NATIONAL 

MEDIATION BOARD

Progress Made on 

GAO 

Recommendations, 

but Actions Needed to 

Address Management 

Challenges

Report to Congressional Committees

March 2018

GAO-18-301

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-18-301, a report to 

congressional committees

March 2018

NATIONAL MEDIATION BOARD

Progress Made on GAO Recommendations, but

Actions Needed to Address Management Challenges

What GAO Found

The National Mediation Board (NMB), which facilitates labor relations for 

railroads and airlines, has implemented five of the eight recommendations GAO 

made in its December 2013 and February 2016 reports (see table). The three 

remaining recommendations—on information security, information privacy, and 

rail grievance arbitration—are not yet fully implemented. 

Regarding information security, GAO found that NMB has made progress but is 

only partially following key practices. On information privacy, GAO found that 

NMB was following two of four key privacy practices but has not yet, among 

other things, assessed the privacy risks of its information systems. Finally, the 

agency has taken steps to track rail grievance arbitration cases, but still cannot 

perform needed analysis of the data. At the same time, NMB reports its backlog 

of these cases has grown from about 2,400 at the end of fiscal year 2011 to over

8,400 at the end of fiscal year 2017. While NMB has taken some steps to reduce 

this growing number of cases, it does not have a specific plan to address the 

backlog. Without such a plan, the backlog could continue to increase.

Status of GAO’s 2013 and 2016 Recommendations to NMB 

Recommendation Area Implemented Not Fully Implemented

Strategic Plan X

Performance Measures X

Workforce Plan X

Audit Response X

Procurement X

Information Security X

Information Privacy X

Rail Grievance Arbitration X

Source: GAO analysis of National Mediation Board (NMB) documents | GAO 18-301

NMB also faces other management challenges. First, although federal 

employees may not use their public office for private gain, NMB does not have 

controls in place to ensure that this is followed. During this review, GAO found 

that a lack of internal controls may have permitted a former manager to 

represent himself as a government employee while conducting business for his 

private companies. GAO plans to refer the matter to the appropriate authority for 

further investigation. Second, NMB employees expressed concerns in a 2017 

employee survey about issues such as promotions, training, and leadership.

NMB officials said they have not yet taken actions in response to survey results 

or conducted an internal climate assessment, even though such actions were 

promised in NMB’s strategic plan. Finally, some of NMB’s travel and telework 

policies are inconsistent with federal law and not consistently enforced. For 

example, NMB management approved rental of a luxury car in one case, which 

may have been prohibited by federal regulations. Oversight of a cognizant 

Inspector General (IG), as suggested in GAO’s 2013 report, might have

prevented or minimized many of the issues GAO identified. NMB recently 

established an agreement with the National Labor Relations Board IG to operate 

a telephone fraud hotline; however, ongoing oversight is needed to identify and 

assist NMB with addressing agency challenges.

View GAO-18-301. For more information, 

contact Cindy Brown Barnes at (202) 512-

7215 or brownbarnesc@gao.gov.

Why GAO Did This Study

NMB was established under the 

Railway Labor Act to facilitate labor 

relations for railroads and airlines by 

mediating and arbitrating labor 

disputes and overseeing union 

elections. The FAA Modernization and 

Reform Act of 2012 included a 

provision for GAO to evaluate NMB 

programs and activities every 2 years. 

GAO’s previous reports, issued in 

December 2013 and February 2016, 

included eight recommendations for 

NMB based on assessments of 

policies and processes in several 

management and program areas.

This third report examines the (1) 

progress NMB has made to fully 

implement past GAO 

recommendations, and (2) challenges 

NMB faces in managing its operations. 

GAO reviewed relevant federal laws, 

regulations, and NMB documents, 

such as its procurement and travel 

policies; examined the results of a

2017 employee survey; interviewed 

NMB officials; and investigated a 

potential conflict of interest at NMB.

What GAO Recommends

To improve its operations, NMB should 

develop and execute a plan to address 

the rail arbitration case backlog; follow 

up on employee survey results, 

including conducting an organizational 

climate assessment; and implement 

internal controls to ensure that 

employee requests for outside 

employment, travel, and telework 

comply with federal law. NMB agreed 

with these recommendations, and said 

that it is taking actions to address 

them. NMB also said that it is taking 

actions to fully implement the 

remaining recommendations from 

GAO’s 2013 and 2016 reports.
Page i GAO-18-301 National Mediation Board

Letter 1

Background 4

NMB Has Implemented Five of GAO’s Past Eight 

Recommendations but Additional Actions Are Needed to 

Address Remaining Three 7

Better Oversight Could Assist NMB in Addressing Conflicts of 

Interest, Employee Concerns, Travel, and Telework 

Requirements 18

Conclusions 26

Recommendations for Executive Action 27

Agency Comments and Our Evaluation 27

Appendix I National Mediation Board Documents Compared 

with Statutory and Policy Requirements 30

Appendix II Status of National Mediation Board Practices 

in Information Security and Privacy 33

Appendix III Comments from the National Mediation Board 36

Appendix IV GAO Contact and Staff Acknowledgments 42

Tables

Table 1: Status of 2013 and 2016 GAO Recommendations to the 

National Mediation Board (NMB) 8

Table 2: Number of National Mediation Board (NMB) Rail 

Arbitration Cases per Fiscal Year, 2011- 2017 16

Table 3: GAO Comparison of Key National Mediation Board 

(NMB) Documents with Federal Laws, Guidance, and 

Leading Practices 30

Table 4: Extent to Which the National Mediation Board (NMB) Is 

Following Key Practices for Information Security and 

Privacy 33

Contents
Page ii GAO-18-301 National Mediation Board

Figure

Figure 1: Organization of the National Mediation Board 5

Abbreviations 

FTR Federal Travel Regulation 

GPRA Government Performance and Results Act of 1993

GPRAMA GPRA Modernization Act of 2010 

IG Inspector General 

NLRB National Labor Relations Board

NMB National Mediation Board 

OGE Office of Government Ethics 

OMB Office of Management and Budget 

OPM Office of Personnel Management

RLA Railway Labor A

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-18-301 National Mediation Board

441 G St. N.W.

Washington, DC 20548

March 22, 2018 

The Honorable John Thune

Chairman

The Honorable Bill Nelson

Ranking Member

Committee on Commerce, Science, and Transportation

United States Senate

The Honorable Lamar Alexander

Chairman

The Honorable Patty Murray

Ranking Member

Committee on Health, Education, Labor, and Pensions

United States Senate

The Honorable Bill Shuster

Chairman

The Honorable Peter A. DeFazio

Ranking Member

Committee on Transportation and Infrastructure

House of Representatives

The National Mediation Board (NMB) plays a vital role in helping airline 

and railway carriers resolve labor disputes to avoid work stoppages, 

which could have severe economic consequences for the nation. A 2011 

estimate put the cost of a work stoppage in the railroad industry alone at 

$2 billion per day. NMB, created by a 1934 amendment to the Railway 

Labor Act (RLA), oversees union elections and provides mediation, 

arbitration, and other services to resolve railroad and airline labor 

disputes, including resolving disputes over issues such as working 

conditions, rates of pay, and union representation.1 Currently, NMB 

delivers services to management and labor unions at 100 commercial 

1 The RLA was enacted in 1926 to provide a framework for ensuring harmonious railroad 

labor relations, and amended in 1936 to also cover the airline industry. It establishes 

several key principles, including the requirement to “exert every reasonable effort” to settle 

disputes to avoid interruption to commerce or to the operation of any railroad or airline, 

and procedures for resolving disputes over pay, rules, or working conditions during 

collective bargaining, as well as disputes resulting from the interpretation or application of 

existing collective bargaining agreements. See, 45 U.S.C. §§ 152, First, Sixth, 153 and 

155.

Letter
Page 2 GAO-18-301 National Mediation Board

airlines and nearly 500 railroads. NMB has 51 full-time staff positions and 

had a fiscal year 2016 appropriation of approximately $13 million.

The FAA Modernization and Reform Act of 2012 further amended the 

RLA and included a provision for GAO to evaluate and audit the 

programs, operations, and activities of NMB every 2 years.2 In response 

to this provision, we issued a report in December 2013 with seven 

recommendations related to key management areas, such as strategic 

planning, performance measurement, and financial management.3

Because there is limited budgetary and human capital oversight of NMB, 

and because of concerns in these key areas, we also suggested that 

Congress consider authorizing an Inspector General (IG) at an 

appropriate federal agency to provide independent audit and investigative 

oversight of NMB. We issued a second report in February 2016 that 

provided an assessment of NMB’s progress in implementing our 2013 

recommendations and made an additional recommendation related to 

procurement.4

This is GAO’s third review of NMB and examines the:

1. progress NMB has made to fully implement past GAO recommendations, and

2. challenges, if any, NMB faces in managing its operations.

To address our objectives, we reviewed relevant federal laws, guidance, 

and regulations along with previous GAO work. We also assessed NMB 

documents related to key areas such as strategic planning, information 

security, information privacy, procurement, and travel using criteria such 

as Standards for Internal Control in the Federal Government,5 provisions 

of the Federal Information Security Modernization Act of 2014 (FISMA 

 2 Pub. L. No. 112-95, § 1004, 126 Stat. 11, 147 (creating 45 U.S.C. § 165).

3

GAO, National Mediation Board: Strengthening Planning and Controls Could Better 

Facilitate Rail and Air Labor Relations, GAO-14-5 (Washington, D.C.: Dec. 3, 2013). 

4

GAO, National Mediation Board: Progress Made on Some GAO Recommendations to 

Strengthen Operations, but Key Controls Continue to Be Needed, GAO-16-240 

(Washington, D.C.: Feb. 12, 2016).

5 GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 

(Washington, D.C.: Sept. 10, 2014).
Page 3 GAO-18-301 National Mediation Board

2014),6 and best practices in procurement developed by GAO in prior 

work.7 Appendix I provides a list of key NMB documents we reviewed, 

and the associated criteria we used to evaluate NMB’s efforts in several 

management areas. These areas included ones in which we had 

previously made recommendations and those in which NMB faces 

challenges in managing its operations. Appendix II provides information 

on the extent to which NMB is following key practices for information 

security and privacy.

We reviewed 2017 Federal Employee Viewpoint Survey data for NMB to 

help identify employee concerns, if any. In 2017, the Office of Personnel 

Management (OPM) sent surveys to all 34 eligible NMB employees, and 

59 percent responded. We determined that data from this survey were 

sufficiently reliable for our purposes. While we cannot generalize results 

across the agency, in part because of the small number of employees 

who responded to the survey, the survey provided information on 

employee engagement and organizational climate at NMB. We also 

provided NMB employees an opportunity to report any concerns in order 

to address them during our audit through our FraudNet Hotline from July 

2017 to September 2017 by sending an email with information on 

FraudNet and how to contact the hotline by email, phone number, or 

website form.8

We also conducted an investigation into an alleged conflict of interest on 

the part of a former NMB manager. As part of this investigation, we 

 6 Information security program and evaluation requirements for federal agencies were 

established by the Federal Information Security Management Act of 2002 (FISMA 2002). 

FISMA 2002 was largely superseded by the Federal Information Security Modernization 

Act of 2014 (FISMA 2014). As used in this report, FISMA refers both to FISMA 2014 and 

to those provisions of FISMA 2002 that were either incorporated into FISMA 2014 or were 

unchanged and continue in full force and effect.

7 To assess NMB’s procurement function, we used best practices for acquisition 

developed in GAO, Framework for Assessing the Acquisition Function at Federal 

Agencies, GAO-05-218G (Washington, D.C.: September 2005). To develop this 

framework, we consulted with federal government and industry experts in the areas of 

human capital, information management, financial management, and acquisition practices 

and prior GAO work.

8 FraudNet is operated by GAO to facilitate the reporting of allegations of fraud, waste, 

abuse, or mismanagement of federal funds. When federal employees, contractors, and 

members of the general public want to report such allegations, they can do so by filling out 

a FraudNet form on the Internet. FraudNet’s telephone number, fax number, mailing 

address, and e-mail are also available.
Page 4 GAO-18-301 National Mediation Board

interviewed NMB officials and reviewed pertinent documents, emails, and 

other records.

We interviewed NMB officials and NMB board members who were 

serving as of June 2017. We also selected external stakeholders to 

interview by identifying rail and air management groups that reviewed 

NMB’s strategic plan and groups that were interviewed for the December 

2013 and February 2016 GAO reports. The results of these interviews are 

not generalizable to all NMB stakeholders.9 Further, we interviewed 

officials at OPM, the Department of the Interior, and the Department of 

the Treasury regarding services these agencies provide to NMB.

We conducted the performance audit portion of our work from January 

2017 to March 2018 in accordance with generally accepted government 

auditing standards. Those standards require that we plan and perform the 

audit to obtain sufficient, appropriate evidence to provide a reasonable 

basis for our findings and conclusions based on our audit objectives. We 

believe that the evidence obtained provides a reasonable basis for our 

findings and conclusions based on our audit objectives. We conducted 

our related investigative work in accordance with investigation standards 

prescribed by the Council of the Inspectors General on Integrity and 

Efficiency.

NMB is headed by a three-member board, with each member appointed 

by the President and confirmed by the Senate for a term of 3 years.10

From February 2017, when one member resigned, until November 2017, 

the board had only two members. Three board members—two new and 

one c—were confirmed by the Senate in November 2017. While the 

board provides overall direction for the agency, day-to-day administration 

of the agency is provided by NMB’s General Counsel within the Office of 

Legal Affairs and the Chief of Staff (see fig. 1).

 9 Interviewees for our December 2013 report were identified by issue area experts within 

GAO and a literature review. See GAO-14-5.

10 45 U.S.C. § 154, First. No more than two members of the board can be from the same 

political party. The board members are required to designate a chairman annually. 45 

U.S.C. § 154, Second.

Background

NMB’s Organization and 

Mission
Page 5 GAO-18-301 National Mediation Board

Figure 1: Organization of the National Mediation Board

NMB’s mission is to provide for the independence of air and rail carriers 

and employees in matters of self-organization, avoid interruption to 

commerce conducted through the operation of those carriers, and 

administer adjustment boards11 as well as develop complementary 

strategies to resolve disputes. To fulfill its mission, NMB has three 

program areas:

• Representation: Unions are selected by rail or air carrier employees 

for the purposes of collective bargaining through secret-ballot 

elections conducted by NMB. If there is a question concerning 

representation of a specific craft or class,12 NMB is charged with 

resolving the representation dispute through its Office of Legal Affairs, 

and has sole jurisdiction to decide these disputes.13

• Mediation and Alternative Dispute Resolution: The RLA provides for 

mediation to help resolve disputes that can occur between 

management and labor during collective bargaining negotiations.14

When rail or air carriers and unions cannot reach agreement on the 

 11 If a carrier and employee cannot resolve a dispute, the RLA permits a party to refer the 

dispute to arbitration before an adjustment board created by the rail or air industry. The 

adjustment board consists of a carrier representative, a union representative, and a 

neutral arbitrator. In this capacity, the arbitrator is called upon to break a tie.

12 A craft or class consists of those employees who perform the same duties or functions 

at a given carrier, such as locomotive engineers or pilots.

13 45 U.S.C. § 152, Ninth.

14 45 U.S.C. § 155, First. In general, mediation is a process through which disputing 

parties, with assistance from a neutral third party (known as a mediator), seek ways to 

settle their dispute.
Page 6 GAO-18-301 National Mediation Board

terms of a new or revised collective bargaining agreement—such as 

working conditions or rates of pay—either party can apply for NMB’s 

mediation services to resolve their differences. NMB may also impose 

mediation if it finds that resolving the dispute is in the public’s interest. 

NMB also offers grievance mediation to parties as an alternative way 

to resolve disputes filed for grievance arbitration.

• Arbitration: The RLA also provides for grievance arbitration to help 

resolve disagreements between carriers and unions over how to 

interpret and apply provisions of existing collective bargaining 

agreements.15 For example, employees may file grievances if they 

believe they were wrongfully fired or disciplined in violation of the 

agreement. If the carrier and the employee cannot resolve the 

grievance, the RLA permits either of these parties to refer the dispute 

to arbitration before an adjustment board.16 NMB does not directly 

provide arbitration services, but rather maintains a list of registered 

arbitrators from which the parties can select someone to review and 

decide their case. In the airline industry, the parties pay the costs of 

arbitration. In the railroad industry, however, consistent with the 

requirements of the RLA, NMB pays the fee and travel expenses of 

the arbitrator.

The Office of Management and Budget (OMB) and OPM have key 

oversight responsibilities for all federal agencies, including the NMB. 

Among other things, OMB is responsible for preparing and implementing 

the President’s annual budget and for providing oversight of agencies’

management, including information technology and procurement, and for 

providing guidance to agencies on how to comply with the GPRA 

Modernization Act of 2010 (GPRAMA).17 OPM is the central personnel 

 15 45 U.S.C. § 153, First (i). Unless otherwise noted, in this report, when we refer to 

arbitration, we are referring to grievance arbitration.

16 The arbitration of unresolved grievances in the rail industry takes place before either the 

National Railroad Adjustment Board, created by the RLA, or adjustment boards 

established by the parties (rail carriers and unions), known as Public Law Boards or 

Special Boards of Adjustment. 45 U.S.C. § 153, First (i), Second; 29 C.F.R. § 1207.1. 

These adjustment boards generally are made up of an equal number of carrier and union 

representatives. The RLA gave NMB the authority to create a National Air Transport 

Adjustment Board (45 U.S.C. § 185), but it has not done so. Instead, in the airline industry, 

parties jointly create their own temporary special boards of adjustment, called System 

Boards, through collective bargaining agreements.

17 Pub. L. No. 111-352, 124 Stat. 3866 (2011). GPRA stands for the Government 

Performance and Results Act.

Executive Branch 

Oversight of the NMB
Page 7 GAO-18-301 National Mediation Board

management agency of the federal government charged with 

administering and enforcing federal civil service laws, regulations, and 

rules. OPM is also responsible for maintaining a personnel management 

oversight program to ensure that agencies comply with merit system 

principles, civil service statutes and regulations, and standards set by 

OPM, and conducts audits of agencies’ human capital programs. In 

addition, OPM annually administers the Federal Employee Viewpoint 

Survey to solicit employee views on their agency, including how they view 

agency leadership, collaboration, and other issues.

NMB is not among those agencies required to have an IG, nor is it subject 

to oversight by an IG of another agency. The Inspector General Act of 

1978, as amended, authorizes IGs within various departments and 

agencies.18 IGs have broad access to all aspects of their respective 

agency’s operations and have a mission, among other things, to conduct 

audits and investigations, to promote economy, efficiency, and 

effectiveness in the administration of programs, to prevent and detect 

fraud and abuse, and to report periodically to the head of the agency and 

to Congress.

NMB has implemented five of the eight recommendations GAO made in 

December 2013 and February 2016 (see table 1). For the three remaining 

recommendations, NMB needs to take additional actions to strengthen 

operations in the areas of information security, information privacy, and 

rail grievance arbitration. Without full implementation of these 

recommendations, NMB may be missing opportunities to improve 

performance and mitigate risks in these program and management areas.

 18 Pub. L. No. 95-452, 92 Stat. 1101 (1978) (codified as amended at 5 U.S.C. App).

NMB Has 

Implemented Five of 

GAO’s Past Eight 

Recommendations 

but Additional Actions 

Are Needed to 

Address Remaining 

Three
Page 8 GAO-18-301 National Mediation Board

Table 1: Status of 2013 and 2016 GAO Recommendations to the National Mediation Board (NMB) 

GAO’s 2013 

report recommendations 

Additional actions 

needed to implement 

recommendations 

as of February 2016a

Status of 

recommendations 

as of March 2018

Develop a formal strategic planning process to fully implement 

key required elements of strategic planning, including a formal 

process to obtain congressional and stakeholder input.

Develop formal written policies and 

procedures governing its planning 

process.

Implemented 

Develop, and include in its performance plan, performance 

goals and measures that contain required elements to 

demonstrate results.

Ensure performance goals meet all 

guidelines for federal performance

management.

Implemented

Develop a strategic workforce plan that (1) involves input from 

top management, employees, and other stakeholders; (2) 

identifies critical skills and competencies needed by NMB; (3) 

identifies strategies, such as training, to address any gaps; and 

(4) provides for cost-effective evaluations of these strategic 

workforce planning efforts. This plan should also address 

succession for the significant proportion of NMB staff and 

senior managers who are eligible to retire in the next few 

years.

Formally include stakeholders in 

planning process and evaluate 

workforce planning and other 

human capital efforts.

Implemented

Develop and implement a formal mechanism to ensure the 

prompt resolution of findings and recommendations by 

independent auditors, including clearly assigning responsibility 

for this follow-up to agency management.

Expand the written process to address 

all audits.

Implemented

Develop and fully implement key components of an information 

security program in accordance with FISMA.b Develop and implement policies and procedures and assess third-party 

providers’ implementation of security 

requirements.

Not fully 

implemented

Establish a privacy program that includes conducting privacy 

impact assessments and issuing system of record notices for 

systems that contain personally identifiable information.

Assess impact on privacy and issue 

notices about personally identifiable 

information NMB uses and shares.

Not fully 

implemented
Page 9 GAO-18-301 National Mediation Board

GAO’s 2013 

report recommendations 

Additional actions 

needed to implement 

recommendations 

as of 2016a

Status of 

recommendations 

as of 2018

In order to better inform its decisions about managing the rail 

grievance arbitration process, including addressing the backlog 

of cases, NMB should collect and analyze data on the types of 

grievances filed, and their disposition. NMB should use these 

data to improve the efficiency of the arbitration process and 

consider, as part of this effort, whether to establish fees for 

arbitration services. If NMB determines that the establishment 

of fees would improve the efficiency of the arbitration process, 

it should impose such fees or seek legislative authority to do 

so, as necessary. 

Collect data on all cases 

and analyze.

Not fully 

implemented

GAO’s 2016 report recommendation

Develop and implement written policies and processes 

consistent with its new procurement environment

Not applicable Implemented

Source: GAO-14-5, GAO-16-240. | GAO-18-301

a

In our 2016 report, we reported that NMB made some progress in addressing GAO’s previous 

recommendations made in December 2013; however, additional actions were needed to fully 

implement those recommendations and strengthen operations.

b

Information security program and evaluation requirements for federal agencies were established by 

the Federal Information Security Management Act of 2002 (FISMA 2002). FISMA 2002 was largely 

superseded by the Federal Information Security Modernization Act of 2014 (FISMA 2014). FISMA 

2014 retains many of the requirements for federal agencies’ information security programs previously 

set by the 2002 law.
Page 10 GAO-18-301 National Mediation Board

Strategic Plan

In our 2016 review, we found that NMB had implemented a strategic 

planning process but had not formalized it through written policies and 

procedures. In fiscal year 2014, NMB developed and published a 

strategic plan covering fiscal years 2014 through 2019, which we 

determined was largely consistent with OMB guidance19 on implementing 

the GPRA Modernization Act of 2010 (GPRAMA).20 However, the agency 

had not developed a written policy or set of procedures outlining its 

strategic planning process.

In our current review, we found that NMB had implemented this 

recommendation. Specifically, NMB developed a formalized process to 

define responsibilities, assign key roles, and delegate authority to staff in 

its strategic plan. In addition, NMB has implemented an annual planning 

process for reviewing and updating its strategic plan.

Performance Measures

In our 2016 review, we reported that none of NMB’s performance goals 

followed all elements of OMB’s guidance for implementing GPRAMA.21

NMB officials told us that it is difficult for the agency to design 

performance goals because some outcomes are out of its control, such 

 19 OMB, Strategic Plans, Annual Performance Plans, Performance Reviews, and Annual 

Program Performance Reports, Circular No. A-11, Part 6 (Washington, D.C.: July 2016).

20 In 1993, Congress passed the Government Performance and Results Act (GPRA), 

which established strategic planning, performance planning, and performance reporting as 

a framework for agencies to communicate progress in achieving their missions. Pub. L. 

No. 103-62, 107 Stat. 285 (1993). The GPRA Modernization Act of 2010 (GPRAMA), 

enacted in 2011, established some important changes to existing requirements by placing 

a heightened emphasis on priority-setting, cross-organizational collaboration to achieve 

shared goals, and the use and analysis of goals and measurements to improve outcomes. 

GPRAMA enhanced agency-level planning and reporting requirements and required 

agencies to have additional leadership involvement and accountability. See, Pub. L. No. 

111-352, 124 Stat. 3866 (2011).

21 Consistent with GPRAMA, OMB defines a performance goal as a statement of the level 

of performance to be accomplished within a time frame, expressed as a tangible, 

measurable objective or as a quantitative standard, value, or rate. For implementation of 

GPRAMA, OMB states that a performance goal includes a performance indicator, a target, 

and a time period. See OMB, Preparation and Submission of Strategic Plans, Annual 

Performance Plans, and Annual Performance Reports, Circular No. A-11, Part 6 (July 

2016).

NMB Implemented 

Recommendations to 

Improve Strategic Plan, 

Performance Measures, 

Workforce Plan, Audit 

Response, and 

Procurement

GAO 2013 Recommendation: NMB should 

develop a formal strategic planning process to 

fully implement key required elements of 

strategic planning, including a formal process 

to obtain congressional and stakeholder input.

Source: GAO-14-5. | GAO-18-301

GAO 2013 Recommendation: NMB should 

develop and include in its performance plan, 

performance goals and measures that contain 

required elements to demonstrate results. 

Source: GAO-14-5. | GAO-18-301
Page 11 GAO-18-301 National Mediation Board

as how long it takes parties to reach agreement through mediation. 

However, our prior work has shown there are a number of strategies that 

federal agencies can use to reduce the influence of external factors on 

agencies’ measures.22

In our current review, we found that NMB had implemented this 

recommendation. We assessed the extent to which NMB has developed 

performance goals to meet all guidelines for federal performance 

management and determined that NMB’s performance goals either met or 

substantially met federal guidelines. For example, to facilitate the 

settlement of disputes, NMB’s arbitration department is to acknowledge 

all external requests within 1 business day and the director is to make 

case assignments within 2 business days of deadline for requests.

Workforce Plan

In our 2016 review, we found that NMB did not formally solicit feedback 

from staff and stakeholders on its workforce plan. NMB officials told us 

the agency developed its workforce plan through a collaborative, agencywide process, but they did not formally solicit feedback from stakeholders 

on the plan and the plan did not specifically call for staff and stakeholder 

involvement. In addition, NMB’s workforce and succession plan did not 

address the monitoring and evaluation of its workforce planning efforts, 

and the performance goals related to human capital did not meet OMB 

guidance.

In our current review, we determined that NMB had implemented this 

recommendation. NMB officials stated that during the past fiscal year, the 

agency updated its strategic workforce plan and sent the plan to 

stakeholders for comments. NMB also took steps to formally include 

internal and external stakeholders in its workforce planning process. In 

addition, its strategic workforce plan contains strategies to evaluate 

agency workforce planning and other human capital efforts. For example, 

NMB’s strategic workforce plan contains human capital goals, such as an 

annual review of its training policy; individual development plans for its 

 22 These strategies are (1) selecting a mix of outcome goals of which the agency has 

varying levels of control, (2) redefining the scope of a strategic goal to focus on a more 

narrow range of actual activities, (3) disaggregating goals for distinct target populations for 

which the agency has different expectations, and (4) using data on external factors to 

statistically adjust for their net effect on the desired outcome. See GAO, Managing for 

Results: Measuring Program Results that Are Under Limited Federal Control, 

GAO/GGD-99-16 (Washington, D.C.: Dec. 11, 1998).

GAO 2013 Recommendation: NMB should 

develop a strategic workforce plan that (1) 

involves input from top management, 

employees, and other stakeholders; (2) 

identifies critical skills and competencies 

needed by NMB; (3) identifies strategies, such 

as training, to address any gaps; and (4) 

provides for cost-effective evaluations of 

these strategic workforce planning efforts. 

This plan should also address succession for 

the significant proportion of NMB staff and 

senior managers who are eligible to retire in 

the next few years. 

Source: GAO-14-5. | GAO-18-301
Page 12 GAO-18-301 National Mediation Board

staff; a recruitment plan; and a succession plan. In addition, NMB 

developed a workforce policy that includes a performance management 

process to monitor and evaluate its staff that is consistent with federal 

internal control standards.

Audit Response

In our 2016 review, we found that NMB did not have a formal mechanism 

to promptly resolve all audit findings consistent with federal internal 

control standards. Specifically, while NMB drafted a financial audit 

standard operating procedure in 2014, it did not cover the agency’s 

response to findings from non-financial audits, such as GAO and OPM 

evaluations. NMB’s financial audit document also did not have a formal 

mechanism to promptly resolve all audit findings consistent with federal 

internal control standards.23

In this review, we determined that NMB had implemented this 

recommendation. NMB’s audit standard operating procedures now outline 

the agency process for promptly resolving financial and non-financial 

audit findings, and those procedures are consistent with federal internal 

control standards.

Procurement

In our 2016 review, we found that NMB had not developed policies and 

processes for provision of certain procurement functions contained in its 

interagency agreement with Treasury’s Bureau of the Fiscal Service.24

 23 Federal internal control standards state that agencies should ensure that the findings of 

audits and other reviews are promptly resolved. GAO, Standards for Internal Control in the 

Federal Government, GAO-14-704G (Washington, D.C.: September 10, 2014).

24 Per an interagency agreement between Treasury’s Bureau of the Fiscal Service and 

NMB, Treasury provides NMB with procurement services that include simplified 

acquisition, contracts, contract administration, and purchase cards.

GAO 2013 Recommendation: NMB should 

develop and implement a formal mechanism 

to ensure the prompt resolution of findings 

and recommendations by independent 

auditors, including clearly assigning 

responsibility for this follow-up to agency 

management.

Source: GAO-14-5. | GAO-18-301

GAO 2016 Recommendation: NMB should 

develop and implement written policies and 

processes consistent with its new 

procurement environment. 

Source: GAO-16-240. | GAO-18-301
Page 13 GAO-18-301 National Mediation Board

NMB did not have policies and processes in place consistent with internal 

control standards and best practices.25

In this review, we found that NMB had implemented this recommendation. 

NMB finalized a procurement operation manual in October 2017 that 

includes processes for its interagency agreement with the Bureau of the 

Fiscal Service, and has procurement processes in place that are 

consistent with federal internal control standards and best practices.

Information Security

In our 2016 review, we reported that NMB had fully transitioned its 

network infrastructure and records management system into a cloudcomputing environment and its financial systems to third-party providers. 

NMB also took steps to improve its information security program by 

developing a procedure for handling cyber incidents, and having an 

agreement in place with Treasury’s Bureau of the Fiscal Service to 

conduct a security assessment of its enterprise network among other 

things. However, in 2016 we found that NMB was partially following five 

and minimally following three of the eight key information security 

practices delineated by GAO in 2013.26 For example, NMB had not 

developed agency-wide risk-based policies and procedures that govern 

its information security program, including NMB oversight of third-party 

providers—entities that provided or managed information systems that 

supported NMB operations.

 25 According to the Standards for Internal Control in the Federal Government, control 

activities are the policies, procedures, techniques, and mechanisms that enforce 

management’s directives and they should be effective in accomplishing the entity’s 

objectives. For example, all transactions are promptly recorded to maintain their relevance 

and value to management in controlling operations and making decisions. This applies to 

the entire process or life cycle of a transaction or event, from its initiation and authorization 

through its final classification in summary records. In addition, management designs 

control activities so that all transactions are completely and accurately recorded. 

GAO-14-704G.

26 We assessed whether NMB is following key federal practices according to three states 

of actions—(1) following—taking appropriate actions and has a formal plan, policy, or 

other document; (2) partially following—taking some actions but does not have a formal 

plan or policy and/or some additional steps must be taken to consider this practice 

implemented; or (3) minimally following—taking little or no action to address this particular 

practice. For more information on our evaluation of NMB’s information security practices in 

February 2016, see GAO-16-240.

NMB Needs Additional 

Efforts to Improve 

Information Security, 

Information Privacy, and 

Rail Grievance Arbitration

GAO 2013 Recommendation: NMB should 

develop and fully implement key components 

of an information security program in 

accordance with FISMA

Source: GAO-14-5. | GAO-18-301
Page 14 GAO-18-301 National Mediation Board

In our current review, we determined that NMB has made progress in 

following information security practices, but has not fully implemented 

GAO’s 2013 recommendation. NMB is partially following, meaning some 

actions have been taken but additional steps remain, all eight of the key 

information security practices delineated by GAO in 2013. For example, 

NMB documented a system security plan for its enterprise network, 

security awareness training guidance, and a continuity of operations 

policy, among other things. However, NMB has not developed agencywide policies and procedures for the oversight of third-party providers that 

support the operations and assets of the agency, and NMB officials 

acknowledged that this oversight may need improvement.27 Officials also 

said the agency did not assess third-party providers’ implementation of 

security requirements to help ensure the effectiveness of information 

security controls over information resources that support federal 

operations and assets. For additional details on information security, see 

appendix II.

Information Privacy

In our 2016 review, we reported that NMB was following one of the four 

key information privacy practices delineated by GAO in 2013.28

Specifically, NMB designated the Assistant Chief of Staff as its senior 

agency official for privacy. However, the agency was minimally following 

policies and procedures for privacy protections, privacy impact 

assessments, 29 and system of records notices.30 For example, NMB had 

not conducted a privacy impact assessment for its financial management 

systems, which contained the agency’s personally identifiable information.

 27 Each agency shall develop, document, and implement an agency-wide information 

security program to provide information security for the information and information 

systems that support the operations and assets of the agency, including those provided or 

managed by another agency, contractor, or other source. See FISMA 2014.

28 For more information on our evaluation of NMB’s information privacy practices in 

February 2016, see GAO-16-240.

29 A privacy impact assessment is an analysis of how information is handled (i) to ensure 

handling conforms to applicable legal, regulatory, and policy requirements regarding 

privacy; (ii) to determine the risks and effects of collecting, maintaining and disseminating 

information in an identifiable form in an electronic information system; and (iii) to examine 

and evaluate protections and alternative processes for handling information to mitigate 

potential privacy risks.

30 A system of records is a collection of information about individuals under control of an 

agency from which information is retrieved by the name of an individual or other identifier. 

GAO 2013 Recommendation: NMB should 

establish a privacy program that includes 

conducting privacy impact assessments and 

issuing system of record notices for systems 

that contain personally identifiable 

information.

Source: GAO-14-5. | GAO-18-301
Page 15 GAO-18-301 National Mediation Board

In our current review, we found that NMB has made progress in following 

information privacy, but still has not fully implemented our 2013 

recommendation. Specifically, NMB was following two of the four key 

privacy practices. For example, NMB designated a privacy officer and 

finalized its privacy policy containing procedures for protecting sensitive 

information, including personally identifiable information. However, NMB 

was only minimally following the other two key privacy practices. First, 

NMB has not conducted privacy impact assessments. Among other 

things, such assessments identify privacy risks and the appropriate 

controls to address such risks for its systems or those of third-party 

providers containing the agency’s personally identifiable information. 

According to the Chief Information Officer, the agency’s third-party 

providers perform their own privacy impact assessments. However, NMB 

did not provide any documentation on how it oversaw third-party provider 

assessments. Second, NMB has not issued system of records notices to 

provide transparency about its possible use of personally identifiable 

information. For additional details on the extent to which the agency met 

key information privacy practices, see appendix II.

Rail Grievance Arbitration

In our 2016 review, we found that NMB was collecting data on the types 

of grievances filed for arbitration for two of the three adjustment boards, 

which hear grievances in the rail industry.31 However, NMB was not able 

to capture information on the types of grievances filed at the third 

adjustment board because it did not have the board’s codes, and 

therefore was not able to use this information to analyze the agency’s 

arbitration backlog.

In our current review, we determined that NMB had taken some steps, but 

has not yet fully addressed this recommendation. For example, NMB’s 

Director of the Office of Arbitration Services stated that the agency has 

developed its Arbitrator Work Space (AWS) case management system, 

which assists staff in monitoring, recording, and tracking the activities of 

rail arbitration cases. However, according to this official, AWS does not 

allow the agency to analyze the data because NMB still cannot capture 

information on grievance types from one of the three adjustment boards, 

 31 Grievance arbitration cases in the rail industry can involve a wide range of grievances, 

such as wrongful dismissals, unfair labor practices, and rights to additional pay.

GAO 2013 Recommendation: NMB should 

collect and analyze data on the types of 

grievances filed, and their disposition. NMB 

should use these data to improve the 

efficiency of the arbitration process. 

Source: GAO-14-5. | GAO-18-301
Page 16 GAO-18-301 National Mediation Board

and AWS has limited reporting capabilities.32 After discussing the 

preliminary findings with NMB officials, they provided documentation that 

NMB requested this board to add subject codes to all of its open rail 

arbitration cases by March 1, 2018, and thereafter include the subject 

code when submitting a notice of intent for arbitration.

In addition, we found that the agency’s rail grievance arbitration backlog 

has more than tripled since 2011, increasing from about 2,400 cases at 

the end of fiscal year 2011 to more than 8,500 cases and the end of fiscal 

year 2017. NMB arbitration caseload has increased over the last 5 years 

by about 1,000 cases per year (see table 2).

Table 2: Number of National Mediation Board (NMB) Rail Arbitration Cases per 

Fiscal Year, 2011- 2017

Fiscal year Beginning New Resolved End

2011 2,770 3,908 4,294 2,384

2012 2,384 3,569 3,869 2,084

2013 2,084 5,230 3,737 3,803

2014 3,803 4,313 2,946 5,170

2015 5,170 3,816 2,702 6,247

2016 6,247 4,754 3,562 7,455

2017 7,455 4,148 3,057 8,546

Source: GAO analysis of NMB documents and interviews with NMB officials. | GAO-18-301

NMB officials said the growing backlog is due to a number of factors the 

agency cannot control. For example, NMB’s Director of the Office of 

Arbitration Services stated that carriers and unions are filing more cases 

because they do not have to pay for arbitration.33 In addition, he said that 

rail unions that do not have a centralized office through which arbitration 

cases are processed tend to file more cases. NMB projected that the 

number of rail arbitration cases would continue to increase through fiscal 

 32 AWS only generates an Arbitrator Caseload Report, which tracks cases assigned, 

cases heard, and cases that are late. Other than this one report, the agency uses AWS to 

monitor the individual progress of arbitration cases.

33 In the airline industry, the parties pay the costs of arbitration. In the railroad industry, 

consistent with the requirements of the RLA, NMB pays the fee and travel expenses of the 

arbitrator.
Page 17 GAO-18-301 National Mediation Board

year 2017 and beyond due to the number of new incoming cases and the 

limited number of cases being closed.34

NMB has taken steps to reduce the backlog. For example, in 2016, NMB 

closed 409 inactive rail arbitration cases from rail carriers and unions that 

were 3 or more years old. In addition, NMB proposed grievance mediation 

to rail unions in lieu of grievance arbitration to help expedite the resolution 

of disputes. As of August 2017 there were 323 rail arbitration cases 

undergoing grievance mediation. These actions have resulted in NMB 

addressing about 10 percent of pending rail arbitration cases that were 

open at the beginning of fiscal year 2017.

Nevertheless, NMB does not have a specific plan and related processes 

to address the backlog. However, identifying and assessing the risks 

associated with the backlog and developing a plan and associated 

processes to effectively manage are essential. Such identification, 

assessment, and management activities are key to implementing effective 

risk management, and to addressing the backlog.35

In developing such a plan, NMB has options that it could consider such as 

reevaluating its 60/120 rule;36 setting additional timeframes to its 

grievance arbitration process; modifying its AWS case management 

system to include reports that are more comprehensive; and developing 

methods to motivate carriers, unions, and arbitrators to effective and 

timely resolution of rail grievance arbitration cases.

 34 National Mediation Board, Fiscal Year 2017 Congressional Budget Submission

(Washington, D.C.: Feb.9, 2016).

35 According to federal internal control standards, an agency should assess the risks as it 

seeks to achieve its objectives. This type of assessment provides the basis for developing 

appropriate risk responses that an agency can use to manage its outcomes. 

GAO-14-704G.

36 According to an NMB official, NMB’s 60/120 rule requires arbitrators to act by issuing a 

ruling or setting a date for a hearing within 60 days of case assignment and once a 

hearing date is set, it must be conducted within 120 days of case assignment.
Page 18 GAO-18-301 National Mediation Board

All executive branch employees are required to comply with regulations 

published by the Office of Government Ethics37 (OGE) on standards of 

ethical conduct.38 OGE’s regulations on the standards of ethical conduct 

for employees of the executive branch state that an employee may not 

use their public office for private gain.39 NMB officials said that the agency 

does not have a stand-alone ethics policy for its employees, but follows 

OGE guidelines, including requiring employees to complete annual ethics 

training, and documenting attendance to ensure compliance. NMB 

officials said they also tell employees they should consult the agency 

ethics officer with any questions, and seek the officer’s approval before 

engaging in outside employment or speaking engagements.

Our investigation of a former NMB manager identified activities that were 

inconsistent with NMB policies. Among other things, NMB’s ethics officer 

expressed concern that the former manager may have represented 

himself as an NMB employee while conducting business for his privately 

owned companies. In addition, the officer stated that the manager may 

have claimed hours worked for the government inappropriately. Additional 

details on this investigative matter are not included in this report—we plan 

to refer the matter to the appropriate investigative authority.

 37 The Office of Government Ethics oversees the executive branch ethics program. 

38 5 C.F.R. Part 2635.

39 5 C.F.R. § 2635.702.

Better Oversight 

Could Assist NMB in 

Addressing Conflicts 

of Interest, Employee 

Concerns, Travel, and 

Telework 

Requirements

NMB Lacks Controls to 

Ensure Employees Follow 

Ethical Standards for 

Outside Employment and 

Activities to Avoid Conflicts 

of Interest
Page 19 GAO-18-301 National Mediation Board

An effective ethics program includes monitoring and auditing to detect 

potential improper conduct.40 Our prior work has found an effective 

internal control program includes activities designed to fulfill an 

organization’s responsibility,41 including ensuring that its employees are 

following the ethical standards for government employees. Although NMB 

is a small agency, it still needs to ensure that its staff are complying with 

standards of ethical conduct by implementing needed controls.

However, NMB officials told us the agency does not have any formal 

process for employees to report outside activities, such as employment or 

speaking engagements, other than activities for which employees receive 

income in annual financial disclosure forms.42 In addition, NMB does not 

systematically track or monitor when such activities have been approved 

for an employee by a manager or board member. Without such controls, 

employees may engage in inappropriate outside activities, which may 

violate ethical standards.

 40 United States Sentencing Commission, Guidelines Manual, Chap.8 (November 2016). 

Although the guidelines manual provides guidelines and policy statements for sentencing 

courts to use when sentencing offenders convicted of federal crimes, they also outline 

seven elements of an effective compliance and ethics program that may mitigate the 

punishment of an organization. The guidelines have provided a key source of guidance 

influencing the development of ethics programs. For example, see GAO-15-711, Military 

Personnel: Additional Steps Are Needed to Strengthen DOD’s Oversight of Ethics and 

Professionalism Issues (Washington, D.C.: Sept. 3, 2015).

41 GAO-15-704G.

42 For example, OGE Form 450 includes a requirement for executive branch employees to 

annually report all sources of salary, fees, commissions, and other earned income greater 

than $200.
Page 20 GAO-18-301 National Mediation Board

Surveyed NMB employees expressed concerns about promotions, 

training, leadership, and fear of reprisal at the agency. The 2017 Federal 

Employee Viewpoint Survey43 was sent to all 34 eligible employees44 at 

NMB, and 20 employees responded, but not necessarily to all survey 

questions. The results of the survey are not generalizable to all NMB 

employees, but do provide insights into areas of concern. Specifically, we 

identified 22 out of 71 statements where more than 30 percent of 

employees who responded answered “disagree” or “strongly disagree” as 

potential areas of concern.

Promotions: NMB employees expressed concerns with promotions at 

NMB. Specifically, 11 of 19 employees disagreed with the statement “Pay 

raises depend on how well employees perform their jobs.” Nearly half (8 

of 19) of NMB employees who responded to a survey question about the 

equity of promotions expressed concern that promotions may not be 

based on merit.

Resources and Training: About half (9 of 20) of NMB employees who 

responded to a survey question about resources expressed concern that 

they did not have sufficient resources to do their jobs, and nearly half (8 

of 20) were not satisfied with the training they received.

Leadership: About one-third (7 of 20) of NMB’s employees who 

responded to a survey question about agency leadership had a negative 

view of the policies and practices of senior management, and 8 of 20 

expressed dissatisfaction with the information they receive from 

management.

Fear of Reprisal: About one-third (7 of 20) of NMB’s employees who 

responded to a survey question about retaliation indicated that they did 

not feel they could report violations without fearing reprisal. An official 

with the NMB employee union told us that employees have anonymously 

or directly expressed a fear of retaliation from supervisors, and are 

reluctant to report issues to the union.

 43 OPM has been administering the Federal Employee Viewpoint Survey annually since 

2010. In 2017, more than 485,000 employees across 80 agencies responded to the 

survey. Full-time and part-time permanent, nonseasonal employees were eligible to 

participate in the self-administered Web survey.

44 Eligible employees include both full- and part-time permanent, nonpolitical employees 

who were in pay status as of the end of October of the previous year.

Surveyed NMB 

Employees Expressed 

Concerns about 

Promotions, Leadership, 

and Other Issues
Page 21 GAO-18-301 National Mediation Board

Research on both private- and public-sector organizations has found that 

increased levels of engagement—generally defined as the sense of 

purpose and commitment employees feel toward their employer and its 

mission—can lead to better organizational performance.45 Employee 

engagement is particularly important within federal agencies, where 

employees influence the well-being and safety of the public in myriad 

ways.

Although NMB’s strategic plan states that an internal climate assessment 

was to be conducted by the end of calendar year 2015 and every 3 years 

thereafter, NMB officials told us they have not conducted such an 

assessment and said that OPM had recently conducted a human capital 

assessment at NMB. OPM officials told us that the employees’ responses 

to the Federal Employee Viewpoint Survey indicate that there might be an 

underlying issue, but that this was not reflected in employee interviews, 

possibly due to fear of reprisal. The strategic plan also says that the 

agency will identify areas for improvement based on Federal Employee 

Viewpoint Survey results. However, officials said they have not taken 

actions in response to survey results because they believe the negative 

responses were attributable to a few employees. Without such an 

assessment, NMB employees may be less engaged, leading to 

absenteeism or turnover.

In addition to the concerns expressed by employees, our review found 

concerns with hiring and promotions at NMB. OPM maintains a personnel 

management oversight program to ensure that agencies’ hiring actions 

comply with merit system principles and statutes and regulations 

governing the appointment. OPM’s hiring handbook states that applicants 

who do not meet qualification requirements may not be considered. OPM 

also has an agreement with NMB to recruit and provide a list of qualified 

applicants for vacant positions.

Our review identified two NMB employees appointed to new positions for 

which they were deemed unqualified by OPM. After receiving OPM’s 

decision, the former NMB Chief of Staff requested that the Department of 

Interior (NMB’s human capital service provider) evaluate the candidates 

and appoint them to the positions. Interior officials told us that in 

 45 Office of Personnel Management, 2014 Federal Employee Viewpoint Survey Results: 

Employees Influencing Change: Government-wide Management Report (Washington, 

D.C.: 2014).

NMB Hiring Decisions 

Raise Questions
Page 22 GAO-18-301 National Mediation Board

conducting this evaluation, they reviewed the resumes and job 

descriptions, but they did not reach out to OPM regarding the previous 

decisions. They stated that they did not have any concerns about 

deeming the individuals qualified. Accordingly, the employees were 

subsequently appointed to the positions.

In addition, for one of the positions, Interior created the position 

description after receiving the applicant’s resume. OPM’s hiring 

guidance46 clearly stipulates an agency must conduct a job analysis and 

create the job description before reviewing applications. Agencies are 

prohibited from granting an individual an advantage not authorized in law 

in the application process, such as defining the requirements for a 

position to improve the prospects of any particular applicant.47

NMB’s travel and telework policies are, in some respects, inconsistent 

with federal laws and regulations, 48 and the policies are not consistently 

enforced. As a result, the agency could be at risk for waste or 

mismanagement.

Travel. The Federal Travel Regulation (FTR) issued by the General 

Services Administration enumerates the travel and relocation policy for all 

executive branch agency employees who travel on official government 

business. The FTR states that federal employees should use their 

government credit card unless it is impractical—for example, a vendor 

does not accept credit cards, or an alternative payment method is 

necessary in the interest of the agency.

In contrast, NMB’s travel policy states that “decisions to use cash or debit 

cards instead of the government credit card should be made by the 

traveler based on the situation,” which may not be in the interest of the 

agency. The policy also states that “an explanatory line on the travel 

voucher will serve as a justification for using payment methods other than 

 46 Office of Personnel Management, Delegated Examining Operations Handbook: A Guide 

for Federal Agency Examining Offices.

47 5 U.S.C. § 2302(b)(6).

48 See Telework Enhancement Act of 2010, Pub. L. No. 111-292, 124 Stat. 3165 (codified 

at 5 U.S.C. ch. 65) (providing guidance regarding telework); Federal Travel Regulation, 41 

C.F.R. chapters 300-304 (implementing statutory requirements and executive branch 

policies for travel by federal civilian employees and others authorized to travel at 

government expense).

NMB’s Travel and 

Telework Policies Are 

Inconsistent with Federal 

Requirements and Are Not 

Consistently Enforced
Page 23 GAO-18-301 National Mediation Board

the travel card.” Additionally, we identified at least one NMB employee 

who had permission to use his personal credit card on an ongoing basis 

for official travel.

NMB management has also granted NMB staff exceptions to the agency 

travel policy and the FTR. Generally, the FTR requires an employee to 

have authorization prior to incurring any travel expense, unless it is not 

practicable or possible. Prior authorization is always required for travel 

expenses related to attendance at a conference.49 However, NMB 

management has approved travel expenses after the fact rather than 

before travel, including for expenses related to an employee’s attendance 

at a conference. The FTR also requires employees to rent the least 

expensive compact car available, unless an exception for another class of 

vehicle is approved in advance, and generally prohibits them from 

purchasing pre-paid refueling options.50 Management has also made 

exceptions after travel has been completed that allowed the use of a 

luxury rental car and the pre-paid refueling option.

The person who approved the exceptions is no longer with the agency. 

Nevertheless, without greater oversight of employee travel expenses, 

NMB may be incurring needless additional expenses for employee travel.

Telework. The Telework Enhancement Act of 2010 requires, among 

other things, that federal agencies (1) provide telework training to each 

employee eligible to participate in telework,51 (2) ensure that the 

employee has completed the training before entering into a written 

telework agreement, and (3) require that the employee enter into a written 

telework agreement with an agency manager prior to teleworking.

52 In 

addition, OPM is required to submit an annual report that includes the 

number of employees who telework at each executive agency and how 

often they do so, and surveys executive agencies with an annual data call 

to help fulfill this requirement.

53 Telework training and documented 

telework agreements helps agencies ensure employees understand 

 49 41 C.F.R. § 301-2.1.

50 41 C.F.R. § 301-10.450(c), (d). Agencies should approve these exceptions on a limited 

basis and must indicate on the travel authorization the reason for the exception.

51 5 U.S.C. § 6503(a)(2).

52 5 U.S.C. § 6502(b)(2).

53 5 U.S.C. § 6506(b). See also, GAO-17-247.
Page 24 GAO-18-301 National Mediation Board

agency telework policies and that employee telework agreements meet 

agency business needs.

NMB’s telework program is not consistent with the requirements of the 

Telework Enhancement Act of 2010, and is also not consistently 

enforced. NMB’s telework policy, effective October 2015, does not 

mention employee telework training and management did not require 

employees to complete training before entering into a telework 

agreement, as required by federal law. In addition, management has 

allowed employees to telework without a written telework agreement, 

even though this requirement is specified in NMB’s telework policy.

A key element of a strong internal control system includes ongoing 

monitoring of the system as a part of the normal course of operations. 

GAO’s internal control standards54 state that management retains 

responsibility for monitoring the effectiveness of controls, and should use 

ongoing monitoring, separate evaluations, or a combination of the two to 

obtain reasonable assurance that the controls are effective. Tracking 

when exceptions are approved for travel and telework policies would help 

ensure that NMB policies are being applied fairly across the agency and 

ensure compliance with federal regulations.

Our biennial reviews of NMB have identified a number of management 

challenges, yet there is no IG to conduct ongoing reviews of NMB’s 

operations to identify issues or respond to employee concerns as they 

surface. IGs are responsible for conducting audits and investigations 

relating to agency programs and operations, and recommend policies and

conduct other activities to promote economy, efficiency, and effectiveness 

and prevent and detect fraud and abuse. IG offices play a key role in 

federal agency oversight by enhancing government accountability and 

protecting the government’s resources. This includes a strong leadership 

role in recommending improvements to the effectiveness and efficiency of 

government offices and programs at a time when they are needed most. 

Importantly, IGs also keep the agency head and the Congress fully and 

currently informed about problems and deficiencies relating to the 

administration of agency programs and operations.

 54GAO-14-704G.

Lack of an IG Leaves 

NMB Vulnerable to 

Potential Mismanagement, 

Fraud, Waste, and Abuse
Page 25 GAO-18-301 National Mediation Board

We previously recommended in 2013 that Congress consider authorizing 

an appropriate federal agency’s Office of Inspector General to provide 

such oversight. There are a number of examples where IGs in federal 

departments and agencies with relatively large budgets currently provide 

oversight of federal entities with relatively small budgets. To illustrate, the 

Department of State IG has oversight authority for the Broadcasting 

Board of Governors.55 NMB officials recently established an agreement 

with the National Labor Relations Board (NLRB) IG to operate a hotline 

for employees to report issues. The NLRB IG said that it will operate the 

hotline from its own resources, since the cost would be minimal. NMB 

officials stated that the NLRB IG seemed like a logical choice, since the 

two agencies have similar missions and have worked together in the 

past.56

NMB officials also told us that they are considering establishing additional 

agreements with the NLRB IG to conduct further investigative work, such 

as issues identified from the employee hotline and our investigation of a 

former manager. The NLRB IG stated the agency would have to enter 

into a formal Memorandum of Understanding with NMB to conduct 

investigative work. Because this work would be conducted on a 

reimbursable basis, the NLRB IG stated that NMB would have to request 

authority from OMB. While these actions are helpful, we continue to 

believe that Congress should consider authorizing an appropriate federal 

agency’s Office of Inspector General to provide oversight for NMB.57

 55 United States International Broadcasting Act of 1994, Pub. L. No. 103-236, tit.III, § 

310A, 108 Stat. 432 (1994), as added by National Defense Authorization Act for Fiscal 

Year 2017, div. A, § 1288(7), 130 Stat. 2000, 2553 (2016) (codified as amended at 22 

U.S.C. § 6209a). A similar provision was previously located in section 304(a)(3) of the 

United States International Broadcasting Act of 1994, 22 U.S.C. § 6203(a)(3).

56 The NLRB is an independent federal agency enforcing the National Labor Relations 

Act, which guarantees the right of most private sector employees to organize, to engage in 

group efforts to improve their wages and working conditions, to determine whether to have 

unions as their bargaining representative, to engage in collective bargaining, and to refrain 

from any of these activities.

57GAO-14-5. Additionally, in a 2014 testimony, we noted concerns about creating and 

maintaining IG offices in smaller federal agencies where it may not be cost-effective to 

obtain the skills and expertise necessary to provide adequate oversight. However, we also 

observed that specific small agencies, on a case-by-case basis, could benefit by obtaining 

IG oversight from another agency’s IG office where the missions of the two agencies are 

somewhat similar. GAO, Inspectors General: Oversight of Small Federal Agencies and the 

Role of the Inspectors General, GAO-14-503T (Washington, D.C: Apr. 10, 2014).
Page 26 GAO-18-301 National Mediation Board

Ongoing, regular oversight by a cognizant IG could help assure that NMB 

policies comply with federal regulations, and that exceptions to policies 

are appropriate, properly documented, and tracked. This could, for 

instance, include reviewing exceptions granted to agency-wide telework 

and travel policies to ensure compliance. An IG would also allow 

employees an ongoing means to report issues of concern without fearing 

reprisal, and ensure that employee concerns are addressed timely. For 

example, this could provide employees an opportunity to report concerns 

over agency hiring practices and therefore minimize the declines in 

employee morale and engagement.

NMB has implemented most of our prior recommendations from our past 

reviews; however, the agency still needs to take action to implement 

recommendations concerning information security, information privacy, 

and its rail arbitration workload. Without fully implementing these 

recommendations, NMB is missing opportunities to improve performance 

and mitigate risks. In addition, although the agency has taken some steps 

to address an increase in the number of rail arbitration cases, NMB does 

not have a plan to address its growing backlog. Additionally, NMB lacks 

controls to ensure that employee requests to engage in outside 

employment and activities are approved and tracked to prevent violations 

of ethics rules including standards of conduct. As a result, NMB cannot 

ensure that its employees are complying with ethics requirements. 

Further, while employees have expressed concerns in several areas on 

an annual survey, NMB has not fulfilled its commitment to conducting a 

climate assessment or taking actions based on survey results. NMB also 

lacks appropriate internal controls to ensure that travel and telework 

policies are consistently applied and enforced.

As our work continues to demonstrate, NMB faces management 

challenges that could be partly addressed by ongoing, regular oversight 

by an IG. While NMB has arranged for some oversight by the NLRB IG, 

such limited assistance cannot provide the type of ongoing, regular 

oversight needed to identify and help NMB to address issues in a timely 

manner. As such, we continue to believe that Congress should consider 

authorizing an appropriate federal agency’s IG to provide oversight for 

NMB.

Conclusions
Page 27 GAO-18-301 National Mediation Board

We recommend that the Chairman of the National Mediation Board take 

the following five actions:

1. Develop and execute a plan to address the rail arbitration case

backlog. (Recommendation 1)

2. Develop and implement policies for approval and monitoring of

employee requests for outside employment and other outside

activities to prevent violations of ethics rules, consistent with

Office of Government Ethics standards of conduct and federal

internal control standards. (Recommendation 2)

3. Complete and take actions on the organizational climate

assessment and survey results as a means to address employee

concerns. (Recommendation 3)

4. Revise NMB’s travel policy and develop appropriate internal

controls to ensure compliance with federal requirements for travel.

(Recommendation 4)

5. Revise NMB’s telework policy and develop appropriate internal

controls to ensure compliance with federal requirements for

telework. (Recommendation 5)

We provided a draft of this report to the National Mediation Board (NMB) 

for comment. The agency provided written comments, which are 

reproduced in their entirety in appendix III. NMB agreed with our 

recommendations, and stated that it recognizes that additional actions 

and controls are needed to address certain management challenges. The 

following highlights NMB’s response to our recommendations. 

Recommendation 1: NMB stated that it is examining the growing 

arbitration backlog and investigating steps the Board may take to reduce 

it. In particular, NMB stated that it is discussing proposals with 

stakeholders and formulating a plan to reduce the backlog in 2018.

Recommendation 2: NMB stated that it is concerned about GAO’s

investigative findings of potential conflicts of interest activities involving a

former manager. NMB stated that it has taken significant steps to

investigate this matter and has established new controls in order to 

prevent this type of activity in the future, including establishing a 

relationship with the IG of the National Labor Relations Board to operate 

a telephone hotline and email address for the reporting of suspected 

fraud, waste and abuse at NMB. 

Recommendations for 

Executive Action

Agency Comments 

and Our Evaluation
Page 28 GAO-18-301 National Mediation Board

Recommendation 3: NMB stated that the Board is concerned that the 

2017 Federal Employee Viewpoint Survey revealed a level of 

dissatisfaction among NMB employees. NMB stated that it plans to 

conduct an Internal Climate Assessment in 2018, and looks forward to the 

opportunity to better understand and address any employee concerns.

Recommendation 4: NMB stated that it is in the process of reviewing the 

current travel policy, and will revise the policy to be in compliance with 

federal travel regulations as necessary.

Recommendation 5: NMB stated that it will revise NMB’s telework policy 

and strengthen internal controls, as necessary. 

NMB also said that it is taking actions to fully implement the remaining 

recommendations from our 2013 and 2016 reports. 

• For our recommendation on collecting and analyzing data on the 

types of grievances filed for rail arbitration cases, NMB stated that 

it has authorized a plan to designate all existing and new cases 

filed with the National Rail Adjustment Board by March 2018. 

• For our recommendation on information security, NMB stated that 

it will continue to improve its cyber-security practices and has 

added extending coverage to third party provider applications to 

its security plan. NMB also stated that it would re-write the NMB 

Enterprise Cloud Information System Security Plan to address 

required updates with a planned completion in April of 2018. 

• For our recommendation on information privacy, NMB stated that 

it will perform privacy impact assessments as part of the new 

Information System Security Plan by April 2018. 
Page 29 GAO-18-301 National Mediation Board

We are sending copies of this report to the Chairman of the National 

Mediation Board, appropriate congressional committees, and other 

interested parties. In addition, the report will be available at no charge on 

the GAO website at http://www.gao.gov. 

If you or your staff have questions about this report, please contact me on 

(202) 512-7215 or at brownbarnesc@gao.gov. Contact points for our 

Offices of Congressional Relations and Public Affairs may be found of the 

last page of this report. Key contributors to this report are listed in 

appendix IV.

Cindy S. Brown Barnes

Director

Education, Workforce, and Income Security
Appendix I: National Mediation Board 

Documents Compared with Statutory and 

Policy Requirements

Page 30 GAO-18-301 National Mediation Board

Table 3: GAO Comparison of Key National Mediation Board (NMB) Documents with Federal Laws, Guidance, and Leading 

Practices

Management 

area

Key NMB documents 

reviewed

Federal laws and guidance and 

previous GAO work 

Strategic plan National Mediation Board Strategic Plan, Fiscal Year 

2014 - Fiscal Year 2019 As Amended, Fiscal Year 2017 

GPRA Modernization Act of 2010 

(GPRAMA)a

Office of Management and Budget 

(OMB) Circular No. A-11, Part 6 (July 

2016)b

Standards for Internal Control in the 

Federal Governmentc

Performance goals National Mediation Board Strategic Plan, Fiscal Year 

2014 - Fiscal Year 2019 As Amended, Fiscal Year 2017

Fiscal Year 2017 Congressional Budget Submission 

GPRAMAa

OMB’s Circular No. A-11, Part 6 (July 

2016)b

GAO prior work on performance 

measurementd

Workforce Plan National Mediation Board Workforce and Succession 

Plan October 2014

National Mediation Board Strategic Plan, Fiscal Year 

2014 - Fiscal Year 2019 As Amended, Fiscal Year 2017

GAO prior work on workforce planninge

Audit findings and 

recommendations 

National Mediation Board Policy #5100 Audit 

Coordination and Follow-up

Fiscal Year 2015, and 2016 Final Independent Auditors’ 

Reports 

OMB’s Circular No. A-123 (July 15, 

2016)f

OMB’s Circular No. A-50 Revised 

(September 29, 1982)g

Standards for Internal Control in the 

Federal Governmentc

Procurement National Mediation Board Policy #5150 Purchase Card 

Manual (October 5, 2017)

National Mediation Board Policy #5200 Procurement 

Operating Manual (October 5, 2017)

Interagency Agreement Between Department of the 

Treasury Bureau of the Fiscal Service and National 

Mediation Board (Fiscal Year 2017)

GAO’s Framework for Assessing the 

Acquisition Function at Federal 

Agenciesh

Federal Acquisition Regulationi

Standards for Internal Control in the 

Federal Governmentc

Appendix I: National Mediation Board 

Documents Compared with Statutory and 

Policy Requirements
Appendix I: National Mediation Board 

Documents Compared with Statutory and 

Policy Requirements

Page 31 GAO-18-301 National Mediation Board

Management 

area

Key NMB documents 

reviewed

Federal laws and guidance and 

previous GAO work 

Information security 

and privacy

NMB Information Program Plan (April 15, 2016)

NMB 2017 Information System Risk Assessment 

(October 17, 2017)

System Security Plan National Mediation Board 

Enterprise Cloud (March 16, 2016)

Security Assessment and Authorization Package for 

Enterprise Cloud (May 9,2016)

Information Technology Security Education, Awareness 

and Training Standard and Implementation Guidelines 

(April 15, 2016)

FY 2017 Information Technology Training Plan (April 6, 

2017)

Security Awareness Training Certificates and Sign-in 

Sheets (2017)

NMB emails and checklists related to security 

awareness training completion

Plan of Actions and Milestones (September 1, 2017)

National Mediation Board Policy #6450 Continuity of 

Operations (COOP) Plan (March 3, 2016)

NMB Enterprise Cloud Standard Operating Procedures 

for Admin (June 7, 2016 )

NMB emails related to cyber incidents and protection of 

personally identifiable information

National Mediation Board Policy #8200 Privacy Policy 

(October 5, 2017)

2017 Security Assessment for the National Mediation 

Board Enterprise Cloud (November 6, 2017)

Federal Information Security 

Modernization Act of 2014 (FISMA)j

The Privacy Act of 1974 (As Amended)k

E-Government Act of 2002l

National Institute of Standards and 

Technology, SP 800-53 Revision 4, 

Security and Privacy Controls for 

Federal Information Systems and 

Organizationsm

OMB Memos M-14-04,OMB M-04-25, 

and OMB M-16-24n

Rail Grievance 

Arbitration 

NMB’s rail grievance arbitration data for fiscal years 

2011 - 2017

NMB’s arbitrator caseload reports, and arbitration case 

types 

Standards for Internal Control in the 

Federal Governmentc

GAO prior work on performance 

measurementd
Appendix I: National Mediation Board 

Documents Compared with Statutory and 

Policy Requirements

Page 32 GAO-18-301 National Mediation Board

Management 

area

Key NMB documents 

reviewed

Federal laws and guidance and 

previous GAO work 

Telework National Mediation Board Policy #2001 Telecommuting

Email correspondences relating to telework

Telework Enhancement Act of 2010o

Travel National Mediation Board Policy #7000 Travel Policy

Contractor Travel Reimbursement Guidelines

Memos and email correspondences relating to travel

Federal travel regulation found at 41 

C.F.R. § 300-304

Source: GAO analysis of NMB and other agencies documents. | GAO-18-301

a

GPRA stands for the Government Performance and Results Act, Pub. L. No. 111-352, 124 Stat. 

3866 (2011).

b

Office of Management and Budget, Preparation and Submission of Strategic Plans, Annual 

Performance Plans, Performance Reviews, and Annual Performance Reports, Circular No. A-11, Part 

6 (July 2016).

c

GAO, Standards for Internal Control in the Federal Government, GAO14-704G (Washington, D.C.: 

September 2014).

d

GAO, Managing for Results: Measuring Program Results that Are Under Limited Federal Control, 

GAO/GGD-99-16 (Washington, D.C.: Dec. 11, 1998).

e

GAO, Human Capital: Key Principles for Effective Strategic Workforce Planning, GAO-04-39 

(Washington, D.C.: Dec.11, 2003).

f

Office of Management and Budget, Management’s Responsibility for Enterprise Risk Management 

and Internal Control, Circular A-123 (Revised July 15, 2016).

g

Office of Management and Budget, Audit Follow Up, Circular No. A-50 Revised (September 29, 

1982).

h

GAO, Framework for Assessing the Acquisition Function at Federal Agencies, GAO-05-218G 

(Washington, D.C.: September 2005).

i

Federal Acquisition Regulation, https://www.acquisition.gov/.

j

Information security program and evaluation requirements for federal agencies were established by 

the Federal Information Security Management Act of 2002 (FISMA 2002). FISMA 2002 was largely 

superseded by the Federal Information Security Modernization Act of 2014 (FISMA 2014). As used in 

this report, FISMA refers both to FISMA 2014 and to those provisions of FISMA 2002 that were either 

incorporated into FISMA 2014 or were unchanged and continue in full force and effect. 

k

The Privacy Act of 1974, 5 U.S.C. § 552a.

l

E-Government Act of 2002 Pub. L. No. 107-347, § 208, 116 Stat. 2899, 2921.

mNational Institute of Standards and Technology, Security and Privacy Controls for Federal 

Information Systems and Organizations, SP-800-53, Revision 4 (Gaithersburg, MD: April 2013).

n

Office of Management and Budget, Memo OMB M-04-25, FY 2004 Reporting Instructions for the 

Federal Information Security Management Act; M-14-04, Fiscal Year 2013 Reporting Instructions for 

the Federal Information Security Management Act and Agency Privacy Management; and OMB M-16-

24, Role and Designation of Senior Agency Officials for Privacy.

o

Telework Enhancement Act of 2010, Pub. L. No. 111-292 124 Stat. 3165 (primarily codified at 

chapter 65 part III of title 5 of the United States Code).
Appendix II: Status of National Mediation 

Board Practices in Information Security and 

Privacy

Page 33 GAO-18-301 National Mediation Board

Table 4: Extent to Which the National Mediation Board (NMB) Is Following Key Practices for Information Security and Privacy

Practice

Extent NMB 

is followinga Example of NMB’s current status

Information security practicesb

Conduct periodic risk 

assessments that consider 

cyber threats and 

vulnerabilities.

Partially 

following

NMB had the Department of the Treasury’s Bureau of the Fiscal Service conduct a 

security assessment of the agency’s enterprise networkc ending in May 9, 2016. In 

addition, the agency’s chief information security officer documented a security 

assessment of the network signed November 6, 2017. However, NMB has not completed 

assessments for its other systems. NMB also completed an information system risk 

assessment dated October 2017 that identifies and describes threats. The agency noted 

the scope of the assessment did not include the Office of Administration processes that 

use information systems provided and administered by other agencies. 

Develop and implement 

risk-based policies and 

procedures to ensure 

compliance with 

applicable standards and 

guidance including system 

configuration 

requirements.

Partially 

following

NMB has developed an information security policy through its Information Program Plan 

dated April 15, 2016, that includes risk assessment requirements. However, NMB has 

not developed agency-wide policies and procedures on the oversight of its third-party 

providers, including third-party personnel security.

Develop system security 

plans that cover networks, 

facilities, and systems or 

groups of systems, as 

appropriate.

Partially 

following

NMB has developed, documented, and approved a system security plan for its enterprise 

network dated March 16, 2016, and last reviewed the plan on January 10, 2018. 

However, the plan did not always include implementation details spanning operational 

controls and a rationale on why controls were not applicable as recommended by the 

National Institute of Standards and Technology guidance. In addition, NMB drafted 

system security plans for other systems, but these plans have not been completed. NMB 

officials stated that the agency plans to complete security plans for systems that are not 

obsolete when the agency updates the plan for the enterprise network in July 2018. 

Provide security 

awareness training for 

agency 

employees and 

contractors.

Partially 

following

NMB required that employees complete the Department of Defense cybersecurity 

awareness challenge by September 29, 2017, and monitored the completion of this 

training through a checklist of individual names and collection of training completion 

certificates. Of the 38 individuals monitored, 6 did not provide evidence of completing the 

training by the September 29, 2017, deadline. Of the 6 individuals, 4 completed the 

training and the agency reported 1 as being retired as of October 17, 2017. NMB also 

offered security awareness training for its enterprise network and collected sign-in sheets 

to record training completion. However, the agency did not have an adequate tracking 

mechanism in place to ensure all of its employees completed the training for its 

enterprise network.

Conduct periodic 

management testing and 

evaluation of all major 

systems at least annually.

Partially 

following

NMB last had its enterprise network independently tested by the Department of the 

Treasury’s Bureau of the Fiscal Service Division of Security Services in May 2016. In 

addition, the agency’s chief information security officer documented a security 

assessment for the network signed November 6, 2017. However, the agency did not 

provide documentation illustrating that it tested the network and its other systems in 

2017, and stated it did not assess third-party providers’ implementation of security 

requirements.

Appendix II: Status of National Mediation 

Board Practices in Information Security and 

Privacy
Appendix II: Status of National Mediation 

Board Practices in Information Security and 

Privacy

Page 34 GAO-18-301 National Mediation Board

Practice

Extent NMB 

is followinga Example of NMB’s current status

Information security practicesb

Establish a remedial action 

process to address identified 

information security control 

weaknesses.

Partially 

following

NMB has documented a remedial action process and plan of actions for its 

enterprise network. However, the plan of actions as of September 1, 2017, did 

not fully meet the Office of Management and Budget (OMB) requirements to 

include clearly identified points of contact, weaknesses, and changes to 

milestones. In addition, NMB’s plan of actions did not include the agency’s 

weakness of not having privacy impact assessments. Further, NMB’s plans of 

action included past due dates, and NMB did not provide updated completion 

dates. 

Establish security-incident 

procedures for detecting, 

reporting, and responding to 

incidents.

Partially 

following

NMB developed a standard operating procedure dated June 2016 that spans 

handling cyber incidents. However, the procedure did not include required 

actions specified by the Federal Information Security Modernization Act of 2014, 

such as notifying and consulting with the federal information security incident 

center, notifying law enforcement agencies, and relevant offices of Inspector 

General and General Counsel.

Establish and maintain up-todate continuity of operations 

plans and procedures and 

procedures for information 

systems.

Partially 

following

NMB documented a continuity of operations plan policy in March 2016. 

However, the agency has not documented contingency plans for its systems. 

NMB explained that the agency’s enterprise cloud does not depend on any of 

the agency’s hardware or physical assets. Therefore, NMB officials stated that 

as long as the cloud service provider product and the Internet are functioning, 

the agency does not need a contingency plan. However, the agency plans to 

have a contingency plan for its enterprise cloud in October 2018 to explore 

different scenarios.

Information privacy practicesd

Assign agency official for 

privacy

Following NMB designated its privacy officer through its Information Program Plan dated 

April 15, 2016. The agency stated that either the privacy officer or the Chief of 

Staff can be considered the senior official with overall agency-wide responsibility 

for information privacy issues.

Establish policies and 

procedures for privacy 

protections

Following NMB established an October 5, 2017, privacy policy that contains procedures for 

protecting sensitive information, including personally identifiable information.
Appendix II: Status of National Mediation 

Board Practices in Information Security and 

Privacy

Page 35 GAO-18-301 National Mediation Board

Practice

Extent NMB 

is followinga Example of NMB’s current status

Information privacy practicesd

Conduct privacy impact 

assessments for systems 

containing personally 

identifiable information.e

Minimally 

following

NMB has not conducted privacy impact assessments for its systems and those 

of third-party providers containing the agency’s personally identifiable 

information.

Issue system of records 

notice.f Minimally following

NMB did not issue any system of records notices for any of its systems.

Source: GAO analysis of NMB documents and interviews with NMB officials. | GAO-18-301

a

We assessed whether NMB is following key practices—taking appropriate actions and has a formal 

plan, policy, or other document; partially following—taking some actions but does not have a formal 

plan or policy and/or some additional steps must be taken to consider this practice implemented; or 

minimally following—taking little or no action to address this particular practice.

b

We identified key information security practices from the Federal Information Security Modernization 

Act of 2014; NIST Special Publication 800-53 Revision 4 Security and Privacy Controls for Federal 

Information Systems and Organizations, April 2013; and OMB guidance.

c

The enterprise network stands for National Mediation Board’s Enterprise Cloud (NMBEC) system.

d

We identified key privacy practices from the Privacy Act of 1974, the E-Government Act of 2002, 

OMB guidance, and the National Institute of Standards and Technology Special Publication 800-53, 

Revision 4.

e

A privacy impact assessment is an analysis of how personal information is collected, stored, shared, 

and managed in a federal system.

f

A system of records is a collection of information about individuals under control of an agency from 

which information is retrieved by the name of an individual or other identifier. System of records 

notices are posted to agency websites to identify, among other things, the purpose of and individuals 

covered by information in a system of records, the category of records that are maintained about the 

individuals, and how the information is shared and routinely used by the agency.
Appendix III: Comments from the National 

Mediation Board

Page 36 GAO-18-301 National Mediation Board

Appendix III: Comments from the National 

Mediation Board
Appendix III: Comments from the National 

Mediation Board

Page 37 GAO-18-301 National Mediation Board
Appendix III: Comments from the National 

Mediation Board

Page 38 GAO-18-301 National Mediation Board
Appendix III: Comments from the National 

Mediation Board

Page 39 GAO-18-301 National Mediation Board
Appendix III: Comments from the National 

Mediation Board

Page 40 GAO-18-301 National Mediation Board
Appendix III: Comments from the National 

Mediation Board

Page 41 GAO-18-301 National Mediation Board
Appendix IV: GAO Contact and Staff 

Acknowledgments

Page 42 GAO-18-301 National Mediation Board

Cindy Brown Barnes, (202) 512-7215 or brownbarnesc@gao.gov

In addition to the contact named above, Mary Crenshaw (Assistant 

Director), Amy Sweet (Analyst-In-Charge), Chelsa Gurkin (Acting 

Director), and John Lack made significant contributions to this report. Also 

contributing to this report were Shirley Abel, Marie Ahearn, Susan 

Aschoff, Cheryl Bassett, James Bennett, Marcus Corbin, Larry Crosland, 

Karin Fangman, Robert Graves, Thomas Gilbert, Nisha Hazra, Latoya 

King, Jason Kirwan, Kendrick Johnson, Robert Letzler, Barbara Lewis, 

Benjamin Licht, Sheila McCoy, Wayne McElrath, Monica Perez Nelson, 

Dana Pon, Paula Rascona, James Rebbe, Constance Satchell, Cynthia 

Saunders, Monica Savoy, Almeta Spencer, Sabrina Streagle, Adam 

Vodraska, Andrew Von Ah, Shaunyce Wallace, Candice Wright, and 

Helina Wong.

Appendix IV: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(101650)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (https://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to https://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, https://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at https://www.gao.gov.

Contact:

Website: https://www.gao.gov/fraudnet/fraudnet.htm

Automated answering system: (800) 424-5454 or (202) 512-7470

Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.