AUDIT REPORT

REDACTED FOR PUBLIC RELEASE

Audit of NRC’s Oversight of the 

Access Authorization Program for Nuclear Power Plants

OIG-10-A-21 September 30, 2010

All publicly available OIG reports are accessible through

NRC’s Web site at: 

http:/www.nrc.gov/reading-rm/doc-collections/insp-gen/
UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555-0001

OFFICE OF THE

INSPECTOR GENERAL

September 30, 2010

MEMORANDUM TO: R. William Borchardt

Executive Director for Operations

FROM: Stephen D. Dingbaum /RA/

Assistant Inspector General for Audits

SUBJECT: AUDIT OF NRC’S OVERSIGHT OF THE ACCESS 

AUTHORIZATION PROGRAM FOR NUCLEAR POWER 

PLANTS (OIG-10-A-21)

Attached is the Office of the Inspector General’s (OIG) audit report titled, Audit of NRC’s 

Oversight of the Access Authorization Program for Nuclear Power Plants.

The report presents the results of the subject audit. Agency comments provided at the 

August 25, 2010, exit conference have been incorporated, as appropriate, into this 

report.

Please provide information on actions taken or planned on each of the 

recommendations within 30 days of the date of this memorandum. Actions taken or 

planned are subject to OIG followup as stated in Management Directive 6.1.

We appreciate the cooperation extended to us by members of your staff during the 

audit. If you have any questions or comments about our report, please contact me at 

415-5915 or Beth Serepca, Team Leader, Security and Information Management 

Audits, at 415-5911.

Attachment: As stated
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

i

BACKGROUND

The Nuclear Regulatory Commission (NRC) has promulgated regulations 

requiring that its licensees implement an access authorization program to 

provide high assurance that individuals who are granted unescorted 

access and those individuals who maintain unescorted access to nuclear 

power plants are trustworthy and reliable and do not constitute an 

unreasonable risk to public health and safety, including the potential to 

commit radiological sabotage. 

NRC inspects licensee access authorization programs to verify that 

licensees are implementing programs in accordance with NRC regulations 

and the facilities’ security plans. Regional security inspectors conduct 

these inspections on a triennial cycle. Specifically, these inspectors look 

to provide assurance that a licensee’s access authorization program and 

its implementation process and procedures ensure individuals granted 

unescorted access are trustworthy and reliable.

OFFICIAL USE ONLY – PARAGRAPH HAS BEEN REDACTED FOR 

PUBLIC RELEASE

Sharif Mobley was arrested and charged in Yemen as a suspected 

member of al Qaeda in March 2010. Prior to his arrest, Mobley worked as 

a general laborer at six nuclear power plants in the United States between 

2002 and 2008. Mobley’s arrest prompted congressional interest and in 

early 2010, following Mobley’s arrest, Senator Charles Schumer and 
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

ii

Congressman William Owens sent letters to NRC’s Inspector General 

requesting a thorough and comprehensive review of NRC’s process 

requirements for licensees granting unescorted access at nuclear power 

plants.

In light of the Sharif Mobley incident, NRC is evaluating the access 

authorization process and NSIR’s interface with the FBI’s Terrorist 

Screening Center. NRC has made some initial enhancements to certain 

aspects of the access authorization program. 

The purpose of this audit was to determine the effectiveness of NRC’s 

oversight of nuclear power plant access authorization programs. 

Appendix A contains more information on the audit scope and 

methodology.

This audit found that program performance could be enhanced by 

implementing Office of the Inspector General (OIG) recommendations 

regarding: 

Behavioral Observation Program training requirements.

PADS database access.

NRC’s procedures for screening individuals granted unescorted 

access. 

OFFICIAL USE ONLY – PARAGRAPH HAS BEEN REDACTED FOR 

PUBLIC RELEASE
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

iii

OFFICIAL USE ONLY – PAGE HAS BEEN REDACTED FOR PUBLIC 

RELEASE
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

iv

OFFICIAL USE ONLY – SECTION HAS BEEN REDACTED FOR 

PUBLIC RELEASE

This report makes recommendations to improve the agency’s oversight of 

the access authorization program for nuclear power plants. A 

consolidated list of these recommendations appears in Section V of this 

report.

At an August 25, 2010, exit conference, agency senior managers 

generally agreed with the audit findings and recommendations and 

provided editorial suggestions for OIG’s consideration. This final report 

incorporates revisions made, where appropriate, as a result of the 

agency’s suggestions.
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

v

CFR Code of Federal Regulations

FBI Federal Bureau of Investigation

NRC Nuclear Regulatory Commission

NSIR Office of Nuclear Security and Incident Response

OIG Office of the Inspector General

PADS Personnel Access Data System

SSN Social Security Number
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

vi

TABLE OF CONTENTS

EXECUTIVE SUMMARY ............................................................. i

ABBREVIATIONS AND ACRONYMS......................................... v

I. BACKGROUND............................................................. 1

II. PURPOSE .................................................................... 8

III. FINDINGS ..................................................................... 9

A. BEHAVIORAL OBSERVATION PROGRAM

TRAINING.................................................................... 10

B. PADS DATABASE ACCESS .......................................... 15

C. SCREENINGS PROCEDURES FOR INDIVIDUALS

GRANTED UNESCORTED ACCESS ................................. 19

IV. OBSERVATIONS ............................................................. 23

V. CONSOLIDATED LIST OF RECOMMENDATIONS......... 26

VI. AGENCY COMMENTS..................................................... 26

APPENDIX

A. SCOPE AND METHODOLOGY ....................................... 27
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

1

I. BACKGROUND

The Nuclear Regulatory Commission (NRC) has promulgated 

regulations requiring that its licensees implement an access 

authorization program to provide high assurance that individuals

who are granted unescorted access and those individuals who 

maintain unescorted access to nuclear power plants are 

trustworthy and reliable and do not constitute an unreasonable 

risk to public health and safety, including the potential to commit 

radiological sabotage. Following the terrorist attacks of 

September 11, 2001, the Commission issued a series of 

security orders to ensure that nuclear power plants continued to 

have effective security measures in place given the changing 

threat environment. Licensees revised their physical security 

plans, access authorization programs, security officer training 

and qualification plans, and safeguards contingency plans in 

response to these orders. 

Figure 1. Limerick Nuclear Power Plant

Source: NRC

Operating nuclear power plants need workers with unescorted 

access during normal operations and scheduled outages (power 

generation shutdowns) for required maintenance. Some 
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

2

scheduled outages, such as refueling or steam generator 

overhaul, are quite extensive and time consuming. During a 

scheduled outage, a significant additional work force with 

specific skills is required. This type of work cycle leads to a 

continuous and ongoing need for temporary workers who must 

have access to nuclear power plants. Many of these workers 

move from one nuclear power plant, when the required work is 

completed, to the next plant that is commencing its maintenance 

outage. 

Congressional Requests for Audit

Sharif Mobley was arrested and charged in Yemen as a 

suspected member of al Qaeda in March 2010. Prior to his 

arrest, Mobley worked as a general laborer at six1nuclear 

power plants in the United States between 2002 and 2008. 

Mobley had unescorted access to these sites; however, he did 

not have access to safeguards information2or computer 

systems. OFFICIAL USE ONLY – SENTENCE HAS BEEN 

REDACTED FOR PUBLIC RELEASE Based on discussions 

with affected licensees, NRC management stated that there was 

no evidence to indicate that Mobley had been “radicalized” prior 

to his most recent employment at Salem/Hope Creek. 

 

1

Sharif Mobley primarily worked at Salem/Hope Creek [New Jersey] (76 weeks). He also 

worked at Three Mile Island [Pennsylvania] (2 weeks), Peach Bottom [Pennsylvania] (4 

weeks), Limerick [Pennsylvania] (4 weeks), and Calvert Cliffs [Maryland] (2 weeks). The 

Salem/Hope Creek power plants, although located next to each other, operate under 

separate licenses.

 

2

Safeguards information – An NRC categorization for information, which, if disclosed, could 

reasonably be expected to have a significant adverse effect on the health and safety of the 

public and/or the common defense and security by significantly increasing the likelihood of 

theft, diversion, or sabotage of materials or facilities subject to NRC jurisdiction. 
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

3

Mobley’s arrest prompted congressional interest and in early 

2010, following Mobley’s arrest, Senator Charles Schumer and 

Congressman William Owens sent letters to NRC’s Inspector 

General requesting a thorough and comprehensive review of 

NRC’s process requirements for licensees granting unescorted 

access at nuclear power plants. 

Obtaining Unescorted Access 

Unescorted access to a nuclear power plant allows an individual 

access to protected areas.3

Figure 2. Nuclear Power Plant Security Zones

Source: Nuclear Energy Institute

 

3

Areas within the protected area that house equipment important for nuclear safety are 

designated as vital areas. Access to a vital area is allowed only if an individual has been 

authorized to be in that area. Licensees grant access to vital areas of the plant based on the 

job specific duties of each individual. Licensees are required to establish a current access 

authorization list for all vital areas. The access list must be updated by the cognizant licensee 

manager or supervisor at least every 31 days and must be reapproved at least quarterly. The 

licensee must include on the access list only individuals whose specific duties require access 

to vital areas during non-emergency conditions.
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

4

Obtaining unescorted access requires that an individual 

satisfactorily complete all NRC regulatory requirements 

established in the access authorization program. The primary 

requirements that individuals must satisfy when initially applying

for unescorted access and during periodic reinvestigations4

consist of the following:

A background investigation that includes a verification of 

true identity, employment verification with a suitable inquiry 

(i.e., education in lieu of employment and military service as 

employment), a credit check, and character and reputation 

determination. Many licensees use specialized security 

screening companies (contractors) to conduct these 

background investigations, although the licensee is required 

to adjudicate the results. 

A criminal history check is used as an evaluative measure 

to assist in the determination of whether the individual has a 

record of criminal activity that may adversely affect his or her 

trustworthiness and reliability. Licensees are required to 

collect fingerprints from applicants and forward them to 

NRC’s Division of Facilities and Security. The Division of 

Facilities and Security acts as a conduit and submits the 

fingerprints to the FBI to obtain the applicant’s criminal 

history record information. The Division of Facilities and 

Security sends the FBI investigation results to the licensees, 

who use them in determining the trustworthiness and 

reliability of an individual. 

A psychological assessment that provides information to 

identify indications of disturbances in personality or 

psychopathology and to assist in evaluating the possible 

 

4 Most reinvestigations are required to be completed at intervals not to exceed 5 years,

although reinvestigations for individuals classified as belonging to the “critical group” are 

required to be completed at intervals not to exceed 3 years. Critical group individuals have 

extensive knowledge of defensive strategies and design and/or implementation of the plant’s 

defense strategies. 
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

5

adverse impact of any noted psychological characteristics on 

the individual’s trustworthiness and reliability.

Drug testing of all applicants for the use of illegal drugs 

occurs during the initial application process for unescorted

access. Additionally, when a pre-access drug sample is 

collected, the individual is then placed in an approved 

random testing program that satisfies NRC requirements. 

Maintaining Unescorted Access 

Federal regulations

5

require participating in a Behavioral 

Observation Program and a Fitness-for-Duty Program to 

maintain unescorted access. These programs are elements of 

a licensee’s overall access authorization program that assist in 

the oversight and monitoring of individuals granted unescorted 

access. Behavioral Observation Program training educates 

staff to recognize and report behaviors adverse to the safe 

operations and security of the facility and/or aberrant behavior 

that might adversely affect an individual’s trustworthiness or 

reliability. A Fitness-for-Duty Program’s objective is to provide 

reasonable assurance that individuals are not under the 

influence of any substance that would adversely affect their 

ability to safely and competently perform their duties.

 

5

Title 10, Code of Federal Regulations (CFR), Part 26 subparts b & c, and 10 CFR 73.56.
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

6

Figure 3: Calvert Cliffs Nuclear Power Plant

Source: NRC 

NRC’s Role in Access Authorization 

NRC inspects licensee access authorization programs to verify 

that licensees are implementing programs in accordance with 

NRC regulations and the facilities’ security plans. Regional 

security inspectors conduct these inspections on a triennial 

cycle. Specifically, these inspectors look to provide assurance 

that a licensee’s access authorization program and its

implementation process and procedures ensure individuals 

granted unescorted access are trustworthy and reliable. If there 

are any inspection findings, inspectors also present these 

findings to the licensee's management and conduct followup 

inspections to ensure that the licensee has taken corrective 

action.

OFFICIAL USE ONLY – SECTION HAS BEEN REDACTED 

FOR PUBLIC RELEASE
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

7

OFFICIAL USE ONLY – PAGE HAS BEEN REDACTED FOR 

PUBLIC RELEASE
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

8

OFFICIAL USE ONLY – SECTION HAS BEEN REDACTED 

FOR PUBLIC RELEASE

II. PURPOSE

The purpose of this audit was to determine the effectiveness of 

NRC’s oversight of nuclear power plant access authorization 

programs. Appendix A contains more information on the audit 

scope and methodology.
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

9

III. FINDINGS

NRC’s access authorization requirements are intended to 

provide high assurance that individuals granted unescorted 

access to nuclear power plants are trustworthy and reliable and 

do not constitute an unreasonable risk to public health and 

safety, including the potential to commit radiological sabotage. 

Reports that Sharif Mobley, a suspected member of al Qaeda, 

worked at several nuclear power plants prompted congressional 

requests for the Office of the Inspector General (OIG) to 

conduct this audit. This audit found that program performance 

could be enhanced by implementing OIG recommendations 

regarding: 

Behavioral Observation Program training requirements.

PADS database access.

NRC’s procedures for screening individuals granted 

unescorted access. 

OFFICIAL USE ONLY – PARAGRAPH HAS BEEN 

REDACTED FOR PUBLIC RELEASE
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

10

A. Behavioral Observation Program Training

One of the Behavioral Observation Program’s stated objectives 

is to detect and report behavior that may constitute an 

unreasonable risk to the public health and safety, including a 

potential threat to commit radiological sabotage. OFFICIAL 

USE ONLY – SENTENCE HAS BEEN REDACTED FOR 

PUBLIC RELEASE

Objective of the Behavioral Observation Program

One of the Behavioral Observation Program’s objectives is to 

detect and report behavior that may constitute an unreasonable 

risk to public health and safety, including a potential threat to 

commit radiological sabotage. OFFICIAL USE ONLY –

SENTENCE HAS BEEN REDACTED FOR PUBLIC RELEASE

 

Behavioral Observation Program training is mandatory for all 

individuals who are designated for unescorted access or are 

maintaining their unescorted access to a nuclear power plant. 
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

11

The training addresses the knowledge and abilities necessary to 

detect behavior or activities that potentially constitute an 

unreasonable risk and communicates the requirement to report 

noticeable changes in behavior, activities, or fitness-for-duty 

concerns about other individuals to management-designated 

personnel. The training program includes an initial 

comprehensive examination, annual refresher training, and an 

annual supervisory review by the individual’s immediate 

supervisor. 

Figure 5. Salem Nuclear Power Plant

Source: NRC

OFFICIAL USE ONLY – SECTION HAS BEEN REDACTED 

FOR PUBLIC RELEASE
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

12

OFFICIAL USE ONLY – SENTENCE HAS BEEN REDACTED 

FOR PUBLIC RELEASE NRC regional security inspectors, 

who routinely review licensee Behavioral Observation 

Programs, stated that the essence of the program is to provide 

personnel with unescorted access tools for how to recognize 

other employees who are abusing substances. The following 

table (Figure 4) illustrates some behaviors included, and not 

included, in current Behavioral Observation Program training. 

Training Includes Recognizing 

and Reporting:

Personal Health Behaviors

Drug and alcohol abuse

Sleepiness-yawning, tired eyes

Increased irritability

Shaky hands or twitching

Dizziness/Fainting

OFFICIAL USE ONLY –

SECTION HAS BEEN 

REDACTED FOR PUBLIC 

RELEASE

Social Interaction Behavior

Temper outbursts

Refuses social contact

Overly suspicious of others

Figure 4. Behavioral Observation Program training comparison

Source: OIG generated 
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

13

OFFICIAL USE ONLY – SECTION HAS BEEN REDACTED 

FOR PUBLIC RELEASE

OFFICIAL USE ONLY – SENTENCE HAS BEEN REDACTED FOR 

PUBLIC RELEASE An internal industry investigation following the 

Sharif Mobley incident uncovered that Mobley made statements to 

other employees that could be construed as suspicious. Specifically, 

one licensee investigative report uncovered that during Mobley’s 

employment at a nuclear power plant, he stated, "We are brothers in 

the union but if a Holy War comes, look out." Mobley also expressed 

his belief that Islam is the only true faith and that non-Muslims are 

infidels. Additionally, Mobley was observed with unusual Web sites on 

his personal computer, including one with a picture of a mushroom 

cloud. Although an employee who knew Mobley since 2002 was 

aware of this information, this information was only brought to light 

during the course of the investigation. OFFICIAL USE ONLY –

SENTENCE HAS BEEN REDACTED FOR PUBLIC RELEASE
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

14

(Cont.) OFFICIAL USE ONLY – SENTENCE HAS BEEN 

REDACTED FOR PUBLIC RELEASE

Recommendation

OIG recommends that the Executive Director for Operations:

1. OFFICIAL USE ONLY – RECOMMENDATION HAS BEEN 

REDACTED FOR PUBLIC RELEASE 
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

15

B. PADS Database Access

OFFICIAL USE ONLY – SECTION HAS BEEN REDACTED 

FOR PUBLIC RELEASE

Federal Control Standards 

The Government Accountability Office’s Standards for Internal 

Control in the Federal Government prescribes internal control 

standards for timeliness, accuracy, and validity of data. These 

standards require that management ensure there are adequate 

means for promptly recording transactions to maintain their 

relevance and value to management in controlling operations 

and making decisions. 
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

16

OFFICIAL USE ONLY – SECTION HAS BEEN REDACTED 

FOR PUBLIC RELEASE

Figure 6. Hope Creek Nuclear Power Plant 

Source: NRC

OFFICIAL USE ONLY – SECTION HAS BEEN REDACTED 

FOR PUBLIC RELEASE
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

17

OFFICIAL USE ONLY – SECTION HAS BEEN REDACTED 

FOR PUBLIC RELEASE

Reliance on Licensees 

NRC regional inspectors request licensees to provide 

information from PADS during inspections or on a case-by-case 

basis if there is a need to query the database for a specific 

person of interest. Commonly, inspectors will request 

information by telephone or during nuclear power plant site 

visits. Licensees then extract the data or run an inquiry in 

PADS for the inspectors. One inspector reported that during 

site visits, inspectors must physically look over someone’s 

shoulder while they retrieve the information from PADS for the 

inspector to verify information presented by licensees. The 

majority of inspectors interviewed suggested it would be 

beneficial for NRC to have direct access to PADS.

OFFICIAL USE ONLY – SECTION HAS BEEN REDACTED 

FOR PUBLIC RELEASE

 
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

18

OFFICIAL USE ONLY – SECTION HAS BEEN REDACTED 

FOR PUBLIC RELEASE

Limited PADS access also restricts the inspectors’ ability to 

independently review and analyze PADS data for trends and 

exceptions prior to actually inspecting the licensee. The validity 

and/or completeness of licensee provided data is also an area 

of concern. 

Recommendation 

OIG recommends that the Executive Director for Operations:

2. Obtain direct access to the Personnel Access Data System

(PADS) database.
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

19

C. Screening Procedures for Individuals Granted Unescorted 

Access 

OFFICIAL USE ONLY – SECTION HAS BEEN REDACTED 

FOR PUBLIC RELEASE

Figure 7. Peach Bottom Nuclear Power Plant

Source: NRC

Internal Control Requirements 

Control is any action taken by management to enhance the 

likelihood of achieving established objectives and goals. 

Control activities are the policies, procedures, techniques, and 
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

20

mechanisms that enforce management’s directives. Federal 

standards require that NRC maintain a system of internal 

controls. 

OFFICIAL USE ONLY – SECTION HAS BEEN REDACTED 

FOR PUBLIC RELEASE

Management Oversight

NRC planned to develop guidance describing the roles, 

responsibilities, and expectations of the access authorization 

program manager to achieve successful oversight of nuclear 

power plant access authorization programs; however, no 

formalized guidance exists. 
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

21

OFFICIAL USE ONLY – PAGE HAS BEEN REDACTED FOR 

PUBLIC RELEASE
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

22

OFFICIAL USE ONLY – SECTION HAS BEEN REDACTED 

FOR PUBLIC RELEASE

Recommendation

OIG recommends that the Executive Director for Operations:

3. OFFICIAL USE ONLY – RECOMMENDATION HAS BEEN 

REDACTED FOR PUBLIC RELEASE 
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

23

IV. OBSERVATIONS

Verification of True Identity

NRC regulations6require that licensees validate the social 

security number (SSN) that an individual provides prior to 

granting access to a nuclear power plant. Licensees accomplish 

SSN validations through background checks of employment 

history, credit history, and reference checks. OFFICIAL USE 

ONLY – SENTENCE HAS BEEN REDACTED FOR PUBLIC 

RELEASE

Figure 9. Three Mile Island Nuclear Power Plant

Source: NRC

E-Verify is an Internet-based system, operated by the U.S. 

Citizenship and Immigration Services, designed to help 

employers determine employment eligibility of new hires and the 

validity of their SSNs. 

 

6

10 CFR 73.56(d)(3), Verification of True Identity.
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

24

OFFICIAL USE ONLY – PARAGRAPH HAS BEEN 

REDACTED FOR PUBLIC RELEASE

U.S. Citizenship and Immigration Services management stated 

that under current law,7use of the E-Verify database is 

restricted to confirming employment eligibility, thereby

prohibiting NRC and licensees from gaining access to the 

system for verifying the SSNs for all licensee contractor 

employees. 

Required Disclosure of Past Employment Information 

Licensees are required to verify employment/unemployment 

history prior to granting access to a nuclear power plant. 

Background investigators are required to ask previous 

employers questions regarding an employee’s past 

performance. The past performance questions primarily focus 

on fitness-for-duty compliance and reason for termination. Both 

industry and NRC staff stated that many previous employers 

verify the dates of employment for an applicant, while refusing 

to answer the past performance questions for fear of litigation. 

When a licensee is unable to obtain past employment 

performance information from a previous employer, the use of 

“best effort” is permitted. Best effort allows a licensee to use 

employment information obtained from an acceptable alternate 

or secondary source to determine trustworthiness and reliability. 

An acceptable alternate source could be a co-worker or a 

reference on a current application for unescorted access, while 

an acceptable secondary source could be a pay stub or W-2 

form. OFFICIAL USE ONLY – SENTENCE HAS BEEN 

REDACTED FOR PUBLIC RELEASE 

 

7

Illegal Immigration Reform and Immigrant Responsibility Act of 1996, Public Law 104–208, 

September 30, 1996.
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

25

Disclosure of Foreign Travel 

Disclosure of foreign travel is not required on personal history 

questionnaires used to assist in processing background 

investigations of individuals seeking to obtain unescorted 

access to nuclear power plants. Requiring disclosure of foreign 

travel on personal history questionnaires was an idea conveyed 

to OIG during interviews. OFFICIAL USE ONLY – SECTION 

HAS BEEN REDACTED FOR PUBLIC 
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

26

V. CONSOLIDATED LIST OF RECOMMENDATIONS

OIG recommends that the Executive Director for Operations:

1. OFFICIAL USE ONLY – RECOMMENDATION HAS BEEN 

REDACTED FOR PUBLIC RELEASE 

2. Obtain direct access to the Personnel Access Data System

(PADS) database.

3. OFFICIAL USE ONLY – RECOMMENDATION HAS BEEN 

REDACTED FOR PUBLIC RELEASE 

VI. AGENCY COMMENTS

At an August 25, 2010, exit conference, agency senior 

managers generally agreed with the audit findings and 

recommendations and provided editorial suggestions for OIG’s 

consideration. This final report incorporates revisions made, 

where appropriate, as a result of the agency’s suggestions.
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

27

Appendix A

SCOPE AND METHODOLOGY

The audit objective was to determine the effectiveness of NRC’s 

oversight of nuclear power plant access authorization programs. 

To achieve the audit objective, the audit team reviewed 

pertinent laws, regulations, and agency guidance to identify 

criteria relevant to managing nuclear power plant access 

authorization programs. Guidance reviewed included:

Code of Federal Regulations, Title 10 Section 73.56, 

Personnel access authorization requirements for nuclear 

power plants, March 27, 2009.

Illegal Immigration Reform and Immigrant Responsibility Act 

of 1996, Public Law 104–208, September 30, 1996.

Nuclear Energy Institute procedure, Nuclear Power Plant 

Access Authorization Program, NEI 03-01 (Revision 3), May 

2009.

Nuclear Energy Institute procedure, Guideline for Plant 

Access Training, NEI 03-04 (Revision 7), December 2009.

The 2006 Memorandum of Understanding between the 

Terrorist Screening Center and NRC in support of terrorist 

screening.

NRC Inspection Procedure 71130.01, Access Authorization, 

April 1, 2010. 

Auditors met with congressional staff to gain an understanding 

of the requested scope for this audit. In addition to conducting 

interviews with current and former NRC staff, auditors also 

interviewed an Access Authorization Program Manager and a 

background investigation contractor. Interviews with inspectors 

from each of NRC’s four regions were conducted. Auditors also 

reviewed access authorization files and analyzed reports. This 
Audit of NRC’s Oversight of the Access Authorization Program for Nuclear Power Plants

28

work gained auditors an understanding of NRC’s oversight of 

nuclear power plant access authorization programs. Current 

issues, problems, and known deficiencies were uncovered 

because of this work.

This performance audit was conducted from April 2010 through 

July 2010, in accordance with generally accepted Government 

auditing standards. Those standards require that the audit is 

planned and performed with the objective of obtaining sufficient, 

appropriate evidence to provide a reasonable basis for any 

findings and conclusions based on the stated audit objective.

OIG believes that the evidence obtained provides a reasonable 

basis for the report findings and conclusions based on the audit 

objective. Internal controls related to the audit objective were 

reviewed and analyzed. Throughout the audit, auditors were 

aware of the possibility or existence of fraud, waste, or misuse 

in the program.

Beth Serepca, Team Leader; Robert Woodward, Audit 

Manager; Andrea Ferkile, Senior Management Analyst; and 

Michael Dickerson, Summer Intern, conducted this work. We 

performed this audit work at NRC headquarters in Rockville, 

MD; NRC Region I office in King of Prussia, PA; and Exelon 

Power Headquarters in Kennett Square, PA.