prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: With a staff of over 47,000 members, the Coast Guard operates a multimission fleet of 201 fixed and rotary-wing aircraft and over 1,400 boats and ships  Operational control of surface and air assets is divided into two geographic Areas (Pacific and Atlantic), within which are nine Districts consisting of 37 sectors and the stations within them  The Coast Guard’s program oversight, policy development, and personnel administration are carried out at the Coast Guard’s headquarters  As shown in table 1, the Coast Guard is responsible for 11 statutory missions identified in the Homeland Security Act of 2002, as amended  The Coast Guard manages these missions through six mission programs, also listed in table 1  As part of its marine safety mission, for example, the Coast Guard conducts, among other activities, safety inspections and vessel accident investigations, including those involving commercial fishing vessels, which are part of an industry with one of the highest death rates of any industry in the United States  For each of its 11 missions, the Coast Guard has developed goals and targets to assess and communicate agency performance  The Coast Guard’s performance assessment process also includes identifying performance gaps and implementing corrective actions to address unmet performance goals  As part of its process, the Coast Guard is to establish targets for the current and subsequent 2 fiscal years, according to Coast Guard officials  Each target is set by the Coast Guard, but according to the Coast Guard’s Annual Performance Report (APR), some are derived from external factors  For example, DHS requires that Coast Guard set a 100 percent target for the percent of people in imminent danger saved in the maritime environment  Further, several of the Coast Guard’s assets used to conduct these missions are approaching the end of their intended service lives  As part of its efforts to modernize its assets used to carry out various missions, the Coast Guard has begun acquiring new vessels, such as the National Security Cutter, the Fast Response Cutter as well as other assets  However, concerns surrounding the affordability of this effort remain as the Coast Guard continues to pursue multiple new acquisitions without long-term planning to guide the affordability of its acquisition portfolio  Figure 1 shows the Coast Guard’s Fast Response Cutter and National Security Cutter  We previously reported on actions the Coast Guard could take to ensure that, among other things, it addresses limitations posed by incomplete data, the use of unrealistic asset performance data, and limitations with its performance goal data, for more effective program management  Examples of data limitations that we have recommended that the Coast Guard take action on are below  Improve completeness of mission data  In December 2017, we found that several different federal agencies play a role in overseeing and promoting commercial fishing vessel safety, including the Coast Guard  As part of its marine safety activities, the Coast Guard conducts, among other activities, safety inspections and vessel accident investigations  Commercial fishing has one of the highest death rates of any industry in the United States and vessel disasters are the leading cause of fatalities among fishers, according to the National Institute for Occupational Safety and Health  However, our December 2017 review found that more information is needed to calculate vessel safety statistics that could enhance the Coast Guard’s knowledge about accident, injury, and fatality trends involving commercial fishing vessels  The Coast Guard collects some data on commercial fishing vessels that operate in federal waters—including a vessel’s length and construction date—but data on the population of the active U S  commercial fishing vessel fleet are not complete  Between 2006 and 2015, the Coast Guard investigated 2,101 commercial fishing vessel accidents that were identified as occurring in federal waters  While the number of accidents generally increased over this time period, the number of injuries and fatalities declined over the same 10-year period  However, we could not assess the number of accidents, injuries, and fatalities by fishery— meaning the area in which a certain type of fish (e g , shrimp, salmon, crab) is caught—because the Coast Guard’s data is not complete  Further, we were unable to calculate the rates of commercial fishing vessel accidents, injuries, and fatalities, because reliable data on certain information needed to do so—including the total number of vessels that are actively fishing and the fishery or region in which the vessel operates—are either not maintained or are not collected by the Coast Guard or other federal agencies  Having this information could be useful to carrying out the Coast Guard’s marine safety mission, which includes enforcing laws to prevent death, injury and property loss in the marine environment  We recommended in our December 2017 report that the Coast Guard ensure that data it collects during commercial fishing vessel incident investigations is accurately captured  We also recommended that the Coast Guard work with stakeholders to form a working group to determine an efficient means to establish a reliable estimate of the population of active commercial fishing vessels  The Coast Guard agreed with both recommendations, and in February 2018 informed us that it is in the process of developing additional data fields to capture more information, such as the fishery in which the commercial fishing is involved, and is engaging stakeholders to establish an appropriate working group  We will continue to monitor these actions  Use more realistic asset performance data  In our May 2016 report on Coast Guard strategic planning, we found that the Coast Guard did not provide field units with realistic goals for allocating assets, by mission  We reported that the Coast Guard’s strategic allocations of assets were based on unrealistic assumptions about the performance capacity of its assets and did not reflect asset condition and unscheduled maintenance  This was due, in part, to the Coast Guard not including information from its field units on the actual performance of its assets  For example, agency officials noted that one of its classes of cutters was 50 years old and these cutters were hampered by mechanical failures requiring emergency dry dock repairs, which resulted in reduced availability to carry out their missions during the year  In another example, a field unit stated that based on historical use, it planned for 575 hours per vessel for one type of cutter instead of the 825 hours performance capacity  Because actual asset use has consistently fallen below asset performance capacities, there is not a direct alignment between the Coast Guard’s strategic operational goals and its prospects for achieving those goals  As a result, the headquarters’ strategic intent, which is based on asset capacity rather than actual performance, did not provide the field with strategic, realistic goals for allocating assets by mission  Agencies should use quality information that is appropriate, current, complete, accurate, accessible, and timely to achieve objectives and address related risks  We recommended that the Coast Guard incorporate field unit input, such as information on assets’ actual performance, to inform more realistic asset allocation decisions  The Coast Guard concurred with this recommendation, and in February 2018 informed us that it plans to address this recommendation through changes to two process documents that are under revision, with an expected completion date in March 2018  Improve performance goal data  In our October 2017 review of Coast Guard performance goals, we reported that the Coast Guard and DHS identified limitations with two of the seven selected performance goals we reviewed, including the five year average number of recreational boating deaths and injuries  In particular, officials believe that many recreational boating injuries that do not require hospitalization are not reported to the Coast Guard  These officials believe that the amount of underreporting may vary over time due to changes in industry trends, making it difficult to accurately determine actual injury rates and program performance  We determined that the data for this performance goal was not sufficiently reliable for the purposes of our reporting objectives due to these likely limitations  We found that the Coast Guard did not report the possible extent of these limitations with this performance goal in its fiscal year 2016 APR  For the other performance goal, the Coast Guard and DHS identified limitations with the number of detected incursions of foreign fishing vessels violating U S  waters, which is publicly reported in DHS’s APR  DHS’s review of this performance goal, reported in August 2015, raised questions about the validity of this goal—that is, whether it provides a useful measure of the Coast Guard’s performance  Specifically, the review noted that this performance goal is intended to measure a deterrence effect, but doing so is inherently difficult and may lead to contradictory interpretations of performance  In October 2017, we found that the data for this performance goal was sufficiently reliable for our reporting objective purposes, but questions remain about its validity  Reliable data is not a useful indication of performance unless it is also a valid representation of the goal being addressed  DHS officials reported that they did not include a discussion of the limitations for this performance goal in DHS’s fiscal year 2015 APR because the performance goal met the minimum threshold for data reliability despite the goal’s limitations  Coast Guard officials reported they were aware of these limitations and were working with DHS and OMB to improve the performance goal and implement corrective actions within 1 to 2 years  We recommended that the Coast Guard assess the extent to which documentation on performance data reliability contains appropriate information on known data reliability limitations and update these documents, as needed, based on the results of the assessment  The Coast Guard concurred and in February 2018, informed us that it had taken initial actions to address our recommendation  However, our preliminary review of these actions indicates that further action will be needed to fully address our recommendation, such as documenting and reporting the limitations of performance data  Our previous reports have identified areas in which the Coast Guard could improve the transparency of its data used for reporting on its mission performance and planning  Improve transparency of data on mission performance  In our October 2017 report on performance goals, we found that the Coast Guard’s APR has not been released publicly since 2011 due to a previous DHS leadership decision  Consequently, there has not been full visibility over performance across all of the Coast Guard’s missions  For example, one of the Coast Guard’s missions—defense readiness—has no goals that are publicly reported or shared with Congress, even though measures related to defense readiness are included in the Coast Guard’s APR  Coast Guard officials stated that they could see the benefit of publicly releasing their APR; however, DHS’s decision to limit the number of performance goals shared publicly has so far deterred the Coast Guard from pursuing the public release of its APR  DHS officials told us that the department is concerned about conflicting information that a component’s APR might present because it is vetted and produced separately from the DHS APR  However, the lack of transparency regarding performance data shared publicly and with Congress can result in an incomplete picture of mission performance and can limit effective oversight of Coast Guard operations  As a result, the public and Congress may be unable to determine the extent to which the Coast Guard is meeting its missions  We recommended that future Coast Guard APRs be available on the Coast Guard’s public website  The Coast Guard concurred with this recommendation and in February 2018, the Coast Guard informed us that it had completed its 2017 APR and are determining an appropriate approach for making it publicly available  Improve capital planning transparency  In our previously issued work on the Coast Guard’s annual 5-year capital investment plan (CIP), we found that the CIP does not consistently reflect current total cost estimates or the effects of tradeoffs that are made as part of the annual budget cycle  We made several recommendations in recent years intended to help the Coast Guard plan for future acquisitions and the difficult tradeoff decisions it will likely face  The Coast Guard generally concurred with these recommendations and is in various stages of implementation  For example, in 2017 we reported that we have made recommendations that DHS and the Coast Guard take several actions to gain an understanding of what the Coast Guard needs to meet its mission within its likely acquisition funding levels  These recommended actions included the Coast Guard: (1) conducting a comprehensive portfolio review across all its acquisitions to develop revised baselines that meet mission needs and reflect realistic funding scenarios and (2) developing a 20-year plan that identifies all necessary recapitalization efforts and any fiscal resources likely necessary to complete these efforts  For example, in 2014 we recommended the Coast Guard develop a 20-year fleet modernization plan that identifies all acquisitions needed to maintain the current level of service and the fiscal resources needed to acquire them  Without these efforts, the Coast Guard will continue, as it has in recent years, to plan its future acquisitions through the annual budgeting process, an approach that has led to delayed and reduced capabilities  In 2016, the Coast Guard revised its 2005 Mission Needs Statement, which provides a basic foundation for long-term investment planning that is to serve as the basis for evaluating the effectiveness of various fleet mixes, and inform the Coast Guard’s CIP  However, the 2016 Mission Needs Statement did not identify specific assets the Coast Guard needs to achieve its missions, nor did it update the annual hours it needs from each asset class to satisfactorily complete its missions  The Coast Guard has stated it is developing a 20-year Long-term Major Acquisition Plan, but it has not stated when the plan will be completed or what will be included in this plan, such as potential trade-offs that could be made across the Coast Guard’s portfolio of acquisitions to better meet mission needs within realistic funding levels  A long-term plan with a tradeoff analysis would facilitate a full understanding of the affordability challenges facing the Coast Guard while it builds the Offshore Patrol Cutter  DHS concurred with our 2014 recommendation, but it is unclear when the Coast Guard plans to complete the 20-year plan  Chairman Hunter, Ranking Member Garamendi, and members of the sub- committee, this completes my prepared statement  I would be happy to respond to any questions you may have at this time  If you or your staff members have any questions about this testimony, please contact Nathan Anderson at (202) 512-3841 or andersonn@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement  Other individuals making key contributions to this work, and the underlying reports on which it is based, include Dawn Hoff (Assistant Director); Andrew Curry (Analyst-in-Charge); Chuck Bausell; David Bieler; Richard Cederholm; John Crawford; Timothy J  DiNapoli; Michele Fejfar; Laurier R  Fish; Peter Haderlein; Eric Hauswirth; Laura Jezewski; Tracey King; Benjamin Licht; Marie A  Mak; Gary Malavenda; Diana Moldafsky; Heidi Nielson; Meg Ullengren; and Kayli Westling  This is a work of the U S  government and is not subject to copyright protection in the United States  The published product may be reproduced and distributed in its entirety without further permission from GAO  However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately 
Report 2:  In this regard, the agencies identified 78,249 IT- related contracts, to which they obligated $14 7 billion in fiscal year 2016  However, we identified 31,493 additional contracts with $4 5 billion obligated, raising the total amount obligated by these agencies to IT contracts in fiscal year 2016 to at least $19 2 billion  Figure 5 reflects the obligations that the 22 selected agencies reported to us relative to the obligations we identified  The percentage of additional IT contract obligations we identified varied among the selected agencies  For example, the Department of State did not identify 1 percent of its IT contract obligations  Conversely, 8 agencies did not identify over 40 percent of their IT contract obligations  Many of the selected agencies that did not identify these IT contract obligations did not follow OMB guidance  Specifically, 14 of the 22 agencies did not involve the acquisition office in their process to identify IT acquisitions for CIO review, as required by OMB  In addition, 7 agencies did not establish guidance to aid officials in recognizing IT  We concluded that until these agencies involve the acquisitions office in their IT acquisition identification processes and establish supporting guidance, they cannot ensure that they will identify all IT acquisitions  Without proper identification of IT acquisitions, these agencies and CIOs cannot effectively provide oversight of these acquisitions  In addition to not identifying all IT contracts, 14 of the 22 selected agencies did not fully satisfy OMB’s requirement that the CIO review and approve IT acquisition plans or strategies  Further, only 11 of 96 randomly selected IT contracts at 10 agencies that we evaluated were CIO-reviewed and approved as required by OMB’s guidance  The 85 IT contracts not reviewed had a total possible value of approximately $23 8 billion  We believe that until agencies ensure that CIOs are able to review and approve all IT acquisitions, CIOs will continue to have limited visibility and input into their agencies’ planned IT expenditures and will not be able to use the increased authority that FITARA’s contract approval provision is intended to provide  Further, agencies will likely miss an opportunity to strengthen CIOs’ authority and the oversight of IT acquisitions  As a result, agencies may award IT contracts that are duplicative, wasteful, or poorly conceived  As a result of these findings, we made 39 recommendations in our January 2018 report  The recommendations included that agencies ensure that their acquisition offices are involved in identifying IT acquisitions and issuing related guidance, and that IT acquisitions are reviewed in accordance with OMB guidance  OMB and the majority of the agencies generally agreed with or did not comment on the recommendations  In our February 2017 high-risk update, we stated that OMB and agencies needed to demonstrate additional progress on achieving data center consolidation savings in order to improve the management of IT acquisitions and operations  Further, data center consolidation efforts are key to implementing FITARA  Specifically, OMB established the FDCCI in February 2010 to improve the efficiency, performance, and environmental footprint of federal data center activities  The enactment of FITARA in 2014 codified and expanded the initiative  In a series of reports that we issued from July 2011 through August 2017, we noted that, while data center consolidation could potentially save the federal government billions of dollars, weaknesses existed in several areas, including agencies’ data center consolidation plans, data center optimization, and OMB’s tracking and reporting on related cost savings  In these reports, we made a total of 160 recommendations to OMB and 24 agencies to improve the execution and oversight of the initiative  Most agencies and OMB agreed with our recommendations or had no comments  As of May 2018, 80 of these 160 recommendations remained unimplemented  Further, we recently reported in May 2018 that the 24 agencies participating in OMB’s Data Center Optimization Initiative (DCOI) had communicated mixed progress toward achieving OMB’s goals for closing data centers by September 2018  Over half of the agencies reported that they had either already met, or planned to meet, all of their OMB- assigned goals by the deadline  This would result in the closure of 7,221 of the 12,062 centers that agencies reported in August 2017  However, 4 agencies reported that they do not have plans to meet all of their assigned goals and 2 agencies are working with OMB to establish revised targets  With regard to agencies’ progress in achieving cost savings, 24 agencies reported $3 9 billion in cost savings through 2018  The 24 agencies also reported limited progress against OMB’s five data center optimization targets for server utilization and automated monitoring, energy metering, power usage effectiveness, facility utilization, and virtualization  As of August 2017, 1 agency reported that it had met four targets, 1 agency reported that it had met three targets, 6 agencies reported having met either one or two targets, and 14 agencies reported meeting none of the targets  Further, as of August 2017, most agencies were not planning to meet OMB’s fiscal year 2018 optimization targets  Specifically, 4 agencies reported plans to meet all of their applicable targets by the end of fiscal year 2018; 14 agencies reported plans to meet some of the targets; and 4 reported that they did not plan to meet any targets  Figure 6 summarizes agency-reported plans to meet or exceed the OMB’s data center optimization targets, as of August 2017  In 2016 and 2017, we made 81 recommendations to OMB and the 24 DCOI agencies to help improve the reporting of data center-related cost savings and to achieve optimization targets  As of May 2018, 71 of these 81 recommendations have not been fully addressed  In our 2015 high-risk report’s discussion of IT acquisitions and operations, we identified the management of software licenses as an area of concern, in part because of the potential for cost savings  Federal agencies engage in thousands of software licensing agreements annually  The objective of software license management is to manage, control, and protect an organization’s software assets  Effective management of these licenses can help avoid purchasing too many licenses, which can result in unused software, as well as too few licenses, which can result in noncompliance with license terms and cause the imposition of additional fees  As part of its PortfolioStat initiative, OMB has developed policy that addresses software licenses  This policy requires agencies to conduct an annual, agency-wide IT portfolio review to, among other things, reduce commodity IT spending  Such areas of spending could include software licenses  In May 2014, we reported on federal agencies’ management of software licenses and determined that better management was needed to achieve significant savings government-wide  Of the 24 selected agencies we reviewed, only 2 had comprehensive policies that included the establishment of clear roles and central oversight authority for managing enterprise software license agreements, among other things  Of the remaining 22 agencies, 18 had policies that were not comprehensive, and 4 had not developed any policies  Further, we found that only 2 of the 24 selected agencies had established comprehensive software license inventories, a leading practice that would help them to adequately manage their software licenses  The inadequate implementation of this and other leading practices in software license management was partially due to weaknesses in agencies’ policies  As a result, we concluded that agencies’ oversight of software license spending was limited or lacking, thus potentially leading to missed savings  However, the potential savings could be significant considering that, in fiscal year 2012, 1 major federal agency reported saving approximately $181 million by consolidating its enterprise license agreements, even when its oversight process was ad hoc  Accordingly, we recommended that OMB issue a directive to help guide agencies in managing software licenses  We also made 135 recommendations to the 24 agencies to improve their policies and practices for managing licenses  Among other things, we recommended that the agencies regularly track and maintain a comprehensive inventory of software licenses and analyze the inventory to identify opportunities to reduce costs and better inform investment decision making  Most agencies generally agreed with the recommendations or had no comments  As of May 2018, 78 of the 135 recommendations had not been implemented  Table 2 reflects the extent to which the 24 agencies implemented the recommendations in these two areas  Since information security was added to the high-risk list in 1997, we have consistently identified shortcomings in the federal government’s approach to cybersecurity  We have previously testified that, even though agencies have acted to improve the protections over federal and critical infrastructure information and information systems, the federal government needs to take the following actions to strengthen U S  cybersecurity: Effectively implement risk-based entity-wide information security programs consistently over time  Among other things, agencies need to (1) implement sustainable processes for securely configuring operating systems, applications, workstations, servers, and network devices; (2) patch vulnerable systems and replace unsupported software; (3) develop comprehensive security test and evaluation procedures and conduct examinations on a regular and recurring basis; and (4) strengthen oversight of contractors providing IT services  Improve its cyber incident detection, response, and mitigation capabilities  DHS needs to expand the capabilities and support wider adoption of its government-wide intrusion detection and prevention system  In addition, the federal government needs to improve cyber incident response practices, update guidance on reporting data breaches, and develop consistent responses to breaches of personally identifiable information  Expand its cyber workforce planning and training efforts  The federal government needs to (1) enhance efforts for recruiting and retaining a qualified cybersecurity workforce and (2) improve cybersecurity workforce planning activities  Expand efforts to strengthen cybersecurity of the nation’s critical infrastructures  The federal government needs to develop metrics to (1) assess the effectiveness of efforts promoting the National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity and (2) measure and report on the effectiveness of cyber risk mitigation activities and the cybersecurity posture of critical infrastructure sectors  Better oversee protection of personally identifiable information  The federal government needs to (1) protect the security and privacy of electronic health information, (2) ensure privacy when face recognition systems are used, and (3) protect the privacy of users’ data on state-based health insurance marketplaces  As we have previously noted, in order to take the preceding actions and strengthen the federal government’s cybersecurity posture, agencies should implement the information security programs required by FISMA  In this regard, FISMA provides a framework for ensuring the effectiveness of information security controls for federal information resources  The law requires each agency to develop, document, and implement an agency- wide information security program  Such a program includes risk assessments; the development and implementation of policies and procedures to cost-effectively reduce risks; plans for providing adequate information security for networks, facilities, and systems; security awareness and specialized training; the testing and evaluation of the effectiveness of controls; the planning, implementation, evaluation, and documentation of remedial actions to address information security deficiencies; procedures for detecting, reporting, and responding to security incidents; and plans and procedures to ensure continuity of operations  Since 2010, we have made 2,733 recommendations to agencies aimed at improving the security of federal systems and information  These recommendations have identified actions for agencies to take to strengthen technical security controls over their computer networks and systems  They also have included recommendations for agencies to fully implement aspects of their information security programs, as mandated by FISMA  Nevertheless, many agencies continue to be challenged in safeguarding their information systems and information, in part because many of these recommendations have not been implemented  As of May 2018, 793 of information security-related recommendations we have made have not been implemented  In order to determine the effectiveness of the agencies’ information security programs and practices, FISMA requires that federal agencies’ inspectors general conduct annual independent evaluations  The agencies are to report the results of these evaluations to OMB, and OMB is to summarize the results in annual reports to Congress  In these evaluations, the inspectors general frame the scope of their analysis, identify key findings, and detail recommendations to address the findings  The evaluations also are to capture maturity model ratings for their respective agencies  Toward this end, in fiscal year 2017, the inspector general community, in partnership with OMB and DHS, finalized a 3-year effort to create a maturity model for FISMA metrics that align to the five function areas in the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework): identify, protect, detect, respond, and recover  This alignment is intended to help promote consistent and comparable metrics and criteria and provides agencies with a meaningful independent assessment of their information security programs  This maturity model is designed to summarize the status of agencies’ information security programs on a five-level capability maturity scale  The five maturity levels are defined as follows: Level 1 Ad-hoc: Policies, procedures, and strategy are not formalized; activities are performed in an ad-hoc, reactive manner  Level 2 Defined: Policies, procedures, and strategy are formalized and documented but not consistently implemented  Level 3 Consistently Implemented: Policies, procedures, and strategy are consistently implemented, but quantitative and qualitative effectiveness measures are lacking  Level 4 Managed and Measurable: Quantitative and qualitative measures on the effectiveness of policies, procedures, and strategy are collected across the organizations and used to assess them and make necessary changes  Level 5 Optimized: Policies, procedures, and strategy are fully institutionalized, repeatable, self-generating, consistently implemented and regularly updated based on a changing threat and technology landscape and business/mission needs  In March 2018, OMB issued its annual FISMA report to Congress, which showed the combined results of the inspectors general’s fiscal year 2017 evaluations  Based on data from 76 agency inspector general and independent auditor assessments, OMB determined that the government-wide median maturity model ratings across the five NIST Cybersecurity Framework areas did not exceed a level 3 (consistently implemented)  Table 3 shows the inspectors general’s median ratings for each of the NIST Cybersecurity Framework areas  In its efforts toward strengthening the federal government’s cybersecurity, OMB also requires agencies to submit related cybersecurity metrics as part of its Cross-Agency Priority goals  In particular, OMB developed the IT modernization goal so that federal agencies will be able to build and maintain more modern, secure, and resilient IT  A key part of this goal is to reduce cybersecurity risks to the federal mission through three strategies: manage asset security, protect networks and data, and limit personnel access  The key targets supporting each of these strategies correspond to areas within the FISMA metrics  Table 4 outlines the strategies and their associated targets  In conclusion, FITARA and FISMA present opportunities for the federal government to address the high-risk areas on improving the management of IT acquisitions and operations, and ensuring the security of federal IT, thereby saving billions of dollars  Most agencies have taken steps to execute key IT management and cybersecurity initiatives, including implementing CIO responsibilities, requiring CIO review of IT acquisitions, realizing data center consolidation cost savings, managing software assets, and complying with FISMA requirements  The agencies have also continued to address the recommendations that we have made over the past several years  However, further efforts by OMB and federal agencies to implement our previous recommendations would better position them to improve the management and security of federal IT  To help ensure that these efforts succeed, we will continue to monitor agencies’ efforts toward implementing these recommendations  Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, and Members of the Subcommittees, this completes my prepared statement  I would be pleased to respond to any questions that you may have at this time  If you or your staff have any questions about this testimony, please contact David A  Powner, Director, Information Technology, at (202) 512- 9286 or pownerd@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement  GAO staff who made key contributions to this testimony are Kevin Walsh (Assistant Director), Chris Businsky, Rebecca Eyler, Meredith Raymond, and Jessica Waselkow (Analyst in Charge)  This is a work of the U S  government and is not subject to copyright protection in the United States  The published product may be reproduced and distributed in its entirety without further permission from GAO  However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately 

ground_truth: Safety incidents in recent years on WMATA's rail system have raised questions about its processes for performing critical maintenance and replacing capital assets. WMATA initiated a new preventive maintenance program for its rail track in 2017, and is currently implementing a new capital planning process. GAO was asked to examine issues related to WMATA's capital funding and maintenance practices. This report examines: (1) how WMATA spent its capital funds from fiscal years 2011 through 2017, (2) how WMATA's new capital planning process addresses weaknesses it identified in the prior process, and (3) WMATA's progress toward its track preventive maintenance program's goals and how the program aligns with leading program management practices. GAO analyzed WMATA's financial and program information, interviewed officials of WMATA, the Federal Transit Administration, and five transit agencies selected for similarities to WMATA. GAO compared WMATA's capital planning process and track maintenance program with leading practices. From fiscal years 2011 through 2017, the Washington Metropolitan Area Transit Authority (WMATA) spent almost $6 billion on a variety of capital assets, with the largest share spent on improving its rail and bus fleet (see figure). Over this period, WMATA's capital spending was, on average, about $845 million annually. WMATA's new capital planning process could address some weaknesses it identified in the prior process. WMATA established a framework for quantitatively prioritizing capital needs (investments to a group of related assets) over a 10-year period. However, WMATA has not established documented policies and procedures for implementing the new process, such as those for selecting specific projects for funding in its annual capital budget. WMATA is currently using its new capital planning process to make fiscal year 2020 investment decisions. WMATA has proposed a fiscal year 2020 capital budget of $1.4 billion. Without documented policies and procedures for implementing the new planning process, WMATA's stakeholders do not have reasonable assurance that WMATA is following a sound process for making investment decisions. WMATA has made significant progress toward its track preventive maintenance program's goals, which are to reduce both track-defect and electrical-fire incidents by 50 percent in fiscal year 2019 compared with 2017. In fiscal year 2018, WMATA met its goal for reducing track defect incidents and reduced electrical fire incidents by 20 percent. However, in designing the program, WMATA did not fully assess risks. For example, WMATA did not quantitatively assess the impact of track defects or electrical fires on its ability to provide service, nor did it consider other risks such as non-electrical track fires, which represent about 30 percent of all fires on the system, or other factors, such as resources or track time. Without a comprehensive risk assessment, WMATA lacks reasonable assurance that the program is designed to address risks affecting the safety of the rail system or other risks that could hinder the new program's success. GAO is making five recommendations, including that WMATA establish documented policies and procedures for the new capital planning process and conduct a comprehensive risk assessment for the track preventive maintenance program. WMATA described actions planned or underway to address GAO's recommendations. GAO believes the recommendations should be fully implemented, as discussed in the report.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: WMATA was created in 1967 through an interstate compact—matching legislation passed by the District of Columbia, state of Maryland, and Commonwealth of Virginia, and then ratified by Congress—to plan, develop, finance, and operate a regional transportation system in the National Capital area  A board of eight voting directors and eight alternate directors governs WMATA  The directors are appointed by the District of Columbia, Virginia, Maryland, and the federal government, with each appointing two voting and two alternate directors  WMATA operates six rail lines—the Red, Orange, Blue, Green, Yellow, and Silver Lines—connecting various locations within the District of Columbia, Maryland, and Virginia  WMATA’s rail system has 118 linear miles of guideway: 51 miles of subway, 58 miles at ground level, and 9 miles on aerial structures  WMATA’s capital investments are funded through multiple sources  These include a combination of grants it receives from the federal government, along with matching funds and other contributions it receives from the states and local jurisdictions in which it operates (see fig  1)  From fiscal years 2011 through 2017, WMATA received about $5 8 billion in capital funding  Over half of this funding came from the federal government ($3 2 billion), and state and local jurisdictions provided 41 percent ($2 4 billion)  WMATA also took on about $230 million in long- term debt to finance its capital program during this time period  The federal funding included grant awards, in addition to annual appropriations authorized under PRIIA  In 2008, PRIIA authorized $1 5 billion to WMATA, available in increments over 10 years beginning in fiscal year 2009, or until expended, for capital improvements and preventive maintenance  PRIIA funding and certain federal grants require state or local jurisdictions to provide matching funds  Additionally, a large portion of funding from state and local jurisdictions is governed by capital-funding agreements, which are periodically negotiated between WMATA and the states and localities  From fiscal years 2011 through 2017, state and local jurisdictions contributed on average about $340 million annually to WMATA, generally for capital purposes  The annual capital contributions from the jurisdictions are expected to more than double as a result of the recent legislation enacted by the District of Columbia, Maryland, and Virginia in 2018  In addition, WMATA officials told us that it will have the ability to further leverage this dedicated funding and issue debt to finance its capital projects  WMATA has several steps in its capital planning process  These include developing the following: Capital Needs Inventory  WMATA periodically identifies its capital investment needs in this inventory  WMATA issued a Capital Needs Inventory in February 2010 and another in November 2016, each covering a 10-year period  According to WMATA, Capital Needs Inventories help inform the annual capital budget and capital improvement program  Annual Capital Budget  Each year, WMATA prepares an annual capital budget, which identifies projects WMATA plans to undertake in the next fiscal year  WMATA’s fiscal year 2019 annual capital budget was approved by the board of directors at $1 3 billion  Six-Year Capital Improvement Program  Within WMATA’s annual capital budget, WMATA includes a Six-Year Capital Improvement Program identifying capital projects WMATA plans to implement over a 6-year period  WMATA’s most recent Six-Year Capital Improvement Program (covering the fiscal year 2019—2024 period) was approved by the board of directors at $8 5 billion  According to WMATA officials, WMATA is currently implementing a new capital planning process through which it will develop its fiscal year 2020 Capital Budget and fiscal year 2020-2025 Six-Year Capital Improvement Program  WMATA adopts and implements the capital budget by June 30 for the new fiscal year, which begins on July 1  The fiscal year 2020 Capital Budget is scheduled to be adopted and implemented by June 30, 2019  Among other things, the goals and objectives of this new capital planning process are to construct an objective, data-driven, and risk-based approach to estimate major rehabilitation and capital asset replacement needs; build a capital investment prioritization methodology aligned with WMATA’s strategic goals and grounded in asset inventory and condition assessments; and develop a process that will support the construction and ongoing stewardship of its Transit Asset Management Plan  The latter is discussed in more detail below  WMATA has also recently undertaken efforts to address issues related to the condition and maintenance of its track  After SafeTrack concluded in June 2017, WMATA implemented what officials describe as its first track preventive maintenance program designed to incorporate industry-wide best practices related to track maintenance, in order to improve the rail system’s long-term safety and reliability  The new program commenced in June 2017, and WMATA’s board reduced late-night service to allow for longer maintenance work hours  To make the best use of the extra maintenance hours, WMATA focused its new program on six separate initiatives that together would address what WMATA viewed as its two most pressing track maintenance concerns—electrical fires caused by cable and insulator defects along the track wayside, and defects to the track itself, including unsecured rail fasteners and worn track switches (see table 1)  These initiatives are planned to cover the entire transit system and will take various amounts of time to complete  FTA also plays a role in WMATA activities by providing and directing the use of federal funds, overseeing safety, and requiring transit asset management  FTA provides grants that support capital investment in public transportation, consistent with locally developed transportation plans, and has provided such funding to WMATA as noted above  Additionally, though states play a role in safety oversight of rail transit systems through state safety oversight programs, FTA also has the authority to conduct various safety oversight activities such as inspections and investigations  Furthermore, FTA has the authority to assume temporary, direct safety oversight of a rail transit system if it finds the state safety oversight program is inadequate, among other things  After FTA conducted a safety management inspection and issued a safety directive with 91 required actions, it found WMATA’s state safety- oversight program to be inadequate and assumed direct safety-oversight of WMATA in October 2015  Finally, FTA is responsible for assisting public transportation systems to achieve and maintain their infrastructure, equipment, and vehicles in a state of good repair  Specifically, in July 2016, FTA issued regulations establishing a National Transit Asset Management System  Applicable transit agencies were required to have an initial transit asset management plan completed by October 1, 2018  For “tier I providers,” such as WMATA, this plan is to contain nine elements, including an inventory of the number and type of capital assets, and a condition assessment of those inventoried assets for which a provider has direct capital responsibility  WMATA completed its Transit Asset Management plan, dated October 1, 2018  This plan outlines WMATA’s policy, approach, and targeted actions to improve its asset management practices over the next 4 years  WMATA expends its capital funds on a variety of capital assets as part of its capital budget and Capital Improvement Program  From fiscal year 2011 through 2017, WMATA expended approximately $5 9 billion on capital investments  Of this amount, WMATA expended the largest portion on assets related to the replacement, rehabilitation, and maintenance of its revenue vehicles (railcars, buses, and vans) and lesser amounts on other categories of assets, as discussed below and shown in figure 2  Rail and Bus Vehicle Fleet: WMATA expended approximately $2 16 billion (36 percent) of the total $5 9 billion on projects related to its rail and bus fleet from fiscal years 2011 through 2017  The $2 16 billion included approximately $1 1 billion (51 percent) on replacing, expanding, and rehabilitating its rail fleet and approximately $956 million (44 percent) on its bus fleet  According to WMATA, it initiated its railcar replacement program in 2005 to increase capacity and reduce maintenance costs  In addition, a June 2009 Red Line collision of two trains near Fort Totten resulted in nine deaths and led the NTSB to recommend that WMATA retire and replace all 1000 series railcars  From fiscal year 2011 through 2017, WMATA expended almost $656 million on replacing these and other railcars and expanding its overall fleet  This effort includes WMATA’s planned purchase of a total of 748 new 7000-series railcars (see fig  3)  Approximately $530 million was expended on replacing vehicles from fiscal years 2015 through 2017  For example, in fiscal year 2017 WMATA accepted delivery of about 50 percent (364 railcars) of its planned purchase of 748, 7000-series railcars  WMATA expects to complete its current railcar replacement program by fiscal year 2024, with an estimated total program cost of about $1 7 billion  Fixed Rail Infrastructure: WMATA expended about $1 23 billion of the total $5 9 billion (21 percent) to maintain its fixed-rail infrastructure  Of this $1 23 billion, WMATA expended about $650 million (53 percent) on rail infrastructure and rehabilitation projects and $573 million (47 percent) on improvements to its track and structures (e g , bridges and tunnels)  According to WMATA, the rail infrastructure and rehabilitation projects began in 2009 and were the first comprehensive rehabilitation of WMATA’s rail infrastructure in its history  Typical projects included rehabilitating WMATA’s water drainage pumps and tunnel ventilation, fire, and communications systems, among other things  WMATA work related to track and structures involved the maintenance and rehabilitation of the steel rail that guides railcars, the cross ties and fasteners that hold the rail in place, the third rail that provides power to trains, and the bridges and tunnels the track runs on or through  The share of WMATA’s total capital expenditures going to track and structures increased from about $80 million in fiscal year 2016 to $158 million in fiscal year 2017  This expenditure was primarily to implement SafeTrack  Maintenance Facilities and Equipment: WMATA expended approximately $1 1 billion of the total $5 9 billion (19 percent) on assets related to maintenance facilities and equipment, which include rail yards, bus garages, and equipment used to rehabilitate and maintain WMATA’s track and vehicle fleet  For example, from fiscal years 2011 through 2017 WMATA expended approximately $75 million in constructing the Cinder Bed Road bus maintenance facility in Lorton, Virginia  Passenger and Other Facilities: WMATA expended about $814 million of the total $5 9 billion (14 percent) on passenger, business, and security support facilities  Such facilities include rail and bus stations, police facilities, and elevator and escalator rehabilitation  Business Systems and Project Management Support: WMATA also expended about $628 million of the total $5 9 billion (11 percent) on assets related to operations and business support software and equipment  From fiscal years 2011 through 2017, WMATA frequently over-estimated in its annual budgets the annual amount of capital investments it could implement (see fig 4)  Out of the approximately $7 5 billion that WMATA budgeted for capital investments over this period, it expended approximately $5 9 billion (80 percent)  WMATA’s ability to fully expend its capital budget has varied from year to year  Specifically, WMATA expended about 65 percent ($700 million) of its $1 1 billion capital budget in fiscal year 2015, compared with 85 percent ($1 1 billion) of its $1 2 billion capital budget in fiscal year 2016  In fiscal year 2017, WMATA expended nearly 100 percent of its $1 18 billion capital budget  WMATA attributed the increased expenditures to intensified efforts to address deferred maintenance, primarily through the SafeTrack initiative and an increased delivery and acceptance rate for the new 7000-series railcars, among other things  The total amount expended in fiscal year 2017 to replace the older railcars with new vehicles totaled about $335 million  According to WMATA, there are a number of reasons why it has not fully expended its capital budget in any given year: Contracting and Scheduling Issues: WMATA officials stated that there were contract and scheduling delays in the implementation of planned capital projects  For example, WMATA officials said contracts were sometimes not executed during the fiscal year in which funds were originally budgeted for the work, and in other instances contract work was not carried out according to schedule and expenditures were delayed  Changing Priorities: WMATA officials stated that in some instances, the reevaluation and reprioritization of contracted projects affected WMATA’s ability to expend its capital budget  In such cases, new capital needs were sometimes identified and prioritized over other needs, which caused delays in work schedules and potential financial claims by contractors due to delays  For example, WMATA stated that in fiscal year 2011 the initiation of the Red Line rehabilitation program was delayed as a result of the prioritization of the safety needs in response to the 2009 Fort Totten accident  Federal Reimbursement Restrictions: WMATA officials cited FTA restrictions on its reimbursement of federal funds between fiscal years 2014 and 2015 as a reason for its inability to expend budgeted capital funds in those years  In a financial management oversight review completed by FTA in 2014, FTA found material weaknesses and significant deficiencies in WMATA’s financial management controls, policies, and procedures regarding its receipt of federal grant funds  Based on these preliminary findings, FTA restricted WMATA’s ability to automatically access federal grant reimbursements until WMATA undertook corrective actions  During these years, WMATA reported its management slowed expenditures on targeted capital projects due to concerns over reimbursement of grants  By October 2017, after WMATA implemented an action plan to improve its financial controls, FTA reinstated WMATA’s ability to automatically receive all awarded federal funds on a regular schedule  Unpredictable Funding: WMATA officials stated that unpredictable funding affected the level of its capital expenditures from year to year  Since WMATA had multi-year capital projects with multi-year procurements, according to WMATA officials, uncertainty with regard to how much capital funding would be received on an annual basis affected the implementation of projects  Inadequate Capital Planning Process: WMATA attributed some of its inability to expend budgeted capital funds to the absence of a uniform and efficient capital planning process  According to WMATA, it lacked formal procedures to initiate projects and newer projects often experienced delays in implementation, which delayed expenditures on these projects  Later in this report, we discuss WMATA’s efforts to develop a new capital planning process  Although WMATA expended more of its capital budget in fiscal year 2017 than it had in prior years, it estimated that capital spending will need to increase even more to address state-of-good-repair needs  In 2016, WMATA projected that its state-of-good-repair needs amounted to about $17 4 billion from 2017 through 2026  This level is almost $10 billion more than WMATA estimated for its state-of-good-repair needs from 2011 through 2020 in its February 2010 Capital Needs Inventory  WMATA officials attributed the increase to a capital planning process insufficient to identify capital needs and an increase in cost of needs that were previously unmet  In addition, WMATA officials said the quality and quantity of asset data had improved over time  To address its state-of- good-repair needs, in November 2016 WMATA estimated that it will need to expend about $1 74 billion annually on capital expenditures from 2017 through 2026  This is more than twice the $845 million average annual capital expenditures from fiscal year 2011 through fiscal year 2017  WMATA’s new capital planning process could address some of the weaknesses it identified in the previous process, such as better distinguishing capital needs (investments in groups of related assets) from capital projects (investments in specific assets)  However, WMATA has not established documented policies and procedures to guide the developed performance measures to assess capital projects and the capital planning process; and developed a plan to obtain complete information about the inventory and condition of WMATA assets  These remaining weaknesses could hinder sound capital investment decisions  WMATA’s new capital planning process could facilitate better identification of capital investment needs  Leading practices for capital planning, among other things, call for an organization to conduct a comprehensive assessment of its needs to meet its mission  WMATA uses the Capital Needs Inventory to assess its capital needs over a 10- year period across its various assets and help identify specific projects to include on subsequent capital improvement programs  In November 2016, WMATA issued its most recent Capital Needs Inventory, covering calendar year 2017 through 2026, and reported there were weaknesses and limitations in the process used to prepare the previous Capital Needs Inventory, issued in 2010  Those weaknesses and the actions WMATA has taken to address them include the following: Distinguishing capital needs from capital projects  WMATA reported in 2016 that the 2010 Capital Needs Inventory was primarily a list of proposed projects and did not provide proper attention to evaluating WMATA’s overall asset needs and the readiness of projects for programming in the capital improvement program  WMATA has taken actions to potentially address this weakness  In April 2016, WMATA issued a policy/instruction document that established policies and procedures for preparing capital needs inventories  This document defined the process for capital needs identification and established a framework evaluating and prioritizing capital investment needs  Among other things, this framework requires that WMATA departments develop capital needs justification packages and that these packages be reviewed by the Capital Program Advisory Committee for completeness and accuracy before being forwarded for further review  The guidance also requires that WMATA’s strategic objectives be considered when identifying and prioritizing capital projects  Qualitative rather than quantitative prioritization of needs  In 2016, WMATA reported that the prioritization of capital needs in the 2010 Capital Needs Inventory was primarily based on qualitative assessments by management rather than being driven by quantitative information and condition assessments  According to WMATA, the 2010 Capital Needs Inventory was largely based on the professional judgment of staff in consideration of WMATA’s strategic goals but was not data-driven  WMATA has taken actions to address this weakness by issuing a policy that requires WMATA’s senior management serving on the Capital Program Advisory Committee to use a more quantitative-based capital prioritization formula in preparing the Capital Needs Inventory  For example, the November 2016 Capital Needs Inventory used a quantitative approach to rank and prioritize capital needs  This approach included the use of four criteria—asset condition, safety and security, service delivery, and ridership impact— to numerically score capital needs and WMATA then used a risk- based weighting approach to combine these criteria into a single overall prioritization score  While WMATA has addressed some weaknesses it identified in its prior planning, it has not established documented policies and procedures to guide the annual capital planning process, or developed measures to assess capital project and program performance and a plan to obtain complete information on its assets and their physical condition  Although WMATA established policies and procedures for prioritizing capital needs—that is, investments in groups of related assets—for the 2016 Capital Needs Inventory, it has not established documented policies and procedures for the new capital planning process, including how WMATA will rank and select individual projects to address those needs through its annual capital budgets and Six-Year Capital Improvement Program  For example, through its Capital Needs Inventory WMATA stated it needed to invest $17 4 billion over a 10-year period to address its state-of-good-repair needs, including replacing vehicles, rehabilitating stations, and investing in other types of assets  WMATA uses the annual capital budget and Six-Year Capital Improvement Program to identify the specific projects to be funded to meet the 10-year investment needs  However, because WMATA has not established documented policies and procedures for the new capital planning process, it has not yet identified the specific methodologies to rank and select projects for funding on an annual basis  According to WMATA officials, the legacy annual capital planning process was based on implementing the list of projects that resulted from its 2010 Capital Needs Inventory and WMATA did not have a documented capital planning process that it followed on an annual basis  WMATA officials told us that the legacy capital planning process was “ad hoc” in nature, in part because WMATA was reacting to emergencies  For example, because WMATA needed to address the NTSB recommendation to replace the 1000-series railcars and address FTA safety directives after the 2015 smoke incident at the L’Enfant Plaza Station, it did not adhere to a formal annual-planning process  The COSO internal control standards point out the importance of organizations documenting their processes to facilitate retention and sharing of organizational knowledge  Leading practices contained in the Executive Guide also recommend that organizations have defined processes for ranking and selecting projects for capital funding  In addition, the Executive Guide noted that organizations find it beneficial to rank projects because the number of requested projects often exceeds available funding  Officials from all five of the peer transit agencies we spoke with told us they had or planned to develop documented processes for making capital investment decisions  For example, officials from four of the five peer transit agencies we spoke with said they use a project scoring and ranking system in their capital planning process, and officials from the fifth agency told us it plans to develop such a system  Officials from one agency provided us with its project evaluation and scoring system that assigns scores using eight selection criteria that are tied to the agency’s strategic business plan and state priorities  The selection criteria include such things as system preservation, safety, and cost-effectiveness  Officials from another agency told us they use an analytical tool to score projects and that every project (new or existing) gets re-scored annually  As a result of WMATA not having documented policies and procedures for its capital planning process, it is unclear how important parts of the process will work and the basis for WMATA’s investment decisions  WMATA has outlined some high-level policies for the capital planning process and prepared limited guidance for certain parts of the process  For example, WMATA officials told us that its recently issued Transit Asset Management Plan contains asset management policies that address the ranking and selecting of capital projects  Although the Transit Asset Management Plan discusses the process for estimating and prioritizing capital needs and, which are precursors of projects, the plan does not specifically address how projects would be selected for annual capital budgets and the capital improvement program  In addition, WMATA developed limited guidance for staff to use in developing new capital projects  Under this guidance, capital funds could be provided to evaluate, plan, and develop projects  While this guidance may be useful for developing projects, it does not establish the policies and procedures WMATA will follow to decide which projects will be funded through the annual capital budget and the capital improvement program  Further, the documentation prepared by WMATA to date does not establish policies and procedures for the entire capital planning process and how decisions will be made throughout the process  WMATA reported in its fiscal year 2019 annual budget that it had created a capital program manual that identifies the roles, responsibilities, processes, and calendars of events to inform the fiscal year 2020 capital program  WMATA officials told us that the previous Director of the Capital Planning and Program Management Department had included this information in the draft budget proposal when these documents were being developed  However, WMATA officials told us that these documents were not completed, and that the information was mistakenly not removed from the budget before the previous director of the department left the agency  WMATA officials told us they plan to formalize policies, procedures, and manuals for the fiscal year 2021–2026 capital-investment program cycle  The current leadership of the Capital Planning and Program Management Department told us that given the time-constraints facing WMATA in the current fiscal year 2020 planning cycle, WMATA decided not to formally document the new capital planning process until after WMATA has had a chance to test it through the current planning cycle to see how it works  According to the official, the department’s leadership has instructed staff to document steps taken in implementing the new process so that WMATA will have the opportunity to learn from the new process and make necessary changes before developing formal, written procedures that will guide future planning cycles  Although delaying formal development of policies and procedures may provide an opportunity to learn from the process while implementing it, it does not provide the guidance necessary now as WMATA uses its new capital planning process to develop the fiscal year 2020 capital program  In particular, because WMATA has not established policies and procedures for ranking and selecting projects, WMATA does not have a framework or clear criteria for programming projects in the annual capital budget for fiscal year 2020  WMATA has proposed a fiscal year 2020 capital budget of $1 4 billion  In addition, WMATA’s plan to document steps taken in implementing the new process as it is occurring does not provide reasonable assurance that WMATA is making decisions using a consistent process to direct investments toward WMATA’s highest priority needs  A consistent process is all the more important to ensure that WMATA does not continue to use an ad-hoc process for capital investment decisions, as it did in its legacy process  WMATA’s annual capital spending is anticipated to increase substantially over the fiscal year 2020-2025 period, as WMATA expects to be programing the additional $500 million annually for capital purposes committed by the District of Columbia, Maryland, and Virginia  Without a documented planning process that includes procedures for ranking and selecting projects for funding in the fiscal year 2020 capital budget, WMATA’s stakeholders lack reasonable assurance that WMATA’s capital investment decisions will be made using a sound and transparent process  WMATA has also not developed performance measures to assess capital projects and the capital planning process  Leading practices from the Executive Guide suggest that one way to determine if a capital investment achieved the benefits that were intended when it was selected is to evaluate its performance using measures that reflect a variety of outcomes and perspectives  By looking at a mixture of measures, such as financial improvement and customer satisfaction, managers can assess performance based on a comprehensive view of the needs and objectives of the organization  Leading organizations we studied in preparing the Executive Guide, such as private sector companies, use financial and non-financial criteria for success that are tied to organizational goals and objectives  According to the Executive Guide, project-specific performance measures are then used to develop unit performance measures and goals, which are ultimately used to determine how well an organization is meeting its goals and objectives  WMATA officials told us they have not developed performance measures for assessing the performance of individual projects or the capital planning process as a whole  One WMATA official told us that WMATA would like to evaluate results of the new capital planning process to determine whether organizational goals have been met  The official suggested that WMATA would work with a consultant to demonstrate a linkage between capital planning goals and WMATA’s organizational goals  However, the official did not indicate when this step would occur or provide additional information  Moreover, it is unclear whether the official’s intentions for this effort would result in measures for assessing individual projects as well as the overall capital planning process  By developing measures, WMATA will be better positioned to assess whether specific capital investments met their intended outcomes or if the capital planning process itself is helping WMATA achieve its strategic goals and objectives and effectively using taxpayer funds  WMATA also does not have a complete inventory or physical condition assessments of its assets  Leading practices for good capital decision- making call for organizations to conduct a comprehensive assessment of their needs and identify the organization’s capabilities to meet these needs  This process includes taking an inventory of assets and their condition and assessing where there are gaps in meeting organizational needs  The Transit Cooperative Research Program has also identified asset inventory and condition assessments as the first step in determining what asset rehabilitations and replacements are needed as transit providers address their state-of-good-repair requirements  Asset inventories and condition assessments provide critical information for capital-investment decision making  WMATA has initiated various efforts to obtain better information about its assets and their condition  These efforts have included: Transit Asset Inventory and Condition Assessment Project  In 2016, WMATA began this project to provide a physical inventory of WMATA assets and their condition, in part to comply with FTA’s Transit Asset Management regulations  According to WMATA, this project was to be the cornerstone in ensuring a complete, consistent, accurate, and centralized repository of relevant asset-related data  However, WMATA officials said that the project primarily focused on obtaining an inventory and condition assessment of WMATA facilities and equipment  A February 2018 WMATA memo to senior management stated that even when the project was completed, WMATA would still lack a robust database of track, guideway, infrastructure (e g , tunnels and bridges), systems, and communication assets—elements that the November 2016 Capital Needs Inventory noted were the largest gaps in the asset information used to support capital needs forecasting  According to WMATA, this project produced inventory and condition assessments for about 30 percent of WMATA’s asset base  As of October 2018, WMATA considered the project complete since it provided information to help prepare WMATA’s completed Transit Asset Management Plan, dated October 1, 2018  WMATA officials noted that they will continue to develop their asset inventories and condition assessments through its new Enterprise Asset Management Program, described below  Enterprise Asset Management Program  In December 2017, WMATA began development of an Enterprise Asset Management Program  According to WMATA, this program is an effort to institutionalize asset management practices that are aligned with industry best practices to provide, among other things, high quality asset data for informed decision-making, including for capital planning  Expected program tasks include updating asset records and improving and consolidating asset inventories in WMATA’s asset system of record (called Maximo)  WMATA’s efforts to develop more complete asset inventory and condition assessments are not complete  Among other things, WMATA documentation on the Enterprise Asset Management Program cited “inattention, poor standardization, and organizational silos” as factors that have resulted in WMATA having multiple sets of asset records in various states of accuracy and usefulness  The Enterprise Asset Management Program, according to WMATA, is an effort to help address this situation and improve asset data quality, including inventory and condition assessments  Although WMATA is developing a new Enterprise Asset Management Program, it has yet to develop a plan for obtaining a complete inventory or physical condition assessments of its assets  The Project Management Institute’s Guide to the Project Management Body of Knowledge, PMBOK® Guide describes the elements of good project management and their importance in achieving organizational goals  Among these elements are: Having a project charter that formally authorizes a project, that commits resources to the activity, and that provides a direct link to organizational strategic objectives; Preparing a project plan to define the basis of the project’s work and how the work will be performed; and Establishing a monitoring and control process to track, review, and report overall progress in meeting the plan’s objectives  WMATA has prepared draft documents that describe how it will implement the Enterprise Asset Management Program and that contain some elements of good project management  For example, in January 2018 WMATA circulated a proposed charter that once approved would authorize the Enterprise Asset Management program, identify needed resources, and link to WMATA’s strategic goals  As of October 2018, this proposed charter had not yet been finalized  Draft program documents also indicate there would be a monitoring and control process that would establish regular reporting to internal stakeholders to assess program accomplishments and progress implementing the program  While WMATA has developed a proposed charter and a monitoring and control process for its Enterprise Asset Management Program, it has not established a plan for collecting asset inventory and condition assessment information  The draft program charter includes general tasks for updating asset records and improving and consolidating asset inventory data in Maximo  However, a plan would provide more specific details for how the work would be completed, such as the information to be collected on different assets, how and when this information would be consolidated into Maximo, milestones for completing the work, or how the effort would be funded  Without a plan to obtain asset inventory and condition assessment information WMATA will continue to lack critical information needed for good capital planning and sound investment decision-making  WMATA has reported significant progress toward its goals of reducing track defects and fire incidents, but still faces several challenges with implementing its track preventive maintenance program  WMATA defines an incident as any unplanned event that disrupts rail revenue service  According to WMATA officials, within the track preventive maintenance program WMATA seeks to reduce incidents specifically caused by electrical wayside fires and track defects each by 50 percent from fiscal year 2017 to fiscal year 2019  WMATA reported that in fiscal year 2018 it had met its goal for track defect incidents but not for electrical wayside fires  According to officials, track defect incidents—which include incidents caused by defective fasteners, switches, and “ballast”—were reduced by 50 percent from a total of 778 in fiscal year 2017 to 387 in fiscal year 2018  Electrical-wayside-fire incidents—including incidents caused by cable and insulator fires—went down 20 percent from a total of 55 in fiscal year 2017 to 44 in fiscal year 2018 (see fig 5)  Although WMATA has reduced both track defect incidents and electrical fires, the track preventive maintenance program is not intended to address the full range of all defects and track fires that may occur on the system  WMATA officials told us that the track preventive maintenance program specifically seeks to reduce electrical-wayside-fire incidents, which are a specific sub-set of overall track fires, and does not include non-electrical fires or smoke incidents, such as the ones caused by railcars or debris  WMATA captures and publicly reports the non-electrical fires as part of its quarterly Metro Performance Report, but according to WMATA officials, these fires are not specifically addressed through the track preventive maintenance program  While electrical fires decreased in fiscal year 2018, non-electrical fires did not change, as WMATA reported 23 non-electrical fires for both fiscal years 2017 and 2018  Additionally the track preventive maintenance program addresses a certain sub-set of track defect incidents such as those caused by loose fasteners and defective switches  According to WMATA, these track defect incidents can be addressed through its track geometry, torqueing, and switch maintenance initiatives  WMATA addresses other types of track defects, such as rail breaks and third-rail defects, through its capital program  However, according to WMATA, track defects attributable to the capital program are still included as part of the overall goal to reduce all track defect incidents by 50 percent by fiscal year 2019  WMATA established goals for completing each of the six track preventive maintenance initiatives within a certain time period and reported that in fiscal year 2018 it was on-track to meet or exceed those goals for four of the initiatives  For example, in implementing its “cable meggering” initiative, WMATA established a goal to inspect and replace electric cables across its entire rail system within 4 years  According to WMATA, it met its target for fiscal year 2018 by completing 25 percent of the entire system in that year  In addition to cable meggering, WMATA also met its annual targets for the switch maintenance, track bed cleaning, and stray current-testing initiatives  As for the two initiatives behind schedule, the torqueing initiative was 70 percent complete and the tamping initiative stood at 90 percent for the 2018 target (see table 2)  Officials told us they have developed various ways to improve efficiency with these initiatives  For instance, WMATA improved the productivity of its switch maintenance initiative by separating the work to inspect the switches from the follow-up repair work to grind and weld them  These activities had previously been conducted by the same team  However, WMATA faces challenges in implementing the track preventive maintenance program moving forward  WMATA officials described track preventive maintenance as a necessary operation that must be continuously performed and balanced in conjunction with regular train operations that provide service to their customers  According to WMATA officials, executing this new program requires regular refinements to ensure it continues to progress toward its desired outcomes  Among the implementation challenges identified by WMATA officials were the following: Securing Sufficient Track Time  WMATA officials told us that getting adequate time to perform track maintenance is difficult because it requires reducing the number of hours in which WMATA provides service to customers  Consequently, increased maintenance hours can result in lost revenue  Officials from the peer transit agencies we interviewed stated that the tension between conducting maintenance and providing service is common in the transit industry  According to WMATA officials, prior to SafeTrack, windows for performing track maintenance were not sufficient to complete all necessary work, partially because of this need to balance maintenance hours and service hours  To address this issue, WMATA increased its weekly overnight work hours from 33 hours to 39 hours during SafeTrack  After SafeTrack was complete, WMATA extended weekly overnight work hours again to a total of 41 hours  However, maintaining these extended overnight work hours past fiscal year 2019 requires approval from WMATA’s board of directors  As a result, the long-term viability of WMATA’s track preventive maintenance program is partially dependent on the board’s decision to balance the competing demands for service hours and maintenance time  Work Time Productivity  To maintain extended track-maintenance hours into succeeding years, it will be important for WMATA to demonstrate the new program’s productivity  According to WMATA officials, making the most productive use of the extended working hours is a challenge, but it will be necessary to justify the extended maintenance windows  WMATA officials told us that only a portion of overnight work hours yields productive maintenance time  For example, once a line ceases operations, it takes an additional hour for all trains to reach their final destination, and another hour after that to safely turn off all power running to the track and then establish a work zone  Once maintenance work is completed, additional time must be allotted for restoring power and allowing trains to move back into position  Because of these requirements, a five-hour work window may only yield two hours of productive work time (called “wrench time”)  For this reason, WMATA began tracking its wrench time at the beginning of fiscal year 2018  As of June 2018, WMATA reported that average wrench time had increased from about 2 0 hours per day in July 2017 to 2 37 hours  Resource Constraints  According to WMATA officials, having sufficient people with the necessary skills and experience to perform track maintenance work is a significant challenge  For instance, expanded maintenance windows have increased WMATA’s workforce requirements  As a result, WMATA has used contractors to assist with its stray-current testing and track bed cleaning initiatives  In another example, WMATA’s torqueing initiative is particularly resource intensive as the entire rail system contains 135 miles of “direct fixation” track, where the torqueing work is being done, and over 504,000 fasteners to check and tighten as necessary  According to WMATA officials, bolts and fasteners are torqued during their initial installment and then again 90 days afterward as part of the initial capital expenditure  After that, any subsequent torqueing is executed as part of the new track preventive maintenance program  WMATA stated that the torqueing initiative seeks to torque all 135 miles of direct fixation track annually  WMATA officials said the torqueing initiative is a mix of contractor and in-house staff, with contractors supplementing WMATA forces as needed  WMATA’s track preventive maintenance program has followed certain leading program management practices such as establishing key performance metrics and monitoring progress toward them  Leading practices recommend that organizations establish performance baselines for their programs and communicate performance metrics to key stakeholders  For instance, as previously noted, WMATA established a measureable program goal to reduce track-defect and electrical-wayside- fire incidents by 50 percent within 2 years, and WMATA also established time periods to complete its system-wide preventive maintenance initiatives  In addition, WMATA’s Rail Services Department—which manages the track preventive maintenance program—among other things, holds a monthly “RailSTAT” meeting in which the teams leading the preventive maintenance initiatives report their progress toward these goals to WMATA’s management  However, WMATA’s program does not fully align with other applicable internal-control standards or leading program-management practices  Specifically, COSO internal control standards and leading practices identified by the Project Management Institute’s The Standard for Program Management stresses the importance of identifying and assessing program risks and developing a program management plan  COSO recommends that organizations identify risks to the achievement of its objectives and analyze risks as a basis for determining how the risks should be managed  Furthermore, the risk identification is to be comprehensive  The Standard for Program Management also recommends that when identifying risks, the assessments be both qualitative and quantitative in nature  Regarding program management plans: The Standard for Program Management recommends that organizations develop program management plans that align with organizational goals and objectives  This includes aligning the program management plan with the organization’s overall strategic plan  Elements of the plan are to provide a roadmap that identifies such things as milestones and decision points to guide program activities  In developing the track preventive maintenance program, WMATA did not fully identify or quantitatively assess risks associated with the program  WMATA officials told us that in developing the track preventive maintenance program they used their professional judgment to identify track-defect and fire incidents as the most significant risks that they needed to address through the program  However, WMATA’s risk identification was not comprehensive in nature, as it only considered two technical aspects of track maintenance: electrical fires and track defects  As previously mentioned, non-electrical fires—which were not included in the scope of the program or risk assessment—did not change from fiscal year 2017 through 2018 and represent approximately 30 percent of all fires on the system over those years  Although WMATA officials told us in designing the program they reviewed track-related incident data from 2016, they did not quantitatively analyze the impact of these incidents on service or safety  In addition, WMATA did not consider broader strategic risks to its program, such as the availability of a program’s funding and stakeholders’ support for the continuation of the program  Specifically, while WMATA has identified several challenges with implementing the program—such as securing sufficient track time, demonstrating work time productivity, and overcoming resource constraints—none of these factors, or potential mitigations, were documented in a risk assessment in developing the program  WMATA has also not prepared a program management plan for the track preventive maintenance program  Although WMATA has identified program goals, officials told us that WMATA has not formally documented the overall structure of the program or how it would be implemented  Instead, the officials said the presentations they provide to WMATA’s board of directors, along with their ongoing staff and executive team meetings, regarding the track preventive maintenance program cover the relevant information needed for running the program  While providing such information to the WMATA board of directors provides some accountability for the program, these presentations do not represent a formal program management plan that links with WMATA’s strategic plan or that identifies milestones and decision points necessary to guide the program  As we previously reported, WMATA did not develop a project management plan before starting its SafeTrack work, and due to this omission and other issues, we found that WMATA lacked assurance that the approach taken with SafeTrack was the most effective way to identify and address safety issues  Furthermore, as this is the first time WMATA has implemented a track preventive maintenance program, a program management plan could help formally establish the program, provide strategic guidance for this new program by providing accountability for both internal and external stakeholders, and ensure that program goals are met  A program management plan could also provide practical benefits, such as helping ensure that WMATA’s extended overnight work hours are efficiently implemented and that sufficient resources are devoted to the program  Without the strategic direction provided by a comprehensive risk assessment and a formal program management plan, WMATA lacks a documented vision for how the track preventive maintenance program should be structured and implemented in order to meet the agency’s strategic goals and improve track safety  Specifically, without a risk assessment that uses quantitative and qualitative data to assess risks— such as data for all fires on the system and qualitative risks such as securing sufficient time for maintenance—WMATA lacks assurance that the program is comprehensively designed to address risks affecting the safety of the rail system or other risks that could hinder the program’s success  Moreover, a program management plan that draws on information from a comprehensive risk assessment would provide WMATA officials with the assurance that they are prepared to respond to current and future challenges that could threaten the long-term viability of the program  Finally, although WMATA developed the track preventive maintenance program to prevent the need for another emergency repair project like SafeTrack, without a formal program management plan, the WMATA employees charged with managing and implementing the program lack an important document to guide their decision-making to meet that objective and the agency’s overall strategic objectives  Developing a program management plan would outline the specific requirements to successfully implement the program, including necessary track time, expected productivity of program initiatives, and required resources  Furthermore, it would provide WMATA’s board of directors with confidence that the program has a clear roadmap with milestones and decision points as the board considers maintaining the extended overnight work hours necessary to implement the program  WMATA’s rail and bus systems provide nearly a million passenger trips each day, and those passengers rely on WMATA for safe and reliable public transportation in the nation’s capital and the surrounding areas  The federal, state, and local jurisdictions that fund WMATA expect WMATA to wisely use taxpayer funds to ensure the system is safe and reliable  WMATA can better meet these expectations by establishing documented policies and procedures that outline how the new capital planning process will work and the basis of investment decisions  In addition, developing measures to assess the performance of individual projects and the capital planning process would provide greater assurance to WMATA’s funding partners that its investment decisions result in a measurable improvement in operating performance, reliability, or other metrics  Furthermore, WMATA’s recent efforts to establish an Enterprise Asset Management Program, once finalized, could help WMATA develop a more complete inventory of its assets and collect critical information on their condition—both of which are consistent with sound capital planning  However, without a plan that provides specific details for obtaining this information, WMATA will continue to lack the critical asset information necessary to make lasting improvements in its capital planning process and make sound capital-investment decisions  Similarly, track preventive maintenance plays a critical role as WMATA works to reduce the track defects and fires that have endangered safety and service reliability  WMATA could better demonstrate the direction of the track preventive maintenance program and how it can improve track safety by more comprehensively assessing the technical and broader risks facing the program and by developing a formal plan that provides greater assurance WMATA is prepared to address challenges that could threaten the long-term viability of the program  Both actions would help WMATA better focus the program on critical maintenance needs and demonstrate its value to WMATA’s board of directors and other stakeholders as WMATA endeavors to provide safe, reliable, and quality service to its riders  We are making the following five recommendations to WMATA  The General Manager of WMATA should establish documented policies and procedures for the new capital planning process  These policies and procedures should include methodologies for ranking and selecting capital projects for funding in WMATA’s fiscal year 2020 capital budget and fiscal years 2020-2025 Capital Improvement Program and for future planning cycles  (Recommendation 1) The General Manager of WMATA should develop performance measures to be used for assessing capital investments and the capital planning process to determine if the investments and planning process have achieved their planned goals and objectives  (Recommendation 2) The General Manager of WMATA should develop a plan for obtaining complete information regarding WMATA’s asset inventory and physical condition assessments, including assets related to track and structures  (Recommendation 3) The General Manager of WMATA should conduct a comprehensive risk assessment of the track preventive maintenance program that includes both a quantitative and qualitative assessment of relevant program risks  In addition to considering technical program risks, WMATA should also consider broader program risks, such as the availability of funding for the program and stakeholders’ support  (Recommendation 4) The General Manager of WMATA should prepare a formal program management plan for the track preventive maintenance program that aligns with WMATA’s strategic plan, addresses how the program is linked to overall strategic goals and objectives, and includes program milestones and decision points  (Recommendation 5) We provided a draft of this report to WMATA and the Department of Transportation for review and comment  WMATA provided written comments, which are reprinted in appendix II, and technical comments, which we incorporated as appropriate in the report  The Department of Transportation provided technical comments, which we incorporated as appropriate  WMATA concurred in part, or with the intent of four of the recommendations, and disagreed with a fifth  Specifically, regarding the first recommendation, which is that WMATA establish documented policies and procedures for the new capital planning process, and that the policies and procedures include methodologies for ranking and selecting capital projects for the fiscal year 2020 capital budget and fiscal year 2020—2025 capital-improvement program  WMATA stated that it agreed with the recommendation, in part  WMATA said it will continue its efforts to finalize and document policies and procedures for the capital planning process for fiscal year 2021 and beyond  WMATA noted that it already has in place numerous planning tools, such as the 2016 Capital Needs Inventory assessment, which helped inform the fiscal year 2020 capital planning process  According to WMATA, it is currently reviewing policies, procedures, training materials, and other documents for the fiscal year 2020 planning process, and those documents will be updated and formalized through final documentation in fiscal year 2021  WMATA noted that it anticipates that many of the elements we recommend regarding the capital planning process will be part of the process documented in fiscal year 2021  For example, WMATA expects that additional automation, decision-making, governance, and reporting capabilities, will be part of the process that will be documented for fiscal year 2021  However, while WMATA has tools available to inform the capital planning process, it has not prepared documented policies and procedures for this process in fiscal year 2020  As we reported, without documented policies and procedures, including those for ranking and selecting projects for the fiscal year 2020 capital budget, WMATA’s stakeholders do not have reasonable assurance that capital investment decisions are made using a sound and transparent process  Taking action now to establish methodologies for ranking and selecting projects for the fiscal year 2020 capital budget would provide WMATA with an opportunity to improve upon those methodologies for the fiscal year 2021 capital planning process to better ensure investments are directed to WMATA’s highest priority needs  As such, we continue to believe this recommendation is valid and that WMATA should fully implement it  Regarding the second recommendation that WMATA develop performance measures for assessing capital investments and the capital planning process, WMATA stated that it agreed with the intent of the recommendation  WMATA also stated that it has developed such measures through compliance with federal requirements, including the FTA’s performance-based planning requirements and the requirement under MAP-21 that tier I transit providers, such as WMATA, establish state-of-good-repair targets that are linked to the capital program  WMATA noted these targets are set forth in its Transit Asset Management Plan  Although WMATA’s October 2018 Transit Asset Management plan includes some broad performance measures and targets for the state-of-good-repair for its various asset classes, as we reported, WMATA has not developed performance measures to assess individual capital projects or the capital planning process itself, as suggested by leading practices in the Executive Guide  As discussed in the report, such measures are important to determine if capital investments have achieved their expected benefits and if they have achieved organizational goals  Leading practices also indicate that by using a mixture of measures managers can assess performance based on a comprehensive view of the needs and objectives of an organization  These needs and objectives can go beyond just the state-of-good-repair to include such things as measures for assessing projects that would improve service reliability, expand capacity, or achieve financial objectives  We continue to believe that fully implementing this recommendation would help ensure that capital investments meet their intended outcomes and that the capital planning process helps WMATA achieve its strategic goals and objectives  Regarding the third recommendation that WMATA develop a plan for obtaining complete information about asset inventories and condition assessments, WMATA stated that it agreed with the intent of the recommendation and that its 2018 Transit Asset Management Plan outlines plans for continuing its asset inventory update  WMATA also said that it is working to ensure it has a complete asset inventory that addresses legacy information and that includes accurate, up-to-date condition assessments  As we reported, the Enterprise Asset Management Program—the program that WMATA told us it plans to use to continue development of asset inventories and condition assessments—includes some elements of good project management, but it also lacks an established plan for collecting asset inventory and condition assessment information  Without a plan to obtain asset inventory and condition assessment information WMATA will continue to lack critical information needed for good capital planning and sound investment decision-making  Thus, we continue to believe that this recommendation is valid and that WMATA should fully implement it  Regarding the fourth recommendation that WMATA conduct a comprehensive risk assessment of the track preventive maintenance program that includes both quantitative and qualitative assessment of relevant program risks, WMATA stated that it agreed with the intent of the recommendation and is putting in place a new process that will address it  Specifically, WMATA stated it is in the process of developing a new Reliability Centered Maintenance process that will include a comprehensive risk assessment of track infrastructure that includes consideration of broader risks such as costs, funding, and track access  According to WMATA, the new process is an engineering framework that will define the maintenance regimen, including preventive maintenance, and improve safety, reliability, and cost-effectiveness  During our review, WMATA officials did not discuss the Reliability Centered Maintenance process in detail or provide documentation that allowed us to evaluate how this process might interface with the current track preventive maintenance program  As a result, we were not able to evaluate how it might address identification and assessment of risks associated with track preventive maintenance  As we reported, going forward track preventive maintenance will play a critical role as WMATA works to reduce track defects and fires  We will review WMATA’s actions to conduct a comprehensive risk assessment as part of our routine recommendation follow-up process  Regarding the fifth recommendation that WMATA prepare a formal program management plan for the track preventive maintenance program, WMATA stated that it disagreed with the recommendation  WMATA noted that specific technical details of the track preventive maintenance program are evolving as it better understands the most effective maintenance regime through implementation of the Reliability Centered Maintenance process  WMATA stated that it believes the framework of Reliability Centered Maintenance is better suited to the ongoing mission of physical asset management than traditional project and program management tools  According to WMATA, the purpose of Reliability Centered Maintenance is to ensure that all efforts are focused on the safety, reliability, and cost-effectiveness of assets through their lifecycle, which is more relevant and applicable to WMATA’s strategic plan than any individual preventive maintenance program  As stated above, WMATA did not provide details about Reliability Centered Maintenance during our review so we are not able to evaluate this process in relation to the track preventive maintenance program  We will review WMATA’s actions related to implementation of the Reliability Centered Maintenance process as part of our routine recommendation follow-up process  We continue to believe this recommendation is valid and that WMATA should fully implement it  We will send copies of this report to appropriate congressional committees, the Secretary of Transportation, the Administrator of the Federal Transit Administration, and the General Manager of WMATA  In addition, we will make copies available to others upon request, and the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-2834 or goldsteinm@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix III  This report examines: (1) How WMATA expended its capital funding from fiscal years 2011 through 2017; (2) How WMATA’s new capital planning process addresses weaknesses it identified in the previous process; and (3) WMATA’s progress toward its track preventive maintenance goals and how the program aligns with leading program management practices  For each of our objectives we reviewed pertinent federal statutes and regulations as well as WMATA and FTA policies and documents  We also selected a non-generalizable sample of five similar U S  transit agencies based on similarity to WMATA in transit route mileage, system use, capital spending, system age, and rail fleet age  We also factored geographical diversity into our selection process  We then interviewed the officials from these selected transit agencies using a standard set of questions to learn how they utilize their capital funds, conduct capital planning, and oversee maintenance; and then we compared their processes to WMATA  Transit route mileage, system use, capital spending, and rail fleet age were measured using data from FTA’s National Transit Database  We measured system age according to data available within the American Public Transportation Association’s 2017 Public Transportation Fact Book, and geographical diversity was determined through data available from the U S  Census Bureau  The transit agencies we selected were: (1) Bay Area Rapid Transit, Oakland, California; (2) Chicago Transit Authority, Chicago, Illinois; (3) Massachusetts Bay Transportation Authority, Boston, Massachusetts; (4) Metropolitan Atlanta Rapid Transit Authority, Atlanta, Georgia; and (5) Southeastern Pennsylvania Transportation Authority, Philadelphia, Pennsylvania  To assess WMATA’s capital spending from 2011 through 2017, we interviewed knowledgeable officials from WMATA and FTA and also reviewed WMATA annual budgets, fourth-quarter and year-end financial reports, budget reconciliation reports, comprehensive annual financial reports, and FTA grant awards  We selected fiscal year 2011 because it was the first year in which WMATA received federal funding authorized by the Passenger Rail Investment and Improvement Act of 2008 (PRIIA), and we selected fiscal year 2017 because it was the most recent year that capital expenditure data were available at the time of our review  By analyzing this information we determined that the following sources provided the most comprehensive and reliable available data on each of the following topics for our report (see table 3): We collected the aforementioned data, analyzed them to identify errors or other anomalies, and interviewed officials to determine how the data are compiled and checked for accuracy  We determined that these data had some limitations, as an external audit report of WMATA financial information for fiscal year 2016 noted a material weakness with WMATA’s process for accounting acquisition costs of capital assets  Specifically, there were inconsistencies between WMATA’s general ledger and sub- ledger, which are used to record acquisition costs, depreciation, and other financial information related to capital assets  As a result, additional steps were required to reconcile the differences between the two sources and could have resulted in a material error  However, after interviewing WMATA officials about the weakness and assessing the available financial information, we determined that the data we used were sufficiently reliable for our purpose of showing general trends of capital expenditures  Our analysis sought to depict how WMATA allocates and expends funds according to major asset categories within its capital-improvement plan  However, these asset categories only remained consistent from 2011 through 2015, and were revised during 2016 and 2017  However, we determined that each asset category consisted of Capital Improvement Projects that were each assigned a number  These projects and their corresponding numbers remained in existence from fiscal year 2011 through 2017, even though the asset categories were updated in fiscal year 2016  Tracking by Capital Improvement Project number provided a means to report consistently through that time period  Therefore, we used the asset categories from fiscal years 2011 through 2015 as our base reporting categories  These categories consisted of: (1) Vehicles/Vehicle Parts, (2) Rail System Infrastructure Rehabilitation, (3) Maintenance Facilities, (4) Systems and Technology, (5) Track and Structures, (6) Passenger Facilities, (7) Maintenance Equipment, (8) Other Facilities, and (9) Project Management and Support  We consolidated WMATA’s nine asset categories into five asset categories in order to represent broader categories of investment: Rail and Bus Vehicle Fleet (Vehicle/Vehicle Parts), Fixed Rail Infrastructure (Rail System Infrastructure and Track and Structures), Maintenance Facilities and Equipment (Maintenance Facilities and Maintenance Equipment), Passenger and Other Facilities (Passenger Facilities and Other Facilities), and Business Systems and Project Management Support (Systems and Technology and Project Management and Support)  We then reviewed WMATA’s fiscal year 2016 Fourth Quarter Report, fiscal year 2017 Fourth Quarter Report, and fiscal year 2017 Budget Reconciliation Report to match each project number from those two years to their corresponding category from fiscal year 2011 through 2015  To assess WMATA’s new capital planning process and how it addresses weaknesses WMATA identified in the previous process, we interviewed WMATA officials about their capital planning process and reviewed WMATA documentation related to the capital planning process  This included Capital Needs Inventories, WMATA’s policy for preparation of the 2010 and 2016 Capital Needs Inventories, annual capital budgets—to include capital improvement programs, and guidance documents issued by WMATA related to submitting projects for inclusion in the annual capital budget  We also reviewed the fiscal year 2018 business plan for WMATA’s Capital Planning and Program Management Department  We also interviewed officials from the Metropolitan Washington Council of Governments, the American Public Transportation Association, and FTA to discuss WMATA’s capital planning and budgeting processes  Furthermore, we compared WMATA’s capital planning practices to leading practices identified in GAO’s Executive Guide  The Executive Guide was used since it identifies leading practices for capital decision- making that are applicable to a wide variety of organizations, both public and private  For example, the Executive Guide developed leading capital planning practices by (1) identifying government and private sector organizations recognized for outstanding capital decision-making practices and (2) identifying and describing the leading capital decision- making practices implemented by these organizations  To identify leading practices for capital planning, we also reviewed Transit Cooperative Research Program Report 157  This report developed a framework for transit agencies to use when prioritizing the rehabilitation and replacement of capital assets and discusses leading practices in how to do this  We also identified project management principles from the Project Management Institute, Inc  Finally, we discussed capital planning with the peer transit agencies and prepared a summary of various aspects of capital planning in these agencies  To examine progress toward goals in WMATA’s track preventive maintenance program and how the program compares with leading program management practices, we reviewed WMATA documentation about the program, interviewed WMATA officials, and analyzed track- defect data and electrical-wayside-fire data provided by WMATA for fiscal years 2016 through 2018—which were the only years detailed track defect and electrical fire incident data were available  In order to determine whether the data provided were sufficiently reliable, we checked the data for errors, conducted interviews with knowledgeable officials to learn their procedures for collecting and analyzing the data, and performed independent tests that included verifying WMATA’s final tally of track defect and fire incidents and verifying there were no extended periods of time where data was missing  We also provided a set of data reliability questions to determine whether procedures were sufficient  After performing these steps we determined that the data were sufficiently reliable for the purposes of our report  In our interviews with WMATA, officials also described what goals they had created for the track preventive maintenance program, their progress in meeting those goals, and provided documentation to demonstrate their progress, which we reviewed  We also interviewed officials from the American Public Transportation Association and the American Railway Engineering and Maintenance-of-Way Association about best maintenance practices in the transit industry  We then compared WMATA’s track preventive maintenance program to leading program management practices identified by the Project Management Institute, Inc ’s The Standard for Program Management and internal control standards published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)  The Project Management Institute’s, standards are utilized worldwide and provide guidance on how to manage various aspects of projects, programs, and portfolios  In particular, The Standard for Program Management provides guidance that is generally recognized to support good program-management practices for most programs, most of the time  We conducted our work from November 2017 to January 2019 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  In addition to the contact named above, Matt Barranca (Assistant Director), Richard Jorgenson (Analyst in Charge), Melissa Bodeau, Lacey Coppage, Cory Gerlach, Erin Guinn-Villareal, Kirsten Lauber, Joshua Ormond, and Patrick Tierney made significant contributions to this report 


Report 2:  In this regard, the agencies identified 78,249 IT- related contracts, to which they obligated $14 7 billion in fiscal year 2016  However, we identified 31,493 additional contracts with $4 5 billion obligated, raising the total amount obligated by these agencies to IT contracts in fiscal year 2016 to at least $19 2 billion  Figure 5 reflects the obligations that the 22 selected agencies reported to us relative to the obligations we identified  The percentage of additional IT contract obligations we identified varied among the selected agencies  For example, the Department of State did not identify 1 percent of its IT contract obligations  Conversely, 8 agencies did not identify over 40 percent of their IT contract obligations  Many of the selected agencies that did not identify these IT contract obligations did not follow OMB guidance  Specifically, 14 of the 22 agencies did not involve the acquisition office in their process to identify IT acquisitions for CIO review, as required by OMB  In addition, 7 agencies did not establish guidance to aid officials in recognizing IT  We concluded that until these agencies involve the acquisitions office in their IT acquisition identification processes and establish supporting guidance, they cannot ensure that they will identify all IT acquisitions  Without proper identification of IT acquisitions, these agencies and CIOs cannot effectively provide oversight of these acquisitions  In addition to not identifying all IT contracts, 14 of the 22 selected agencies did not fully satisfy OMB’s requirement that the CIO review and approve IT acquisition plans or strategies  Further, only 11 of 96 randomly selected IT contracts at 10 agencies that we evaluated were CIO-reviewed and approved as required by OMB’s guidance  The 85 IT contracts not reviewed had a total possible value of approximately $23 8 billion  We believe that until agencies ensure that CIOs are able to review and approve all IT acquisitions, CIOs will continue to have limited visibility and input into their agencies’ planned IT expenditures and will not be able to use the increased authority that FITARA’s contract approval provision is intended to provide  Further, agencies will likely miss an opportunity to strengthen CIOs’ authority and the oversight of IT acquisitions  As a result, agencies may award IT contracts that are duplicative, wasteful, or poorly conceived  As a result of these findings, we made 39 recommendations in our January 2018 report  The recommendations included that agencies ensure that their acquisition offices are involved in identifying IT acquisitions and issuing related guidance, and that IT acquisitions are reviewed in accordance with OMB guidance  OMB and the majority of the agencies generally agreed with or did not comment on the recommendations  In our February 2017 high-risk update, we stated that OMB and agencies needed to demonstrate additional progress on achieving data center consolidation savings in order to improve the management of IT acquisitions and operations  Further, data center consolidation efforts are key to implementing FITARA  Specifically, OMB established the FDCCI in February 2010 to improve the efficiency, performance, and environmental footprint of federal data center activities  The enactment of FITARA in 2014 codified and expanded the initiative  In a series of reports that we issued from July 2011 through August 2017, we noted that, while data center consolidation could potentially save the federal government billions of dollars, weaknesses existed in several areas, including agencies’ data center consolidation plans, data center optimization, and OMB’s tracking and reporting on related cost savings  In these reports, we made a total of 160 recommendations to OMB and 24 agencies to improve the execution and oversight of the initiative  Most agencies and OMB agreed with our recommendations or had no comments  As of May 2018, 80 of these 160 recommendations remained unimplemented  Further, we recently reported in May 2018 that the 24 agencies participating in OMB’s Data Center Optimization Initiative (DCOI) had communicated mixed progress toward achieving OMB’s goals for closing data centers by September 2018  Over half of the agencies reported that they had either already met, or planned to meet, all of their OMB- assigned goals by the deadline  This would result in the closure of 7,221 of the 12,062 centers that agencies reported in August 2017  However, 4 agencies reported that they do not have plans to meet all of their assigned goals and 2 agencies are working with OMB to establish revised targets  With regard to agencies’ progress in achieving cost savings, 24 agencies reported $3 9 billion in cost savings through 2018  The 24 agencies also reported limited progress against OMB’s five data center optimization targets for server utilization and automated monitoring, energy metering, power usage effectiveness, facility utilization, and virtualization  As of August 2017, 1 agency reported that it had met four targets, 1 agency reported that it had met three targets, 6 agencies reported having met either one or two targets, and 14 agencies reported meeting none of the targets  Further, as of August 2017, most agencies were not planning to meet OMB’s fiscal year 2018 optimization targets  Specifically, 4 agencies reported plans to meet all of their applicable targets by the end of fiscal year 2018; 14 agencies reported plans to meet some of the targets; and 4 reported that they did not plan to meet any targets  Figure 6 summarizes agency-reported plans to meet or exceed the OMB’s data center optimization targets, as of August 2017  In 2016 and 2017, we made 81 recommendations to OMB and the 24 DCOI agencies to help improve the reporting of data center-related cost savings and to achieve optimization targets  As of May 2018, 71 of these 81 recommendations have not been fully addressed  In our 2015 high-risk report’s discussion of IT acquisitions and operations, we identified the management of software licenses as an area of concern, in part because of the potential for cost savings  Federal agencies engage in thousands of software licensing agreements annually  The objective of software license management is to manage, control, and protect an organization’s software assets  Effective management of these licenses can help avoid purchasing too many licenses, which can result in unused software, as well as too few licenses, which can result in noncompliance with license terms and cause the imposition of additional fees  As part of its PortfolioStat initiative, OMB has developed policy that addresses software licenses  This policy requires agencies to conduct an annual, agency-wide IT portfolio review to, among other things, reduce commodity IT spending  Such areas of spending could include software licenses  In May 2014, we reported on federal agencies’ management of software licenses and determined that better management was needed to achieve significant savings government-wide  Of the 24 selected agencies we reviewed, only 2 had comprehensive policies that included the establishment of clear roles and central oversight authority for managing enterprise software license agreements, among other things  Of the remaining 22 agencies, 18 had policies that were not comprehensive, and 4 had not developed any policies  Further, we found that only 2 of the 24 selected agencies had established comprehensive software license inventories, a leading practice that would help them to adequately manage their software licenses  The inadequate implementation of this and other leading practices in software license management was partially due to weaknesses in agencies’ policies  As a result, we concluded that agencies’ oversight of software license spending was limited or lacking, thus potentially leading to missed savings  However, the potential savings could be significant considering that, in fiscal year 2012, 1 major federal agency reported saving approximately $181 million by consolidating its enterprise license agreements, even when its oversight process was ad hoc  Accordingly, we recommended that OMB issue a directive to help guide agencies in managing software licenses  We also made 135 recommendations to the 24 agencies to improve their policies and practices for managing licenses  Among other things, we recommended that the agencies regularly track and maintain a comprehensive inventory of software licenses and analyze the inventory to identify opportunities to reduce costs and better inform investment decision making  Most agencies generally agreed with the recommendations or had no comments  As of May 2018, 78 of the 135 recommendations had not been implemented  Table 2 reflects the extent to which the 24 agencies implemented the recommendations in these two areas  Since information security was added to the high-risk list in 1997, we have consistently identified shortcomings in the federal government’s approach to cybersecurity  We have previously testified that, even though agencies have acted to improve the protections over federal and critical infrastructure information and information systems, the federal government needs to take the following actions to strengthen U S  cybersecurity: Effectively implement risk-based entity-wide information security programs consistently over time  Among other things, agencies need to (1) implement sustainable processes for securely configuring operating systems, applications, workstations, servers, and network devices; (2) patch vulnerable systems and replace unsupported software; (3) develop comprehensive security test and evaluation procedures and conduct examinations on a regular and recurring basis; and (4) strengthen oversight of contractors providing IT services  Improve its cyber incident detection, response, and mitigation capabilities  DHS needs to expand the capabilities and support wider adoption of its government-wide intrusion detection and prevention system  In addition, the federal government needs to improve cyber incident response practices, update guidance on reporting data breaches, and develop consistent responses to breaches of personally identifiable information  Expand its cyber workforce planning and training efforts  The federal government needs to (1) enhance efforts for recruiting and retaining a qualified cybersecurity workforce and (2) improve cybersecurity workforce planning activities  Expand efforts to strengthen cybersecurity of the nation’s critical infrastructures  The federal government needs to develop metrics to (1) assess the effectiveness of efforts promoting the National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity and (2) measure and report on the effectiveness of cyber risk mitigation activities and the cybersecurity posture of critical infrastructure sectors  Better oversee protection of personally identifiable information  The federal government needs to (1) protect the security and privacy of electronic health information, (2) ensure privacy when face recognition systems are used, and (3) protect the privacy of users’ data on state-based health insurance marketplaces  As we have previously noted, in order to take the preceding actions and strengthen the federal government’s cybersecurity posture, agencies should implement the information security programs required by FISMA  In this regard, FISMA provides a framework for ensuring the effectiveness of information security controls for federal information resources  The law requires each agency to develop, document, and implement an agency- wide information security program  Such a program includes risk assessments; the development and implementation of policies and procedures to cost-effectively reduce risks; plans for providing adequate information security for networks, facilities, and systems; security awareness and specialized training; the testing and evaluation of the effectiveness of controls; the planning, implementation, evaluation, and documentation of remedial actions to address information security deficiencies; procedures for detecting, reporting, and responding to security incidents; and plans and procedures to ensure continuity of operations  Since 2010, we have made 2,733 recommendations to agencies aimed at improving the security of federal systems and information  These recommendations have identified actions for agencies to take to strengthen technical security controls over their computer networks and systems  They also have included recommendations for agencies to fully implement aspects of their information security programs, as mandated by FISMA  Nevertheless, many agencies continue to be challenged in safeguarding their information systems and information, in part because many of these recommendations have not been implemented  As of May 2018, 793 of information security-related recommendations we have made have not been implemented  In order to determine the effectiveness of the agencies’ information security programs and practices, FISMA requires that federal agencies’ inspectors general conduct annual independent evaluations  The agencies are to report the results of these evaluations to OMB, and OMB is to summarize the results in annual reports to Congress  In these evaluations, the inspectors general frame the scope of their analysis, identify key findings, and detail recommendations to address the findings  The evaluations also are to capture maturity model ratings for their respective agencies  Toward this end, in fiscal year 2017, the inspector general community, in partnership with OMB and DHS, finalized a 3-year effort to create a maturity model for FISMA metrics that align to the five function areas in the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework): identify, protect, detect, respond, and recover  This alignment is intended to help promote consistent and comparable metrics and criteria and provides agencies with a meaningful independent assessment of their information security programs  This maturity model is designed to summarize the status of agencies’ information security programs on a five-level capability maturity scale  The five maturity levels are defined as follows: Level 1 Ad-hoc: Policies, procedures, and strategy are not formalized; activities are performed in an ad-hoc, reactive manner  Level 2 Defined: Policies, procedures, and strategy are formalized and documented but not consistently implemented  Level 3 Consistently Implemented: Policies, procedures, and strategy are consistently implemented, but quantitative and qualitative effectiveness measures are lacking  Level 4 Managed and Measurable: Quantitative and qualitative measures on the effectiveness of policies, procedures, and strategy are collected across the organizations and used to assess them and make necessary changes  Level 5 Optimized: Policies, procedures, and strategy are fully institutionalized, repeatable, self-generating, consistently implemented and regularly updated based on a changing threat and technology landscape and business/mission needs  In March 2018, OMB issued its annual FISMA report to Congress, which showed the combined results of the inspectors general’s fiscal year 2017 evaluations  Based on data from 76 agency inspector general and independent auditor assessments, OMB determined that the government-wide median maturity model ratings across the five NIST Cybersecurity Framework areas did not exceed a level 3 (consistently implemented)  Table 3 shows the inspectors general’s median ratings for each of the NIST Cybersecurity Framework areas  In its efforts toward strengthening the federal government’s cybersecurity, OMB also requires agencies to submit related cybersecurity metrics as part of its Cross-Agency Priority goals  In particular, OMB developed the IT modernization goal so that federal agencies will be able to build and maintain more modern, secure, and resilient IT  A key part of this goal is to reduce cybersecurity risks to the federal mission through three strategies: manage asset security, protect networks and data, and limit personnel access  The key targets supporting each of these strategies correspond to areas within the FISMA metrics  Table 4 outlines the strategies and their associated targets  In conclusion, FITARA and FISMA present opportunities for the federal government to address the high-risk areas on improving the management of IT acquisitions and operations, and ensuring the security of federal IT, thereby saving billions of dollars  Most agencies have taken steps to execute key IT management and cybersecurity initiatives, including implementing CIO responsibilities, requiring CIO review of IT acquisitions, realizing data center consolidation cost savings, managing software assets, and complying with FISMA requirements  The agencies have also continued to address the recommendations that we have made over the past several years  However, further efforts by OMB and federal agencies to implement our previous recommendations would better position them to improve the management and security of federal IT  To help ensure that these efforts succeed, we will continue to monitor agencies’ efforts toward implementing these recommendations  Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, and Members of the Subcommittees, this completes my prepared statement  I would be pleased to respond to any questions that you may have at this time  If you or your staff have any questions about this testimony, please contact David A  Powner, Director, Information Technology, at (202) 512- 9286 or pownerd@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement  GAO staff who made key contributions to this testimony are Kevin Walsh (Assistant Director), Chris Businsky, Rebecca Eyler, Meredith Raymond, and Jessica Waselkow (Analyst in Charge)  This is a work of the U S  government and is not subject to copyright protection in the United States  The published product may be reproduced and distributed in its entirety without further permission from GAO  However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately 

ground_truth: The Coast Guard, a component of DHS, serves as the principal federal agency responsible for maritime safety, security, and environmental stewardship in U.S. ports and waterways. To ensure that the Coast Guard is effectively fulfilling its missions, agency managers must have accurate information and base decisions on sound analyses for effective program management. This statement discusses Coast Guard actions needed to (1) improve the quality of data used for program management and (2) improve the transparency of its data for reporting on mission performance and planning. This statement is based on relevant products GAO issued from June 2014 through December 2017 on Coast Guard strategic planning and management issues, as well as related recommendation follow-up conducted through February 2018. GAO reviewed applicable laws, regulations, policies and guidance. GAO also interviewed Coast Guard officials responsible for administering these programs and obtained information on how they used data to inform decisionmaking. GAO interviewed a range of stakeholders, including federal and industry officials. GAO's prior work recommended multiple actions to improve the Coast Guard's program management by improving the quality of data it uses to manage and report on its mission performance. Specifically, GAO recommended actions such as collecting more complete data and clarifying the data limitations to facilitate more effective program management. For example, in December 2017, GAO found that more information is needed to calculate vessel safety statistics that could enhance the Coast Guard's knowledge about accident, injury, and fatality trends involving commercial fishing vessels. Having more complete information could be useful to carrying out its marine safety mission, and GAO recommended, among other things, that the Coast Guard ensure that data collected during commercial fishing vessel incident investigations is accurately captured. In 2018, the Coast Guard reported taking initial steps to capture more accurate data. GAO's prior work also identified areas where the Coast Guard could improve the transparency of the data it uses for reporting on its mission performance as well its capital planning purposes. For example, in an October 2017 report on performance goals, GAO found the Coast Guard's Annual Performance Report (APR) has not been released publicly since 2011. Consequently, there has not been full visibility over performance across all of the Coast Guard's missions. Coast Guard officials stated that a decision by Department of Homeland Security (DHS) leadership to limit the number of performance goals shared publicly had deterred the Coast Guard from public release of its APR. GAO recommended that APRs be available on the Coast Guard's website; the Coast Guard plans to publicly release future APRs. In addition, previous GAO reports found that the Coast Guard's annual 5-year capital investment plan, which projects acquisition funding needs for the upcoming 5 years, did not consistently reflect current total cost estimates or the effects of tradeoffs made as part of the annual budget cycle. GAO made recommendations to help the Coast Guard plan for future acquisitions and the difficult trade off decisions it will face given funding constraints. The Coast Guard agreed, but it is unclear when it will complete the 20-year plan. GAO is not making new recommendations in this statement but has made them to the Coast Guard and DHS in the past on improving its program management through, among other things, better quality and more transparent data. DHS and the Coast Guard agreed with these recommendations and reported actions or plans to address them.