You are given two reports by the government agency.  

Report 1:
Since DHS’s creation in 2003, significant internal control and financial management system deficiencies have hampered its ability to reasonably assure effective financial management and to manage operations. These deficiencies contributed to our decision to designate DHS’s management functions, including financial management, as high risk. To help address these deficiencies, DHS initiated a decentralized approach to upgrade or replace legacy financial management systems and has been evaluating various options for modernizing them, including the use of SSPs. DHS initiated three projects for modernizing the systems of selected DHS components, including its TRIO modernization project. The TRIO project has focused on migrating the financial management systems of Coast Guard, DNDO, and TSA to a modernized solution provided by IBC. DHS’s efforts to effectively assess and manage risks associated with this project are essential to DHS’s realizing its modernization goals. In 2013, OMB issued a memorandum directing agencies to consider federal SSPs as part of their AAs. Also, in May 2014, Treasury and OMB designated IBC as one of four federal SSPs for financial management to provide core accounting and other services to federal agencies. This designation was based on Treasury and OMB’s evaluation of the four service providers’ ability to assist federal agencies in meeting their accounting and financial management needs, including experience with implementing financial management systems and providing other financial management services to customers, cost of services provided, compliance with financial management and internal control requirements, commitment to shared services, capacity, and long-term growth strategy. FIT’s responsibilities related to the governance and oversight of federal SSPs were subsequently transferred to USSM after USSM was established in October 2015. Because of concerns that its Core Accounting System (CAS) Suite was outdated, inefficient, and did not reliably meet requirements, Coast Guard completed an AA in January 2012 to assist in developing a path forward for modernizing its financial management system. In August 2012, Coast Guard established its CAS Replacement project team to further evaluate two of the alternatives considered in its AA and develop a recommended course of action. In addition, Coast Guard determined that hosting, owning, operating, and managing a financial management system were not among its core competencies. Because TSA and DNDO also relied on CAS as their primary accounting system, they also conducted AAs to identify the best alternative for transitioning to a modernized financial management system solution. The AAs conducted by the TRIO components during 2012 and 2013 considered the use of federal and commercial SSPs and other options. In addition, Coast Guard completed additional market research including further analysis of commercial SSPs in June 2013. In July 2013, the TRIO components determined that migrating to a federal SSP was the best course of action and subsequently conducted discovery phase efforts with IBC from November 2013 through May 2014 to further explore the functional requirements for procurement, asset, and financial management services. Based on these efforts, in July 2014, the TRIO components recommended that they proceed with implementation of the IBC shared services solution. In August 2014, FIT and OMB concurred with this recommendation, and DHS entered into an interagency agreement (IAA) with IBC for implementation. Figure 1 shows a timeline of these key events. The IAA for implementation and related performance work statement included a description of the services that IBC is to provide and the roles and responsibilities of DHS, the TRIO components, and IBC. The IAA also required IBC to prepare a detailed project management plan describing how the requirements would be managed and updated and an integrated master schedule (IMS) for identifying tasks to be completed, duration, percentage completed, dependencies, critical path, and milestones. According to the February 2015 project management plan, DNDO, TSA, and Coast Guard were expected to go-live on the IBC solution in the first quarter of fiscal years 2016, 2017, and 2018, respectively. However, in May 2016, DHS and IBC determined that TSA’s and Coast Guard’s planned implementation dates were not viable because of various challenges impacting the TRIO project and recommended a 1-year delay for their respective implementation dates. Figure 2 summarizes planned and completed key implementation events for the TRIO project as of May 2016. GAO, SEI, and other entities have developed and identified best practices to help guide organizations in effectively planning and managing various activities, including acquisitions of major information technology systems. These include GAO’s identified best practices for the AOA process and best practices identified by SEI for risk management. GAO-identified best practices for AOA process. GAO identified 22 best practices for a reliable, high-quality AOA process that can be applied to a wide range of activities in which an alternative must be selected from a set of possible options, as well as to a broad range of capability areas, projects, and programs. These practices can provide a framework to help ensure that entities consistently and reliably select the project alternative that best meets mission needs. Not conforming to these best practices may lead to an unreliable process, and the entity will lack assurance that the preferred alternative best meets the mission needs. Appendix II provides additional details on GAO’s identified AOA process best practices and how they can be applied to a wide range of activities in which an alternative must be selected from a set of possible options, as well as to a broad range of capability areas, projects, and programs. SEI’s risk management practices. SEI’s practices for the risk management process area call for the identification of potential problems before they occur so that risk-handling activities can be planned throughout the life of a project to mitigate adverse impacts on achieving objectives. These practices are determining risk sources and categories, defining parameters used to analyze and categorize risks and to control the risk management effort, establishing and maintaining the strategy to be used for risk identifying and documenting risks, evaluating and categorizing each identified risk using defined risk categories and parameters and determining its relative priority, developing a risk mitigation plan in accordance with the risk monitoring the status of each risk periodically and implementing the risk mitigation plan as appropriate. Although the TRIO components conducted AAs to identify the preferred alternative for modernizing their financial management systems, their efforts did not always follow best practices. For example, Coast Guard’s and TSA’s AAs supporting their selection of migrating to a federal SSP for modernizing their financial management systems did not fully or substantially meet all four characteristics of a reliable, high-quality AOA process. In addition, we found that DHS guidance did not fully or substantially incorporate five of GAO’s identified best practices for conducting an AOA process. The TRIO components’ AAs included descriptions of the key factors, such as scores for each alternative against the selection criteria used to assess it. Based on these AAs, DHS and the TRIO components selected the federal SSP alternative as their preferred choice and subsequently selected IBC as their federal SSP. However, because Coast Guard’s and TSA’s AAs did not fully or substantially meet all four characteristics of a reliable, high-quality AOA process, they are at increased risk regarding their decision on the solution that represents the best alternative for meeting their mission needs. Based on the extent to which the DHS TRIO components followed the GAO-identified 22 best practices for conducting an AOA process, we found that DNDO’s AA process substantially met the four characteristics of a reliable, high-quality AOA process while the Coast Guard and TSA AA processes both substantially met one and partially met three of these four characteristics. For example, we found that TSA’s AA partially met the “well-documented” characteristic, in part, because risk mitigation strategies, assumptions, and constraints associated with each alternative were not discussed in its AA. In addition, we found that Coast Guard’s AA partially met the “credible” characteristic, in part, because there was no indication that it contained sensitivity analyses, an evaluation of the impact of changing assumptions on its overall costs or benefits analyses. Our overall assessment is summarized in table 1. Appendix III provides additional details on our assessment of the TRIO components’ AAs for each of the GAO-identified 22 AOA best practices. Further, in comparing DHS AOA and AA guidance to the GAO-identified 22 AOA process best practices, we found that although DHS’s guidance for conducting both AOAs and AAs fully or substantially incorporated 17 of the identified best practices, the guidance did not fully or substantially incorporate 5 of these practices. For example, although the guidance addressed risk management in general terms, it did not detail the need to document risk mitigation strategies for each alternative. Not documenting the risks and related mitigation strategies for each alternative prevents decision makers from performing a meaningful trade-off analysis necessary to choose a recommended alternative. In addition, while DHS guidance describes the need for an AA or AOA review, it describes reviews conducted within the organizational chain of command and does not address the need for an independent review—one of the most reliable means to validate an AOA process. Further, although the guidance noted that weights for selection criteria may become more subjective when they cannot be derived analytically, additional guidance on weighting selection criteria was limited. Our overall assessment is summarized in table 2. Because of these limitations in guidance, and because Coast Guard and TSA did not fully adhere to the GAO-identified best practices, Coast Guard’s and TSA’s AAs did not fully or substantially reflect all four characteristics of a reliable, high-quality AOA process. As a result, Coast Guard and TSA increased their risk of selecting a solution that may not represent the best alternative for meeting their mission needs. Documentation supporting TRIO components’ AA efforts included descriptions of the key factors, metrics, and processes involved in conducting their analyses, including the (1) alternatives considered, (2) market research conducted, (3) three alternatives evaluated, (4) selection criteria used by each and how the criteria were weighted, (5) scores for each alternative against the selection criteria, and (6) alternatives that scored the best under the AOA evaluation. The TRIO components conducted market research to develop reasonable alternative solutions for consideration. For example, through its market research, TSA identified OMB-designated federal SSPs and commercial entities as potential alternatives for hosting and implementing a modernized and integrated financial management system. According to its AA, TSA was able to gain an understanding of the offerings, capabilities, and related costs associated with these alternatives through reviews of documentation and interviews. After developing a diverse range of financial system modernization alternatives for consideration, each of the TRIO components assessed them for viability using various factors—such as measures of effectiveness, cost, risk, and value—and identified the three top-rated alternatives for further evaluation. For example, Coast Guard identified nine alternatives for consideration and analyzed, scored, and ranked them to determine its top three alternatives for further analysis: incrementally improve the current CAS Suite and remove certain outdated components, host the financial management system internally using software and tools already owned, and use an SSP to host the financial management system. Each component identified its three alternatives for further evaluation and used defined selection criteria to rate them. For example, DNDO’s selection criteria included four categories of operational effectiveness that were weighted according to their level of importance. Based on their evaluations, each component identified the best alternative for its respective financial management system needs. According to Coast Guard’s November 2012 decision memorandum, Coast Guard further narrowed the alternatives it focused on to (1) using an SSP to host its financial management system and (2) hosting the system internally using already-owned software and tools, and it also gathered rough order of magnitude cost estimates for both alternatives. Based on its evaluation, Coast Guard determined that the two alternatives were comparable. According to this memorandum, Coast Guard further determined that owning, hosting, operating, and managing a financial management system were not among its core competencies. Based on this determination, OMB direction to agencies to use (with limited exceptions) shared services, and other factors, Coast Guard decided that migrating to an SSP was the best alternative. TSA found in its February 2013 analysis that the differences between federal and commercial SSP alternatives were not significant and, as a result, recommended that a competitive procurement be conducted to better evaluate each alternative. However, DHS officials told us that TSA subsequently determined that a competitive procurement was not warranted and chose to migrate to a federal SSP. This determination was based on additional OMB guidance issued in March 2013 directing agencies to consider federal SSPs as part of their AAs and stating that commercial SSPs are an appropriate solution and would be funded by OMB only in instances in which the agency’s business case demonstrates that a commercial SSP can provide a better value for the federal government. In addition, DNDO determined that migrating to a federal SSP was its best alternative in May 2013. Because its preliminary research focused primarily on the federal SSP marketplace, Coast Guard conducted additional market research to include a more robust analysis of commercial SSPs. Coast Guard’s June 2013 market research report described the results of this effort, including its evaluation of responses from 11 commercial SSPs. Coast Guard reported that none of the commercial SSPs that responded could meet all 44 specific financial management system requirements and the extent to which they could meet them varied significantly. Based on these results, Coast Guard determined that there was a lack of maturity in the commercial SSP market for federal financial management. According to the report, this overall assessment was based on various considerations of information provided by commercial SSP respondents, including the wide variety of proposed configurations, solutions, prices, and implementation schedules, the lack of federal experience and service for agency-wide capabilities, and insufficient length of service to establish positive trends in audit performance; the lack of similar offerings that implied a lack of strong competition between comparable products that would exert downward pressure on cost; and the lack of like product offerings, which increases the likelihood of higher switching costs in the case of poor performance because of increased difficulty in moving from one “turnkey” service to another. In July 2013, the TRIO components and DHS selected the federal SSP alternative as their preferred choice and subsequently selected IBC as their federal SSP. DHS officials told us that IBC was selected based on (1) DHS’s reliance on OMB and Treasury’s designation of IBC as a federal SSP, (2) OMB guidance to consider the use of federal SSPs, and (3) a review of the availability of the four federal SSPs indicating that IBC was the only one available to meet the requirements and implementation schedule at that time. In August 2013, DHS notified OMB that the TRIO components had performed extensive market research and finalized their respective AAs and independently concluded that migrating to a federal SSP was in the best interests of the government. Also, in August 2013, FIT notified OMB regarding the TRIO components’ AA efforts and that the TRIO components would proceed to the discovery phase with IBC. According to FIT’s notification memorandum to OMB, the TRIO components’ AAs demonstrated that migrating to a federal SSP was the best value to the federal government and that the components identified IBC as a suitable partner based on the results of their market research into federal SSPs. Risk management best practices call for the identification of potential problems before they occur so that risk-handling activities can be planned throughout the life of the project to mitigate adverse impacts on achieving objectives. These best practices involve (1) preparing for risk management, (2) identifying and analyzing risks, and (3) mitigating identified risks. Preparing for risk management involves determining risk sources and categories and developing risk mitigation techniques. Identifying and analyzing risks includes determining those that are associated with cost, schedule, and performance and evaluating identified risks using defined risk parameters. Mitigating risks includes determining the levels and thresholds at which a risk becomes unacceptable and triggers the execution of a risk mitigation plan or contingency plan; determining the costs and benefits of implementing the risk mitigation plan for each risk; monitoring risk status; and providing a method for tracking open risk-handling action items to closure. Based on our evaluation, we found that DHS processes generally reflected three of seven specific risk management best practices and partially reflected the remaining four practices. Table 3 summarizes the extent to which DHS followed these seven best practices for managing TRIO project risks. Additional details on DHS and TRIO component efforts to address these practices are summarized following this table. Prepare for risk management. Key aspects of processes established by DHS and TRIO components related to the three best practices associated with preparing for risk management: Determine risk sources and categories. This practice calls for a basis for systematically examining circumstances that affect the ability of the project to meet its objective and a mechanism for collecting and organizing risks. DHS and the TRIO components established processes that met this best practice. For example, DHS reviewed the integrated master schedule that IBC prepared to identify sources of risk and defined risk categories in TRIO project policies. Define risk parameters. Risk parameters are used to provide common and consistent criteria for comparing risks to be managed. The best practice includes defining criteria for evaluating and quantifying risk likelihood and severity levels and defining thresholds for each risk category to determine whether risk is acceptable or unacceptable and to trigger management action. DHS partially met this best practice. DHS’s risk management program defined rating scales to provide consistent criteria for evaluating and quantifying risk likelihood and severity levels. However, DHS’s Risk Management Planning Handbook and related template for developing risk management plans for projects did not address the need for thresholds relevant to each category of risk to facilitate review of performance metrics in order to determine when risks become unacceptable or to invoke selected risk-handling options when monitored risks exceed defined thresholds. Establish a risk management strategy. A risk management strategy addresses specific actions and the management approach used to apply and control the risk management program, including identifying sources of risk, the scheme used to categorize risks, and parameters used to evaluate and control risks for effective handling. DHS met this best practice. DHS and IBC established risk management policies and plans for the TRIO project based on DHS acquisition guidance, which provided a framework for a risk management program. Collectively, these policies and plans constitute a risk management strategy. DHS and IBC have periodically updated these documents to maintain the scope of the risk management effort; the methods and tools to be used for risk identification, risk analysis, risk mitigation, risk monitoring, and communication; the prioritization of risks; and the allocation of resources for risk mitigation. Identify and analyze risks. Key aspects of processes established by DHS and the TRIO components related to the two best practices associated with identifying and analyzing risks: Identify risks. Risk identification should be an organized, thorough process to seek out probable or realistic risks to achieving objectives. This practice recognizes that risks should be identified and described understandably before they can be analyzed and managed properly. Using categories and parameters developed in the risk management strategy and identified sources of risk guides the identification of risks associated with cost, schedule, and performance. To identify risks, best practice elements include reviewing the work breakdown structure (WBS) and project plan to help ensure that all aspects of the work have been considered. Best practices for documenting risks include documenting the context, conditions, and potential consequences of each risk and identifying the relevant stakeholders associated with each risk. DHS partially met this best practice. DHS’s July 2016 risk register contained a wide range of risks associated with defined risk categories. It also reflected DHS’s review of the TRIO project’s integrated master schedule that IBC prepared based on the WBS and work plans that IBC also developed. The risk register documented the context, conditions, potential consequences, and relevant stakeholders associated with each risk. However, DHS’s documented risk management processes did not identify all significant risks or reflect its efforts to revisit risks that had previously been closed. For example, DHS officials told us that IBC was unable to provide sufficient, reliable cost and schedule information for project monitoring; however, a risk reflecting these concerns was not included on its July 2016 risk register. Further, the risk register included certain closed risks related to the need for a governance structure and strategy for ensuring that IBC met performance, cost, and schedule objectives. Although DHS had ongoing concerns about its ability to ensure that IBC met these objectives, the risk register did not reflect efforts to revisit these risks to determine whether their status needed revision or if other risks should be included on the risk register to address its accountability concerns. In addition, DHS did not always take timely action to document its consideration of risks identified by its independent verification and validation (IV&V) contractor for potential inclusion on its risk register. For example, the IV&V contractor identified a risk related to inefficiencies in DHS’s document review process in June 2015 that was not included on DHS’s risk register until February 2016. DHS officials indicated that a crosswalk between the DHS risk register and IV&V contractor risk management observations was performed weekly; however, results of these weekly reviews were not documented. Evaluate, categorize, and prioritize risks. Risk assessment uses defined categories and parameters to determine the priority of each risk to assist in determining when appropriate management attention is required. Best practices for analyzing risks include categorizing risks according to defined risk categories, evaluating identified risks using defined risk parameters, and prioritizing risks for mitigation. DHS’s processes met this practice. For example, the documented risk management program included application of defined risk categories and parameters for all identified risks, providing a means for reviewing risks and determining the likelihood and severity of risks being realized. The TRIO project’s Joint Risk Management Integrated Project Team provided consistency to the application of parameters by reviewing risk assessments when risks were first identified. By determining exposure ratings for each identified risk, DHS prioritized risks for monitoring and allocation of resources for risk mitigation. Mitigate risks. Key aspects of processes established by DHS and the TRIO components related to the two best practices associated with mitigating risks: Develop risk mitigation plans. Risk mitigation plans are developed in accordance with the risk management strategy and include a recommended course of action for each critical risk. The risk mitigation plan for a given risk includes techniques and methods used to avoid, reduce, and control the probability of risk occurrence; the extent of damage incurred should the risk occur; or both. Elements of this practice include determining the levels and thresholds that define when a risk becomes unacceptable and triggers the execution of a risk mitigation plan or contingency plan, identifying the person or group responsible for addressing each risk, determining the costs and benefits of implementing the risk mitigation plan for each risk, developing an overall risk mitigation plan for the work to orchestrate the implementation of individual risk mitigation plans, and developing contingency plans for selected critical risks in the event impacts associated with the risks are realized. DHS partially met this best practice. DHS’s risk management program documentation reflected the development of risk response plans for most risks, including all those determined to be of medium and high exposure level. DHS identified those responsible for addressing each risk. However, DHS and IBC did not always develop sufficiently detailed risk mitigation plans including specific risk-handling action items, determination of the costs and benefits of implementing the risk mitigation plan for each risk, and developing contingency plans for selected critical risks in the event that their impacts are realized. For example, a risk associated with IBC’s capacity and experience for migrating large agencies the size of Coast Guard and TSA was identified in July 2014. Although DHS developed plans to help mitigate this risk, a contingency plan was not developed prior to realizing the adverse impact of not implementing Coast Guard and TSA on IBC’s modernized solution. Rather, a contingency plan working group (CPWG) to address this and other concerns was established in January 2017, over 2 years after the risk was initially identified. Further, thresholds were not used within the risk management program to define when a risk becomes unacceptable, triggering the execution of a risk mitigation plan or contingency plan. Implement risk mitigation plans. Risk mitigation plans are implemented to facilitate a proactive program to regularly monitor risks and the status and results of risk-handling actions to effectively control and manage risks during the work effort. Best practice elements include revisiting and reevaluating risk status at regular intervals to support the discovery of new risks or new risk-handling options that can require reassessment of risks and re-planning of risk mitigation efforts. Elements also include providing a method for tracking open risk-handling action items to closure, establishing a schedule or period of performance for each risk-handling activity, invoking selected risk-handling options when monitored risks exceed defined thresholds, and providing a continued commitment of resources for each risk mitigation plan. DHS partially met this best practice. Risk monitoring of the TRIO project consisted of reviews performed by DHS and TRIO component officials responsible for risk management and oversight functions. These reviews considered significant risks, risks approaching realization events, and the effect of management intervention on the resolution of risks. These reviews also relied, in part, on data contained in DHS’s risk register, which represents the official repository of TRIO project risks and information on the status of risks and related risk mitigation efforts. However, other aspects of DHS’s efforts to implement risk mitigation plans did not fully adhere to certain elements associated with this best practice. For example, we identified certain issues that raised questions concerning the accuracy of data contained in the risk register, such as (1) the lack of clear markings indicating when the accuracy of data on each risk was last confirmed, including risk records that had not been modified in the previous 3 months, and (2) certain risks for which the estimated risk impact date had already occurred but its status risk according to DHS’s risk register did not reflect that it had been realized and become an issue. In addition, DHS officials stated that IBC did not provide sufficiently detailed, reliable cost and schedule information that could have been used to monitor TRIO project risks more effectively. DHS’s ability to monitor cost, schedule, and other performance metrics was also limited because of the lack of thresholds for management involvement, as noted above. DHS’s implementation of risk monitoring plans was further limited by other issues, including (1) a period of performance for each risk-handling activity, which includes a start date and anticipated completion date to control and monitor risk mitigation efforts, was not always established and (2) an inability to fully track open risk-handling action items to closure existed because of the lack of sufficient detail on specific risk-handling activities in the DHS risk register. According to DHS officials, DHS relied heavily on IBC to manage risks associated with the TRIO project and, in particular, those for which IBC was assigned as the risk owner. They also acknowledged DHS’s responsibility for overseeing IBC’s TRIO project risk management efforts and described various actions taken to address growing concerns regarding IBC’s efforts. For example, DHS created the Joint Risk Management Integrated Project Team, in part, to provide a forum in which IBC could obtain assistance in developing risk responses and discuss DHS’s risk mitigation concerns. Further, to help reduce exposure of underlying risks, DHS offered assistance to IBC’s project management functions, such as developing the integrated master schedule and performing quality control checks on project deliverables. Despite these efforts, DHS officials stated that challenges associated with the IAA structure and terms of the performance work statement with IBC on the TRIO project limited DHS’s visibility into IBC’s overall cost, schedule, and performance controls and ability to oversee IBC’s risk management efforts. For example, they stated that the performance work statement did not specify the level of reporting to be provided by IBC on cost, schedule, and performance in sufficient detail to effectively monitor progress on achieving key project objectives. Further, the limitations to managing risks related to the best practices we assessed as partially met were largely attributable to limitations in DHS and TRIO project guidance and policies. For example, DHS’s Risk Management Planning Handbook and related template for developing risk management plans for projects does not address the need to define thresholds to facilitate review of performance metrics to determine when risks become unacceptable. Also, TRIO project policies did not address the need to periodically revisit consideration of risk sources other than IMS-related milestones, specify periods of performance for specific risk- handling activities, or define an interval for updating and certifying risk statuses. In addition, DHS guidance and TRIO project policies did not describe the need to consider and document risks specifically related to the lack of sufficient, reliable cost and schedule information to properly manage and oversee the project or for timely disposition of risks that its IV&V contractor identified. Further, TRIO project risk management policies and management tools used to implement them address best practice elements such as determination of the costs and benefits of implementing risk mitigation plans, developing contingency plans, and developing specific risk-handling action items. However, these policies do not require, and the risk register was not designed to specifically capture, these elements in documented risk mitigation plans. By not adopting important elements of risk management best practices into project guidance, DHS and the TRIO components increase the risk that potential problems would not be identified before they occur and that activities to mitigate adverse impacts would not be effectively planned and initiated. Although DHS has taken various actions to manage the risks of using IBC for the TRIO project, including some that were consistent with best practices, the TRIO project has experienced challenges raising concerns regarding the extent to which its objectives will be achieved. In connection with these challenges, the TRIO components notified DHS during April 2016 through January 2017 that certain baseline cost and schedule objectives had not been, or were projected to not be, achieved as planned. According to these notifications and DHS officials we interviewed, several key factors and challenges significantly impacted DHS’s and IBC’s ability to achieve TRIO project objectives as intended. In addition, IBC, FIT, and USSM officials identified similar issues impacting the TRIO project. In connection with these challenges, DHS and IBC began contingency planning efforts in January 2017 to identify and assess viable options for improving program performance and addressing key TRIO project priorities. Plans for DHS’s path forward on the TRIO project, as of May 2017, involve significant changes, such as transitioning away from using IBC and a 2-year delay in completing Coast Guard and TSA’s migration to a modernized solution. We grouped the key factors and challenges impacting the TRIO project that DHS, IBC, FIT, and USSM officials and OMB staff identified into five broad categories: (1) project resources, (2) project schedule, (3) complex requirements, (4) project costs, and (5) project management and communications. The key factors and challenges related to each category are summarized below. Project resources: Concerns about IBC’s experience and its capacity to handle a modernization project involving agencies the size of Coast Guard and TSA were identified as significant risks in July 2014, resulting from discovery phase efforts completed prior to DHS and IBC’s entering the implementation phase in August 2014. According to DHS officials, status reports, and other documentation, key TRIO project challenges related to resources included concerns that (1) IBC encountered federal employee hiring challenges and was unable to ramp up and deploy the resources necessary to meet required deliverables, and (2) IBC experienced significant turnover of key stakeholders which adversely impacted its ability to achieve TRIO project objectives. In connection with DHS’s decision to use IBC for the TRIO project, DHS officials told us that DHS relied heavily on OMB and Treasury’s designation of IBC as a federal SSP and their related assessment of IBC’s capacity and experience. DHS officials also told us that DHS relied on FIT’s federal agency migration evaluation model during discovery phase efforts that focused on assessing the functionality of the software rather than assessing IBC’s (1) capacity, experience, and capability; (2) ability to address more complex software configurations and interfaces associated with large agencies; and (3) cost, schedule, and performance metrics. DHS officials stated that issues related to IBC’s capacity and experience represented the most significant challenge impacting the TRIO project. IBC officials acknowledged that IBC was unable to ramp up its resources until after the project had begun and that the IBC project team experienced significant turnover in key leadership and TRIO project positions over the course of the project. IBC officials also acknowledged that during its early efforts on the TRIO project, assigned IBC staff lacked the experience and expertise necessary for managing large-scale projects and, as a result, many of the risks initially identified were not effectively addressed. FIT and USSM officials and OMB staff also acknowledged that resource challenges significantly impacted the TRIO project. A FIT official acknowledged that assessing software functionality, rather than implementation, was emphasized during the discovery process. Although DHS relied on OMB and Treasury’s designation of IBC as a federal SSP, this FIT official also told us that because agencies’ specific needs can vary significantly, agencies are responsible for conducting sufficient due diligence to assess a federal SSP’s ability to meet their requirements. Project schedule: DHS, IBC, FIT, and USSM officials acknowledged that migrating the TRIO components to IBC within original time frames was a significant challenge given the overall magnitude and complexity of the TRIO project. According to DHS officials and TRIO project documentation, DHS identified delays in completing various tasks and milestones including providing design phase technical documentation and design processing proposed change requests; meeting proposed baseline schedules for implementing Coast Guard and TSA on the modernized IBC solution; and achieving initial operating capability requirements and stabilizing the production environment after DNDO’s migration to IBC because of various issues related to reporting, invoice payment processing, contract management processes, and resolving help desk tickets in a timely manner. DHS officials also stated that IBC did not consistently update the IMS to ensure that it accurately reflected all required tasks, the completion status, and the resources required to complete them. Concerns related to meeting milestones and updating the IMS were discussed during periodic status update meetings that included DHS, IBC, OMB, FIT, and USSM officials. IBC and DHS officials acknowledged that processes for communicating and resolving issues were not always efficient and contributed to schedule delays. In addition, in November 2016, USSM noted several concerns based on its review of a draft IMS supporting TSA’s re-planning efforts to go-live in October 2017. USSM’s concerns included an incomplete project scope and schedule and need for additional discovery to determine cost and level of effort, an extremely aggressive schedule with very limited contingencies for the lack of interim checkpoints or oversight on tasks exceeding 30 days, the need for a resource-loaded IMS that incorporates an appropriate level of detail, and the need for an expedited program governance strategy and escalation path that DHS and IBC leadership could use to make program decisions within the time allotted on the schedule. Complex requirements: DHS, IBC, FIT, and USSM officials acknowledged the overall complexity of the TRIO project and that the lack of a detailed understanding of the components’ requirements earlier in the project impacted IBC’s and DHS’s ability to satisfy the requirements as planned. For example, USSM and FIT officials told us that under the shared services model, the approach for onboarding new customers usually involves migrating to a proven configuration of a solution that is already being used by the provider’s existing customers. However, rather than taking this approach, DHS and IBC agreed to implement a more recent version of Oracle Federal Financial software (version 12.2) with integrated contract life cycle and project modules. Under this approach, IBC’s plans included migrating other existing customers to this upgraded environment. USSM officials told us that migrating TRIO components to a new solution that required configuring new software and related applications and developing related interfaces introduced additional complexities that contributed to issues on the TRIO project. According to a FIT official, the functionality of this more recent version of software is very different than that of the version IBC’s existing customers used. This official stated that IBC did not have the needed government personnel with knowledge and experience associated with this new software, a condition that likely contributed to the challenges experienced on the TRIO project. IBC officials acknowledged that IBC’s lack of familiarity with Oracle 12.2 increased the complexity of the TRIO project. In addition, DHS and IBC perspectives on the need for changes differed because of the lack of clarity regarding TRIO project requirements. DHS officials told us that many change requests on the TRIO project reflected the need for required functionality based on previously stated requirements. They also told us that they did not consider DNDO-related requirements to be overly complex when compared to those associated with IBC’s similarly sized customers. However, DHS officials stated that as of June 2017, IBC has not yet met DNDO’s needs to deliver a functioning travel system interface and other requirements. According to IBC officials, TRIO project change requests to address components’ requirements were extensive and included significant customizations to meet unique requirements that were not aligned with the federal shared service model. IBC officials noted additional challenges in addressing TRIO project requirements related to DHS’s efforts to address certain organizational change management and business process reengineering responsibilities. According to IBC officials, in some instances, the TRIO components provided conflicting requirements related to the same process that would have been more consistent had DHS completed more of its business process reengineering efforts prior to providing them to IBC. Project costs: According to the July 2014 discovery report, proposed implementation costs for the TRIO project totaled $89.9 million. However, according to DHS officials and TRIO project documentation, estimated costs significantly increased because of schedule delays, unanticipated complexities, and other challenges. In January 2017, DHS prepared a summary of estimated TRIO project implementation costs associated with its IAA with IBC. According to this summary, estimated IBC-related TRIO project implementation costs through fiscal year 2017 increased by approximately $42.8 million (54 percent) from the $79.2 million provided in the original August 2014 IAA with IBC as a result of modifications required, in part, to address challenges impacting the project. DHS officials also expressed concerns regarding increases in estimated operations and maintenance costs for the IBC solution. For example, according to a December 2016 memorandum to DHS on action items associated with failing to meet the baseline schedule date for initial operational capability, DNDO stated that IBC’s updated projected costs of operations and maintenance of its system were unaffordable. In connection with these costs, DHS officials also stated that IBC determined that separate, rather than shared, help desk resources were required to support the TRIO project because it was significantly different from the solution that IBC’s existing customers used. As a result, the officials indicated that these costs were more than originally expected. However, IBC officials told us that a portion of the increase in help desk- related costs was also due to DNDO employees not using the system properly because they were not sufficiently trained on it before it was implemented. In addition, challenges impacting the TRIO project have contributed to significant changes in the path forward on the project; as a result, the extent to which overall TRIO project modernization costs will be impacted going forward has not yet been determined. Project management and communication: According to DHS officials, various program management-related challenges impacted the TRIO project. For example, they expressed concerns regarding the effectiveness of IBC’s project management efforts including cost, schedule, and change management as well as IBC’s allocation of resources and slow decision-making process. They also stated that DHS provided significant time and resources to make up for fundamental project management activities that were under IBC’s control and not performed. In addition, DHS officials identified limitations associated with (1) poorly defined service level agreements and program performance metrics, (2) poor quality control plan, and (3) the lack of mechanisms for measuring delivery and addressing concerns regarding IBC’s performance. DHS officials told us that although various mechanisms can be used to hold commercial vendors accountable—such as cure notices, quality assurance surveillance plans, and incentives or disincentives to monitor performance—few mechanisms are available to hold federal agency service providers accountable for performance concerns. DHS officials also acknowledged challenges in their project management and communication efforts and identified lessons learned to help improve future efforts, including the need to establish a performance-based contract to determine objective and enforceable activity level metrics; be more prepared for organizational changes; improve vendor, project, and schedule management efforts; better understand SSP resource plans and monitor SSP efforts to help ensure that sufficient resources are secured timely; and centralize program management for financial system modernization functions, rather than continuing with the structure used on the TRIO project—for example, the TRIO project’s program management structure consisted of program management offices at the component level performing cost, schedule, and technical monitoring activities with DHS headquarters’ involvement focused on governance and oversight, resulting in duplicate efforts across components. IBC officials acknowledged challenges concerning IBC’s lack of sufficient resources and turnover, as described above. However, they told us that DHS’s approach to project management often resulted in duplicative meetings and a lengthy decision-making process involving several officials and multiple review and approval processes. According to USSM officials, the TRIO project team focused an unbalanced portion of its efforts on the delivery of technology at the expense of organizational change management, communication management, and other project management areas. For example, the failure to incorporate lessons learned from DNDO’s deployment adversely affected subsequent TRIO project implementation efforts, as change management activities did not address previously encountered risks. An OMB staff member concurred with the lessons learned that DHS identified, including those indicating the need for stronger project management. While the project is ongoing, the OMB staff member noted the importance of DHS having well-defined requirements for the project and better coordination to achieve the desired outcomes. In connection with TRIO project challenges, DHS officials told us that IBC notified DHS in April 2016 that it would not be able to meet the planned October 2016 implementation date for TSA. In response, DHS and IBC established the TSA Replan Tiger Team to perform a detailed assessment of potential courses of action. According to DHS officials, DHS and IBC subsequently took various actions to help address these and other challenges impacting the TRIO project, as summarized below. May 2016: IBC requested additional funding for fiscal year 2016 for 14 additional IBC and contractor personnel to strengthen program coordination and management support. According to DHS officials, DHS provided this requested funding along with additional funding to establish a business integration office to help strengthen cross organizational communication. DHS determined that plans for migrating TSA and Coast Guard to IBC during the first quarter of fiscal years 2017 and 2018, respectively, were not viable. As a result, their planned migrations were each extended an additional year. June 2016: DHS and IBC developed a comprehensive remediation plan to track progress on efforts to resolve numerous issues associated with DNDO’s production environment that continued to hamper its stability since going live in November 2015. According to DHS officials, these issues related to invoice payment and interest accruals, contract life cycle management, reporting, and other activities and have required numerous work-arounds to execute business processes. August to October 2016: DHS, Coast Guard, and IBC determined that a similar replanning effort was needed for Coast Guard’s successful migration to IBC. According to DHS officials, IBC indicated that it was unable to simultaneously provide DNDO production and TSA implementation support while also addressing the complexities related to Coast Guard. DHS officials told us that another Tiger Team established to address Coast Guard issues failed to complete the scope of its charter, and as a result, Coast Guard was forced to assume a minimum of a 2- year delay (rather than the 1-year delay previously determined in May 2016) and that this significantly increased program costs. They further stated that some of the team’s deliverables have not been initiated or remain outstanding as of June 2017. December 2016: IBC communicated to DHS that it cannot support the discovery phase with DHS’s CUBE modernization project. In addition, DHS approved the establishment of a Joint Program Management Office to serve as the overarching program management for DHS financial systems modernization projects. According to DHS officials, using a department-wide approach will enable DHS to more effectively leverage the resources and expertise across all modernization projects. January 2017: IBC communicated to DHS that it cannot support Coast Guard implementation in October 2018, and DHS and IBC established a joint CPWG to assess viable options for improving program performance and addressing stakeholder concerns and key TRIO project priorities. February 2017: DHS and IBC issued a joint memorandum to provide an update on contingency planning discussions. DHS and IBC shared commitments and determinations included (1) stabilizing the DNDO production environment and executing TSA implementation activities, (2) delivering the best value for the government and ensuring mutual success to the greatest extent possible, (3) preserving and protecting the current investment, and (4) making TSA implementation the first priority. In addition, DHS and IBC presented two options as representing the best opportunities for success in improving program performance and addressing stakeholder concerns: (1) continue with the status quo plan for Coast Guard implementation in October 2019, with significant improvements to program management and overall support capability and capacity, or (2) platform replacement. Platform replacement was presented as the preferred path toward meeting the needs of both DHS and IBC. Under this option, DHS and IBC would proceed with TSA implementation and work toward an orderly transition of TRIO components to an alternate service provider, hosting location, or both. March 2017: According to DHS officials, DHS, IBC, and USSM officials met to review certain critical success criteria for TSA’s implementation. Based on these discussions, it was determined that TSA would not go live with IBC in fiscal year 2018 given the high-risk schedule and critical criteria involved and the Coast Guard implementation would also be delayed accordingly. Further, TSA release 3.0 would be delivered in October 2017 or as soon as possible thereafter. In addition, the CPWG would continue working to identify an alternative path forward, and DHS and IBC would identify and evaluate critical transition activities and timelines. April 2017: The CPWG recommended moving away from IBC to a commercial service provider leveraging the cloud as the best course of action to complete TRIO project implementation and as the most fiscally responsible approach from a long-term sustainment and cost perspective. The CPWG’s recommendation was based on its analysis of six options and proposed a transition timeline, including key activities, as shown in figure 3. May 2017: During its May 3, 2017 briefing of the Financial Systems Modernization Executive Steering Committee, DHS indicated that two of the options that the CPWG considered were no longer viable, including the CPWG’s recommendation to transition to a commercial cloud service provider because the software was not yet cloud-ready. DHS ranked the remaining four options using 13 OMB risk factors as selection criteria and determined that migrating the solution to a DHS data center represented the best option going forward. In addition, DHS decided to move forward with discovery efforts related to this option. According to its briefing presentation and DHS officials, the notional timeline of planned key events for the TRIO project included various items, as shown in figure 4. DHS officials indicated that DHS expects to present the findings and recommendations resulting from discovery efforts associated with this new path forward to USSM and OMB for concurrence. As of August 2017, results of this effort were under review by DHS leadership. The TRIO project represents a key element of DHS’s efforts to address long-standing deficiencies in its financial management systems and further improve financial management. Following best practices to manage risks effectively can help provide increased assurance that large, complex projects—such as the TRIO project—will achieve planned objectives. DNDO’s AA process substantially met the four characteristics of a reliable, high-quality AOA process. However, Coast Guard’s and TSA’s AAs substantially met one and partially met three of these four characteristics. Further, DHS did not always follow best practices for managing the risks of using IBC for the TRIO project. As a result, TRIO components faced an increased risk that the solution they chose would not represent the best alternative for meeting their mission needs and that the risks impacting the TRIO project would not be effectively managed to mitigate adverse impacts. In addition, significant challenges have impacted the TRIO project, raising concerns about the extent to which objectives will be achieved as planned. Plans for DHS’s path forward on the TRIO project, as of May 2017, involve significant changes, such as transitioning away from IBC and a 2-year delay in completing Coast Guard’s and TSA’s migration to a modernized solution. Without greater adherence to best practices for analyzing alternatives and managing project risks, DHS continues to face increased risk that its financial management system modernization project will not provide reasonable assurance of achieving its mission objectives. We are making the following two recommendations to DHS: The DHS Under Secretary for Management should develop and implement effective processes and improve guidance to reasonably assure that future AAs fully follow AOA process best practices and reflect the four characteristics of a reliable, high-quality AOA process. (Recommendation 1) The DHS Under Secretary for Management should improve the Risk Management Planning Handbook and other relevant guidance for managing risks associated with financial management system modernization projects to fully incorporate risk management best practices, including defining thresholds to facilitate review of performance metrics to determine when risks become unacceptable; identifying and analyzing risks to include periodically reconsidering risk sources, documenting risks specifically related to the lack of sufficient, reliable cost and schedule information needed to help properly manage and oversee the project, and timely disposition of IV&V contractor-identified risks; developing risk mitigation plans with specific risk-handling activities, the costs and benefits of implementing them, and contingency plans for selected critical risks; and implementing risk mitigation plans to include establishing periods of performance for risk-handling activities and defining time intervals for updating and certifying the accuracy and completeness of information on risks in DHS’s risk register. (Recommendation 2) We provided a draft of this product to DHS and the Department of the Interior for comment. In its comments, reprinted in appendix IV, DHS concurred with our recommendations and provided details on its implementation of the recommendations as discussed below. In addition, DHS provided technical comments, which we incorporated as appropriate. The Department of the Interior only provided technical comments, which we incorporated as appropriate. DHS stated that it remains committed to its financial system modernization program. Specifically, regarding our first recommendation to develop and implement effective processes and improve guidance to reasonably assure that future AAs fully follow AOA process best practices and reflect the four characteristics of a reliable, high-quality AOA process, DHS stated that it agrees that effective processes and guidance are necessary to assure best practices. DHS also stated that it is important to note that the GAO-identified best practices were published more than 2 years after the TRIO components’ AAs were completed. While this is the case, as discussed in our report, these best practices are based on long- standing, fundamental tenets of sound decision making and economic analysis and were identified by compiling and reviewing commonly mentioned AOA policies and guidance that are known to and have been used by government and private sector entities. DHS also stated that it has already implemented this recommendation through its issuance of guidance and instructions in 2016 and that a copy of this additional guidance and instructions was provided to GAO. However, the documentation provided by DHS does not fully address our recommendation. As part of our recommendation follow-up process, we will coordinate with DHS to obtain additional information on its efforts to address our recommendation. With regard to our second recommendation to improve the Risk Management Planning Handbook and other relevant guidance, DHS stated that it concurred and agreed that the Risk Management Planning Handbook required updating to fully incorporate risk management best practices. In addition, DHS described actions it will take, and has taken, to revise and publish an updated handbook. We are sending copies of this report to the appropriate congressional committees, the Acting Secretary of Homeland Security, the DHS Under Secretary for Management, the Acting DHS Chief Financial Officer, the Secretary of the Interior, and the Director of the Interior Business Center. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-9869 or khana@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix V. To determine the extent to which the Department of Homeland Security (DHS) followed best practices in analyzing the alternatives used in choosing the preferred alternative for modernizing TRIO components’ financial management systems, we reviewed information that the TRIO components provided as part of their alternatives analysis (AA) process, referred to as the AA body of work, which includes the AA and other supporting documentation that is not specifically included in the AA. In addition, we discussed the DHS AA process with the TRIO components and DHS officials. We evaluated each TRIO component’s AA body of work and assessed this information against the GAO-identified 22 analysis of alternatives (AOA) process best practices. We then scored each AA against those best practices. In appendix II, these GAO- identified best practices are described in detail. Our evaluation comprised the following steps: (1) two GAO analysts separately examined the AA information received for each component, providing a score for each of 18 best practices; (2) a third GAO analyst resolved any differences between the two analysts’ initial scoring; and (3) a GAO specialist on AOA best practices, independent of the audit team, reviewed the team’s AA documentation, scores, and analyses for consistency. The GAO specialist also assessed the four best practices related to cost estimating. We used the average scores for each best practice to determine an overall score for four summary characteristics—well-documented, comprehensive, unbiased, and credible—of a reliable, high-quality AOA process at each TRIO component. Next, we shared our preliminary analysis with the TRIO components and DHS, and requested their technical comments and any additional information for our further consideration. For those characteristics of the AA process that received a score of partially met or below, we met with TRIO component and DHS officials to discuss potential reasons that an AA did not always conform to best practices. Finally, using the same methodology and scoring process explained above, we performed a final assessment based on our preliminary analysis and the comments and additional information received. The best practices were not used to determine whether DHS made the correct decision in selecting Department of the Interior’s Interior Business Center (IBC) to implement the financial management systems modernization solution or whether the TRIO project would have arrived at a different conclusion had it more fully conformed to these best practices. We also reviewed DHS guidance for conducting AOAs and AAs against the GAO-identified 22 AOA process best practices using the same methodology described above for reviewing the TRIO components’ AAs. In the course of applying these best practices to a TRIO component’s AA and to DHS guidance for the AA process, we assessed the reasonableness of the information we collected. We determined that the information from the DHS AA process was sufficiently reliable to use in assessing the TRIO components’ AAs and DHS guidance against these 22 best practices. To determine the key factors, metrics, and processes used by the TRIO components in developing and evaluating DHS’s alternative solutions and final choice for financial system modernization, we reviewed each component’s AA, including a description of (1) the alternatives considered, (2) the market research conducted, (3) the three alternatives evaluated, (4) the selection criteria used and how the criteria were weighted, (5) how each alternative scored against the selection criteria, and (6) the alternative that scored the best according to the component’s evaluation. To determine the extent to which DHS managed the risks of using IBC consistent with risk management best practices, we reviewed DHS’s and TRIO components’ risk management guidance and other documentation supporting their risk management efforts, including risk registers, mitigation plans, status reports, and risk management meeting minutes. We also met with officials to gain an understanding of the key processes and documents used for managing and reporting on TRIO project risks. We assessed the processes against best practices that the Software Engineering Institute (SEI) identified. The practices we selected are fundamental to effective risk management activities. These practices are identified in SEI’s Capability Maturity Model® Integration (CMMI®) for Acquisition, Version 1.3. In particular, the key best practices for preparing for risk management are determine risk sources and categories, define risk parameters, and establish a risk management strategy. The key best practices for identifying and analyzing risks are evaluate, categorize, and prioritize risks. The key best practices for mitigating identified risks are develop risk mitigation plans and implement risk mitigation plans. We applied the criteria from the CMMI risk management process area to determine the extent to which the expected practices were implemented, or future activities were planned for, by the program office. The rating system we used is as follows: (1) meets, or generally satisfies all elements of the specific practice; (2) partially meets, or generally satisfies a portion of specific practice elements; and (3) does not meet, or does not satisfy specific practice elements. In the context of the best practices methodology, we assessed the reliability of TRIO project risk data contained in DHS’s risk register. We interviewed officials on how the risk register was developed and maintained, including key control activities used to provide reasonable assurance of the accuracy of the information reported in the register. We reviewed DHS’s July 2016 risk register and minutes from risk management committee meetings (one meeting per quarter, randomly selected). Of 120 TRIO project risks on the July 2016 risk register, we found 13 risks with missing data. Of 47 active risks identified, 28 risk records had not been modified in the previous 3 months and the register did not indicate when their accuracy was last confirmed and 35 risks were beyond their indicated impact dates but had not been marked as issues. We concluded that the pervasiveness of these data reliability problems decreased the usefulness of the risk register in connection with managing TRIO project risks. To determine the key factors or challenges that have impacted the TRIO project and DHS’s plans for completing remaining key priorities, we met with DHS, IBC, Office of Financial Innovation and Transformation, and Unified Shared Services Management office officials and Office of Management and Budget staff to obtain their perspectives. In addition, we reviewed documentation provided by these officials, including TRIO project status reports and memorandums, leadership briefings, and other presentations. We conducted this performance audit from March 2016 to September 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Many guides describe an approach to an analysis of alternatives (AOA); however, there is no single set of practices for the AOA process that has been broadly recognized by both the government and private sector entities. GAO has previously identified 22 best practices for an AOA process by (1) compiling and reviewing commonly mentioned AOA policies and guidance used by different government and private sector entities and (2) incorporating experts’ comments on a draft set of practices to develop a final set of practices. These practices are based on longstanding, fundamental tenets of sound decision making and economic analysis. In addition, these practices can be applied to a wide range of activities in which an alternative must be selected from a set of possible options, as well as to a broad range of capability areas, projects, and programs. These practices can provide a framework to help ensure that entities consistently and reliably select the project alternative that best meets mission needs. The guidance below is an overview of the key principles that lead to a successful AOA process and not as a “how to” guide with detailed instructions for each best practice identified. The 22 best practices that GAO identified are grouped into the following five phases: 1. Initialize the AOA process: Includes best practices that are applied before starting the process of identifying, analyzing, and selecting alternatives. This includes determining the mission need and functional requirements, developing the study time frame, creating a study plan, and determining who conducts the analysis. 2. Identify alternatives: Includes best practices that help ensure that the alternatives to be analyzed are sufficient, diverse, and viable. 3. Analyze alternatives: Includes best practices that compare the alternatives to be analyzed. The best practices in this category help ensure that the team conducting the analysis uses a standard, quantitative process to assess the alternatives. 4. Document and review the AOA process: Includes best practices that would be applied throughout the AOA process, such as documenting all steps taken to initialize, identify, and analyze alternatives and to select a preferred alternative in a single document. 5. Select a preferred alternative: Includes a best practice that is applied by the decision maker to compare alternatives and to select a preferred alternative. The five phases address different themes of analysis necessary to complete the AOA process, and comprise the beginning of the AOA process (defining the mission needs and functional requirements) through the final step of the AOA process (selecting a preferred alternative). We also identified four characteristics that relate to a reliable, high-quality AOA process—that the AOA process is well-documented, comprehensive, unbiased, and credible. Table 4 shows the four characteristics and their relevant AOA best practices. Conforming to the 22 best practices helps ensure that the preferred alternative selected is the one that best meets the agency’s mission needs. Not conforming to the best practices may lead to an unreliable AOA process, and the agency will not have assurance that the preferred alternative best meets mission needs. The Department of Homeland Security’s TRIO components—the U.S. Coast Guard (Coast Guard), Transportation Security Administration (TSA), and Domestic Nuclear Detection Office (DNDO)—conducted alternatives analyses (AA) during 2012 and 2013 to determine the best alternative for transitioning to a modernized financial management system solution. We evaluated the TRIO components’ AA processes against analysis of alternatives (AOA) best practices GAO identified as necessary characteristics of a reliable, high-quality AOA process (described in app. II). GAO’s assessment of the extent to which Coast Guard’s, TSA’s, and DNDO’s AAs met each of the 22 best practices is detailed in tables 5, 6, and 7. In addition to the contact named above, James Kernen (Assistant Director), William Brown, Courtney Cox, Eric Essig, Valerie Freeman, Matthew Gardner, Jason Lee, Jennifer Leotta, and Madhav Panwar made key contributions to this report.

 

 Report 2:
The United States has many international agreements that require treaty partners to provide certain information to IRS, which can help prevent the use of foreign bank accounts to facilitate tax evasion. FATCA goes much further, requiring FFIs to report more detailed information to IRS about their U.S. customers annually. These provisions are important developments in efforts to combat tax evasion by U.S. persons holding investments in offshore accounts. FATCA generally requires certain taxpayers to report foreign financial accounts and other specified foreign financial assets whose aggregate value exceeds specified thresholds to IRS on Form 8938. These taxpayers must report these assets and income generated from such assets to IRS with their tax return on Form 8938. These thresholds vary by filing status—such as single or married filing jointly—and by domestic or foreign residency. FATCA also promotes third-party reporting of foreign financial assets by requiring a withholding agent to withhold 30 percent on certain payments to an FFI unless the FFI or the jurisdiction in which the FFI is located has entered into an agreement with the United States to report certain account information of their U.S. customers. Under such an agreement, participating FFIs report detailed information to IRS annually about accounts held by their U.S. customers using an IRS Form 8966, FATCA Report (Form 8966). According to IRS, FATCA improves visibility into taxable income from foreign sources, and enhances the agency’s ability to identify and pursue taxpayer noncompliance. For example, FATCA allows IRS to compare information reported by FFIs on Forms 8966 to information reported by U.S. persons on Forms 8938. According to IRS, this comparison can be used to ensure taxpayers and FFIs are properly reporting foreign financial assets and income from international investments. This type of comparison is a common IRS enforcement technique. For example, IRS can directly compare information it receives from financial institutions’ IRS Form 1099-INT, Interest Income, against a tax return to determine if the taxpayer reported income generated from interest earned. To facilitate FATCA implementation for FFIs operating in jurisdictions with laws that would prohibit FFIs from complying with the terms of the FFI agreement, Treasury developed two alternative intergovernmental agreements (IGA)—Model 1 and Model 2—to facilitate the effective and efficient implementation of FATCA by removing partner jurisdictions’ legal impediments to comply with FATCA reporting requirements, and reducing burdens on FFIs located in partner jurisdictions. FFIs from countries with Model 1 IGAs report information on U.S. persons’ accounts to their respective host country tax authorities (HCTAs). The HCTAs, in turn, compile the information from FFIs and transmit it to IRS. In contrast, FFIs from countries with Model 2 IGAs, or countries treated as not having an IGA in effect, directly report information on U.S. persons’ accounts to IRS. Separate from the FATCA requirements, regulations implementing the Bank Secrecy Act of 1970 (BSA) also impose a separate self-reporting requirement for foreign accounts. Specifically, certain taxpayers and residents are required to file an FBAR with FinCEN annually if they have financial interest or signature or other authority over one or more foreign financial accounts with a total of more than $10,000, regardless of whether they reside within or outside the United States. Federal, state, and local law enforcement agencies can use information from these reports to combat financial crimes, including terrorist financing and tax evasion. Appendix IV provides a comparison of Form 8938 and FBAR reporting requirements. Figure 1 depicts the flow of foreign financial account information from U.S. persons and FFIs to IRS and FinCEN through the FATCA and FBAR reporting processes. As part of the FATCA reporting requirements, IRS collects information on financial accounts through forms and reports submitted by both taxpayers and FFIs. As part of this effort, IRS requires taxpayers to identify their TINs on Forms 8938 they submit. IRS also requires participating FFIs to report the TINs of each account holder who is a specified U.S. person on Forms 8966. IRS intends to use reported TINs to link Form 8938 data filed by taxpayers to Form 8966 data filed by the FFIs to ensure that taxpayers and FFIs are properly reporting foreign financial assets. However, IRS often could not link account information collected from FFIs to the account’s owner because of incorrect or missing TINs. In July 2018, the Treasury Inspector General for Tax Administration (TIGTA) found that almost half of new Forms 8966 filed by FFIs did not include a TIN or included an invalid TIN. A consulting firm working with FFIs to implement FATCA reporting requirements told us that FFIs encountered significant challenges obtaining accurate TINs from U.S. persons as part of the self-certification process. For instance, FFIs encountered situations where U.S. persons provided incomplete or inaccurate TINs—such as Social Security Numbers (SSN) with less than nine digits—on forms used to self-certify their status as U.S. persons. FFIs also encountered situations where U.S. persons may not have obtained TINs or were unwilling to provide them to FFIs. Additionally, banking associations told us that it has taken time, effort, and expense for FFIs to report TINs, as they had to upgrade computer systems to collect and record TINs from U.S. customers. Finally, Treasury told us that jurisdictions that have an IGA with the United States but no legal requirement to collect TINs are not in compliance with the requirements of the IGA. Treasury and IRS determined that some FFIs reporting from countries with Model 1 IGAs needed additional time to implement procedures to obtain and report required U.S. TINs for preexisting accounts that are U.S. reportable accounts. Consequently, IRS provided a transition period, through the end of 2019, for compliance with the TIN requirements for FFIs under Model 1 IGAs. Specifically, in September 2017, IRS issued a notice modifying procedures for FFIs reporting from countries with Model 1 IGAs to become compliant with TIN reporting requirements for preexisting accounts. For calendar years 2017-2019, IRS will not determine that certain FFIs in countries with Model 1 IGAs are significantly noncompliant with their obligations under the IGA solely as a result of a failure to report U.S. TINs associated with the FFI’s U.S. reportable accounts, providing they (1) obtain and report the date of birth of each account holder and controlling person whose TIN is not reported, (2) make annual requests for missing TINs from each account holder, and (3) search electronically searchable data maintained by such FFIs for missing required U.S. TINs before reporting information that relates to calendar year 2017 to a partner jurisdiction. As a result, even without any further extensions, calendar year 2020 is the earliest IRS will be enforcing requirements for FFIs from countries with Model 1 IGAs to provide accurate and complete information on U.S. account holders’ TINs to IRS. Without valid TINs on Forms 8966 submitted by FFIs, according to IRS officials, IRS faces significant hurdles in matching accounts reported by FFIs to those reported by individual tax filers on their Forms 8938. As a result, IRS must rely on information such as names, dates of birth, and addresses that the filers and/or FFIs may not consistently report. Without data that can be reliably matched between Forms 8938 and 8966, IRS’s ability to identify taxpayers not reporting accurate or complete information on specified foreign financial assets is hindered, interfering with its ability to enforce compliance with FATCA reporting requirements, and ensure taxpayers are paying taxes on income generated from such assets. In July 2018, TIGTA reported that IRS lacked success in matching FFI and individual taxpayer data because reports FFIs filed did not include or included invalid TINs. This, in turn, affected IRS’s ability to identify and enforce requirements for individual taxpayers. TIGTA recommended, among other things, that IRS initiate compliance efforts to address and correct missing or invalid TINs on Form 8966 filings from FFIs from countries with Model 2 IGAs or without any IGAs with the United States. IRS management said it disagreed with this recommendation because a system to ensure validation of every TIN upon submission of a Form 8966 would be cost prohibitive. However, IRS management said that IRS would address invalid TINs as they are uncovered on other compliance efforts, such as initiating development of a data product to automate risk assessments across the FATCA filing population. IRS also said it continues efforts to systematically match Form 8966 and Form 8938 data to identify nonfilers and underreporting related to U.S. holders of foreign accounts. However, IRS management told us they are waiting until they have a full set of data, including TINs, before doing analysis to develop a compliance strategy. According to TIGTA, IRS management believed that having the FFI’s Global Intermediary Identification Number (GIIN) on Form 8938, which is filed by the taxpayer, would help with matching records. However, Form 8938 instructions identify that the field is optional for taxpayers to complete. TIGTA recommended that to reduce taxpayer burden in obtaining GIINs from FFIs, IRS add guidance to Form 8938 instructions to inform taxpayers on how to use the FFI List Search and Download Tool on the IRS’s website to obtain an FFI’s GIIN. IRS agreed with this recommendation. However, even if an individual taxpayer provided GIINs, IRS may continue to have difficulty matching accounts with U.S. taxpayers if the TIN and name of the account holder reported on the Form 8966 do not match the TIN and name of the taxpayer on the Form 8938. IRS officials said they are aware of these difficulties and have attempted to match Forms 8938 and 8966 based on other criteria such as dates of birth. In its response to our draft report, IRS said that all financial institutions and foreign tax authorities that file required account information receive a notification listing administrative and other minor errors contained in their reporting. According to IRS, its Large Business and International division follows up with foreign tax authorities regarding these errors to ensure the tax authorities are working with financial institutions to correct these errors in compliance with the countries’ IGAs. IRS added it has initiated a campaign addressing FFIs that do not meet their compliance responsibilities with respect to account opening requirements. Additionally, IRS drafted a risk acceptance form and tool addressing risks in implementing FATCA compliance and business process capabilities. This risk assessment focused on the limitations IRS faces due to budget constraints, but did not address the specific risks it faces from not receiving complete and valid TINs on U.S. account holders. We previously reported that risk management could help stakeholders make decisions about assessing risk, allocating resources, and taking actions under conditions of uncertainty. Key management practices for risk management we identified from our prior work include identifying, analyzing, and prioritizing risks; developing a mitigation plan to address identified risks; implementing the plan; and monitoring, reporting, and controlling risks. Without developing a risk mitigation plan to address risks IRS faces from not receiving complete and valid TINs moving forward, IRS may lose opportunities to adjust its compliance programs to better identify U.S. persons who are not fully reporting specified foreign financial assets as required under FATCA. Several IRS databases store data collected from individuals’ electronic and paper filings of Form 8938 and/or elements of parent individual tax returns to which the Form 8938 is attached—the filer’s country of residence and filing status—used to determine specified reporting thresholds for Form 8938 filers. Additionally, data from these databases and other sources are transferred downstream to IRS’s Compliance Data Warehouse (CDW)—a database used for research and analytical purposes. We extracted data from copies of Individual Return Transaction File (IRTF) and Modernized Tax Return Database (MTRDB) data copied into CDW to obtain information reported on Forms 8938 and relevant information from parent tax returns, such as filing status and filers’ country of residence. We found that IRTF and MTRDB had inconsistent and incomplete data. For example, neither database had consistent and complete information on foreign financial account and other asset information submitted by Form 8938 filers. While IRS officials told us that IRTF is the authoritative source for filers of Form 8938, it does not store account and other asset information submitted on Forms 8938. Additionally, IRS officials said MTRDB is not designed to store information submitted on paper filings of Forms 8938 and parent tax returns. Officials from IRS’s Research, Applied Analytics and Statistics (RAAS) division also noted that CDW did not have reliable information from Form 8938 paper filings. Because of the lack of foreign financial asset information from such filings, we could not report complete information on assets reported by Form 8938 filers. Further, IRS does not provide instructions to CDW users on how to extract appropriate data from CDW—such as data copied from IRTF and MTRDB—leading to confusion on which databases to use for extracting Form 8938 and relevant parent tax return data. For example, five distinct tables within CDW are required to identify the TIN, parent form, filing status, country of residence, and amount of foreign assets accurately. Without clear explanations of how data in each of these tables relate to each other and to the underlying filings, errors could be introduced into CDW users’ analyses of foreign asset information. Standards for Internal Control in the Federal Government notes that management should use quality information to achieve the entity’s objectives. One attribute of this principle includes processing data into quality information that is appropriate, current, complete, accurate, accessible, and provided on a timely basis. Additionally, the Internal Revenue Manual states that IRS needs to measure taxpayer compliance so that customer-focused programs and services can be enhanced or developed so that compliance information and tools can be improved. According to IRS officials, IRS researchers have been taking additional steps to obtain and review Form 8938 and parent tax return data stored in the Integrated Production Model (IPM) database. They said IPM is the only database that contains complete data from individuals’ electronic and paper filings of Forms 8938 and relevant elements of parent tax returns. IRS officials said that RAAS has been working with IRS’s information technology (IT) division to obtain read-only access to IPM, and import Forms 8938 and 8966 data from IPM into CDW for analysis. However, as of February 2019, this effort has been delayed due to budget constraints. In its response to our draft report, IRS said that obtaining read-only access would require a new technical process and plans to continue working with IT on the feasibility and timeframe for enabling this access. Enabling access to consistent and complete Form 8938 and parent tax return data for compliance staff and researchers from RAAS and other IRS business units would help IRS strengthen its efforts to enforce compliance with FATCA reporting requirements and conduct research to bolster enforcement efforts. However, such efforts may be hampered until IRS can ensure readily available access to such data. We previously recommended that IRS develop a broad strategy, including a timeline and performance measures, for how IRS intends to use FATCA information to improve tax compliance. IRS agreed with this recommendation and developed a strategy for FATCA in July 2013. IRS updated the strategy in 2016 by creating the FATCA Compliance Roadmap as a comprehensive plan to articulate IRS’s priorities to facilitate compliance with FATCA reporting requirements. The roadmap also provided an overview of compliance activities used solely for enforcing FATCA reporting requirements or enhancing existing compliance efforts. However, in July 2018, TIGTA reported that IRS had not updated the FATCA Compliance Roadmap since 2016, and had taken limited or no action on a majority of the planned activities outlined in it. We also found that IRS had not yet evaluated the effects of FATCA, including the effects on voluntary tax compliance. IRS documentation states that only 7 of 31 capabilities outlined in the FATCA Compliance Roadmap were delivered due to funding constraints. As of October 2018, IRS has stopped using the FATCA Compliance Roadmap and has not developed a revised comprehensive plan to manage efforts to leverage FATCA data to improve taxpayer compliance. According to IRS officials, IRS moved away from updating broad strategy documents, such as the FATCA Compliance Roadmap, to focus on individual compliance campaigns. These include a campaign to match individual tax filers to the reports from FFIs, and another campaign to identify FFIs with FATCA reporting requirements who are not meeting all of their obligations. According to what IRS told us, with the passage of time and as FATCA is becoming more integrated into agency operations, it has moved from updating the broad strategy documents focused on FATCA to working on compliance campaigns that incorporate FATCA into overall tax administration. Additionally, IRS and outside researchers plan to study the role of enforcement in driving overall patterns in reporting offshore assets and income generated from such assets. Though IRS maintains that FATCA is more integrated into its operations, TIGTA’s 2018 report concluded that IRS was still unprepared to enforce compliance with FATCA in part because it took limited or no action on the majority of planned activities outlined in the FATCA Compliance Roadmap. Documenting a framework for using FATCA reporting requirements to improve taxpayer compliance and measure their effect is consistent with three steps we found leading public sector organizations take to increase the accountability of their initiatives: (1) define clear missions and desired outcomes; (2) measure performance to gauge progress; and (3) use performance information as a basis for decision-making. We also previously reported that it is important for IRS to use a documented framework that defines a clear strategy, timeline, and plans for assessment. Having such a framework in place can help IRS better allocate resources and avoid unnecessary costs resulting from not having the necessary or appropriate data available to execute its objectives. In light of the challenges IRS faces to collect, manage, and use FATCA data to improve compliance in a resource-constrained environment, employing a comprehensive plan would help IRS maximize the use of collected data and better leverage individual campaigns to increase taxpayer compliance. Without such a plan, IRS’s ability to collect and leverage data collected under FATCA for compliance enforcement and other purposes is constrained. We could not report on total values of foreign financial assets on Forms 8938 in tax years 2015 and 2016. However, we could provide a range of total maximum account values reported on FBARs during the same period. Specifically, we determined that more than 900,000 individuals filed FBARs in calendar years 2015 and 2016, and declared total maximum values of accounts ranging from about $1.5 trillion to more than $2 trillion each year. A little more than one in five—or about 21.7 percent—of the approximately 404,800 Forms 8938 filed with IRS in tax year 2016 were done so from U.S. persons living abroad, with the other 78.3 percent living in the United States. Table 1 shows that a higher proportion of Form 8938 filings from U.S. persons living abroad for tax year 2016 were filed on paper (43.3 percent) than Form 8938 filings from U.S. persons living in the United States during the same period (14.7 percent). We extracted these data from IRTF, which IRS officials said is the authoritative source for filers of Form 8938. However, we could not report complete information on foreign financial assets reported by Form 8938 filers because such data are incomplete; as noted above, IRS databases we used to extract Form 8938 data—IRTF and MTRDB—do not include asset information reported on paper filings of Forms 8938. Of the approximately 404,800 Forms 8938 filed by individuals for tax year 2016—the most recent data available—we could access information on residency of filers and reported foreign financial assets from about 277,600 Forms 8938 that did not indicate that foreign financial assets and values were declared on other forms besides the Form 8938. Of the subset of these Forms 8938, more than one quarter—or about 73,500— reported foreign financial assets in amounts that indicate the Form 8938 may have been filed unnecessarily, since they reported specified foreign financial assets with aggregate values at or below reporting thresholds as of the last day of the tax year. Based on available Form 8938 data from tax year 2016, table 2 shows that about 61,900 filings from U.S. persons living in the United States and about 11,600 filings from U.S. persons living abroad during the same tax year reported specified foreign financial assets with aggregate values at or below end of tax year thresholds. These totals likely understate the total number of Forms 8938 that U.S. persons may have filed unnecessarily in tax year 2016; due to data limitations, these totals exclude Forms 8938 without asset information stored in IRS’s databases, including most Forms 8938 filed on paper and Forms 8938 where filers identified that they declared foreign financial assets on other forms besides the Form 8938. There is no clear explanation as to why some U.S. persons may have filed Forms 8938 unnecessarily. However, we identified a number of potential reasons from focus groups and other interviews with stakeholder groups. In focus groups we conducted, participants expressed confusion about IRS’s instructions for completing the Form 8938 and information provided on IRS’s website. In the instructions for completing Form 8938, IRS described the specific types of foreign financial assets that are to be reported on Form 8938, and the asset value thresholds that must be met for required reporting, depending on the location of residence and filing status of the taxpayer. IRS also posted responses to frequently asked questions on meeting FATCA reporting requirements on its website, and established a separate page on its website comparing foreign financial assets that must be reported on Form 8938 and/or FBAR. Nonetheless, focus group participants reported confusion on whether and how to report investment and retirement accounts and compulsory savings plans managed by their country of residence. In a meeting we convened with an organization representing tax attorneys, they told us taxpayers are unsure about what account values to report on the Form 8938. Tax practitioners participating in another focus group added that they filed Forms 8938 regardless of the aggregate value of the assets because it was too cumbersome for them to identify whether the assets exceeded reporting thresholds as of the end of the year or at any time during the year. IRS officials also cited a number of possible reasons why U.S. persons may be filing Forms 8938 unnecessarily. For example, it may be easier for U.S. persons to report all specified foreign financial assets they hold on the Form 8938, rather than determine whether the value of such assets met applicable thresholds. IRS officials also said that U.S. persons might complete a Form 8938 for reasons besides meeting tax-filing requirements, such as providing evidence of assets for a loan application. IRS’s Taxpayer Bill of Rights states that taxpayers are entitled to clear explanations of the laws and IRS procedures in all tax forms, instructions, publications, notices, and correspondence. Furthermore, one of IRS’s strategic goals is to empower taxpayers by making it easier for them to understand and meet their filing, reporting, and payment obligations. IRS officials said they hosted sessions for tax practitioners at IRS Nationwide Tax Forums to address FATCA reporting requirements. However, they said IRS has not taken direct steps to identify or implement actions to further clarify instructions and related guidance on IRS’s website for completing Form 8938, such as information on which foreign financial assets to report, how to calculate asset values, and determine whether such values exceed required reporting thresholds. Additionally, IRS officials said they have not conducted additional outreach to educate taxpayers on required reporting thresholds under FATCA, or notify Form 8938 filers of instances where aggregate values of specified foreign financial assets reported on Forms 8938 were below reporting thresholds. IRS officials said they have not made efforts to determine whether there is a pattern of unnecessary Form 8938 filings that they could address. Rather, they said they believed resources should be devoted to FATCA implementation in general. However, as shown above, we have identified many tens of thousands of instances where U.S. persons may have filed Forms 8938 unnecessarily. Without assessing factors contributing to unnecessary Form 8938 reporting—and identifying or implementing actions to further clarify and educate taxpayers on FATCA reporting requirements—IRS is missing opportunities to help taxpayers understand their filing and reporting obligations and minimize their compliance burdens while properly meeting their tax obligations. Additionally, IRS may be missing opportunities to reduce costs in processing forms that taxpayers did not need to file. Because of overlapping statutory reporting requirements, IRS and FinCEN—both bureaus within Treasury—collect duplicative foreign financial asset data using two different forms (Form 8938 and FBAR). Our evaluation and management guide for fragmentation, overlap, and duplication states that overlap occurs when multiple agencies or programs have similar goals, engage in similar activities or strategies to achieve them, or target similar beneficiaries. Table 3 shows that individuals required to report foreign financial assets on Form 8938, in many cases, also must meet FBAR reporting requirements. For example, specified individuals with foreign financial accounts exceeding $50,000 in aggregate value on the last day of the tax year must file both Form 8938 and FBAR if such values exceed the minimum Form 8938 thresholds; these thresholds depend on the filing status and address of specified individuals. Table 3 also shows that, in many cases, specified interests in foreign financial assets as defined in Form 8938 instructions are the same as the financial interest in such assets under FBAR. Further, as noted in table 3, the overlapping requirements lead to IRS and FinCEN collecting the same information on certain types of foreign financial assets. For example, both Form 8938 and FBAR collect information on foreign financial accounts for which a person has signature authority and a financial interest in the account. Form 8938 and FBAR also both collect duplicative information on several other types of foreign financial assets, such as foreign mutual funds and accounts at a foreign financial institution that include foreign stock or securities. Overlapping reporting requirements result in most Form 8938 filers also filing an FBAR during the same reporting year. Table 4 shows that close to 75 percent of Form 8938 filers in tax years 2015 and 2016 percent also filed an FBAR for the same year using the same TIN. Overlapping requirements to file both Form 8938 and FBAR increases the compliance burden on U.S. persons and adds complexity that can create confusion, potentially resulting in inaccurate or unnecessary reporting. Focus group participants in all five countries included in our study affirmed that U.S. persons experienced confusion and frustration with having to report duplicative foreign financial asset information on both forms. Focus group participants and others we interviewed also noted that U.S. persons incurred additional financial costs to complete and file both Form 8938 and FBAR. For instance, one tax practitioner in Canada said the charge was about $190 to report four-to-five accounts on an FBAR in addition to charging about $540 for basic tax return packages. An accounting firm based in Japan typically charged between $300 and $800 to complete a Form 8938 and between $150 and $500 to complete an FBAR, depending on the number of accounts reported on the forms. Proposed revisions to regulations implementing BSA proposed by FinCEN may also increase the number of duplicative foreign financial accounts reported on Form 8938 and FBAR. Currently, U.S. persons must report detailed information on all foreign financial accounts on Form 8938 if the value of such accounts and other specified foreign financial assets reaches applicable reporting thresholds. In contrast, U.S. persons are generally exempted from reporting detailed account information on FBARs if they report having signature or other authority over 25 or more foreign financial accounts. FinCEN’s proposed revisions to BSA regulations would eliminate the exemption, requiring U.S. persons to report detailed information on all foreign financial accounts in which he or she has a financial interest if the value of such accounts exceed FBAR’s $10,000 reporting threshold. FinCEN estimated that it will receive account information for the first time on about 5.4 million foreign financial accounts if it finalizes the proposed revisions. In turn, these revisions may lead to increased filings of duplicative asset data on both Form 8938 and FBAR, as U.S. persons may have to report detailed information on all foreign financial accounts using both forms. U.S. persons also face exposure to two different penalty regimes for any failures in accurately and completely reporting foreign financial asset information to two bureaus within Treasury—IRS and FinCEN. Officials from one organization representing U.S. persons living abroad said penalties due to failure to report certain accounts on one or both forms can be significant, even if little or no taxes are owed on those accounts. The duplicative reporting of foreign financial asset data on two different forms also creates additional costs to the government to process and store the same or similar information twice, and enforce reporting compliance with both requirements. In 2012, we recommended that Treasury direct the Office of Tax Policy, IRS, and FinCEN to determine whether the benefits of implementing a less duplicative reporting process exceed the costs and, if so, implement that process. Treasury did not implement our recommendation. While we continue to believe that the agencies should have considered whether less duplicative reporting could have been implemented, we do recognize that FATCA and FBAR were enacted under two different statutes to serve different purposes. As mentioned above, according to IRS, FATCA improves visibility into taxable income from foreign sources and enhances the agency’s ability to identify and pursue taxpayer noncompliance. In contrast, the information reported on the FBAR is collected to identify money laundering and other financial crimes; law enforcement agencies can use BSA information—including information collected from FBARs— to aid regulatory and criminal investigations. Additionally, data collected from Form 8938 and FBAR are used in different systems for use by different bureaus within Treasury. Fully addressing issues stemming from overlapping reporting requirements and the resulting collection of duplicative information—while at the same time ensuring that such information can be used for tax compliance and law enforcement purposes—can only be done by modifying the statutes governing the requirements. Further, IRS and FinCEN have varying degrees of access to foreign financial asset information collected from Form 8938 and FBAR to enforce tax compliance and financial crime laws. FATCA was enacted, in part, to improve visibility into taxable income from foreign sources. However, information provided on Forms 8938 is taxpayer return information protected by section 6103 of the Internal Revenue Code (IRC), which generally prohibits IRS from disclosing information provided on Forms 8938. IRS can share return information with other government agencies and others when it is allowed by statute. For example, under section 6103, IRS may disclose return information related to taxes imposed under the IRC—such as self-employment income tax, Social Security and Medicare tax and income tax withholding—to the Social Security Administration (SSA) as needed to carry out its responsibilities under the Social Security Act. However, according to FinCEN officials, FinCEN, law enforcement, and regulators often cannot access information submitted on Forms 8938. While section 6103 provides other exceptions to disclosure prohibitions—such as allowing IRS to share return information with law enforcement agencies for investigation and prosecution of nontax criminal laws—such information is generally only accessible pursuant to a court order. As noted above, information reported on the FBAR can be used by law enforcement agencies to aid regulatory and criminal investigations. This includes IRS, which has been delegated responsibility from FinCEN to enforce compliance with FBAR reporting requirements. IRS has used FBAR information in addressing taxpayer noncompliance with reporting and paying taxes on foreign assets and income. For example, taxpayers accepted into one of IRS’s offshore voluntary disclosure programs must have filed amended or late FBARs as part of their program applications. Investigators from IRS’s Criminal Investigation division generally reviewed applications to determine if the taxpayer has made a complete and truthful disclosure. IRS examiners can also use information from case files of program participants—such as information disclosed on FBARs— to identify new groups of taxpayers suspected of hiding income offshore. IRS can then choose to continue offering offshore programs and encourage these newly identified groups of taxpayers, as well as all taxpayers with unreported offshore accounts, to disclose their accounts voluntarily. In addition to eliminating overlapping reporting requirements, harmonizing statutes governing foreign financial asset reporting and use of information collected on such assets to make such statutes fully consistent could yield additional benefits to both IRS and the law enforcement community. Specifically, and as shown in appendix IV, there are specified foreign financial assets reported on Form 8938—such as foreign hedge funds and foreign private equity funds—that are not required to be reported on an FBAR. In contrast, there are other specified foreign financial assets reported on an FBAR—such as indirect interests in foreign financial assets through an entity—that are not required to be reported on Form 8938. Without congressional action to address overlap in foreign financial asset reporting requirements, IRS and FinCEN will neither be able to coordinate efforts to collect and use foreign financial asset information, nor reduce unnecessary burdens faced by U.S. persons in reporting duplicative foreign financial asset information. Two reporting systems for sharing foreign account information from foreign financial institutions are in operation globally—FATCA and the Common Reporting Standard (CRS). According to officials from banking associations and a consulting firm, FFIs in the countries where we examined FATCA implementation encountered challenges implementing and now maintaining two overlapping reporting systems for collecting and transmitting account information to other countries for a seemingly similar purpose, and collecting sufficient information from customers to ensure they meet the requirements of both systems. As noted above, we previously identified overlap as occurring when multiple agencies or programs have similar goals, engage in similar activities or strategies to achieve them, or target similar beneficiaries. According to an IRS official, collecting account information under FATCA ushered in an era of greater transparency; as noted above, FATCA’s passage sought to reduce tax evasion by creating greater transparency and accountability with respect to offshore accounts and other assets held by U.S. taxpayers. When FATCA was first introduced, there was no international platform to share account information between countries. The United States and other countries worked together to reach an agreement on the electronic formatting that would be used to share the information. Other countries tax authorities’ became more interested in understanding the financial assets held abroad by their residents through an exchange of account information among themselves. In response, the Organisation for Economic Co-operation and Development (OECD) established the CRS reporting system for automatic exchange of information among member countries. According to the OECD, CRS was developed with a view to maximize efficiency and reduce cost for financial institutions. Thus, CRS drew extensively on the intergovernmental approach used to implement FATCA reporting requirements for FFIs. Countries participating in CRS exchange account information with each other using OECD’s Common Transmission System, which was modeled on FATCA’s International Data Exchange System. Figure 2 depicts the flow of account information between countries under FATCA and CRS. CRS reporting requirements are in many ways similar to FATCA, including required reporting of the account holders’ name and address, taxpayer identification number, account number, account balance, and income and sales proceeds. However, the requirements differ in significant ways. The biggest differences in requirements are driven by the nature of the U.S. tax system. The United States, like many countries, generally taxes citizens and resident aliens on their worldwide income regardless of where that income is earned. However, the United States differs from other countries because it generally subjects U.S. citizens who reside abroad to U.S. taxation in the same manner as U.S. residents. In contrast to U.S. policy, most other countries do not tax their citizens if they reside in a country other than their country of citizenship. Further, IGAs implementing FATCA require FFIs to report the foreign-held accounts of U.S. citizens and residents—including resident aliens—while CRS requires financial institutions in jurisdictions participating in CRS to report on almost all accounts held by nonresidents of the reporting country. Appendix V provides more detailed information on differences in reporting requirements, due diligence requirements, and definitions under FATCA and CRS. These differences in tax systems drive variations in due diligence procedures between FATCA and CRS. For example, FATCA aims to identify whether an account holder at a foreign institution is a U.S. person based on citizenship and tax residency information. In contrast, CRS aims to identify the tax residency of all account holders of a financial institution, and does not consider citizenship. Due to the multilateral nature of CRS, if an account holder is determined on the basis of the due diligence procedures to have residency in two or more countries, information would be exchanged with all jurisdictions in which the account holder is determined a resident for tax purposes. Under CRS rules, information about foreign accounts held by a U.S. citizen with a tax residence abroad would not be reported to IRS, but rather to the jurisdiction in which they were a resident for tax purposes. Because the United States taxes the worldwide income of U.S. citizens, CRS rules would need to require identification of account holders’ citizenship in member countries where they are residents if FATCA were to be aligned with CRS. Table 5 shows a comparison of individuals reported to IRS under FATCA and hypothetically under CRS. Treasury and IRS, as part of its 2017-2018 Priority Guidance Plan, are considering modifying certain elements of the existing FATCA regulations. For instance, Treasury and IRS are considering coordinating certain documentation requirements for participating FFIs with the requirements under IGAs. In December 2018, Treasury and IRS also proposed regulations intended, in part, to reduce the burdens of FATCA. The proposed regulations included a clarification of the definition of an investment entity that is similar to the guidance published by OECD interpreting the definition of a “managed by” investment entity under CRS. If the United States wanted to adopt CRS, some of the key differences between FATCA and CRS—as outlined above and in appendix V—could be aligned through regulation while others would require legislation. According to Treasury officials, to align FATCA and CRS, Congress would need to revise statutes to: provide for the collection of information for accounts that residents of partner jurisdictions maintain at U.S. financial institutions; require certain U.S. financial institutions to report the account balance (including, in the case of a cash value insurance contract or annuity contract, the cash value or surrender value) for all financial accounts maintained at a U.S. office and held by foreign residents; expand the current reporting required with respect to U.S. source income paid to accounts held by foreign residents to include similar non-U.S. source payments; require financial institutions to report the gross proceeds from the sale or redemption of property held in, or with respect to, a financial account; and require financial institutions to report information with respect to financial accounts held by certain passive entities with substantial foreign owners. While better aligning FATCA and CRS to some extent is possible, anything short of the United States fully adopting CRS would not fully eliminate the burdens of overlapping requirements that FFIs must currently meet under the two different systems. While having the United States adopt the CRS reporting system in lieu of FATCA could benefit FFIs that may otherwise have to operate two overlapping reporting systems, it would result in no additional benefit to IRS in terms of obtaining information on U.S. accounts. Additionally, it could generate additional costs and reporting burdens to U.S. financial institutions that would need to implement systems to meet CRS requirements. The extent of these costs is unknown. Further, adoption of CRS would create the circumstance where foreign accounts held by U.S. citizens with a tax residence in partner jurisdiction—including U.S. citizens who have a U.S. tax obligation—would not be reported to IRS. Tax practitioners and others we interviewed said that U.S. persons living abroad—whether or not they are required to complete a Form 8938—risk being denied access to foreign financial services. U.S. persons and tax practitioners located in four of the five countries where we conducted focus groups and interviews reported that some U.S. persons and U.S.- owned businesses encountered difficulties opening bank accounts with FFIs after FATCA was enacted, with some FFIs closing U.S. persons’ existing accounts or denying them opportunities to open new accounts. One focus group participant, for example, said that the financial institution closed down all accounts including business checking, savings, and money market accounts after FATCA was implemented, requiring this individual to find a local resident who could co-sign on a new account. Costs FFIs would incur from implementing FATCA were cited as a significant factor in increasing barriers faced by U.S. persons in accessing foreign financial services. Officials from one organization representing tax attorneys said that as a result of costs associated with FATCA implementation, FFIs have found it less burdensome to close accounts of U.S. persons or require the accounts to be moved to a Securities and Exchange Commission registered affiliate than comply with FATCA. Tax practitioners and an official from a bankers association added that because FFIs may gain only small margins of profit from U.S. persons, FFIs may believe it is too troublesome to do business with them. Additionally, officials from a foreign government agency told us that because FATCA is expensive for FFIs to continue implementing, banks in their country might charge U.S. persons seeking access to financial services additional fees to account for FATCA implementation costs. Tax practitioners, consultants working with FFIs to implement FATCA reporting requirements, and the National Taxpayer Advocate told us that FFIs with smaller asset sizes such as smaller trust companies were more prone to decline business with U.S persons. Officials from an advocacy group representing U.S. persons living abroad told the National Taxpayer Advocate that some smaller banks declined U.S. persons as customers as a business decision, believing it would cost more for them to comply with FATCA reporting requirements than maintain U.S. expatriates’ accounts. Banking associations we interviewed said that decisions made by FFIs on whether to accept U.S. persons as customers also depends on the overall risks and benefits of taking on individual U.S. persons, shaped in part from risks in not meeting FATCA reporting requirements. Representatives of a banking association and an advocacy group told us that some FFIs decided to avoid doing business with U.S. persons after they became concerned about potential penalties for failure to comply—either willfully or in error—with FATCA reporting requirements. One banking association added that such errors could affect other aspects of FFIs’ relationships with the U.S. government, such as nonprosecution agreements made with the U.S. Department of Justice. Officials from one consulting firm that helped FFIs meet FATCA reporting requirements added that FFIs’ determination of risk depends on many layers, such as the value of clients’ assets or the country in which clients reside or possess citizenship. After FATCA’s implementation, according to officials from the consulting firm, FFIs decided to turn away U.S. persons in some cases because the benefits of doing business with U.S. persons were less than the potential risks. For example, if a U.S. person only maintained a payroll account, the FFI may determine it would not make enough money to account for risks in incorrectly identifying the status of the customer as a U.S. or non-U.S. person. However, focus group participants from two countries said that FFIs may agree to accept U.S persons as customers if they have higher account balances that offset risks from FATCA reporting requirements. One focus group participant, for instance, said banks in his country will do business with a U.S. person if he or she has more than $500,000 in assets. Additionally, U.S. persons and tax practitioners we interviewed said that other factors such as language barriers and U.S. regulations designed to prevent money laundering may also inhibit U.S. persons’ access to brokerage accounts while overseas. Focus group participants and others we interviewed said that Form 8938 reporting requirements contributed to denials of employment and promotion opportunities for U.S. persons living abroad. Treasury officials noted that requirements imposed by FATCA do not directly hinder U.S. persons from gaining employment or promotion opportunities overseas. However, focus group participants, a consulting firm, and a foreign government agency noted that foreign-owned companies and nonprofit organizations such as churches did not want to hire or promote U.S. persons because they wanted to avoid exposing information to the U.S. government on their organizations’ accounts and client trust accounts where the U.S. person would have signature authority. As noted above, a U.S. person is generally required to report on the Form 8938 foreign financial accounts for which the person has signature authority if he or she has a financial interest in the account. Focus group participants and others noted that such requirements have adversely affected the ability of U.S. persons to serve on a corporate board or in a nonprofit organization, or maintain business relationships. Treasury and Department of Commerce officials stationed in one country included in our review added that FATCA implementation has played a role in dissuading foreign-owned corporations in some Asian countries from considering U.S. persons for corporate leadership positions such as directorships. This is in part because FATCA has triggered additional paperwork burden and operating costs for onboarding U.S. employees since they have had to help them meet Form 8938 reporting requirements. Two advocacy groups representing U.S. persons living abroad added that it is also harder for U.S.-based companies to justify relocating U.S. persons overseas and paying for such relocations since they also have had to help their U.S. employees meet Form 8938 reporting requirements in addition to meeting other tax filing requirements. U.S. embassy documents indicate there was increased demand for Social Security Numbers (SSN) since FATCA’s passage in 2010, driven in part by U.S. citizens applying for an SSN to gain access to foreign financial services or resolve outstanding U.S. tax obligations before completing renunciation. However, officials from two organizations representing Americans living abroad cited significant challenges faced by some U.S. persons living abroad in obtaining SSNs required to meet their U.S. tax obligations or obtain financial services. U.S. persons living abroad might not possess an SSN because their parents did not obtain one for them as a minor. Often, this may have been due to the parents leaving the United States when the child was young. State officials also said that U.S. citizens applying for U.S. passports while overseas frequently forget their SSNs or do not know if their parents ever applied for an SSN on their behalf. Officials from organizations representing U.S. persons living abroad added that without an SSN, these persons are unable to claim refunds or other tax benefits when filing their tax returns, or participate in IRS programs to voluntarily disclose previously unreported tax liabilities and assets. Additionally, some might be unable to gain or maintain access to financial accounts or other assets in their countries of residence without an SSN. According to these officials and tax practitioners we interviewed, U.S. persons living abroad face greater challenges in obtaining SSNs than those living in the United States. For instance, they faced difficulties obtaining documentation from the United States that the Social Security Administration (SSA) requires with SSN applications; traveling to Social Security offices and U.S. embassies or consulates to certify documents or submit applications in person; and receiving valid SSNs from SSA in a timely manner to file tax returns or participate in offshore disclosure programs. SSA officials also identified several challenges U.S. persons experience when applying for an SSN from abroad. For instance, SSA officials said that efforts to authenticate documents submitted with SSN applications can cause delays for U.S. persons living abroad in obtaining an SSN. Additionally, SSN applicants living abroad face significantly longer wait times than applicants living in the United States once their applications are processed. According to SSA officials, after an application is processed, it can take 3 to 6 months–-depending on the country’s mail service–-for an individual to receive a Social Security Card. This is significantly longer than the 2-week period it takes SSN applicants to receive a card after mailing in their applications from within the United States. According to Department of State (State) data, the annual number of approvals of requests for renunciations of U.S. citizenships increased nearly 178 percent during a 6-year period, from 1,601 in 2011—the year after FATCA was enacted—to 4,449 in 2016, the most recent year to which full data on renunciations were available. According to U.S. embassy documents and information provided by focus group participants and interviewees across all the countries we examined, FATCA was the reason or a contributing factor in some of these decisions and the resulting increase in total renunciations. Specific effects of FATCA implementation contributing to decisions to renounce U.S. citizenship included reduced access to foreign financial services and employment or promotion opportunities in a foreign-owned company—as identified above from our document reviews, focus groups, and interviews—and burdens in meeting FATCA reporting requirements. However, the extent to which FATCA implementation contributed to increased renunciations is unclear. State officials said that data are unavailable to determine the extent to which these renunciation decisions were the direct result of FATCA because State has no legal obligation to collect information on the motivation behind renunciation of citizenship. In response to concerns about the availability of foreign financial services, Treasury implemented regulations that allow certain low-risk local FFIs to be deemed compliant with FATCA, but only if the FFIs do not implement policies or practices that discriminate against opening or maintaining accounts for specified U.S. persons. Treasury and State also previously established joint strategies to address these challenges. For instance, Treasury and State developed guidance on FATCA that was posted on embassy websites to educate U.S. persons and others. Additionally, Treasury and State officials conducted outreach events and workshops through U.S. embassies and American chambers of commerce worldwide to provide information on FATCA and other tax filing requirements, According to State officials, the U.S. embassies in at least two countries—Switzerland and France—also worked with foreign officials and/or FFIs to increase access to financial services for U.S. citizens residing in those countries. For instance, Treasury and State officials reached agreements with FFIs in Switzerland to provide a wider range of financial services to U.S. persons. Similarly, in 2017, SSA and State implemented an interagency agreement to streamline processes for providing SSNs to U.S. persons living abroad after FATCA’s implementation in 2010. SSA officials said they are also in discussions with State on improving SSA’s website to include more transparent, specific information for SSN overseas applicants about SSA documentation requirements. Tax practitioners, advocacy groups, and Treasury officials we interviewed said FFIs have become more willing to accept U.S. persons as customers compared to when FATCA was enacted in 2010. However, U.S. persons living abroad continue to face issues gaining access to foreign financial services. For example, in a September 2018 letter sent by the Chair of the Finance Committee of the Netherlands House of Representatives to a member of Congress, U.S. citizens born outside the United States and who have never lived, studied, or worked in the United States are effectively being denied access to financial services in the Netherlands. Focus group participants added that some banks will reject U.S. clients or charge heavy fees for them to open an account. Agencies have ongoing efforts to address FATCA-related issues, as listed below, but some are ad hoc, fragmented, or otherwise not part of a broader effort between Treasury and other agencies such as State or SSA to use ongoing collaborative mechanisms to monitor and share information on such issues, and jointly develop and implement steps to address them: Treasury officials said they are participating in discussions with FFIs to address residual issues with access to foreign financial services. However, they said they have not involved other agencies in these discussions. IRS officials, in response to concerns from the French government, said they are developing a program to help streamline foreign asset- related tax compliance requirements for a small group of U.S. born citizens that have been French residents most of their lives without an SSN, and—according to State officials—did not wish to take the necessary steps to renounce their citizenship. However, no effort has been made to address these issues more broadly. State encouraged U.S. citizens to alert the nearest U.S. embassy of any practices they encounter with regard to the provision of financial services. State documents noted that some Americans have been turned away by banks or required to meet a higher deposit threshold in part because of FATCA reporting requirements. State documentation also noted that there have been cases of U.S. citizens with existing bank accounts who have been asked to close them. However, State documentation we reviewed does not highlight collaborative efforts currently underway with Treasury or other agencies to address banking access issues U.S. persons living abroad are presently encountering worldwide. As described above, SSA and State streamlined processes and policies for U.S. persons abroad seeking to obtain SSNs. However, SSA officials said they have not been involved in any ongoing efforts involving Treasury to identify systemic issues and related solutions involving SSNs for the purposes of tax compliance and citizenship renunciations. Treasury officials said they spoke with SSA officials about problems U.S. persons living abroad face in obtaining SSNs, but SSA believed that cycle times for processing SSN applications submitted by U.S. persons living abroad were not significantly greater than for applications submitted by U.S. persons living in the United States, although mailing times could vary significantly and take up to 3 to 6 months. We have previously identified key practices to enhance and sustain interagency collaboration, including defining and articulating a common outcome, establishing mutually reinforcing or joint strategies, and developing mechanisms to monitor, evaluate, and report on results. One goal in IRS’s strategic plan is to collaborate with external partners proactively to improve tax administration, while objectives in SSA’s strategic plan include improving service delivery and expanding service delivery options. Additionally, according to State’s Bureau of Consular Affairs website, one of State’s key priorities is to protect the interests of U.S. citizens overseas, such as through ensuring responsive and efficient provision of consular services overseas. As noted above, there are a host of ongoing issues and challenges for U.S. persons living abroad from implementation of FATCA, such as loss of access to foreign financial services, denial of employment and promotion opportunities overseas, and difficulty obtaining SSNs from abroad. However, Treasury currently lacks a collaborative mechanism to coordinate efforts with other agencies to address these issues, and Treasury officials said they do not plan to establish them. Without effective collaborative mechanisms to monitor and share information and implement cross-agency solutions, future efforts to address such issues will continue to be fragmented and less effective than they otherwise could be. In enacting FATCA, Congress sought to reduce tax evasion by creating greater transparency and accountability over offshore assets held by U.S. taxpayers. Because of FATCA, IRS receives information on foreign financial assets from hundreds of thousands of filers annually. IRS could use this information to help ensure taxpayers holding offshore assets report and pay taxes owed on income generated from such assets. However, to take full advantage of the information, IRS must address key challenges. Specifically, Taxpayer Identification Numbers (TIN) reported by FFIs are often inaccurate or incomplete, which makes it difficult for IRS to match information reported by FFIs to individual taxpayers. As such, IRS must develop a plan to mitigate the risks that these data issues pose to agency efforts to identify and combat taxpayer noncompliance. Lack of consistent, complete, and readily available Form 8938 and related parent individual tax return data also affects IRS’s compliance activities, making it more difficult for IRS business units to extract and analyze FATCA data to improve tax compliance efforts and reduce tax revenue loss from income generated from offshore assets. At the same time, IRS has stopped following its FATCA Compliance Roadmap it developed in 2016 because, according to IRS officials, IRS moved away from updating broad strategy documents to focus on individual compliance campaigns. However, in light of the challenges IRS continues to face in fully integrating FATCA information into its compliance programs, it will not maximize use of such information and effectively leverage individual compliance campaigns unless it employs a comprehensive plan that enables IRS to better leverage such campaigns to improve taxpayer compliance. Our analysis of available data indicates that many of the Forms 8938 filed in tax year 2016 may have been filed unnecessarily. Factors that are contributing to this unnecessary reporting are unclear. While IRS has provided instructions and guidance on its website for completing Form 8938, focus group participants and tax practitioners reported confusion on whether and how to report investments in foreign accounts. Taking steps to identify and address factors contributing to unnecessary Form 8938 reporting would help reduce taxpayer burden and reduce processing costs for IRS. Reporting requirements for foreign financial assets under FATCA overlap with reporting requirements under FBAR. These overlapping requirements—implemented under two different statutes—have resulted in most taxpayers filing Forms 8938 also filing FBARs with FinCEN. Duplicative filings on foreign financial assets cause confusion, frustration, and compliance burdens for taxpayers. Duplicative filings also increased costs to the government to process and store the same or similar information. Modifying the statutes governing the requirements can fully address the issues outlined above, and can allow for the use of FATCA information for prevention and detection of financial crimes. This is similar to other statutory allowances for IRS to disclose return information for other purposes, such as for determining Social Security income tax withholding. Lastly, FATCA has created challenges for some U.S. persons living abroad that go beyond increasing their tax compliance burdens. Some U.S. persons living abroad are still facing issues accessing financial services and employment and obtaining SSNs. Treasury, State, and SSA have taken some steps to address these issues both separately and in coordination with each other. However, Treasury, as the agency ultimately responsible for effective administration of FATCA, currently lacks a collaborative mechanism with State and SSA to address ongoing issues. Establishing a formal means to collaboratively address burdens faced by Americans abroad from FATCA can help agencies develop effective solutions to mitigate such burdens. We are making the following matter for congressional consideration: Congress should consider amending the Internal Revenue Code, Bank Secrecy Act of 1970, and other statutes, as needed, to address overlap in foreign financial asset reporting requirements for the purposes of tax compliance and detection, and prevention of financial crimes, such as by aligning the types of assets to be reported and asset reporting thresholds, and ensuring appropriate access to the reported information. We are making the following four recommendations to IRS: The Commissioner of Internal Revenue should develop a plan to mitigate risks with compliance activities due to the lack of accurate and complete TINs of U.S. account holders collected from FFIs. (Recommendation 1) The Commissioner of Internal Revenue should ensure that appropriate business units conducting compliance enforcement and research have access to consistent and complete data collected from individuals’ electronic and paper filings of Form 8938 and elements of parent individual tax returns. As part of this effort, the Commissioner should ensure that IRS provides clear guidance to the business units for accessing such data in IRS’s Compliance Data Warehouse. (Recommendation 2) The Commissioner of Internal Revenue should employ a comprehensive plan for managing efforts to leverage FATCA data in agency compliance efforts. The plan should document and track activities over time to ensure individuals and FFIs comply with FATCA reporting assess and mitigate data quality risks from FFIs; improve the quality, management, and accessibility of FATCA data for compliance, research, and other purposes; and establish, monitor, and evaluate compliance efforts involving FATCA data intended to improve voluntary compliance and address noncompliance with FATCA reporting requirements. (Recommendation 3) The Commissioner of Internal Revenue should assess factors contributing to unnecessary Form 8938 reporting and take steps, as appropriate, to address the issue. Depending on the results of the assessment, potential options may include: identifying and implementing steps to further clarify IRS Form 8938 instructions and related guidance on IRS’s website on determining what foreign financial assets to report, and how to calculate and report asset values subject to reporting thresholds; and conducting additional outreach to educate taxpayers on required reporting thresholds, including notifying taxpayers that may have unnecessarily filed an IRS Form 8938 to reduce such filings. (Recommendation 4) We are also making the following recommendation to Treasury: The Secretary of the Treasury should lead efforts, in coordination with the Secretary of State and Commissioner of Social Security, to establish a formal means to collaboratively address ongoing issues— including issues accessing financial services and employment and obtaining SSNs—that U.S. persons living abroad encounter from implementation of FATCA reporting requirements. (Recommendation 5) We are also making the following recommendation to State: The Secretary of State, in coordination with the Secretary of the Treasury and Commissioner of Social Security, should establish a formal means to collaboratively address ongoing issues—including issues accessing financial services and employment and obtaining SSNs—that U.S. persons living abroad encounter from implementation of FATCA reporting requirements. (Recommendation 6) We are also making the following recommendation to SSA: The Commissioner of Social Security, in coordination with the Secretaries of State and Treasury, should establish a formal means to collaboratively address ongoing issues—including issues accessing financial services and employment and obtaining SSNs—that U.S. persons living abroad encounter from implementation of FATCA reporting requirements. (Recommendation 7) We provided a draft of this report to the Secretaries of State and the Treasury, Commissioner of Internal Revenue, and Acting Commissioner of Social Security. IRS provided written comments that are summarized below and reprinted in appendix VI. IRS did not state whether it agreed or disagreed with our four recommendations but otherwise provided responses. Regarding our recommendation to develop a plan to mitigate risks with compliance activities due to the lack of accurate and complete TINs of U.S. account holders collected from FFIs (recommendation 1), IRS reiterated that it provided a transition period, through the end of 2019, for compliance with the TIN requirements for FFIs in countries with Model 1 IGAs with the United States. IRS also said that it continued to make progress on improving FATCA filing compliance, citing efforts such as initiating a campaign addressing FFIs that do not meet their compliance responsibilities. While these efforts may help IRS obtain more accurate and complete information from financial accounts, IRS did not specify how it will mitigate the ongoing hurdles it faces in matching accounts reported by FFIs without valid TINs to accounts reported by individual tax filers and ensure compliance. Regarding our recommendation that appropriate business units have access to consistent and complete data collected from Forms 8938 and tax returns filed by individuals (recommendation 2), IRS reiterated that RAAS has been working to obtain read-only access to the IPM database but that limited budgetary resources are delaying implementation. Enabling access to consistent and complete Form 8938 and tax return data would help IRS better target compliance initiatives and leverage limited available enforcement resources. While IRS continues to work on enabling access to IPM, it could still provide clear guidance to its business units for accessing Form 8938 and tax return data in IRS’s Compliance Data Warehouse, as we recommended. Regarding our recommendation to employ a comprehensive plan for managing efforts to leverage FATCA data in agency compliance efforts (recommendation 3), IRS said the resources that would be required to develop a comprehensive plan would be better spent on enforcement activities. While implementing enforcement activities could increase compliance with FATCA reporting requirements, it risks not maximizing the value of such efforts without a comprehensive plan to manage and address the myriad of challenges discussed in this report. Further, it is our belief that IRS’s failure to execute the FATCA roadmap is not justification for abandoning a strategic approach going forward. Regarding our recommendation to assess factors contributing to unnecessary Form 8938 reporting and take appropriate steps to address the issue (recommendation 4), IRS said it will continue to observe filings of Form 8938 and, to the extent that there are unnecessary filings, assess options to inform account holders to reduce reporting and filing burdens followed by appropriate steps to implement any selected options. Our analysis of available data indicates that many Forms 8938 may have been filed unnecessarily. Implementing our recommendation reduces the risk that taxpayers file—and IRS processes—forms unnecessarily. Treasury provided written comments but did not state whether it agreed or disagreed with our recommendation that it lead efforts, in coordination with State and SSA, to establish a formal means to collaboratively address ongoing issues that U.S. persons living abroad encounter from implementation of FATCA reporting requirements (recommendation 5). Treasury said it will work collaboratively with State and SSA to answer questions that Americans abroad have regarding their tax obligations and, where appropriate, to direct U.S. citizens to resources that will help them understand the procedures applied by SSA to apply for an SSN. However, Treasury said it is not the appropriate agency to lead coordination efforts involving foreign employment issues and issues regarding access to foreign financial services and obtaining SSNs. As we noted above, Treasury is ultimately responsible for effective administration of FATCA. As such, it is in a better position than State or SSA to adjust regulations and guidance implementing FATCA to address burdens FFIs and foreign employers face from FATCA implementation while ensuring tax compliance. Additionally, Treasury has an interest in helping U.S. persons receive valid SSNs from SSA in a timely manner to meet their tax obligations. Treasury’s written response is reprinted in appendix VII. State and SSA also provided written comments in which they concurred with our recommendations to establish a formal means to address collaboratively together with Treasury ongoing issues that U.S. persons living abroad encounter with FATCA (recommendations 6 and 7). State and SSA’s written comments are reprinted in appendices VIII and IX, respectively. Treasury, State, and SSA provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretaries of State and the Treasury, Commissioner of Internal Revenue, Acting Commissioner of Social Security, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9110 or mctiguej@gao.gov. Contact points for our offices of Congressional Relations and Public Affairs are on the last page of this report. GAO staff who contributed to this report are listed in appendix X. The objectives of this report are to (1) assess the Internal Revenue Service’s (IRS) efforts to use information collected under the Foreign Account Tax Compliance Act (FATCA) to improve taxpayer compliance; (2) examine available foreign financial asset reports submitted by U.S. persons, including submissions that were below required filing thresholds; (3) examine the extent to which the Department of the Treasury (Treasury) administers overlapping reporting requirements on foreign financial assets; (4) describe similarities and differences between FATCA and Common Reporting Standard (CRS) reporting requirements; and (5) examine the effects of FATCA implementation that are unique to U.S. persons living abroad. For our first objective, we reviewed Treasury Inspector General for Tax Administration reports and collected information from Treasury and IRS to summarize efforts to collect complete and valid Taxpayer Identification Numbers (TIN) from foreign financial institutions (FFI). We identified criteria from our prior work identifying key practices for risk management. The key practices are derived from the Software Engineering Institute’s Capability Maturity Model® Integration for Development and Office of Management and Budget guidance. We applied these criteria to assess steps IRS has taken to manage risks in not receiving complete and valid TIN information from FFIs. We also applied criteria from our prior work on use of documented frameworks to IRS documentation on FATCA compliance activities to determine the extent to which IRS implemented a comprehensive plan to maximize use of collected data to enforce compliance with FATCA. For our second objective, we identified total maximum account values reported by individual filers of Financial Crimes Enforcement Network (FinCEN) Form 114s (commonly known as the Report of Foreign Bank and Financial Accounts, or FBAR) in calendar years 2015 and 2016. See appendix III for more details on our methodology to evaluate these data. We also summarized the numbers of IRS Forms 8938, Statement of Specified Foreign Financial Assets (Form 8938) filed in tax year 2016, accounting for the data limitations described below. We also identified Forms 8938 filed in tax year 2016—the most recent year for which data were available—with available residency and asset information that reported specified foreign financial assets with aggregate values at or below end-of-year tax thresholds, which vary depending on the location of residence and filing status of such filers. For our third objective, we reviewed IRS and FinCEN documentation, and applied criteria from Fragmentation, Overlap, and Duplication: An Evaluation and Management Guide to identify the extent to which IRS and FinCEN were engaged in overlapping activities, and collecting duplicative information on foreign financial assets held by U.S. persons. We assessed the extent to which individual filers who submitted a Form 8938 in 2015 and 2016 also submitted an FBAR for the same year by determining the number and percentage of Forms 8938 with TINs that also match the TIN listed on the corresponding FBAR for the same year. For the three objectives described above, we assessed the reliability of data submitted on Forms 8938 filed by individuals for tax years 2015 and 2016, the most recent data available. These data were extracted from IRS’s Individual Return Transaction File (IRTF) and Modernized Tax Return Database (MTRDB) through IRS’s Compliance Data Warehouse (CDW). We also assessed the reliability of data from FBARs for calendar years 2015 and 2016 by (1) reviewing documentation about the data and the systems that produced them; (2) conducting electronic tests, such as identifying data with significant numbers of missing Form 8938 or FBAR records, or values of foreign financial assets reported outside an expected range; (3) tracing selections or random samples of data to source documents; and (4) interviewing IRS and FinCEN officials knowledgeable about the data. We also reviewed Form 8938 and relevant parent tax return data stored in IRS databases to determine whether IRS management is using quality information collected from Forms 8938 to achieve its objectives, as defined in our Standards for Internal Control in the Federal Government. We determined that data extracted from IRTF on characteristics of Form 8938 filers and from FBAR filings was sufficiently reliable for our purposes, subject to caveats identified in this report. However, we determined we could not obtain complete data on foreign financial assets reported on Forms 8938 filed on paper. For our fourth objective, we reviewed model international agreements and other documentation, and interviewed officials from Treasury, IRS, and the Organisation for Economic Co-operation and Development to compare and contrast FATCA and CRS reporting requirements. We also used the collected information to identify what changes, if any, the United States and other countries could implement to align FATCA and CRS reporting requirements. For our fifth objective, we collected documentation and conducted focus groups and semi-structured interviews with 21 U.S. persons living abroad that were subject to FATCA reporting requirements. We also conducted focus groups and interviews with tax practitioners, banking and CPA organizations, government agencies, advocacy groups representing Americans living abroad, and other organizations from the United States and five other countries (Canada, Japan, Singapore, Switzerland, and the United Kingdom). We selected these countries based on geography, relatively high numbers of U.S. expatriates and Form 8938 filers, tax information sharing agreements, and other tax treaties with the United States. The findings from the focus groups and interviews are not generalizable to other U.S. persons, tax practitioners or organizations, but were selected to represent the viewpoints of U.S. persons, FFIs, and host country tax authorities required to transmit information on foreign accounts and other specified foreign financial assets to IRS. We conducted a thematic analysis of the focus groups and interviews, and reviewed cables from U.S. embassies to identify the unique effects of FATCA implementation on U.S. persons living abroad. We collected documentation from and interviewed Treasury, IRS, Department of State, and Social Security Administration officials on steps to monitor and mitigate such effects. We also identified criteria from our prior work on key practices to enhance and sustain interagency collaboration and mechanisms to facilitate coordination. We applied the criteria to agencies’ collaborative efforts addressing issues U.S. persons living abroad faced from FATCA’s implementation, and identified the extent to which agencies established effective collaborative mechanisms to identify, assess, and implement cross-agency solutions to such issues. We conducted this performance audit from August 2017 to April 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The following IRS databases store data collected from individuals’ electronic and paper filings of Forms 8938 and/or elements of individual parent tax returns—the filer’s address and filing status—used to determine specified reporting thresholds for Form 8938 filers: Individual Master File (IMF), which serves as IRS’s system for processing individual taxpayer account data. Using this system, accounts are updated, taxes are assessed, and refunds are generated as required during each tax-filing period. Individual Returns Transaction File (IRTF), which stores edited, transcribed, and error-corrected data from the Form 1040 series and related forms for the current processing year and two prior years. Modernized Tax Return Database (MTRDB), which serves as the official repository of all electronic returns processed through IRS’s Modernized e-File system. Tax return data is stored immediately after returns are processed. International Compliance Management Model (ICMM)-FATCA International Returns (ICMM-FIR), which collects, parses, and stores data from incoming form reports–such as Forms 8938 and 8966–into the FATCA Database (FDB), which serves as the repository where ICMM-FIR stores data and from which downstream applications can pull data. Integrated Production Model (IPM), which is a downstream data repository that houses IMF data, information returns, and other data. According to IRS officials, data from IPM are consolidated and made available to a variety of downstream, security certified, systems for use in conducive analysis, case selection, and report preparation. Additionally, data from these and other IRS databases are copied to IRS’s Compliance Data Warehouse (CDW) periodically, which captures data from multiple production systems and organizes the data in a way that is conductive to analysis. Table 6 highlights several problems with the consistency and completeness of Form 8938 and relevant parent tax return data stored across the listed databases. Inconsistent and incomplete data on address and filing status of Form 8938 filers: As noted above, elements of parent tax returns— specifically the filer’s country of residence and filing status—are used to determine specified reporting thresholds for Form 8938 filers. However, IRTF and MTRDB have inconsistent and incomplete data on addresses linked to Form 8938 filers, and report inconsistent numbers of Forms 8938 filed from a U.S. residence. For example, the variable identified as containing data on foreign countries of residence in IRTF shows approximately 8,100 foreign filers in tax years 2015 and 2016, whereas a similar variable in MTRDB shows approximately 89,000 foreign filers for those same years. Additionally, FDB does not contain country codes from paper filings of Form 8938. ICCM-FIR stores information from some elements from parent tax returns—such as TINs and document locator numbers. According to IRS officials, however, ICMM-FIR lacks data on country codes and filing status of Form 8938 filers. IRS officials said that ICMM-FIR was not designed or intended to store data on Form 8938 filers; rather, it was designed to be a database for use in comparing Form 8938 and 8966 data. In general, IRS officials indicated that they would like to adjust the way ICMM-FIR stores data, but that would require modifying the way the database was established. Incomplete data on assets reported on Forms 8938: MTRDB contains detailed information on specified foreign financial assets submitted on electronic filings of Form 8938 and the country code from which the Form 8938 was filed. IRS officials said it is not designed to store information submitted on paper filings of Forms 8938 and parent tax returns. IRS officials said that while IMF processes information transcribed from individual income tax returns, there is no requirement to cross-reference information from the tax return with information submitted with an accompanying Form 8938. Additionally, while IRS officials told us that IRTF is the authoritative source for filers of Form 8938, it does not store account and other asset information submitted from Forms 8938. When asked whether there is any move to store account and other asset information collected from Forms 8938 into IRTF, IRS officials said that the decision on what returns or portions of returns are transcribed are subject to resource constraints and are prioritized from year to year. Table 7 shows that more than 900,000 individuals filed Financial Crimes Enforcement Network (FinCEN) Form 114s (commonly known as the Report of Foreign Bank and Financial Accounts, or FBAR) in calendar years 2015 and 2016, and declared total maximum values of accounts ranging from about $1.5 trillion to more than $2 trillion each year. We are providing a range of estimates because we found a large number of filings made potentially in error. In some cases, for instance, FBAR filers reported more than $100 trillion in foreign financial accounts. We assume many of these filings are likely made in error, but have only limited means to determine which filings have errors, and which filings have accurate information. Because we cannot independently verify the accuracy of all self-reported FBAR data, we decided to present a range of data with (1) a lower bound discarding all FBAR filings reporting total values of reported foreign financial accounts at or above $1 billion; and (2) an upper bound discarding all filings reporting total values of such accounts at or above $5 billion. Table 2 excludes amended and duplicated FBAR filings. This table also excludes FBAR filings that reported a financial interest in 25 or more financial accounts, but reported total maximum account values of $0 from parts II and III of the FBAR. Although we identified problems with the data, we determined they were reliable enough to provide an estimated range of asset values to report the scale of foreign financial accounts held by U.S. persons. Table 8 shows a detailed breakdown of 2015 and 2016 FBAR filings by residence and categories of total maximum account values reported on the FBARs. Appendix IV: Detailed Comparison of Individual Foreign Financial Asset Reporting Requirements 26 U.S.C. § 6038D; 26 C.F.R. §§ 1.6038D-1 to 1.6038D-8. 26 C.F.R. § 1.6038D-2. Filers in this category include those who identify as single, married filing separately, “head of household,” or “qualifying widow(er).” Includes maximum value of specified foreign financial assets (Form 8938) or maximum value of financial accounts maintained by a financial institution physically located in a foreign country (FBAR). Under FATCA, any income, gains, losses, deductions, credits, gross proceeds, or distributions from holding or disposing of the account are or would be required to be reported, included, or otherwise reflected on a person’s income tax return. Under FBAR reporting requirements, a person has signature or other authority if he or she has the authority (alone or in conjunction with another) to control the disposition of money, funds or other assets held in a financial account by direct communication (whether in writing or otherwise) to the person with whom the financial account is maintained. The account itself is subject to reporting, but the contents of the account do not have to be separately reported. In addition to the contact named above, Brian James (Assistant Director), Mark Ryan (Analyst-in-Charge), Ariana Graham, George Guttman, Krista Loose, Daniel Mahoney, Cynthia Saunders, A.J. Stephens, and Elwood White made key contributions to this report. Michael John Bechetti, Ted Burik, and Jacqueline Chapin also provided assistance.

Question: Write a one-page summary of the report 1.

Answer: To help address long-standing financial management system deficiencies, DHS initiated its TRIO project, which has focused on migrating three of its components to a modernized financial management system provided by IBC, an OMB-designated, federal SSP. House Report Number 3128 included a provision for GAO to assess the risks of DHS using IBC in connection with its modernization efforts. This report examines (1) the extent to which DHS and the TRIO components followed best practices in analyzing alternatives, and the key factors, metrics, and processes used in their choice of a modernized financial management system; (2) the extent to which DHS managed the risks of using IBC for its TRIO project consistent with risk management best practices; and (3) the key factors and challenges that have impacted the TRIO project and DHS's plans for completing remaining key priorities. GAO interviewed key officials, reviewed relevant documents, and determined whether DHS followed best practices identified by GAO as necessary characteristics of a reliable, high-quality AOA process and other risk management best practices. The Department of Homeland Security's (DHS) TRIO project represents a key effort to address long-standing financial management system deficiencies. During 2012 and 2013, the TRIO components—U.S. Coast Guard (Coast Guard), Transportation Security Administration (TSA), and Domestic Nuclear Detection Office (DNDO)—each completed an alternatives analysis (AA) to determine a preferred alternative for modernizing its financial management system. GAO found that DNDO's AA substantially met the four characteristics—well-documented, comprehensive, unbiased, and credible—that GAO previously identified for a reliable, high-quality analysis of alternatives (AOA) process. However, Coast Guard's and TSA's AAs did not fully or substantially meet three of these characteristics, and DHS guidance for conducting AAs did not substantially incorporate certain best practices, such as identifying significant risks and mitigation strategies and performing an independent review to help validate the AOA process. Based on these analyses and other factors, the TRIO components determined that migrating to a federal shared service provider (SSP) represented the best alternative, and in 2014, DHS selected the Department of the Interior's Interior Business Center (IBC) as the federal SSP for the project. However, because Coast Guard's and TSA's AAs did not fully or substantially reflect all of the characteristics noted above, they are at increased risk that the alternative selected may not achieve mission needs. DHS also did not fully follow best practices for managing project risks related to its use of IBC on the TRIO project. Specifically, DHS followed three of seven risk management best practices, such as determining risk sources and categories and establishing a risk management strategy. However, it did not fully follow four best practices for defining risk parameters, identifying risks, developing risk mitigation plans, and implementing these plans largely because its guidance did not sufficiently address these best practices. For example, although DHS created joint teams with IBC and provided additional resources to IBC to help address risk mitigation concerns, it did not always develop sufficiently detailed risk mitigation plans that also included contingency plans for selected critical risks. As a result, although IBC's capacity and experience for migrating large agencies the size of Coast Guard and TSA was identified as a risk in July 2014, a contingency plan working group to address this concern was not established until January 2017. By not fully following risk management best practices, DHS is at increased risk that potential problems may not be identified or properly mitigated. DHS, IBC, Office of Management and Budget (OMB), and other federal oversight agencies identified various challenges that have impacted the TRIO project and contributed to a 2-year delay in the implementation of Coast Guard's and TSA's modernized solutions. These challenges include the lack of sufficient resources, aggressive schedule, complex requirements, increased costs, and project management and communication concerns. To help address these challenges, DHS and IBC established review teams and have taken other steps to assess potential mitigating steps. In May 2017, DHS determined that migrating the solution from IBC to a DHS data center represented the best option and initiated discovery efforts to further assess this as its path forward for the TRIO project. GAO recommends that DHS more fully follow best practices for conducting an AOA process and managing risks. DHS concurred with GAO's recommendations and described actions it will take, or has taken, in response.