You are given two reports by the government agency.  

Report 1:
Risk management, as applied to security of federal facilities, entails a continuous process of applying a series of mitigating actions—assessing risk through the evaluation of threats, vulnerabilities, and consequences; responding to risks with appropriate countermeasures; and monitoring risks using quality information (see fig. 1). In 1995, Executive Order 12977 established the ISC after the bombing of the Oklahoma City Alfred P. Murrah Federal Building in April 1995. The ISC’s mandate is to enhance the quality and effectiveness of security in and protection of federal facilities in the United States occupied by federal employees for nonmilitary activities. The order directs the ISC to develop and evaluate security standards for federal facilities, develop a strategy to ensure executive agencies and departments comply with such standards, and oversee the implementation of appropriate security measures in federal facilities. The ISC has released a body of standards, including the ISC Standard, designed to apply to the physical security efforts of all federal, non-military agencies. The ISC Standard prescribes a process for agencies to follow in developing their risk assessment methodologies (see fig. 2). Most federal departments and agencies are generally responsible for protecting their own facilities and have physical security programs in place to do so. The ISC Standard requires executive departments and agencies to follow the risk-management process when conducting risk assessments for each of their facilities. That process begins with determining the facility security level, ranging from level I (lowest risk) for facilities generally having 100 or fewer employees to level V (highest risk) for the most critical facilities and generally having greater than 750 employees. The security level designation determines the facility’s baseline countermeasures. For each facility, departments and agencies are required to (a) consider all of the “undesirable events” that could pose a risk to their facilities— such as active shooters, vandalism, and explosions—and (b) assess three factors of risk (threats, vulnerabilities, and consequences) to specific undesirable events. Subsequently, agencies are to combine all three factors to yield a measurable level of risk for each undesirable event (see app. III). Based on the results of these assessments, agencies should customize (either increase or decrease) the countermeasures to adequately reflect the assessed level of risk. In addition, as part of planning for physical security resources within an agency’s budget process, the ISC has identified the need to balance allocations for countermeasures with other operational needs and with competing priorities. The ISC Best Practices have some similarities with leading practices in capital decision-making. For example, both state that the allocation of resources should be integrated into the agency’s mission, objectives, goals, and budget process. However, beyond the ISC Best Practices, the Office of Management and Budget and we have developed more comprehensive leading practices in capital decision- making that provide agencies with guidance for prioritizing budget decisions such as for countermeasure projects. The Office of Management and Budget and our guidance also emphasize evaluating a full range of alternatives, informed by agency asset inventories that contain condition information, to bridge any identified performance gap. Furthermore, the guidance calls for a comprehensive decision-making framework to review, rank, and select from among competing project proposals. Such a framework should include the appropriate levels of management review, and selections should be based on the use of established criteria. The following describes the mission and physical security program characteristics for the agencies in our review: CBP, the nation’s largest law enforcement agency, has responsibility for securing the country’s borders. It also has responsibility for conducting security assessments at about 1,200 facilities, including approximately 215 federally owned and agency-controlled higher-level facilities (facility security levels III and IV). These facilities include border patrol stations with holding cells for people detained at the border, office buildings, and canine-training centers. CBP conducts these assessments. FAA’s mission is to provide a safe and efficient aerospace system for the country. According to agency data, FAA has 55 federally owned and agency-controlled higher-level facilities—including critical air traffic control towers. According to FAA officials, FAA specialists conduct security assessments. ARS conducts research related to agriculture and disseminates information to ensure high-quality safe food and to sustain a competitive agricultural economy. According to agency data, ARS has security responsibility for four domestic federally owned and agency- controlled higher-level facilities—including laboratories for research to improve food and crop quality, office buildings, and warehouses. ARS security personnel have responsibility for conducting security assessments. The Forest Service sustains the health, diversity, and productivity of the nation’s forests and grasslands. According to agency officials, the Forest Service has one federally owned and agency-controlled higher- level facility—a regional headquarters office building. The Forest Service’s security officials have responsibility for conducting security assessments, but at the time of our review, USDA security officials conducted the assessment at Forest Service’s one higher-level facility. None of the four selected agencies’ security assessment methodologies fully aligned with the ISC Standard. The ISC gives agencies some flexibility to design their own security-assessment methodologies for identifying necessary countermeasures as long as the chosen methodology adheres to fundamental principles of a sound risk- management methodology. Specifically, methodologies must: consider all of the undesirable events identified in the ISC Standard as possible risks to federal facilities, and assess three factors of risk (threats, vulnerabilities, and consequences) for each of the events. Furthermore, the ISC Standard requires executive departments and agencies to document decisions that deviate from the ISC Standard. Agencies’ policies and methodologies reference the ISC Standard. However, none of the agencies’ methodologies considered all of the undesirable events during assessments although they used some type of risk assessment methodology. In addition, the agencies did not always adhere to these principles of risk management (see table 1). At the time of our review, CBP’s methodology did not fully align with the ISC Standard because it did not consider all of the 33 undesirable events nor assess threat and consequence. CBP security specialists assessed vulnerabilities at building entrances and exits, in interior rooms, and around the perimeter using a yes/no checklist during the assessment process. However, assessment reports showed that specialists did not assess the threats and consequences of undesirable events at each facility. According to security officials, the gap occurred because they designed the checklist to meet requirements in the 2009 CBP Security Policy and Procedures Handbook, which predates the first edition of the ISC Standard issued in 2010. CBP officials told us that as of January 2017, they began using an improved methodology to assess the threats, vulnerabilities, and consequences for 30 of 33 undesirable events— omitting three now identified in the November 2016 revision to the ISC Standard. However, CBP has not yet updated its handbook to align with the ISC Standard, even though it started this effort over 3 years ago in December 2013. CBP officials did not provide a draft of its updated handbook, but they provided a plan with milestone dates for issuing the handbook by September 2018. CBP officials also told us that updates to the handbook may have to wait due to competing priorities, including efforts to address the backlog of assessments (which we discuss later in this report). Delays in updating the handbook mean that CBP’s policy will continue to not align with the ISC Standard. Furthermore, although CBP security officials told us that all of the agency’s security specialists have been trained to use the improved assessment methodology, without documentation of the methodology in agency policy, there may be greater risk of its inconsistent application. Standards for Internal Control emphasize the importance of agencies developing and documenting policies to ensure agency-wide objectives are met. Documentation serves to retain institutional knowledge over time when questions about previous decisions arise. Without an updated policy handbook that requires a methodology that assesses all undesirable events consistent with the ISC Standard, CBP cannot reasonably ensure that its facilities will have levels of protection commensurate to their risk. FAA’s methodology does not fully align with the ISC Standard because it does not consider all of the 33 undesirable events nor does it assess all three factors of risk. FAA security specialists assess vulnerabilities to the site perimeter, entryways, and interior rooms using a yes/no checklist, but the checklist does not assess the consequences from each of the undesirable events at each facility. With respect to threat, FAA applies the ISC’s baseline threat—a general federal facilities threat level that relates directly to a set of baseline countermeasures—across all its higher-level facilities because FAA policy states that there is no agency-specific threat that exceeds the current baseline threat. According to FAA officials, the baseline threat standardizes the security needs across their facilities rather than addressing the security needs of individual facilities from specific threats. When necessary, FAA policy allows specialists to modify countermeasures based on an evaluation of conditions at the facility. FAA realized that this approach was no longer appropriate given the agency-wide goal to make risk-based decisions, a review of the assessment process after a 2014 Chicago fire incident that destroyed critical FAA equipment, and an awareness of ISC initiatives to assess compliance. To address the resulting methodological gaps, FAA hired a contractor to design, develop, test, and validate an improved risk- assessment methodology. Subsequently, FAA improved its methodology in January 2017 to assess the threats, vulnerabilities, and consequences for 30 of the 33 undesirable events identified in the November 2016 revision to the ISC Standard —and tested the methodology at lower- and higher-level facilities. This revised methodology addresses the need to assess individual facility needs rather than using a standardized baseline approach. In April 2017, FAA officials told us of their plan for implementing this methodology and provided tentative milestone dates to conduct further testing, training, and analysis before deciding to use the improved methodology, which they expect to complete by January 2018. However, their plan lacks the necessary information to ensure successful implementation, such as detail on how many facilities they will test and how they will use the results of testing, training, and analysis to implement the improved methodology within the identified 9-month time frame. Furthermore, the improved methodology does not address undesirable events for which ISC issued countermeasures in May 2017. Without a detailed implementation plan to assess the methodology’s impact on its security program, FAA cannot reasonably ensure that its facilities have the proper countermeasures. With ongoing changes to its security program, FAA has an opportunity to fully align its improved methodology with the ISC Standard by including all 33 undesirable events and to update its policy requiring the use of such a methodology. Unlike CBP and FAA—which developed their own methodologies separate from their parent departments (Department of Homeland Security (DHS) and Department of Transportation (DOT), respectively)— ARS and the Forest Service follow an assessment methodology developed by USDA. USDA’s methodology does not fully align with the ISC Standard because it does not consider all of the 33 undesirable events for which ISC issued countermeasures in May 2017. Security specialists from USDA headquarters typically assess ARS’s and the Forest Service’s higher-level facilities using a risk-based methodology that considers the 31 undesirable events listed in the previous version of the ISC Standard dated August 2013. However, until recently, USDA did not assign ratings to each of the three risk factors—threat, vulnerability, and consequence—and then combine these ratings to yield a measurable level of risk for each undesirable event. USDA security officials said that they have revised the assessment-reporting format to include this risk calculation and trained their specialists to measure risk in this way. USDA officials provided us with a new assessment template that addresses all 33 undesirable events and includes measuring risk. Additionally, USDA officials said that they are revising their outdated physical security manual and expect to complete it by April 2018. With a revised manual and application of the new assessment template, USDA should be better positioned to assess risk at its facilities. When agencies do not use methodologies that fully align with the ISC Standard, they could face deleterious effects, ranging from facilities having inappropriate levels of protection to agencies having an inability to make informed resource allocation decisions for their physical security needs. Specifically, the ISC Standard states that facilities may face the effect of either having (1) less protection than needed resulting in inadequate security or (2) more protection than needed resulting in an unnecessary use of resources. The ISC Standard also states that these effects can be negated by determining the proper protection according to a risk assessment. Identified excess resources in one risk area then can be reallocated to underserved areas, thus ensuring the most cost- effective security program is implemented. As an illustration of such potential effects, we found that two agencies assessing two higher-level facilities came to two different conclusions in terms of their need for X-ray machines to screen for guns, knives, and other prohibitive items in federal facilities. Specifically, one agency based its decision on a policy that does not deviate from the ISC’s baseline set of countermeasures, and the other agency based its decision on professional judgement that deviated from the ISC’s baseline set of countermeasures. Neither agency based its decision on a risk assessment nor documented its decision—both ISC requirements, specifically: Without conducting a risk assessment, FAA recently expanded a policy requirement calling for all higher-level facilities to have X-ray machines and magnetometers. This new requirement poses a potentially sizeable investment for the agency with an estimated cost of X-ray machines of about $24,000 and magnetometers of about $4,000 each. FAA may need such equipment at all its higher-level facilities. However, the ISC Standard requires that agencies conduct risk assessments first to justify their needs. Without conducting risk assessments, FAA managers could unnecessarily use resources by installing such equipment in all higher-level air traffic facilities when there may be higher priority needs A USDA security specialist decided, despite an ISC baseline requirement that higher–level facilities have X-ray machines, not to recommend an X-ray machine at a higher-level Forest Service facility. The specialist reasoned that unlike other federal buildings with numerous unknown visitors, this facility receives mostly known individuals and a limited number of visitors. The ISC Standard allows for professional judgement; however, the ISC requires that agencies document deviations from the baseline set of countermeasures. Reducing the facility’s level of protection without documenting an assessment of risk could result in no record of the basis of the decision for current and future facility managers and security officials to review or use as justification in the case of a question of compliance. In another case, we found that one higher-level facility did not have access control for employees or visitors nor did it have armed guard patrols. The facility manager told us that intelligence and a history without incidents gave leadership reason to believe that these measures were not needed and that therefore the agency did not require and would not fund such protective measures for this facility—in effect, accepting the risks to the facility. Security officials said they also had the same understanding and did not document the matter in the assessment report even though agency policy and the ISC Standard require written documentation when officials deviate from the baseline requirement. Without security assessments that fully align with the ISC Standard and provide measureable levels of risk, agencies do not have the information they need to determine priorities and make informed resource allocation decisions. For example, they may not be able to assess whether to acquire or forego costly physical-security countermeasures—such as, X- ray machines, access control systems, and closed-circuit television systems—for facilities. Additionally, after determining the need to acquire a countermeasure, agencies must fund the countermeasure. As previously discussed, leading practices in capital decision-making include a comprehensive framework to review, rank, and select from competing project proposals for funding. In conducting risk assessments that do not fully align with the ISC Standard (i.e., not assessing threats, vulnerabilities, and consequences and measuring risks), agencies miss the opportunity for more informed funding decisions. Three of the four agencies (CBP, ARS, and the Forest Service) currently prioritize funding for operational needs over physical security needs (see table 2) when agencies’ priorities might be different if they based their decisions on an aligned risk assessment. Standards for Internal Control state that agencies should use quality information on an ongoing basis as a means to monitor program activities and take corrective action, as necessary. The ISC requires that agencies assess higher-level facilities at least once every 3 years—an interval requirement to identify and address evolving risks. We found that three of the four agencies (CBP, ARS, and the Forest Service) did not meet this requirement. Officials reported various challenges including (1) assessments competing with other security activities, (2) an insufficient number of qualified staff to conduct assessments when compared to the number of facilities, or (3) not knowing of the required assessment schedule. An “information system” is the people, processes, data, and technology that management organizes to obtain, communicate, or dispose of information. that had not been reassessed since 2010. CBP security officials attributed the backlog to (1) having too few security specialists assigned to assess about 1,200 facilities and (2) the specialists working on competing priorities, such as revising the security handbook, conducting technical inspections, and reviewing new construction designs and renovation projects. According to CBP security officials, they have developed a plan to eliminate the backlog by the end of fiscal year 2018 by prioritizing the completion of assessments. While we found the plan comprehensive, the schedule did not seem feasible. For example, the plan assumes that one specialist can complete six assessments in 3 consecutive days and that another specialist can complete three assessments in 1 day. In contrast, security officials told us specialists take about 20 work hours (or 2½ days) to conduct an on-site assessment of one facility. CBP officials said that they believe they can meet the time frames of the plan because they have set aside other priorities and have a thorough understanding of the scope of work involved at the facilities. They added that it will not be easy to meet the timeline, but they can accomplish it with a motivated and committed workforce, adequate financial resources, and absent activities that would otherwise require shifting of resources. We question the feasibility of setting aside important priorities, such as updating the policy manual and reviewing physical security elements in new construction designs, as well as the workload assumptions for completing the assessments. Further, these other priorities are also key to securing facilities. Without balancing assessments with competing priorities, CBP’s time frames for completing the assessments by the end of fiscal year 2018 may not be feasible and may also result in the agency’s not addressing other important physical security responsibilities. Since the ISC issued its standard in 2010, ARS and the Forest Service have assessed their higher-level facilities at least once. However, these agencies have not reassessed all of their higher-level facilities within the 3-year interval requirement. Specifically, security specialists have not conducted required reassessments of two ARS and one Forest Service higher-level facilities. The ARS headquarters official explained that the agency had not reassessed the two facilities due to competing priorities and insufficient internal resources. During the course of our review, ARS headquarters officials said they began assessing one of the two ARS facilities in May 2017 and will begin assessing the second facility in October 2017. The Forest Service official explained that the agency missed its security reassessment of the regional office because the facility staff had not requested one. During our visit, facility staff responsible for security told us that they were not aware of the ISC’s 3- year interval requirement. Facility staff requested a reassessment, and security officials told us that they expected to complete it by mid-June 2017. Completing this one-time assessment may address the facility’s security needs temporarily. However, ARS and the Forest Service have not implemented a long-term schedule with key milestones and lack a means to monitor completion of assessments of higher-level facilities at least once every 3 years. Consequently, these agencies cannot reasonably ensure that they have full knowledge of the risks to their facilities. FAA data from 2010 through 2016 show that FAA has assessed its 55 higher-level facilities at least once every 3 years. FAA policy requires that specialists schedule assessments of higher-level facilities every 12– 18 months depending on whether the facility has met FAA physical security standards. The ISC Standard states that to make appropriate resource decisions, agencies need information, such as what is being accomplished, what needs management attention, and what is performing at expected levels. We found that agencies’ methods of collecting and storing security information had limitations that affected agency and facility officials’ oversight of the physical security of their facilities (see table 3). Without having long-term, agency-wide information to monitor whether assessments are conducted on schedule, ARS and the Forest Service may not meet the ISC Standard, resulting in not adequately protecting their facilities and employees. The ISC Standard also states that agencies should measure their security program’s capabilities and effectiveness to demonstrate the need to fund facility security and to make appropriate decisions for allocating resources. However, the agencies in our review were unable to demonstrate appropriate oversight of their physical security programs because: CBP’s handbook does not include requirements for data collection and analysis for monitoring physical-security program activities. Facility managers and security officials do not enter assessment results, such as the countermeasures recommended for facilities, in the real property database. Consequently, they do not have comprehensive data to manage their security program, assess overall performance, and take any necessary corrective actions. A CBP official told us that a comprehensive database would allow CBP to set priorities for addressing countermeasures. Without including data collection and analysis requirements in its updated handbook, CBP may be unable to monitor the performance of its physical security program. FAA’s policy does not require ongoing monitoring of physical security information, such as the status of recommended countermeasures or assessment schedules. As a result, FAA officials do not proactively use physical security information to assess the overall performance of its physical security program and take corrective actions before an incident occurs. Without a policy requiring ongoing monitoring of information—an internal control activity, FAA may be unable to assess the overall performance of its security program and take necessary corrective actions. USDA has a decentralized security program and places the responsibility on agencies to create their physical security programs. Security officials from ARS and the Forest Service told us that USDA does not have a policy for collecting and managing agency-wide information; however, they said that USDA is drafting a new departmental regulation and manual that will specify (1) the roles and responsibilities of agency and facility managers and (2) electronic- data-reporting requirements for monitoring the performance of the physical security program. USDA officials provided a draft of USDA’s regulation and manual for our review. The draft regulation did not mention data reporting and monitoring, while the draft manual only contained a table of contents that included a section entitled “Facility Tracking Database.” USDA officials expect to issue new policies sometime between October 2017 and April 2018. In the absence of new departmental regulation and manual, USDA and Forest Service officials told us that they have begun to develop a Forest Service system for storing electronic copies of agency-wide assessments and that they plan to expand the use of this system to track site specific assessment dates and status of recommended countermeasures. Forest Service officials provided milestone dates and described the capabilities for a future information system, which they expect to complete in September 2017. However, we could not determine whether the manual will have information system requirements to monitor agencies’ physical security program, an internal control activity. Without USDA’s including data collection and analysis requirements in its manual, its agencies may not be able to monitor the performance of their physical security programs. Without agencies having information to monitor security activities, they were unable to provide us information on the status of countermeasures across their entire portfolio. In order to better understand the status of countermeasures implemented and facilities’ experiences when implementing countermeasures, we determined the status of countermeasures at 13 facilities we visited. As previously noted, risk management, as it pertains to physical security, involves agency officials monitoring their physical security programs. During our visits to 13 selected facilities, we found the four agencies differed in the number of countermeasures that they had not implemented. Facility officials provided us with some information on why countermeasures had not been implemented, specifically: CBP had a significant number of recommended countermeasures from 2010 through 2016 that remained open at the eight selected CBP facilities. CBP facility officials gave reasons why recommended countermeasures had not been implemented. At one facility, officials did not know about the recommended countermeasures from its last 2010 assessment because the individuals previously knowledgeable about the assessments left the organization without communicating the results. By taking action to improve facility security, they implemented some needed countermeasures. However, at the time of our review, a large number of the recommendations remained open. At another facility, officials told us that they too had not known (for the same reason mentioned above) of their 2010 assessment, which contained recommended countermeasures. However, these officials told us that they submitted a funding request a few weeks before our visit to address all except one of the open countermeasures. In other cases, facilities have not implemented needed countermeasures due to resource constraints or physical site limitations. FAA had a large number of recommended countermeasures from 2010 through 2016 that remained open at the time of our review for the two FAA facilities visited. In this case, the most recent security assessment, completed in late 2016, resulted in one facility’s having little time to implement countermeasures by the time we conducted our analysis. While ARS had closed almost all recommended countermeasures at two facilities at the time of our review, one Forest Service facility had not yet implemented a recommendation (to secure its entrance doors) that was identified in a 2013 security assessment (see bottom center photo, fig. 3). This countermeasure remained open because facility officials said they continued to explore alternatives to address the recommendation. Figure 3 shows examples of countermeasures not fully implemented at selected facilities we visited. During our site visits and discussions with facility staff, we found that physical site limitations or other priorities can make it difficult for facility managers to implement countermeasures. For example, a countermeasure might involve correcting a clear zone violation—that is, moving an object (such as a brick wall) a certain distance away from the facility’s perimeter fence to prevent a potential intruder from using the object to climb over the fence. However, when the object near the fence is a building and the property outside of the fence is not federally owned (see bottom right photo, fig. 3), it may not be cost effective to correct the clear zone violation. In this situation, the agency bears the responsibility for exploring ways to address the vulnerability. In following the ISC Standard, as previously noted, managers are required to justify and document why they could not implement recommended countermeasures—what the ISC calls risk acceptance. Selected agencies carry a great responsibility for protecting facilities that support border protection activities, provide safe and efficient air traffic around the country, and protect the quality of the nation’s food supply. With this responsibility comes the need to appropriately assess risk to ensure the security of these agencies’ facilities. However, 7 years after the ISC issued its initial risk-management process standard, each of four selected agencies continued to use assessment methodologies that did not fully align with this standard. During our review, agencies improved their methodologies to better align with the ISC Standard, but the agencies had not yet incorporated the methodologies into their policies and procedures. Without updated policies and procedures requiring a methodology that adheres to the ISC Standard (including all 33 undesirable events now identified in the November 2016 revision to the ISC Standard), agencies may not collect the information needed to assess risk and determine priorities for improved security. This situation could hamper the agencies’ ability to make informed resource allocation decisions or to recommend countermeasures commensurate to the needs at specific facilities. To address challenges in conducting timely assessments, agencies that had a backlog developed plans to address them, but the assumptions used in CBP’s plans and time frames did not appear to fully reflect the agency’s competing priorities and actual experience. Additionally, ARS and Forest Service have not implemented a long-term assessment schedule with key milestones to ensure that higher-level facilities are reassessed at least once every 3 years. Further, in cases where the agencies may have had risk assessment information, CBP, ARS, and the Forest Service lack the means to collect, store, and analyze this information in order to monitor the status of a facility’s security. Without these key aspects of a comprehensive security program—a methodology that meets the standard, policies, and procedures that incorporate that methodology; the ability to complete assessments on time; and information to perform monitoring—agencies remain vulnerable to substantial security risks. To improve agencies’ physical security programs’ alignment with the ISC Risk Management Process for Federal Facilities and Standards for Internal Control in the Federal Government for information and monitoring, we recommend that the Commissioner of U.S. Customs and Border Protection take the following three actions: with regard to the updated Security Policy and Procedures Handbook, the ISC’s Risk Management Process for Federal Facilities requirement to assess all undesirable events, consider all three factors of risk, and document deviations from the standard, and data collection and analysis requirements for monitoring the performance of CBP’s physical security program. revise the assumptions used in the plan to address the backlog to balance assessments with competing priorities, such as updating the policy manual and reviewing new construction design, to develop a feasible time frame for completing the assessment backlog. Secretary of Transportation direct the FAA Administrator to take the following three actions: develop a plan that provides sufficient details on the activities needed and time frames within the date when FAA will implement an improved methodology; update FAA’s policy to require the use of a methodology that fully aligns with the ISC’s Risk Management Process for Federal Facilities for assessing all undesirable events, considering all three factors of risk, and documenting all deviations from the standard countermeasures; and update FAA’s policy to include ongoing monitoring of physical security information. Secretary of Agriculture take the following two actions: include data collection and analysis requirements for monitoring the performance of agencies’ physical security programs, in the department’s revised physical-security manual, and direct the Administrator of the Agricultural Research Service and the Chief of the Forest Service to implement and monitor a long-term assessment schedule with key milestones to ensure that higher-level facilities are reassessed at least once every 3 years. We provided a draft of this report to the Departments of Homeland Security, Transportation, and Agriculture for review and comment. All three departments agreed with the findings and recommendations for their respective agencies. DHS agreed with our recommendations and provided actions and timeframes for completion. With regard to our recommendation to update the Security Policy and Procedures Handbook, DHS stated that CBP is updating the handbook to include: (1) a discussion and diagram of the ISC risk management process and its application within CBP’s assessment processes; (2) specific guidance for conducting risk assessments in accordance with the ISC’s Risk Management Process for Federal Facilities; and (3) a requirement and guidance for data collection and analysis in support of a robust physical security program. With regard to our recommendation to revise the assumptions used in the plan to address the assessment backlog, DHS stated that CBP has reevaluated current priorities and believes the current plan to eliminate the risk assessment backlog by the end of fiscal year 2018 is achievable. DHS also provided technical comments, which we incorporated as appropriate. DHS’s official written response is reprinted in appendix IV. DOT also agreed with our recommendations and by e-mail requested that we publish the response to the sensitive version of this report. DOT stated that FAA continues to refine its policy and develop processes that address the ISC threats, vulnerabilities, and consequences. Further, DOT stated that FAA would either validate that current mitigation strategies address those risks or apply additional appropriate countermeasures. DOT stated that it will provide a detailed response to each recommendation within 60 days from the date of this report. DOT’s official written response is reprinted in appendix V. USDA agreed with our recommendations and provided the agency-wide actions for completion. USDA provided a plan to ensure compliance with the ISC’s Risk Management Process for Federal Facilities by development of a standard physical-security assessment process and by initiation of a compliance program to track assessments and monitor the installation of countermeasures. In an e-mail, USDA provided milestone dates and planned completion by January 2019. USDA’s official written response is reprinted in appendix VI. If you or your staff has any questions about this report, please contact me at (202) 512-2834 or RectanusL@gao.gov. GAO staff who made key contributions to this report are listed in appendix VI. This report examines: (1) how selected agencies’ assessment methodologies align with the Interagency Security Committee’s (ISC) risk management standard for identifying necessary countermeasures and (2) what management challenges, if any, selected agencies reported facing in conducting physical security assessments and monitoring the results. To determine how selected agencies’ assessment methodologies align with ISC standards for identifying the necessary countermeasures, we identified federal executive branch departments and agencies reported by the Department of Homeland Security (DHS) to have received delegations of authority to protect their own buildings. We reviewed the Federal Real Property Council’s data on the Federal Real Property Profile to identify federally owned and agency-controlled buildings. We determined that these data were sufficiently reliable for the purpose of our reporting objectives based upon our recent report that reviewed these data fields. We selected four agencies based upon their large quantity of reported federally owned and agency-controlled buildings: DHS, U.S. Customs and Border Protection (CBP); Department of Transportation (DOT), Federal Aviation Administration (FAA); United States Department of Agriculture (USDA), Agricultural Research Service (ARS) and USDA’s United States Forest Service (Forest Service). This methodology purposely does not include federal buildings protected by FPS and under the control of the General Services Administration as well as other agencies that we reported on in our previous work. We obtained and reviewed one particular ISC standard, The Risk Management Process for Federal Facilities (the ISC Standard) and its related appendices for assessing physical security and providing recommended countermeasures at federal facilities. We obtained and analyzed the selected departments’ and agencies’ facility-security policies and procedures for a risk assessment methodology. According to the ISC Standard, agencies’ risk assessment methodologies must: consider all of the undesirable events identified in the ISC Standard as possible risks to federal facilities as listed in appendix III; assess the threat, consequences, and vulnerability to specific produce similar or identical results when applied by various security provide sufficient justification for deviations from the ISC-defined security baseline. We limited the scope of this review to the first two standards above because agencies’ adherence to these standards could be objectively verified by reviewing and analyzing agency documentation and interviewing agency officials, and their adherence to the two additional standards could not be verified in this manner. We did not conduct risk assessments with independent security professionals to evaluate: 1) the results from prior agency evaluations and 2) the sufficiency of justifications for deviations from the ISC-defined security baseline, as both evaluations were outside of the scope of the engagement. Therefore, for the purposes of this report, risk assessment policies, procedures and resulting methodology that align with ISC standards are those that consider all of the undesirable events and assess the threats, consequences, and vulnerabilities to specific undesirable events. We reviewed and analyzed information to answer the following five questions: 1. Do the policies and procedures mention the ISC standards? 2. Do the policies and procedures consider all of the undesirable events? 3. Do the policies and procedures assess the threat of specific undesirable events? 4. Do the policies and procedures assess the consequences of specific undesirable events? 5. Do the policies and procedures assess the vulnerability to specific undesirable events? We answered each of these questions as either a “Yes” or “No” for our selected agencies. The “No” answer to questions 3, 4, and 5 includes the following two possibilities: (a) the agency’s threat, consequence, or vulnerability ratings are not tied to specific undesirable events, or (b) the agency does not have a framework or formalized steps within which it collects and analyzes threat-, consequence-, or vulnerability-related information. If the answer to each of the five questions was “Yes,” then the agency’s overall risk assessment methodology aligns with ISC risk assessment standards for the purposes of this report. If the answer to one or more of the five questions was “No”, then the agency’s methodology does not to align with ISC standards for the purposes of this report. We interviewed security officials at ISC; three departments (DHS, DOT, and USDA); and four agencies (CBP, FAA, ARS, and the Forest Service). We obtained and analyzed agency guidance on prioritizing physical security needs and interviewed agencies’ facility maintenance and budget officials. We reviewed the ISC’s best practices for planning for physical security resources within an agency budget process. Additionally, we reviewed the Office of Management and Budget’s and our leading practices in capital decision-making that provide agencies with guidance for prioritizing budget decisions such as “countermeasure projects.” We also reviewed Standards for Internal Control in the Federal Government because internal controls play a significant role in helping agencies achieve their mission-related responsibilities. Our findings from our review of the selected agencies are not generalizable to all ISC member agencies, but provide insight into and illustrative examples about selected agencies’ facility risk-assessment methodologies. To determine what management challenges selected agencies reported facing in conducting physical security assessments and monitoring results, we interviewed agencies’ security, maintenance, and budget officials. We requested agency security officials to provide portfolio- wide data on facility security assessments for our review in order to select sites to visit and analyze data for dates of assessments and the status of findings. We assessed the reliability of this data through interviews with knowledgeable agency staff and a review for completeness and any unexpected values. We compiled information from physical security assessments when no portfolio-wide agency data were available. We determined that these data were sufficient for the purpose of our reporting objectives and selected geographically dispersed sites with buildings with higher reported security levels per the ISC Standard, as these higher security levels have greater requirements and therefore the potential for greater resource needs. See appendix II for the 13 sites we selected. For these selected sites, we interviewed agency staff concerning the assessment process, site-specific findings, recommendations, justification for deviations from ISC’s baseline standards, and management challenges faced in addressing physical security needs. We observed and photographed the status of the findings from the site physical security assessments. We did not independently determine what constitutes a management challenge or a physical security finding. Rather, we relied on these stakeholders to determine these physical security concerns as defined in their own standards and guidance. The information from our selected sites is illustrative and cannot be generalized to sites agency- wide. The performance audit upon which this report is based was conducted from June 2016 to August 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate, evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We subsequently worked with DHS, DOT and USDA from August 2017 to October 2017 to prepare this version of the original report for public release. This public version was also prepared in accordance with these standards. Error! No text of specified style in document. Error! No text of specified style in document. Appendix VII: GAO Contact and Staff Acknowledgments Error! No text of specified style in document. In addition to the contact named above, Amelia Shachoy (Assistant Director), Steve Martinez (Analyst-in-Charge), Jennifer Clayborne, George Depaoli, Geoffrey Hamilton, Joshua Ormond, Alison Snyder, Amelia Michelle Weathers, and Elizabeth Wood made key contributions to this report.

 

 Report 2:
In accordance with the Improper Payments Information Act of 2002 (IPIA), as amended, and OMB guidance, CMS developed the PERM to estimate the national Medicaid improper payment rate. CMS has other mechanisms to review and assess program integrity risks in state Medicaid managed care programs, and it uses information from the PERM to target its program integrity activities and oversight of states’ Medicaid programs. IPIA requires federal executive branch agencies to, among other things, (1) identify programs and activities that may be susceptible to significant improper payments; and (2), on an annual basis, estimate the amount of improper payments for susceptible programs and activities. Agency heads must produce a statistically valid estimate or an estimate that is otherwise appropriate, using an OMB-approved alternate methodology. Those agencies with programs identified by OMB as being high priority for additional oversight and review are required to submit annual reports to their Inspectors General detailing the actions the agency plans to take to recover improper payments and prevent future improper payments. The Inspector General of each agency submitting such a report is required to review the quality of the improper payment estimates and methodology, among other things. OMB designated Medicaid as a high priority program. In addition, the Improper Payments Elimination and Recovery Act of 2010 requires the Inspector General of each agency to conduct a compliance review to report on the agency’s compliance with several criteria, one of which is that an agency has reported an improper payment rate of less than 10 percent for each program and activity. IPIA also directed OMB to issue guidance for agencies in implementing the IPIA improper payments requirements. Among other things, the OMB guidance requires that agencies review payments made at the point that federal funds are transferred to nonfederal entities and report on the root causes of identified improper payments. To calculate the Medicaid improper payment rate through the PERM, CMS computes an annual rolling average of improper payment rates across all states based on a 17-state, 3-year rotation cycle. In accordance with IPIA, as amended, OMB approved CMS’s PERM methodology, and the HHS-OIG conducts annual compliance reviews. Beginning with its annual improper payment compliance review for fiscal year 2014, the HHS-OIG established a rotating approach to reviewing the estimation methodology for high-priority programs, including Medicaid, that OMB deemed susceptible to improper payments. Due to the number and complexity of the programs, the HHS-OIG methodology reviews are scheduled to be performed over a 4-year period; the PERM estimation methodology will be reviewed as a part of its fiscal year 2017 compliance review. Each of the three components of the Medicaid PERM—FFS, managed care, and eligibility—is estimated differently: The FFS component of the PERM measures errors in a sample of FFS claims, which are records of services provided and the amount the Medicaid program paid for these services. For the majority of sampled FFS claims, the PERM review contractor performs a medical review, which includes a review of the medical documentation to determine errors that do not meet federal and state policies, such as medically unnecessary services, diagnosis coding errors, and policy violations. Any FFS claims that were paid for services that should have been covered under a managed care plan’s capitated payment are also considered errors. The managed care component of the PERM measures errors that occur in the capitated payments that state Medicaid agencies make to managed care organizations (MCO) on behalf of enrollees. Capitated payments are periodic payments approved by CMS that state Medicaid agencies make to contracted MCOs to cover the provision of medical services to enrollees, as well as the MCOs’ administrative expenses and their profits or earnings. The PERM assesses whether any payments made to the MCOs were in amounts different than those the state agency is contractually required to pay, which are approved by CMS. In contrast to the FFS component, the managed care component of the PERM neither includes a medical review of services delivered to enrollees, nor reviews of MCO records or data. The eligibility component of the PERM measures errors in state determinations of whether enrollees meet categorical and financial criteria for receipt of benefits under the Medicaid program. The eligibility component assesses determinations for both FFS and managed care enrollees. This component has not been calculated since 2014; instead, CMS piloted different approaches to update the methodologies used to assess enrollee eligibility, as the Patient Protection and Affordable Care Act changed income eligibility requirements for nonelderly, nonpregnant individuals who qualify for Medicaid. Beginning in the 2019 reporting year, eligibility reviews under the PERM will resume and will be conducted by a federal contractor. Medicaid program integrity consists of efforts to ensure that federal and state expenditures are used to deliver quality, necessary care to eligible enrollees, and efforts to prevent fraud, waste, and abuse. We have found in prior work that CMS’s and states’ program integrity efforts focused primarily on payments and services delivered under FFS and did not closely examine program integrity in Medicaid managed care. For Medicaid managed care, CMS has largely delegated program integrity oversight of MCOs to the states. States, in turn, generally oversee MCOs and the providers under contract to MCOs through their contracts with the MCOs and reporting requirements. Some program integrity risks for managed care are similar to those in FFS, including payments made for nonenrolled, ineligible, or deceased individuals; payments to ineligible, excluded, or deceased providers; and payments to providers for improper or false claims, such as payments for services that are not medically necessary. Other program integrity risks are more unique to managed care. For example, capitated payments generally reflect the average cost to provide covered services to enrollees, rather than a specific service. Federal law requires capitation rates to be actuarially sound, meaning that, among other things, they must be reasonably calculated for the populations expected to be covered and for the services expected to be furnished under contract. In order to receive federal funds for its managed care program, a state is required to submit the rates it pays MCOs and the methodology it uses to set those rates to CMS for review and approval. Additionally, federal and state oversight of Medicaid managed care can include ensuring that MCOs fulfill contractual provisions within their managed care contracts. In some cases, these provisions relate directly to program integrity activities, including plans and procedures for identifying, recovering, and reporting on overpayments made to providers. The managed care component of the PERM measures the accuracy of the capitated payments state Medicaid agencies make to MCOs. Specifically, a CMS contractor examines whether the state agency made capitated payments only for eligible enrollees, made capitated payments for the correct amount based on the contract and coverage requirements (time period and geographic location), made capitated payments based on the correct rate for enrollees, and did not make any duplicate payments for enrollees. CMS officials noted that the agency established capitated payments as the level of review, because the capitation rate is the transaction used to determine the federal match in managed care. In general, the federal government matches most state expenditures for Medicaid services on the basis of a statutory formula. In FFS, the federal match is provided for the amount the state pays a health care provider for delivering services to enrollees. With managed care, the federal match is provided for the amount of the capitation rate the state pays the MCO. Capitated payments do not directly relate to the provision of a specific service, but reflect the average cost to provide covered services to enrollees. As a result, CMS officials maintain that the capitated payment is the lowest transaction level at which the agency can clearly identify federal funds without making significant assumptions. Because the managed care component of the PERM review is limited to measuring capitated payments, it does not account for other program integrity risks—such as overpayments to providers and unallowable MCO costs. In addition to errors in capitated payments included in PERM reviews, CMS regulations state that overpayments in managed care include any payment made to an MCO or provider under contract to an MCO to which the MCO or provider is not entitled under Medicaid. Such overpayments included payments for services that were not provided or medically necessary; or to ineligible, excluded, or deceased providers, which are not measured by the PERM. Unallowable MCO costs refers to operating costs that MCOs cannot claim under their managed care contracts, such as certain marketing costs, or that the MCO reported incorrectly. Among the 27 audits and investigations of Medicaid managed care programs we reviewed, 10 identified about $68 million in MCO overpayments to providers and unallowable MCO costs that were not accounted for in PERM estimates. In addition, one investigation of an MCO operating in nine states resulted in a $137.5 million settlement to resolve allegations of false claims. (See app. I for a complete list of the audits and investigations we identified.) However, the full extent of these overpayments and unallowable costs is unknown, because these audits and investigations were conducted over more than 5 years and involved a small fraction of the more than 270 MCOs operating nationwide as of September 2017. Specifically, 24 of the audits and investigations represented reviews in 10 states and, in many cases, focused on individual providers or MCOs; there were about 90 MCOs operating in the 10 states as of September 2017, according to the Kaiser Family Foundation. Some examples of the audits and investigations that identified overpayments and unallowable costs include the following: The Washington State Auditor’s Office found that two MCOs made $17.5 million in overpayments to providers in 2010, which may have increased the state’s 2013 capitation rates. The New York State Comptroller found that two MCOs paid over $6.6 million to excluded and deceased providers from 2011 through 2014. The Massachusetts State Auditor found that one MCO paid $420,000 for health care services and unauthorized prescriptions from excluded providers in 2013 and 2014. The Department of Justice alleged that an MCO operating in several states submitted inflated expenditure information to the state Medicaid agencies, falsified encounter data, and manipulated claims costs and service provision costs in nine states. The MCO agreed to pay over $137.5 million to resolve these claims. The Texas State Auditor’s Office found that an MCO reported $3.8 million in unallowable costs for advertising, company events, gifts, and stock options, along with $34 million in other questionable costs in 2015. The New York State Comptroller also found that an MCO claimed over $260,000 in unallowable administrative expenses, which contributed to an increase in capitation rates across the state. To the extent that the state does not identify or know of MCO overpayments to providers or unallowable MCO costs, the overpayments and unallowable costs could inflate future capitation rates, as the Washington State Auditor and New York State Comptroller noted in their findings. The PERM assesses the accuracy of capitated payments that states make to MCOs. States set capitation rates based on cost data— historical utilization and spending—that MCOs submit to the state Medicaid agencies, but the PERM does not consider these data. Unless removed from these cost data, unidentified overpayments and unallowable costs would likely inflate the MCO cost data that states use to set capitation rates. (See fig. 1.) As a result, future capitation rates would also be inflated, resulting in higher state and federal spending. In fiscal year 2017, the Medicaid managed care improper payment rate was 0.3 percent, while the FFS improper payment rate was 12.9 percent, leading to an assumption that the estimated risks in managed care are less significant than those estimated in FFS. However, the managed care component of the PERM does not determine whether MCO payments to providers were for services that were medically necessary, actually provided, accurately billed and delivered by eligible providers, or whether the MCO costs were allowable and appropriate. As a result, the PERM improper payment estimate potentially understates the extent of program integrity risks in Medicaid managed care. Moreover, this potential understatement in the PERM’s improper payment rate estimate may curtail investigations into the appropriateness of MCO spending. We previously reported that CMS and state program integrity efforts did not closely examine program integrity in Medicaid managed care, focusing primarily on payments and services delivered under FFS. Our current review of the 27 audits we identified encompassed a 5-year period, suggesting that reviews of managed care continue to be limited. An official from a state auditor’s office we spoke with suggested that some states may not audit services delivered under managed care, because of a low improper payment rate. In addition, he noted that his state Medicaid agency used the relatively low payment error rate in managed care as an indicator of few program integrity problems. As noted, CMS has increased its focus on and worked with states to improve oversight of Medicaid managed care; however, these efforts and the oversight efforts of states do not ensure the identification and reporting of overpayments and unallowable costs. In recent years, the agency has sought to strengthen oversight of managed care programs through updated regulations; reviews of states’ managed care programs (Focused Program Integrity Reviews) and collaborative audits, which are conducted jointly by federal program integrity contractors and states; and state monitoring of overpayments. Regulations. In May 2016, CMS updated its regulations for managed care programs in order to strengthen oversight. The updated regulations require a number of additional program integrity activities, such as those listed below. If fully implemented, these updated regulations may help with the identification and removal of overpayments and unallowable costs from data used to set future capitation rates. Under these regulations States must arrange for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by MCOs, at least once every 3 years. Through contracts with MCOs, states must require MCOs to have a mechanism through which providers report and return overpayments to the MCOs. States must also require MCOs to promptly report any identified or recovered overpayments—specifying those that are potentially fraudulent—and submit an annual report on recovered overpayments to their state. States must use this information when setting actuarially sound capitation rates. Through contracts with MCOs, states must also require MCOs to report specific data, information, and documentation. In addition, the MCO’s chief executive officer or authorized representative must certify the accuracy and completeness of the reported data, information, and documentation. States must enroll MCO providers that are not otherwise enrolled with the state to provide services to enrollees in Medicaid FFS, and revalidate the enrollment at least once every 5 years. Initially this requirement was to start for MCO contracts beginning on July 1, 2018. Subsequently enacted legislation codified this requirement in statute and moved the implementation to January 1, 2018. It is too early to know if these regulations will assure better oversight of MCO payments to providers and the data used to set future capitation rates. The above program integrity requirements only went into effect recently—for contracts starting on or after July 1, 2017, and January 1, 2018. In addition, CMS issued a notice in June 2017 stating that the agency will use its enforcement discretion to assist states that are unable to implement new requirements by the required compliance date. Also, CMS has delayed issuance of implementing guidance for certain provisions until the agency completes its review, a step that may further delay states’ implementation. The agency has designated Medicaid managed care for “deregulatory action” and plans to propose a new rule, but has not indicated which of these provisions, if any, would be revised. Focused Program Integrity Reviews. In fiscal year 2014, CMS implemented its Focused Program Integrity Reviews in order to target high-risk program integrity areas in each state, including managed care. As we previously reported, these focused reviews are narrower in scope than the prior reviews conducted by CMS, but they still involve on-site visits to states. In its focused reviews of managed care, CMS found that several states had incomplete oversight of MCO payments to providers, even though the agency relies on states to verify reported MCO overpayments and to ensure the overpayments are excluded from the data used to set capitation rates. In the 27 focused reviews of managed care from 2014 to 2017, CMS found that MCOs in 17 states reported fewer overpayments to their state Medicaid agencies than CMS would expect. For example, MCOs in at least 5 states reported that overpayments were less than 0.1 percent of their total managed care expenditures; while CMS noted in 1 focused review that overpayments typically equal 1 to 10 percent of total expenditures in managed care. CMS also found that 5 of the 27 states did not verify that MCOs excluded overpayments from these data, and 1 state did not exclude overpayments from the capitation rate setting. This is consistent with our March 2017 report in which we noted that CMS commonly found that MCOs reported low amounts of recovered overpayments and conducted few reviews to identify overpayments. Also, officials from three of the five states we interviewed for that report said the focused reviews gave them leverage in dealing with MCOs or led MCOs to focus more on program integrity. We also reported that CMS officials recommended states take steps to improve their oversight of MCOs, based on the focused review findings. The findings from CMS’s focused reviews of managed care also highlight the need for greater federal oversight of states. Without these reviews, it is unclear if states would independently identify MCOs’ reporting of overpayments or work to strengthen MCO reporting. Yet, CMS has not yet published the focused reviews of managed care in 13 states, and it may only conduct a focused review in a state once every three or more years. Given CMS’s timeline for the focused reviews, it may take years to determine if corrective actions result in improved program integrity in services delivered through managed care. Collaborative audits. CMS has expanded the federal-state collaborative audits beyond FFS, and has begun to engage states to participate in collaborative audits of MCOs and providers under contract to MCOs. As a part of the collaborative audit process, the state volunteers to jointly develop the audit processes the federal contractors follow. CMS officials told us that federal contractors have completed 14 collaborative audits of providers under contract to MCOs in three states—Arizona, the District of Columbia, and Tennessee. Only the audit of Trusted Healthcare, an MCO in the District of Columbia, has been published. That audit identified $129,000 in overpayments in a sample of MCO payments to providers, which, if generalized to all of the MCO’s payments over 6 months, would equate to over $4 million in overpayments. According to CMS, three additional states—Louisiana, Nebraska, and New Hampshire—have shown interest in collaborative audits of their MCOs, although such audits require states to prepare data files for the federal contractor and commit staff time. In our March 2017 report, we found that states’ participation in FFS collaborative audits varied and some states reported barriers to their participation. Expanding collaborative audits in managed care will require commitment from and coordination with states. State monitoring of overpayments in managed care. States are required to report overpayments they have identified and recouped along with state expenditures on a quarterly basis. However, based on the responses of the program integrity officials in 13 of the 16 states we contacted, most officials were unable to define the magnitude of overpayments in their managed care programs, which may signify a need for greater federal oversight or coordination. Specifically, officials in 7 of the 13 states could not or did not identify the share of total reported Medicaid overpayments that occurred in managed care. In 11 of the 13 states, officials responded that they did not directly monitor MCO payments to providers. Of those 11 states, officials in 4 said they depend on MCOs to report overpayments and exclude the overpayments from the data used to set capitation rates. As long as states are not taking action to identify overpayments in managed care, they cannot be assured that they are accurately paying MCOs for medically necessary services provided to enrollees. Federal internal control standards call for agency management to identify, analyze, and respond to risks. CMS has taken some steps to identify, analyze, and respond to risks through its regulations, Focused Program Integrity Reviews, and collaborative audits. However, key CMS and state oversight efforts fall short of mitigating the limitations of the PERM estimates of improper payments for managed care, because they do not ensure the identification and reporting of overpayments to providers and unallowable MCO costs. Without addressing these key risks, CMS and states cannot ensure the integrity of Medicaid managed care programs. The 0.3 percent improper payment rate for Medicaid managed care, as measured by the PERM, is significantly lower than the improper payment rate of 12.9 percent for Medicaid FFS. However, this difference does not signal better oversight; rather, it represents differences in the review criteria between FFS and managed care, which result in a less complete accounting for the program integrity risks in managed care. The PERM does not account for key program integrity risks in Medicaid managed care: specifically, unidentified overpayments and unallowable costs. One federal investigation of an MCO operating in nine states resulted in a settlement of $137.5 million to resolve allegations of false claims that were not captured in the national Medicaid improper payment rate estimate. Further, CMS found that MCOs and states do not provide sufficient oversight in Medicaid managed care to address the risks that are not accounted for in the PERM, findings that are reinforced by our reports on Medicaid managed care program integrity. CMS has taken steps to improve its oversight of Medicaid managed care, yet these efforts fall short of ensuring that the agency and states will be able to identify and address overpayments to providers and unallowable MCO costs. Without better measurement of program risks—particularly as expenditures for Medicaid managed care continue to grow—CMS cannot be certain that the low improper payment rate for managed care, as measured by the PERM, accurately reflects lower risks in managed care. The Administrator of CMS should consider and take steps to mitigate the program risks that are not measured in the PERM, such as overpayments and unallowable costs; such an effort could include actions such as revising the PERM methodology or focusing additional audit resources on managed care. (Recommendation 1) We provided a draft of this report to the Department of Health and Human Services (HHS) for comment. In its written comments, HHS concurred with our recommendation, and indicated that it will review regulatory authority and audit resources to determine the best way to account for Medicaid program risks that are not accounted for in the PERM. However, HHS stated that the PERM is not intended to measure all Medicaid program integrity risks, and utilizing the PERM measurement in that way would be a misunderstanding and misuse of the reported rate. HHS also commented that a review of payments from MCOs to providers is outside the scope of IPIA. In addition, HHS asserted that including such a review would diminish the value of PERM reporting—because it would require significant assumptions about the amount of federal share in MCO payments to providers. Further, HHS maintained that such a review also would result in a measurement that was not comparable to other programs or agencies, which would diminish the value of government- wide improper payment rate reporting. We acknowledge that the current PERM methodology has been approved by OMB. However, we maintain that the PERM likely underestimates program integrity risks in Medicaid managed care. To ensure the appropriate targeting of program integrity activities, CMS needs better information about these risks. Given the size of the Medicaid program, its vulnerability to improper payments, and the growth in managed care, it is critical to have a full accounting of program integrity risks in managed care in order to best ensure the integrity of the whole Medicaid program. In its written comments, HHS also summarized several activities it uses to oversee and support states’ Medicaid program integrity efforts, including state program integrity reviews; collaborative audits conducted by federal contractors; Medicaid Integrity Institute training for state employees; and the Medicaid Provider Enrollment Compendium. HHS also provided technical comments, which we incorporated as appropriate. HHS’s comments are reprinted in appendix II. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or at yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff that made key contributions to this report are listed in appendix III. We reviewed 16 federal and state audits and 11 notices of investigations of Medicaid managed care organizations (MCO) and providers issued from January 2012 to September 2017. As the findings below show, the audits and investigations represent a limited number of reviews that, in many cases, focused on individual states and individual providers or MCOs within that state. Given the limited scope and number of states reviewed, the amount of the overpayments and unallowable costs occurring nationwide is unknown. These audits and investigations show cases of MCO overpayments to providers or unallowable costs, which are not accounted for by the Centers for Medicare & Medicaid Services’ Payment Error Rate Measurement (PERM) ; errors in capitated payments (e.g., capitated payments made for deceased individuals), which are accounted for in the PERM; and gaps in managed care oversight. When reporting overpayments and unallowable costs identified in the audits and investigations, we only include amounts specifically attributed to MCOs in our total. This total does not include the following: overpayments and unallowable costs identified in those audits and investigations that did not distinguish between the amounts attributable to MCOs, Medicaid fee-for-service, or Medicare; overpayments and unallowable costs identified in criminal proceedings that are not yet resolved; and errors in capitated payments, as those payments would be reviewed by the PERM. As a result, the total amount of overpayments and unallowable costs and capitated payment errors in this appendix exceed what we report. In addition to the contact named above, Leslie V. Gordon (Assistant Director), Pauline Adams (Analyst-in-Charge), Erika Huber, and Drew Long made key contributions to this report. Also contributing were Muriel Brown and Jennifer Whitworth.

Question: Write a one-page summary of the report 1.

Answer: Protecting federal employees and facilities from security threats is of critical importance. Most federal agencies are generally responsible for their facilities and have physical security programs to do so. GAO was asked to examine how federal agencies assess facilities' security risks. This report examines: (1) how selected agencies' assessment methodologies align with the ISC's risk management standard for identifying necessary countermeasures and (2) what management challenges, if any, selected agencies reported facing in conducting physical security assessments and monitoring the results. GAO selected four agencies—CBP, FAA, ARS, and the Forest Service—based on their large number of facilities and compared each agency's assessment methodology to the ISC Standard; analyzed facility assessment schedules and results from 2010 through 2016; and interviewed security officials. GAO also visited 13 facilities from these four agencies, selected based on geographical dispersion and their high risk level. None of the four agencies GAO reviewed—U.S. Customs and Border Protection (CBP), the Federal Aviation Administration (FAA), the Agricultural Research Service (ARS), and the Forest Service—used security assessment methodologies that fully aligned with the Interagency Security Committee's Risk Management Process for Federal Facilities standard (the ISC Standard). This standard requires that methodologies used to identify necessary facility countermeasures—such as fences and closed-circuit televisions—must: 1. Consider all of the undesirable events (i.e., arson and vandalism) identified by the ISC Standard as possible risks to facilities. 2. Assess three factors—threats, vulnerabilities, and consequences—for each of these events and use these three factors to measure risk. All four agencies used methodologies that included some ISC requirements when conducting assessments. CBP and FAA assessed vulnerabilities but not threats and consequences. ARS and the Forest Service assessed threats, vulnerabilities, and consequences, but did not use these factors to measure risk. In addition, the agencies considered many, but not all 33 undesirable events related to physical security as possible risks to their facilities. Agencies are taking steps to improve their methodologies. For example, ARS and the Forest Service now use a methodology that measures risk and plan to incorporate the methodology into policy. Although CBP and FAA have updated their methodologies, their policies do not require methodologies that fully align with the ISC standard. As a result, these agencies miss the opportunity for a more informed assessment of the risk to their facilities. All four agencies reported facing management challenges in conducting physical security assessments or monitoring assessment results. Specifically, CBP, ARS, and the Forest Service have not met the ISC's required time frame of every 3 years for conducting assessments. For example, security specialists have not conducted required reassessments of two ARS and one Forest Service higher-level facilities. While these three agencies have plans to address backlogs, CBP's plan does not balance conducting risk assessments with other competing security priorities, such as updating its policy manual, and ARS and the Forest Service lack a means to monitor completion of future assessments. Furthermore, CBP, ARS, and the Forest Service did not have the data or information systems to monitor assessment schedules or the status of countermeasures at facilities, and their policies did not specify such data requirements. For example, ARS and the Forest Service do not collect and analyze security-related data, such as countermeasures' implementation. FAA does not routinely monitor the performance of its physical security program. Without improved monitoring, agencies are not well equipped to prioritize their highest security needs, may leave facilities' vulnerabilities unaddressed, and may not take corrective actions to meet physical security program objectives. This is a public version of a sensitive report that GAO issued in August 2017. Information that the agencies under review deemed sensitive has been omitted. GAO recommends: (1) that CBP and FAA update policies to require the use of methodologies fully aligned with the ISC Standard; (2) that CBP revise its plan to eliminate the assessments backlog; and (3) that all four agencies improve monitoring of their physical security programs. All four agencies agreed with the respective recommendations.