Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

i

Evaluation Report

 

Inspector General’s Assessment of the Most 

Serious Management and Performance 

Challenges Facing NRC

OIG-15-A-01 

October 16, 2014 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

i

TABLE OF CONTENTS

I. BACKGROUND AND PURPOSE........................................................... 2

II. ASSESSMENT RESULTS .................................................................... 5

III. AGENCY COMMENTS AND OIG’S RESPONSE TO COMMENTS... 29

IV. SCOPE AND METHODOLOGY......................................................... 31

APPENDIX: AGENCY COMMENTS....................................................... 32
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

2

I. BACKGROUND AND PURPOSE

On January 24, 2000, Congress enacted the Reports Consolidation Act of 

2000, requiring Federal agencies to provide financial and performance 

management information in a more meaningful and useful format for 

Congress, the President, and the public. The act requires the Inspector 

General (IG) of each Federal agency to annually summarize what he or 

she considers to be the most serious management and performance 

challenges facing the agency and to assess the agency’s progress in 

addressing those challenges.

To accomplish this assessment, the NRC IG considered the overall work 

of the Office of the Inspector General (OIG), the OIG staff’s general 

knowledge of agency operations, and other relevant information to 

develop and update the list of management and performance challenges 

and assess the agency’s progress in addressing these challenges. 

In addition, beginning in 2012, OIG staff performed an analysis of the past 

10 years of audit findings and assigned them to performance categories, 

such as internal controls, accountability and communications. 

Approximately 540 audit findings and recommendations were analyzed. 

Every year since, OIG staff incorporated new audit findings into this 

analysis. As part of the most recent analysis – which focused on the last 5 

years of audit findings and recommendations – OIG staff identified a total 

of eight performance categories that are supported by the audit findings. 

These categories represent the most serious management and 

performance challenges facing the agency. They relate directly to the 

mission-oriented management challenges in past OIG reports in that 

improvement in the eight performance categories supports improvement in 

the past mission-oriented challenge areas. The audit-based categories 

also support enhancing performance in NRC strategic areas and 

management objectives. 

Likewise, the Investigations staff of OIG analyzed 5 years of investigation 

information for identification of performance trends and opportunities to 

improve performance. A total of 287 investigations were reviewed. This 

information was evaluated for applicability to the audit based categories 

already identified and sorted on that basis as it applied. Additionally, the 

investigation information was analyzed for any other trends and one 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

3

additional management challenge category (cyber security) was 

developed.

These nine categories are more specific and actionable than those in past 

NRC OIG management and performance challenge reports. They 

represent significant opportunities for the agency to improve performance 

affecting its strategic goals and management objectives. Figure 1 relates 

these new management and performance challenges to past management 

and performance challenges and the agency’s strategic goals and 

management objectives.

The agency’s performance relative to the new challenge areas will be 

evaluated by OIG as new information becomes available, including audit 

and investigative findings and Issue Area Monitoring.1 As OIG notes 

improved performance in a challenge, the challenge will be removed, as 

warranted. 

 1 Through OIG’s Issue Area Monitor (IAM) program, OIG staff designated as IAMs are assigned 

responsibility for keeping abreast of major agency programs and activities. The broad IAM areas address 

nuclear reactors, nuclear materials, nuclear waste, information management, security, financial and 

administrative programs, human resources, and international programs.
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

4

Figure 1. OIG Assessment of Audit and Investigative Results

Security

Security Materials Nuclear 

Facilities

High Level 

Waste

Information 

Technology

Human 

Capital

Financial 

Management

1 Internal Controls X X X X X X

2

Guidance & 

Procedures X X X X X X

3 Training X X X X X

4

Acquisitions, 

Contracting, & 

Procurement

X X

5 Project Management X X X

6

Internal 

Communication & 

Coordination

X X X X X X

7 Human Capital 

Management

X

8 Accountability X X X X X

9 Cyber Security X X

CHALLENGES

Safety Management Objectives

Strategic Goals and Functional Areas
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

5

II. ASSESSMENT RESULTS

NRC’s mission is to license and regulate the Nation’s civilian use of 

byproduct, source, and special nuclear materials to ensure adequate 

protection of public health and safety, promote the common defense and 

security, and protect the environment. Like other Federal agencies, NRC 

faces management and performance challenges in carrying out its 

mission. 

Congress left the determination and threshold of what constitutes a most 

serious management and performance challenge to the discretion of the 

IGs. 

The NRC IG has defined serious management and performance 

challenges as mission critical areas or programs that have the potential for 

a perennial weakness or vulnerability that, without substantial 

management attention, would seriously impact agency operations or 

strategic goals. Based on this definition, the IG identified the following as 

the most serious management and performance challenges facing NRC 

as of October 1, 2014:

1. Internal Controls.

2. Guidance and Procedures.

3. Training.

4. Acquisition, Contracting, and Procurement.

5. Project Management.

6. Internal Communication and Coordination.

7. Human Capital Management.

8. Accountability.

9. Cyber Security.

Each of these challenges is discussed on the following pages.
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

6

Management Challenge #1

Internal Controls

Internal controls are the plans, methods, policies, and procedures an 

organization employs to ensure effective resource use in fulfilling its 

mission, goals, objectives, and strategic plan. A quality internal control 

program promotes operational efficiency, ensures that established policies 

are followed, safeguards assets, prevents fraud, minimizes errors, and 

verifies the accuracy and reliability of data.

Internal controls are essential to strong organizational performance and 

affect all NRC strategic areas and management objectives. Internal 

controls are essential for NRC’s continued and successful management of 

its regulatory processes (reactors and materials), security programs, 

information technology, financial management (and procurement), and 

human capital. 

Like all Federal agencies, NRC internal controls are expected to provide 

reasonable, but not absolute, assurance that agency objectives are 

consistently met. NRC has established internal controls for its various 

programs. OIG audits and investigations have consistently identified 

shortfalls in NRC’s internal controls. Examples of performance gaps in 

internal controls found during OIG audits and investigations are included 

below. Taken together, these examples indicate the need for NRC to 

improve its internal controls.

Specific examples

• NRC has some issues executing certain facets of the National 

Environmental Policy Act (NEPA) because the agency does not have 

controls in place to ensure that staff is compliant. As a result, staff 

have varying interpretations on how to comply with NRC’s regulations 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

7

in 10 CFR Part 51. In an effort to strengthen its internal controls, NRC 

has proposed to develop agencywide guidance to ensure that staff 

appropriately follow Part 51.

• NRC’s approach to contract oversight has weaknesses in verifying 

dollar amounts submitted on invoices by contractors. Specifically, 

NRC’s internal control processes do not include steps to routinely use 

source documentation to verify amounts billed on contractor invoices.

The agency has committed to develop steps to include periodic 

reviews and evaluation of contractor invoice source documentation.

• Until recently, NRC did not systematically track nuclear power reactor 

licensees’ commitments, in part because the agency did not have an 

adequate tool for tracking them. Subsequently, NRC successfully 

developed and implemented an approach for systematically tracking 

power reactor licensee commitments. The agency’s new approach to 

tracking commitments creates a key internal control for managing 

records that are relevant to the oversight of licensee activities. 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

8

Management Challenge #2

Guidance and

Procedures

Guidance and procedures refers to directives and other types of formal 

written guidance that establishes NRC management’s expectations for 

agency staff. Policies and procedures are designed to influence and 

determine all major decisions and actions and all activities take place 

within the boundaries set by them. Together policies and procedures 

ensure that a point of view held by a governing body of an organization 

such as NRC is translated into steps that result in an outcome compatible 

with that view. OIG audits and investigations have consistently identified 

shortfalls in NRC’s guidance and procedures. Examples of these gaps 

found during OIG audits and investigations are included below. Taken 

together, these examples indicate the need for NRC to improve its 

guidance and procedures. 

Specific examples

• NRC imposed license conditions for fuel cycle and uranium recovery 

facilities that do not meet the intent of the Atomic Energy Act because 

NRC does not have adequate guidance for staff preparing the licenses. 

NRC has proposed to develop and implement detailed guidance for

fuel cycle and uranium recovery staff to use when developing license 

conditions.

• NRC has not developed and incorporated within policy and guidance 

the existing mechanisms used for systematic and continual monitoring, 

collecting, and trending of age-related data for some types of 

components in nuclear power plants. Age-related studies have 

emphasized the importance of continual monitoring, collecting, and 

trending of age-related data for components in an ever changing 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

9

environment. Yet, NRC has not systematically and continually 

collected or evaluated age-related data to determine if a specific aging 

component oversight program is needed or what type of program 

would be necessary. Currently, NRC may identify data on active 

component aging intermittently during Reactor Oversight Process

inspections, but not through any methods of systematic data collection, 

analysis, and trending. At present, age-related failures are not 

consistently identified in existing reporting mechanisms, when they are 

identified at all. 

• Generally, NRC’s oversight of industrial radiography is effective. 

However, NRC’s inspection guidance lacks language defining which 

licensee location should be visited for each routine inspection, and 

lacks a methodology to ensure that field station2 selection is reliable. 

Additionally, some NRC inspectors do not know what they can require 

of an NRC licensee during an inspection when that licensee’s facility is 

located in an Agreement State3 because there is no guidance for NRC 

inspectors conducting inspections of NRC licensees in Agreement 

States. NRC staff are currently revising inspection guidance to clearly 

define expectations, including locations that must be inspected 

(including field stations) and at what frequency, as well as records and 

other information inspectors should review for conducting an inspection 

of a NRC licensee who is located in an Agreement State. 

• NRC’s travel card program management does not maximize the 

agency’s travel card rebates. This is because the agency does not pay 

the entire bill for centrally billed accounts upon receipt, but instead 

pays the bill as charges are matched to specific line items. The 

agency is in the process of developing and implementing a policy to 

pay centrally billed travel cards on a daily or weekly basis. 

Additionally, NRC is currently revising Management Directive 14.1, 

Official Temporary Duty Travel, to require cardholders who travel more 

than five times a year to use their Government travel card for official 

travel expenses. 

 2 Field stations are facilities listed in the license.

3 Agreement States are States that have entered into an agreement assuming regulatory authority from 

NRC. In accordance with Section 274 of the Atomic Energy Act, as amended, NRC may relinquish its 

authority to regulate byproduct, source, and limited quantities of special nuclear material to States. These 

States must first demonstrate that their regulatory programs are adequate to protect public health and 

safety and are compatible with NRC’s program.
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

10

Management Challenge #3

Training

Training comprises the acquisition of knowledge, skills, and competencies 

as a result of the teaching of vocational or practical skills and knowledge 

that relate to specific useful competencies. Training has specific goals of 

improving one’s capability, capacity, productivity, and performance. 

Through training, NRC establishes a pool of skilled employees to meet 

current and future organizational needs and support professional growth.

Many of the NRC programs have established training plans to enhance 

the knowledge base of its staff. OIG audits and investigations have 

consistently identified a lack of training as a cause for program 

weaknesses. Examples of a lack of training found during OIG audits and 

investigations are included below. Taken together, these examples 

indicate the need for NRC to strengthen its training programs. 

Specific examples

• NRC employees are required to comply with personnel reporting 

responsibilities for continued access authorization. NRC’s 

Management Directive 12.3, NRC Personnel Security Program, 

requires employees to comply with a list of reporting responsibilities set 

forth in the directive. Specifically, employees are required to report 

certain events that may bring into question their reliability and 

trustworthiness; however, NRC employees rarely comply with 

personnel reporting responsibilities for continued access authorization. 

The agency is working to implement the needed training. 

• Training for NRC’s Inspections, Tests, Analyses, and Acceptance 

Criteria (ITAAC) process staff is improvised. The Office of New 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

11

Reactors provides ITAAC training to staff as determined by various 

managers in headquarters and Region II. However, this training has 

not been systematically developed in accordance with the training and 

development policies listed on the NRC’s internal training Web site. 

These policies are based on the Office of Personnel Management’s 

(OPM) training guidance. OPM/agency policies call for a training 

needs assessment to help agency and program managers identify 

appropriate subjects and methods for training. Current ad hoc training 

practices hinder the staff’s ability to identify and conduct relevant 

ITAAC inspections and closure notice reviews. The agency is currently 

working to design and develop training needs assessment guidance 

and on the development and delivery of training, and anticipates the 

training will be accessible to users via NRC’s training Web site by 

October 31, 2014.

• Although the agency provides staff and managers with training on the 

non-concurrence process, the training is limited. Providing properly 

implemented training that effectively communicates policies, 

objectives, responsibilities, authorities, requirements, and information 

to employees are essential human capital practices that help to ensure 

employees have the knowledge and skills to perform their job and 

accomplish the agency mission. However, training on the agency’s 

non-concurrence process is not provided in a medium that is routinely 

available to all staff when they need it. Without timely training, the nonconcurrence process will continue to be inconsistently implemented 

and staff will perceive the process as ineffective and inefficient. 

Agency staff are currently working to develop on-line, on-demand nonconcurrence process training for all staff and managers.

• Although the agency has offered training on its core accounting 

system, additional training is needed on the system’s report 

functionalities and features. Agency management acknowledges that 

the core accounting system reports have been a challenge for program 

staff to obtain and understand. Recently, the agency has conducted 

approximately eight training sessions related to interactive reports and 

plans to conduct monthly user group meetings. 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

12

Management Challenge #4

Acquisitions, 

Contracting, and

Procurement

Acquisitions, contracting, and procurement refer to the process through 

which the government purchases ("acquires") goods and services. 

NRC’s procurement of goods and services aims to achieve the best value 

for the agency’s dollars in a timely manner. Agency policy provides that 

these activities support the agency’s mission and be consistent with sound 

business practices and contracting principles. The agency focuses on the 

goals of achieving (1) a 21st century acquisition program that uses stateof-the-art acquisition methodologies for acquisition planning, execution, 

management, and closeout, and (2) an acquisition program that fully 

integrates with the agencywide program and financial planning and budget 

execution.

During the past few years, NRC has made several changes to its

acquisitions, contracting and procurement management functions. OIG 

continues to monitor the impact of these changes through its audits and 

investigative functions. Included below, are examples of NRC’s continuing 

challenges in acquisitions, contracting, and procurement. 

Specific examples

• NRC is in the process of streamlining the agency’s contracting 

practices. During FY 2014, NRC deployed the Strategic Acquisition 

System (STAQS), the new Agencywide system for acquisitions 

management. As expected during the first year of implementing a new 

system, staff had challenges adjusting to the functionalities of STAQS. 

Also, during the first months of implementation, there were some 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

13

delays in migrating prior year data into STAQS. In addition, the 

agency continues to monitor the interface between STAQS and the 

core financial system to resolve any outstanding issues. The agency’s 

Office of Administration continues to provide support to staff and is 

committed to improving the system’s overall performance. 

• NRC’s administration of a $34 million contract to implement Microsoft 

technologies throughout the agency lacked internal controls over the 

invoice review process, as evidenced by irregularities in the invoices. 

The agency had not provided agency staff with detailed guidance that 

sufficiently addresses the specifics of reviewing and approving contract 

invoices. Consequently, NRC lacked assurance that contract costs 

were being consistently and appropriately evaluated to determine 

whether they are allowable, allocable, and reasonable, thus leaving the 

agency vulnerable to potential fraud, waste, and abuse. In response to 

an OIG audit, the agency quickly developed interim guidance, and is in 

the process of developing permanent guidance and validating invoices

associated with the specific contract reviewed by the OIG auditors.

• NRC’s contract award policies and procedures need improvement. 

Specifically, the agency needs to determine what policies and 

procedures are required for an efficient and effective contract award 

process, develop or update them, and establish a process to regularly 

maintain them. During FY 2014, the agency updated Management 

Directive 11.1, NRC Acquisition of Supplies and Services, which 

establishes a more effective and efficient contract award process.

• NRC staff involved in contract administration and oversight need to 

maintain diligence to prevent and deter fraud, waste, and abuse in 

NRC’s contracts. An OIG investigation found that a university 

associate research scientist and two other university employees did 

not perform work on an NRC contract as claimed and their hours were 

improperly billed to the NRC contract. The U.S. Department of Justice 

(DOJ) accepted this contract fraud case for civil litigation; 

subsequently, a settlement agreement was executed in October 2012

in which the university agreed to pay single damages ($278,674.03) 

plus investigative costs ($192,395.63) for a total of $471,069.66. In 

another example, OIG investigated an allegation that an information 

technology contractor may have inappropriately billed one NRC 

regional office for the same work the contractor had previously billed a 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

14

different regional office. OIG determined that the contractor used a set 

of documents it prepared for one region as templates for documents 

for the other region and left information in the documents pertaining to 

the first region. The contractor apologized to the project officer, 

removed its quality assurance project manager due to the issues 

raised by NRC and corrected the documents.
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

15

Management Challenge #5

Project 

Management

Project management is the discipline of planning, organizing, motivating, 

and controlling resources to achieve specific goals within a defined, limited 

time period, within budget and with appropriate quality.

The American taxpayer, the rate-paying consumer, and licensees are all 

entitled to the best possible management and administration of regulatory 

activities. Effective project management is key to ensuring success 

whether the project is related to NRC’s regulatory processes (reactors and 

materials), security programs, information technology, financial 

management (and procurement), or human capital management.

OIG audits and investigations continue to identify areas for improvement 

regarding NRC’s project management. Examples of performance gaps in 

project management found during OIG audits and investigations are 

included below. Taken together, these examples indicate the need for 

NRC to improve its project management.

Specific examples

• NRC provided insufficient oversight of development of the Construction 

Inspection Program Information Management System, which is a 

database used to document inspection items and report the results of 

construction- and vendor-related inspections. The database is also 

used to support the Commission in making informed findings for 

permitting licensees to load fuel into a newly constructed reactor. NRC 

staff members responsible for oversight were unfamiliar with the 

agency’s own “Project Management Methodology” requirements. 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

16

Moreover, the agency failed to appoint a single project manager to 

oversee the database development, resulting in coordination issues 

and confusion among database stakeholders. The agency addressed 

the issue for this particular project in an expedient manner, and the 

recommendations have been closed.

• The National Source Tracking System (NSTS) was developed by NRC 

and deployed in 2008. NSTS was designed primarily to be an Internetbased system enabling licensees to directly enter data on the 

movement of certain nuclear material. However, a majority of the 

licensee user population did not fully adopt the technology required for 

direct access to NSTS. This trend was caused by challenges inherent 

in the development of the NSTS credentialing process, as well as 

technical problems encountered by licensees in using the associated 

smart card devices. Further, licensees were not able to get help in 

resolving application and set-up problems. NRC staff re-evaluated its 

credentialing strategies and implemented a targeted outreach strategy 

for NSTS users.

• Management Directive 2.8, Project Management Methodology (PMM), 

is outdated. It is the sole guidance used for the information technology 

(IT) investment management process, yet is more than 6 years old and 

incomplete. The directive does not address how IT aligns with the 

agency’s objectives, and does not even use or define the term “IT 

governance.” Furthermore, NRC’s Project Management Methodology 

Web page depicts an older IT governance structure. The Office of 

Information Services subsequently worked with the Office of 

Administration to establish a timeline for a revision and issuance of 

Management Directive 2.8 in February 2016. The first revision has 

been drafted.

• NRC conducted limited outreach activities in preparation for 

implementation of the logical access control systems (LACS) for 

Homeland Security Presidential Directive 12 (HSPD-12). HSPD-12 

established standardized identification to gain physical access to 

Federal facilities and logical access to Federal information systems. 

Outreach activities for this project occurred several months after the 

use of the new standardized identification cards became mandatory for 

physical access at NRC headquarters. This delay occurred for two 

main reasons. First, NRC lacked a communications plan for educating 

employees about LACS and for coordinating outreach activities with 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

17

LACS implementation schedules. Second, some policies and 

procedures for using LACS equipment were still evolving after the 

equipment’s use became mandatory at NRC headquarters. Effective 

project management includes controls to ensure that communications 

and training necessary to project success are completed in a timely 

manner. Subsequently, NRC developed and implemented a LACS 

communication and outreach plan and also developed on demand 

training for the new access system.
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

18

Management Challenge #6

Internal 

Communications 

and Coordination

Internal communications and coordination refers to vertical and horizontal 

communication linkages designed to provide managers and staff with 

relevant information for decision making, coordination, evaluation, and 

control. Communications and coordination are especially important to 

ensure regulatory and operational consistency across multiple physical 

locations and program areas. Licensees, other governmental and 

nongovernmental organizations, and the public are dependent upon NRC 

being a well-coordinated and informed regulator. As such, effective 

communication and coordination support NRC’s stated goals regarding an 

open, collaborative work environment, and are key enablers of NRC’s 

organizational values and “Principles of Good Regulation.” 

Communication and coordination is also essential to adhering to and 

implementing internal controls. Managers and staff need quality 

information to support internal control systems. Effective information and 

communication is vital for an organization to run and control its operations. 

Therefore, managers and staff need access to relevant and reliable 

information and communication regarding events and activities that 

potentially impact the effectiveness and efficiency of the agency’s mission.

OIG audits and investigations have regularly identified opportunities to 

improve NRC’s communication and coordination. Examples of 

performance gaps in communication and coordination found during OIG 

audits and investigations are included below. 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

19

Specific examples

• The agency’s information technology governance framework and 

processes have not been effectively communicated to stakeholders. 

OIS management has not communicated key evaluation and approval 

process requirements, including details of individual roles and 

responsibilities, service followup, project tracking, and matrices to 

measure the success of its decisions that directly affect program and 

regional offices. This has resulted in a lack of stakeholder buy-in. 

Specifically, there is a lack of assurance that IT services and 

management can be adequately provided to the agency. Some 

stakeholders believe that OIS has not provided sufficient customer 

service and have yet to be convinced that OIS can be counted upon to 

deliver an acceptable level of service. As a result, some stakeholders 

have been circumventing OIS and the governance process by 

approving or creating their own shadow IT systems. This, in turn, 

creates a less effective IT governance process which may result in 

possible IT security breaches, compliance issues, and investment 

waste. As a result of our audit, the agency has committed to 

developing and implementing a comprehensive information technology 

governance communication strategy. 

• Agency managers’ roles and responsibilities for supporting resident 

inspectors could be clarified and communicated. NRC asserts that the 

director in each of the four regional Divisions of Reactor Projects serve 

in a champion-like capacity for resident inspectors. However, there is 

no documentation that describes the regional directors’ roles and 

responsibilities in this capacity. Consequently, there is a need for the 

Executive Director for Operations to take measures to ensure that the 

roles and responsibilities for existing support systems for resident 

inspectors’ needs and concerns are communicated and understood by 

the appropriate management and staff, and are effectively executed. 

The agency has committed to communicating roles and responsibilities 

during “available meetings and communications opportunities,” and to 

provide training to selected headquarters staff and management as 

well as to attendees at regional counterpart meetings.

• NRC’s oversight of new reactor construction involves multiple agency 

stakeholder organizations across headquarters, Region II, and the

construction sites. OIG observed a lack of sustained coordination 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

20

during the development and revision of key guidance documents, the 

creation of a key database, and implementation of vendor inspections. 

For example, NRC does not have formal documentation that outlines a 

comprehensive strategy for the inspection of modular assembly 

facilities. Consequently, agency staff were making decisions without 

the benefit of a structured and systematic evaluation to determine what 

systems, structures and components assembled or manufactured offsite need to be inspected prior to arrival at the construction site in 

support of construction inspection closure activities. During FY 2014, 

the agency completed a number of steps to address these concerns. 

• Although NRC had identified significant agencywide lessons learned, 

agency staff were generally unaware of the agency’s formal Lessons 

Learned program and activities. The purpose of the program is to 

ensure that knowledge gained from significant lessons learned is 

retained and disseminated in a manner which maximizes its benefit 

and usefulness to staff. However, the program’s purpose/intention had 

not been effectively communicated to staff, and management’s 

attention to and support for certain aspects of the program had 

diminished over time. As a result, NRC was missing opportunities to 

identify and inform NRC staff of significant agencywide lessons learned 

that would improve agency operations. In response, NRC staff and 

managers completed a communication plan and took additional 

specific actions to better inform staff and managers of the Lessons 

Learned program. 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

21

Management Challenge #7

Human Capital 

Management

Human Capital Management is the process of acquiring, training, 

managing, and retaining employees for them to contribute effectively to 

the goals of the organization. Attributes of human capital management 

include effective programs for selection and hiring, knowledge 

management, career development, training and succession planning.

Like many Federal agencies, NRC continues to face increasing challenges 

related to human capital management. The agency continues to respond 

to a challenging Federal Government budget environment while trying to 

streamline processes and maintain or improve the level of service that 

agency offices provide to each other. Included below, are examples of 

NRC’s continuing challenges in human capital management as identified 

by OIG audits and investigations. 

Specific examples

• At NRC, staff levels have stabilized and it is unlikely that there will be 

any growth over the next several years. In response, the NRC has 

adjusted its human capital strategies to ensure that the agency 

continues to meet its mission of protecting public health and safety and 

security. For example, NRC implemented a strategy to redistribute 

work across agency offices by centralizing and streamlining several 

processes to reduce inefficiencies and overhead. During FY 2014, the 

agency initiated a project aimed at identifying key strategies and 

recommendations in NRC programs and processes required during the 

next 5 years. This project will evaluate, among other items, how
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

22

human capital factors such as attractiveness of Government service 

and millennials in the workforce influence the agency’s ability to carry 

out its mission. 

• The agency needs to make improvements to agency programs aimed 

at providing employees with a flexible work environment. For example, 

the agency’s recordkeeping and training compliance related to its 

full-time telework program need improvement. In addition, the agency 

needs to make improvements to its flexible work schedule program, 

called NEWFlex, specifically in the areas of training compliance, 

establishing performance measures, and providing program 

information to employees. The agency is committed to making 

improvements in this area.

• OIG’s most recent Safety Culture Climate Survey at NRC (2012) 

showed significant improvement since 2005 in (1) “open collaborative 

work environment,” which was viewed favorably by 78 percent of 

respondents, up 11 points from 2005, and (2) Differing Professional 

Opinion/Non-Concurrence, which was viewed favorably by 60 percent 

of respondents, up 7 points from 2005. At the same time, the survey 

demonstrated that in comparison with 2009 survey results, NRC was 

well below external benchmarks on recognizing and respecting value 

of human differences, there was a significant decline in 

recruiting/retaining talented employees and developing people to their 

full potential, and that the agency lost ground on Differing Professional 

Opinion/Non-Concurrence.

These outcomes indicate that while many employees have positive 

perceptions towards the workplace environment, such views are not 

universal, and NRC should continue its efforts to promote an Open 

Collaborative Work Environment that encourages all employees and 

contractors to promptly raise concerns and differing views without fear 

of reprisal and make further improvements related to the NRC Differing 

Professional Opinion Program/Non-Concurrence Process. 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

23

Management Challenge #8

Accountability

Accountability refers to holding an individual responsible, with appropriate 

incentives and disincentives, for carrying out a defined set of duties or 

tasks, and for conforming to rules and standards applicable to their posts.

Accountability is driven by the tone at the top of an organization and 

supported by the commitment to integrity and ethical values, 

organizational structure, and expectations of competence, which influence 

the control culture of the organization. Accountability for performance of 

internal control responsibility supports day-to-day decision making, 

attitudes, and behaviors. 

OIG audits and investigations have identified opportunities to improve 

accountability among managers and staff alike at NRC. Examples of 

accountability issues found during OIG audits and investigations are 

included below. These examples illustrate the need for NRC to improve 

the culture of accountability in the agency.

Specific examples

• Accountability can be established through the implementation of 

effective internal controls. Currently, however, there are few controls 

over financial management system codes. One type of financial 

management system code is a budget object code. These codes are 

used to classify budget activity by type of cost; for example, supplies, 

equipment, or personnel. Budget object codes also indicate type of 

item acquired, such as training and telephone services. Each fiscal 

year, the Office of the Chief Financial Officer issues a list of budget 

object codes; however, according to agency managers the use of 

budget object codes is inconsistently enforced. The agency is 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

24

currently exploring how to enforce the use of these codes. Supervisory 

review over staff implementation of important management 

expectations and controls establishes accountability. For example, in 

calculating licensee fees, NRC’s Office of the Chief Financial Officer 

uses various spreadsheets. However, OIG auditors found that the 

Office of the Chief Financial Officer needs to develop quality control 

checklists to use during the preparation of the license fee calculation 

spreadsheets. In addition, NRC needs to ensure a supervisor reviews 

the completed checklists and documents the review and approval on 

the quality control checklists. The agency, in response to the OIG 

advisory, promptly took action to develop such quality control 

checklists and to include supervisory review. 

• Clear roles and responsibilities for managers and staff are important 

for ensuring organizational accountability. NRC’s process to identify 

bankrupt materials licensees is not as efficient as it could be because 

staff are performing duplicative tasks. Multiple NRC staff members—

both in headquarters and some in regional offices—conduct Internet 

and other searches to determine if organizations declaring bankruptcy 

are NRC licensees. Lacking written guidance, it is up to each staff

member to (or not to) determine the sources of information to examine 

and the extent of the review to perform, resulting in an inefficient use of 

resources. Currently, agency staff are working to develop guidance 

that provides clear roles and responsibilities for identifying bankrupt 

NRC materials licensees. 

• Organization leaders also need to seek information about ways to 

better support staff and follow through with appropriate support. 

Resident inspectors, for example, are tasked with a wide variety of 

activities associated with their role as the agency’s onsite presence at 

individual facilities for inspection and assessment of licensee 

performance and conformance with regulatory requirements. OIG 

found that resident inspectors generally receive sufficient support to 

enable them to adequately perform their roles and responsibilities. 

However, the residents—via a survey instrument—did identify 

opportunities for the agency to enhance the type and level of support 

currently being provided. Agency management had not been aware of 

a number of these issues, because the agency does not have a formal 

mechanism for obtaining resident inspectors’ concerns, including 

feedback and perspectives on support-related issues. NRC has 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

25

committed to taking specific programmatic steps and computer support 

solutions to address resident inspector support issues. 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

26

Management Challenge #9

Cyber Security

Cyber security refers to measures taken to protect a computer or 

computer system against unauthorized access or attack. Cyber security 

threats are a major concern for all Federal entities. Given the importance 

and sensitivity of NRC’s activities, along with the vast array of data it 

processes and maintains, cyber security has become a crucial aspect of 

NRC's overall security posture. 

Although NRC has implemented countermeasures during the recent 

years, security challenges and threats to the agency's information systems 

continue and are constantly evolving. Adversaries routinely attempt to 

compromise the information technology assets of the agency. In the 

recent past, targeted spear phishing attempts, credential harvesting and 

attacks of NRC’s public Web site have highlighted the importance of 

protecting these systems as well as the difficulty and diligence required to 

guard against such intrusions.

It is critical that cyber security protective measures keep pace with the 

growing threat as evidenced by the examples included below. 

Specific examples

• Several recent cyber-attack attempts against the agency's networks 

and systems have underscored the importance and urgency of a 

strong cyber security program. In April 2014, several senior NRC 

managers were targets of credential harvesting phishing emails, in 

which two senior NRC managers who received the e-mail, clicked on 

the link and provided their login credentials, which resulted in more 

than 2,000 e-mails being sent from one of the senior manager’s 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

27

compromised e-mail account to various recipients on the manager’s 

contact list, both inside and outside of NRC. In June 2013, an e-mail 

was sent to over 5,000 NRC e-mail accounts, directing users to click 

on a link and input their logon credentials to update the storage space 

in the email box. More than 50 NRC employees clicked on the link and 

input their logon credentials. 

• In March 2012, a hacker notified NRC of a vulnerability on NRC’s 

public facing NRC.gov Web site and NRC discovered questionable 

documents as well as a vulnerability used by an unknown person to 

gain access to the server. 

• The Federal Information Security Management Act of 2002 (FISMA) 

established the requirement for Federal agencies to develop, 

implement and manage agencywide information security programs, 

and provide acceptable levels of security for the information and 

systems that support the operations and assets of the agency. As part 

of OIG’s responsibilities under FISMA, OIG conducts an annual 

independent evaluation of NRC’s implementation of FISMA. The most 

recent FISMA evaluation for fiscal year (FY 2013) found that while the 

agency has continued to make improvements in its IT security program 

and has made progress in implementing the recommendations 

resulting from previous FISMA evaluations, information system security 

program weaknesses exist pertaining, for example, to the agency’s 

contractor oversight program and inconsistent application of 

configuration management procedures.

• The US-CERT continues to report that spear phishing attempts are 

increasing governmentwide. CSO CSIRT’s analysis reveals that 

recent phishing attempts are typically carried out by sending emails to 

target personnel attempting to acquire information such as usernames, 

passwords, and other personally identifiable information by 

masquerading as a trustworthy entity. Additionally, phishing 

awareness exercises performed by CSO found that NRC is up 1

percentage point to 17 percent of NRC users receiving a test phishing 

email clicking on the link to provide their login information.

• The Office of Information Services’ (OIS) Security Operations Center 

(SOC) reported for FY 2013, that there were three US-CERT Category 

3, Malicious Code, reportable events. A US-CERT Category 3 event is 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

28

the successful installation of malicious software (e.g., virus, worm, 

Trojan horse, or other code-based malicious entity) that infects an 

operating system or application. In January 2013, OIS discovered that 

an NRC workstation had been infected with malicious files. 

Additionally, in July 2013, OIS discovered an NRC workstation was 

attempting to make outbound calls to known malware sites, and it was 

determined that the computer was infected with a virus.

• The Computer Security Office’s Computer Security Incident Response 

Team (CSIRT) performs ongoing trend analysis as a means to 

evaluate and report security incident information to senior agency 

officials. During FY 2013, NRC experienced 51 US-CERT Category 5 

(scans, probes, and attempted access) reportable events at NRC – an 

increase from 25 incidents reported during FY 2012. A US-CERT 

Category 5 event is a category that “includes any activity that seeks to 

access or identify a Federal agency computer, open ports, protocols, 

service, or any combination for later exploit. This activity does not 

directly result in a compromise or denial of service.” 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

29

III. AGENCY COMMENTS AND OIG’S RESPONSE TO COMMENTS

On September 9, 2014, OIG issued a discussion draft of this report to the 

Executive Director for Operations (EDO) and the Chief Financial Officer 

(CFO) and requested formal and/or informal comments. On October 6, 

the Office of the Chief Financial Officer notified OIG that the office had no 

comments concerning the report. On October 9, 2014, the EDO provided 

formal comments, which conveyed the following main points:

• The discussion draft report and process involved in its development 

differ significantly from recent years in that NRC was not asked to 

provide suggested challenges and information supporting the 

challenges. The new format appears to be an assessment of NRC’s 

past 5 years of performance rather than an assessment of the 

challenges facing NRC. 

• The examples used to illustrate the challenges are past OIG 

recommendations that NRC has recognized as areas for continued 

improvement, has addressed, and continues to address.

• The tone of the discussion draft could be read to convey numerous 

programmatic weaknesses across the agency’s processes and not 

as specific, challenging areas for enhancement or improvement.

Many of the examples cited in the report do not rise to the threshold 

OIG has established for the challenges.

In addition to these general comments, the EDO provided specific 

technical and editorial comments for OIG’s consideration. The EDO’s

comments are presented in their entirety in the appendix to this report.

OIG agrees that its approach to developing and presenting the 2014

management and performance challenges report differs from prior years. 

OIG described this new approach to representatives from the Office of the 

Executive Director for Operations and the Office of the Chief Financial 

Officer during a June 27, 2014, management challenges kickoff meeting, 

and in a July 1, 2014, memorandum from OIG to the EDO and CFO. 

During the briefing and in the memorandum, OIG explained that as part of 

the new approach, the office would not be requesting early input from the 

agency and that, instead, the 2014 challenges and assessment would be 

based on OIG’s collective significance analysis of findings and 

recommendations from OIG audit reports, findings and issues identified in 
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

30

OIG investigative reports, agency action in response to OIG reports, and 

information gathered through OIG’s Issue Area Monitoring Program.

OIG’s intent was to prepare an independent assessment based primarily

on OIG audit and investigative findings and agency actions and plans for 

action in response to OIG reports. The management and performance 

challenges identified in this year’s report reflect trends that emerged over 

the past 5 years and remain apparent, based on audit and investigative 

findings and audit recommendations for which agency action is not yet 

completed. The examples described under each challenge area are 

intended to convey both areas needing improvement and progress made 

to address the challenges. Individual examples do not, in and of 

themselves, serve as evidence of a challenge, but viewed collectively, 

they do. Moreover, each of the nine challenges identified through OIG’s 

evidence-based approach meet the IG’s threshold for what constitutes a 

serious management and performance challenge. 

OIG anticipates that in future years, as the agency completes actions to 

address prior OIG findings, and as OIG identifies new areas that warrant 

management attention, the list of management and performance 

challenges will change and evolve as some challenges drop off the list 

and others, potentially, are added. This 2014 list is intended to be more 

actionable than prior year lists and, therefore, to serve as a tool for 

continuing and positive agency change.

OIG appreciates the EDO’s comments concerning the draft, and made 

modifications to two examples in the report based on those comments.
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

31

IV. SCOPE AND METHODOLOGY

This report presents the IG’s annual assessment of the most serious 

management and performance challenges facing the NRC. The 

challenges represent critical areas or difficult tasks that warrant high level 

management attention. To accomplish this work, OIG reviewed and 

analyzed pertinent laws and authoritative guidance, agency documents, 

and OIG reports, and analyzed approximately 540 audit findings issued 

over the past 12 years and 287 investigative reports issued over the past 

5 years to identify common themes and trends. Based on this analysis, 

OIG identified nine performance categories that represent the most 

serious management and performance challenges facing the agency.

This evaluation was conducted in accordance with the “Quality Standards 

for Inspection and Evaluation.” OIG staff conducted this evaluation from 

June through August 2014 at NRC headquarters.
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

32

APPENDIX
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

33
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

34
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

35
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

36
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

37
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

38
Inspector General’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

39