UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555-0001

OFFICE OF THE

INSPECTOR GENERAL

October 1, 2015

MEMORANDUM TO: Chairman Burns

FROM: Hubert T. Bell /RA/

Inspector General

SUBJECT: INSPECTOR GENERAL’S ASSESSMENT OF THE MOST 

SERIOUS MANAGEMENT AND PERFORMANCE 

CHALLENGES FACING THE NUCLEAR REGULATORY 

COMMISSION (OIG-16-A-01)

In accordance with the Reports Consolidation Act of 2000, I am providing what I 

consider to be the most serious management and performance challenges facing the 

U.S. Nuclear Regulatory Commission (NRC) in FY 2016.

INTRODUCTION

NRC is an independent Federal agency established to license and regulate the Nation’s 

civilian use of radioactive materials to ensure adequate protection of public health and 

safety, promote the common defense and security, and protect the environment.

NRC performs critical functions to ensure the safe and secure use of

radioactive materials in the United States and to protect both the public and radiation 

workers from radiation hazards that could result from the use of radioactive materials. 

NRC provides licensing and oversight activities for 99 commercial nuclear power 

reactors. 

NRC’s principal regulatory functions are to establish regulatory requirements and 

conduct confirmatory research to support requirements; issue licenses to facility 

operators and owners, possessors, and users of nuclear materials; oversee these 

licensees to ensure they are in compliance with NRC requirements and operate safely 
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

2

and securely; and respond to emergencies involving regulated activities. NRC also 

participates in international work that is integral to the agency’s mandate to protect 

public health and safety and promote the common defense and security. To carry out 

its mission, NRC’s proposed FY 2016 budget is $1,032.2 million, including 3,754 fulltime equivalent positions.

Based on NRC’s mission and objectives, the Office of the Inspector General (OIG) 

annually identifies what it considers to be the most serious management and 

performance challenges facing NRC. Our goal is to focus attention on these issues to 

enhance the effectiveness of NRC programs and operations.

MANAGEMENT CHALLENGES

The FY 2016 management and performance challenges are directly related to NRC’s 

mission areas (commercial nuclear reactors and nuclear materials), security, 

information technology and information management, financial programs and 

administrative functions. Our work in these areas indicates that while program 

improvements are needed, NRC is continually making progress to address OIG 

recommendations and improve the efficiency and effectiveness of its programs. The FY 

2016 management and performance challenges are as follows:

1. Regulation of nuclear reactor safety programs.

2. Regulation of nuclear materials and radioactive waste programs.

3. Management of security over internal infrastructure (personnel, physical, and cyber 

security) and nuclear security.

4. Management of information technology and information management.

5. Management of financial programs.

6. Management of administrative functions.

These challenges represent what OIG considers to be inherent and continuing program 

challenges relative to maintaining effective and efficient oversight and internal controls. 

As a result, it is likely they will continue to be challenges from year to year. Challenges 

do not necessarily equate to problems. 

Attached is a brief synopsis of each management and performance challenge along 

with summaries of OIG reports that inform the decision process. A complete list of 

reports can be found at http://www.nrc.gov/reading-rm/doc-collections/insp-gen/.
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

3

NRC is responsible for maintaining an established regulatory framework for the safe 

and secure use of civilian nuclear reactors, including commercial nuclear power plants 

as well as research, test, and training reactors. There are currently 99 nuclear power 

plants licensed to operate in the United States, which generate about 20 percent of the 

Nation's electrical use, as well as 5 plants under construction (Vogtle 3 and 4, Summer 

2 and 3, Watts Bar 2). There are also 31 licensed research and test reactors. NRC’s 

regulatory oversight responsibilities in the reactor arena include developing policy and 

rulemaking; licensing and inspecting reactors; licensing reactor operators; and enforcing 

regulations. The agency implements the nuclear reactor safety program with 

approximately 77 percent ($810 million) of its total budget authority and 76 percent

(2,900 full-time equivalent employees) of its total staff. Thus, it is of paramount 

importance that the agency implement these programs as effectively and efficiently as 

possible. 

Key reactor safety oversight challenges for NRC include the following:

 Ensuring an adequate and efficient reactor and operator licensing process, 

accounting for safety impacts of major changes to plant configuration, and 

sufficiently evaluating older plants for license extensions.

 Providing an adequate number of trained inspectors for sufficient oversight, and 

ensuring inspection procedures are adequate and are being followed.

 Ensuring adequate construction oversight of new power reactors, adequately 

reviewing and approving design changes that are occurring concurrent with the 

construction, and verifying whether plants are built in accordance with the 

intended design.

 Ensuring appropriate and reasonable application of the agency’s Reactor 

Oversight Process, Construction Reactor Oversight Process, Significance 

Determination Process for determining regulatory violation severity, safety culture

policy, and Alternative Dispute Resolution.

 Incorporating operational experience from the domestic and international nuclear 

industries into NRC’s regulatory program, including lessons learned from 

Fukushima and other events. 

The following audit report synopses are examples of work that OIG has completed or is 

ongoing pertaining to nuclear reactor safety programs. 

1. Regulation of nuclear reactor safety programs.
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

4

Audit of NRC’s Task Interface Agreement Process

OIG-15-A-05, November 25, 2014

NRC’s Office of Nuclear Reactor Regulation (NRR) is responsible for a broad range of 

regulatory activities in the licensing and oversight of commercial nuclear power reactors to 

protect public health and safety and the environment. NRR works with the NRC regions and 

other offices to accomplish its mission, including providing technical assistance to the 

regions and other offices. A Task Interface Agreement (TIA) is one such form of technical 

assistance that NRR provides the regions and other offices. A TIA is a request for NRR 

technical assistance from other NRC organizations and contains questions on subjects 

involving regulatory or policy interpretations, specific plant events, or inspection findings.

Ensuring that adequate, appropriate, and timely feedback is provided to the requesting 

organization is central to the agency’s mission to protect public health and safety and the 

environment.

Our review found that NRC regional and office staff requesting technical assistance from 

NRR are generally satisfied with the technical content provided through the TIA process. 

However, there are concerns regarding the efficiency of the process and, conceivably, long 

overdue TIAs could be regarded as eroding overall effectiveness of the TIA process. 

Roughly one-third of TIA requests are not resolved and communicated in a timely manner 

because NRC lacks controls to ensure TIA timeliness performance measures are met. 

Failure to meet timeliness performance measures degrades the agency’s safety oversight 

mission as well as overall program effectiveness and accountability. The agency agreed with 

the report’s findings and recommendations and is in the process of developing new 

performance measures that will serve as internal controls to ensure TIA timeliness.

The full report is available at: http://pbadupws.nrc.gov/docs/ML1432/ML14329A081.pdf
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

5

Audit of NRC’s Construction Reactor Oversight Process

OIG-15-A-14, June 16, 2015

NRC licenses and oversees new nuclear power reactor construction. Four reactors are 

being built under combined licenses issued in accordance with Title 10, Code of Federal 

Regulations, Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants. Two 

of the new reactors are in Georgia (Vogtle) and two in South Carolina (Summer). A fifth 

reactor, Watts Bar 2 is being built under the regulations for 10 CFR Part 50. NRC uses the 

Construction Reactor Oversight Process (cROP), a matrix-based tool for evaluating the 

quality of construction, to oversee construction of new nuclear power reactors licensed 

under Part 52. The audit objective was to assess the efficiency and effectiveness of NRC’s 

Construction Reactor Oversight Process. 

Our review found that NRC needs to improve efficiency when adjusting to construction 

inspection schedules and revising inspection guidance. In Fiscal Year 2014, regional 

construction inspection staff spent approximately 60 percent of time on administrative 

program support activities such as adjusting to licensee construction schedules and revising 

SmartPlans rather than conducting inspections. NRC relies on Construction inspection staff 

for monitoring and adjusting to construction schedule changes because schedules provided 

by licensees do not contain real-time information as originally envisaged. Further, the 

process for approving SmartPlan revisions is dominated by multiple levels of review by 

individuals who do not necessarily need to participate in the review. Agency efforts to 

identify process inefficiencies are not comprehensive and has left the agency unable to 

identify process and functional redundancies, overlap, and gaps. As the pace of new 

reactor construction increases, unaddressed administrative inefficiencies could affect future 

cROP effectiveness. The agency agreed with the report’s findings and recommendations 

and plans to assess its inspection planning and scheduling processes and monitor these 

programs for further inefficiencies. 

The full report is available at: http://pbadupws.nrc.gov/docs/ML1516/ML15167A491.pdf
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

6

Audit of NRC’s Operator Licensing Program for the AP1000 Power Reactor

(Ongoing Audit)

Pursuant to the Atomic Energy Act of 1954, as amended, Title 10, Code of Federal 

Regulations, Part 55 establishes procedures and criteria for the issuance of operator 

licenses to persons who operate commercially owned nuclear power reactors in the United 

States. The AP1000 power reactor is a newly designed system that will be incorporated in 

four nuclear power reactor units currently under construction. Specifically, units 3 and 4 at 

the Vogtle plant in Georgia and units 2 and 3 at the V.C. Summer plant in South Carolina, 

are scheduled to be operational around the 2019–2020 timeframe. 

The new AP1000 power reactor design will require operators to be trained, licensed, and 

qualified to take the controls in accordance with 10 CFR Part 55 when the reactors become 

operational. Each new reactor should have an onsite functional control room simulator for 

training and testing operators that must duplicate the plant as designed and built; however, 

some aspects of the AP1000 designs are incomplete. Consequently, the control room 

simulators may be insufficient for operator licensing when the new nuclear power reactor 

units are expected to be operational. 

OIG’s audit objective is to determine if NRC’s program for licensing AP-1000 reactor 

operators is efficiently and effectively implemented.
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

7

NRC is responsible for maintaining an established regulatory framework for the safe 

and secure use of nuclear materials; medical, industrial, and academic applications; 

uranium recovery, conversion and enrichment activities; fuel fabrication and

development; and, high-level and low-level radioactive waste. NRC is authorized to 

grant licenses for the possession and use of radioactive materials and establish 

regulations to govern the possession and use of those materials. Upon a State’s 

request, NRC may enter into an agreement to relinquish its authority to the State to 

regulate certain radioactive materials and limited quantities of special nuclear material. 

The State must demonstrate that its regulatory program is adequate to protect public 

health and safety and the environment, and compatible with NRC’s program. The 

States that enter into an agreement assuming this regulatory authority from NRC are 

called Agreement States. Currently, there are 37 Agreement States. 

NRC regulates high-level radioactive waste generated from commercial nuclear power 

reactors. High-level radioactive waste is either spent (used) reactor fuel when it is 

accepted for disposal or waste material remaining after spent fuel is reprocessed. 

Since radioactive waste becomes harmless only through decay (which may take 

hundreds of thousands of years for high-level waste), the material must be stored and 

ultimately disposed of in a manner that provides adequate protection of the public for a

very long time. 

Low-level radioactive waste (LLRW) is typically produced at nuclear power reactors, 

hospitals, research facilities, and clinics from the use of nuclear materials for industrial 

and medical purposes. NRC regulates the management, storage, and disposal of 

radioactive waste produced as a result of NRC-licensed activities. LLRW includes 

contaminated protective clothing, equipment and tools, medical supplies, and laboratory 

animal tissues. 

Key nuclear materials and radioactive waste oversight challenges for NRC include the 

following:

 Ensuring that licensing activities are conducted consistent with NRC 

requirements.

2. Regulation of nuclear materials and radioactive waste programs.
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

8

 Providing an adequate number of trained inspectors for sufficient oversight, 

providing adequate inspector training and assessing whether inspection 

procedures are adequate and are being followed.

 Providing effective oversight of licensees’ radioactive materials programs to 

preclude loss or theft.

 

 Ensuring that Agreement State programs are adequate to protect public health 

and safety and the environment, and are compatible with NRC’s program. 

 Providing effective oversight for the safe and secure interim storage of increasing 

quantities of high-level radioactive waste until a permanent repository for highlevel radioactive waste is operational.

 Providing effective oversight of licensee programs for the safe storage and 

disposal of low-level radioactive waste produced as a result of NRC-licensed 

activities. 

The following audit report synopses are examples of work that OIG has completed or is 

ongoing pertaining to nuclear materials and radioactive waste programs. 
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

9

Audit of NRC’s Oversight of Spent Fuel Pools

OIG-15-A-06, February 10, 2015

There are a total of 93 spent fuel pools for both operating and permanently shutdown nuclear 

power plants in the United States that currently store spent fuel. Recent NRC staff studies 

demonstrating the safety of spent fuel pools and the safety of continued storage of spent fuel 

at reactor sites highlight the need to ensure the safety of pool operations for longer periods 

than originally envisioned. The audit objective was to determine whether NRC’s oversight of 

spent fuel pools and the nuclear fuel they contain provides adequate protection for public 

health and safety, and the environment.

Our review revealed that regulatory uncertainty exists in NRC’s evaluation of spent fuel pool 

criticality safety analyses. In addition, there are gaps in NRC’s spent fuel pool inspection 

program as inspections of spent fuel pools greatly vary between licensee sites and are 

limited in scope. To fulfill its responsibility to protect public health and safety, NRC must 

inspect and assess licensee operations and facilities to ensure compliance with its regulatory 

requirements. NRC should also regulate in a manner that clearly communicates 

requirements and ensures that regulations are consistently applied and are practical. An 

absence of effective spent fuel pool criticality analyses guidance for both licensees and NRC 

staff may lead to a reduction in program efficiency and effectiveness. The agency agreed 

with the report’s findings and recommendations.

The full report is available at: http://pbadupws.nrc.gov/docs/ML1504/ML15041A567.pdf
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

10

Audit of NRC’s Oversight of Medical Uses of Nuclear Material

(Ongoing Audit)

Nuclear medicine is the use of radioactive material to provide information about the 

functioning of a person's specific internal organs (diagnostic) or to treat a disease 

(therapeutic). NRC is responsible for overseeing the medical uses of nuclear material 

through its licensing, inspection, and enforcement programs. NRC issues medical use 

licenses to medical facilities, develops guidance and regulations for use by licensees, and 

maintains a committee of medical experts and health care professionals to obtain advice 

about the use of byproduct materials in medicine.

NRC regulations aim to assure radioactive material is used properly in medical diagnosis, 

treatment, and research. The regulations are also meant to assure the safety of patients, 

medical workers, and the public, as well as to protect the environment. These regulations 

require licensees to report any event which fits the definition of a “medical event.” Medical 

events refer to a potential problem with how a medical facility uses radioactive material. 

These events may involve doses to a patient of the wrong amount, the wrong radioactive 

drug, incorrect administration of a drug, or dose to the wrong patient or wrong part of the 

body. On average, there are approximately 40 reported medical events per year out of 

hundreds of thousands of medical procedures involving radioactive material.

The audit objective will be to determine whether NRC’s oversight of medical uses of 

radioactive 
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

11

NRC must remain vigilant with regard to the security of its infrastructure and that of 

nuclear facilities and nuclear materials. NRC must continue to use robust, proactive 

measures to protect its infrastructure – the buildings, personnel, and information – from 

both internal and external threats. Moreover, as the nature of the threat continues to 

evolve, NRC faces challenges with oversight of protecting nuclear facilities and 

materials, the sharing of sensitive information, as well as emergency preparedness and 

incident response.

Key security oversight challenges for NRC include the following:

 Ensuring that cyber security protective measures keep pace with the growing 

threat. Recently, the data breach at OPM that affected NRC employees, targeted 

spear phishing attempts, credential harvesting and attacks of NRC’s public Web 

site have highlighted the importance of protecting these systems as well as the 

difficulty and diligence required to guard against such intrusions. 

 Establishing the insider threat prevention and detection program for detecting, 

deterring, and mitigating insider threats to address safeguarding of classified 

information from exploitation, compromise or unauthorized disclosure. 

 Continuing to pursue the need for new regulations focused on unique 

requirements of decommissioned nuclear power plants, which present different 

safety and security considerations than operating plants.

 Ensuring effective oversight of physical and personnel security at nuclear power 

plants. 

 Executing the Federal Information Security Management Act (FISMA) 

Modernization Act of 2014, to strengthen the security of computer networks. 

The following audit report synopses are examples of work that OIG has completed in 

the security programs. 

3. Management of security over internal infrastructure (personnel, 

physical, and cyber security) and nuclear security.
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

12

Independent Evaluation of NRC’s Implementation of the Federal Information Security 

Management Act for Fiscal Year 2014 

OIG-15-A-02 November 13, 2014

NRC has continued to make improvements in its information technology security program and 

progress in implementing the recommendations resulting from previous FISMA evaluations. 

However, we found that continuous monitoring is not performed as required. Specifically, we 

found that annual risk management activities in support of continuous monitoring were either 

delayed or not performed at all. In addition, system security plans, including the NRC 

Information Security Program Plan (ISPP), were not updated to reflect changes to National 

Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and 

Privacy Controls for Federal Information Systems and Organizations, with the issuance of 

Revision 4 in April 2013. As a result, NRC cannot ensure the effectiveness of information 

security controls for NRC systems and cannot identify and control risk. 

To improve the agency’s implementation of FISMA, we made a recommendation to develop a 

plan and schedule for updating system security plans, as well as the ISPP, to reflect NIST SP 

800-53. We also identified two repeat findings from previous FISMA evaluations. These 

included that configuration management procedures are still not consistently implemented and 

plans of action and management still needs improvement. The agency agreed with our findings 

and recommendations and is working towards implementing the recommendations to 

strengthen FISMA compliance.

The full report is available at http://pbadupws.nrc.gov/docs/ML1432/ML14323A321.pdf
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

13

Audit of NRC’s Communications Security (COMSEC) Program 

OIG-14-A-21 September 29, 2014 

COMSEC equipment at NRC is used to communicate sensitive and classified information and is 

a vital link for secure communication. NRC headquarters, region offices, and resident inspectors 

use a mix of classified and unclassified COMSEC equipment. As of August 2014, NRC had 696 

COMSEC items in its inventory. In Fiscal Year 2013 (the most current year for which data were 

available during this audit), NRC spent $3,622,500 on classified information systems, which 

included COMSEC equipment.

The Office of the Inspector General evaluated NRC staff’s management of the COMSEC 

program in accordance with Federal and agency policies. Based on this work, auditors did not 

identify instances where staff mismanaged the COMSEC program, or classified and sensitive 

information was disclosed to unauthorized personnel. However, opportunities exist to improve 

the COMSEC emergency plans and management of equipment maintenance contracting. 

COMSEC Emergency Plans: Federal Government COMSEC policy states that emergency 

plans must be documented and maintained, and that staff must be aware of plans for the 

accounting and protection of COMSEC materials during emergencies. NRC has not fully 

complied with Federal Government COMSEC emergency planning requirements. This occurs 

because of inconsistent management emphasis on updating plans and informing personnel 

of their responsibilities. As a result, NRC staff who manage and use COMSEC equipment may 

not be prepared to uphold their COMSEC responsibilities during emergency situations such as 

natural disasters or hostile actions against their facilities. 

Inadequate Maintenance: Federal and NRC guidance provides criteria for procurement and 

resource management that emphasizes efficient and effective resource use. Although NRC has 

a contract in place for secure fax maintenance, auditors observed a 60-percent malfunction rate 

across the agency’s inventory of secure fax machines. The high malfunction rates of NRC’s 

secure fax machines are attributable to a lack of performance-based contract terms that reflect 

the agency’s equipment readiness requirements. 

While no NRC staff faced immediate harm because of malfunctioning secure fax machines, the 

quarterly testing and compensating maintenance work performed by staff on these machines is 

an inefficient use of agency resources. The agency agreed with the report’s findings and 

recommendations and is working to fix the identified vulnerabilities. 

The full report is available at: http://pbadupws.nrc.gov/docs/ML1427/ML14272A359.pdf
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

14

Technology advances rapidly. New technologies such as cloud, virtualization, and 

mobility are tools that can be implemented. The challenge is deciding which of these 

new technologies will work to the best interest of NRC now.

The mission of NRC’s information technology/information management (IT/IM) program 

is to manage information and employ information technology to enhance information 

access and strengthen agency performance. The most important goal of NRC’s IT/IM 

program is effective information access—enabling both NRC staff and the public to 

quickly and easily obtain the information they need. This goal reflects NRC’s 

commitment to openness and is essential for effective agency operations. 

Key information technology and information management challenges for NRC include 

the following:

 Ensuring that information is protected and meets user requirements.

 Implementing and optimizing technology across NRC such as mobile computing, 

Web-based applications, and IT security.

 Implementing The Federal Information Technology Acquisition Reform Act of 

2014, which enhances the Chief Information Officers authorities. 

The following audit report synopses are examples of work that OIG has completed or is 

ongoing pertaining to the IT/IM programs.

4. Management of information technology and information 

management.
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

15

Audit of Web Based Licensing System 

OIG-15-A-17 June 29, 2015

The Web Based Licensing (WBL) system is a materials licensing system that supports the U.S. 

Nuclear Regulatory Commission (NRC) in managing the licensing information of regulated 

entities that use radioactive materials. It was deployed in August 2012. Designed to maintain 

information on materials licensees, WBL supports the entry of licensing information and license 

images that enables managing the licensing life cycle from initial application through license 

issuance, amendment, reporting, and termination.

Use of WBL can be improved to better support effective and efficient operations. Specifically, 

OIG found that varied use of WBL among the NRC regions, outdated business processes, and 

lack of standardization hinder efficiency and effectiveness. OIG concluded that full 

implementation of WBL’s capabilities can unify NRC’s oversight of materials licensees and 

support national efforts to monitor and secure radioactive materials. Management stated their 

general agreement with the findings and recommendations in this report.

The full report is available at: http://pbadupws.nrc.gov/docs/ML1518/ML15180A203.pdf

Audit of NRC’s IT Procurement Process

OIG15-A-09 February 10, 2015

Cost-effective information technology (IT) procurement is critical as the Nuclear Regulatory 

Commission (NRC) aims to provide staff with technology that helps them perform their mission 

and manage information security risk, while also maintaining fiscal discipline in the face of 

declining resources. The need to “innovate with less” is reinforced by trends in NRC’s annual IT 

spending, which decreased from approximately $165 million in fiscal year (FY) 2011 to 

approximately $152 million in FY 2015. This spending supports mission and management data 

systems, such as NRC’s incident response, official agency recordkeeping, and core financial 

accounting systems. Infrastructure services and support—which includes maintenance of NRC 

computer and telecommunication networks across agency headquarters, regional, and resident 

inspector offices—accounts for the largest single line item at $71 million, or 46 percent of NRC’s 

total FY 2015 IT budget.

NRC IT governance groups do not consistently apply investment criteria in reviewing and 

approving staff requests for new technology. Specifically, OIG found cases dating from 2010 to 

the present in which NRC purchased items to meet specific customer needs without 

establishing standardized selection criteria or applying such criteria to business case 

justifications for the procurements. Additionally, staff interviews and internal agency analysis 

corroborate a need for better coordination of IT procurement planning, budgeting, and 

prioritization. Management stated their general agreement with the finding and 

recommendations in this report.

The full report is available at http://pbadupws.nrc.gov/docs/ML1504/ML15042A355.pdf
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

16

Audit of NRC’s Network Security Operations Center (Ongoing Audit) 

The Network Security Operations Center (SOC) is responsible for monitoring, detecting, and 

isolating incidents and the management of the organization’s security products, network 

devices, end-user devices, and systems. This function is performed seven days a week, 24

hours per day. Basically the SOC, is a centralized facility responsible for every aspect of 

security in an organization. 

In July 2015, OIG initiated an audit of NRC’s network Security Operations Center (SOC). The 

audit objective is to determine whether the SOC meets its operational requirements, and to 

assess the effectiveness of SOC coordination with organizations that have a role in securing 

NRC’s network. 
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

17

NRC is required by the Omnibus Budget Reconciliation Act of 1990 to collect fees 

totaling approximately 90 percent of its annual budget authority. The agency’s budget 

authority for FYs 2013 and 2014 was $985.6 million and $1,055.9 million, respectively. 

NRC estimated that $859.6 million for FY 2013 and $916.7 million for FY 2014 should 

be recovered from invoiced fees. NRC is required to establish a schedule of charges 

that fairly and equitably assess the fees to license holders and license applicants. In 

recent years, multiple external stakeholders have questioned NRC’s budget and fees 

structure. To maintain transparency, NRC must continue to implement solid internal 

controls over financial management and reporting.

Key financial management and reporting challenges include the following:

 Developing and implementing the agency’s budget in accordance with Federal 

laws, regulations and guidelines.

 Maintaining a fee structure in accordance with laws and regulations and that is 

fair to agency licensees.

 Improving controls over license fee billing.

 Maintaining effective controls over financial reporting, contracts, and grants.

The following audit report synopses are examples of work that OIG has completed or is 

ongoing pertaining to financial programs.

5. Management of financial programs.
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

18

Audit of NRC’s Internal Controls Over Fee Revenue

OIG-15-A-12 March 19, 2015

The agency needs to establish more effective internal controls over the recordation of fee 

revenue. The procedures to identify and capture fee billable staff time and reimbursable 

contractor costs are ineffective and inefficient. Also, the process for validating the accuracy of 

the charges is labor intensive, difficult, and challenging. Controls for setting up timekeeping 

codes and their definitions are inconsistent and not standardized making it difficult for staff to 

identify the correct code for charging time. In addition, controls to prevent errors in selecting 

timekeeping codes for charging staff time can be improved.

Similarly, the overhead cost allocation process also needs improvement. The allocation 

calculation uses data that is unreliable and could produce inaccurate invoices to NRC licensees 

and applicants.

In addition, NRC validation reports and invoices sent to licensees and license applicants do not 

have adequate contractor details regarding services provided and related reimbursable costs. 

Lack of contractor detail in NRC validation reports and invoices sent to licensees and applicants 

increases the risk of billing errors. The agency agreed with the report’s findings and 

recommendations.

The full report is available at: http://pbadupws.nrc.gov/docs/ML1507/ML15078A321.pdf
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

19

Audit of NRC’s Decommissioning Funds Program (Ongoing Audit)

Under 10 CFR Part 50.75, NRC must receive reasonable assurances from nuclear reactor 

licensees that funds will be available for the decommissioning process. As of the prior biennial 

reporting and review period (as of December 31, 2012), the Decommissioning Trust Funds 

dedicated to NRC requirements for decommissioning and radiological decontamination totaled 

$45.7 billion. The agency began reviewing biennial decommissioning reports submitted by 

licensees that include information as of December 31, 2014, in the spring of calendar year 2015.

It is important to understand NRC actions to ensure that the licensees have reasonable plans in 

place to make up any shortfalls that exist between the current funded amount and the amount 

estimated as needed by NRC’s two-tiered formula. (The formula can be found in 10 CFR 

50.75(c).) The first tier computes the minimum amount, in 1986 dollars, needed at the time of 

permanent cessation of operations based on reactor type and power level of the reactors. The 

second tier adjusts the amount computed in the first tier, from 1986 dollars to current year 

dollars, based on escalation factors of labor, energy, and burial. OIG and the Government 

Accountability Office previously reported that NRC’s decommissioning formula was developed 

in 1986 and may not reliably estimate adequate decommissioning costs (see Audit Report OIG06-A-07, dated February 6, 2006, http://pbadupws.nrc.gov/docs/ML0603/ML060370376.pdf and 

GAO-12-258, dated April 2012). The audit objectives are to identify opportunities for program 

improvement and determine the adequacy of NRC’s processes for coordinating with licensees 

to address possible shortfalls.
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

20

NRC should continue exploring ways to reduce administrative inefficiencies while 

maintaining the appropriate corporate support to carry out agency operations. During 

FY 2015, NRC workforce totaled approximately 3,700 staff positions. To support the 

agency’s technical staff, NRC provides corporate support services such as contract 

support and multiple human resource programs. Although NRC has implemented 

multiple programs to support agency staff, NRC continues to operate in a Federal 

Government environment of stagnant or reduced agency budgets, and increasing 

pressure to reduce corporate support costs. Because of this, the agency needs to have 

an adequate balance between administrative functions and technical needs. In 

addition, NRC must be able to effectively recruit, train and transfer knowledge to new 

hires. This includes maintaining up-to-date guidance to effectively transfer knowledge 

and train current staff. 

Key NRC corporate support function challenges include the following:

 Reducing related costs while continuing to provide essential administrative 

functions that help the agency carry out its mission.

 Maintaining agency headquarters operations while complying with Federal space 

utilization guidelines and carbon footprint reduction targets.

 Recruiting, training and effectively transferring knowledge to NRC new hires.

 Providing current staff with the training and tools to maintain and/or improve the 

skills needed to effectively perform their jobs.

 Keeping NRC policies and procedures current.

The following audit report synopses are examples of work that OIG has completed that 

pertain to NRC’s administrative functions.

6. Management of administrative functions.
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

21

Audit of NRC’s Regulatory Analysis Process

OIG-15-A-15 June 24, 2015

The Atomic Energy Act of 1954, as amended (42 U.S.C. 2011), and Energy Reorganization Act 

of 1974, authorize the Nuclear Regulatory Commission (NRC) to develop regulations that 

licensees must follow to protect public health and safety and the environment, and to promote 

the common defense and security. NRC is authorized to establish by rule, regulation, or order, 

such standards and instructions to govern the possession and use of special nuclear, source, 

and byproduct material. NRC uses regulatory analyses to evaluate proposed rulemaking actions 

to protect public health and safety.

OIG found that the NRC’s knowledge management techniques for regulatory analysis need 

improvement and the agency does not consistently document stakeholder input prior to the 

proposed rule stage. The agency agreed with the report’s findings and recommendations.

The full report is available at: http://pbadupws.nrc.gov/docs/ML1517/ML15175A344.pdf
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

22

Audit of NRC’s Process for Revising Management Directives

OIG-14-A-19 September 15, 2014

Federal regulations provide that Federal agencies should strive to (1) convey written instructions 

and document agency policies and procedures through effective directives management and (2) 

provide agency personnel with information needed in the right place, at the right time, and in a 

useful format. At NRC, management directives are issued to (1) promulgate internal policies and 

procedures of agencywide interest or application that concern a high profile, mission-critical 

agency function or program and (2) impose substantive requirements on more than one NRC 

office. Management directives do not propose new policy; instead, directives reflect policy 

decisions already made and provide the process and guidance for implementing that policy. 

NRC Management Directive (MD) 1.1, NRC Management Directives System, issued March 18, 

2011, describes the process for issuing and revising directives. These directives are to be 

reviewed and reissued or certified as relevant at least every 5 years (the 5-Year Plan).

Although the agency strives for compliance with MD 1.1, NRC generally is not in compliance 

with keeping MDs accurate and up-to-date. Therefore, opportunities exist to improve program 

efficiency and increase compliance with MD 1.1 by (A) issuing MDs timely and (B) centralizing 

authoritative guidance. The agency agreed with the report’s findings and recommendations.

The full report is available at: http://pbadupws.nrc.gov/docs/ML1425/ML14258A612.pdf
IG’s Assessment of the Most Serious Management and Performance Challenges Facing NRC

23

Please Contact:

Email: Online Form

Telephone: 1-800-233-3497

TDD 1-800-270-2787

Address: U.S. Nuclear Regulatory Commission

Office of the Inspector General

Hotline Program

Mail Stop O5-E13

11555 Rockville Pike

Rockville, MD 20852

If you wish to provide comments on this report, please email OIG using this link.

In addition, if you have suggestions for future OIG audits, please provide them using 

this link.

 TO REPORT FRAUD, WASTE, OR ABUSE

 COMMENTS AND SUGGESTIONS