regulators  These new requirements significantly changed the risk-based capital standards for banks and bank holding companies  As we reported in November 2014, officials interviewed from community banks did not anticipate any difficulties in meeting the U S  Basel III capital requirements but expected to incur additional compliance costs  In addition to regulatory changes that could increase burden or costs on community banks, some of the Dodd-Frank Act provisions have likely resulted in reduced costs for these institutions  For example, revisions to the way that deposit insurance premiums are calculated reduced the amount paid by banks with less than $10 billion in assets by $342 million or 33 percent from the first to second quarter of 2011 after the change became effective  Another change reduced the audit-related costs that some banks were incurring in complying with provisions of the Sarbanes- Oxley Act  A literature search indicated that prior studies by other entities, including regulators, trade associations or others, which examined how to measure regulatory burden generally focused on direct costs resulting from compliance with regulations, and our analysis of them identified various limitations that restrict their usefulness in assessing regulatory burden  For example, researchers commissioned by the Credit Union National Association, which advocates for credit unions, found costs attributable to regulations totaled a median of 0 54 percent of assets in 2014 for a non- random sample of the 53 small, medium, and large credit unions responding to a nationwide survey  However, one of the study’s limitations was its use of a small, non-random sample of credit unions  In addition, the research was not designed to conclusively link changes in regulatory costs for the sampled credit unions to any one regulation or set of regulations  CFPB also conducted a study of regulatory costs associated with specific regulations applicable to checking accounts, traditional savings accounts, debit cards, and overdraft programs  Through case studies involving 200 interviews with staff at seven commercial banks with assets over $1 billion, the agency’s staff determined that the banks’ costs related to ongoing regulatory compliance were concentrated in operations, information technology, human resources, and compliance and retail functions, with operations and information technology contributing the highest costs  While providing detailed information about the case study institutions, reliance on a small sample of mostly large commercial banks limits the conclusions that can be drawn about banks’ regulatory costs generally  In addition, the study notes several challenges to quantifying compliance costs that made their cost estimates subject to some measurement error, and the study’s design limits the extent to which a causal relationship between financial regulations and costs could be fully established  Researchers from the Mercatus Center at George Mason University used a nongeneralizable survey of banks to find that respondents believed they were spending more money and staff time on compliance than before due to Dodd-Frank regulations  From a universe of banks with less than $10 billion of assets, the center’s researchers used a non-random sample to collect 200 responses to a survey sent to 500 banks with assets less than $10 billion about the burden of complying with regulations arising from the Dodd-Frank Act  The survey sought information on the respondents’ characteristics, products, and services and the effects various regulatory and compliance activities had on operations and decisions, including those related to bank profitability, staffing, and products  About 83 percent of the respondents reported increased compliance costs of greater than or equal to 5 percent due to regulatory requirements stemming from the Dodd-Frank Act  The study’s limitations include use of a non-random sample selection, small response rate, and use of questions that asked about the Dodd-Frank Act in general  In addition, the self-reported survey items used to capture regulatory burden—compliance costs and profitability—have an increased risk of measurement error and the causal relationship between Dodd- Frank Act requirements and changes in these indicators is not well- established  Community bank and credit union representatives that we interviewed identified three sets of regulations as most burdensome to their institutions: (1) data reporting requirements related to loan applicants and loan terms under the Home Mortgage Disclosure Act of 1975 (HMDA); (2) transaction reporting and customer due diligence requirements as part of the Bank Secrecy Act and related anti-money laundering laws and regulations (collectively, BSA/AML); and (3) disclosures of mortgage loan fees and terms to consumers under the TILA-RESPA Integrated Disclosure (TRID) regulations  In focus groups and interviews, many of the institution representatives said these regulations were time- consuming and costly to comply with, in part because the requirements were complex, required preparation of individual reports that had to be reviewed for accuracy, or mandated actions within specific timeframes  However, federal regulators and consumer advocacy groups said that benefits from these regulations were significant  Representatives of community banks and credit unions in all our focus groups and in most of our interviews told us that HMDA’s data collection and reporting requirements were burdensome  Under HMDA and its implementing Regulation C, banks and credit unions with more than $45 million in assets that do not meet regulatory exemptions must collect, record, and report to the appropriate federal regulator, data about applicable mortgage lending activity  For every covered mortgage application, origination, or purchase of a covered loan, lenders must collect information such as the loan’s principal amount, the property location, the income relied on in making the credit decision, and the applicants’ race, ethnicity, and sex  Institutions record this on a form called the loan/application register, compile these data each calendar year, and submit them to CFPB  Institutions have also been required to make these data available to the public upon request, after modifying them to protect the privacy of applicants and borrowers  Representatives of many community banks and credit unions with whom we spoke said that complying with HMDA regulations was time consuming  For example, representatives from one community bank we interviewed said it completed about 1,100 transactions that required HMDA reporting in 2016, and that its staff spent about 16 hours per week complying with Regulation C  In one focus group, participants discussed how HMDA compliance was time consuming because the regulations were complex, which made determining whether a loan was covered and should be reported difficult  As a part of that discussion, one bank representative told us that it was not always clear whether a residence that was used as collateral for a commercial loan was a reportable mortgage under HMDA  In addition, representatives in all of our focus groups in which HMDA was discussed and in some interviews said that they had to provide additional staff training for HMDA compliance  Among the 28 community banks and credit unions whose representatives commented on HMDA in our focus groups, 61 percent noted having to conduct additional HMDA-related training  In most of our focus groups and three of our interviews, representatives of community banks and credit unions also expressed concerns about how federal bank examiners review HMDA data for errors  When regulatory examiners conducting compliance examinations determine that an institution’s HMDA data has errors above prescribed thresholds, the institution has to correct and resubmit its data, further adding to the time required for compliance  While regulators have revised their procedures for assessing errors as discussed later, prior to 2018, if 10 percent or more of the loan/application registers that examiners reviewed had errors, an institution was required to review all of their data, correct any errors, and resubmit them  If 5 percent or more of the reviewed loan/application registers had errors in a single data field, an institution had to review all other registers and correct the data in that field  Participants in one focus group discussed how HMDA’s requirements left them little room for error and that they were concerned that examiners weigh all HMDA fields equally when assessing errors  For example, representatives of one institution noted that for purposes of fair lending enforcement, errors in fields such as race and ethnicity can be more important than errors in the action taken date (the field for the date when a loan was originated or when an application not resulting in an origination was received)  Representatives of one institution also noted that they no longer have access to data submission software that allowed them to verify the accuracy of some HMDA data, and this has led to more errors in their submissions  Representatives of another institution told us that they had to have staff conduct multiple checks of HMDA data to ensure the data met accuracy standards, which added to the time needed for compliance  Representatives of many community banks and credit unions with whom we spoke also expressed concerns that compliance requirements for HMDA were increasing  The Dodd-Frank Act included provisions to expand the information institutions must collect and submit under HMDA, and CFPB issued rules implementing these new requirements that mostly became effective January 2018  In addition to certain new data requirements specified in the act, such as age and the total points and fees payable at origination, CFPB’s amendments to the HMDA reporting requirements also added additional data points, including some intended to collect more information about borrowers such as credit scores, as well as more information about the features of loans, such as fees and terms  In the final rule implementing the new requirements, CFPB also expanded the types of loans on which some institutions must report HMDA data to include open-ended lines of credit and reverse mortgages  Participants in two of our focus groups with credit unions said reporting this expanded information will require more staff time and training and cause them to purchase new or upgraded computer software  In most of our focus groups, participants said that changes should be made to reduce the burdens associated with reporting HMDA data  For example, in some focus groups, participants suggested raising the threshold for institutions that have to file HMDA reports above the then current $44 million in assets, which would reduce the number of small banks and credit unions that are required to comply  Representatives of two institutions noted that because small institutions make very few loans compared to large ones, their contribution to the overall HMDA data was of limited value in contrast to the significant costs to the institutions to collect and report the data  Another participant said their institution sometimes make as few as three loans per month  In most of our focus groups, participants also suggested that regulators could collect mortgage data in other ways  For example, one participant discussed how it would be less burdensome for lenders if federal examiners collected data on loan characteristics during compliance examinations  However, staff of federal regulators and consumer groups said that HMDA data are essential for enforcement of fair lending laws and regulations  Representatives of CFPB, FDIC, NCUA, and OCC and groups that advocate for consumer protection issues said that HMDA data has helped address discriminatory practices  For example, some representatives noted a decrease in “redlining” (refusing to make loans to certain neighborhoods or communities)  CFPB staff noted that HMDA data provides transparency about lending markets, and that HMDA data from community banks and credit unions is critical for this purpose, especially in some rural parts of the country where they make the majority of mortgage loans  While any individual institution’s HMDA reporting might not make up a large portion of HMDA data for an area, CFPB staff told us that if all smaller institutions were exempted from HMDA requirements, regulators would have little or no data on the types of mortgages or on lending patterns in some areas  Agency officials also told us that few good alternatives to HMDA data exist and that the current collection regime is the most effective available option for collecting the data  NCUA officials noted that collecting mortgage data directly from credit unions during examinations to enforce fair lending rules likely would be more burdensome for the institutions  CFPB staff and consumer advocates we spoke with also said that HMDA provides a low-cost data source for researchers and local policy makers, which leads to other benefits that cannot be directly measured but are included in HMDA’s statutory goals—such as allowing local policymakers to target community investments to areas with housing needs  While representatives of some community banks and credit unions argued that HMDA data were no longer necessary because practices such as redlining have been reduced and they receive few requests for HMDA data from the public, representatives of some consumer advocate groups responded that eliminating the transparency that HMDA data creates could allow discriminatory practices to become more common  CFPB staff and representatives of one of these consumer groups also said that before the financial crisis of 2007–2009, some groups were not being denied credit outright but instead were given mortgages with terms, such as high interest rates, which made them more likely to default  The expanded HMDA data will allow regulators to detect such problematic lending practices for mortgage terms  CFPB and FDIC staff also told us that while lenders will have to collect and report more information, the new fields will add context to lending practices and should reduce the likelihood of incorrectly flagging institutions for potential discrimination  For example, with current data, a lender may appear to be denying mortgage applications to a particular racial or ethnic group, but with expanded data that includes applicant credit scores, regulators may determine that the denials were appropriate based on credit score underwriting  CFPB staff acknowledged that HMDA data collection and reporting may be time consuming, and said they have taken steps to reduce the associated burdens for community banks and credit unions  First, in its final rule implementing the Dodd-Frank Act’s expanded HMDA data requirements, CFPB added exclusions for banks and credit unions that make very few mortgage loans  Effective January 2018, an institution will be subject to HMDA requirements only if it has originated at least 25 closed-end mortgage loans or at least 100 covered open-end lines of credit in each of the 2 preceding calendar years and also has met other applicable requirements  In response to concerns about the burden associated with the new requirement for reporting open-end lines of credit, in 2017  CFPB temporarily increased the threshold for collecting and reporting data for open-end lines of credit from 100 to 500 for the 2018 and 2019 calendar years  CFPB estimated that roughly 25 percent of covered depository institutions will no longer be subject to HMDA as a result of these exclusions  Second, the Federal Financial Institutions Examination Council (FFIEC), which includes CFPB, announced the new FFIEC HMDA Examiner Transaction Testing Guidelines that specify when agency examiners should direct an institution to correct and resubmit its HMDA data due to errors found during supervisory examinations  CFPB said these revisions should greatly reduce the burden associated with resubmissions  Under the revised standards, institutions will no longer be directed to resubmit all their HMDA data if they exceeded the threshold for HMDA files with errors, but will still be directed to correct specific data fields that have errors exceeding the specified threshold  The revised guidelines also include new tolerances for some data fields, such as application date and loan amount  Third, CFPB also introduced a new online system for submitting HMDA data in November 2017  CFPB staff said that the new system, the HMDA Platform, will reduce errors by including features to allow institutions to validate the accuracy and correct the formatting of their data before submitting  They also noted that this platform will reduce burdens associated with the previous system for submitting HMDA data  For example, institutions no longer will have to regularly download software, and multiple users within an institution will be able to access the platform  NCUA officials added that some credit unions had tested the system and reported that it reduced their reporting burden  Finally, on December 21, 2017, CFPB issued a public statement announcing that, for HMDA data collected in 2018, CFPB does not intend to require resubmission of HMDA data unless errors are material, and does not intend to assess penalties for errors in submitted data  CFPB also announced that it intends to open a rule making to reconsider various aspects of the 2015 HMDA rule, such as the thresholds for compliance and data points that are not required by statute  In all our focus groups and many of our interviews, participants said they found BSA/AML requirements to be burdensome due to the staff time and other costs associated with their compliance efforts  To provide regulators and law enforcement with information that can aid in pursuing criminal, tax, and regulatory investigations, BSA/AML statutes and regulations require covered financial institutions to file Currency Transaction Reports (CTR) for cash transactions conducted by a customer for aggregate amounts of more than $10,000 per day and Suspicious Activity Reports (SAR) for activity that might signal criminal activity (such as money laundering or tax evasion); and establish BSA/AML compliance programs that include efforts to identify and verify customers’ identities and monitor transactions to report, for example, transactions that appear to violate federal law  Participants in all of our focus groups discussed how BSA/AML compliance was time-consuming, and in most focus groups participants said this took time away from serving customers  For example, representatives of one institution we interviewed told us that completing a single SAR could take 4 hours, and that they might complete 2 to 5 SARs per month  However, representatives of another institution said that at some times of the year it has filed more than 300 SARs per month  In a few cases, representatives of institutions saw BSA/AML compliance as burdensome because they had to take actions that seemed unnecessary based on the nature of the transactions  For example, one institution’s representatives said that filing a CTR because a high school band deposited more than $10,000 after a fundraising activity seemed unnecessary, while another’s said that it did not see the need to file SARs for charitable organizations that are well known in their community  Representatives of institutions in most of our focus groups also noted that BSA/AML regulations required additional staff training  Some of these representatives noted that the requirements are complex and the activities, such as identifying transactions potentially associated with terrorism, are outside of their frontline staff’s core competencies  Representatives in all focus groups and a majority of interviews said BSA imposes financial costs on community banks and credit unions that must be absorbed by those institutions or passed along to customers  In most of our focus groups, representatives said that they had to purchase or upgrade software systems to comply with BSA/AML requirements, which can be expensive  Some representatives also said they had to hire third parties to comply with BSA/AML regulations  Representatives of some institutions also noted that the compliance requirements do not produce any material benefits for their institutions  In most of our focus groups, participants were particularly concerned that the compliance burden associated with BSA/AML regulations was increasing  In 2016, FinCEN—the bureau in the Department of the Treasury that administers BSA/AML rules—issued a final rule that expanded due-diligence requirements for customer identification  The final rule was intended to strengthen customer identification programs by requiring institutions to obtain information about the identities of the beneficial owners of businesses opening accounts at their institutions  The institutions covered by the rule are expected to be in compliance by May 11, 2018  Some representatives of community banks and credit unions that we spoke with said that this new requirement will be burdensome  For example, one community bank’s representatives said the new due-diligence requirements will require more staff time and training and cause them to purchase new or upgraded computer systems  Representatives of some institutions also noted that accessing beneficial ownership information about companies can be difficult, and that entities that issue business licenses or tax identification numbers could perform this task more easily than financial institutions  In some of our focus groups, and in some comment letters that we reviewed that community banks and credit unions submitted to bank regulators and NCUA as part of the EGRPRA process, representatives of community banks and credit unions said regulators should take steps to reduce the burdens associated with BSA/AML  Participants in two of our focus groups and representatives of two institutions we interviewed said that the $10,000 CTR threshold, which was established in 1972, should be increased, noting it had not been adjusted for inflation  One participant told us that if this threshold had been adjusted for inflation over time, it likely would be filing about half of the number of CTRs that it currently files  In several focus groups, participants also indicated that transactions that must be checked against the Office of Foreign Assets Control list also should be subject to a threshold amount  Representatives of one institution noted that they have to complete time-consuming compliance work for even very small transactions (such as less than $1)  Representatives of some institutions suggested that the BSA/AML requirements be streamlined to make it easier for community banks and credit unions to comply  For example, representatives of one institution that participated in the EGRPRA review suggested that institutions could provide regulators with data on all cash transactions in the format in which they keep these records rather than filing CTRs  Finally, participants in one focus group said that regulators should better communicate how the information that institutions submit contributes to law enforcement successes in preventing or prosecuting crimes  Staff from FinCEN told us that the reports and due-diligence programs required in BSA/AML rules are critical to safeguarding the U S  financial sector from illicit activity, including illegal narcotics and terrorist financing activities  They said they rely on CTRs and SARs that financial institutions file for the financial intelligence they disseminate to law enforcement agencies, and noted that they saw all BSA/AML requirements as essential because activities are designed to complement each other  Officials also pointed out that entities conducting terrorism, human trafficking, or fraud all rely heavily on cash, and reporting frequently made deposits makes tracking criminals easier  They said that significant reductions in BSA/AML reporting requirements would hinder law enforcement, especially because depositing cash through ATMs has become very easy  FinCEN staff said they utilize a continuous evaluation process to look for ways to reduce burden associated with BSA/AML requirements, and noted actions taken as a result  They said that FinCEN has several means of soliciting feedback about potential burdens, including through its Bank Secrecy Act Advisory Group that consists of industry, regulatory, and law enforcement representatives who meet twice a year, and also through public reporting and comments received through FinCEN’s regulatory process  FinCEN officials said that based on this advisory group’s recommendations, the agency provided SAR filing relief by reducing the frequency of submission for written SAR summaries on ongoing activity from 90 days to 120 days  FinCEN also has recognized that financial institutions do not generally see the beneficial impacts of their BSA/AML efforts, and officials said they have begun several different feedback programs to address this issue  FinCEN staff said they have been discussing ways to improve the CTR filing process, but in response to comments obtained as part of a recent review of regulatory burden they noted that the staff of law enforcement agencies do not support changing the $10,000 threshold for CTR reporting  FinCEN officials said that they have taken some steps to reduce the burden related to CTR reporting, such as by expanding the ability of institutions to seek CTR filing exemptions, especially for low-risk customers  FinCEN is also utilizing its advisory group to examine aspects of the CTR reporting obligations to assess ways to reduce reporting burden, but officials said it is too early to know the outcomes of the effort  However, FinCEN officials said that while evaluation of certain reporting thresholds may be appropriate, any changes to them or other CTR requirements to reduce burden on financial institutions, must still meet the needs of regulators and law enforcement, and prevent misuse of the financial system  FinCEN staff also said that some of the concerns raised about the upcoming requirements on beneficial ownership may be based on misunderstandings of the rule  FinCEN officials told us that under the final rule, financial institutions can rely on the beneficial ownership information provided to them by the entity seeking to open the account  Under the final rule, the party opening an account on behalf of the legal entity customer is responsible for providing beneficial ownership information, and the financial institution may rely on the representations of the customer unless it has information that calls into question the accuracy of those representations  The financial institution does not have to confirm ownership; rather, it has to verify the identity of the beneficial owners as reported by the individual seeking to open the account, which can be done with photocopies of identifying documents such as a driver’s license  FinCEN issued guidance explaining this aspect of the final rule in 2016  In all of our focus groups and many of our interviews, representatives of community banks and credit unions said that new requirements mandating consolidated disclosures to consumers for mortgage terms and fees have increased the time their staff spend on compliance, increased the cost of providing mortgage lending services, and delayed the completion of mortgages for customers  The Dodd Frank Act directed CFPB to issue new requirements to integrate mortgage loan disclosures that previously had been separately required by the Truth-in-Lending Act (TILA) and the Real Estate Settlement Procedures Act (RESPA), and their implementing regulations, Regulation Z and X, respectively  Effective in October 2015, the combined TILA-RESPA Integrated Disclosure (known as TRID) requires mortgage lenders to disclose certain mortgage terms, conditions, and fees to loan applicants during the origination process for certain mortgage loans and prescribe how the disclosures should be made  The disclosure provisions also require lenders, in the absence of specified exceptions, to reimburse or refund to borrowers portions of certain fees that exceed the estimates previously provided in order to comply with the revised regulations  Under TRID, lenders generally must provide residential mortgage loan applicants with two forms, and deliver these documents within specified time frames (as shown in fig  1)  Within 3 business days of an application and at least 7 business days before a loan is consummated, lenders must provide the applicant with the loan estimate, which includes estimates for all financing costs and fees and other terms and conditions associated with the potential loan  If circumstances change after the loan estimate has been provided (for example, if a borrower needs to change the loan amount), a new loan estimate may be required  At least 3 days before a loan is consummated, lenders must provide the applicant with the closing disclosure, which has the loan’s actual terms, conditions, and associated fees  If the closing disclosure is mailed to an applicant, lenders must wait an additional 3 days for the applicant to receive it before they can execute the loan, unless they can demonstrate that the applicant has received the closing disclosure  If the annual percentage rate or the type of loan change after the closing disclosure is provided, or if a prepayment penalty is added, a new closing disclosure must be provided and a new 3-day waiting period is required  Other changes made to the closing disclosure require the provision of a revised closing disclosure, but a new 3-day waiting period is not required  If the fees in the closing disclosure are more than the fees in the loan estimate (subject to some exceptions and tolerances discussed later in this section), the lender must reimburse the applicant for the amount of the increase in order to comply with the applicable regulations  In all of our focus groups and most of our interviews, representatives of community banks and credit unions said that TRID has increased the time required to comply with mortgage disclosure requirements and increased the cost of mortgage lending  In half of our focus groups, participants discussed how they have had to spend additional time ensuring the accuracy of their initial estimates of mortgage costs, including fees charged by third parties, in part because they are now financially responsible for changes in fees during the closing process  Some participants also discussed how they have had to hire additional staff to meet TRID’s requirements  In one focus group of community banks, participants described how mortgage loans frequently involve the use of multiple third parties, such as appraisers and inspectors, and obtaining accurate estimates of the amounts these parties will charge for their services within the 3-day period prescribed by TRID can be difficult  The community banks we spoke with also discussed how fees from these parties often change at closing, and ensuring an accurate estimate at the beginning of the process was not always possible  As a result, some representatives said that community banks and credit unions have had to pay to cure or correct the difference in changed third-party fees that are outside their control  In most of our focus groups and some of our interviews, representatives told us that this TRID requirement has made originating a mortgage more costly for community banks and credit unions  Community banks and credit unions in half of our focus groups and some of our interviews also told us that TRID’s requirements are complex and difficult to understand, which adds to their compliance burden  Participants in one focus group noted that CFPB’s final rule implementing TRID was very long—the rule available on CFPB’s website is more than 1,800 pages including the rule’s preamble—and has many scenarios that require different actions by mortgage lenders or trigger different responsibilities as the following examples illustrate  Some fees in the loan estimate, such as prepaid interest, may be subsequently changed provided that the estimates were in good faith  Other fees, such as for third-party services where the charge is not paid to the lender or the lender’s affiliate, may be changed by as much as 10 percent in aggregate before the lender becomes liable for the difference  However, for some charges the lender must reimburse or refund to the borrower portions of subsequent increases, such as fees paid to the creditor, mortgage broker, or a lender affiliate, without any percentage tolerance  Based on a poll we conducted in all six focus groups, 40 of 43 participants said that they had to provide additional training to staff to ensure that TRID’s requirements were understood, which takes additional time from serving customers  In all of our focus groups and most of our interviews, community banks and credit unions also said that TRID’s mandatory waiting periods and disclosure schedules increased the time required to close mortgage loans, which created burdens for the institutions and their customers  Several representatives we interviewed told us that TRID’s waiting periods led to delays in closings of about 15 days  The regulation mandates that mortgage loans generally cannot be consummated sooner than 7 business days after the loan estimate is provided to an applicant, and no sooner than 3 business days after the closing disclosure is received by the applicant  If the closing disclosure is mailed, the lender must add another 3 business days to the closing period to allow for delivery  Representatives in some of our focus groups said that when changes needed to be made to a loan during the closing period, TRID requires them to restart the waiting periods, which can increase delays  For example, if the closing disclosure had been provided, and the loan product needed to be changed, a new closing disclosure would have to be provided and the applicant given at least 3 days to review it  Some representatives we interviewed said that their customers are frustrated by these delays and would like to close their mortgages sooner than TRID allows  Others said that TRID’s waiting periods decreased flexibility in scheduling the closing date, which caused problems for homebuyers and sellers (for instance, because transactions frequently have to occur on the same day)  However, CFPB officials and staff of a consumer group said that TRID has streamlined previous disclosure requirements and is important for ensuring that consumers obtaining mortgages are protected  CFPB reported that for more than 30 years lenders have been required by law to provide mortgage disclosures to borrowers, and CFPB staff noted that prior time frames were similar to those required by TRID and Regulation Z  CFPB also noted that information on the disclosure forms that TRID replaced was sometimes overlapping, used inconsistent terminology, and could confuse consumers  In addition, CFPB staff and staff of a consumer group said that the previous disclosures allowed some mortgage-related fees to be combined, which prevented borrowers from knowing what charges for specific services were  They said that TRID disclosures better highlight important items for home buyers, allowing them to more readily compare loan options  Furthermore, CFPB staff told us that before TRID, lenders and other parties commonly increased a mortgage loan’s fees during the closing process, and then gave borrowers a “take it or leave it” choice just before closing  As a result, borrowers often just accepted the increased costs  CFPB representatives said that TRID protects consumers from this practice by shifting the responsibility for most fee increases to lenders, and increases transparency in the lending process  CFPB staff told us that it is too early to definitively identify what impact TRID has had on borrowers’ understanding of mortgage terms, but told us that some information they have seen indicated that it has been helpful  For example, CFPB staff said that preliminary results from the National Survey of Mortgage Originations conducted in 2017 found that consumer confidence in mortgage lending increased  While CFPB staff said that this may indicate that TRID, which became effective in October 2015, has helped consumers better understand mortgage terms, they noted that the complete survey results are not expected to be released until 2018  CFPB staff said that these results should provide valuable information on how well consumers generally understood mortgage terms and whether borrowers were comparison shopping for loans that could be used to analyze TRID’s effects on consumer understanding of mortgage products  CFPB staff also told us that complying with TRID should not result in significant time being added to the mortgage closing process  Based on the final rule, they noted that TRID’s waiting periods should not lead to delays of more than 3 days  CFPB staff also pointed out that the overall 7-day waiting period and the 3-day waiting period can be modified or waived if the consumer has a bona fide personal financial emergency, and thus should not be creating delays for those consumers  To waive the waiting period, consumers have to provide the lender with a written statement that describes the emergency  CFPB staff also said that closing times are affected by a variety of factors and can vary substantially, and that the delays that community banks and credit unions we spoke with reported may not be representative of the experiences of other lenders  A preliminary CFPB analysis of industry-published mortgage closing data found that closing times increased after it first implemented TRID, but that the delays subsequently declined  CFPB staff also said that they plan to analyze closing times using HMDA data now that they are collecting these data, and that they expect that delays that community banks and credit unions may have experienced so far would decrease as institutions adjusted to the new requirements  Based on our review of TRID’s requirements and discussions with community banks and credit unions, some of the burden related to TRID that community banks and credit unions described appeared to result from institutions taking actions not required by regulations, and community banks and credit unions told us they still were confused about TRID requirements  For example, representatives of some institutions we interviewed said that they believed TRID requires the entire closing disclosure process to be restarted any time any changes were made to a loan’s amount  CFPB staff told us that this is not the case, and that revised loan estimates can be made in such cases without additional waiting periods  Representatives of several other community banks and credit unions cited 5- and 10-day waiting periods not in TRID requirements, or believed that the 7-day waiting period begins after the closing disclosure is received by the applicant, rather than when the loan estimate is provided  Participants in one focus group discussed that they were confused about when to provide disclosures and what needs to be provided  Representatives of one credit union said that if they did not understand a requirement, it was in their best interest to delay closing to ensure they were in compliance  CFPB staff said that they have taken several steps to help lenders understand TRID requirements  CFPB has published a Small Entity Compliance Guide and a Guide to the Loan Estimate and Closing Disclosure Forms  As of December 2017, these guides were accessible on a TRID implementation website that has links to other information about the rule, as well as blank forms and completed samples  CFPB staff told us that the bureau conducted several well-attended, in-depth webinars to explain different aspects of TRID, including one with more than 20,000 participants, and that recordings of the presentations remained available on the bureau’s TRID website  CFPB also encourages institutions to submit questions about TRID through the website, and the staff said that they review submitted questions for any patterns that may indicate that an aspect of the regulation is overly burdensome  However, the Mortgage Bankers Association reported that CFPB’s guidance for TRID had not met the needs of mortgage lenders  In a 2017 report on reforming CFPB, this association stated that timely and accessible answers to frequently asked questions about TRID were still needed, noting that while CFPB had assigned staff to answer questions, these answers were not widely circulated  The association also reported that it had made repeated requests for additional guidance related to TRID, but the agency largely did not respond with additional materials in response to these requests  Although we found that misunderstandings of TRID requirements could be creating unnecessary compliance burdens for some small institutions, CFPB had not assessed the effectiveness of the guidance it provided to community banks and credit unions  Under the Dodd-Frank Act, CFPB has a general responsibility to ensure its regulations are not unduly burdensome, and internal control standards direct federal agencies to analyze and respond to risks related to achieving their defined objectives  However, CFPB staff said that they have not directly assessed how well community banks and credit unions have understood TRID requirements and acknowledged that some of these institutions may be applying the regulations improperly  They said that CFPB intends to review the effectiveness of its guidance, but did not indicate when this review would be completed  Until the agency assesses how well community banks and credit unions understand TRID requirements, CFPB may not be able to effectively respond to the risk that some smaller institutions have implemented TRID incorrectly, unnecessarily burdening their staff and delaying consumers’ home purchases  We did not find that regulators directed institutions to comply with regulations from which they were exempt, although institutions were concerned about the appropriateness of examiner expectations  To provide regulatory relief to community banks and credit unions, Congress and regulators have sometimes exempted smaller institutions from the need to comply with all or part of some regulations  Such exemptions are often based on the size of the financial institution or the level of particular activities  For example, CFPB exempted institutions with less than $45 million in assets and fewer than 25 closed-end mortgage loans or 500 open-end lines of credit from the expanded HMDA reporting requirements  In January 2013, CFPB also included exemptions for some institutions in a rule related to originating loans that meet certain characteristics—known as qualified mortgages—in order for the institutions to receive certain liability protections if the loans later go into default  To qualify for this treatment, the lenders must make a good faith effort to determine a borrower’s ability to repay a loan and the loan must not include certain risky features (such as interest-only or balloon payments)  In its final rule, CFPB included exemptions that allow small creditors to originate loans with certain otherwise restricted features (such as balloon payments) and still be considered qualified mortgage loans  Concerns expressed to legislators about exemptions not being applied appeared to be based on misunderstandings of certain regulations  For example, in June 2016, a bank official testified that he thought his bank would be exempt from all of CFPB’s requirements  However, CFPB’s rules applicable to banks apply generally to all depository institutions, although CFPB only conducts compliance examinations for institutions with assets exceeding $10 billion  The depository institution regulators continue to examine institutions with assets below this amount (the overwhelming majority of banks and credit unions) for compliance with regulations enacted by CFPB  Although not generalizable, our analysis of select examinations did not find that regulators directed institutions to comply with requirements from which they were exempt  In our interviews with representatives from 17 community banks and credit unions, none of the institutions’ representatives identified any cases in which regulators required their institution to comply with a regulatory requirement from which they should have been exempt  We also randomly selected and reviewed examination reports and supporting material for 28 examinations conducted by the regulators to identify any instances in which the regulators had not applied exemptions  From our review of the 28 examinations, we found no instances in the examination reports or the scoping memorandums indicating that examiners had required these institutions to comply with the regulations covered by the eight selected exemptions  Because of the limited number of the examinations we reviewed, we cannot generalize our findings to the regulatory treatment of all institutions qualifying for exemptions  Although not identifying issues relating to exemptions, representatives of community banks and credit unions in about half of our interviews and focus groups expressed concerns that their regulators expected them to follow practices they did not feel corresponded to the size or risks posed by their institutions  For example, representatives from one institution we interviewed said that examiners directed them to increase BSA/AML activities or staff, whereas they did not see such expectations as appropriate for institutions of their size  Similarly, in public forums held by regulators as part of their EGRPRA reviews (discussed in the next section) a few bank representatives stated that regulators sometimes considered compliance activities by large banks to be best practices, and then expected smaller banks to follow such practices  However, institution representatives in the public forums and in our interviews and focus groups that said sometimes regulators’ expectations for their institutions were not appropriate, but did not identify specific regulations or practices they had been asked to consider following when citing these concerns  To help ensure that applicable exemptions and regulatory expectations are appropriately applied, federal depository institution regulators told us they train their staff in applicable requirements and conduct senior-level reviews of examinations to help ensure that examiners only apply appropriate requirements and expectations on banks and credit unions  Regulators said that they do not conduct examinations in a one-size-fits- all manner, and aim to ensure that community banks and credit unions are held to standards appropriate to their size and business model  To achieve this, they said that examiners undergo rigorous training  For example, FDIC staff said that its examiners have to complete four core trainings and then receive ongoing on-the-job instruction  Each of the four regulators also said they have established quality assurance programs to review and assess their examination programs periodically  For example, each Federal Reserve Bank reviews its programs for examination inconsistency and the Federal Reserve Board staff conducts continuous and point-in-time oversight reviews of Reserve Banks’ examination programs to identify issues or problems, such as examination inconsistency  The depository institution regulators also said that they have processes for depository institutions to appeal examination findings if they feel they were held to inappropriate standards  In addition to less formal steps, such as contacting a regional office, each of the four regulators have an ombudsman office to which institutions can submit complaints or concerns about examination findings  Staffs of the various offices are independent from the regulators’ management and work with the depository institutions to resolve examination issues and concerns  If the ombudsman is unable to resolve the complaints, then the institutions can further appeal their complaints through established processes  Federal depository institution regulators address regulatory burden of their regulated institutions through the rulemaking process and also through retrospective reviews that may provide some regulatory relief to community banks  However, the retrospective review process has some limitations that limit its effectiveness in assessing and addressing regulatory burden on community banks and credit unions  Federal depository institution regulators can address the regulatory burden of their regulated institutions throughout the rulemaking process and through mandated, retrospective or “look back” reviews  According to the regulators, attempts to reduce regulatory burden start during the initial rulemaking process  Staff from FDIC, Federal Reserve, NCUA, and OCC all noted that when promulgating rules, their staff seek input from institutions and others throughout the process to design requirements that achieve the goals of the regulation at the most reasonable cost and effort for regulated entities  Once a rule has been drafted, the regulators publish it in the Federal Register for public comment  The staff noted that regulators often make revisions in response to the comments received to try to reduce compliance burdens in the final regulation  After regulations are implemented, banking regulators also address regulatory burdens by periodically conducting mandated reviews of their regulations  The Economic Growth and Regulatory Paperwork Reduction Act of 1996 (EGRPRA) directs three regulators (Federal Reserve, FDIC, and OCC, as agencies represented on the Federal Financial Institutions Examination Council) to review at least every 10 years all of their regulations and through public comment identify areas of the regulations that are outdated, unnecessary or unduly burdensome on insured depository institutions  Under the act, the regulators are to categorize their regulations and provide notice and solicit public comment on all the regulations for which they have regulatory authority  The act also includes a number of requirements on how the regulators should conduct the review, including reporting results to Congress  The first EGRPRA review was completed in 2007  The second EGRPRA review began in 2014 and the report summarizing its results was submitted to Congress in March 2017  While NCUA is not required to participate in the EGRPRA review (because EGRPRA did not include the agency in the list of agencies that must conduct the reviews), NCUA has been participating voluntarily  NCUA’s assessment of its regulations appears in separate sections of the reports provided to Congress for each of the 2007 and 2017 reviews  Regulators began the most recent EGRPRA review by providing notice and soliciting comments in 2014–2016  The Federal Reserve, FDIC, and OCC issued four public notices in the Federal Register seeking comments from regulated institutions and interested parties on 12 categories of regulations they promulgated  The regulators published a list of all the regulations they administer in the notices and asked for comments, including comments on the extent to which regulations were burdensome  Although not specifically required under EGRPRA, the regulators also held six public meetings across the country with several panels of banks and community groups  At each public meeting, at least three panels of bank officials represented banks with assets of generally less than $5 billion and a large number of the panels included banks with less than $2 billion in assets  Panels were dedicated to specific regulations or sets of regulations  For example, one panel covered capital-related rules, consumer protection, and director-related rules, and another addressed BSA/AML requirements  Although panels were dedicated to specific regulations or sets of regulations, the regulators invited comment on all of their regulations at all public meetings  The regulators then assessed the public comments they received and described actions they intended to take in response  EGRPRA requires that the regulators identify the significant issues raised by the comments  The regulators generally deemed the issues that received the most public comments as significant  For the 2017 report, representatives at the Federal Reserve, FDIC, and OCC reviewed, evaluated, and summarized more than 200 comment letters and numerous oral comments they received  For interagency regulations that received numerous comments, such as those relating to capital and BSA/AML requirements, the comment letters for each were provided to staff of one of the three regulators or to previously established interagency working groups to conduct the initial assessments  The regulators’ comment assessments also included reviews by each agency’s subject-matter experts, who prepared draft summaries of the concerns and proposed agency responses for each of the rules that received comments  According to one bank regulator, the subject-matter experts assessed the comments across three aspects: (1) whether a suggested change to the regulation would reduce bank burdens; (2) how the change to the regulation would affect the safety and soundness of the banking system; and (3) whether a statutory change would be required to address the comment  The summaries drafted by the subject-matter experts then were shared with staff representing all three regulators and further revised  The staff of the three regulators said they then met jointly to analyze the merits of the comments and finalize the comment responses and the proposed actions for approval by senior management at all three regulators  In the 2017 report summarizing their assessment of the comments received, the regulators identified six significant areas in which commenters raised concerns: (1) capital rules, (2) financial condition reporting (Call Reports), (3) appraisal requirements, (4) examination frequency, (5) Community Reinvestment Act, and (6) BSA/AML  Based on our analysis of the 2017 report, the Federal Reserve, FDIC, and OCC had taken or pledged to take actions to address 11 of the 28 specific concerns commenters had raised across these six areas  We focused our analysis on issues within the six significant issues that affected the smaller institution and defined an action taken by the regulators as a change or revision to a regulation or the issuance of guidance  Capital rules


Report 2:  The regulators noted in the 2017 EGRPRA report that they received comment letters from more than 30 commenters on the recently revised capital requirements  Although some of the concerns commenters expressed related to issues affecting large institutions, some commenters sought to have regulators completely exempt smaller institutions from the requirements  Others objected to the amounts of capital that had to be held for loans made involving more volatile commercial real estate  In response, the regulators stated that the more than 500 failures of banks in the recent crisis, most of which were community banks, justified requiring all banks to meet the new capital requirements  However, they pledged in the report to make some changes, and have recently proposed rules that would alter some of the requirements  For example, on September 27, 2017, the regulators proposed several revisions to the capital requirements that would apply to banks not subject to the advanced approach requirements under the capital rules (generally, banks with less than $250 billion in assets and less than $10 billion in total foreign exposure)  For example, the proposed rule simplifies the capital treatment for certain commercial acquisition, development, and construction loans, and would change the treatment of mortgage servicing assets  Call Reports  The regulators also received more than 30 comments relating to the reports—known as Call Reports—that banks file with the regulators outlining their financial condition and performance  Generally, the commenters requested relief (reducing the number of items required to be reported) for smaller banks and also asked that the frequency of reporting for some items be reduced  In response to these concerns, the regulators described a review of the Call Report requirements intended to reduce the number of items to be reported to the regulators  The regulators had started this effort to address Call Report issues soon after the most recent EGRPRA process had begun in June 2014  In the 2017 EGRPRA report, the regulators noted that they developed a new Call Report form for banks with assets of less than $1 billion and domestic offices only  For instance, according to the regulators, the new form reduced the number of items such banks had to report by 40 percent  Staff from the regulators told us that about 3,500 banks used the new small-bank reporting form in March 2017, which represented about 68 percent of the banks eligible to use the new form  OCC officials told us that an additional 100 federally chartered banks submitted the form for the 2017 second quarter reporting period  After the issuance of the 2017 EGRPRA report, in June 2017 the regulators issued additional proposed revisions to the three Call Report forms that banks are required to complete  These proposed changes are to become effective in June 2018  For example, one of the proposed changes to the new community bank Call Report form would change the frequency of reporting certain data on non-accrual assets— nonperforming loans that are not generating their stated interest rate— from quarterly to semi-annually  In November 2017, the agencies issued further proposed revision to the community bank Call Report that would delete or consolidate a number of items and add a new, or raise certain existing, reporting thresholds  The proposed revision would take effect as of June 2018  Appraisals  The three bank regulators and NCUA received more than 160 comments during the 2017 EGRPRA process related to appraisal requirements  The commenters included banks and others that sought to raise the size of the loans that require appraisals, and a large number of appraisers that objected to any changes in the requirements According to the EGRPRA report, several professional appraiser associations argued that raising the threshold could undermine the safety and soundness of lenders and diminish consumer protection for mortgage financing  These commenters argued that increasing the thresholds could encourage banks to neglect collateral risk-management responsibilities  In response, in July 2017, the regulators proposed raising the threshold for when an appraisal is required from $250,000 to $400,000 for commercial real estate loans  The regulators indicated that the appraisal requirements for 1-4 family residential mortgage loans above the current $250,000 would not be appropriate at the this time because they believed having such appraisals for loans above that level increased the safety of those loans and better protected consumers and because other participants in the housing market, such as the Department of Housing and Urban Development and the government-sponsored enterprises, also required appraisals for loans above that amount  However, the depository institution regulators included in the proposal a request for comment about the appraisal requirements for residential real estate and what banks think are other factors that should be included when considering the threshold for these loans  As part of the 2017 EGRPRA process, the regulators also received comments indicating that banks in rural areas were having difficulty securing appraisers  In the EGRPRA report, the regulators acknowledged this difficulty and in May 2017, the bank regulators and NCUA issued agency guidance on how institutions could obtain temporary waivers and use other means to expand the pool of persons eligible to prepare appraisals in cases in which suitable appraiser staff were unavailable  The agencies also responded to commenters who found the evaluation process confusing by issuing an interagency advisory on the process in March 2016  Evaluations may be used instead of an appraisal for certain transactions including those under the threshold  Frequency of safety and soundness examinations  As part of the 2017 EGRPRA process, the agencies also received comments requesting that they raise the total asset threshold for an insured depository institution to qualify for the extended 18-month examination cycle from $1 billion to $2 billion and to further extend the examinations cycle from 18 months to 36 months  During the EGRPRA process, Congress took legislative action to reduce examination frequency for smaller, well-capitalized banks  In 2015, the FAST Act raised the threshold for the 18-month examination cycle from less than $500 million to less than $1 billion for certain well-capitalized and well-managed depository institutions with an “outstanding” composite rating and gave the agencies discretion to similarly raise this threshold for certain depository institutions with an “outstanding” or “good” composite rating  The agencies exercised this discretion and issued a final rule in 2016 making qualifying depository institutions with less than $1 billion in total assets eligible for an 18-month (rather than a 12-month) examination cycle  According to the EGRPRA report, agency staff estimated that the final rules allowed approximately 600 more institutions to qualify for an extended 18-month examination cycle, bringing the total number of qualifying institutions to 4,793  Community Reinvestment Act  The commenters in the 2017 EGRPRA process also raised various issues relating to the Community Reinvestment Act, including the geographic areas in which institutions were expected to provide loans to low- and moderate-income borrowers and whether credit unions should be required to comply with the act’s requirements  The regulators noted that they were not intending to take any actions to revise regulations relating to this act because many of the revisions the commenters suggested would require changes to the statute (that is, legislative action)  The regulators also noted that they had addressed some of the concerns by revising the Interagency Questions and Answers relating to this act in 2016  Furthermore, the agencies noted that they have been reviewing their existing examination procedures and practices to identify policy and process improvements  BSA/AML  The regulators also received a number of comments as part of the 2017 EGRPRA process on the burden institutions encounter in complying with BSA/AML requirements  These included the threshold for reporting currency transactions and suspicious activities  The regulators also received comments on both BSA/AML examination frequency and the frequency of safety and soundness examinations generally  Agencies typically review BSA/AML compliance programs during safety and soundness examinations  As discussed previously, regulators allowed more institutions of outstanding or good composite condition to be examined every 18 months instead of every 12 months  Institutions that qualify for less frequent safety-and-soundness examinations also will be eligible for less frequent BSA/AML examinations  For the remainder of the issues raised by commenters, the regulators noted they do not have the regulatory authority to revise the requirements but provided the comments to FinCEN, which has authority for these regulations  A letter with FinCEN’s response to the comments was included as an appendix of the EGRPRA report  In the letter, the FinCEN Acting Director stated that FinCEN would work through the issues raised by the comments with its advisory group consisting of regulators, law enforcement staff, and representatives of financial institutions  Additional Burden Reduction Actions  In addition to describing some changes in response to the comments deemed significant, the regulators’ 2017 report also includes descriptions of additional actions the individual agencies have taken or planned to take to reduce the regulatory burden for banks, including community banks  The Federal Reserve Board noted that it changed its Small Bank Holding Company Policy Statement that allows small bank holding companies to hold more debt than permitted for larger bank holding companies  In addition, the Federal Reserve noted that it had made changes to certain supervisory policies, such as issuing guidance on assessing risk management for banks with less than $50 billion in assets and launching an electronic application filing system for banks and bank holding companies  OCC noted that it had issued two final rules amending its regulations for licensing/chartering and securities-related filings, among other things  According to OCC staff, the agency conducted an internal review of its agency-specific regulations and many of the changes to these regulations came from the internal review  The agency also noted that it integrated its rules for national banks and federal savings associations where possible  In addition, OCC noted that it removed redundant and unnecessary information requests from those made to banks before examinations  FDIC noted that it had rescinded enhanced supervisory procedures for newly insured banks and reduced the consumer examination frequency for small and newly insured banks  Similarly to OCC, FDIC is integrating its rules for both non-state member banks and state- chartered savings and loans associations  In addition, FDIC noted it had issued new guidance on banks’ deposit insurance filings and reduced paperwork for new bank applications  The 2017 report also presents the results of NCUA’s concurrent efforts to obtain and respond to comments as part of the EGRPRA process  NCUA conducts its review separately from the bank regulators’ review  In four Federal Register notices in 2015, NCUA sought comments on 76 regulations that it administers  NCUA received about 25 comments raising concerns about 29 of its regulations, most of which were submitted by credit union associations  NCUA received no comments on 47 regulations  NCUA’s methodology for its regulatory review was similar to the bank regulators’ methodology  According to NCUA, all comment letters responding to a particular notice were collected and reviewed by NCUA’s Special Counsel to the General Counsel, an experienced, senior-level attorney with overall responsibility for EGRPRA compliance  NCUA staff told us that criteria applied by the Special Counsel in his review included relevance, depth of understanding and analysis exhibited by the comment, and degree to which multiple commenters expressed the same or similar views on an issue  The Special Counsel prepared a report summarizing the substance of each comment  The comment summary was reviewed by the General Counsel and circulated to the NCUA Board and reviewed by the Board members and staff  NCUA identified in its report the following as significant issues relating to credit union regulation: (1) field of membership and chartering; (2) member business lending; (3) federal credit union ownership of fixed assets; (4) expansion of national credit union share insurance coverage; and (5) expanded powers for credit unions  For these, NCUA took various actions to address the issues raised in the comments  For example, NCUA modified and updated its field of credit union membership by revising the definition of a local community, rural district and underserved area, which provided greater flexibility to federal credit unions seeking to add a rural district to their field of membership  NCUA also lessened some of the restrictions on member lending to small business; and raised some of the asset thresholds for what would be defined as a small credit union so that fewer requirements would apply to these credit unions  Also, in April 2016, the NCUA Board issued a proposed rule that would eliminate the requirement that federal credit unions must have a plan by which they will achieve full occupancy of premises within an explicit time frame  The proposal would allow for federal credit unions to plan for and manage their use of office space and related premises in accordance with their own strategic plans and risk-management policies  The bank and credit union regulators’ process for the 2007 EGRPRA review also began with Federal Register notices that requested comments on regulations  The regulators then reviewed and assessed the comments and issued a report in 2007 to Congress in which they noted actions they took in some of the areas raised by commenters  Our analysis of the regulators’ responses indicated that the regulators took responsive actions in a few areas  The regulators noted they already had taken action in some cases (including after completion of a pending study and as a result of efforts to work with Congress to obtain statutory changes)  However, for the remaining specific concerns, the four regulators indicated that they would not be taking actions  Similar to its response in 2017, NCUA discussed its responses to the significant issues raised about regulations in a separate section of the 2007 report  Our analysis indicated that NCUA took responsive actions in about half of the areas  For example, NCUA adjusted regulations in one case and in another case noted previously taken actions  For comments related to three other areas, NCUA took actions not reflected in the 2007 report because the actions were taken over a longer time frame (in some cases, after 8 years)  In the remaining areas, NCUA deemed actions as not being desirable in four cases and outside of its authority in two other cases  The bank regulators do not conduct other retrospective reviews of regulations outside of the EGRPRA process  We requested information from the Federal Reserve, FDIC, and OCC about any discretionary regulatory retrospective reviews that they performed in addition to the EGRPRA review during 2012–2016  All three regulators reported to us they have not conducted any retrospective regulatory reviews outside of EGRPRA since 2012  However, under the Regulatory Flexibility Act (RFA), federal agencies are required to conduct what are referred to as section 610 reviews  The purpose of these reviews is to determine whether certain rules should be continued without change, amended, or rescinded consistent with the objectives of applicable statutes, to minimize any significant economic impact of the rules upon a substantial number of small entities  Section 610 reviews are to be conducted within 10 years of an applicable rule’s publication  As part of other work, we assessed the bank regulators’ section 610 reviews and found that the Federal Reserve, FDIC, and OCC conducted retrospective reviews that did not fully align with the Regulatory Flexibility Act’s requirements  Officials at each of the agencies stated that they satisfy the requirements to perform section 610 reviews through the EGRPRA review process  However, we found that the requirements of the EGRPRA reviews differ from those of the RFA-required section 610 reviews, and we made recommendations to these regulators to help ensure their compliance with this act in a separate report issued in January 2018  In addition to participating in the EGRPRA review, NCUA also reviews one-third of its regulations every year (each regulation is reviewed every 3 years)  NCUA’s “one-third” review employs a public notice and comment process similar to the EGRPRA review  If a specific regulation does not receive any comments, NCUA does not review the regulation  For the 2016 one-third review, NCUA did not receive comments on 5 of 16 regulations and thus these regulations were not reviewed  NCUA made technical changes to 4 of the 11 regulations that received comments  In August 2017, NCUA staff announced they developed a task force for conducting additional regulatory reviews, including developing a 4-year agenda for reviewing and revising NCUA’s regulations  The primary factors they said they intend to use to evaluate their regulations will be the magnitude of the benefit and the degree of effort that credit unions must expend to comply with the regulations  Because the 4-year reviews will be conducted on all of NCUA’s regulations, staff noted that the annual one-third regulatory review process will not be conducted again until 2020  Our analysis of the EGRPRA review found three limitations to the current process  First, the EGRPRA statute does not include CFPB and thus the significant mortgage-related regulations and other regulations that it administers— regulations that banks and credit unions must follow—were not included in the EGRPRA review  Under the Dodd-Frank Act, CFPB was given financial regulatory authority, including for regulations implementing the Home Mortgage Disclosure Act (Regulation C); the Truth-in-Lending Act (Regulation Z); and the Truth-in-Savings Act (Regulation DD)  These regulations apply to many of the activities that banks and credit unions conduct; the four depository institution regulators conduct the large majority of examinations of these institutions’ compliance with these CFPB-administered regulations  However, EGRPRA was not amended after the Dodd-Frank Act to include CFPB as one of the agencies that must conduct the EGRPRA review  During the 2017 EGRPRA review, the bank regulators only requested public comments on consumer protection regulations for which they have regulatory authority  But the banking regulators still received some comments on the key mortgage regulations and the other regulations that CFPB now administers  Our review of 2017 forum transcripts identified almost 60 comments on mortgage regulations, such as HMDA and TRID  The bank regulators could not address these mortgage regulation-related comments because they no longer had regulatory authority over these regulations; instead, they forwarded these comment letters to CFPB staff  According to CFPB staff, their role in the most recent EGRPRA process was very limited  CFPB staff told us they had no role in assessing the public comments received for purposes of the final 2017 EGRPRA report  According to one bank regulator, the bank regulators did not share non- mortgage regulation-related letters with CFPB staff because those comment letters did not involve CFPB regulations  Another bank regulator told us that CFPB was offered the opportunity to participate in the outreach meetings and were kept informed of the EGRPRA review during the quarterly FFIEC meetings that occurred during the review  Before the report was sent to Congress, CFPB staff said that they reviewed several late-stage drafts, but generally limited their review to ensuring that references to CFPB’s authority and regulations and its role in the EGRPRA process were properly characterized and explained  As a member of FFIEC, which issued the final report, CFPB’s Director was given an opportunity to review the report again just prior to its approval by FFIEC  CFPB must conduct its own reviews of regulations after they are implemented  Section 1022(d) of the Dodd-Frank Act requires CFPB to conduct an assessment of each significant rule or order adopted by the bureau under federal consumer financial law  CFPB must publish a report of the assessment not later than 5 years after the effective date of such rule or order  The assessment must address, among other relevant factors, the rule’s effectiveness in meeting the purposes and objectives of title X of the Dodd-Frank Act and specific goals stated by CFPB  The assessment also must reflect available evidence and any data that CFPB reasonably may collect  Before publishing a report of its assessment, CFPB must invite public comment on recommendations for modifying, expanding, or eliminating the significant rule or order  CFPB announced in Federal Register notices in spring 2017 that it was commencing assessments of rules related to Qualified Mortgage/Ability- to-Repay requirements, remittances, and mortgage servicing regulations  The notices described how CFPB planned to assess the regulations  In each notice, CFPB requested comment from the public on the feasibility and effectiveness of the assessment plan, data, and other factual information that may be useful for executing the plan; recommendations to improve the plan and relevant data; and data and other factual information about the benefits, costs, impacts, and effectiveness of the significant rule  Reports of these assessments are due in late 2018 and early 2019  According to CFPB staff, the requests for data and other factual information are consistent with the statutory requirement that the assessment must reflect available evidence and any data that CFPB reasonably may collect  The Federal Register notices also describe other data sources that CFPB has in-house or has been collecting pursuant to this requirement  CFPB staff told us that they have not yet determined whether certain other regulations that apply to banks and credit unions, such as the revisions to TRID and HMDA requirements, will be designated as significant and thus subjected to the one-time assessments  CFPB staff also told us they anticipate that within approximately 3 years after the effective date of a rule, it generally will have determined whether the rule is a significant rule for section 1022(d) assessment purposes  In tasking the bank regulators with conducting the EGRPRA reviews, Congress indicated its intent was to require these regulators to review all regulations that could be creating undue burden on regulated institutions  According to a Senate committee report relating to EGRPRA, the purpose of the legislation was to minimize unnecessary regulatory impediments for lenders, in a manner consistent with safety and soundness, consumer protection, and other public policy goals, so as to produce greater operational efficiency  Some in Congress have recognized that the omission of CFPB in the EGRPRA process is problematic, and in 2015 legislation was introduced to require that CFPB—and NCUA—formally participate in the EGRPRA review  Currently, without CFPB’s participation, key regulations that affect banks and credit unions may not be subject to the review process  In addition, these regulations may not be reviewed if CFPB does not deem them significant  Further, if reviewed, CFPB’s mandate is for a one-time, not recurring, review  CFPB staff told us that they have two additional initiatives designed to review its regulations, both of which have been announced in CFPB’s spring and fall 2017 Semiannual Regulatory Agendas  First, CFPB launched a program to periodically review individual existing regulations—or portions of large regulations—to identify opportunities to clarify ambiguities, address developments in the marketplace, or modernize or streamline provisions  Second, CFPB launched an internal task force to coordinate and bolster their continuing efforts to identify and relieve regulatory burdens, including with regard to small businesses such as community banks that potentially will address any regulation the agency has under its jurisdiction  Staff told us the agency has been considering suggestions it received from community banks and others on ways to reduce regulatory burden  However, CFPB has not provided public information specifically on the extent to which it intends to review regulations applicable to community banks and credit unions and other institutions or provided information on the timing and frequency of the reviews  In addition, it has not indicated the extent to which it will coordinate the reviews with the federal depository institution regulators as part of the EGRPRA reviews  Until CFPB publicly provides additional information indicating its commitment to periodically review the burden of all its regulations, community banks, credit unions, and other depository institutions may face diminished opportunities for relief from regulatory burden  Second, the federal depository institution regulators have not conducted or reported on quantitative analyses during the EGRPRA process to help them determine if changes to regulations would be warranted  Our analysis of the 2017 report indicated that in responses to comments in which the regulators did not take any actions, the regulators generally only provided their arguments against taking actions and did not cite analysis or data to support their narrative  In contrast, other federal agencies that are similarly tasked with conducting retrospective regulatory reviews are required to follow certain practices for such reviews that could serve as best practices for the depository institution regulators  For example, the Office of Management and Budget’s Circular A-4 guidance on regulatory analysis notes that a good analysis is transparent and should allow qualified third parties reviewing such analyses to clearly see how estimates and conclusions were determined  In addition, executive branch agencies that are tasked under executive orders to conduct retrospective reviews of regulations they issue generally are required under these orders to collect and analyze quantitative data as part of assessing the costs and benefits of changing existing regulations  However, EGRPRA does not require the regulators to collect and report on any quantitative data they collected or analyzed as part of assessing the potential burden of regulations  Conducting and reporting on how they analyzed the impact of potential regulatory changes to address burden could assist the depository institution regulators in conducting their EGRPRA reviews  For example, as discussed previously, Community Reinvestment Act regulations were deemed a significant issue, with commenters questioning the relevance of requiring small banks to make community development loans and suggesting that the asset threshold for this requirement be raised from $1 billion to $5 billion  The regulators told us that if the thresholds were raised, then community development loans would decline, particularly in underserved communities  However, regulators did not collect and analyze data for the EGRPRA review to determine the amount of community development loans provided by banks with assets of less than $1 billion; including a discussion of quantitative analysis might have helped show that community development loans from smaller community banks provided additional credit in communities—and thus helped to demonstrate the benefits of not changing the requirement as commenters requested  By not performing and reporting quantitative analyses where appropriate in the EGRPRA review, the regulators may be missing opportunities to better assess regulatory impacts after a regulation has been implemented, including identifying the need for any changes or benefits from the regulations and making their analyses more transparent to stakeholders  As the Office of Management and Budget’s Circular A-4 guidance on the development of regulatory analysis noted, sound quantitative estimates of costs and benefits, where feasible, are preferable to qualitative descriptions of benefits and costs because they help decision makers understand the magnitudes of the effects of alternative actions  By not fully describing their rationale for the analyses that supported their decisions, regulators may be missing opportunities to better communicate their decisions to stakeholders and the public  Lastly, in the EGRPRA process, the federal depository institution regulators have not assessed the ways that the cumulative burden of the regulations they administer may have created overlapping or duplicative requirements  Under the current process, the regulators have responded to issues raised about individual regulations based on comments they have received, not on bodies of regulations  However, congressional intent in tasking the depository institution regulators with the EGRPRA reviews was to ensure that they considered the cumulative effect of financial regulations  A 1995 Senate Committee on Banking, Housing, and Urban Affairs report stated while no one regulation can be singled out as being the most burdensome, and most have meritorious goals, the aggregate burden of banking regulations ultimately affects a bank’s operations, its profitability, and the cost of credit to customers  For example, financial regulations may have created overlapping or duplicative regulations in the areas of safety and soundness  One primary concern noted in the EGRPRA 2017 report was the amount of information or data banks are required to provide to regulators  For example, the cumulative burden of information collection was raised by commenters in relation to Call Reports, Community Reinvestment Act, and BSA/AML requirements  But in the EGRPRA report, the regulators did not examine how the various reporting requirements might relate to each other or how they might collectively affect institutions  In contrast, the executive branch agencies that conduct retrospective regulatory reviews must consider the cumulative effects of their own regulations, including cumulative burdens  For example, Executive Order 13563 directs agencies, to the extent practicable, to consider the costs of cumulative regulations  Executive Order 13563 does not apply to independent regulatory agencies such as the Federal Reserve, FDIC, OCC, NCUA, or CFPB  A memorandum from the Office of Management and Budget provided guidance to the agencies required to follow this order for assessing the cumulative burden and costs of regulations  The actions suggested for careful consideration include conducting early consultations with affected stakeholders to discuss potential interactions between rulemaking under consideration and existing regulations as well as other anticipated regulatory requirements  The executive order also directs agencies to consider regulations that appear to be attempting to achieve the same goal  However, other researchers often acknowledge that cumulative assessments of burden are difficult  Nevertheless, until the Federal Reserve, FDIC, OCC, and NCUA identify ways to consider the cumulative burden of regulations, they may miss opportunities to streamline bodies of regulations to reduce the overall compliance burden among financial institutions, including community banks and credit unions  For example, regulations applicable to specific activities of banks, such as lending or capital, could be assessed to determine if they have overlapping or duplicative requirements that could be revised without materially reducing the benefits sought by the regulations  New regulations for financial institutions enacted in recent years have helped protect mortgage borrowers, increase the safety and soundness of the financial system, and facilitate anti-terrorism and anti-money laundering efforts  But the regulations also entail compliance burdens, particularly for smaller institutions such as community banks and credit unions, and the cumulative burden on these institutions can be significant  Representatives from the institutions with which we spoke cited three sets of regulations—HMDA, BSA/AML, and TRID—as most burdensome for reasons that included their complexity  In particular, the complexity of TRID regulations appears to have contributed to misunderstandings that in turn caused institutions to take unnecessary actions  While regulators have acted to reduce burdens associated with the regulations, CFPB has not assessed the effectiveness of its TRID guidance  Federal internal control standards require agencies to analyze and respond to risks to achieving their objectives, and CFPB’s objectives include addressing regulations that are unduly burdensome  Assessing the effectiveness of TRID guidance represents an opportunity to reduce misunderstandings that create additional burden for institutions and also affect individual consumers (for instance, by delaying mortgage closings)  The federal depository institution regulators (FDIC, Federal Reserve, OCC, as well as NCUA) also have opportunities to enhance the activities they undertake during EGRPRA reviews  Congress intended that the burden of all regulations applicable to depository institutions would be periodically assessed and reduced through the EGRPRA process  But because CFPB has not been included in this process, the regulations for which it is responsible were not assessed, and CFPB has not yet provided public information about what regulations it will review, and when, and whether it will coordinate with other regulators during EGPRA reviews  Until such information is publicly available, the extent to which the regulatory burden of CFPB regulation will be periodically addressed remains unclear  The effectiveness of the EGRPRA process also has been hampered by other limitations, including not conducting and reporting on depository institution regulators’ analysis of quantitative data and assessing the cumulative effect of regulations on institutions  Addressing these limitations in their EGRPRA processes likely would make the analyses the regulators perform more transparent, and potentially result in additional burden reduction  We make a total of 10 recommendations, which consist of 2 recommendations to CFPB, 2 to FDIC, 2 to the Federal Reserve, 2 to OCC, and 2 to NCUA  The Director of CFPB should assess the effectiveness of TRID guidance to determine the extent to which TRID’s requirements are accurately understood and take steps to address any issues as necessary  (Recommendation 1) The Director of CFPB should issue public information on its plans for reviewing regulations applicable to banks and credit unions, including information describing the scope of regulations the timing and frequency of the reviews, and the extent to which the reviews will be coordinated with the federal depository institution regulators as part of their periodic EGRPRA reviews  (Recommendation 2) The Chairman, FDIC, should, as part of the EGRPRA process, develop plans for their regulatory analyses describing how they will conduct and report on quantitative analysis whenever feasible to strengthen the rigor and transparency of the EGRPRA process  (Recommendation 3) The Chairman, FDIC, should, as part of the EGRPRA process, develop plans for conducting evaluations that would identify opportunities for streamlining bodies of regulation  (Recommendation 4) The Chair, Board of Governors of the Federal Reserve System, should, as part of the EGRPRA process develop plans for their regulatory analyses describing how they will conduct and report on quantitative analysis whenever feasible to strengthen the rigor and transparency of the EGRPRA process  (Recommendation 5) The Chair, Board of Governors of the Federal Reserve System, should, as part of the EGRPRA process, develop plans for conducting evaluations that would identify opportunities to streamline bodies of regulation  (Recommendation 6) The Comptroller of the Currency should, as part of the EGRPRA process, develop plans for their regulatory analyses describing how they will conduct and report on quantitative analysis whenever feasible to strengthen the rigor and transparency of the EGRPRA process  (Recommendation 7) The Comptroller of the Currency should, as part of the EGRPRA process, develop plans for conducting evaluations that would identify opportunities to streamline bodies of regulation  (Recommendation 8) The Chair of NCUA should, as part of the EGRPRA process, develop plans for their regulatory analyses describing how they will conduct and report on quantitative analysis whenever feasible to strengthen the rigor and transparency of the EGRPRA process  (Recommendation 9) The Chair of NCUA should, as part of the EGRPRA process, develop plans for conducting evaluations that would identify opportunities to streamline bodies of regulation  (Recommendation 10) We provided a draft of this report to CFPB, FDIC, FinCEN, the Federal Reserve, NCUA, and OCC  We received written comments from CFPB, FDIC, the Federal Reserve, NCUA, and OCC that we have reprinted in appendixes II through VI, respectively  CFPB, FDIC, FinCEN, the Federal Reserve, NCUA, and OCC also provided technical comments, which we incorporated as appropriate  In its written comments, CFPB agreed with the recommendation to assess its TRID guidance to determine the extent to which it is understood  CFPB stated it intends to solicit public input on how it can improve its regulatory guidance and implementation support  In addition, CFPB agreed with the recommendation on issuing public information on its plan for reviewing regulations  CFPB committed to developing additional plans with respect to their reviews of key regulations and to publicly releasing such information and in the interim, CFPB stated it intends to solicit public input on how it should approach reviewing regulations  FDIC stated that it appreciated the two recommendations and stated that it would work with the Federal Reserve and OCC to find the most appropriate ways to ensure that the three regulators continue to enhance their rulemaking analyses as part of the EGRPRA process  In addition, FDIC stated that as part of the EGRPRA review process, it would continue to monitor the cumulative effects of regulation through for example, a review of the community and quarterly banking studies and community bank Call Report data  The Federal Reserve agreed with the two recommendations pertaining to the EGRPRA process  Regarding the need conduct and report on quantitative analysis whenever feasible to strengthen and to increase the transparency of the EGRPRA process, the Federal Reserve plans to coordinate with FDIC and OCC to identify opportunities to conduct quantitative analyses where feasible during future EGRPRA reviews  With respect to the second recommendation, the Federal Reserve agreed that the cumulative impact of regulations on depository institutions is important and plans to coordinate with FDIC and OCC to identify further opportunities to seek comment on bodies of regulations and how they could be streamlined  NCUA acknowledged the report’s conclusions as part of their voluntary compliance with the EGRPRA process; NCUA should improve its qualitative analysis and develop plans for continued reductions to regulatory burden within the credit union industry  In its letter, NCUA noted it has appointed a regulatory review task force charged with reviewing and developing a four-year plan for revising their regulations and the review will consider the benefits of NCUA’s regulations as well as the burden they have on credit unions  In its written comments, OCC stated that it understood the importance of GAO’s recommendations  They stated they OCC will consult and coordinate with the Federal Reserve and FDIC to develop plans for regulatory analysis, including how the regulators should conduct and report on quantitative analysis and also, will work with these regulators to increase the transparency of the EGRPRA process  OCC also stated it will consult with these regulators to develop plans, as part of the EGRPRA process, to conduct evaluations that identify ways to decrease the regulatory burden created by bodies of regulations  As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date  At that time, we will send copies to CFPB, FDIC, FinCEN, the Federal Reserve, NCUA, and OCC  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions concerning this report, please contact me at (202) 512-8678 or evansl@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made major contributions to this report are listed in appendix VII  This report examines the burdens that regulatory compliance places on community banks and credit unions and actions that federal regulators have taken to reduce these burdens; specifically: (1) the financial regulations that community banks and credit unions reported viewing as the most burdensome, the characteristics of those regulations that make them burdensome, and the benefits are associated with those regulations and (2) federal financial regulators’ efforts to reduce any existing regulatory burden on community banks and credit unions  To identify the regulations that community banks and credit unions viewed as the most burdensome, we first constructed a sample frame of financial institutions that met certain criteria for being classified as community banks or community-focused credit unions for the purposes of this review  These sample frames were then used as the basis for drawing our non-probability samples of institutions for purposes of interviews, focus group participation, and document review  Defining a community bank is important because, as we have reported, regulatory compliance may be more burdensome for community banks and credit unions than for larger banks because they are not as able to benefit from economies of scale in compliance resources  While there is no single consensus definition for what constitutes a community bank, we reviewed criteria for defining community banks developed by the Federal Deposit Insurance Corporation (FDIC), officials from the Independent Community Bankers Association, the Office of the Comptroller of the Currency (OCC)  Based on this review, we determined that institutions that had the following characteristics would be the most appropriate to include in our universe of institutions, (1) fewer total assets, (2) engage in traditional lending and deposit taking activities, have limited geographic scope, and (3) did not have complex operating structures  To identify banks that met these characteristics, we began with all banks that filed a Consolidated Reports of Condition and Income (Call Report) for the first quarter of 2016 (March 31, 2016) and are not themselves subsidiaries of another bank that filed a Call Report  We then excluded banks using an asset-size threshold, to ensure we are including only small institutions  Based on interviews with regulators and our review of the FDIC’s community bank study, we targeted institutions around the $1 billion in assets as the group that could be relatively representative of the experiences of many community banks in complying with regulations  Upon review of the Call Reports data, we found that the banks in the 90th percentile by asset size were had about $1 2 billion, and we selected this to be an appropriate cutoff for our sample frame  In addition we excluded institutions with characteristics suggesting they do not engage in typical community banking activities like such as deposit-taking and lending; and those with characteristics suggesting they conduct more specialized operations not typical of community banking, such as credit card banks  In addition to ensure that we excluded banks whose views of regulatory compliance might be influenced by being part of a large and/or complex organization, we also excluded banks with foreign offices and banks that are subsidiaries of either foreign banks or of holding companies with $50 billion or more in consolidated assets  Finally, as a practical matter, we excluded banks for which we could not obtain data on one or more of the characteristics listed below  We also relied on a similar framework to construct a sample frame for credit unions  We sought to identify credit unions that were relatively small, engaged in traditional lending and deposit taking activities, and had limited geographic scope  To do this, we began with all insured credit unions that filed a Call Report for the first quarter of 2016 (March 31, 2016)  We then excluded credit unions using an asset-size threshold of $860 million, which is the 95th percentile of credit unions, to ensure we are including only smaller institutions  The percentile of credit unions was higher than the percentile of banks because there are more large banks than there are credit unions  We then excluded credit unions that did not engage in activities that are typical of community lending, such as taking deposits, making loans and leases, and providing consumer checking accounts, as well as those credit unions with headquarters outside of the United States  We assessed the reliability of data from FFIEC, FDIC, the Federal Reserve Bank of Chicago, and NCUA by reviewing relevant documentation and electronically testing the data for missing values or obvious errors, and we found the data from these sources to be sufficiently reliable for the purpose of creating sample frames of community banks and credit unions  The sample frames were then used as the basis for drawing our nonprobability samples of institutions for purposes of interviews and focus groups  To identify regulations that community banks and credit unions viewed as among the most burdensome, we conducted structured interviews and focus groups with a sample of a total of 64 community banks and credit unions  To reduce the possibility of bias, we selected the institutions to ensure that banks and credit unions with different asset sizes and from different regions of the country were included  We also included at least one bank overseen by each of the three primary federal depository institution regulators, Federal Reserve, FDIC, NCUA, and OCC in the sample  We interviewed 17 institutions (10 banks and 7 credit unions) about which regulations their institutions experienced the most compliance burden  On the basis of the results of these interviews, we determined that considerable consensus existed among these institutions as to which regulations were seen as most burdensome, including those relating to mortgage fees and terms disclosures to consumers, mortgage borrower and loan characteristics reporting, and anti-money laundering activities  As a result, we determined to conduct focus groups with institutions to identify the characteristics of the regulations identified in our interviews that made these regulations burdensome  To identify the burdensome characteristics of the regulations identified in our preliminary interviews, we selected institutions to participate in three focus groups of community banks and three focus groups of credit unions  For the first focus group of community banks, we randomly selected 20 banks among 647 banks between $500 million and $1 billion located in nine U S  census geographical areas using the sample frame of community banks we developed, and contacted them asking for their participation  Seven of the 20 banks agreed to participate in the first focus group  However, mortgages represented a low percentage of the assets of two participants in the first focus group, so we revised our selection criteria because two of the regulations identified as burdensome were related to mortgages  For the remaining two focus groups with community banks, we randomly selected institutions with more than $45 million and no more than $1 2 billion in assets to ensure that they would be required to comply with the mortgage characteristics reporting and with at least a 10 percent mortgage to asset ratio to better ensure that they would be sufficiently experienced with mortgage regulations  After identifying the large percentage of FDIC regulated banks in the first 20 banks we contacted, we decided to prioritize contact with banks regulated by OCC and the Federal Reserve for the institutions on our list  When banks declined or when we determined an institution merged or was acquired, we selected a new institution from that state and preferenced institutions regulated by OCC and the Federal Reserve  The three focus groups totaled 23 community banks with a range of assets  We used a similar selection process for three focus groups of credit unions consisting of 23 credit unions  We selected credit unions with at least $45 million in assets so that they would be required to comply with the mortgage regulations and with at least a 10 percent mortgage-to-asset ratio  During each of the focus groups, we asked the representatives from participating institutions what characteristics of the relevant regulations made them burdensome with which to comply  We also polled them about the extent to which they had to take various actions to comply with regulations, including hiring or expanding staff resources, investing in additional information technology resources, or conducting staff training  During the focus groups, we also confirmed with the participants that the three sets of regulations (on mortgage fee and other disclosures to consumers, reporting of mortgage borrower and loan characteristics, and anti-money laundering activities) were generally the ones they found most burdensome  To identify in more detail the steps a community bank or credit union may take to comply with the regulations identified as among the most burdensome, we also conducted an in-depth on-site interview with one community bank  We selected this institution by limiting the community bank sample to only those banks in the middle 80 percent of the distribution in terms of assets, mortgage lending, small business lending, and lending in general that were no more than 70 miles from Washington, D C  We limited the sample in this way to ensure that the institution was not an outlier in terms of activities or size, and to limit the travel resources needed to conduct the site visit  We also interviewed associations representing consumers to understand the benefits of these regulations  These groups were selected using professional judgement of their knowledge of relevant banking regulations  We interviewed associations representing banks and credit unions  To identify the requirements of the regulations identified as among the most burdensome, we reviewed the Home Mortgage Disclosure Act (HMDA) and its implementing regulation, Regulation C; Bank Secrecy Act and anti-money laundering (BSA/AML) regulations, including those deriving from the Currency and Foreign Transactions Reporting Act, commonly known as the Bank Secrecy Act (BSA), and the 2001 USA PATRIOT Act; and the Integrated Mortgage Disclosure Rule Under the Real Estate Settlement Procedures Act (RESPA) with the implementing Regulation X; and the Truth-in-Lending Act (TILA) with implementing Regulation Z  We reviewed the Consumer Financial Protection Bureau’s (CFPB) small entity guidance and supporting materials on the TILA- RESPA Integrated Disclosure (TRID) regulation and HMDA to clarify the specific requirements of each rule and to analyze the information included in the CFPB guidance  We interviewed staff from each of the federal regulators responsible for implementing the regulations, as well as from the federal regulators responsible for examining community banks and credit unions  To identify the potential benefits of the regulations that were considered burdensome by community banks and credit unions, we interviewed representatives from four community groups to document their perspectives on the benefits provided by the identified regulations  To determine whether the bank regulators had required banks to comply with certain provisions from which the institutions might be exempt, we identified eight exemptions from the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 from which community banks and credit unions should be exempt and reviewed a small group of the most recent examinations to identify instances in which a regulator may not have applied an exemption for which a bank was eligible  We reviewed 20 safety and soundness and consumer compliance examination reports of community banks and eight safety and soundness examination reports of credit unions  The bank examination reports we reviewed were for the first 20 community banks we contacted requesting participation in the first focus group  The bank examination reports included examinations from all three bank regulators (FDIC, Federal Reserve, and OCC)  The NCUA examination reports we reviewed were for the eight credit unions that participated in the second focus group of credit unions  Because of the limited number of the examinations we reviewed, we cannot generalize whether regulators extended the exemptions to all qualifying institutions  To assess the federal financial regulators’ efforts to reduce the existing regulatory burden on community banks and credit unions, we identified the mechanisms the regulators used to identify burdensome regulations and actions to reduce potential burden  We reviewed laws and congressional and agency documentation  More specifically, we reviewed the Economic Growth and Regulatory Paperwork Reduction Act of 1996 (EGRPRA) that requires the Federal Reserve, FDIC, and OCC to review all their regulations every 10 years and identify areas of the regulations that are outdated, unnecessary, or unduly burdensome and reviewed the 1995 Senate Banking Committee report, which described the intent of the legislation  We reviewed the Federal Register notices that bank regulators and NCUA published requesting comments on their regulations  We also reviewed over 200 comment letters that the regulators had received through the EGRPRA process from community banks, credit unions, their trade associations, and others, as well as the transcripts of all six public forums regulators held as part the 2017 EGRPRA regulatory review efforts they conducted  We analyzed the extent to which the depository institutions regulators addressed the issues raised in comments received for the review  In assessing the 2017 and 2007 EGRPRA reports sent to Congress, we reviewed the significant issues identified by the regulators and determined the extent to which the regulators proposed or took actions in response to the comments relating to burden on small entities  We compared the requirements of Executive Orders 12866, 13563, and 13610 issued by Office of Management and Budget with the actions taken by the regulators in implementing their 10-year regulatory retrospective review  The executive orders included requirements on how executive branch agencies should conduct retrospective reviews of their regulations  For both objectives, we interviewed representatives from CFPB, FDIC, Federal Reserve, Financial Crimes Enforcement Network, NCUA, and OCC to identify any steps that regulators took to reduce the compliance burden associated with each of the identified regulations and to understand how they conduct retrospective reviews  We also interviewed representatives of the Small Business Administration’s Office of Advocacy, which reviews and comments on the burdens of regulations affecting small businesses, including community banks  We conducted this performance audit from March 2016 to February 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  In addition to the contact name above, Cody J  Goebel (Assistant Director); Nancy Eibeck (Analyst in Charge); Bethany Benitez; Kathleen Boggs; Jeremy A  Conley; Pamela R  Davidson; Courtney L  LaFountain; William V  Lamping; Barbara M  Roesmann; and Jena Y  Sinkfield made key contributions to this report 

ground_truth: Crashes at highway-rail grade crossings are one of the leading causes of railroad-related deaths. According to FRA data, in 2017, there were more than 2,100 crashes resulting in 273 fatalities. Since 2009 crashes have occurred at a fairly constant rate. The federal government provides states funding to improve grade-crossing safety through FHWA's Section 130 Program. The persistence of crashes and deaths raises questions about the effectiveness of the federal grade-crossing-safety program. GAO was asked to review federal efforts to improve grade-crossing safety. This report examines: (1) the focus of FRA's grade-crossing-safety research, (2) how states select and implement grade-crossing projects and what data are available from FRA to inform their decisions, and (3) the challenges states reported in implementing and assessing projects and the extent to which FHWA assesses the program's effectiveness. GAO analyzed FRA data; reviewed FRA's, FHWA's, and states' documents; reviewed a study of states' selection of projects; and interviewed FRA and FHWA headquarters and field staff, and officials from a non-generalizable sample of eight states, selected to include a mix in the number of grade crossings and crashes, and geographic diversity. Research sponsored by the Federal Railroad Administration (FRA) has identified driver behavior as the main cause of highway-rail grade crossing crashes and that factors such as train and traffic volume can contribute to the risk of a crash. (See figure.) Over 70 percent of fatal crashes in 2017 occurred at grade crossings with gates. To meet the requirements of the federal grade-crossing program, states are responsible for selecting and ensuring the implementation of grade-crossing improvement projects. Most state DOT officials and other relevant transportation officials use local knowledge of grade crossings to supplement the results of models that rank grade crossings based on the risk of an accident. These states generally consider the same primary risk factors, such as vehicle and train traffic. FRA is taking steps to improve the data used in its model to help states assess risk factors at grade crossings. For example, FRA's grade-crossing inspectors will review and identify issues with railroad- and state-reported inventory data. FRA is currently developing guidelines, which it plans to finalize by the end of 2018, to implement these inspections as it has for other types of FRA inspections. Officials we spoke with in eight states reported challenges in pursuing certain types of projects that could further enhance safety, in part because of federal requirements. While safety has improved, many crashes occur at grade crossings with gates, and officials said there could be additional ways to focus program requirements to continue improving safety. States' and the Federal Highway Administration's (FHWA) reporting focuses on the program's funding and activity, such as the number and types of projects, yet the low number of crashes makes it difficult to assess the effectiveness of projects in reducing crashes and fatalities. FHWA reports the program has been effective in reducing fatalities by about 74 percent since 1975. However, since 2009, annually there have been about 250 fatalities—almost one percent of total highway fatalities. FRA expects future crashes to grow, in part, due to the anticipated increase in rail and highway traffic. An evaluation of the program should consider whether its funding and other requirements allow states to adequately address ongoing safety issues. FHWA officials said they are not required to perform such evaluations. GAO has previously reported on the importance of program evaluations to determine the extent to which a program is meeting its objectives. An evaluation of the program could lead FHWA to identify changes that could allow states to more strategically address problem areas. GAO recommends that FHWA evaluate the program's requirements to determine if they allow states the flexibility to address ongoing safety issues. The Department of Transportation concurred with GAO's recommendation.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: Grade-crossing safety has improved significantly since 1975, but since 2009, the number of crashes and fatalities at grade crossings has plateaued (see fig  1)  The yearly number of grade-crossing crashes declined from 12,126 in 1975 to 2,117 in 2017  In that time frame, fatalities dropped from 917 to 273  The most significant reductions in grade-crossing crashes and fatalities were achieved from 1975 to 1985, when states closed or improved the most dangerous crossings  Grade- crossing safety continued to improve until the mid-2000s, though at a slower rate  Since 2009, the number of grade-crossing crashes and fatalities remains at around 2,100 crashes and 250 fatalities a year  These fatalities typically make up less than one percent of all highway- related fatalities  The decrease in crashes and fatalities occurred as the volume of train and highway traffic generally increased over the years  FRA expects the traffic volumes to continue to increase and has expressed concern that grade-crossing crashes and fatalities may also increase  As a set-aside portion of FHWA’s much larger Highway Safety Improvement Program (HSIP), the Section 130 Program provides funds to state DOTs for the elimination of hazards at highway-rail grade crossings  States determine what improvements need to be made at grade crossings  FHWA has oversight responsibilities regarding the use of federal funds as part of its administration of federal-aid highway programs and funding, including HSIP funds  FHWA uses a statutory formula to distribute to states Section 130 Program funds, which averaged $235 million per year during the last 10 years (fiscal years 2009 through 2018)  Section 130 Program projects are funded at a 90 percent federal share, with the state or the roadway authority funding the remaining 10 percent  States have 4 years to obligate their program funds before they expire, meaning that in any given fiscal year, states can obligate funds appropriated in that year as well as any unobligated funds from the previous 3 fiscal years  In addition, states may choose to combine funds from multiple years to fund relatively expensive projects  The Section 130 Program’s requirements direct states to establish an implementation schedule for grade-crossing-safety improvement projects that, at a minimum, include warning signs for all public grade crossings  Grade crossings are generally categorized as “active” or “passive” depending on the type of traffic control devices that are present  As of July 2018, according to FRA’s National Highway-Rail Crossing Inventory, there were approximately 68,000 public grade crossings with electronic, or active, traffic control devices in the United States  Another approximately 58,000 public grade crossings have passive traffic-control devices, which include signs and supplementary pavement markings  The requirements also specify that at least 50 percent of Section 130 Program funding must be dedicated to the installation of protective devices at grade crossings, including traffic control devices  States can use remaining program funds for any hazard elimination project  States may also use program funds to improve warning signs and pavement markings or to improve the way the roadway aligns with the tracks (e g , to ensure low-clearance vehicles do not get stuck on the tracks)  In addition, states can use up to 2 percent of the funds to improve their grade-crossing inventories and to collect and analyze data  See figure 2 for examples of the types of projects eligible for Section 130 Program funds and graphical depictions of grade crossings before and after safety improvements have been made  FHWA and FRA are the primary agencies responsible for safety at grade crossings, and they both play key—yet distinct—roles  FHWA oversees the Section 130 Program and monitors states’ uses of program funds through 52 division offices located in each state, the District of Columbia, and Puerto Rico and through headquarters staff in Washington, D C  In addition, FHWA’s division staff reviews states’ processes for prioritizing and selecting grade-crossing-safety improvement projects  FHWA does not evaluate the appropriateness of individual grade-crossing projects, but instead helps states determine that projects meet program eligibility requirements  Division staff assists in the implementation of Section 130 Program state-administered projects, and they may participate in state- DOT-led, on-site reviews of grade crossings under consideration for Section 130 Program projects  FHWA headquarters staff is responsible for FHWA-wide initiatives, such as working with stakeholders to establish standards for traffic control devices and systems at grade crossings and for engineering oversight of state-administered safety improvement projects  FRA provides safety oversight of both freight and passenger railroads by: collecting and analyzing data; issuing and enforcing numerous safety regulations, including on grade-crossings’ warning systems; conducting focused inspections, audits, and accident providing technical assistance to railroads and other stakeholders  Specifically, FRA oversees rail safety through eight regional offices and through headquarters staff in Washington, D C  Regional staff monitor railroads’ compliance with federal safety regulations through inspections and provide technical assistance and guidance to states  In 2017, FRA created a new discipline for grade-crossing safety and is hiring new grade-crossing inspectors  These inspectors conduct field investigations, identify regulatory defects and violations, recommend civil penalty assessments when appropriate, and may participate in state- DOT-led teams that conduct on-site reviews of grade crossings to evaluate potential safety improvements  According to FRA documentation, FRA’s new inspectors will also work with a variety of stakeholders to institute new types of training, explore new safety concepts and technologies, and assist in the development of new or modified highway-rail grade-crossing-safety regulations, initiatives, and programs  The inspectors will also work with FHWA and other DOT operating administrations in a cooperative effort to improve grade- crossing safety  FRA regional staff also investigates select railroad crashes, including those at grade crossings, to determine root causation and any contributing factors, so that railroads can implement corrective actions  FRA headquarters staff develops analytical tools for states to use to prioritize grade-crossing projects  In addition, headquarters staff manages research and development to support improved railroad safety, including at grade crossings  FRA’s Office of Railroad Safety maintains the National Highway-Rail Crossing Inventory database and the Railroad Accident/Incident Reporting System on grade-crossing crashes  Both states and railroads submit information to FRA’s crossing inventory, which is designed to contain information on every grade crossing in the nation  Railroads submit information such as train speed and volume; states submit information such as highway speed limits and average annual daily traffic  The Rail Safety Improvement Act of 2008 added requirements for both railroads and states to periodically update the inventory; however, the Moving Ahead for Progress in the 21st Century Act (MAP-21) repealed a provision providing DOT authority to issue implementing regulations that would govern states’ reporting to the inventory  According to FRA officials, while FRA’s regulations do not require states to report the information, FRA encourages them to do so  FRA regulations require railroads to report and update their information in the inventory every 3 years or sooner in some instances, such as if new warning devices are installed or the grade crossing is closed  FRA’s accident system contains details about each grade-crossing accident that has occurred  In addition to submitting immediate reports of fatal grade-crossing crashes, railroads are required to submit accident reports within 30 days after the end of the month in which the accident occurred and describe conditions at the time of the accident (e g , visibility and weather); information on the grade crossing (e g , type of warning device); and information on the driver (e g , gender and age)  In its role overseeing grade-crossing safety, FRA has sponsored a number of research efforts to better understand the causes of grade- crossing crashes and identify potential ways to improve engineering, education, and enforcement efforts  For example, FRA sponsored an in- depth data analysis of grade-crossing crashes to better identify which crossing characteristics increase the risk of an accident  The report, issued in 2017, found that the volumes of train and vehicle traffic at a crossing are the biggest predictors of grade-crossing crashes  Changes in vehicle and train traffic therefore affect the annual number of grade- crossing crashes  For example, as highway traffic decreased in 2008, possibly due to the economic recession and higher gas prices, so too did the number of grade-crossing crashes  As previously noted, FRA expects that the number of grade-crossing crashes will likely grow with anticipated increases in future train and highway traffic  As discussed below, vehicle and train volume are included in the U S  DOT Accident Prediction Model, which some states use to select grade-crossing improvement projects  According to FRA officials, FRA is using the results of this recent in-depth data analysis to, in part, evaluate whether additional risk factors, such as the number of male drivers or trains carrying toxic materials, should be added to the model  FRA has targeted other research into understanding driver behavior at grade crossings, which is the leading cause of crashes  According to FRA’s accident data, in 2017, 71 percent of fatal crashes at public grade crossings occurred at those with gates  In 2004, the DOT Inspector General (IG) reported that 94 percent of grade-crossing crashes from 1994 to 2003 could be attributed to risky driver behavior or poor judgement  State officials we spoke with explained that drivers may become impatient waiting at a grade crossing and decide to go around the gates  Drivers may also line up over the grade crossing in heavy vehicular traffic, and be unable to exit before the gates come down  See figure 3 for examples of risky driver behavior at grade crossings  To better understand driver behavior, FRA sponsored a John A  Volpe National Transportation Systems Center (Volpe Center) study that recorded and analyzed drivers’ actions as they approached grade crossings  The researchers found that almost half of drivers were doing another task, such as eating, and over a third did not look in either direction while approaching passive grade crossings  We have previously reported, and many stakeholders we interviewed agreed, that in light of inappropriate driver behavior, technological solutions alone may not fully resolve safety issues at grade crossings  In addition, public-education and law-enforcement efforts can augment the effectiveness of technological solutions  According to FRA officials, they shared information on driver education with DOT’s National Highway Traffic Safety Administration (NHTSA) as NHTSA works more closely with states on driver education manuals  According to DOT officials, NHTSA updates its driver education materials every 2–3 years and plans to consider including grade-crossing-safety materials in the next versions  FRA is also working with states and localities to research and develop new protective devices and other safety measures targeted at improving driver behavior at grade crossings  As most fatal crashes happen at grade crossings already equipped with gates, FRA and state and local agencies are exploring whether additional safety measures can improve safety at those locations  For example, in 2016 and 2017, FRA’s Grade Crossing Task Force worked with the Volpe Center and the City of Orlando to test whether photo enforcement at grade crossings could reduce risky driver behavior  The City of Orlando installed automated photo-enforcement devices at a grade crossing, and instead of issuing fines to drivers who had violated its warning devices, sent drivers a warning notice and educational safety materials  Eight months after the photo-enforcement system was installed, grade crossing violations decreased by 15 percent  While FRA judged these enforcement efforts successful at changing driver behavior, a 2015 FRA whitepaper noted that photo enforcement equipment is costly—on average costing over $300,000 per crossing to install and operate for 2 years—and may not be cost-effective for most grade crossings  FRA found that due to costs and state laws prohibiting photo-enforcement, only two photo- enforcement cameras were currently in operation at grade crossings across the country  States, localities, and FHWA are also exploring whether new types of pavement markings at grade crossings can improve driver behavior  According to DOT officials, FHWA is working with two states to develop new cross-hatch pavement markings for grade crossings that would comply with the Manual on Uniform Traffic Control Devices, similar to the “don’t block the box” type pavement markings used in intersections  FHWA also worked with a city to test the use of in-roadway lights to delineate the crossing  (See fig  4)  FRA and state DOTs are also trying to improve pedestrian safety at grade crossings by developing new safety measures  Grade-crossing accidents involving pedestrians are less frequent than those involving automobiles at grade crossings but have a higher fatality rate  While pedestrians were involved in only 9 percent of accidents at public crossings in 2017, almost 40 percent of fatal grade-crossing accidents involved pedestrians  To try to improve pedestrian safety, in 2012 the Volpe Center worked with New Jersey Transit to study whether adding additional pedestrian gate skirts— hanging gates that further block a crossing (see fig  5)—would prevent people from ducking under the gates  The Volpe Center reported that these new gates had mixed success  While incidents of people going under and around the gates decreased, more people chose to cross the tracks in the street rather than at the sidewalk  Finally, FRA is exploring new automated and connected vehicle technologies that could reduce risky driver behavior at grade crossings  FRA, FHWA, and officials from one state we interviewed said they anticipate that such technology will be critical to further improving safety  Specifically, FRA and FHWA are coordinating with DOT’s Intelligent Transportation Systems Joint Program Office to develop pilot technology that would enable crossing infrastructure or trains to communicate wirelessly with vehicles  Vehicles can use this information to warn the driver that a crash or violation is imminent, or integrate with onboard active safety systems  According to FRA officials, they completed a proof of concept in 2013 and completed and tested a prototype of the technology in 2017  DOT officials said that DOT does not have a time frame for when automakers might begin incorporating such connected vehicle technologies and noted that retrofitting older cars with new equipment will likely make this a long-term effort  FRA shares information on its research in various ways with state DOTs, because states are responsible for deciding which safety measures to install at grade crossings  Specifically, FRA and FHWA jointly hold quarterly webinars with stakeholders, including state DOT officials, and conduct presentations at highway-rail safety workshops  Information on safety measures such as grade-crossing devices, signs, and markings are also included in the Railroad-Highway Grade Crossing Handbook  According to DOT officials, the handbook was developed jointly by FHWA and FRA  The last version of the handbook was updated in 2007 and includes some out of date information  FRA and FHWA officials said they began working on an update in 2017, but missed the July 2018 target completion date  According to FHWA officials, updating the handbook is a complex undertaking that has taken more time than they anticipated due to the extensive collaboration required among stakeholders  FHWA officials said they anticipate completing the update during the spring of 2019  The risk of crashes at public grade crossings within a state factors into states’ selection of over 1,000 new Section 130 Program projects nationally each fiscal year  FHWA requires states to develop a grade crossing program that considers relative risk  FHWA officials said they review the methods that states use to select projects to ensure that risk is considered  According to a 2016 academic study of 50 states, most states use mathematical formulas, or “accident prediction models,” to help assess risk and identify grade crossings for potential projects  More specifically, these accident prediction models use factors such as grade crossing characteristics and accident history to rank grade crossings by risk  DOT provides one such model—the Accident Prediction Model—and some states have developed their own models  The study reported that 19 states used DOT’s model and 20 states used a different model  It also found that the DOT and commonly used state models include some similar grade-crossing characteristics to predict accident risk  For example, the selected models reviewed all considered vehicle- and train- traffic volume, which FRA has found to be the strongest predictors of grade-crossing crashes  FRA makes its Accident Prediction Model available to states online through its Web Accident Prediction System  This system is an online tool that uses FRA’s crossing inventory, crossing collision history, and the DOT Accident Prediction Model to predict accident risk for grade crossings in each state  Only one of the eight states in our review used the system as its primary source for ranking grade-crossing risk  Most of the other states perform their own calculations to rank grade crossings  Officials from two states said that they believe their state-maintained data are more reliable than FRA’s crossing inventory and explained that they go directly to their contacts at railroads to get updated information on factors such as train volume  Accident prediction models are only one source of information states use when selecting Section 130 Program projects  According to the state officials we spoke with, a variety of other considerations can also influence their decisions, including the following: Proximity of projects together along a railroad “corridor” in order to gain efficiencies and reduce construction costs  Requests from local jurisdictions or railroads  These stakeholders may have information on upcoming changes at a grade crossing, such as higher train volume or new housing developments nearby, which would increase risk but would not be reflected yet in the accident prediction model  Availability of local funding to provide the required 10 percent match for Section 130 Program projects, while trying to spread the funds fairly across the state  States may also consider grade crossings that have had close calls in the past, such as where a car narrowly avoided being hit by a train  FRA does not require railroads to report on these close calls, or “near misses;” however, according to state officials, railroads sometimes provide this information to states on an ad-hoc basis  State officials from four of the eight states we spoke with said they considered near misses when selecting Section 130 Program projects  A 2004 Volpe Center report noted that studying close calls was a proactive way to improve safety  According to the report, FRA sponsored a workshop to learn about the benefits of collecting and analyzing close calls  However, stakeholders we interviewed noted challenges formalizing near-miss reporting  For example, Volpe Center officials said these reports are subjective in nature—what one engineer considers a close call, others may not  FRA developed another online tool—GradeDec—to allow states to compare the costs and benefits for various grade-crossing improvement projects  GradeDec uses models to analyze a project’s risk and calculate cost-benefit ratios and net present value for potential projects  FRA provides state DOTs with on-site GradeDec workshops upon request  While FRA officials noted that many state and local governments have registered to use the program, none of the state officials we spoke with identified GradeDec as a tool that they use to conduct cost-benefit analysis  Officials from two state DOTs we spoke with said that cost- benefit analyses could help them better identify and select the most cost- effective crossing safety projects in the future  According to the academic study of 50 states noted above, because of limited funding for grade-crossing improvements, states should consider the life-cycle costs of the projects as well as net present value to help select projects  As discussed later in this report, the small number of crashes at grade crossings can make it challenging to distinguish between different projects in terms of their effectiveness in reducing accidents  Finally, after they have considered risk factors and created a list of potential grade crossings for improvement, state officials, along with relevant stakeholders from railroads and local governments, conduct field reviews of the potential projects  According to state officials, these reviews help identify grade-crossing characteristics that may not be included in the accident prediction models, such as vegetation that would obstruct drivers’ views  In 2008, legislation was enacted mandating reporting by states and railroads to the National Highway-Rail Crossing Inventory  However, the fact that reporting to the inventory remained voluntary until 2015 has had lingering effects on the completeness of the data in the inventory  In 2015, as mandated by statute, FRA issued regulations requiring railroads to update certain data elements for all grade crossings every 3 years  However, our analysis of FRA’s crossing inventory found that 4 percent of grade crossings were last updated in 2009 or earlier  In addition, because MAP-21 repealed DOT’s authority to issue regulations that would govern state reporting to the inventory, state reporting of grade-crossing data remains voluntary, according to FRA officials, and all state-reported information is not complete  Our analysis of state-reported data in FRA’s crossing inventory found varying levels of completeness  For example, while some state-reported data fields were almost entirely complete, 33 percent of public grade crossings were missing data on posted highway speed  We also found that of the crossings for which states reported the year when the highway-traffic count was conducted, 64 percent of the highway-traffic counts for public grade crossings, another important risk factor, had not been updated since 2009, or earlier  According to the 2015 final rule, FRA will continue to evaluate whether additional regulations to address state reporting are needed to maintain the crossing inventory’s accuracy  FRA officials told us that improving inventory data will help them better deploy their limited resources, particularly their grade-crossing inspectors, and said that they have taken steps to help improve the data  In 2017, FRA regional officials conducted field reviews to verify the latitude and longitude data for grade crossings in the inventory, data that states are responsible for updating  In addition, FRA expects its grade-crossing inspectors as part of their inspections to review and identify issues with the railroad- and state-reported inventory data  According to FRA officials, FRA has begun to both transition its 19 grade-crossing managers into grade-crossing inspectors and also hire new inspectors, for an eventual total of 24 inspectors and eight regional specialists to supervise their activities  To help ensure railroads’ compliance with crossing inventory regulations, officials said that the inspectors will use spot checks to validate the inventory data by comparing grade-crossing characteristics in the field with the information railroads submitted to the inventory  In addition, FRA has incorporated information on inventory-reporting requirements into the grade-crossing inspectors’ training  Finally, FRA is currently developing guidelines for the grade-crossing inspections similar to those for other FRA safety disciplines  FRA headquarters officials acknowledged that they are still clarifying the details for the inspections that will be included in the compliance manuals that inspectors will use  Specifically, they said they are still determining appropriate inspector workloads and drafting specific guidelines that will need to be integrated into FRA’s regional inspection plans  FRA officials said they are working to develop and make available inventory inspection guidance to the grade-crossing managers and inspectors by December 31, 2018  In the meantime, FRA held training that included information on inventory-reporting requirements  In August 2018, FRA developed guidance for grade-crossing inspections specific to quiet zones in response to a recommendation we made in 2017  It is important that FRA meets its goal to issue similar guidance specific to reviewing the accuracy of the inventory data, as FRA cannot have reasonable assurance that inspections that are already under way are being conducted in such a manner that would allow them to consistently identify data reliability issues at each crossing  About 75 percent of all Section 130 Program projects states implemented in fiscal year 2016 involved installing or updating active grade-crossing equipment, including warning lights and protective gates (see fig  6)  The prevalence of this type of project is in part due to the Section 130 Program requirement that states spend at least 50 percent of funds on protective devices  Other than eliminating a grade crossing, adding protective devices has long been considered the most effective way of reducing the risk of a crash  Officials from six of eight state DOTs we interviewed told us that the numbers and types of grade-crossing projects they implement are dependent on the amount of Section 130 Program funding they receive and the cost of the projects  As previously described, funds are set aside from the Highway Safety Improvement Program and distributed to states by a statutory formula that includes factors such as the number of grade crossings in each state  Officials from six of the eight state DOTs we spoke to agreed that the set-aside nature of the program was crucial in allowing them to implement projects, many of which they said would not have been possible without Section 130 Program funds  For example, many said the formula funding ensures that grade-crossing projects are completed along with highway safety projects, particularly given the fact that fatalities resulting from grade-crossing crashes account for so few when compared to highway deaths  Overall, fatalities resulting from grade-crossing crashes account for less than 1 percent of all highway- related fatalities  In fiscal year 2018, the funds distributed ranged from a low of approximately $1 2 million for eight states and Washington, D C , to over $16 million for California and over $19 million for Texas  The number of grade crossings in the eight states and Washington, D C  ranged from 5 to 380, while California had almost 6,000 and Texas had over 9,000  Project implementation costs varied by project type and ranged widely depending on project scope  Based on 2016 DOT data, some typical project costs ranged as follows: adding signs to passive grade crossings—$500 to $1,500; adding flashing lights and two gates to passive grade crossings— $150,000 to $300,000; adding four gates to grade crossings with flashing lights—$250,000 - closing a grade crossing—$25,000 to $100,000; and separating a grade crossing from traffic (Grade Separation)—$5 million to $40 million  State officials we spoke with cited several challenges in pursuing certain types of controversial, innovative, and expensive projects that could help them address the evolving nature of risk at grade crossings and difficulty in measuring the effectiveness of their projects  First, most state DOT officials said that the cost of grade-separation projects and, at times, the controversy of eliminating grade crossings through closure reduces the number of these projects, while acknowledging that they are the most effective ways to improve safety  These types of projects made up only 3 percent of Section 130 Program projects in fiscal year 2016 (see fig  6)  Grade-separation projects are often more expensive than the annual Section 130 Program funding available to states  In 2018, only eight states received annual Section 130 Program funding sufficient to fund a $7-million grade-separation project  As discussed previously, to fund relatively expensive projects, states may choose to combine funds from multiple years  Also, states and railroads may make incentive payments to localities for the permanent closure of a grade crossing  In addition to the cost, most state DOT officials reported challenges obtaining local support for closing grade crossings  They said closures may inconvenience residents who use the road and force emergency responders to take longer routes, potentially slowing response times  Grade-separation projects address these safety concerns and may be more agreeable to residents, but they are substantially more expensive  While up to $7,500 in Section 130 Program funding can be used to help incentivize communities to close grade crossings, officials from some of our selected state DOTs said this amount is generally not enough to persuade local officials to support the closing  Second, officials from many state DOTs we interviewed also reported that the requirements of the Section 130 Program create challenges for them in implementing what they considered to be innovative projects  For example, the program requirement that 50 percent of funds be used on protective devices, combined with what one researcher described to us as the tendency by states to implement “known” projects—i e , protective devices—may impede states’ selection of new, more innovative safety projects  Officials we interviewed from many state DOTs described challenges related to the program’s requirements  They noted that they are prevented from using Section 130 Program funds for new types of safety technologies not yet incorporated into FHWA’s Manual on Uniform Traffic Control Devices  As noted previously in this report, outside the Section 130 Program FHWA is working with states and localities to explore whether new types of pavement markings at grade crossings, not in the manual, can improve driver behavior  One state DOT official we interviewed suggested changes to allow states to fund one grade- crossing pilot project per year or to use a set percentage of program funds to finance a pilot project that could help them explore promising but as yet unproven technologies  Third, state DOT officials from four of the eight selected states also said it can be difficult to find funding for the required 10 percent state match  As previously mentioned, while certain rail-safety projects are eligible for up to 100 percent federal funding, Section 130 Program projects are funded at a 90 percent federal share  According to DOT documentation we reviewed, only some states have a dedicated source for such a match, and state DOT officials from one of our selected states said their state cannot use state funds for the 10 percent match  Some state DOT officials said this situation can drive project selection  For example, they sometimes chose projects based on which localities or railroads were willing to provide matching funds or offer cost savings  Finally, many state officials cited challenges in measuring the effectiveness of grade crossing projects in reducing crashes or the risk of crashes  In particular, state officials we spoke to said it can be difficult to use before-and-after crash statistics as a measure of effectiveness because of the low number and random nature of crashes  Also, as FRA research has shown and as FHWA and FRA have noted, reporting on before-and-after grade-crossing accident statistics can be misleading, given the infrequency of crashes and crashes that are not the result of grade crossing conditions  States’ required Section 130 Program annual progress reports to the Secretary of DOT call for states to report on the effectiveness of the improvements they made  FHWA reporting guidance suggests they define effectiveness as the reduction in the number of fatalities and serious injuries after grade-crossing projects were implemented, consistent with statutory requirements  In addition, FHWA guidance states that consideration should be given to quantifying effectiveness in the context of fatalities and serious injuries  However, states often report no differences in crashes after specific projects were implemented, and there have been instances where states reported a slight increase in crashes  Such an increase does not necessarily mean that the project was not effective in reducing the overall risk of a crash  Also, not all projects are implemented at grade crossings where there has been a crash  Among other information, states also typically report information on funding and data on the numbers and types of projects implemented  In addition, the extent to which states report projects’ effectiveness varies greatly  Given states’ responsibility for implementing the Section 130 Program and the differences in the amounts of funding they receive, FHWA officials said states should determine and report on the appropriate effectiveness metrics for their programs  According to FHWA officials, during the 2017 reporting year, a few states requested examples of what to include when reporting effectiveness, and FHWA responded with examples of various methods they could use, such as a benefit-cost ratio or the percentage decrease in fatalities, serious injuries, and crashes  Regardless of the difficulty in measuring the effectiveness of specific projects, most state DOT officials we interviewed stressed the importance of the Section 130 Program in funding grade-crossing projects  FHWA’s biennial report to Congress is intended to provide information to Congress on the progress being made by the states in implementing projects to improve safety and, in addition, make recommendations for future implementation of the program  FHWA reviews states’ annual Section 130 Program reports and uses them to formulate the report to Congress every 2 years  FHWA’s 2018 report highlights that the Section 130 Program has seen great success since 1975, with a decrease of approximately 74 percent in fatalities at the same time that there was an increase in vehicle and train traffic  The report described the latest available 10-year trend, from 2007 to 2016, as showing a 31 percent decrease in fatalities  Fatalities have also decreased when adjusted for train traffic  However, FHWA officials acknowledged in interviews with us that crashes and fatalities have remained constant since about 2009, with more recent data showing a slight increase in fatalities over the last 2 to 3 years, data that are consistent with the increases in overall roadway fatalities  The officials said increased train- and vehicle-traffic volumes could be contributing to that increase, in addition to other factors, such as more bicycle riders and pedestrians using grade crossings  As described earlier, states have generally already used Section 130 Program funding to address safety at the riskiest grade crossings by adding protective measures, typically lights and gates  Yet crashes continue to occur at these improved grade crossings  Given these trends and the challenges discussed earlier related to the requirements of the Section 130 Program, it is not clear whether the program remains effective in continuing to reduce the risk of crashes and fatalities at grade crossings  As required, FHWA’s biennial report includes a section on “recommendations for future implementation” of the Section 130 Program  As part of this, FHWA reports on challenges and actions being taken to address them  FHWA’s 2018 report identified one of the same challenges we heard about from state DOT officials related to the inability or unwillingness of local agencies to provide matching funds and the relatively low amount of funding designed to incentivize localities to close crossings  FHWA reported on its efforts to address these challenges, including by providing guidance, resources, and supportive training to states and local agencies and serving as a clearinghouse for innovative methods of supporting projects  However, with the exception of the funding challenge, FHWA’s most recent report does not include the other challenges state officials identified to us related to the requirements of the Section 130 Program discussed above  These include program funding requirements that may impede innovative approaches and the difficulties of using before-and-after crash statistics to measure effectiveness  Many state DOT officials we spoke with said there may be an opportunity to more broadly assess the Section 130 Program at the national level  It could be more informative to comprehensively assess more detailed crash trends, such as those that look forward over multiple years across the more than 1,700 crashes nationwide, rather than on the approximately 35 that occur on average within a state, and identify strategies to address those trends  Doing so could help FHWA learn more about why crashes are continuing and what types of projects may be effective  There could be ways to evaluate the program in a more comprehensive way; many state DOT officials we interviewed told us such a comprehensive evaluation could help improve program effectiveness in a number of ways, including by enabling the program to better keep up with the rapid pace of technological change and re- examining eligibility requirements that limit the flexibility of states to consider other types of projects beyond engineering  Also, most state DOT officials we interviewed agreed that education and enforcement efforts are crucial to further improving safety, as did 8 out of 10 other stakeholders we spoke to, as well as officials from Volpe Center and NTSB  However, according to FHWA officials, those project types are not allowed under the Section 130 Program’s requirements  The officials said FHWA has partnered with FRA and NHTSA on research efforts, such as driver-behavior studies, to inform grade-crossing safety issues  However, the officials said that FHWA has not conducted a program evaluation of the Section 130 Program to consider whether the program’s funding and other requirements allow states to adequately address ongoing safety issues such as driver behavior  FHWA officials said that there is no federal requirement for them to conduct such a program evaluation  We have previously reported that an important component of effective program management is through program performance assessment, which helps establish a program’s effectiveness—the extent to which a program is operating as it was intended and the extent to which a program achieves what the agency proposes to accomplish  This type of evaluative information helps the executive branch and congressional committees make decisions about the programs they oversee  Assessing program performance includes conducting program evaluations, which are individual systematic studies that answer specific questions about how well a program is meeting its objectives  In addition, federal internal-control standards state that management should identify, analyze, and respond to significant changes in a program’s environment that could pose new risks  FHWA officials said the fact that crashes and fatalities have held steady while the volume of train and vehicle traffic has increased is an indication that grade-crossing safety has continued to improve  However, specific to fatalities per million train-miles, FHWA’s 2018 biennial report shows this rate to be fairly constant since 2009  As noted previously, FRA expects train and traffic volumes to continue to increase and has expressed concern that grade-crossing crashes and fatalities may also increase  Without conducting a program evaluation, FHWA cannot ensure that the Section 130 Program is achieving one of the national goals of the federal- aid highway program, to reduce fatalities and injuries  In addition, It is difficult to see how FHWA, in its biennial reports to Congress, could make informed recommendations for future program implementation without conducting a program evaluation to assess, among other things, whether program requirements first established some four decades ago continue to reduce fatalities and injuries  We note that as part of a program evaluation, some changes that FHWA, working with FRA, identifies as potentially having merit to improve the program’s effectiveness could require a statutory change  The continued number of crashes and fatalities at grade crossings with devices intended to warn of a train’s presence calls into question whether the Section 130 Program is structured to help states continue making progress toward the national goal to reduce fatalities and injuries  An evaluation of the program’s requirements could help determine whether Congress should consider better ways to focus federal funds to address the key factor in crashes—risky driver behavior  An FHWA program evaluation could also help determine whether, for example, states could more strategically target emerging safety problems if changes were made to the types of projects eligible for funding under the Section 130 Program  FRA’s new grade-crossing inspectors are meant to increase the effectiveness of FRA’s rail-safety oversight activities, and accordingly, these FRA inspectors, along with FRA researchers, may be well positioned to help FHWA evaluate potential changes to improve the effectiveness of the Section 130 Program  The Administrator of FHWA, working with FRA, should evaluate the Section 130 Program’s requirements to determine whether they allow states sufficient flexibility to adequately address current and emerging grade-crossing safety issues  As part of this evaluation, FHWA should determine whether statutory changes to the program are necessary to improve its effectiveness  (Recommendation 1) We provided a draft of this report to DOT for review and comment  In written comments, reproduced in appendix II, DOT concurred with our recommendation  DOT also provided technical comments, which we incorporated as appropriate  We are sending copies of this report to the appropriate congressional committees, the Secretary of Transportation, the Administrator of the Federal Highway Administration, and the Administrator of the Federal Railroad Administration  In addition, the report will be available at no charge on GAO’s website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-2834 or flemings@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix III  This report examines (1) what has been the focus of Federal Railroad Administration’s (FRA) grade-crossing-safety research, (2) how states select and implement grade-crossing projects and what railroad- and state-reported data are available from FRA to inform states’ decisions, and (3) the challenges states reported in implementing and assessing projects and the extent to which the Federal Highway Administration (FHWA) assesses the program’s effectiveness  The scope of this work focused on the nation’s more than 128,000 public grade crossings  We did not include private grade crossings, as states can only use Railway- Highway Crossings Program (commonly referred to as the Section 130 Program) funds to improve safety at public grade crossings  While FRA provides safety grants to address rail issues, including for grade-crossing projects, we focused our work on the Section 130 Program because it is the primary source of federal funding directed at grade-crossing-safety improvement  For each objective we reviewed: pertinent statutes and FHWA and FRA regulations and documents; interviewed FHWA and FRA program officials in headquarters; and conducted in-depth interviews with a non- generalizable sample of organizations that included officials from 4 freight and passenger railroads, 12 state agencies from 8 states, 6 FRA regional offices, and 8 FHWA state division offices  We also spoke with representatives from relevant associations and officials from NTSB and Volpe Center  We selected these organizations based on our initial background research, prior work, and input from other stakeholders, among other things  See the paragraph below for additional selection details and table 5 for a complete list of organizations we spoke with  We selected eight states as part of our non-generalizable sample for interviews  These states included Arizona, California, Florida, Illinois, Missouri, New Jersey, North Carolina, and Pennsylvania  The states were selected to include a mix of state experiences based on a variety of factors, including the number of grade crossings and crashes at those crossings, and the amount of Section 130 Program funding they received  Specifically, we selected four states from those in the top 25 percent of all states in terms of their number of grade crossings and the amount of Section 130 Program funds they received  We selected the other four states to include a mix of these factors  We also considered geographical diversity and recommendations from FRA and FHWA officials  Within these eight states, we conducted in-depth interviews with FHWA division staff, FRA regional staff, and state officials  A variety of state agencies administer the Section 130 Program within their state; the state officials we spoke with from our eight selected states worked for agencies such as state departments of transportation, corporation commissions, and public utility commissions  We also spoke with a non-generalizable sample of four railroads: Amtrak, CSX, Norfolk Southern, and Sierra Northern  We selected railroads based on a variety of factors including geographic location and stakeholder recommendations  We also conducted additional work related to each of the objectives  To describe the focus of FRA’s grade-crossing-safety research, we examined FRA research aimed at understanding the causes of grade- crossing crashes and identifying potential improvements and described FRA efforts to test new approaches that could improve safety  We did not assess the quality of FRA’s research, as that was beyond the scope of this engagement  Instead, we described the nature of the research  We also spoke with FRA research and development staff, Volpe researchers, and state partners about this work  To describe how states select and implement grade-crossing projects, and what FRA data are available to inform their decisions, we reviewed an academic study that included a literature review and interviews with state officials to describe how states select Section 130 Program projects  We spoke with the researcher and determined the study to be reliable for the purposes of our reporting objectives  We also spoke with officials from our eight selected states, FHWA division staff, and FRA regional staff, and reviewed the states’ 2017 Section 130 Program reports  As part of this objective, we also assessed the reliability of data reported for all railroads in FRA’s National Highway-Rail Crossing Inventory data as of August 31, 2018  For public grade crossings that were not closed, we examined a selection of fields within the database to identify the frequency of missing data (see table 1), data anomalies (see table 2), relational errors, where two related data fields had values that were incompatible (see table 3), and when the data was last updated (see table 4)  Specifically, we conducted the following electronic tests on the crossing inventory data to determine if they were within reasonable ranges, were internally consistent, and appeared complete: Before conducting our analysis, we filtered the inventory data to only include open, public, at-grade crossings  To understand FRA’s efforts to improve its crossing inventory data, we interviewed FRA regional and headquarters staff and reviewed job descriptions for FRA’s new grade- crossing inspectors  Finally, to determine the challenges states reported in implementing and assessing grade-crossing safety projects and the extent to which FHWA assesses the program’s effectiveness, we reviewed program requirements and state project data and other components from FHWA’s 2016 and 2018 Section 130 Program biennial reports to Congress  We also reviewed FHWA’s summary of fiscal year 2018 program funds provided to states and federal laws and guidance related to implementing projects and measuring performance  We interviewed state DOT officials from the eight selected states and other stakeholders on the challenges states reported in implementing and assessing projects, and FHWA and FRA officials for their perspectives on managing the program, including how FHWA measures performance and assesses program effectiveness  We compared information collected from FHWA and FRA to federal internal-control standards and criteria on program evaluation identified in our previous work  In addition, we reviewed FHWA and FRA documents designed to guide states, such as the Grade Crossing Handbook, the Manual on Uniform Traffic Control Devices, the Action Plan and Project Prioritization Noteworthy Practices Guide, and other related documents  We conducted this performance audit from November 2017 to November 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  Susan A  Fleming, (202) 512-2834, Flemings@gao gov  In addition to the individual named above, Maria Edelstein (Assistant Director); Gary Guggolz (Analyst in Charge); Steven Campbell; Tim Guinane; Ben Licht; Catrin Jones; Delwen Jones; SaraAnn Moessbauer; Malika Rice; Larry Thomas; and Crystal Wesco made key contributions to this report 


Report 2: The national pipeline system consists of more than 2 7 million miles of networked pipelines transporting oil, natural gas, and other hazardous liquids  Hazardous liquid and natural gas pipelines—primarily buried underground in the continental United States—run under remote and open terrain, as well as densely populated areas  These pipelines are of three main types: Hazardous liquid: About 216,000 miles of hazardous liquid pipeline transport crude oil, diesel fuel, gasoline, jet fuel, anhydrous ammonia, and carbon dioxide  Natural gas transmission and storage: About 319,000 miles of pipeline—mostly interstate—transport natural gas from sources to communities  Natural gas distribution: About 2 2 million miles of pipeline—mostly intrastate—transport natural gas from transmission sites to consumers  Figure 1 depicts the network of hazardous liquid and natural gas transmission pipelines in the United States  More than 3,000 pipeline companies operate the nation’s pipeline systems, which can traverse multiple states and the U S  borders with Canada and Mexico  Many pipeline systems are comprised of the pipelines themselves, as well as a variety of facilities, such as storage tanks, compressor stations, and control centers  Most pipeline systems are monitored and moderated through automated ICS or Supervisory Control and Data Acquisition (SCADA) systems using remote sensors, signals, and preprogramed parameters to activate and deactivate valves and pumps to maintain flows within tolerances  Federal agencies and pipeline operators determine the criticality of pipeline systems and their facilities based on their importance to the nation’s energy infrastructure; service to installations critical to national defense; or, if attacked, have the potential to cause mass casualties and significant impact on public drinking water affecting major population centers  Accordingly, those determined to be critical merit increased attention to security  However, as we previously reported, the inherent design and operation of U S  pipeline systems may reduce some potential impacts of lost service  The pipeline sector is generally considered to be resilient and versatile  Historically, pipeline operators have been able to quickly respond to the adverse consequences of an incident—whether it is damage from a major hurricane or a backhoe—and quickly restore pipeline service  Pipeline infrastructure also includes redundancies such as parallel pipelines or interconnections that enable operators to reroute material through the network  Figure 2 depicts the U S  pipeline system, its basic components, examples of vulnerabilities, and the entities to which it supplies energy and raw materials  These entities include utility companies, airports, military sites, and industrial and manufacturing facilities  According to TSA, pipelines are vulnerable to physical attacks—including the use of firearms or explosives—largely due to their stationary nature, the volatility of transported products, and the dispersed nature of pipeline networks spanning urban and outlying areas  The nature of the transported commodity and the potential effect of an attack on national security, commerce, and public health make some pipelines and their assets more attractive targets for attack  Oil and gas pipelines have been and continue to be targeted by terrorists and other malicious groups globally  Terrorists have also targeted U S  pipelines, but have not succeeded in attacking them  Further, environmental activists and lone actors seeking to halt the construction of new pipelines through sabotage have recently emerged as a new threat to pipelines  For example, in March 2017, activists used blowtorches to cut holes in empty portions of the Dakota Access Pipeline in two states  In February 2017, local law enforcement officers fatally shot a man who used an assault rifle to damage the Sabal Trail Pipeline, a natural gas pipeline under construction in Florida  The sophisticated computer systems that pipeline operations rely on are also vulnerable to various cyber threats  According to DOE, the frequency, scale, and sophistication of cyber threats have increased, and attacks have become easier to launch  NCCIC reported that the energy sector, which includes pipelines, experienced more cyber incidents than any sector from 2013 to 2015, accounting for 35 percent of the 796 incidents reported by all critical infrastructure sectors  In 2016, NCCIC reported that the energy sector was the third most frequently attacked sector  Further, according to DOE, the cost of preventing and responding to cyber incidents in the energy sector is straining the ability of companies to adequately protect their critical cyber systems  For example, a 2015 study by the Ponemon Institute estimated the annualized cost of cyber crime for an average energy company to be about $28 million  Ineffective protection of cyber assets from these threats can increase the likelihood of security incidents and cyber attacks that disrupt critical operations; lead to inappropriate access to and disclosure, modification, or destruction of sensitive information; and threaten national security, economic well-being, and public health and safety  Unintentional or nonadversarial threat sources may include failures in equipment or software due to aging, resource depletion, and errors made by end users  They also include natural disasters and failures of critical infrastructure on which the organization depends, but that are outside of the control of the organization  Intentional or adversarial threats may include corrupt employees, criminal groups, terrorists, and nations that seek to leverage the organization’s dependence on cyber resources (i e , information in electronic form, information and communications technologies, and the communications and information-handling capabilities provided by those technologies)  These threat adversaries vary in terms of their capabilities, their willingness to act, and their motives, which can include seeking monetary gain or seeking an economic, political, or military advantage  Cyber threat adversaries make use of various techniques, tactics, practices, and exploits to adversely affect an organization’s computers, software, or networks, or to intercept or steal valuable or sensitive information  For example, an attacker could infiltrate a pipeline’s operational systems via the internet or other communication pathways to potentially disrupt its service and cause spills, releases, explosions, or fires  Moreover, ICS, which were once largely isolated from the Internet and the company’s information technology systems, are increasingly connected in modern energy systems, allowing cyber attacks to originate in business systems and migrate to operational systems  For example, malicious nation-state actors used spear-phishing and other similar approaches in 2018 against energy sector organizations to gain access to their business systems, conduct reconnaissance, and collect information about their ICS  Similarly, in April 2012, the Industrial Control Systems Cyber Emergency Response Team reported that an unidentified cyber attacker had conducted a series of cyber intrusions into U S  natural gas pipeline systems beginning in December 2011  Federal policy and public-private plans establish roles and responsibilities for the protection of critical infrastructure, including pipelines  These include Presidential Policy Directive 21 (PPD-21), the NIPP, and Executive Order 13636  PPD-21, issued in February 2013, reflects an all- hazards approach to protecting critical infrastructure, including natural disasters, terrorism, and cyber incidents  The directive also identifies the 16 critical infrastructure sectors and assigns roles and responsibilities for each critical infrastructure sector among nine designated federal sector-specific agencies  While PPD-21 identified the critical infrastructure sectors and assigned responsibility for each sector’s sector-specific agency, the NIPP outlines critical infrastructure stakeholder roles and responsibilities regarding critical security and resilience  It describes a voluntary partnership model as the primary means of coordinating government and private sector efforts to protect critical infrastructure  As part of the partnership structure, the designated sector-specific agencies serve as the lead coordinators for security programs of their respective sector  As sector-specific agencies, federal departments or agencies lead, facilitate, or support the security and resilience programs and associated activities of their designated critical infrastructure sector  For example, DHS and DOT are both designated as sector-specific agencies for the transportation systems sector, which includes pipelines  Each sector also has a government coordinating council, consisting of representatives from various levels of government, and many have a sector coordinating council (SCC) consisting of owner-operators of these critical assets or members of their respective trade associations  For example, the Transportation Government Coordinating Council has been established, and the Pipeline Modal SCC has been established to represent pipeline operators  The NIPP also outlines a risk management framework for critical infrastructure protection  As shown in Figure 3, the NIPP uses a risk management framework as a planning methodology intended to inform how decision makers take actions to manage risk  The risk management framework calls for public and private critical infrastructure partners to conduct risk assessments to understand the most likely and severe incidents that could affect their operations and communities, and use this information to support planning and resource allocation  According to DHS, the risk management framework is influenced by the nature and magnitude of a threat, the vulnerabilities to that threat, and the consequences that could result, as shown in Figure 4  Federal policy has encouraged voluntary information-sharing mechanisms between the federal government and critical infrastructure owners and operators  For example, Information Sharing and Analysis Centers (ISAC) are formed by critical infrastructure owners and operators to gather, analyze, appropriately sanitize, and disseminate intelligence and information related to critical infrastructure  They typically collect, analyze and disseminate actionable threat information to their members and provide members with tools to mitigate risks and enhance resiliency  ISACs in which pipeline operators may participate have been formed including the Oil and Natural Gas ISAC, Downstream Natural Gas ISAC, and Electricity ISAC  Finally, in February 2013, the president issued Executive Order 13636, Improving Critical Infrastructure Cybersecurity, which cited repeated cyber intrusions into critical infrastructure as demonstrating the need for improved cybersecurity  Executive Order 13636 outlined actions for improving critical infrastructure cybersecurity, including direction for the National Institute of Standards and Technology (NIST) to lead the development of a voluntary risk-based cybersecurity framework that would comprise a set of industry standards and best practices to help organizations manage cybersecurity risks  NIST issued the framework in 2014 and updated it in April 2018  The order also addressed the need to improve cybersecurity information sharing and collaboratively develop risk-based standards and stated that U S  policy was to increase the volume, timeliness, and quality of cyber threat information shared with private sector entities so that these entities may better protect and defend themselves against cyber threats  Protecting the nation’s pipeline systems is a responsibility shared by both the federal government and private industry  As a result, several federal departments, agencies, and the private sector have significant roles in pipeline physical and cyber-related security  These entities include the following: Transportation Security Administration (TSA)  TSA, within DHS, has primary oversight responsibility for the physical security and cybersecurity of transmission and distribution pipeline systems  Within TSA, the Security Policy and Industry Engagement’s Pipeline Security Branch is charged with overseeing its pipeline security program  Pursuant to its authority, TSA’s Pipeline Security Branch first issued its voluntary Pipeline Security Guidelines in 2011, and released revised guidelines in March 2018  In accordance with the 9/11 Commission Act, TSA’s Pipeline Security Branch identifies the top 100 critical pipeline systems in the nation  To do so, it uses system annual throughput, which is based on the amount of hazardous liquid or natural gas product transported through a pipeline in 1 year (i e , annual throughput)  TSA also ranks the relative risk among the top 100 critical pipeline systems, discussed later in the report  Additionally, TSA’s Pipeline Security Branch is responsible for conducting voluntary Corporate Security Reviews (CSR) and Critical Facility Security Reviews (CFSR), which assess the extent to which the 100 most critical pipeline systems are following the intent of TSA’s Pipeline Security Guidelines  See figure 5 below for an overview of the CSR and CFSR processes  In addition, TSA Intelligence and Analysis is responsible for collecting and analyzing threat information related to the transportation network, and sharing relevant threat information to pipeline stakeholders  National Cybersecurity and Communications Integration Center (NCCIC)  Within DHS, NCCIC assists critical infrastructure owners in addressing cyber incidents and attacks, including those targeting industrial control systems  The NCCIC’s mission is to reduce the likelihood and severity of incidents that may significantly compromise the security and resilience of the nation’s critical information technology and communications networks  NCCIC’s role is to serve as the federal civilian interface for sharing information related to cybersecurity risks, incidents, analysis, and warnings with federal and nonfederal entities, and to provide shared situational awareness to enable real-time actions to address cybersecurity risks and incidents to federal and nonfederal entities  Pipeline and Hazardous Materials Safety Administration (PHMSA)  PHMSA, within DOT, is responsible for regulating the safety of hazardous materials transportation and the safety of pipeline systems, some aspects of which can be related to pipeline security  In 2004, PHMSA and TSA entered into a memorandum of understanding regarding their respective roles in all modes of transportation  In 2006, they signed an annex to the memorandum of understanding that further delineates lines of authority and responsibility between TSA and PHMSA on pipeline and hazardous materials transportation security  The annex identifies TSA as the lead federal entity for transportation security, including hazardous materials and pipeline security, and PHMSA as responsible for administering a national program of safety in natural gas and hazardous liquid pipeline transportation, including identifying pipeline safety concerns and developing uniform safety standards  Department of Energy (DOE)  DOE is responsible for protecting electric power, oil, and natural gas delivery infrastructure and, in December 2015, was identified in statute as the sector-specific agency for cybersecurity for the energy sector  The Office of Cybersecurity, Energy Security, and Emergency Response is the lead for DOE’s cybersecurity efforts  In addition, DOE operates the National SCADA Test Bed Program, a partnership with Idaho National Laboratory, Sandia National Laboratories, and other national laboratories which addresses control system security challenges in the energy sector  Among its key functions, the program performs control systems testing, research, and development; control systems requirements development; and industry outreach  Federal Energy Regulatory Commission (FERC)  FERC regulates the U S  bulk electric power system, which is increasingly powered by natural gas pipeline systems  FERC has regulatory authority over interstate natural gas pipelines under the Natural Gas Act  However, its role is limited to natural gas pipeline siting and rate regulation  The North American Electric Reliability Corporation is the federally designated U S  Electric Reliability Organization, and is overseen by FERC  The North American Electric Reliability Corporation, with approval from FERC, has developed mandatory critical infrastructure protection standards for protecting electric utility–critical and cyber-critical assets  Private sector  Although TSA has primary federal responsibility for overseeing interstate pipeline security, private sector pipeline operators are responsible for implementing asset-specific protective security measures  As we previously reported, operators have increased their attention on security by incorporating security practices and programs into their overall business operations  Pipeline operators’ interests and concerns are primarily represented by five major trade associations with ties to the pipeline industry—the Interstate Natural Gas Association of America (INGAA), American Gas Association (AGA), American Public Gas Association, American Petroleum Institute (API), and Association of Oil Pipe Lines  According to TSA officials, pipeline operators, and association representatives, these associations have worked closely with the federal government on a variety of pipeline security-related issues, including collaborating on TSA’s voluntary standards and information sharing  All of the pipeline operators and pipeline association representatives we interviewed reported receiving security information from federal and nonfederal entities  Pipeline operators also reported providing security- related information to federal agencies, including TSA, as incidents occur  Multiple federal entities exchange alerts of physical and cybersecurity incidents and other risk-related information with critical infrastructure partners, including pipeline operators  For example, DHS components including TSA’s Intelligence and Analysis and NCCIC share security- related information on physical and cyber threats and incidents with sector stakeholders  Specifically, Intelligence and Analysis provides quarterly intelligence briefings to pipeline operators  NCCIC also issues indicator bulletins, which can contain information related to cyber threat indicators, defensive measures, and cybersecurity risks and incidents  In addition, TSA and other federal entities have coordinated to address specific pipeline-related security incidents  For example, TSA officials coordinated with DOT, DOE, the Department of Justice, and FERC through the Oil and Natural Gas subsector SCC to address ongoing incidents of vandalism and sabotage of critical pipeline assets by environmental activists in 2016  In July 2017, according to DOT officials, PHMSA and TSA collaborated on a web-based portal to facilitate sharing sensitive but unclassified incident information among federal agencies with pipeline-related responsibilities  See table 1 for the key federal information sharing entities and programs that exchange security-related or incident information with critical infrastructure stakeholders, including the pipeline sector  Pipeline operators also share security-related information with TSA and the NCCIC  In its Pipeline Security Guidelines, TSA requests that pipeline operators report by telephone or email to its Transportation Security Operations Center (TSOC) any physical security incidents that are indicative of a deliberate attempt to disrupt pipeline operations or activities that could be considered precursors to such an attempt  TSA’s Pipeline Security Guidelines also request that operators report any actual or suspected cyber attacks that could impact pipeline industrial control systems or other information technology-based systems to the NCCIC  According to the TSOC’s operating procedures, if a reported incident meets certain criteria, such as the incident was intended to or resulted in damage or requires a general evacuation of a facility, the TSOC watch officer is then to contact Office of Security and Industry Engagement officials  According to TSA officials, the TSOC does not conduct investigations of the specific security incidents that pipeline operators report  However, TSOC staff do analyze the incident information they receive for national trends and common threats  TSA officials stated that they share their observations with pipeline operators and other critical infrastructure asset owners during monthly and quarterly conference calls that TSA holds with pipeline operators  All the pipeline operators and association representatives we interviewed identified other nonfederal information sharing entities, including ISACs, fusion centers, industry associations, and SCCs, which provide forums for exchanging information about physical and cyber incidents throughout the pipeline sector  See table 2 for nonfederal information sharing entities identified as available to pipeline operators  Operators and TSA officials reported that the current backlog in granting security clearances for some key pipeline operator employees was a significant factor affecting information sharing between TSA and pipeline operators  TSA officials acknowledged that some pipeline operators have had difficulty obtaining security clearances for key employees due to ongoing backlogs in processing requests by the Office of Personnel Management National Background Investigation Bureau, and that TSA’s ability to share timely information with operators whose staff do not have a clearance may be hindered  Three of the 10 pipeline operators we interviewed identified receiving timely classified security information as a specific challenge due, in part, to difficulties staff have had obtaining security clearances  Further, 7 of the 10 pipeline operators that we interviewed reported experiencing delays in obtaining a security clearance or were aware of others who had experienced this issue  However, according to three operators we interviewed, TSA was helpful in facilitating approval of security clearances for the operators’ personnel to access classified information when necessary  This security clearance challenge is not faced by pipeline operators alone  In January 2018, we designated the backlog of investigations for the clearance process and the government-wide personnel security clearance process as a high-risk area  We will continue to monitor agencies’ progress in reducing the backlog and improving the security clearance process  Pipeline operators that we interviewed reported using a range of guidelines and standards to address their physical and cybersecurity risks, and all of them reported implementing TSA’s voluntary Pipeline Security Guidelines that were applicable to their operations  TSA revised and issued its Pipeline Security Guidelines in March 2018, but the revised guidelines lack a defined process to consider updates to supporting guidance such as to the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework)  Furthermore, TSA has not clearly defined the terms within the criteria that pipeline operators are to use to determine the criticality of their facilities  Pipeline operators that we interviewed reported using a range of guidelines and standards to address their physical and cybersecurity risks  For example, all 10 of the pipeline operators we interviewed stated they had implemented the voluntary 2011 TSA Pipeline Security Guidelines the operators determined to be applicable to their operations  The guidelines provide TSA’s recommendations for pipeline industry security practices such as establishing a corporate security program and identifying critical facilities among others (see sidebar)  Five of the 10 pipeline operators we interviewed characterized the guidelines as generally or somewhat effective in helping to secure their operations, 1 was neutral on their effectiveness, and 4 did not provide an assessment of the guidelines’ effectiveness  However, one operator pointed out that they had not adopted the guidelines’ recommended interval of 36 months or less for conducting security vulnerability assessments due to staffing limitations  Also, another pipeline operator noted that they were working to implement the guidelines in the operations of a newly acquired asset that they determined was not using the guidelines in the same manner as their company  All of the pipeline operators we interviewed reported using other guidelines or standards to address pipeline systems’ security risks  For example, pipeline operators reported using and industry association representatives reported that their members use INGAA’s Control Systems Cyber Security Guidelines for the Natural Gas Pipeline Industry, API’s Pipeline SCADA Security standard, and the NIST Cybersecurity Framework as sources of cybersecurity standards, guidelines, and practices that may be scaled and applied to address a pipeline operator’s cybersecurity risks  Further, pipeline operators are required to adhere to regulations related to pipeline safety and, depending upon their assets, operations, and location, may be required to adhere to regulations for electrical utilities, chemical storage facilities, and locations near waterways  For example, all pipeline operators must adhere to DOT’s PHMSA safety regulations  In addition, pipeline operators whose systems include chemical facilities may be required to comply with DHS’s Chemical Facility Anti-Terrorism Standards (CFATS)  Pipeline operators whose systems include a terminal located on a U S  port may be required to comply with Maritime Transportation Security Act regulations  For a listing of federal and industry guidelines identified as applicable to security by the pipeline operators, see appendix I  TSA’s Pipeline Security Branch issued its revised Pipeline Security Guidelines in March 2018, but TSA has not established a documented process to ensure that revisions occur and fully capture updates to supporting standards and guidance  The guidelines were revised to, among other things, reflect the dynamic threat environment and to incorporate cybersecurity principles and practices from the NIST Cybersecurity Framework, which were initially issued in February 2014  To revise the guidelines and incorporate feedback, according to Pipeline Security Branch officials, they incorporated outcomes from pipeline modal threat assessments and best practices from security reviews, and collaborated with pipeline sector stakeholders—including industry associations and other federal agencies with a role in pipeline security  Officials from the industry associations we interviewed confirmed that they provided input to the revised pipeline guidelines, including meeting with and consolidating comments from member pipeline operators  See figure 6 for a timeline of events pertinent to federal pipeline security guidelines  TSA’s Pipeline Security Smart Practice Observations for pipeline operators states that security plans should have a documented process to include security plan reviews and updates on a periodic and an as- needed basis  Standards for Internal Control in the Federal Government states that periodic review of policies, procedures, and related control activities should occur to determine their continued relevance and effectiveness in achieving identified objectives or addressing related risks  The NIPP and NIST also emphasize the need to provide updates on incident response guidance and security procedures, respectively  Moreover, other pipeline industry guidance cited by TSA’s guidelines also has a prescribed interval for review and revision  For example, API reviews its standards at least every 5 years  However, TSA has not instituted a documented process to consider the need to update the Pipeline Security Guidelines on a regular basis  Pipeline Security Branch officials acknowledged the value of having a defined process for reviewing and, if necessary, revising TSA’s Pipeline Security Guidelines at regular defined intervals to ensure it includes, among other things, newly identified best practices and updated industry guidance that are relevant to pipeline operators, such as the elements of the latest version of NIST’s Cybersecurity Framework  For example, TSA’s revisions to its guidelines incorporated some, but not all of the elements of the NIST Cybersecurity Framework version 1  Specifically, to improve incident response, the NIST framework recommends implementing an incident response analysis and feedback function to a security program  However, TSA’s Pipeline Security Guidelines do not include similar steps for pipelines operators to include in their pipeline security programs  Further, because NIST released version 1 1 of the Cybersecurity Framework in April 2018, the guidelines that TSA released in March 2018 do not incorporate cybersecurity elements that NIST added to the latest Cybersecurity Framework such as the Supply Chain Risk Management category  Pipeline Security Branch officials said that they have not instituted a review process on a regular basis because they intended to review and revise TSA’s guidelines on an as-needed basis in response to updated supporting guidance, but could provide no timeline for doing so  Without a documented process defining how frequently Pipeline Security Branch staff are to review and revise its guidelines, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical and cybersecurity, or address the persistent and dynamic security threat environment currently facing the nation’s pipeline system  Under TSA’s Pipeline Security Guidelines, pipeline operators are to self- identify the critical facilities within their system and report their critical facilities to TSA  TSA’s Pipeline Security Branch conducts CFSRs at the critical facilities that pipeline operators have identified  However, our analysis of TSA’s data found that at least 34 of the top 100 critical pipeline systems deemed highest risk indicated that they had no critical facilities  Accordingly, TSA would not conduct a CFSR at any of these systems’ facilities because their operators identified none of them as critical  The fact that pipeline operators of about one third of the highest risk systems identified no critical facilities may be due, in part, to the Pipeline Security Branch not clearly defining the criteria outlined in the Pipeline Security Guidelines that pipeline operators are to use to determine the criticality of their facilities  Three of the 10 operators we interviewed stated that some companies reported to TSA that they had no critical facilities, and may possibly be taking advantage of the guidelines’ lack of clarity  Accordingly, operators that report no critical facilities would avoid TSA’s reviews of their facilities  service or deliverability resulting in a state or local government's inability to provide essential public services and emergency response for an extended period of time; Significantly damage or destroy national intended use of major rivers, lakes, or waterways (e g , public drinking water for large populations or disruption of major commerce or public transportation routes); service or deliverability to a significant number of customers or individuals for an extended period of time; operations for an extended period of time (i e , business critical facilities)  Our review of the eight criteria included in TSA’s Pipeline Security Guidelines (see sidebar) found that no additional examples or clarification are provided to help operators determine criticality  Although we previously noted that 5 of the 10 operators we interviewed generally found TSA’s Guidelines as a whole helpful in addressing pipeline security, more than half of the operators we interviewed identified TSA’s criticality criteria as a specific area for improvement  Specifically, 3 of the 10 pipeline operators that we interviewed stated that TSA had not clearly defined certain terms within the criteria, and 3 additional operators of the 10 reported that additional consultation with TSA was necessary to appropriately apply the criteria and determine their facilities’ criticality  For example, 2 operators told us that individual operators may interpret TSA’s criterion, “cause mass casualties or significant health effect,” differently  One of these operators that we interviewed stated that this criterion could be interpreted either as a specific number of people affected or a sufficient volume to overwhelm a local health department, which could vary depending on the locality  Another operator reported that because TSA’s criteria were not clear, they created their own criteria which helped the operator identify two additional critical facilities  Pipeline Security Branch officials acknowledged there are companies that report having no critical facilities in their pipeline systems  According to Pipeline Security Branch officials, pipeline operators are in the best position to determine which of their facilities are critical, and the companies that have determined that their pipeline systems have no critical facilities also have reported sufficient redundancies to make none of their facilities critical to the continuity of their operations  According to these officials, they have had extensive discussions with pipeline company officials to assess the validity of their criticality determinations, and have closely questioned companies to ensure they have properly applied TSA’s criteria  However, according to TSA’s Pipeline Security Guidelines, operators should use a consistent set of criteria for determining the criticality of their facilities  In addition, Standards for Internal Control in the Federal Government states that management should define objectives clearly to enable the identification of risks  To achieve this, management generally defines objectives in specific and measurable terms and ensures the terms are fully and clearly set forth so they can be easily understood  Pipeline Security Branch officials acknowledged that the criticality definitions in the Pipeline Security Guidelines could be clarified to be more specific  Additionally, an industry association representative reported that the association, in consultation with TSA, has been developing supplementary guidance for its members to clarify certain terms in TSA’s critical facility criteria  As of October 2018 this guidance is still under review at the association and has not been made available to the association’s members  Pipeline Security Branch officials confirmed they worked with the industry association on its supplementary guidance, but also acknowledged that the supplementary guidance may only be distributed to the association’s membership  Without clearly defined criteria for determining pipeline facilities’ criticality, TSA cannot ensure that pipeline operators are applying its guidance uniformly  Further, because TSA selects the pipeline facilities on which to conduct CFSRs based on operators’ determinations, TSA cannot fully ensure that all of the critical facilities across the pipeline sector have been identified using the same criteria, or that their vulnerabilities have been identified and addressed  TSA’s Intelligence and Analysis identifies security risks to pipeline systems through various assessments  Additionally, TSA’s Pipeline Security Branch conducts security reviews to assess pipeline operators’ implementation of TSA’s Pipeline Security Guidelines, but gaps in staffing and lack of a workforce plan may affect its ability to carry out effective reviews  The Pipeline Security Branch also developed a pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems and to prioritize its security reviews of pipeline companies, but shortfalls in its calculations of threat, vulnerability, and consequence may limit its ability to accurately identify pipeline systems with the highest risk  Finally, the pipeline risk assessment has not been peer reviewed to validate the assessment’s data and methodology, which we previously reported as a best practice in risk management  TSA’s Intelligence and Analysis produces assessments related to pipeline security risks, including Pipeline Modal and Cyber Modal Threat Assessments and the Transportation Sector Security Risk Assessment  The Pipeline and Cyber Modal Threat Assessments are issued on a semiannual basis; TSA Intelligence and Analysis may also issue additional situation-based products on emerging threats  The Pipeline Modal and Cyber Modal Threat Assessments evaluate, respectively, physical and cyber threats to pipelines  The pipeline modal threat assessment evaluates terrorist threats to hazardous liquid and natural gas pipelines, and the cyber modal threat assessment evaluates cyber threats to transportation, including pipelines  Both assessments specifically analyze the primary threat actors, their capabilities, and activities—including attacks occurring internationally—as well as other characteristics of threat  The Transportation Sector Security Risk Assessment assesses threat, vulnerability, and consequence for various attack scenarios across the five transportation modes for which TSA is responsible  The scenarios define a type of threat actor—including homegrown violent extremists and transnational extremists, such as al Qaeda and its affiliates—a target, and an attack mode  For example, a scenario might assess the risk of attacks using varying sizes of improvised explosive devices on pipeline system assets  As part of the assessment process, TSA engages with subject matter experts from TSA and industry stakeholder representatives to compile vulnerabilities for each mode, and TSA analyzes both direct and indirect consequences of the various attack scenarios  According to Pipeline Security Branch officials, the assessments produced by TSA’s Intelligence and Analysis provide key information to inform the pipeline security program’s efforts  According to TSA officials, TSA conducts pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews (CFSRs)—to assess pipeline vulnerabilities and industry implementation of TSA’s Pipeline Security Guidelines  However, as shown by Figure 7 below, the number of CSRs and CFSRs completed by TSA has varied during the last five fiscal years, ranging from zero CSRs conducted in fiscal year 2014 to 23 CSRs conducted in fiscal year 2018, as of July 31, 2018  TSA officials reported that staffing limitations have prevented TSA from conducting more reviews  As shown in table 3, TSA Pipeline Security Branch staffing levels (excluding contractor support) have varied significantly over the past 9 years ranging from 14 full-time equivalents (FTEs) in fiscal years 2012 and 2013 to one FTE in fiscal year 2014  They stated that, while contractor support has assisted with conducting CFSRs, there were no contractor personnel providing CSR support from fiscal years 2010 through 2017, but that has now increased to two personnel in fiscal year 2018  TSA prioritizes reviewing and collecting information on the nation’s top 100 critical pipeline systems  According to TSA officials, they would need to conduct 46 CSRs in order to review the top 100 critical pipeline systems  In July 2018, TSA officials stated that TSA’s current target was to assess each pipeline company every 2 to 3 years; this would equate to about 15 to 23 CSRs per year  TSA officials stated that they expect to complete 20 CSRs and 60 CFSRs per fiscal year with Pipeline Security Branch employees and contract support, and have completed 23 CSRs through July 2018 for fiscal year 2018  Given the ever-increasing cybersecurity risks to pipeline systems, ensuring that the Pipeline Security Branch has the required cybersecurity skills to effectively evaluate pipeline systems’ cybersecurity is essential  Pipeline operators we interviewed emphasized the importance of cybersecurity skills among TSA staff  Specifically, 6 of the 10 pipeline operators and 3 of the 5 industry representatives we interviewed reported that the level of cybersecurity expertise among TSA staff and contractors may challenge the Pipeline Security Branch’s ability to fully assess the cybersecurity portions of its security reviews  TSA officials stated that Security Policy and Industry Engagement staff are working with DHS’s National Protection and Programs Directorate to help address cyber- related needs, including identifying specific cybersecurity skills and competencies required for the pipeline security program  The officials were uncertain, however, whether TSA would use contractor support or support from the National Protection and Programs Directorate to provide identified skills and competencies  TSA officials also stated that Security Policy and Industry Engagement staff work with TSA’s human resource professionals to identify critical skills and competencies needed for Pipeline Security Branch personnel, and helps its workforce maintain professional expertise by providing training and education for any identified skill or competency gaps  Our previous work has identified principles that a strategic workforce planning process should follow including developing strategies tailored to address gaps in number, deployment, and alignment of human capital approaches for enabling and sustaining the contributions of all critical skills and competencies  Workforce planning efforts, linked to an agency’s strategic goals and objectives, can enable it to remain aware of and be prepared for its needs, including the size of its workforce, its deployment across the organization, and the knowledge, skills, and abilities needed for it to pursue its mission  Agencies should consider how hiring, training, staff development, performance management, and other human capital strategies can be aligned to eliminate gaps and improve the long-term contribution of skills and competencies identified as important for mission success  TSA has not established a workforce plan for its Security Policy and Industry Engagement or its Pipeline Security Branch that identifies staffing needs and skill sets such as the required level of cybersecurity expertise among TSA staff and contractors  When asked for TSA strategic workforce planning documents used to inform staffing allocations related to the pipeline security program, TSA officials acknowledged they do not have a strategic workforce plan  Rather, according to these officials, TSA determines agency-level staffing allocations through the Planning, Programming, Budgeting and Execution process, which is used to decide policy, strategy, and the development of personnel and capabilities to accomplish anticipated missions  According to TSA officials, when they use this process they look at existing resources and then set priorities based on the TSA Administrator’s needs  However, a strategic workforce plan allows an agency to identify and prepare for its needs, such as the size of its workforce, its deployment across the organization, and the knowledge, skills, and abilities needed to pursue its mission  TSA officials stated that the agency has a detailed allocation plan for strategically aligning resources to screen passengers at TSA-regulated airports, but not for the entire agency  By establishing a strategic workforce plan, TSA can help ensure it has identified the knowledge, skills, and abilities that the future workforce of TSA’s Pipeline Security Branch may need in order to meet its mission of reducing pipeline systems’ vulnerabilities to physical and cybersecurity risks, especially in a dynamic and evolving threat environment  Further, as greater emphasis is placed on cybersecurity, determining the long- term staffing needs of the Pipeline Security Branch will be essential  Furthermore, a workforce plan could enable TSA to determine the number of personnel it needs to meet its stated goals for conducting CSRs and CFSRs  After TSA identifies the top 100 critical pipeline systems based on throughput, the Pipeline Security Branch uses the Pipeline Relative Risk Ranking Tool (risk assessment), which it developed in 2007, to assess various security risks of those systems  We previously reported, in 2010, that the Pipeline Security Branch was the first of TSA’s surface transportation modes to develop a risk assessment model that combined all three components of risk—threat, vulnerability, and consequence—to generate a risk score  The risk assessment generates a risk score for each of the 100 most critical pipeline systems and ranks them according to risk  The risk assessment calculates threat, vulnerability, and consequence for each pipeline system on variables such as the amount of throughput in the pipeline system and the number critical facilities  The risk assessment combines data collected from pipeline operators, as well as other federal agencies, such as the Departments of Transportation and Defense, to generate the risk score  However, the last time the Pipeline Security Branch calculated relative risk among the top 100 critical pipeline systems using the risk assessment was in 2014  Pipeline Security Branch officials told us that they use the pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems, and the standard operating procedures for conducting CSRs state the results of the risk ranking are the primary factor considered when prioritizing corporate security reviews of pipeline companies  According to Pipeline Security Branch officials, the risk assessment has not changed since 2014 because the Pipeline Security Branch is still conducting CSRs based on the 2014 ranking of pipeline systems  As outlined in table 4 below, we identified several factors that likely limit the usefulness of the current risk assessment in calculating threat, vulnerability, and consequence to allow the Pipeline Security Branch to effectively prioritize reviews of pipeline systems  For example, because the risk assessment has not changed since 2014, information on threat may be outdated  Additionally, sources of data and underlying assumption and judgments regarding certain threat and vulnerability inputs to the assessment are not fully documented  For example, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology, making it unclear if cybersecurity is part of the assessment’s threat factor  Further, the risk assessment does not include information that is consistent with the NIPP and other DHS priorities for critical infrastructure risk mitigation, such as information on natural hazards and the ability to measure risk reduction (feedback data)  According to Pipeline Security Branch officials, the risk ranking assessment is not intended to be a fully developed risk model detailing all pipeline factors influencing risk  Rather, officials said they are primarily interested in assessing risk data that impacts security  However, because TSA’s Pipeline Security Program is designed to enhance the security preparedness of the pipeline systems, incorporating additional factors that enhance security into their risk calculation would better align their efforts with PPD-21  For example, PPD-21 calls for agencies to integrate and analyze information to prioritize assets and manage risks to critical infrastructure, as well as anticipate interdependencies and cascading impacts  For a more detailed discussion of the shortfalls we identified, refer to appendix II  In addition to the shortfalls identified above, the risk assessment has not been peer reviewed since its conception in 2007  In our past work, we reported that independent, external peer reviews are a best practice in risk management and that independent expert review panels can provide objective reviews of complex issues  According to the National Research Council of the National Academies, external peer reviews should, among other things, address the structure of the assessment, the types and certainty of the data, and how the assessment is intended to be used  The National Research Council has also recommended that DHS improve its risk analyses for infrastructure protection by validating the assessments and submitting them to independent, external peer review  Other DHS components have implemented our prior recommendations to conduct peer reviews of their risk assessments  For example, in April 2013, we reported on DHS’s management of its Chemical Facility Anti- Terrorism Standards (CFATS) program and found that the approach used to assess risk did not consider all of the elements of consequence, threat, and vulnerability associated with a terrorist attack involving certain chemicals  The Infrastructure Security Compliance Division, which manages the CFATS program conducted a multiyear effort to improve their risk assessment methodology and included commissioning a peer review by the Homeland Security Studies and Analysis Institute, which resulted in multiple recommendations  As part of the implementation of some of the peer review’s recommendations, DHS conducted peer reviews and technical reviews with government organizations and facility owners and operators, and worked with Sandia National Laboratories to verify and validate the CFATS program’s revised risk assessment methodology, which was completed in January 2017  According to Pipeline Security Branch officials, they are considering updates to the risk assessment methodology including changes to the vulnerability and consequence factors  These officials said the risk assessment was previously reviewed within the past 18 months by industry experts and they consider input from several federal partners including DHS, DOT, and the Department of Defense  Officials also said they will consider input from industry experts and federal partners while working on updating the risk assessment  However, most of the proposed changes to the risk assessment methodology officials described are ones that have been deliberated since our last review in 2010  Therefore, an independent, external peer review would provide the opportunity for integration and analysis of additional outside expertise across the critical infrastructure community  While independent, external peer reviews cannot ensure the success of a risk assessment approach, they can increase the probability of success by improving the technical quality of projects and the credibility of the decision-making process  According to the National Research Council of the National Academies, independent, external peer reviews should include validation and verification to ensure that the structure of the risk assessment is both accurate and reliable  Thus, an independent, external peer review would provide better assurance that the Pipeline Security Branch can rank relative risk among pipeline systems using the most comprehensive and accurate threat, vulnerability, and consequence information  TSA has established performance measures, as well as databases to monitor pipeline security reviews and analyze their results  However, weaknesses in its performance measures and its efforts to record pipeline security review recommendations limit its ability to determine the extent that its pipeline security program has reduced pipeline sector risks  Furthermore, we identified data reliability issues in the information that TSA collects to track the status of pipeline security review recommendations, such as missing data, inconsistent data entry formats, and data entry errors  TSA has three sets of performance measures for its pipeline efforts: the Pipeline Security Plan in the 2018 Biennial National Strategy for Transportation Security (NSTS), a management measure in the DHS fiscal year 2019 congressional budget justification, and summary figures in their CSR and CFSR databases  As a result of our 2010 work, TSA established performance measures and linked them to Pipeline Security Plan goals within the Surface Security Plan of the 2018 NSTS  See table 5 below for the 2018 NSTS Pipeline Security Plan performance measures  As shown in table 6 below, DHS also included a management measure in its fiscal year 2019 congressional budget justification to track the annual number of completed pipeline security reviews  Finally, TSA Pipeline Security Branch officials said they use summary figures in the CFSR status database and the CSR goals and priorities database as performance measures  For example, these include the percentage of CFSR recommendations implemented and the average percentage compliance with the guidelines by fiscal year  We previously found that results-oriented organizations set performance goals to clearly define desired program outcomes and develop performance measures that are clearly linked to the performance goals  Performance measures should focus on whether a program has achieved measurable standards toward achieving program goals, and allow agencies to monitor and report program accomplishments on an ongoing basis  Our previous work on performance metrics identified 10 attributes of effective performance  Table 7 identifies each key attribute of effective performance measures along with its definition  We evaluated the current performance measures included in the 2018 NSTS, the DHS fiscal year 2019 congressional budget justification, the CSR goals and priorities database, and the CFSR status database related to TSA’s Pipeline Security Branch  We primarily focused on key attributes which could be applied to individual measures  These include clarity, linkage, measurable targets, objectivity, reliability, and baseline and trend data  Our prior work on performance measurement found that all performance measure attributes are not equal and failure to have a particular attribute does not necessarily indicate that there is a weakness in that area or that the measure is not useful; rather, it may indicate an opportunity for further refinement  Based on our evaluation, the TSA-identified measures do not possess attributes that we have identified as being key to successful performance measures  As a result, TSA cannot fully determine the extent to which the Pipeline Security Branch has achieved desired outcomes, including the effectiveness of its efforts to reduce risks to pipelines  Specifically, many of TSA’s measures cover agency goals and mission, but they generally lack clarity and measurable targets, provide significantly overlapping information, and do not include baseline and trend data  Clarity  The pipeline-related measures in the 2018 NSTS are not clear because they do not describe the methodology used to calculate them, and the names and definitions are not clearly described  For example, NSTS goal 1 includes an objective to conduct training of employees responding to terrorist attacks  The desired outcome is to improve the capability of industry employees to respond and recover from terrorist attacks  However, the performance measure is the percentage of critical pipeline systems implementing the TSA Pipeline Security Guidelines  It is not clear if this measure is specific to the sections of the guidelines related to employee training or overall implementation of the guidelines  The CFSR status database measures include the percentage of recommendations implemented by topic, such as “Site Specific Security Measures,” “Signage,” or “Miscellaneous ” However, the database does not specifically define these topics or explain the methodology for calculating the measures  Unclear measures could be confusing and misleading to users  Core program activities  The pipeline-related measures in the 2018 NSTS cover some of the agency’s core program activities, such as conducting security exercises with the pipeline industry and providing intelligence and information products to the industry  However, the NSTS Pipeline Security Plan measures do not specifically include some core program activities, such as updating the TSA Pipeline Security Guidelines or the results of conducting CSRs and CFSRs in order to collect the information necessary for the existing performance measures  The CSR goals and priorities database and the CFSR status database include measures intended to track some of the results of pipeline security reviews, such as the average percentage compliance with the guidelines by fiscal year and the percentage of CFSR recommendations implemented  If core program activities are not covered, there may not be enough information available in those areas to managers and stakeholders  Limited overlap  The pipeline-related measures in the 2018 NSTS do not have limited overlap  As discussed previously, four of the five NSTS measures are based on the percentage of critical pipeline systems implementing TSA’s Pipeline Security Guidelines  The management measure is based on the number of complete pipeline security reviews  The CFSR status database measures are based on the percentage of recommendations implemented overall and by groups  Finally, the CSR goals and priorities database measures are based on the average compliance percentage of companies that had CSRs conducted in fiscal years 2016 and 2017  This is similar to four of the five NSTS measures  Significantly overlapping measures may lead to redundant, costly information that does not add value for TSA management  Linkage  The pipeline-related measures in the 2018 NSTS generally exhibited this key attribute  For example, all of the NSTS measures were arranged by agency strategic goals and risk-based priorities  However, the management measure in DHS’s fiscal year 2019 congressional budget justification and the CFSR status database measures did not specify the TSA goals and priorities to which they were aligned  If measures are not aligned with division and agency- wide goals and mission, the behaviors and incentives created by these measures do not support achieving those goals or mission  Measurable target  TSA’s measures generally did not include measurable targets in the form of a numerical goal and none of the NSTS measures had measurable targets  For example, the NSTS measure under the Security Planning priority, which tracks the percentage of critical pipeline systems implementing TSA’s Pipeline Security Guidelines, does not state what specific percentages would be considered an improvement in industry security plans  However, the management measure did include target numbers of pipeline security reviews by fiscal year  Both the CFSR status database measures and CSR goals and priorities database measures did not include measurable targets  Without measurable targets, TSA cannot tell if performance is meeting expectations  Objectivity  Because the pipeline-related measures in the 2018 NSTS, the CFSR status database, and the CSR goals and priorities database generally lack clarity and measurable targets, TSA cannot ensure its measures are free from bias or manipulation, and therefore, are not objective  If measures are not objective, the results of performance assessments may be systematically overstated or understated  Reliability  Because the pipeline-related measures in the 2018 NSTS, the CFSR status database, and the CSR goals and priorities database generally lack clarity, measurable targets, and baseline and trend data, it is not clear if TSA’s measures produce the same result under similar conditions; therefore, the pipeline-related measures are unreliable  If measures are not reliable, reported performance data may be inconsistent and add uncertainty  Baseline and trend data  TSA’s measures generally did not include baseline and trend data  For example, none of the NSTS measures included past results and compared them to measurable targets  TSA officials were unable to identify measures or goals to assess the extent to which pipeline operators have fully implemented the guidelines or increased pipeline security, but did say developing a feedback mechanism to measure progress in closing vulnerability gaps was important  However, the management measure did include the number of completed pipeline security reviews for each fiscal year from 2014 through 2017, as well as numerical goals  The CFSR status database includes information on CFSRs conducted from May 22, 2012, through June 29, 2017, but the measures are calculated for the entire time period rather than year-by-year  The CSR goals and priorities database measures include percentage compliance with the guidelines for CSRs conducted in fiscal years 2016 and 2017, as well as a combined measure  However, baseline and trend data are not tracked or reported in either database  Collecting, tracking, developing, and reporting baseline and trend data allows agencies to better evaluate progress being made and whether or not goals are being achieved  Pipeline Security Branch officials explained that in addition to the measures reported in the 2018 NSTS Pipeline Security Plan, they primarily rely on measures assessing CSR and CFSR implementation for assessing the value of its pipeline security program  TSA officials reported that they collect and analyze data and information collected from CSRs and CFSRs to, among other things, determine strengths and weaknesses at critical pipeline facilities, areas to target for risk reduction strategies, and pipeline industry implementation of the voluntary Pipeline Security Guidelines  For example, TSA officials reported that they analyzed information from approximately 734 CFSR recommendations that were made during fiscal years 2012 through 2016  They found that pipeline operators had made the strongest improvements in security training, public awareness outreach and law enforcement coordination, and site specific security measures  The most common areas in need of improvement were 24x7 monitoring, frequency of security vulnerability assessments, and proper signage  However, as described above, we found those measures also did not comport with key attributes for successful measures and we report below on reliability concerns for underlying data supporting those measures  In addition, while the Pipeline Security Branch may not rely on the measures included in the 2018 NSTS Pipeline Security Plan and the fiscal year 2019 congressional budget justification, they are important for reporting the status of pipeline security efforts to TSA as a whole and to external stakeholders such as Congress  Taking steps to ensure that the pipeline security program performance measures exhibit key attributes of successful performance measures could allow TSA to better assess the program’s effectiveness at reducing pipeline physical and cybersecurity risks  This could include steps such as modifying its suite of measures so they are clear, have measurable targets, and add baseline and trend data  Further examples include the following: Adding measurable targets consisting of numerical goals could allow TSA to better determine if the pipeline security program is meeting expectations  For example, measurable targets could be added to TSA’s existing measures by developing annual goals for the percentage of recommendations implemented to the CFSR status database and then reporting annual results  To make measures clearer, TSA could verify that each measure has a clearly stated name, definition, and methodology for how the measure is calculated  For example, the NSTS objective for security training mentioned above could have more specific language explaining how the measure is calculated and whether it applies to pipeline operators’ implementation of the training-related portions of the TSA Pipeline Security Guidelines or overall implementation  Finally, adding baseline and trend data could allow TSA to identify, monitor, and report changes in performance and help ensure that performance is viewed in context  For example, the NSTS measures, CFSR status database measures, and CSR goals and priorities database measures could have annual results from prior years  This could help TSA and external stakeholders evaluate the effectiveness of the pipeline security program and whether it is making progress toward its goals  According to TSA officials, the primary means for assessing the effectiveness of the agency’s efforts to reduce pipeline security risks is through conducting pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews (CFSRs)  However, TSA has not tracked the status of CSR recommendations for over 5 years and related security review data are not sufficiently reliable  When conducting CSRs and CFSRs, TSA staff makes recommendations to operators, if appropriate  For example, a CSR recommendation might include a suggestion to conduct annual security-related drills and exercises, and a CFSR recommendation might include a suggestion to install barbed wire on the main gate of a pipeline facility  In response to recommendations that we made in our 2010 report, TSA developed three databases to track CSR and CFSR recommendations and their implementation status by pipeline facility, system, operator, and product type  In addition, the agency recently developed a fourth database to collect and analyze information gathered from pipeline operators’ responses to CSR questions  TSA officials reported that they use this database to assess the extent that TSA’s pipeline security program has met NSTS goals and Pipeline Security Branch priorities  TSA officials stated that they use the CSR goals and priorities database for follow-up on recommendations, indications of improvement in pipeline security, and as an input into TSA performance goals and measures, including the performance measures for the 2018 NSTS Pipeline Security Plan  We found several problems with the databases that indicate that the pipeline security program data are not sufficiently reliable and do not provide quality information that is current, complete, and accurate  First, the CSR recommendations database only included information for reviews conducted from November 2010 through February 2013  TSA officials stated that the agency stopped capturing CSR recommendations and status information in 2014  A TSA official stated that one factor was that the pipeline staffing level was one FTE in fiscal year 2014  However, the Pipeline Security Branch did not resume entering CSR recommendation-related information when staffing levels rose to 6 FTEs in the following year and beyond  As a result, TSA is missing over 5 years of data for the recommendations it made to pipeline operators when conducting CSRs  The agency collected some information from CSRs conducted in fiscal years 2016 and 2017 in the separate CSR goals and priorities database  However, this database does not include all of the information that TSA collects when conducting CSRs  Specifically, the CSR goals and priorities database does not state which companies were reviewed, what specific recommendations were made, or the current status of those recommendations, and only records operators’ responses to 79 of the 222 CSR questions  Second, our review identified instances of missing data, inconsistent data entry formats, and data entry errors in the four databases  For example: The CSR recommendations database had missing data in all 13 of the included fields and a data entry error shifted 50 observations into the wrong fields, impacting both the Status Date and Completion Code fields  The CSR goals and priorities database had seven entries with inconsistent data formatting and five of those entries were not taken into account when calculating summary figures  The CFSR recommendations database had missing data in 3 of 9 fields  There was also inconsistent data entry formats in 3 fields  The CFSR status database had missing data in 7 of 29 fields and inconsistent data entry formats in 4 fields  Finally, TSA has not documented its data entry and verification procedures, such as in a data dictionary or user manual, and does not have electronic safeguards for out-of-range or inconsistent entries for any of the databases it uses to track the status of CSR or CFSR recommendations and analyze operator responses to the CSR  TSA Pipeline Security Branch officials told us that they had not documented data entry and verification procedures and did not have electronic safeguards  This was for two reasons  First, the officials stated that the databases are small and maintained in a commercial spreadsheet program that does not allow for electronic safeguards  However, based on our review of the databases, the spreadsheet program does allow for a variety of electronic safeguards  For example, entries can be restricted to only allow selections from a drop-down list or only allow dates to be entered  Second, only a small number of TSA employees enter information into these databases  TSA officials explained that typically one TSA employee is responsible for entering information from pipeline security reviews, and another individual, usually whoever conducted the review, is tasked to verify the accuracy of the data entered  As a result, according to the officials, any errors would be self-evident and caught during these TSA employees’ reviews  Our work has emphasized the importance of quality information for management to make informed decisions and evaluate agencies’ performance in achieving key objectives and addressing risks  The Standards for Internal Control in the Federal Government states that management should use quality information to achieve agency objectives, where “quality” means, among other characteristics, current, complete, and accurate  In addition, DHS’s Information Quality Guidelines state that all DHS component agencies should treat information quality as integral to every step of the development of information, including creation, collection, maintenance, and dissemination  The guidelines also state that agencies should substantiate the quality of the information disseminated through documentation or other appropriate means  Without current, complete, and accurate information, it is difficult for TSA to evaluate the performance of the pipeline security program  Until TSA monitors and records the status of these reviews’ recommendations, it will be hindered in its efforts to determine whether its recommendations are leading to significant reduction in risk  By entering information on CSR recommendations and monitoring and recording their status, developing written documentation of its data entry and verification procedures and electronic safeguards, and improving the quality of its pipeline security program data, TSA could better ensure it has the information necessary to effectively monitor pipeline operators’ progress in improving their security posture, and evaluate its pipeline security program’s effectiveness in reducing security risks to pipelines  A successful pipeline attack could have dire consequences on public health and safety, as well as the U S  economy  Recent coordinated campaigns by environmental activists to disrupt pipeline operations, and the successful attempts by nation-state actors to infiltrate and obtain sensitive information from pipeline operators’ business and operating systems, demonstrate the dynamic and continuous threat to the security of our nation’s pipeline network  To help ensure the safety of our pipelines throughout the nation, it is important for TSA to address weaknesses in the management of its pipeline security program  TSA’s Pipeline Security Branch revised its security guidelines in March 2018 to, among other things, reflect the dynamic threat environment and incorporate NIST’s Cybersecurity Framework cybersecurity principles and practices  However, without a documented process defining how frequently TSA is to review and, if deemed necessary, revise its guidelines, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical and cybersecurity, or address the persistent and dynamic security threat environment currently facing the nation’s pipeline system  Further, without clearly defined criteria for determining pipeline facilities’ criticality, TSA cannot ensure that pipeline operators are applying guidance uniformly and that all of the critical facilities across the pipeline sector have been identified; or that their vulnerabilities have been identified and addressed  TSA could improve its ability to conduct pipeline security reviews and the means that it uses to prioritize which pipeline systems to review based on their relative risk ranking  Establishing a strategic workforce plan could help TSA ensure that it has identified the necessary skills, competencies, and staffing allocations that the Pipeline Security Branch needs to carry out its responsibilities, including conducting security reviews of critical pipeline companies and facilities, as well as their cybersecurity posture  Better considering threat, vulnerability, and consequence elements in its risk assessment and incorporating an independent, external peer review in its process would provide more assurance that the Pipeline Security Branch ranks relative risk among pipeline systems using comprehensive and accurate data and methods  We are making 10 recommendations to TSA: The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to implement a documented process for reviewing, and if deemed necessary, for revising TSA’s Pipeline Security Guidelines at regular defined intervals  (Recommendation 1) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to clarify TSA’s Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities  (Recommendation 2) The TSA Administrator should develop a strategic workforce plan for its Security Policy and Industry Engagement’s Surface Division, which could include determining the number of personnel necessary to meet the goals set for its Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs  (Recommendation 3) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to update the Pipeline Relative Risk Ranking Tool to include up-to-date data to ensure it reflects industry conditions, including throughput and threat data  (Recommendation 4) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to fully document the data sources, underlying assumptions and judgments that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment  (Recommendation 5) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies  (Recommendation 6) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach  (Recommendation 7) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to ensure that it has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, and baseline and trend data  (Recommendation 8) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to take steps to enter information on CSR recommendations and monitor and record their status  (Recommendation 9) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to improve the quality of its pipeline security program data by developing written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors  (Recommendation 10) We provided a draft of this report to DHS, DOE, DOT, and FERC  DHS provided written comments which are reproduced in appendix III  In its comments, DHS concurred with our recommendations and described actions planned to address them  DHS, DOE, DOT, FERC, also provided technical comments, which we incorporated as appropriate  We also provided draft excerpts of this product to the American Petroleum Institute (API), the Association of Oil Pipe Lines, the American Gas Association (AGA), the Interstate Natural Gas Association of America (INGAA), the American Public Gas Association, and the selected pipeline operators that we interviewed  For those who provided technical comments, we incorporated them as appropriate  With regard to our first recommendation, that TSA implement a documented process for reviewing, and if deemed necessary, for revising its Pipeline Security Guidelines at regular defined intervals, DHS stated that TSA will implement a documented process for reviewing and revising its Pipeline Security Guidelines at regular defined intervals, as appropriate  DHS estimated that this effort would be completed by March 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our second recommendation, that TSA clarify its Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities, DHS stated that TSA will clarify its Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities  DHS estimated that this effort would be completed by May 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our third recommendation, that TSA develop a strategic workforce plan for its Security Policy and Industry Engagement's Surface Division, DHS stated that TSA will develop a strategic workforce plan for the division, which includes determining the number of personnel necessary to meet the goals set for the Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs  DHS estimated that this effort would be completed by June 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our fourth recommendation, that TSA update the Pipeline Relative Risk Ranking Tool to include up-to-date data in order to ensure it reflects industry conditions, including throughput and threat data, DHS stated that TSA will update the Pipeline Relative Risk Ranking Tool to include up-to-date data in order to ensure it reflects industry conditions, including throughput and threat data  DHS estimated that this effort would be completed by February 28, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our fifth recommendation, that TSA fully document the data sources, underlying assumptions, and judgements that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment, DHS stated that TSA will fully document the data sources, underlying assumptions, and judgements that form the basis of the Pipeline Relative Risk Ranking Tool  According to DHS, this will include sources of uncertainty and any implications for interpreting the results from the assessment  DHS estimated that this effort would be completed by February 28, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our sixth recommendation, that TSA identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, DHS stated that TSA will identify and/or develop other sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities  DHS also stated that TSA will incorporate that data into the Pipeline Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies  DHS estimated that this effort would be completed by June 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our seventh recommendation, that TSA take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach, DHS stated that, after completing enhancements to its risk assessment approach, TSA will take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool  DHS estimated that this effort would be completed by November 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our eighth recommendation, that TSA ensure that the Security Policy and Industry Engagement's Surface Division has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, baseline, and trend data, DHS stated that TSA’s Surface Division’s Pipeline Section will develop both physical and cyber security performance measures, in consultation with pipeline stakeholders, to ensure that it has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, baseline, and trend data  DHS estimated that this effort would be completed by November 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our ninth recommendation, that TSA take steps to enter information on CSR recommendations and monitor and record their status, DHS stated that TSA will enter information on CSR recommendations and monitor and record their status  DHS estimated that this effort would be completed by October 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our tenth recommendation, that TSA take steps to improve the quality of its pipeline security program data by developing written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors, DHS stated that TSA will develop written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors  DHS estimated that this effort would be completed by July 31, 2019  This action, if fully implemented, should address the intent of the recommendation  As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until one day from the report date  At that time, we will send copies to the appropriate congressional committees; the Secretaries of Energy, Homeland Security, and Transportation; the Executive Director of the Federal Energy Regulatory Committee; and other interested parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact Chris Currie at (404) 679-1875 or curriec@gao gov, and Nick Marinos at (202) 512-9342 or marinosn@gao gov  Key contributors to this report are listed in appendix IV  This appendix lists security guidance and guidance-related tools that the pipeline operators and industry association officials we interviewed identified as adopted or available in order to secure their physical and cyber operations  This list should not be considered to include all physical and cybersecurity guidance that may be available or used by all pipeline operators nor do all operators use all guidance listed  The Transportation Security Administration’s (TSA) Pipeline Security Branch developed the Pipeline Relative Risk Ranking Tool (risk assessment) in 2007  The risk assessment calculates threat, vulnerability, and consequence on variables such as the amount of throughput in the pipeline system (consequence input)  Pipeline Security Branch officials told us that they use the pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems, and the standard operating procedures for conducting Corporate Security Reviews (CSR) state the results of the risk ranking are the primary factor considered when prioritizing CSRs of pipeline companies  However, we identified several factors that likely limit the usefulness of the current assessment in calculating threat, vulnerability, and consequence to allow the Pipeline Security Branch to effectively prioritize reviews of pipeline systems  For example, because the risk assessment has not changed since 2014, information on threat may be outdated  Additionally, sources of data and underlying assumption and judgments regarding certain threat and vulnerability inputs to the assessment are not fully documented  For example, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology, making it unclear if cybersecurity is part of the assessment’s threat factor  Further, the risk assessment does not include information that is consistent with the National Infrastructure Protection Plan (NIPP) and other Department of Homeland Security (DHS) priorities for critical infrastructure risk mitigation, such as information on natural hazards and the ability to measure risk reduction (feedback data)  According to Pipeline Security Branch officials, the risk ranking assessment is not intended to be a fully developed risk model detailing all pipeline factors influencing risk  Rather, officials said they are primarily interested in assessing risk data that impacts security  However, because TSA’s Pipeline Security Program is designed to enhance the security preparedness of the pipeline systems, incorporating additional factors that enhance security into their risk calculation of the most critical pipeline systems would better align their efforts with Presidential Policy Directive 21 (PPD-21)  For example, PPD-21 calls for agencies to integrate and analyze information to prioritize assets and manage risks to critical infrastructure, as well as anticipate interdependencies and cascading impacts  Below we present the various shortfalls in the risk assessment—outdated data, limited description of sources and methodology, and opportunities to better align with the NIPP and other DHS priorities for critical infrastructure risk mitigation—in the context of the components that comprise a risk assessment: threat, vulnerability, and consequence  Whereas in 2010 we made recommendations to improve the consequence component in the pipeline relative risk ranking tool, we have currently identified shortfalls that cut across all risk components: threat, vulnerability, and consequence  We identified several shortfalls in the pipeline risk assessment’s calculation of threat  First, while the risk assessment assesses consequence and vulnerability by pipeline system through use of multiple variables, it currently ranks threat for pipeline systems equally  Second, the evolving nature of threats to pipelines may not be reflected, since the risk assessment was last updated in 2014  Third, the threat calculation does not take into account natural hazards  Pipeline Security Branch officials said they currently rank threat equally across pipeline systems because they do not have granular enough threat information to distinguish threat by pipeline  However, ranking threat equally effectively has no effect on the risk calculation for pipeline systems  Further, this judgment is not documented in the risk assessment’s methodology  According to the NIPP, a risk assessment’s methodology must clearly document what information is used and how it is synthesized to generate a risk estimate, including any assumptions and judgments  Additionally, our analysis of the pipeline risk assessment found that it includes at least one field that TSA could use to differentiate threat by pipeline  Specifically, the risk assessment includes a field that accounts for whether a pipeline experienced a previous security threat (including failed attacks), and information provided by Pipeline Security Branch suggests some pipeline systems have experienced such threats  However, the Pipeline Security Branch did not capture these events in the risk assessment’s calculation, which Pipeline Security Branch officials said should be part of the threat calculation, but could not account for why they were not calculated for the systems in the risk assessment  These officials also clarified that incidents such as suspicious photography or vandalism do not constitute an attack to be accounted for in the threat calculation  Documenting such assumptions, judgments, or decisions to exclude information could provide increased transparency to those expected to interpret or use the results  Pipeline Security Branch officials also said that they ranked threat equally because TSA Intelligence and Analysis data show that threats to the oil and natural gas sector have been historically low, and Intelligence and Analysis does not conduct specific threat analysis against individual pipeline systems  However, the Pipeline Security Branch has not updated the risk assessment since June 2014; therefore, the threat information it used to determine threat calculations—and decide to rank threat equally—may be outdated and not reflect the threats to the industry that have emerged in recent years  In fact, pipeline operators we interviewed indicated that the types of threats that concern pipeline operators have evolved  For example, 5 of the 10 operators we interviewed indicated that environmental activists were an increased threat to the pipeline industry because they use sabotage techniques, such as valve turning and cutting in service pipelines with blow torches, against pipelines  Additionally, 6 of 10 pipeline operators we interviewed said cyber attacks from nation-state actors were a primary threat to their industry  Further, when TSA issued its revised Pipeline Security Guidelines in March 2018, it stated that its revisions to the guidelines were made to reflect the ever-changing threat environment in both the physical and cybersecurity realms  However, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology  Recent Pipeline Modal and Cyber Modal Threat Assessments include cyber threats to the pipeline industry, but the description of the pipeline risk assessment’s methodology does not specify what types of threat assessments (sources) are used to calculate its threat score  To better align with the guidance in the NIPP for documenting sources of information when conducting risk assessments, the Pipeline Security Branch should document the information used  Keeping the risk assessment updated with current information, as well as documenting those data sources, could help the Pipeline Security Branch ensure it is using its limited resources to review the pipeline systems with greater risk  Natural Hazard Threats to Pipelines The Transportation Systems Sector, of which pipelines are a part, is critical to the Pacific Northwest, but also at risk from natural hazards, like earthquakes  For example, according to the Department of Homeland Security, an earthquake in the Puget Sound region—which relies on the transportation of crude oil from Alaska—could cripple the ports of Seattle and Tacoma, as well as the Olympic and Williams Pipelines greatly impacting the Pacific Northwest Economic Region  Hurricanes are the most frequent disruptive natural hazard for the oil and natural gas subsector and can cause the shutdown of facilities in an area, even when the facilities themselves are not directly affected by the storms  For example, according to the U S  Energy Information Administration, the flow of petroleum into the New York area via pipeline from the Gulf Coast relies on the ability to move it through major terminals  In August 2017, Hurricane Harvey caused major disruptions to crude oil and petroleum product supply chains, including those to New York Harbor from Houston, Texas via the Colonial Pipeline  Due to the hurricane, decreased supplies of petroleum products available for the pipeline in Houston forced Colonial Pipeline to limit operations temporarily  Finally, another shortfall in the current pipeline risk assessment methodology is that it does not account for natural hazards in its threat calculation, even though DHS’s definition of threat includes natural hazards, and security and resilience of critical infrastructure are often presented in the context of natural hazards  According to the NIPP, threat is a natural or manmade occurrence, individual, entity, or action that has or indicates the potential to harm life, information, operations, the environment, and/or property  As such, along with terrorism, criminal activity and cybersecurity, natural disasters are a key element of DHS’s critical infrastructure security and resilience mission  According to Pipeline Security Branch officials, there is not sufficient historical data available that would indicate a significant impact from natural disasters on specific pipeline systems  However, we identified possible sources of data for the Pipeline Security Branch to consider  For example, a 2016 RAND Corporation study examined national infrastructure systems’ exposure to natural hazards, including pipelines  Additionally, the Federal Emergency Management Agency (FEMA) has collaborated with stakeholders to develop the National Risk Index to, among other things, establish a baseline of natural hazards risk for the United States While there may not be historical data of natural hazard impact for every pipeline system, consulting other sources or experts could provide regional data or analysis to build a more comprehensive threat picture to help distinguish threats by pipeline system  According to the NIPP, hazard assessments should rely not only on historical information, but also future predictions about natural hazards to assess the likelihood or frequency of various hazards  We also identified multiple shortfalls in the vulnerability factors used in the risk assessment methodology, such as the potential uncertainty of the number of critical facilities and incorporating a feedback mechanism to calculate overall risk reduction  Other considerations for vulnerability calculations include physical condition of the pipeline system, cybersecurity activities, and interdependencies among sectors  The number of critical facilities a pipeline system has identified is used as an input for its vulnerability calculation in the Pipeline Security Branch’s risk assessment methodology  As discussed earlier, we identified deficiencies in TSA’s criteria for identifying critical facilities, and found that well-defined criteria and consistent application of the criteria for identifying critical facilities could improve the results of the Pipeline Security Branch’s risk assessment  Nevertheless, communicating in the risk assessment the uncertainty that may be inherent in this self-reported information would better align the risk assessment with the NIPP  Measuring Effectiveness in a Voluntary Environment According to the National Infrastructure Protection Plan, the use of performance metrics is an important step in the critical infrastructure risk management process to enable assessment of improvements in critical infrastructure security and resilience  The metrics provide a basis for the critical infrastructure community to establish accountability, document actual performance, promote effective management, and provide a feedback mechanism to inform decision making  By using metrics to evaluate the effectiveness of voluntary partnership efforts to achieve national and sector priorities, critical infrastructure partners can adjust and adapt their security and resilience approaches to account for progress achieved, as well as changes in the threat and other relevant environments  Metrics are used to focus attention on areas of security and resilience that warrant additional resources or other changes through an analysis of challenges and priorities at the national, sector, and owner/operator levels  Metrics also serve as a feedback mechanism for other aspects of the critical infrastructure risk management approach  Another shortfall in the risk assessment is its inability to reliably measure the progress a pipeline system made in addressing vulnerability gaps between security reviews  The current risk assessment includes a CSR score as part of its vulnerability calculation, which was developed in part in response to our 2010 recommendation to use more reliable data to measure a pipeline system’s vulnerability gap  However, during our review, Pipeline Security Branch officials said they plan to remove pipeline companies’ CSR scores from the risk assessment calculations, because they and industry partners do not have confidence that the score appropriately measures a pipeline system’s vulnerability  For example, Pipeline Security Branch officials explained that pipeline companies consider security factors differently, which can lead to variation in implementing risk reduction activities and by extension lead to different CSR scores  However, removing the CSR score eliminates the only feedback mechanism in the risk assessment from a pipeline company’s actual security review conducted by the Pipeline Security Branch  The NIPP and DHS’s Risk Management fundamentals emphasize the important role that such feedback mechanisms play in risk management  Officials from the Pipeline Security Branch agree on the importance of a feedback mechanism tying results of reviews to a revised vulnerability metric, but said they need a better measure than the current CSR score which is unreliable for comparative and analytic purposes  Developing a feedback mechanism based on implementation of TSA’s Pipeline Security Guidelines could be an important input to the risk assessment’s vulnerability calculation  This information would also inform the amount of risk pipeline companies are reducing by implementing the guidelines and could be used to inform overall risk reduction  The physical and cyber environments in which the pipeline sector operates also present vulnerabilities not accounted for in the pipeline risk assessment  In recent years, DHS has listed the potential for catastrophic losses to dramatically increase the overall risk associated with failing infrastructure and highlighted risks due to climate change and natural hazards to pipelines  For example, DHS reported extreme temperatures—such as higher and lower temperatures over prolonged periods of time—increase vulnerability to the critical infrastructure by causing elements to break and cease to function  Pipelines that freeze and then rupture can affect the energy and transportation systems sectors  As noted above, according to the NIPP, a natural or man-made occurrence or action with the potential to harm life is considered a threat, whereas vulnerability is defined as a physical feature or operational attribute that renders an entity open to exploitation or susceptible to a given threat or hazard  While pipeline physical condition is typically thought of in context of safety, pipeline condition or location (such as above or below ground) could touch upon pipeline security as it relates to system vulnerability  For example, a pipeline system or segment of a system with a compromised physical condition due to corrosion or age could affect the system’s vulnerability to threats and affect its ability to recover from such threats by potentially increasing the time a system is offline  According to the Transportation Systems Sector-Specific Plan, vulnerabilities to damage in aging transportation infrastructure—of which pipelines are a part—are projected to increase with the continued effects of climate change  Further, according to TSA’s Pipeline Security and Incident Recovery Protocol Plan, pipeline integrity efforts—including the design, construction, operation, and maintenance of pipelines—are important to pipeline security because well-maintained, safe pipelines are more likely to tolerate a physical attack  The Pipeline Security Branch already collects information from the Pipeline and Hazardous Materials Safety Administration (PHMSA) for its risk assessment, specifically information on High Consequence Area and High Threat Urban Area mileage  By considering additional information PHMSA collects on pipeline integrity, the Pipeline Security Branch could also use the information to help pipeline operators identify security measures to help reduce the consequences related to the comparatively higher vulnerability of an aging or compromised system  This would align with the Pipeline Security Branch’s efforts to improve security preparedness of pipeline systems and could better inform its vulnerability calculations for relative risk ranking of pipeline systems  Capturing cybersecurity in the risk assessment is also an area for improvement  Pipeline Security Branch officials told us they consulted with the National Cybersecurity and Communications Integration Center to revise TSA’s Pipeline Security Guidelines to align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and that absent data specific to pipelines on their cybersecurity vulnerabilities, they are unable to include a pipelines’ vulnerability to cyber attack in the risk assessment  However, the Pipeline Security Branch recently updated the security review questions asked of pipeline operators during corporate and critical facility reviews based on the recently updated Pipeline Security Guidelines  Using these updated questions related to companies’ cybersecurity posture, the Pipeline Security Branch could collect additional information on cybersecurity vulnerabilities which could inform the risk assessment  This could be an element of the feedback mechanism described above and emphasized in the NIPP  Additionally, NIST identified several supply chain vulnerabilities associated with cybersecurity, which are not currently accounted for in TSA’s Pipeline Security Guidelines  As pipeline operators implement increasing levels of network technologies to control their systems, the Pipeline Security Branch may not be fully accounting for pipeline systems’ cybersecurity posture by not including the cybersecurity-related vulnerabilities in its risk assessment inputs  Finally, we identified shortfalls in cross-sector interdependencies, which could affect vulnerability calculations  According to the NIPP, understanding and addressing risks from cross-sector dependencies and interdependencies is essential to enhancing critical infrastructure security and resilience  The Pipeline Security Branch’s pipeline risk assessment currently considers the effects of a pipeline system’s ability to service assets such as major airports, the electric grid, and military bases  However, consequence is calculated on the loss or disruption of the pipeline system to these other assets and does not capture the dependency of the pipeline system on other energy sources, such as electricity  Weather events such as Gulf of Mexico hurricanes and Superstorm Sandy highlighted the interdependencies between the pipeline and electrical sectors  Specifically, according to a 2015 DHS annual report on critical infrastructure, power failures during Superstorm Sandy in 2012 closed major pipelines for 4 days, reducing regional oil supplies by 35 to 40 percent  The report goes on to say that the interconnected nature of infrastructure systems can lead to cascading impacts and are increasing in frequency  Pipeline Security Branch officials are considering cross-sector interdependencies and said they discuss these factors with operators as they relate to system resiliency  Considering interdependencies of sectors in both directions—such as calculating the likelihood that an input like electricity could fail and cause disruptions to critical pipelines—could improve the calculations in the pipeline risk assessment  As previously discussed, the Pipeline Security Branch last calculated relative risk among the top 100 pipeline systems in 2014  When doing so, it used pipeline systems’ throughput data from 2010 to assess relative risk  According to Pipeline Security Branch officials, the amount of throughput in pipeline systems does not change substantially year to year  However, Standards for Internal Control in the Federal Government calls for management to use quality information to achieve the entity’s objectives, including using relevant data from reliable sources obtained in a timely manner  The Pipeline Security Branch uses throughput data as a consequence factor in the risk assessment to determine a pipeline system’s relative risk score  Throughput changes could affect relative risk ranking and the Pipeline Security Branch’s ability to accurately prioritize reviews based on relative risk  Chris P  Currie at (404) 679-1875 or curriec@gao gov Nick Marinos at (202) 512-9342 or marinosn@gao gov  In addition to the contacts named above, Ben Atwater, Assistant Director; Michael W  Gilmore, Assistant Director; and Michael C  Lenington, Analyst-in-Charge, managed this assignment  Chuck Bausell, David Blanding, Dominick Dale, Eric Hauswirth, Kenneth A  Johnson, Steve Komadina, Susanna Kuebler, Thomas Lombardi, David Plocher, and Janay Sam made significant contributions to this report 

ground_truth: More than 2.7 million miles of pipeline transport and distribute oil, natural gas, and other hazardous products throughout the United States. Interstate pipelines run through remote areas and highly populated urban areas, and are vulnerable to accidents, operating errors, and malicious physical and cyber-based attack or intrusion. The energy sector accounted for 35 percent of the 796 critical infrastructure cyber incidents reported to DHS from 2013 to 2015. Several federal and private entities have roles in pipeline security. TSA is primarily responsible for the oversight of pipeline physical security and cybersecurity. GAO was asked to review TSA's efforts to assess and enhance pipeline security and cybersecurity. This report examines, among other objectives: (1) the guidance pipeline operators reported using to address security risks and the extent that TSA ensures its guidelines reflect the current threat environment; (2) the extent that TSA has assessed pipeline systems' security risks; and (3) the extent TSA has assessed its effectiveness in reducing pipeline security risks. GAO analyzed TSA documents, such as its Pipeline Security Guidelines ; evaluated TSA pipeline risk assessment efforts; and interviewed TSA officials, 10 U.S. pipeline operators—selected based on volume, geography, and material transported—and representatives from five industry associations. Pipeline operators reported using a range of guidelines and standards to address physical and cybersecurity risks, including the Department of Homeland Security's (DHS) Transportation Security Administration's (TSA) Pipeline Security Guidelines , initially issued in 2011. TSA issued revised guidelines in March 2018 to reflect changes in the threat environment and incorporate most of the principles and practices from the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity . However, TSA's revisions do not include all elements of the current framework and TSA does not have a documented process for reviewing and revising its guidelines on a regular basis. Without such a documented process, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical security and cybersecurity, or address the dynamic security threat environment that pipelines face. Further, GAO found that the guidelines lack clear definitions to ensure that pipeline operators identify their critical facilities. GAO's analysis showed that operators of at least 34 of the nation's top 100 critical pipeline systems (determined by volume of product transported) deemed highest risk had identified no critical facilities. This may be due, in part, to the guidelines not clearly defining the criteria to determine facilities' criticality. To assess pipeline security risks, TSA conducts pipeline security reviews—Corporate Security Reviews and Critical Facility Security Reviews—to assess pipeline systems' vulnerabilities. However, GAO found that the number of TSA security reviews has varied considerably over the last several years, as shown in the table on the following page. TSA officials stated that staffing limitations have prevented TSA from conducting more reviews. Staffing levels for TSA's Pipeline Security Branch have varied significantly since fiscal year 2010 with the number of staff ranging from 14 full-time equivalents in fiscal years 2012 and 2013 to 1 in 2014. Further, TSA does not have a strategic workforce plan to help ensure it identifies the skills and competencies—such as the required level of cybersecurity expertise—necessary to carry out its pipeline security responsibilities. By establishing a strategic workforce plan, TSA can help ensure that it has identified the necessary skills, competencies, and staffing. GAO also identified factors that likely limit the usefulness of TSA's risk assessment methodology for prioritizing pipeline system reviews. Specifically, TSA has not updated its risk assessment methodology since 2014 to reflect current threats to the pipeline industry. Further, its sources of data and underlying assumptions and judgments regarding certain threat and vulnerability inputs are not fully documented. In addition, the risk assessment has not been peer reviewed since its inception in 2007. Taking steps to strengthen its risk assessment, and initiating an independent, external peer review would provide greater assurance that TSA ranks relative risk among pipeline systems using comprehensive and accurate data and methods. TSA has established performance measures to monitor pipeline security review recommendations, analyze their results, and assess effectiveness in reducing risks. However, these measures do not possess key attributes—such as clarity, and having measurable targets—that GAO has found are key to successful performance measures. By taking steps to ensure that its pipeline security program performance measures exhibit these key attributes, TSA could better assess its effectiveness at reducing pipeline systems' security risks. Pipeline Security Branch officials also reported conducting security reviews as the primary means for assessing the effectiveness of TSA's efforts to reduce pipeline security risks. However, TSA has not tracked the status of Corporate Security Review recommendations for the past 5 years. Until TSA monitors and records the status of these reviews' recommendations, it will be hindered in its efforts to determine whether its recommendations are leading to significant reduction in risk. GAO makes 10 recommendations to TSA to improve its pipeline security program management (many are listed on the next page), and DHS concurred. GAO recommends, among other things, that the TSA Administrator take the following actions: implement a documented process for reviewing, and if deemed necessary, for revising TSA's Pipeline Security Guidelines at defined intervals; clarify TSA's Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities; develop a strategic workforce plan for TSA's Security Policy and Industry Engagement‘s Surface Division; update TSA's pipeline risk assessment methodology to include current data to ensure it reflects industry conditions and threats; fully document the data sources, underlying assumptions and judgments that form the basis of TSA's pipeline risk assessment methodology; take steps to coordinate an independent, external peer review of TSA's pipeline risk assessment methodology; ensure the Security Policy and Industry Engagement‘s Surface Division has a suite of performance measures which exhibit key attributes of successful performance measures; and enter information on Corporate Security Review recommendations and monitor and record their status.