prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: Federal and state Medicaid spending on long-term care continues to increase; for example it increased from $146 billion in 2013 to $158 billion in 2015  Individuals seeking long-term care generally need care that is, by definition, longer term in nature and more costly than other types of care  Spending on long-term care services provided in home and community settings, including assisted living facilities, exceeds the amount spent on institutional settings such as nursing homes  State Medicaid programs may cover certain medical and non-medical services that assisted living facilities provide; however, the Medicaid statute does not provide for coverage of room and board charges of an assisted living facility  In their federal-state partnership, both CMS and states play important roles in the oversight of Medicaid  CMS is responsible for oversight of state Medicaid programs  To conduct this oversight, CMS issues program requirements in the form of regulations and guidance, approves changes states make to their programs, provides technical assistance to states, collects and reviews required information and data from states and, in some cases, reviews individual state programs  States are responsible for the day-to-day administration of their Medicaid programs, including monitoring and oversight of the different HCBS programs through which they cover assisted living services, within broad federal rules and requirements  Each state is required to identify and designate a single state agency to administer or supervise the administration of its Medicaid program  The state Medicaid agency may partially or fully delegate the administration and oversight of the state’s HCBS programs to another state agency or other entity, such as a state unit on aging, a mental health department, or other state departments or agencies with jurisdiction over a specific population or service  However, the state Medicaid agency is ultimately accountable to the federal government for compliance with the HCBS requirements  Under different authorizing provisions of federal law, states have considerable flexibility to establish multiple HCBS programs including those covering assisted living services  A state Medicaid program can have multiple HCBS programs operating under different federal authorities  CMS is responsible for ensuring that states meet the requirements associated with their HCBS programs under these different authorities  Key to states’ monitoring of the health and welfare of Medicaid beneficiaries is their tracking of, and response to, incidents that may cause harm to a beneficiary’s health or welfare, such as abuse, neglect, or exploitation—commonly referred to as critical incidents  Such monitoring is required for most HCBS programs; however, we previously found that requirements for states related to oversight of the health and welfare of beneficiaries in different types of HCBS programs varied, and recommended that CMS take steps to harmonize those requirements across programs  The most common HCBS programs with the most stringent federal requirements are HCBS waiver programs  These programs serve beneficiaries who are eligible for an institutional level of care; that is, beneficiaries must have needs that rise to the level of care usually provided in a nursing facility, hospital, or other institution  CMS oversees states’ HCBS waiver programs specifically by reviewing and approving applications and reviewing HCBS program reports that states submit  HCBS waiver program applications include specific requirements implementing various statutory and regulatory provisions  (See text box below ) One requirement is that states have the necessary safeguards in place to protect the health and welfare of beneficiaries receiving services covered by HCBS waiver programs  For each of their HCBS waiver programs, states must demonstrate to CMS that they are meeting various requirements CMS has established regarding beneficiary health and welfare  The Six Requirements States Must Demonstrate for Home- and Community-Based Services Waiver Programs 1  Administrative authority: The Medicaid agency retains ultimate administrative authority and responsibility for the operation of the waiver program by exercising oversight of the performance of waiver functions by other state and local/regional non-state agencies (if appropriate) and contracted entities  2  Level of care: The state demonstrates that it implements the processes and instrument(s) specified in its approved waiver for evaluating/re-evaluating an applicant’s/waiver participant’s level of care consistent with care provided in a hospital, nursing facility, or intermediate care facility  3  Qualified providers: The state demonstrates that it has designed and implemented an adequate system for assuring that all waiver services are provided by qualified providers  4  Service plan: The state demonstrates it has designed and implemented an effective system for reviewing the adequacy of service plans for the waiver participants  5  Health and welfare: The state demonstrates it has designed and implemented an effective system for assuring waiver participant health and welfare  6  Financial accountability: The state must demonstrate that it has designed and implemented an adequate system for insuring financial accountability of the waiver program  CMS also provides ongoing oversight of state HCBS programs through annual reports that states must submit for each of their HCBS waiver programs as well as renewal reports submitted about two years before an HCBS waiver is scheduled to end  The state reports are intended to provide CMS with information on the operation of state HCBS waiver programs  In contrast to long-term care services provided in nursing facilities, less is known at the federal level about the oversight and quality of care in assisted living facilities  Generally, states establish their own licensing and oversight requirements for assisted living facilities  As a result, the requirements for assisted living facilities and the type and frequency of oversight can vary across states  In contrast, nursing homes must meet a comprehensive set of federal requirements in order to receive payment for long-term care services for Medicaid and Medicare beneficiaries in addition to state requirements  CMS contracts with state entities to regularly inspect nursing facilities and investigate complaints to assess whether nursing homes meet these federal quality requirements  Annually CMS publishes a comprehensive report on nursing homes that serve Medicaid and Medicare beneficiaries, including the extent that beneficiaries are at risk for harm, based on these investigations and inspections  In addition, CMS publicly reports a summary of each nursing home’s quality data using a five-star quality rating based on health inspection results, staffing data, and quality measure data  The goal of this rating system is to help consumers make meaningful distinctions among high- and low-performing nursing homes  This type of standardized framework for oversight, investigation and inspections, and reporting on quality of care concerns does not exist for assisted living facilities and other types of HCBS providers  Forty-eight state Medicaid agencies reported collectively spending about $10 billion in state and federal Medicaid funds for assisted living services in 2014, according to our survey  The other 3 states reported that they did not pay for assisted living services  We estimate that this spending for services provided by assisted living facilities represents 12 4 percent of the $80 6 billion Medicaid spent on HCBS in all settings that year  More than 330,000 Medicaid beneficiaries received assisted living services, based on data reported to us by the 48 states  Nationally, the average spending per beneficiary on assisted living services in the 48 states in 2014 was about $30,000; states provided these HCBS services through fee-for-service and managed care delivery models  Fee-for-service spending comprised 81 percent of total spending on assisted living services and managed care spending was about 19 percent of the total  The cost per beneficiary reported by surveyed states also varied based on payment type; average per beneficiary cost was $31,000 for fee-for-service and $27,000 for managed care  About 21 percent of Medicaid assisted living enrollment was for beneficiaries receiving these services under a managed care delivery model  (See table 1 ) Average per-beneficiary spending varied significantly across the states  For example, for the nine states with the lowest spending per beneficiary, average Medicaid spending ranged from about $1,700 to about $9,500 per beneficiary  In contrast, in the nine states with the highest per- beneficiary spending, the average spending ranged from about $43,000 to $108,000 per beneficiary  (See Figure 1 ) For more information on each state’s enrollment, total spending, and average per beneficiary spending on assisted living services, see appendix I  The 48 states that reported covering assisted living services in 2014 said they did so through 132 different programs  The majority of the states, 31 of the 48, reported administering more than one program that covered assisted living services  As illustrated in table 2 below, of the different types of HCBS programs under which states can provide coverage for assisted living services, HCBS waivers were the most common type of program they used  Specifically, 39 states and 69 percent of the programs that provided assisted living services, were operated under the HCBS waiver program  (See appendix II for additional details on each state’s number of programs by program type and total number of HCBS programs that covered assisted living facility services in 2014 ) Almost all of the 48 states that covered assisted living services did so for two groups of Medicaid beneficiaries eligible through their programs  In 45 of 48 states, aged beneficiaries received services provided by assisted living facilities  Similarly, in 43 of 48 states, physically disabled beneficiaries received services  (See Figure 2 ) In 38 or more of the 48 states that covered assisted living services, six types of services were provided  For example, 45 states covered assistance with activities of daily living, such as bathing and dressing; 44 states covered medication administration; and 41 states covered coordination of meals  (See Figure 3 ) State Medicaid agency approaches for oversight of assisted living services varied widely in terms of who provided the oversight for their largest programs, according to their responses to our survey  Thirteen of the 48 state Medicaid agencies reported delegating administrative responsibilities, including oversight of beneficiary health and welfare, to other state or local agencies  State Medicaid agencies may delegate the administration of programs to government or other agencies through a written agreement; however, state Medicaid agencies retain the ultimate oversight responsibility for those delegated functions  For example, among the 13 states that delegated HCBS program administration, the administering agencies were those that provided services to the aged, disabled, or both of these populations, such as the states’ Departments of Aging  (See text box, below, for examples of states’ delegation ) Examples of State Medicaid Agencies’ Delegation of Authority for Administration of Home- and Community-based Services’ Programs Covering Assisted Living Services Georgia’s Elderly & Disabled Waiver Program was operated in 2014 by the Georgia Department of Human Services Division of Aging Services, a separate agency of the state that was not a division/unit of the Medicaid agency  The Georgia Medicaid Agency maintained a formal interagency agreement with the Division of Aging Services which describes by function the required deliverables to support compliance and a schedule for delivery of reports  Nebraska’s Waiver for Aged and Adults and Children with Disabilities is operated by the state Medicaid agency Division of Medicaid and Long Term Care  The majority of services are provided by independent contractors in order to allow service delivery in the rural and frontier areas of the state  The state Medicaid agency contracts with the Area Agencies on Aging, Independent Living Centers, and Early Development Network agencies to perform a variety of operational and administrative functions including authorizing services and monitoring the delivery of services  States also varied in the types of information they reported reviewing as part of the oversight of assisted living services, and the extent to which state Medicaid agencies review the information when another agency is responsible for administration  For example, other entities outside the state Medicaid agency—such as the agency delegated to administer an HCBS program, or a contractor that manages provider enrollment—may check to ensure a provider is allowed to deliver services to Medicaid beneficiaries; in such cases, however, the state Medicaid agency might not be aware of the results of such checks  As illustrated in table 3, in all 48 states the types of information generally reviewed by either the state Medicaid agency, the agency delegated administrative responsibilities, or other agencies were: critical incident reports, the HHS Office of Inspector General’s list of excluded providers, patient service plans, and information on concerns about care received directly from patients, relatives, caregivers or the assisted living facility itself  In many cases, the state Medicaid agency did not review all information sources reviewed by other agencies  For example, although all critical incident reports were reviewed in the 48 states by either the state Medicaid agency, the agency delegated administrative responsibilities, or another agency; in 16 of those states, the state Medicaid agency was not involved in those reviews, according to responses to our survey  Instead, the critical incident reports were reviewed by another entity designated responsible for the HCBS program in the state or another state entity with regulatory responsibility over the assisted living facility  Such reviews, including any critical incidents found, may not have been communicated back to the state Medicaid agency, according to responses to our survey  State Medicaid agencies also varied in reporting the extent to which they were made aware or notified when enforcement actions were taken as a result of concerns with beneficiary care identified by other entities  Various oversight actions may be taken by the state Medicaid agency, the agency delegated to administer an HCBS program, or a state regulatory agency, such as a state agency responsible for licensing and inspecting various types of HCBS providers  When delegated agencies or other licensing agencies take corrective action, the state Medicaid agency may not be aware unless notified by the agencies taking that action  For example, in 23 states, the investigation of potential incidents related to beneficiary health and welfare was delegated to another agency but in only 6 of these states was the state Medicaid agency always notified of such an investigation based on our survey  (See table 4 and text box below ) Example of a Collaborative Approach to Monitoring and Ensuring Quality Care Specifically for Assisted Living Facilities In 2009, the Wisconsin Coalition for Collaborative Excellence in Assisted Living was formed to redesign the way quality is ensured and improved for individuals residing in assisted living communities  This public/private coalition utilizes a collective impact model approach that brings together the state, the industry, the consumer, and academia to identify and implement agreed upon approaches designed to improve the outcomes of individuals living in Wisconsin assisted living communities  The core of the coalition is the implementation of an association developed, department approved, comprehensive quality assurance, quality improvement program  For their largest HCBS programs that covered assisted living services, the 48 states varied in how they monitored “critical incidents” that caused actual or potential harm to Medicaid beneficiaries in assisted living facilities  Specifically, the 48 states varied in their ability to report the number of critical incidents; how they defined incidents, and the extent to which they made information on such incidents readily available to the public  These states varied in whether they could provide us the number of critical incidents involving beneficiaries for their largest programs covering assisted living services, and for those that could report, the number of incidents they reported varied widely  In 26 of the 48 states the Medicaid agencies were unable to report, for their largest program covering assisted living services, the number of critical incidents that had occurred in assisted living facilities in 2014  The remaining 22 states reported a total of 22,921 critical incidents involving Medicaid beneficiaries in their largest programs covering assisted living services  The number of critical incidents reported in these states ranged from 1 to 8,900  For six of these states the number of critical incidents reported was more than 1,000, (See text box, below, for examples of selected state processes managing critical incidents ) Selected States’ Processes for Managing Beneficiary Harm or Potential Harm in Assisted Living Facilities Georgia: According to state officials in 2014 there was no centralized or comprehensive system for capturing and tracking the data on actual and potential violations  State officials acknowledged the lack of a centralized system prevents the Division of Community Health from tracking the status of each problem  Nebraska: According to state officials, Nebraska’s Adult Protective Services operates an electronic system that coordinates across state social service programs  When Adult Protective Services initiates an investigation of reported harm to an assisted living resident, the state Medicaid agency is automatically notified  Reasons state Medicaid agencies reported for being unable to provide us with the number of critical incidents included limitations in the data or data systems for tracking them  Nine states reported an inability to track incidents by provider type, and thus distinguish critical incidents in assisted living facilities from other providers of home and community based services  States also cited lacking a system to collect critical incidents (9 states), and that the system for reporting could not identify whether a resident was a Medicaid beneficiary (5 states)  Even in the 32 states where the state Medicaid agencies reported reviewing information about critical incidents, 20 states were unable to provide the actual number of critical incidents that occurred in assisted living facilities  State Medicaid agencies’ definitions of critical incidents also varied  As illustrated in Figure 4, all 48 states cited physical assault, emotional abuse, and sexual assault or abuse as a critical incident in their largest programs providing assisted living services in 2014  However, for other types of incidents, several states did not identify the incident as critical, including discharge and eviction from the facility (not a critical incident in 24 states), medication errors (not a critical incident in 7 states), and unauthorized use of seclusion, (not a critical incident in 6 states)  For other serious incidents, a relatively small number of states did not identify the incident as critical, such as unexplained death (not a critical incident in 3 states) and missing beneficiaries (not a critical incident in 2 states)  See appendix IV for a full list of the beneficiary-related incidents and the number of states that identify each as critical  Although half of the 48 states that cover assisted living services did not consider discharges or evictions to be critical incidents, according to state responses to our survey, 42 states offered certain protections related to involuntary discharge of Medicaid residents who live in assisted living facilities  The majority of protections consisted of a lease agreement requirement that applied to other housing contracts in the state, such as providing residents with eviction notices  Other protections included an appeals process (10 states) and a requirement for the facility to find an alternative location for the resident (10 states)  State Medicaid agencies also varied in whether they made information on critical incidents and other key information readily available to the public  (See table 5 ) Beneficiaries seeking care in an assisted living facility may want to know the number of critical incidents related to a particular facility  Through our survey we found that states differed in the availability of information related to health and welfare that was available to the public  For example, 34 of the 48 states reported that they made critical incident information available to the public by phone, website, or in person, and the remaining 14 states did not have such information available at all  Although all 48 states had information in some form on which assisted facilities accepted Medicaid beneficiaries, 8 states could not provide this information by phone and 22 states could not provide the information in person  In recent years, CMS has taken steps to improve oversight of beneficiary health and welfare in HCBS programs by adding new HCBS waiver application requirements for state monitoring of beneficiary health and welfare  CMS requires state waiver applications to include specific requirements that implement various statutory and regulatory provisions, including a provision that states assure that they will safeguard the health and welfare of Medicaid beneficiaries  In March 2014, CMS added unexplained death to the events that states must be able to identify and address on an ongoing basis, as part of their efforts to prevent instances of abuse, neglect, and exploitation, and added four new requirements for states to protect beneficiary health and welfare  (See table 6 ) In its guidance implementing the 2014 requirements, CMS noted that state associations and state representatives’ work groups had agreed that “health and welfare is one of the most important assurances to track, and requires more extensive tracking to benefit the individuals receiving services, for instance by using data to prevent future incidents ” As a condition for approval of their HCBS waiver applications for each of the requirements, states must identify and agree with CMS on the type of information they will collect to provide as evidence that they will meet the requirements  However, according to CMS officials, each state Medicaid agency has wide discretion over the information it will collect and report to demonstrate that it is meeting the health and welfare requirements and protecting beneficiaries  Although CMS added the additional requirements in 2014 for safeguarding beneficiary health and welfare, the agency generally did not change requirements for how it oversees state monitoring efforts once HCBS waivers are approved  We found a number of limitations in CMS’s oversight of approved HCBS waivers that undermine the agency’s ability to effectively monitor state oversight of HCBS waivers  These limitations include: unclear guidance on what states should identify and report annually related to any identified program deficiencies; lack of requirements on states to regularly provide CMS information on critical incidents; and CMS’s inconsistent enforcement of the requirement that states submit annual reports  Unclear guidance on what states should identify and report annually related to any identified program deficiencies  Federal law requires states to provide CMS with information annually on an HCBS waiver’s impact on (1) the type and amount, and cost of services provided and (2) the health and welfare of Medicaid beneficiaries receiving waiver services  CMS reporting requirements give states latitude to determine what to report as health and welfare deficiencies found through state monitoring of their HCBS programs  With respect to health and welfare, CMS’s State Medicaid Manual directs states when preparing their annual reports to “check the appropriate boxes regarding the impact of the waiver on the health and welfare” of beneficiaries and to describe relevant information  States are required to provide a brief description of the state process for monitoring beneficiary safeguards, use check boxes to indicate that beneficiary health and welfare safeguards have been met, and identify whether deficiencies were detected during the monitoring process  If states determine that deficiencies were identified through monitoring, states are required to “provide a summary of the significant areas where deficiencies were detected” and an explanation of the actions taken to address deficiencies and ensure the deficiencies do not recur  CMS’s written instructions for completing the HCBS annual report do not provide further guidance regarding reporting of deficiencies  For example, the reporting instructions do not describe or identify 1) what states are supposed to report as deficiencies, 2) how they are to identify which deficiencies are most significant, and 3) the extent to which states need to explain the steps taken to ensure that deficiencies do not recur  The lack of clarity is inconsistent with federal internal control standards, in particular, the need for federal agencies to have processes that identify information needed to achieve objectives and address risk  Without clear instructions as to what states must report, states’ annual reports may not identify deficiencies with states’ HCBS waiver programs that may affect the health and welfare of beneficiaries  States may determine that issues or problems they identified through monitoring do not represent reportable deficiencies and therefore may not report those deficiencies to CMS, increasing the risk that problems are not elevated to CMS’s attention  In the case of one of the selected states we reviewed, no problems were included on the annual reports submitted to CMS between 2011 and 2015  However, when CMS completed its review in the fourth year of the state’s waiver— for purpose of renewing the waiver—it determined the state was not assuring beneficiary health and welfare  CMS found that the information the state submitted for purpose of renewal suggested a “pervasive failure” by the state to assure the health and welfare of beneficiaries receiving services, including assisted living services  In particular, CMS noted the state provided insufficient information regarding the number of unexpected or suspicious beneficiary deaths  CMS concluded that the state failed to demonstrate that it has effective systems and processes for ensuring the health and welfare of beneficiaries  Lack of requirements on states to annually provide CMS information on critical incidents  Despite the importance of state critical incident management and reporting systems to protecting the health and welfare of beneficiaries, CMS lacks written requirements that states provide information needed for the agency oversight of state monitoring of critical incidents  According to CMS, a critical element of effective state oversight is the operation of data systems that support the identification of trends and patterns in the occurrence of critical incidents to identify needed improvements  Such a system is also consistent with federal internal controls standards which specify, in particular, the need for federal agencies to have processes that identify information needed to achieve objectives and address risk  CMS requires states to operate a critical incident reporting system  On their waiver applications states must check a box indicating they operate a system and also describe their system—including who must report and when, and what must be reported  Despite this requirement for states to have critical incident reporting systems, CMS does not require states to report to CMS any data from these systems on critical incidents as part of their required annual reports  Specifically, states are not required to include, in their annual reports, the number of critical incidents reported or substantiated that involve Medicaid beneficiaries  As a result, CMS does not have a method to confirm what states describe about critical incident management systems, which is a required component of states’ waiver applications or to assess the capabilities of states’ systems  For example, CMS cannot confirm whether the state systems can report incidents by location or type of residential provider, such as assisted living facilities; the type and severity of critical incidents that occurred; and the number of incidents that involved Medicaid beneficiaries  Without annual critical incident reporting, CMS may be at risk of (1) not having adequate evidence that states are meeting CMS requirements to have an effective critical incident management and reporting system and of (2) being unaware of problems with states’ abilities to identify, track, and address critical incidents involving Medicaid beneficiaries  Our prior work has shown that the lack of explicit reporting requirements on critical incidents not only impacts HCBS waiver programs but also impacts other types of Medicaid long-term services programs as well  Specifically, In a November 2016 report, we found that CMS requirements for states to report on their critical incident monitoring systems for the HCBS waiver program were more stringent than those for other types of HCBS programs, potentially leaving those other programs at even greater risk  We recommended that CMS take steps to harmonize requirements across different types of HCBS programs  HHS concurred with the recommendation stating it would seek input from states, stakeholders, and the public regarding harmonizing requirements across programs  In an August 2017 report we found similar issues in critical incident reporting requirements for other types of long term services programs, particularly those used to provide HCBS and other long term services under managed care  We found that CMS was not always requiring states that contracted with managed care organizations to provide long term services and supports to report to CMS sufficient information on critical incidents and other key areas needed to monitor beneficiary access and quality  We recommended that CMS take steps to identify and obtain key information needed to better oversee states’ efforts to monitor beneficiary access to quality services in their managed long-term services and supports programs  HHS concurred with this recommendation and stated that the agency would take this recommendation into account as part of an ongoing review of its 2016 Medicaid managed care rule  We continue to believe that the implementation of our prior recommendations is needed to help improve CMS oversight of states monitoring of beneficiary safety  CMS’s inconsistent enforcement of the requirement that states submit annual reports  States must prepare and submit an annual report for each HCBS waiver as a condition of waiver approval  According to CMS guidance, the agency’s review of the annual report is part of the ongoing oversight of HCBS waiver programs and not submitting an annual report jeopardizes the states renewal of HCBS waiver programs  However, some states have not been timely in submitting the required annual reports for their HCBS waivers  A review of 2013 HCBS annual reports by a CMS contractor, published in 2016, found that annual reports were missing for 29 HCBS waivers and multiple years’ of annual reports were missing for 8 waivers  In 2014, CMS adopted new strategies to ensure compliance with HCBS waiver requirements, including the requirement that states submit annual reports on a timely basis  These strategies include withholding federal funding, placing a moratorium on enrollment in the waiver, or other actions the agency determines necessary  CMS officials reported that the agency had not used these new strategies with states that were delinquent in submitting their annual reports  Officials said they were in the process of reviewing how to implement these new strategies in the case of one state; however, as of August 2017 officials had not finalized a decision  CMS’s ability to provide effective oversight of state programs and protect beneficiary health and welfare is undermined by the lack of enforcement and receipt of required annual waiver reports  Effective state and federal oversight is necessary to ensure that the health and welfare of Medicaid beneficiaries receiving assisted living services are protected, especially given the particular vulnerability of many of these beneficiaries to abuse, neglect, or exploitation  CMS has taken steps to strengthen beneficiary health and welfare protections in states’ HCBS waiver programs, the most common type of program that covers assisted living services and one that serves the most vulnerable beneficiaries  In particular, CMS now has multiple requirements for states to safeguard beneficiaries’ health and welfare, including requirements to operate an effective critical incident management and reporting system to identify, investigate, and address incidents of beneficiary abuse, neglect, exploitation, and unexplained death  However, CMS’s ability to effectively monitor how well states are assuring beneficiary health and welfare is limited by gaps in state reporting to CMS  CMS has not provided clear guidance to states on what information to include in annual reports on deficiencies they identify  As a result, CMS lacks assurance that it is receiving consistent, complete, and relevant information on deficiencies that is needed to oversee beneficiary health and welfare  Lacking clear guidance on the reporting of deficiencies may result in a delayed recognition of problems that may affect beneficiary health and welfare  Further, for years, states have been required to check a box attesting that they operate a critical incident management system, but have not always been required to report information on incidents of potential or actual harm to beneficiaries  Given the increasing prevalence of assisted living facilities as a provider of services to Medicaid beneficiaries, it is unclear why more than half of states responding to our survey could not provide us information on the number of critical incidents that occurred in these facilities in their states  Reporting data from their critical incident systems, such as the number of incidents, the type and severity of the incidents, or the location or type of facility in which the incident occurred would provide evidence that an effective system is in place, provide information on the extent beneficiaries are subject to actual or potential harm, and allow for tracking trends over time  Finally, CMS has not ensured that all states submit annual reports on their HCBS waiver programs as required  Without improvements to state reporting, CMS cannot ensure states are meeting their commitments to protect the health and welfare of Medicaid beneficiaries receiving assisted living services, potentially jeopardizing their care  We are making the following three recommendations to CMS: The Administrator of CMS should provide guidance and clarify requirements regarding the monitoring and reporting of deficiencies that states using HCBS waivers are required to report on their annual reports  (Recommendation 1) The Administrator of CMS should establish standard Medicaid reporting requirements for all states to annually report key information on critical incidents, considering, at a minimum, the type of critical incidents involving Medicaid beneficiaries, and the type of residential facilities, including assisted living facilities, where critical incidents occurred  (Recommendation 2) The Administrator of CMS should ensure that all states submit annual reports for HCBS waivers on time as required  (Recommendation 3) We provided a draft of this report to HHS for review and comment  HHS provided written comments, which are reproduced in Appendix V  The department also provided technical comments, which we incorporated as appropriate  In its written comments, the department concurred with two of our three recommendations, specifically, that CMS will clarify requirements for state reporting of program deficiencies and ensure that all states submit required annual reports on time  HHS did not explicitly agree or disagree with our third recommendation to require all states to report information on critical incidents to CMS annually  The department noted it has established a workgroup to learn more about states’ health and welfare systems and that it will use the results of this workgroup to determine which additional reporting requirements would be beneficial  The workgroup’s review will continue through calendar year 2018  In technical comments, HHS indicated that after the workgroup’s review is complete it will consider annual reporting of critical incidents  We believe establishing the workgroup is a positive first step towards improving oversight and state reporting and encourage HHS to require annual reporting on critical incidents when developing additional reporting requirements  As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date  At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, the Administrator of the Administration for Community Living, appropriate congressional committees, and other interested parties  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or at iritanik@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff that made key contributions to this report are listed in appendix VI  Our survey of state Medicaid agencies regarding coverage, spending, enrollment, and oversight of assisted living services in 2014, obtained information on challenges for Medicaid beneficiaries to access assisted living services in their states  States provided information related to factors that create challenges for Medicaid beneficiaries’ ability to access and receive assisted living services and the extent states had policies to help beneficiaries with the cost of room and board  A number of states in our survey cited common factors as creating the greatest challenges to a beneficiary’s ability to access assisted living services, including the number of assisted living facilities willing to accept Medicaid beneficiaries (13 states or 27 percent of the 48 states) program enrollment caps (9 states or 19 percent of the 48 states) beneficiaries’ inability to pay for assisted living facility room and board (9 states or 19 percent of the 48 states), which Medicaid typically does not cover low rates the state Medicaid program paid assisted living facilities (8 states or 17 percent of the 48 states)  A number of states reported that they had policies to assist Medicaid beneficiaries with the costs of room and board charged by assisted living facilities, which Medicaid does not typically cover  Two common policies, cited by at least half of the states, were aimed at limiting how much assisted living facilities could charge Medicaid beneficiaries for room and board  For example, 30 of 48 states, limited the amount facilities could charge for room and board to the amount of income certain beneficiaries receive as Supplemental Security Income  The other commonly cited policies focused on providing financial assistance to the beneficiaries to defray the room and board costs  (See table 9 ) In addition to the contact named above, Tim Bushfield and Christine Brudevold (Assistant Directors), Jennie Apter, Shirin Hormozi, Anne Hopewell, Kelsey Kreider, Perry Parsons, Vikki Porter, and Jennifer Whitworth made key contributions to this report 
Report 2:  Then-Department of State Legal Adviser Harold Koh stated November 9, 2009, that the United States has determined that its "national security interests cannot be fully ensured consistent with the terms" of the CCM  The Barack Obama Administration announced on November 25, 2011, that the United States would continue to implement the DOD policy on cluster munitions issued June 19, 2008, which recognized the need to minimize harm to civilians and infrastructure but also reaffirmed that "cluster munitions are legitimate weapons with clear military utility " The central directive in the Pentagon's policy was the unwaiverable requirement that cluster munitions used after 2018 must leave less than 1% of unexploded submunitions on the battlefield  Prior to that deadline, U S  use of cluster munitions that did not meet this criterion required combatant commander approval  On November 30, 2017, then-Deputy Secretary of Defense Patrick Shanahan issued a revised policy on cluster munitions  The memorandum describing the policy noted that [c]luster munitions provide the Joint Force with an effective and necessary capability to engage area targets, including massed formations of enemy forces, individual targets dispersed over a defined area, targets whose precise location are not known, and time-sensitive or moving targets  Cluster munitions are legitimate weapons with clear military utility, as they provide distinct advantages against a range of threats in the operating environment  Additionally, the use of cluster munitions may result in less collateral damage than the collateral damage that results from use of unitary munitions alone  Since the inception of the 2008 policy, in the midst of extended combat operations in Iraq and Afghanistan, we have witnessed important changes in the global security environment and experienced several years of budgets that under-invested in replacement systems and the modernization of the Joint Force more broadly  Our adversaries and our potential adversaries have developed advanced capabilities and operational approaches specifically designed to limit our ability to project power  Both Shanahan and Admiral Harry Harris Jr  have also argued that sustaining the current U S  cluster munitions arsenal is necessary to prepare for a potential conflict with North Korea  The revised policy reverses the 2008 policy that established an unwaiverable requirement that cluster munitions used after 2018 must leave less than 1% of unexploded submunitions on the battlefield  Combatant commanders can use cluster munitions that do not meet the 1% or less unexploded submunitions standard in extreme situations to meet immediate warfighting demands  Furthermore, the new policy does not establish a deadline to replace cluster munitions exceeding the 1% rate, and these munitions will be removed only after new munitions that meet the 1% or less unexploded submunitions standard are fielded in sufficient quantities to meet combatant commander requirements  However, the new DOD policy stipulates that the department "will only procure cluster munitions containing submunitions or submunition warheads" meeting the 2008 UXO requirement or possessing "advanced features to minimize the risks posed by unexploded submunitions " Specifically, DOD's revised policy stipulates the following: Continuing or beginning with their respective FY2019 budgets, the military departments will program for capabilities to replace cluster munitions currently in active inventories that do not meet the above-described standards for procuring new cluster munitions  The department's annual Program and Budget Review will be used to assess the sufficiency of the replacement efforts  The department's operational planners should plan for the availability of cluster munitions  The approval authority to employ cluster munitions that do not meet the standards prescribed by this policy for procuring new cluster munitions, however, rests with the combatant commanders  In accordance with their existing authorities, commanders may use cluster munitions that meet the standards prescribed by this policy for procuring new cluster munitions  The military departments and combatant commands, in keeping with U S  legal obligations under CCW Protocol V on Explosive Remnants of War and consistent with past practices, will continue to record and retain information on the use of cluster munitions and provide relevant information to facilitate the removal or destruction of unexploded submunitions  The military departments and combatant commands will maintain sufficient inventories and a robust stockpile surveillance program to ensure operational quality and reliability of cluster munitions  In extremis, to meet immediate warfighting demand, combatant commanders may accept transfers of cluster munitions that do not meet the above-described cluster-munition procurement standards  Cluster munitions that do not meet the standards prescribed by this policy for procuring new cluster munitions will be removed from active inventories and demilitarized after their capabilities have been replaced by sufficient quantities of munitions that meet the standards in this policy  The department will not transfer cluster munitions except as provided for under U S  law  The operational use of cluster munitions that include Anti-Personnel Landmines (APL) submunitions shall comply with presidential policy  Furthermore, the Deputy Secretary of Defense Expect(s) the Department to achieve the goals in this policy as rapidly as industry can support  Combatant Commanders will continue to ensure that the employment of cluster munitions is consistent with the law of war and applicable international agreements in order to minimize their harmful effects on civilian populations and infrastructure  In developing a new generation of cluster munitions less dangerous to civilians, DOD will need to determine whether such a high level of performance is achievable under both controlled laboratory conditions and real-world conditions  Factors such as delivery technique, landing in soft or muddy ground, getting caught in trees and vegetation, and submunitions being damaged after dispersal or landing could result in an appreciable number of dud submunitions, even if they have a self-deactivation feature  DOD and the services have been and are currently involved in efforts to reduce cluster munitions failure rates  The Army's Alternative Warhead Program (AWP) is intended to assess and recommend new technologies to reduce or eliminate cluster munitions failure rates  The AWP program is viewed as particularly relevant, as the Pentagon estimates that "upward of 80 percent of U S  cluster munitions reside in the Army artillery stockpile " In December 2008, the Army decided to cease procurement of a Guided Multiple Launch Rocket System (GMLRS) warhead—the Dual-Purpose Improved Conventional Munition (DPICM) warhead—because its submunitions had a dud rate up to 5%  The Air Force has also acquired cluster munitions that comply with the less than 1% failure rate—the CBU-97 Sensor Fuzed Weapon (SFW) and the CBU-105 WCMD/SFW  While DOD's new 2017 cluster munitions policy calls for DOD to continue its efforts to meet the 1% or less unexploded submunitions standard "as rapidly as industry can support," it is not yet known how this policy will affect the aforementioned programs or how it could result in the establishment of new programs  It may be argued that even with advances in "sensor-fuzed" type submunitions that seek out and destroy certain targets, cluster munitions are still essentially an indiscriminate area weapon in an era where precision weapons are increasingly becoming the military norm  In Operation Desert Storm in 1991, only about 10% of ordnance used were precision-guided, but by the time of the Iraq invasion in 2003, "the ratio of 'smart' to dumb weapons was nearly reversed " Since then, this trend toward greater precision has continued, if not accelerated with the development of precision rocket, artillery, mortar munitions, and smaller precision aerial bombs designed to reduce collateral damage  Given current and predicted future precision weaponry trends, cluster munitions might be losing their military relevance—much as chemical weapons did between World War I and World War II  According to the State Department, the U S  military suspended its use of cluster munitions in Iraq and Afghanistan in 2003  For subsequent military operations, where cluster munitions would otherwise have been the weapon of choice, Congress might review what types of weapons were substituted in place of cluster munitions and how effective they were in achieving the desired tactical results  Also worth considering are effects-based weapons systems and operations, which seek to achieve the same or similar effect against a potential target without applying a "kinetic solution" such as a cluster munition  Such insights could prove valuable in analyzing U S  policy options on the future of cluster munitions  DOD's November 2017 revised policy on cluster munitions potentially raises a number of issues for possible congressional consideration  With limits on cluster munition use after 2018 rescinded, how does this affect combatant commanders' operational plans in their respective theaters? Does this mean a lesser degree of military risk because combatant commanders can employ cluster munitions to meet warfighting demands, possibly translating into fewer forces needed to achieve the same result when the 2008 policy was in effect? Despite DOD emphasis on achieving a 1% or less unexploded submunitions standard "as rapidly as industry can support," will DOD funding restrictions slow or stall programs previously intended to replace those systems that exceeded 1% because there no longer is an urgent operational need to replace those systems? In a similar manner, will defense industry view this as a renewed opportunity to develop systems with a 1% or less unexploded submunitions standard or take a more sanguine view that since DOD is no longer time constrained to develop and field 1% or less weapons that funding these programs will be less of a priority and, therefore, an unprofitable venture? Another possible issue for consideration is how this U S  policy reversal on the military use of cluster munitions will be perceived by the international community and how this might affect future U S  and international military treaty initiatives  Consolidated Appropriations Acts The Consolidated Appropriations Act, 2010 ( P L  111-117 ), which the President signed into law December 16, 2009, prohibits the provision of military assistance for cluster munitions, the issuing of defense export licenses for cluster munitions, or the sale or transfer of cluster munitions or cluster munitions technology unless "the submunitions of the cluster munitions, after arming, do not result in more than 1 percent unexploded ordnance across the range of intended operational environments " Moreover, any agreement "applicable to the assistance, transfer, or sale of such cluster munitions or cluster munitions technology" must specify that the munitions "will only be used against clearly defined military targets and will not be used where civilians are known to be present or in areas normally inhabited by civilians " Subsequent appropriations laws have included similar provisions; the most recent is the Consolidated Appropriations Act, 2019 ( P L  116-6 ), which the President signed into law on February 15, 2019  

ground_truth: Protecting federal employees and facilities from security threats is of critical importance. Most federal agencies are generally responsible for their facilities and have physical security programs to do so. GAO was asked to examine how federal agencies assess facilities' security risks. This report examines: (1) how selected agencies' assessment methodologies align with the ISC's risk management standard for identifying necessary countermeasures and (2) what management challenges, if any, selected agencies reported facing in conducting physical security assessments and monitoring the results. GAO selected four agencies—CBP, FAA, ARS, and the Forest Service—based on their large number of facilities and compared each agency's assessment methodology to the ISC Standard; analyzed facility assessment schedules and results from 2010 through 2016; and interviewed security officials. GAO also visited 13 facilities from these four agencies, selected based on geographical dispersion and their high risk level. None of the four agencies GAO reviewed—U.S. Customs and Border Protection (CBP), the Federal Aviation Administration (FAA), the Agricultural Research Service (ARS), and the Forest Service—used security assessment methodologies that fully aligned with the Interagency Security Committee's Risk Management Process for Federal Facilities standard (the ISC Standard). This standard requires that methodologies used to identify necessary facility countermeasures—such as fences and closed-circuit televisions—must: 1. Consider all of the undesirable events (i.e., arson and vandalism) identified by the ISC Standard as possible risks to facilities. 2. Assess three factors—threats, vulnerabilities, and consequences—for each of these events and use these three factors to measure risk. All four agencies used methodologies that included some ISC requirements when conducting assessments. CBP and FAA assessed vulnerabilities but not threats and consequences. ARS and the Forest Service assessed threats, vulnerabilities, and consequences, but did not use these factors to measure risk. In addition, the agencies considered many, but not all 33 undesirable events related to physical security as possible risks to their facilities. Agencies are taking steps to improve their methodologies. For example, ARS and the Forest Service now use a methodology that measures risk and plan to incorporate the methodology into policy. Although CBP and FAA have updated their methodologies, their policies do not require methodologies that fully align with the ISC standard. As a result, these agencies miss the opportunity for a more informed assessment of the risk to their facilities. All four agencies reported facing management challenges in conducting physical security assessments or monitoring assessment results. Specifically, CBP, ARS, and the Forest Service have not met the ISC's required time frame of every 3 years for conducting assessments. For example, security specialists have not conducted required reassessments of two ARS and one Forest Service higher-level facilities. While these three agencies have plans to address backlogs, CBP's plan does not balance conducting risk assessments with other competing security priorities, such as updating its policy manual, and ARS and the Forest Service lack a means to monitor completion of future assessments. Furthermore, CBP, ARS, and the Forest Service did not have the data or information systems to monitor assessment schedules or the status of countermeasures at facilities, and their policies did not specify such data requirements. For example, ARS and the Forest Service do not collect and analyze security-related data, such as countermeasures' implementation. FAA does not routinely monitor the performance of its physical security program. Without improved monitoring, agencies are not well equipped to prioritize their highest security needs, may leave facilities' vulnerabilities unaddressed, and may not take corrective actions to meet physical security program objectives. This is a public version of a sensitive report that GAO issued in August 2017. Information that the agencies under review deemed sensitive has been omitted. GAO recommends: (1) that CBP and FAA update policies to require the use of methodologies fully aligned with the ISC Standard; (2) that CBP revise its plan to eliminate the assessments backlog; and (3) that all four agencies improve monitoring of their physical security programs. All four agencies agreed with the respective recommendations.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: Risk management, as applied to security of federal facilities, entails a continuous process of applying a series of mitigating actions—assessing risk through the evaluation of threats, vulnerabilities, and consequences; responding to risks with appropriate countermeasures; and monitoring risks using quality information (see fig  1)  In 1995, Executive Order 12977 established the ISC after the bombing of the Oklahoma City Alfred P  Murrah Federal Building in April 1995  The ISC’s mandate is to enhance the quality and effectiveness of security in and protection of federal facilities in the United States occupied by federal employees for nonmilitary activities  The order directs the ISC to develop and evaluate security standards for federal facilities, develop a strategy to ensure executive agencies and departments comply with such standards, and oversee the implementation of appropriate security measures in federal facilities  The ISC has released a body of standards, including the ISC Standard, designed to apply to the physical security efforts of all federal, non-military agencies  The ISC Standard prescribes a process for agencies to follow in developing their risk assessment methodologies (see fig  2)  Most federal departments and agencies are generally responsible for protecting their own facilities and have physical security programs in place to do so  The ISC Standard requires executive departments and agencies to follow the risk-management process when conducting risk assessments for each of their facilities  That process begins with determining the facility security level, ranging from level I (lowest risk) for facilities generally having 100 or fewer employees to level V (highest risk) for the most critical facilities and generally having greater than 750 employees  The security level designation determines the facility’s baseline countermeasures  For each facility, departments and agencies are required to (a) consider all of the “undesirable events” that could pose a risk to their facilities— such as active shooters, vandalism, and explosions—and (b) assess three factors of risk (threats, vulnerabilities, and consequences) to specific undesirable events  Subsequently, agencies are to combine all three factors to yield a measurable level of risk for each undesirable event (see app  III)  Based on the results of these assessments, agencies should customize (either increase or decrease) the countermeasures to adequately reflect the assessed level of risk  In addition, as part of planning for physical security resources within an agency’s budget process, the ISC has identified the need to balance allocations for countermeasures with other operational needs and with competing priorities  The ISC Best Practices have some similarities with leading practices in capital decision-making  For example, both state that the allocation of resources should be integrated into the agency’s mission, objectives, goals, and budget process  However, beyond the ISC Best Practices, the Office of Management and Budget and we have developed more comprehensive leading practices in capital decision- making that provide agencies with guidance for prioritizing budget decisions such as for countermeasure projects  The Office of Management and Budget and our guidance also emphasize evaluating a full range of alternatives, informed by agency asset inventories that contain condition information, to bridge any identified performance gap  Furthermore, the guidance calls for a comprehensive decision-making framework to review, rank, and select from among competing project proposals  Such a framework should include the appropriate levels of management review, and selections should be based on the use of established criteria  The following describes the mission and physical security program characteristics for the agencies in our review: CBP, the nation’s largest law enforcement agency, has responsibility for securing the country’s borders  It also has responsibility for conducting security assessments at about 1,200 facilities, including approximately 215 federally owned and agency-controlled higher-level facilities (facility security levels III and IV)  These facilities include border patrol stations with holding cells for people detained at the border, office buildings, and canine-training centers  CBP conducts these assessments  FAA’s mission is to provide a safe and efficient aerospace system for the country  According to agency data, FAA has 55 federally owned and agency-controlled higher-level facilities—including critical air traffic control towers  According to FAA officials, FAA specialists conduct security assessments  ARS conducts research related to agriculture and disseminates information to ensure high-quality safe food and to sustain a competitive agricultural economy  According to agency data, ARS has security responsibility for four domestic federally owned and agency- controlled higher-level facilities—including laboratories for research to improve food and crop quality, office buildings, and warehouses  ARS security personnel have responsibility for conducting security assessments  The Forest Service sustains the health, diversity, and productivity of the nation’s forests and grasslands  According to agency officials, the Forest Service has one federally owned and agency-controlled higher- level facility—a regional headquarters office building  The Forest Service’s security officials have responsibility for conducting security assessments, but at the time of our review, USDA security officials conducted the assessment at Forest Service’s one higher-level facility  None of the four selected agencies’ security assessment methodologies fully aligned with the ISC Standard  The ISC gives agencies some flexibility to design their own security-assessment methodologies for identifying necessary countermeasures as long as the chosen methodology adheres to fundamental principles of a sound risk- management methodology  Specifically, methodologies must: consider all of the undesirable events identified in the ISC Standard as possible risks to federal facilities, and assess three factors of risk (threats, vulnerabilities, and consequences) for each of the events  Furthermore, the ISC Standard requires executive departments and agencies to document decisions that deviate from the ISC Standard  Agencies’ policies and methodologies reference the ISC Standard  However, none of the agencies’ methodologies considered all of the undesirable events during assessments although they used some type of risk assessment methodology  In addition, the agencies did not always adhere to these principles of risk management (see table 1)  At the time of our review, CBP’s methodology did not fully align with the ISC Standard because it did not consider all of the 33 undesirable events nor assess threat and consequence  CBP security specialists assessed vulnerabilities at building entrances and exits, in interior rooms, and around the perimeter using a yes/no checklist during the assessment process  However, assessment reports showed that specialists did not assess the threats and consequences of undesirable events at each facility  According to security officials, the gap occurred because they designed the checklist to meet requirements in the 2009 CBP Security Policy and Procedures Handbook, which predates the first edition of the ISC Standard issued in 2010  CBP officials told us that as of January 2017, they began using an improved methodology to assess the threats, vulnerabilities, and consequences for 30 of 33 undesirable events— omitting three now identified in the November 2016 revision to the ISC Standard  However, CBP has not yet updated its handbook to align with the ISC Standard, even though it started this effort over 3 years ago in December 2013  CBP officials did not provide a draft of its updated handbook, but they provided a plan with milestone dates for issuing the handbook by September 2018  CBP officials also told us that updates to the handbook may have to wait due to competing priorities, including efforts to address the backlog of assessments (which we discuss later in this report)  Delays in updating the handbook mean that CBP’s policy will continue to not align with the ISC Standard  Furthermore, although CBP security officials told us that all of the agency’s security specialists have been trained to use the improved assessment methodology, without documentation of the methodology in agency policy, there may be greater risk of its inconsistent application  Standards for Internal Control emphasize the importance of agencies developing and documenting policies to ensure agency-wide objectives are met  Documentation serves to retain institutional knowledge over time when questions about previous decisions arise  Without an updated policy handbook that requires a methodology that assesses all undesirable events consistent with the ISC Standard, CBP cannot reasonably ensure that its facilities will have levels of protection commensurate to their risk  FAA’s methodology does not fully align with the ISC Standard because it does not consider all of the 33 undesirable events nor does it assess all three factors of risk  FAA security specialists assess vulnerabilities to the site perimeter, entryways, and interior rooms using a yes/no checklist, but the checklist does not assess the consequences from each of the undesirable events at each facility  With respect to threat, FAA applies the ISC’s baseline threat—a general federal facilities threat level that relates directly to a set of baseline countermeasures—across all its higher-level facilities because FAA policy states that there is no agency-specific threat that exceeds the current baseline threat  According to FAA officials, the baseline threat standardizes the security needs across their facilities rather than addressing the security needs of individual facilities from specific threats  When necessary, FAA policy allows specialists to modify countermeasures based on an evaluation of conditions at the facility  FAA realized that this approach was no longer appropriate given the agency-wide goal to make risk-based decisions, a review of the assessment process after a 2014 Chicago fire incident that destroyed critical FAA equipment, and an awareness of ISC initiatives to assess compliance  To address the resulting methodological gaps, FAA hired a contractor to design, develop, test, and validate an improved risk- assessment methodology  Subsequently, FAA improved its methodology in January 2017 to assess the threats, vulnerabilities, and consequences for 30 of the 33 undesirable events identified in the November 2016 revision to the ISC Standard —and tested the methodology at lower- and higher-level facilities  This revised methodology addresses the need to assess individual facility needs rather than using a standardized baseline approach  In April 2017, FAA officials told us of their plan for implementing this methodology and provided tentative milestone dates to conduct further testing, training, and analysis before deciding to use the improved methodology, which they expect to complete by January 2018  However, their plan lacks the necessary information to ensure successful implementation, such as detail on how many facilities they will test and how they will use the results of testing, training, and analysis to implement the improved methodology within the identified 9-month time frame  Furthermore, the improved methodology does not address undesirable events for which ISC issued countermeasures in May 2017  Without a detailed implementation plan to assess the methodology’s impact on its security program, FAA cannot reasonably ensure that its facilities have the proper countermeasures  With ongoing changes to its security program, FAA has an opportunity to fully align its improved methodology with the ISC Standard by including all 33 undesirable events and to update its policy requiring the use of such a methodology  Unlike CBP and FAA—which developed their own methodologies separate from their parent departments (Department of Homeland Security (DHS) and Department of Transportation (DOT), respectively)— ARS and the Forest Service follow an assessment methodology developed by USDA  USDA’s methodology does not fully align with the ISC Standard because it does not consider all of the 33 undesirable events for which ISC issued countermeasures in May 2017  Security specialists from USDA headquarters typically assess ARS’s and the Forest Service’s higher-level facilities using a risk-based methodology that considers the 31 undesirable events listed in the previous version of the ISC Standard dated August 2013  However, until recently, USDA did not assign ratings to each of the three risk factors—threat, vulnerability, and consequence—and then combine these ratings to yield a measurable level of risk for each undesirable event  USDA security officials said that they have revised the assessment-reporting format to include this risk calculation and trained their specialists to measure risk in this way  USDA officials provided us with a new assessment template that addresses all 33 undesirable events and includes measuring risk  Additionally, USDA officials said that they are revising their outdated physical security manual and expect to complete it by April 2018  With a revised manual and application of the new assessment template, USDA should be better positioned to assess risk at its facilities  When agencies do not use methodologies that fully align with the ISC Standard, they could face deleterious effects, ranging from facilities having inappropriate levels of protection to agencies having an inability to make informed resource allocation decisions for their physical security needs  Specifically, the ISC Standard states that facilities may face the effect of either having (1) less protection than needed resulting in inadequate security or (2) more protection than needed resulting in an unnecessary use of resources  The ISC Standard also states that these effects can be negated by determining the proper protection according to a risk assessment  Identified excess resources in one risk area then can be reallocated to underserved areas, thus ensuring the most cost- effective security program is implemented  As an illustration of such potential effects, we found that two agencies assessing two higher-level facilities came to two different conclusions in terms of their need for X-ray machines to screen for guns, knives, and other prohibitive items in federal facilities  Specifically, one agency based its decision on a policy that does not deviate from the ISC’s baseline set of countermeasures, and the other agency based its decision on professional judgement that deviated from the ISC’s baseline set of countermeasures  Neither agency based its decision on a risk assessment nor documented its decision—both ISC requirements, specifically: Without conducting a risk assessment, FAA recently expanded a policy requirement calling for all higher-level facilities to have X-ray machines and magnetometers  This new requirement poses a potentially sizeable investment for the agency with an estimated cost of X-ray machines of about $24,000 and magnetometers of about $4,000 each  FAA may need such equipment at all its higher-level facilities  However, the ISC Standard requires that agencies conduct risk assessments first to justify their needs  Without conducting risk assessments, FAA managers could unnecessarily use resources by installing such equipment in all higher-level air traffic facilities when there may be higher priority needs A USDA security specialist decided, despite an ISC baseline requirement that higher–level facilities have X-ray machines, not to recommend an X-ray machine at a higher-level Forest Service facility  The specialist reasoned that unlike other federal buildings with numerous unknown visitors, this facility receives mostly known individuals and a limited number of visitors  The ISC Standard allows for professional judgement; however, the ISC requires that agencies document deviations from the baseline set of countermeasures  Reducing the facility’s level of protection without documenting an assessment of risk could result in no record of the basis of the decision for current and future facility managers and security officials to review or use as justification in the case of a question of compliance  In another case, we found that one higher-level facility did not have access control for employees or visitors nor did it have armed guard patrols  The facility manager told us that intelligence and a history without incidents gave leadership reason to believe that these measures were not needed and that therefore the agency did not require and would not fund such protective measures for this facility—in effect, accepting the risks to the facility  Security officials said they also had the same understanding and did not document the matter in the assessment report even though agency policy and the ISC Standard require written documentation when officials deviate from the baseline requirement  Without security assessments that fully align with the ISC Standard and provide measureable levels of risk, agencies do not have the information they need to determine priorities and make informed resource allocation decisions  For example, they may not be able to assess whether to acquire or forego costly physical-security countermeasures—such as, X- ray machines, access control systems, and closed-circuit television systems—for facilities  Additionally, after determining the need to acquire a countermeasure, agencies must fund the countermeasure  As previously discussed, leading practices in capital decision-making include a comprehensive framework to review, rank, and select from competing project proposals for funding  In conducting risk assessments that do not fully align with the ISC Standard (i e , not assessing threats, vulnerabilities, and consequences and measuring risks), agencies miss the opportunity for more informed funding decisions  Three of the four agencies (CBP, ARS, and the Forest Service) currently prioritize funding for operational needs over physical security needs (see table 2) when agencies’ priorities might be different if they based their decisions on an aligned risk assessment  Standards for Internal Control state that agencies should use quality information on an ongoing basis as a means to monitor program activities and take corrective action, as necessary  The ISC requires that agencies assess higher-level facilities at least once every 3 years—an interval requirement to identify and address evolving risks  We found that three of the four agencies (CBP, ARS, and the Forest Service) did not meet this requirement  Officials reported various challenges including (1) assessments competing with other security activities, (2) an insufficient number of qualified staff to conduct assessments when compared to the number of facilities, or (3) not knowing of the required assessment schedule  An “information system” is the people, processes, data, and technology that management organizes to obtain, communicate, or dispose of information  that had not been reassessed since 2010  CBP security officials attributed the backlog to (1) having too few security specialists assigned to assess about 1,200 facilities and (2) the specialists working on competing priorities, such as revising the security handbook, conducting technical inspections, and reviewing new construction designs and renovation projects  According to CBP security officials, they have developed a plan to eliminate the backlog by the end of fiscal year 2018 by prioritizing the completion of assessments  While we found the plan comprehensive, the schedule did not seem feasible  For example, the plan assumes that one specialist can complete six assessments in 3 consecutive days and that another specialist can complete three assessments in 1 day  In contrast, security officials told us specialists take about 20 work hours (or 2½ days) to conduct an on-site assessment of one facility  CBP officials said that they believe they can meet the time frames of the plan because they have set aside other priorities and have a thorough understanding of the scope of work involved at the facilities  They added that it will not be easy to meet the timeline, but they can accomplish it with a motivated and committed workforce, adequate financial resources, and absent activities that would otherwise require shifting of resources  We question the feasibility of setting aside important priorities, such as updating the policy manual and reviewing physical security elements in new construction designs, as well as the workload assumptions for completing the assessments  Further, these other priorities are also key to securing facilities  Without balancing assessments with competing priorities, CBP’s time frames for completing the assessments by the end of fiscal year 2018 may not be feasible and may also result in the agency’s not addressing other important physical security responsibilities  Since the ISC issued its standard in 2010, ARS and the Forest Service have assessed their higher-level facilities at least once  However, these agencies have not reassessed all of their higher-level facilities within the 3-year interval requirement  Specifically, security specialists have not conducted required reassessments of two ARS and one Forest Service higher-level facilities  The ARS headquarters official explained that the agency had not reassessed the two facilities due to competing priorities and insufficient internal resources  During the course of our review, ARS headquarters officials said they began assessing one of the two ARS facilities in May 2017 and will begin assessing the second facility in October 2017  The Forest Service official explained that the agency missed its security reassessment of the regional office because the facility staff had not requested one  During our visit, facility staff responsible for security told us that they were not aware of the ISC’s 3- year interval requirement  Facility staff requested a reassessment, and security officials told us that they expected to complete it by mid-June 2017  Completing this one-time assessment may address the facility’s security needs temporarily  However, ARS and the Forest Service have not implemented a long-term schedule with key milestones and lack a means to monitor completion of assessments of higher-level facilities at least once every 3 years  Consequently, these agencies cannot reasonably ensure that they have full knowledge of the risks to their facilities  FAA data from 2010 through 2016 show that FAA has assessed its 55 higher-level facilities at least once every 3 years  FAA policy requires that specialists schedule assessments of higher-level facilities every 12– 18 months depending on whether the facility has met FAA physical security standards  The ISC Standard states that to make appropriate resource decisions, agencies need information, such as what is being accomplished, what needs management attention, and what is performing at expected levels  We found that agencies’ methods of collecting and storing security information had limitations that affected agency and facility officials’ oversight of the physical security of their facilities (see table 3)  Without having long-term, agency-wide information to monitor whether assessments are conducted on schedule, ARS and the Forest Service may not meet the ISC Standard, resulting in not adequately protecting their facilities and employees  The ISC Standard also states that agencies should measure their security program’s capabilities and effectiveness to demonstrate the need to fund facility security and to make appropriate decisions for allocating resources  However, the agencies in our review were unable to demonstrate appropriate oversight of their physical security programs because: CBP’s handbook does not include requirements for data collection and analysis for monitoring physical-security program activities  Facility managers and security officials do not enter assessment results, such as the countermeasures recommended for facilities, in the real property database  Consequently, they do not have comprehensive data to manage their security program, assess overall performance, and take any necessary corrective actions  A CBP official told us that a comprehensive database would allow CBP to set priorities for addressing countermeasures  Without including data collection and analysis requirements in its updated handbook, CBP may be unable to monitor the performance of its physical security program  FAA’s policy does not require ongoing monitoring of physical security information, such as the status of recommended countermeasures or assessment schedules  As a result, FAA officials do not proactively use physical security information to assess the overall performance of its physical security program and take corrective actions before an incident occurs  Without a policy requiring ongoing monitoring of information—an internal control activity, FAA may be unable to assess the overall performance of its security program and take necessary corrective actions  USDA has a decentralized security program and places the responsibility on agencies to create their physical security programs  Security officials from ARS and the Forest Service told us that USDA does not have a policy for collecting and managing agency-wide information; however, they said that USDA is drafting a new departmental regulation and manual that will specify (1) the roles and responsibilities of agency and facility managers and (2) electronic- data-reporting requirements for monitoring the performance of the physical security program  USDA officials provided a draft of USDA’s regulation and manual for our review  The draft regulation did not mention data reporting and monitoring, while the draft manual only contained a table of contents that included a section entitled “Facility Tracking Database ” USDA officials expect to issue new policies sometime between October 2017 and April 2018  In the absence of new departmental regulation and manual, USDA and Forest Service officials told us that they have begun to develop a Forest Service system for storing electronic copies of agency-wide assessments and that they plan to expand the use of this system to track site specific assessment dates and status of recommended countermeasures  Forest Service officials provided milestone dates and described the capabilities for a future information system, which they expect to complete in September 2017  However, we could not determine whether the manual will have information system requirements to monitor agencies’ physical security program, an internal control activity  Without USDA’s including data collection and analysis requirements in its manual, its agencies may not be able to monitor the performance of their physical security programs  Without agencies having information to monitor security activities, they were unable to provide us information on the status of countermeasures across their entire portfolio  In order to better understand the status of countermeasures implemented and facilities’ experiences when implementing countermeasures, we determined the status of countermeasures at 13 facilities we visited  As previously noted, risk management, as it pertains to physical security, involves agency officials monitoring their physical security programs  During our visits to 13 selected facilities, we found the four agencies differed in the number of countermeasures that they had not implemented  Facility officials provided us with some information on why countermeasures had not been implemented, specifically: CBP had a significant number of recommended countermeasures from 2010 through 2016 that remained open at the eight selected CBP facilities  CBP facility officials gave reasons why recommended countermeasures had not been implemented  At one facility, officials did not know about the recommended countermeasures from its last 2010 assessment because the individuals previously knowledgeable about the assessments left the organization without communicating the results  By taking action to improve facility security, they implemented some needed countermeasures  However, at the time of our review, a large number of the recommendations remained open  At another facility, officials told us that they too had not known (for the same reason mentioned above) of their 2010 assessment, which contained recommended countermeasures  However, these officials told us that they submitted a funding request a few weeks before our visit to address all except one of the open countermeasures  In other cases, facilities have not implemented needed countermeasures due to resource constraints or physical site limitations  FAA had a large number of recommended countermeasures from 2010 through 2016 that remained open at the time of our review for the two FAA facilities visited  In this case, the most recent security assessment, completed in late 2016, resulted in one facility’s having little time to implement countermeasures by the time we conducted our analysis  While ARS had closed almost all recommended countermeasures at two facilities at the time of our review, one Forest Service facility had not yet implemented a recommendation (to secure its entrance doors) that was identified in a 2013 security assessment (see bottom center photo, fig  3)  This countermeasure remained open because facility officials said they continued to explore alternatives to address the recommendation  Figure 3 shows examples of countermeasures not fully implemented at selected facilities we visited  During our site visits and discussions with facility staff, we found that physical site limitations or other priorities can make it difficult for facility managers to implement countermeasures  For example, a countermeasure might involve correcting a clear zone violation—that is, moving an object (such as a brick wall) a certain distance away from the facility’s perimeter fence to prevent a potential intruder from using the object to climb over the fence  However, when the object near the fence is a building and the property outside of the fence is not federally owned (see bottom right photo, fig  3), it may not be cost effective to correct the clear zone violation  In this situation, the agency bears the responsibility for exploring ways to address the vulnerability  In following the ISC Standard, as previously noted, managers are required to justify and document why they could not implement recommended countermeasures—what the ISC calls risk acceptance  Selected agencies carry a great responsibility for protecting facilities that support border protection activities, provide safe and efficient air traffic around the country, and protect the quality of the nation’s food supply  With this responsibility comes the need to appropriately assess risk to ensure the security of these agencies’ facilities  However, 7 years after the ISC issued its initial risk-management process standard, each of four selected agencies continued to use assessment methodologies that did not fully align with this standard  During our review, agencies improved their methodologies to better align with the ISC Standard, but the agencies had not yet incorporated the methodologies into their policies and procedures  Without updated policies and procedures requiring a methodology that adheres to the ISC Standard (including all 33 undesirable events now identified in the November 2016 revision to the ISC Standard), agencies may not collect the information needed to assess risk and determine priorities for improved security  This situation could hamper the agencies’ ability to make informed resource allocation decisions or to recommend countermeasures commensurate to the needs at specific facilities  To address challenges in conducting timely assessments, agencies that had a backlog developed plans to address them, but the assumptions used in CBP’s plans and time frames did not appear to fully reflect the agency’s competing priorities and actual experience  Additionally, ARS and Forest Service have not implemented a long-term assessment schedule with key milestones to ensure that higher-level facilities are reassessed at least once every 3 years  Further, in cases where the agencies may have had risk assessment information, CBP, ARS, and the Forest Service lack the means to collect, store, and analyze this information in order to monitor the status of a facility’s security  Without these key aspects of a comprehensive security program—a methodology that meets the standard, policies, and procedures that incorporate that methodology; the ability to complete assessments on time; and information to perform monitoring—agencies remain vulnerable to substantial security risks  To improve agencies’ physical security programs’ alignment with the ISC Risk Management Process for Federal Facilities and Standards for Internal Control in the Federal Government for information and monitoring, we recommend that the Commissioner of U S  Customs and Border Protection take the following three actions: with regard to the updated Security Policy and Procedures Handbook, the ISC’s Risk Management Process for Federal Facilities requirement to assess all undesirable events, consider all three factors of risk, and document deviations from the standard, and data collection and analysis requirements for monitoring the performance of CBP’s physical security program  revise the assumptions used in the plan to address the backlog to balance assessments with competing priorities, such as updating the policy manual and reviewing new construction design, to develop a feasible time frame for completing the assessment backlog  Secretary of Transportation direct the FAA Administrator to take the following three actions: develop a plan that provides sufficient details on the activities needed and time frames within the date when FAA will implement an improved methodology; update FAA’s policy to require the use of a methodology that fully aligns with the ISC’s Risk Management Process for Federal Facilities for assessing all undesirable events, considering all three factors of risk, and documenting all deviations from the standard countermeasures; and update FAA’s policy to include ongoing monitoring of physical security information  Secretary of Agriculture take the following two actions: include data collection and analysis requirements for monitoring the performance of agencies’ physical security programs, in the department’s revised physical-security manual, and direct the Administrator of the Agricultural Research Service and the Chief of the Forest Service to implement and monitor a long-term assessment schedule with key milestones to ensure that higher-level facilities are reassessed at least once every 3 years  We provided a draft of this report to the Departments of Homeland Security, Transportation, and Agriculture for review and comment  All three departments agreed with the findings and recommendations for their respective agencies  DHS agreed with our recommendations and provided actions and timeframes for completion  With regard to our recommendation to update the Security Policy and Procedures Handbook, DHS stated that CBP is updating the handbook to include: (1) a discussion and diagram of the ISC risk management process and its application within CBP’s assessment processes; (2) specific guidance for conducting risk assessments in accordance with the ISC’s Risk Management Process for Federal Facilities; and (3) a requirement and guidance for data collection and analysis in support of a robust physical security program  With regard to our recommendation to revise the assumptions used in the plan to address the assessment backlog, DHS stated that CBP has reevaluated current priorities and believes the current plan to eliminate the risk assessment backlog by the end of fiscal year 2018 is achievable  DHS also provided technical comments, which we incorporated as appropriate  DHS’s official written response is reprinted in appendix IV  DOT also agreed with our recommendations and by e-mail requested that we publish the response to the sensitive version of this report  DOT stated that FAA continues to refine its policy and develop processes that address the ISC threats, vulnerabilities, and consequences  Further, DOT stated that FAA would either validate that current mitigation strategies address those risks or apply additional appropriate countermeasures  DOT stated that it will provide a detailed response to each recommendation within 60 days from the date of this report  DOT’s official written response is reprinted in appendix V  USDA agreed with our recommendations and provided the agency-wide actions for completion  USDA provided a plan to ensure compliance with the ISC’s Risk Management Process for Federal Facilities by development of a standard physical-security assessment process and by initiation of a compliance program to track assessments and monitor the installation of countermeasures  In an e-mail, USDA provided milestone dates and planned completion by January 2019  USDA’s official written response is reprinted in appendix VI  If you or your staff has any questions about this report, please contact me at (202) 512-2834 or RectanusL@gao gov  GAO staff who made key contributions to this report are listed in appendix VI  This report examines: (1) how selected agencies’ assessment methodologies align with the Interagency Security Committee’s (ISC) risk management standard for identifying necessary countermeasures and (2) what management challenges, if any, selected agencies reported facing in conducting physical security assessments and monitoring the results  To determine how selected agencies’ assessment methodologies align with ISC standards for identifying the necessary countermeasures, we identified federal executive branch departments and agencies reported by the Department of Homeland Security (DHS) to have received delegations of authority to protect their own buildings  We reviewed the Federal Real Property Council’s data on the Federal Real Property Profile to identify federally owned and agency-controlled buildings  We determined that these data were sufficiently reliable for the purpose of our reporting objectives based upon our recent report that reviewed these data fields  We selected four agencies based upon their large quantity of reported federally owned and agency-controlled buildings: DHS, U S  Customs and Border Protection (CBP); Department of Transportation (DOT), Federal Aviation Administration (FAA); United States Department of Agriculture (USDA), Agricultural Research Service (ARS) and USDA’s United States Forest Service (Forest Service)  This methodology purposely does not include federal buildings protected by FPS and under the control of the General Services Administration as well as other agencies that we reported on in our previous work  We obtained and reviewed one particular ISC standard, The Risk Management Process for Federal Facilities (the ISC Standard) and its related appendices for assessing physical security and providing recommended countermeasures at federal facilities  We obtained and analyzed the selected departments’ and agencies’ facility-security policies and procedures for a risk assessment methodology  According to the ISC Standard, agencies’ risk assessment methodologies must: consider all of the undesirable events identified in the ISC Standard as possible risks to federal facilities as listed in appendix III; assess the threat, consequences, and vulnerability to specific produce similar or identical results when applied by various security provide sufficient justification for deviations from the ISC-defined security baseline  We limited the scope of this review to the first two standards above because agencies’ adherence to these standards could be objectively verified by reviewing and analyzing agency documentation and interviewing agency officials, and their adherence to the two additional standards could not be verified in this manner  We did not conduct risk assessments with independent security professionals to evaluate: 1) the results from prior agency evaluations and 2) the sufficiency of justifications for deviations from the ISC-defined security baseline, as both evaluations were outside of the scope of the engagement  Therefore, for the purposes of this report, risk assessment policies, procedures and resulting methodology that align with ISC standards are those that consider all of the undesirable events and assess the threats, consequences, and vulnerabilities to specific undesirable events  We reviewed and analyzed information to answer the following five questions: 1  Do the policies and procedures mention the ISC standards? 2  Do the policies and procedures consider all of the undesirable events? 3  Do the policies and procedures assess the threat of specific undesirable events? 4  Do the policies and procedures assess the consequences of specific undesirable events? 5  Do the policies and procedures assess the vulnerability to specific undesirable events? We answered each of these questions as either a “Yes” or “No” for our selected agencies  The “No” answer to questions 3, 4, and 5 includes the following two possibilities: (a) the agency’s threat, consequence, or vulnerability ratings are not tied to specific undesirable events, or (b) the agency does not have a framework or formalized steps within which it collects and analyzes threat-, consequence-, or vulnerability-related information  If the answer to each of the five questions was “Yes,” then the agency’s overall risk assessment methodology aligns with ISC risk assessment standards for the purposes of this report  If the answer to one or more of the five questions was “No”, then the agency’s methodology does not to align with ISC standards for the purposes of this report  We interviewed security officials at ISC; three departments (DHS, DOT, and USDA); and four agencies (CBP, FAA, ARS, and the Forest Service)  We obtained and analyzed agency guidance on prioritizing physical security needs and interviewed agencies’ facility maintenance and budget officials  We reviewed the ISC’s best practices for planning for physical security resources within an agency budget process  Additionally, we reviewed the Office of Management and Budget’s and our leading practices in capital decision-making that provide agencies with guidance for prioritizing budget decisions such as “countermeasure projects ” We also reviewed Standards for Internal Control in the Federal Government because internal controls play a significant role in helping agencies achieve their mission-related responsibilities  Our findings from our review of the selected agencies are not generalizable to all ISC member agencies, but provide insight into and illustrative examples about selected agencies’ facility risk-assessment methodologies  To determine what management challenges selected agencies reported facing in conducting physical security assessments and monitoring results, we interviewed agencies’ security, maintenance, and budget officials  We requested agency security officials to provide portfolio- wide data on facility security assessments for our review in order to select sites to visit and analyze data for dates of assessments and the status of findings  We assessed the reliability of this data through interviews with knowledgeable agency staff and a review for completeness and any unexpected values  We compiled information from physical security assessments when no portfolio-wide agency data were available  We determined that these data were sufficient for the purpose of our reporting objectives and selected geographically dispersed sites with buildings with higher reported security levels per the ISC Standard, as these higher security levels have greater requirements and therefore the potential for greater resource needs  See appendix II for the 13 sites we selected  For these selected sites, we interviewed agency staff concerning the assessment process, site-specific findings, recommendations, justification for deviations from ISC’s baseline standards, and management challenges faced in addressing physical security needs  We observed and photographed the status of the findings from the site physical security assessments  We did not independently determine what constitutes a management challenge or a physical security finding  Rather, we relied on these stakeholders to determine these physical security concerns as defined in their own standards and guidance  The information from our selected sites is illustrative and cannot be generalized to sites agency- wide  The performance audit upon which this report is based was conducted from June 2016 to August 2017 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate, evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  We subsequently worked with DHS, DOT and USDA from August 2017 to October 2017 to prepare this version of the original report for public release  This public version was also prepared in accordance with these standards  Error! No text of specified style in document  Error! No text of specified style in document  Appendix VII: GAO Contact and Staff Acknowledgments Error! No text of specified style in document  In addition to the contact named above, Amelia Shachoy (Assistant Director), Steve Martinez (Analyst-in-Charge), Jennifer Clayborne, George Depaoli, Geoffrey Hamilton, Joshua Ormond, Alison Snyder, Amelia Michelle Weathers, and Elizabeth Wood made key contributions to this report 


Report 2:  Then-Department of State Legal Adviser Harold Koh stated November 9, 2009, that the United States has determined that its "national security interests cannot be fully ensured consistent with the terms" of the CCM  The Barack Obama Administration announced on November 25, 2011, that the United States would continue to implement the DOD policy on cluster munitions issued June 19, 2008, which recognized the need to minimize harm to civilians and infrastructure but also reaffirmed that "cluster munitions are legitimate weapons with clear military utility " The central directive in the Pentagon's policy was the unwaiverable requirement that cluster munitions used after 2018 must leave less than 1% of unexploded submunitions on the battlefield  Prior to that deadline, U S  use of cluster munitions that did not meet this criterion required combatant commander approval  On November 30, 2017, then-Deputy Secretary of Defense Patrick Shanahan issued a revised policy on cluster munitions  The memorandum describing the policy noted that [c]luster munitions provide the Joint Force with an effective and necessary capability to engage area targets, including massed formations of enemy forces, individual targets dispersed over a defined area, targets whose precise location are not known, and time-sensitive or moving targets  Cluster munitions are legitimate weapons with clear military utility, as they provide distinct advantages against a range of threats in the operating environment  Additionally, the use of cluster munitions may result in less collateral damage than the collateral damage that results from use of unitary munitions alone  Since the inception of the 2008 policy, in the midst of extended combat operations in Iraq and Afghanistan, we have witnessed important changes in the global security environment and experienced several years of budgets that under-invested in replacement systems and the modernization of the Joint Force more broadly  Our adversaries and our potential adversaries have developed advanced capabilities and operational approaches specifically designed to limit our ability to project power  Both Shanahan and Admiral Harry Harris Jr  have also argued that sustaining the current U S  cluster munitions arsenal is necessary to prepare for a potential conflict with North Korea  The revised policy reverses the 2008 policy that established an unwaiverable requirement that cluster munitions used after 2018 must leave less than 1% of unexploded submunitions on the battlefield  Combatant commanders can use cluster munitions that do not meet the 1% or less unexploded submunitions standard in extreme situations to meet immediate warfighting demands  Furthermore, the new policy does not establish a deadline to replace cluster munitions exceeding the 1% rate, and these munitions will be removed only after new munitions that meet the 1% or less unexploded submunitions standard are fielded in sufficient quantities to meet combatant commander requirements  However, the new DOD policy stipulates that the department "will only procure cluster munitions containing submunitions or submunition warheads" meeting the 2008 UXO requirement or possessing "advanced features to minimize the risks posed by unexploded submunitions " Specifically, DOD's revised policy stipulates the following: Continuing or beginning with their respective FY2019 budgets, the military departments will program for capabilities to replace cluster munitions currently in active inventories that do not meet the above-described standards for procuring new cluster munitions  The department's annual Program and Budget Review will be used to assess the sufficiency of the replacement efforts  The department's operational planners should plan for the availability of cluster munitions  The approval authority to employ cluster munitions that do not meet the standards prescribed by this policy for procuring new cluster munitions, however, rests with the combatant commanders  In accordance with their existing authorities, commanders may use cluster munitions that meet the standards prescribed by this policy for procuring new cluster munitions  The military departments and combatant commands, in keeping with U S  legal obligations under CCW Protocol V on Explosive Remnants of War and consistent with past practices, will continue to record and retain information on the use of cluster munitions and provide relevant information to facilitate the removal or destruction of unexploded submunitions  The military departments and combatant commands will maintain sufficient inventories and a robust stockpile surveillance program to ensure operational quality and reliability of cluster munitions  In extremis, to meet immediate warfighting demand, combatant commanders may accept transfers of cluster munitions that do not meet the above-described cluster-munition procurement standards  Cluster munitions that do not meet the standards prescribed by this policy for procuring new cluster munitions will be removed from active inventories and demilitarized after their capabilities have been replaced by sufficient quantities of munitions that meet the standards in this policy  The department will not transfer cluster munitions except as provided for under U S  law  The operational use of cluster munitions that include Anti-Personnel Landmines (APL) submunitions shall comply with presidential policy  Furthermore, the Deputy Secretary of Defense Expect(s) the Department to achieve the goals in this policy as rapidly as industry can support  Combatant Commanders will continue to ensure that the employment of cluster munitions is consistent with the law of war and applicable international agreements in order to minimize their harmful effects on civilian populations and infrastructure  In developing a new generation of cluster munitions less dangerous to civilians, DOD will need to determine whether such a high level of performance is achievable under both controlled laboratory conditions and real-world conditions  Factors such as delivery technique, landing in soft or muddy ground, getting caught in trees and vegetation, and submunitions being damaged after dispersal or landing could result in an appreciable number of dud submunitions, even if they have a self-deactivation feature  DOD and the services have been and are currently involved in efforts to reduce cluster munitions failure rates  The Army's Alternative Warhead Program (AWP) is intended to assess and recommend new technologies to reduce or eliminate cluster munitions failure rates  The AWP program is viewed as particularly relevant, as the Pentagon estimates that "upward of 80 percent of U S  cluster munitions reside in the Army artillery stockpile " In December 2008, the Army decided to cease procurement of a Guided Multiple Launch Rocket System (GMLRS) warhead—the Dual-Purpose Improved Conventional Munition (DPICM) warhead—because its submunitions had a dud rate up to 5%  The Air Force has also acquired cluster munitions that comply with the less than 1% failure rate—the CBU-97 Sensor Fuzed Weapon (SFW) and the CBU-105 WCMD/SFW  While DOD's new 2017 cluster munitions policy calls for DOD to continue its efforts to meet the 1% or less unexploded submunitions standard "as rapidly as industry can support," it is not yet known how this policy will affect the aforementioned programs or how it could result in the establishment of new programs  It may be argued that even with advances in "sensor-fuzed" type submunitions that seek out and destroy certain targets, cluster munitions are still essentially an indiscriminate area weapon in an era where precision weapons are increasingly becoming the military norm  In Operation Desert Storm in 1991, only about 10% of ordnance used were precision-guided, but by the time of the Iraq invasion in 2003, "the ratio of 'smart' to dumb weapons was nearly reversed " Since then, this trend toward greater precision has continued, if not accelerated with the development of precision rocket, artillery, mortar munitions, and smaller precision aerial bombs designed to reduce collateral damage  Given current and predicted future precision weaponry trends, cluster munitions might be losing their military relevance—much as chemical weapons did between World War I and World War II  According to the State Department, the U S  military suspended its use of cluster munitions in Iraq and Afghanistan in 2003  For subsequent military operations, where cluster munitions would otherwise have been the weapon of choice, Congress might review what types of weapons were substituted in place of cluster munitions and how effective they were in achieving the desired tactical results  Also worth considering are effects-based weapons systems and operations, which seek to achieve the same or similar effect against a potential target without applying a "kinetic solution" such as a cluster munition  Such insights could prove valuable in analyzing U S  policy options on the future of cluster munitions  DOD's November 2017 revised policy on cluster munitions potentially raises a number of issues for possible congressional consideration  With limits on cluster munition use after 2018 rescinded, how does this affect combatant commanders' operational plans in their respective theaters? Does this mean a lesser degree of military risk because combatant commanders can employ cluster munitions to meet warfighting demands, possibly translating into fewer forces needed to achieve the same result when the 2008 policy was in effect? Despite DOD emphasis on achieving a 1% or less unexploded submunitions standard "as rapidly as industry can support," will DOD funding restrictions slow or stall programs previously intended to replace those systems that exceeded 1% because there no longer is an urgent operational need to replace those systems? In a similar manner, will defense industry view this as a renewed opportunity to develop systems with a 1% or less unexploded submunitions standard or take a more sanguine view that since DOD is no longer time constrained to develop and field 1% or less weapons that funding these programs will be less of a priority and, therefore, an unprofitable venture? Another possible issue for consideration is how this U S  policy reversal on the military use of cluster munitions will be perceived by the international community and how this might affect future U S  and international military treaty initiatives  Consolidated Appropriations Acts The Consolidated Appropriations Act, 2010 ( P L  111-117 ), which the President signed into law December 16, 2009, prohibits the provision of military assistance for cluster munitions, the issuing of defense export licenses for cluster munitions, or the sale or transfer of cluster munitions or cluster munitions technology unless "the submunitions of the cluster munitions, after arming, do not result in more than 1 percent unexploded ordnance across the range of intended operational environments " Moreover, any agreement "applicable to the assistance, transfer, or sale of such cluster munitions or cluster munitions technology" must specify that the munitions "will only be used against clearly defined military targets and will not be used where civilians are known to be present or in areas normally inhabited by civilians " Subsequent appropriations laws have included similar provisions; the most recent is the Consolidated Appropriations Act, 2019 ( P L  116-6 ), which the President signed into law on February 15, 2019  

ground_truth: The number of individuals receiving long term care services from Medicaid in community residential settings is expected to grow. These settings, which include assisted living facilities, provide a range of services that allow aged and disabled beneficiaries, who might otherwise require nursing home care, to remain in the community. State Medicaid programs and CMS, the federal agency responsible for overseeing the state programs, share responsibility for ensuring that beneficiaries' health and welfare is protected. GAO was asked to examine state and federal oversight of assisted living services in Medicaid. This report (1) describes state spending on and coverage of these services, (2) describes how state Medicaid agencies oversee the health and welfare of beneficiaries in these settings, and (3) examines the extent that CMS oversees state Medicaid agency monitoring of assisted living services. GAO surveyed all state Medicaid agencies and interviewed officials in a nongeneralizeable sample of three states with varied oversight processes for their assisted living programs. GAO reviewed regulations and guidance, and interviewed CMS officials. State Medicaid agencies in 48 states that covered assisted living services reported spending more than $10 billion (federal and state) on assisted living services in 2014. These 48 states reported covering these services for more than 330,000 beneficiaries through more than 130 different programs. Most programs were operated under Medicaid waivers that allow states to target certain populations, limit enrollment, or restrict services to certain geographic areas. With respect to oversight of their largest assisted living programs, state Medicaid agencies reported varied approaches to overseeing beneficiary health and welfare, particularly in how they monitored critical incidents involving beneficiaries receiving assisted living services. State Medicaid agencies are required to protect beneficiary health and welfare and operate systems to monitor for critical incidents—cases of potential or actual harm to beneficiaries such as abuse, neglect, or exploitation. Twenty-six state Medicaid agencies could not report to GAO the number of critical incidents that occurred in assisted living facilities, citing reasons including the inability to track incidents by provider type (9 states), lack of a system to collect critical incidents (9 states), and lack of a system that could identify Medicaid beneficiaries (5 states). State Medicaid agencies varied in what types of critical incidents they monitored. All states identified physical, emotional, or sexual abuse as a critical incident. A number of states did not identify other incidents that may indicate potential harm or neglect such as medication errors (7 states) and unexplained death (3 states). State Medicaid agencies varied in whether they made information on critical incidents and other key information available to the public. Thirty-four states made critical incident information available to the public by phone, website, or in person, while another 14 states did not have such information available at all. Oversight of state monitoring of assisted living services by the Centers for Medicare & Medicaid Services (CMS), an agency within the Department of Health and Human Services (HHS), is limited by gaps in state reporting. States are required to annually report to CMS information on deficiencies affecting beneficiary health and welfare for the most common program used to provide assisted living services. However, states have latitude in what they consider a deficiency. States also must describe their systems for monitoring critical incidents, but CMS does not require states to annually report data from their systems. Under federal internal control standards, agencies should have processes to identify information needed to achieve objectives and address risk. Without clear guidance on reportable deficiencies and no requirement to report critical incidents, CMS may be unaware of problems. For example, CMS found, after an in-depth review in one selected state seeking to renew its program, that the state lacked an effective system for assuring beneficiary health and welfare, including reporting insufficient information on the number of unexpected or suspicious beneficiary deaths. The state had not reported any deficiencies in annual reports submitted to CMS in 5 prior years. GAO recommendations to CMS include clarifying state requirements for reporting program deficiencies and requiring annual reporting of critical incidents. HHS concurred with GAO's recommendations to clarify deficiency reporting and stated that it would consider annual reporting requirements for critical incidents after completing an ongoing review.