HIGH-RISK SERIES 

Substantial Efforts 

Needed to Achieve 

Greater Progress on 

High-Risk Areas

Report to Congressional Committees

March 2019

GAO-19-157SP

United States Government Accountability Office
United States Government Accountability Office

 

Highlights of GAO-19-157SP, a report to 

congressional committees

March 2019 

HIGH-RISK SERIES

Substantial Efforts Needed to Achieve Greater 

Progress on High-Risk Areas

What GAO Found

The ratings for more than half of the 35 areas on the 2019 High-Risk List remain 

largely unchanged. Since GAO’s last update in 2017, seven areas improved, 

three regressed, and two showed mixed progress by improving in some criteria 

but declining in others. Where there has been improvement in high-risk areas, 

congressional actions have been critical in spurring progress in addition to 

actions by executive agencies. 

GAO is removing two of the seven areas with improved ratings from the HighRisk List because they met all of GAO’s five criteria for removal. The first area, 

Department of Defense (DOD) Supply Chain Management, made progress on 

seven actions and outcomes related to monitoring and demonstrated progress 

that GAO recommended for improving supply chain management. For example, 

DOD improved the visibility of physical inventories, receipt processing, cargo 

tracking, and unit moves. Improvements in asset visibility have saved millions of 

dollars and allow DOD to better meet mission needs by providing assets where 

and when needed.

The second area, Mitigating Gaps in Weather Satellite Data, made significant

progress in establishing and implementing plans to mitigate potential gaps. For 

example, the National Oceanic and Atmospheric Administration successfully 

launched a satellite, now called NOAA-20, in November 2017. NOAA-20 is 

operational and provides advanced weather data and forecasts. DOD developed 

plans and has taken actions to address gaps in weather data through its plans to 

launch the Weather System Follow-on–Microwave satellite in 2022. 

There are two new areas on the High-Risk List since 2017. Added in 2018 

outside of GAO’s biennial high-risk update cycle, the Government-Wide 

Personnel Security Clearance Process faces significant challenges related to 

processing clearances in a timely fashion, measuring investigation quality, and 

ensuring information technology security. The second area, added in 2019, is 

Department of Veterans Affairs (VA) Acquisition Management. VA has one of the 

most significant acquisition functions in the federal government, both in 

obligations and number of contract actions. GAO identified seven contracting

challenges for VA, such as outdated acquisition regulations and policies, lack of 

an effective medical supplies procurement strategy, and inadequate acquisition 

training. 

Overall, 24 high-risk areas have either met or partially met all five criteria for 

removal from the list; 20 of these areas fully met at least one criterion. Ten highrisk areas have neither met nor partially met one or more criteria.

While progress is needed across all high-risk areas, GAO has identified nine that 

need especially focused executive and congressional attention, including 

Ensuring the Cybersecurity of the Nation, Resolving the Federal Role in Housing 

Finance, addressing Pension Benefit Guaranty Corporation Insurance Programs, 

Managing Risks and Improving VA Health Care, and ensuring an effective 2020 

Decennial Census. Beyond these specific areas, focused attention is needed to 

address mission-critical skills gaps in 16 high-risk areas, confront three high-risk 

areas concerning health care and tax law enforcement that include billions of 

dollars in improper payments each year, and focus on a yawning tax gap. 

View GAO-19-157SP. For more information, 

contact J. Christopher Mihm at (202) 512-6806 

or mihmj@gao.gov. 

Why GAO Did This Study

The federal government is one of the 

world’s largest and most complex 

entities; about $4.1 trillion in outlays in 

fiscal year 2018 funded a broad array 

of programs and operations. GAO’s 

high-risk program identifies 

government operations with

vulnerabilities to fraud, waste, abuse, 

and mismanagement, or in need of

transformation to address economy, 

efficiency, or effectiveness challenges.

This biennial update describes the 

status of high-risk areas, outlines 

actions that are still needed to assure 

further progress, and identifies two

new high-risk areas needing attention 

by the executive branch and Congress. 

Solutions to high-risk problems save 

billions of dollars, improve service to 

the public, and would strengthen 

government performance and 

accountability.

GAO uses five criteria to assess 

progress in addressing high-risk areas: 

(1) leadership commitment, (2) agency 

capacity, (3) an action plan, (4) 

monitoring efforts, and (5) 

demonstrated progress.

What GAO Recommends

This report describes GAO’s views on 

progress made and what remains to be 

done to bring about lasting solutions 

for each high-risk area. Substantial 

efforts are needed by the executive 

branch to achieve progress on highrisk areas. Addressing GAO’s 

hundreds of open recommendations 

across the high-risk areas and 

continued congressional oversight and 

action are essential to achieving 

greater progress.
GAO’s 2019 High-Risk List

Strengthening the Foundation for Efficiency and Effectiveness

Strategic Human Capital Management

Managing Federal Real Property

Funding the Nation’s Surface Transportation Systema

Modernizing the U.S. Financial Regulatory Systema

Resolving the Federal Role in Housing Financea

USPS Financial Viabilitya 

Management of Federal Oil and Gas Resources

Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risksa

Improving the Management of IT Acquisitions and Operations

Improving Federal Management of Programs That Serve Tribes and Their Membersa

2020 Decennial Censusa

U.S. Government Environmental Liabilitya

Transforming DOD Program Management

DOD Weapon Systems Acquisition

DOD Financial Management

DOD Business Systems Modernization

DOD Support Infrastructure Managementa

DOD Approach to Business Transformation 

Ensuring Public Safety and Security

Government-wide Personnel Security Clearance Process (new)a

Ensuring the Cybersecurity of the Nationa

Strengthening Department of Homeland Security Management Functions

Ensuring the Effective Protection of Technologies Critical to U.S. National Security Interestsa

Improving Federal Oversight of Food Safetya 

Protecting Public Health through Enhanced Oversight of Medical Products

Transforming EPA’s Processes for Assessing and Controlling Toxic Chemicalsa

Managing Federal Contracting More Effectively

VA Acquisition Management (new)

DOE’s Contract Management for the National Nuclear Security Administration and Office of Environmental Managementa

NASA Acquisition Managementa

DOD Contract Management

Assessing the Efficiency and Effectiveness of Tax Law Administration

Enforcement of Tax Lawsa

Modernizing and Safeguarding Insurance and Benefit Programs

Medicare Program & Improper Paymentsa

Strengthening Medicaid Program Integritya

Improving and Modernizing Federal Disability Programs

Pension Benefit Guaranty Corporation Insurance Programsa

National Flood Insurance Programa

Managing Risks and Improving VA Health Carea

 

Source: GAO. | GAO-19-157SP

a

Legislation is likely to be necessary in order to effectively address this area. 
Page i GAO-19-157SP High-Risk Series 

Letter 1

How We Identify and Rate High-Risk Areas 2

Changes to the 2019 High-Risk List 4

DOD Supply Chain Management 6

Mitigating Gaps in Weather Satellite Data 13

High-Risk Areas That Made Progress 25

High-Risk Areas Needing Significant Attention 45

Appendix I Background 69

Appendix II Overview for Each High-Risk Area 74

Strategic Human Capital Management 75

Managing Federal Real Property 78

Funding the Nation’s Surface Transportation System 86

Modernizing the U.S. Financial Regulatory System 91

Resolving the Federal Role in Housing Finance 95

USPS Financial Viability 99

Management of Federal Oil and Gas Resources 103

Limiting the Federal Government’s Fiscal Exposure by Better 

Managing Climate Change Risks 110

Improving the Management of IT Acquisitions and Operations 123

Improving Federal Management of Programs that Serve Tribes 

and Their Members 128

2020 Decennial Census 134

U.S. Government’s Environmental Liability 138

DOD Weapon Systems Acquisition 143

DOD Financial Management 147

DOD Business Systems Modernization 152

DOD Support Infrastructure Management 158

DOD Approach to Business Transformation 163

Government-wide Personnel Security Clearance Process 170

Ensuring the Cybersecurity of the Nation 178

Strengthening Department of Homeland Security Management 

Functions 185

Ensuring the Effective Protection of Technologies Critical to U.S. 

National Security Interests 190

Improving Federal Oversight of Food Safety 195

Protecting Public Health through Enhanced Oversight of Medical 

Products 198

Contents
Page ii GAO-19-157SP High-Risk Series 

Transforming EPA’s Process for Assessing and Controlling Toxic 

Chemicals 204

VA Acquisition Management 210

DOE’s Contract and Project Management for the National Nuclear 

Security Administration and Office of Environmental 

Management 217

NASA Acquisition Management 222

DOD Contract Management 227

Enforcement of Tax Laws 235

Medicare Program & Improper Payments 241

Strengthening Medicaid Program Integrity 250

Improving and Modernizing Federal Disability Programs 259

Pension Benefit Guaranty Corporation Insurance Programs 267

National Flood Insurance Program 272

Managing Risks and Improving VA Health Care 275

Appendix III GAO’s 2019 High-Risk List 283

GAO Related Products 285

Tables

Table 1: Status of Asset Visibility Remaining Action Items 

Required to Remove Supply Chain Management from 

GAO’s High-Risk List 8

Table 2: Status of Materiel Distribution Remaining Action Items 

Required to Remove Supply Chain Management from 

GAO’s High-Risk List 10

Table 3: 2017 High-Risk Areas Rated Against Five Criteria for 

Removal from GAO’s High-Risk List 25

Table 4: 2019 High-Risk Area Ratings on Five Criteria for 

Removal from GAO’s High-Risk List 28

Table 5: Examples of Congressional Actions Taken on High-Risk 

Areas 35

Table 6: Examples of GAO High-Risk Area Recommendations 

Leading to Financial Benefits 43

Table 7: Skills Gaps Related to High-Risk Areas 60

Table 8: Changes to the High-Risk List, 1990-2019 69
Page iii GAO-19-157SP High-Risk Series 

Table 9: Percent of Executive Branch Agencies Meeting Security 

Clearance Processing Timeliness Objectives in Fiscal 

Year 2018 174

Table 10: GAO’s 2019 High-Risk List 283

Figures

Figure 1: Illustrative Example of High-Risk Progress Criteria 

Ratings 4

Figure 2: Segments of GAO’s Department of Defense’s Supply 

Chain Management High-Risk Area 6

Figure 3: High-Risk Areas’ Progress and Regress on High-Risk 

Criteria Since 2017 27

Figure 4: Percentage of Agencies That Identified Their 

Involvement with the Fraud Reduction and Data Analytics 

Act of 2015 Working Group as a Great or Moderate 

Challenge 39

Figure 5: Essential Elements of Federal Government Enterprise 

Risk Management 45

Figure 6: Ten Critical Actions Needed to Address Four Major 

Cybersecurity Challenges 53

Figure 7: Improper Payment Estimates Were Concentrated in 

Three Areas in Fiscal Year 2018 64

Figure 8: Criteria for Removal from the High-Risk List and 

Examples of Actions Leading to Progress 71

Figure 9: History of Areas Removed from the High-Risk List 72

Figure 10: Areas on GAO’s 2019 High-Risk List Were Designated 

as High Risk, by Year Added 73

Figure 11: Projected Cumulative Highway Trust Fund Balance, 

Fiscal Years 2022 through 2029 87

Figure 12: Ten Critical Actions Needed to Address Four Major 

Cybersecurity Challenges 182

Figure 13: Percent of VHA Contract Actions Designated as 

Emergencies, Fiscal Year 2016 213

Figure 14: Pension Benefit Guaranty Corporation’s (PBGC) Net 

Financial Position of the Single-Employer and 

Multiemployer Programs Combined, Fiscal Years 1990 

through 2018 268
Page iv GAO-19-157SP High-Risk Series 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-19-157SP High-Risk Series 

441 G St. N.W. Comptroller General

Washington, DC 20548 of the United States

March 6, 2019

The Honorable Ron Johnson

Chairman

The Honorable Gary C. Peters

Ranking Member

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Elijah E. Cummings

Chairman

The Honorable Jim Jordan

Ranking Member

Committee on Oversight and Reform

House of Representatives

Since the early 1990s, our high-risk program has focused attention on 

government operations with greater vulnerabilities to fraud, waste, abuse, 

and mismanagement, or that are in need of transformation to address 

economy, efficiency, or effectiveness challenges. This effort, supported 

by the Senate Committee on Homeland Security and Governmental 

Affairs and by the House of Representatives Committee on Oversight and 

Reform, has brought much needed attention to problems impeding 

effective government and costing billions of dollars each year.

We have made hundreds of recommendations to reduce the 

government’s high-risk challenges. Executive agencies either have 

addressed or are addressing many of them and, as a result, progress is 

being made in a number of areas. Congress also continues to take 

important actions. For example, Congress has enacted a number of laws 

since our last report in February 2017 that are helping to make progress

on high-risk issues. Financial benefits to the federal government due to 

progress in addressing high-risk areas over the past 13 years (fiscal year 

2006 through fiscal year 2018) totaled nearly $350 billion or an average of 

about $27 billion per year. In fiscal year 2018, financial benefits were the 

highest we ever reported at nearly $47 billion.1

 

1

Financial benefits are based on actions taken in response to our work, such as reducing 

government expenditures, increasing revenues, or reallocating funds to other areas. 

Letter
Page 2 GAO-19-157SP High-Risk Series 

This report describes (1) progress made addressing high-risk areas and 

the reasons for that progress, and (2) actions that are still needed. It also 

identifies two new high-risk areas—Government-wide Personnel Security 

Clearance Process and Department of Veterans Affairs (VA) Acquisition 

Management, and two high-risk areas we removed from the list because 

they demonstrated sufficient progress in managing risk—Department of 

Defense (DOD) Supply Chain Management and Mitigating Gaps in 

Weather Satellite Data.

2

Substantial efforts are needed on the remaining high-risk areas to 

achieve greater progress and to address regress in some areas since the 

last high-risk update in 2017. Continued congressional attention and 

executive branch leadership attention remain key to success.

To determine which federal government programs and functions should 

be designated high-risk, we use our guidance document, Determining 

Performance and Accountability Challenges and High Risks.3

We consider qualitative factors, such as whether the risk 

• involves public health or safety, service delivery, national security, 

national defense, economic growth, or privacy or citizens’ rights, or

• could result in significantly impaired service, program failure, injury or 

loss of life, or significantly reduced economy, efficiency, or effectiveness.

We also consider the exposure to loss in monetary or other quantitative 

terms. At a minimum, $1 billion must be at risk, in areas such as the value 

of major assets being impaired; revenue sources not being realized; 

major agency assets being lost, stolen, damaged, wasted, or 

underutilized; potential for, or evidence of improper payments; and 

presence of contingencies or potential liabilities.

Before making a high-risk designation, we also consider corrective 

measures planned or under way to resolve a material control weakness 

and the status and effectiveness of these actions.

 

2

Government-wide Personnel Security Clearance Process was added to the High-Risk 

List in January 2018.

3

GAO, Determining Performance and Accountability Challenges and High Risks, 

GAO-01-159SP (Washington, D.C.: November 2000).

How We Identify and 

Rate High-Risk Areas
Page 3 GAO-19-157SP High-Risk Series 

Our experience has shown that the key elements needed to make 

progress in high-risk areas are top-level attention by the administration 

and agency leaders grounded in the five criteria for removal from the 

High-Risk List, as well as any needed congressional action. The five 

criteria for removal that we issued in November 2000 are as follows:

• Leadership commitment. Demonstrated strong commitment and top 

leadership support. 

• Capacity. Agency has the capacity (i.e., people and resources) to 

resolve the risk(s). 

• Action plan. A corrective action plan exists that defines the root cause, 

solutions, and provides for substantially completing corrective measures, 

including steps necessary to implement solutions we recommended. 

• Monitoring. A program has been instituted to monitor and independently 

validate the effectiveness and sustainability of corrective measures.

• Demonstrated progress. Ability to demonstrate progress in 

implementing corrective measures and in resolving the high-risk area.

Starting in our 2015 update, we added clarity and specificity to our 

assessments by rating each high-risk area’s progress on the five criteria 

and used the following definitions:

• Met. Actions have been taken that meet the criterion. There are no 

significant actions that need to be taken to further address this criterion. 

• Partially met. Some, but not all, actions necessary to meet the criterion 

have been taken.

• Not met. Few, if any, actions towards meeting the criterion have been 

taken.

Figure 1 shows a visual representation of varying degrees of progress in 

each of the five criteria for a high-risk area. Each point of the star 

represents one of the five criteria for removal from the High-Risk List and 

each ring represents one of the three designations: not met, partially met,

or met. An unshaded point at the innermost ring means that the criterion 

has not been met, a partially shaded point at the middle ring means that 

the criterion has been partially met, and a fully shaded point at the 

outermost ring means that the criterion has been met. Further, a plus 

symbol inside the star indicates the rating for that criterion progressed 

since our last high-risk update. Likewise, a minus symbol inside the star 

indicates the rating for that criterion declined since our last update.
Page 4 GAO-19-157SP High-Risk Series 

Figure 1: Illustrative Example of High-Risk Progress Criteria Ratings

Some high-risk areas are comprised of segments or subareas that make 

up the overall high-risk area. For example, the high-risk area Protecting 

Public Health through Enhanced Oversight of Medical Products includes 

two segments—Response to Globalization and Drug Availability—to 

reflect two interrelated parts of the overall high-risk area. Multidimensional 

high-risk areas such as these have separate ratings for each segment as 

well as a summary rating of the overall high-risk area that reflects a 

composite of the ratings received under the segment for each of the five 

high-risk criteria. High-risk areas that are primarily based on the need for 

congressional action are not rated on the criteria and do not receive a star 

graphic. 

We are removing two areas—DOD Supply Chain Management and 

Mitigating Gaps in Weather Satellite Data—from the list due to the 

progress that was made in addressing the high-risk issues. As we have 

with areas previously removed from the High-Risk List, we will continue to 

monitor these areas to ensure that the improvements we have noted are 

sustained. If significant problems again arise, we will consider reapplying 

the high-risk designation. We added two areas to the High-Risk List since 

our 2017 update—Government-Wide Personnel Security Clearance 

Process and VA Acquisition Management. See pages 6-18 for more 

information on the two high-risk areas being removed.

Changes to the 2019 

High-Risk List
Page 5 GAO-19-157SP High-Risk Series 

In addition to specific areas that we have designated as high risk, other 

important challenges facing our nation merit continuing close attention. 

One of these is the use of illicit drugs and the misuse of prescription 

drugs and the ways they affect individuals, their families, and the 

communities in which they live.
DOD Supply Chain Management

Page 6 GAO-19-157SP High-Risk Series 

We are removing this high-risk area because the Department of Defense (DOD) has made sufficient progress 

on the remaining seven actions and outcomes we recommended for improving supply chain management. 

Congressional attention, DOD leadership commitment, and our collaboration contributed to this successful 

outcome. 

Why High-Risk Area is Being 

Removed

From 2014 to 2017, we identified 

18 actions and outcomes DOD 

needed to implement in order for 

its supply chain management to 

be removed from our High-Risk 

List. In our 2017 High-Risk 

Report, we reported that DOD 

had made progress in addressing 

11 actions and met the criteria of 

leadership commitment, capacity, 

and action plan for asset visibility 

and materiel distribution. 

However, DOD needed to take 

additional actions to fully implement the remaining seven actions and 

outcomes related to the monitoring and demonstrated progress criteria. 

(See fig. 2.)

Figure 2: Segments of GAO’s Department of Defense’s Supply Chain Management 

High-Risk Area

We are removing DOD Supply Chain Management from the High-Risk 

List because, since 2017, DOD has addressed the remaining two criteria 

(monitoring and demonstrated progress) for asset visibility and materiel 

distribution by addressing the seven actions and outcomes identified in 

our 2017 High-Risk Report.

DOD Supply Chain Management

Why Area Was High Risk

DOD manages about 4.9 million 

secondary inventory items, such as 

spare parts, with a reported value of 

$92.9 billion as of September 2017. 

Effective and efficient supply chain 

management is critical for (1) supporting 

the readiness and capabilities of the 

force and (2) helping to ensure that DOD 

avoids spending resources on unneeded 

inventory that could be better applied to 

other defense and national priorities. We 

define supply chain management as 

including three segments—inventory 

management, asset visibility, and 

materiel distribution.

DOD Supply Chain Management has 

been on our High-Risk List since 1990—

starting with inventory management—

because of inefficient and ineffective 

management practices leading to excess 

inventory. In 2005, we added asset 

visibility and materiel distribution to this 

high-risk area due to weaknesses 

identified during operations in Iraq and 

Afghanistan, including backlogs of 

hundreds of pallets and containers at 

distribution points. 

In 2017, we removed inventory 

management from this area because 

DOD made key improvements, such as 

reducing on-order excess inventory by 

about $600 million and addressing each 

of our high-risk criteria, resulting in 

demonstrable and sustained 

improvements.

Contact Information

For additional information about this 

high-risk area, contact Diana Maurer at 

202-512-9627 or maurerd@gao.gov.
DOD Supply Chain Management

Page 7 GAO-19-157SP High-Risk Series 

Since our 2017 High-Risk Report, DOD has 

continued to meet the criteria of leadership 

commitment, capacity, and action plan for 

asset visibility. Further, DOD has fully 

addressed the three remaining actions and 

outcomes we outlined in 2017 in order to 

mitigate or resolve long-standing 

weaknesses in asset visibility. 

Consequently, DOD has met the monitoring 

and demonstrated progress criteria for 

asset visibility to remove this area from our 

High-Risk List. 

Leadership commitment: met. Senior leaders have continued to 

demonstrate commitment through their involvement in groups such as the 

Supply Chain Executive Steering Committee—senior-level officials 

responsible for overseeing asset visibility improvement efforts—and 

through the Asset Visibility Working Group, which identifies opportunities 

for improvement and monitors the implementation of initiatives by issuing 

its Strategy for Improving DOD Asset Visibility (Strategy) in 2014, 2015, 

and 2017. 

Capacity: met. DOD continues to demonstrate that it has the capacity—

personnel and resources—to improve asset visibility. For example, DOD’s 

2015 and 2017 Strategies advise the components to consider items such 

as staffing, materiel, and sustainment costs when documenting cost 

estimates for the initiatives in the Strategy, as we recommended in 

January 2015. 

Action plan: met. A provision in the National Defense Authorization Act 

for Fiscal Year 2014 required DOD to submit to Congress a 

comprehensive strategy and implementation plans for improving asset 

tracking and in-transit visibility. In January 2014, DOD issued the Strategy 

and accompanying implementation plans, which outlined initiatives 

intended to improve asset visibility. DOD updated its 2014 Strategy in 

October 2015 and in August 2017. 

Importantly, since 2017 DOD addressed the three remaining actions and 

outcomes related to the monitoring and demonstrated progress criteria 

through updates to and implementation of the Strategies (see table 1).

Asset Visibility
DOD Supply Chain Management

Page 8 GAO-19-157SP High-Risk Series 

Table 1: Status of Asset Visibility Remaining Action Items Required to Remove 

Supply Chain Management from GAO’s High-Risk List

Action items Action 

item 

status

High-risk 

category

1. Incorporate the attributes of successful performance 

measures (e.g., clear, quantifiable, objective, and 

reliable), as appropriate, in subsequent updates to the 

Strategy for Improving DOD Asset Visibility 

Met Monitoring

2. Take steps to incorporate into after-action reports 

information relating to performance measures for the 

asset visibility initiatives

Met Monitoring

3. Demonstrate sustained progress in implementing 

initiatives that result in measurable outcomes and 

progress towards realizing the goals and objectives in 

the Strategy for Improving DOD Asset Visibility

Met Demonstrated 

progress

Source: GAO analysis and prior GAO report. | GAO-19-157SP

Monitoring: met. DOD provided guidance in its 2017 update to the 

Strategy for the military components to consider key attributes of 

successful performance measures during metric development for their 

improvement initiatives. As appropriate, the military components have 

followed the guidance and provided high-level summary metrics updates 

to the Asset Visibility Working Group. In addition, DOD has taken steps to 

monitor asset visibility by incorporating into after-action reports, as 

appropriate, information relating to performance measures. These afteraction reports serve as closure documents and permanent records of 

each initiative’s accomplishments.

Demonstrated progress: met. DOD has demonstrated sustained 

progress by completing 34 of the 39 initiatives to improve asset visibility 

and continues to monitor the remaining 5 initiatives. These initiatives have 

supported DOD’s goals and objectives, which include: (1) improving 

visibility efficiencies of physical inventories, receipt processing, cargo 

tracking, and unit moves; (2) ensuring asset visibility data are 

discoverable, accessible, and understandable to support informed 

decision-making across the enterprise; and (3) increasing efficiencies for 

delivery accuracy and cycle times. Also, the Asset Visibility Working 

Group meets regularly to identify opportunities to further improve asset 

visibility within DOD. 

DOD has taken the following actions to demonstrate sustained progress: 

(1) created an integrated single portal system providing 7,500 users 

access to near-real-time, in-transit visibility of eight million lines of items 

of supply and transportation data; and (2) increased its visibility of assets 

through radio-frequency identification (RFID), an automated data-capture 

technology that can be used to electronically identify, track, and store 

information contained on a tag. There are two main types of RFID tags, 
DOD Supply Chain Management

Page 9 GAO-19-157SP High-Risk Series 

passive and active, which show whether assets are in-storage, in-transit, 

in-process, or in-use. Passive tags, such as mass transit passes, do not 

contain their own power source and cannot initiate communication with a 

reader; while active tags, such as an “E-Z pass,” contain a power source 

and a transmitter, and send a continuous signal over longer distances. 

DOD closed nine initiatives from its Strategies by implementing RFID 

technology. For example, the Marine Corps implemented long-range 

passive RFID for visibility and accountability of items, resulting in 

improvements that include an increased range for “reading” an item—

from 30 feet to 240 feet—and reduced inventory cycle times from 12 days 

to 10 hours. Also, the Navy reported that the use of passive RFID 

technology to support the overhaul of its nuclear-powered attack 

submarines enabled the Navy to better track parts, resulting in 98 percent 

fewer missing components and an average cost avoidance of $1.3 million 

per boat. 

Additionally, according to DOD, the use of RFID tags to provide visibility 

of sustainment cargo at the tactical leg resulted in $1.4 million annual cost 

savings. Further, DOD reported that the migration of the active RFID 

enterprise from a proprietary communication standard to a competitive 

multivendor environment reduced the cost of active RFID tags by half, 

resulting in an estimated $5.7 million annual reduction in costs.

Since our 2017 High-Risk Report, DOD has 

continued to meet the criteria of leadership 

commitment, capacity, and action plan for 

materiel distribution. Further, DOD has fully 

addressed the four remaining actions and 

outcomes we outlined in 2017 in order to 

mitigate or resolve long-standing 

weaknesses in materiel distribution. 

Consequently, DOD has met the monitoring 

and demonstrated progress criteria for 

materiel distribution to remove this area from 

our High-Risk List. 

Leadership commitment: met. Senior leaders continue to demonstrate 

commitment through their involvement in groups such as the Supply 

Chain Executive Steering Committee—senior-level officials responsible 

for overseeing materiel distribution corrective actions—and through the 

Distribution Working Group, which helped develop the Materiel 

Distribution Improvement Plan (Improvement Plan) in 2016. 

Capacity: met. DOD has continued to demonstrate that it has the 

personnel and resources, such as key organizations and the associated 

Materiel Distribution
DOD Supply Chain Management

Page 10 GAO-19-157SP High-Risk Series 

governance structure, to improve materiel distribution. The Improvement 

Plan recognizes that additional resources will be required to accomplish 

its corrective actions and close any identified performance gaps within the 

time frame specified.

Action plan: met. In 2016, DOD developed its corrective action plan to 

address the department’s materiel distribution challenges. The 

Improvement Plan details specific goals and actions to better measure 

the end-to-end distribution process, ensure the accuracy of underlying 

data, and strengthen and integrate distribution policies and the 

governance structure. 

Importantly, since 2017, DOD has fully addressed the four remaining 

actions and outcomes related to monitoring and demonstrated progress 

to mitigate or resolve long-standing weaknesses in materiel distribution 

(see table 2).

Table 2: Status of Materiel Distribution Remaining Action Items Required to 

Remove Supply Chain Management from GAO’s High-Risk List

Action items Action 

item 

status

High-risk 

category

1. Make progress in developing Department of Defense’s 

(DOD’s) suite of distribution performance metrics, 

improving the quality of data underlying those metrics, 

and sharing metrics information among stakeholders.

Met Monitoring

2. Integrate distribution metrics data, including cost data, 

from the combatant commands and other DOD 

components, as appropriate, on the performance of all 

legs of the distribution system, including the tactical leg.

a

Met Monitoring

3. Refine existing actions in the Materiel Distribution 

Improvement Plan or incorporate additional actions 

based on interim progress and results, and update the 

Materiel Distribution Improvement Plan accordingly. 

Met Monitoring

4. Demonstrate that the actions implemented under its 

Materiel Distribution Improvement Plan improve its 

capability to comprehensively measure distribution 

performance, identify distribution problems and root 

causes, and identify and implement solutions. 

Met Demonstrated 

progress

Source: GAO analysis and prior GAO report. | GAO-19-157SP

a

The tactical leg is the last segment of the distribution system between the supply points in a military 

theater of operations and the forward operating bases and units. 

Monitoring: met. DOD has monitored materiel distribution by making 

progress in developing its suite of distribution performance metrics, 

improving the quality of their underlying data, and sharing metrics 

information with stakeholders. For example, in January 2017, DOD 

developed a suite of performance metrics that provides a comprehensive 

picture of the distribution process, including whether supplies are 
DOD Supply Chain Management

Page 11 GAO-19-157SP High-Risk Series 

delivered on time and at sufficient quantity and quality. Also, DOD 

implemented checklists to assess the quality of data underlying each 

performance metric based on relevance, accuracy, comparability, and 

interpretability. 

The checklists and their standards assist in identifying root causes and 

addressing areas where performance data quality may be lacking. DOD 

has also incorporated internal control requirements in its supply chain 

management guidance to increase confidence in the performance data. 

Additionally, DOD has revised its policy documents to require 

stakeholders to routinely capture and share distribution performance 

metrics, including cost data, and the department maintains websites to 

provide current performance information to distribution stakeholders. 

DOD has also incorporated distribution metrics, as appropriate, on the 

performance of all legs of the distribution system, including the tactical leg 

(i.e., the last segment of the distribution system). We previously reported 

on DOD’s deficiencies to accurately assess its distribution performance at 

the tactical leg, such as missing delivery dates for shipments in 

Afghanistan. Since that time, the geographic combatant commands have 

been tracking metrics at the tactical leg, including required delivery dates, 

to determine the movement and causes of delays for shipments, and 

have been sharing distribution performance information with the U.S. 

Transportation Command (TRANSCOM) through their deployment and 

distribution operations centers. DOD is implementing a cost framework to 

incorporate transportation costs for all legs of the distribution system, 

which will provide an additional metric for distribution stakeholders to 

assess the efficiency of the system. The first phase of the cost framework 

began operating in August 2018 and is expected to be fully implemented 

in 2019.

DOD is making progress in refining its Improvement Plan and is 

incorporating additional actions based on interim progress and results. 

Since DOD issued the Improvement Plan in September 2016, the agency 

has (1) documented the results and monitored the status of each 

corrective action, (2) revised completion dates as needed, and (3) 

periodically provided decision makers with summary action charts, plans, 

and milestones. DOD is also updating its instruction on management and 

oversight of the distribution enterprise to clarify the roles and 

responsibilities of all distribution stakeholders. DOD officials have not 

determined a date for when this instruction will be issued.

Demonstrated progress: met. DOD has demonstrated sustained 

progress in improving its capability to comprehensively measure 

distribution performance, identify distribution problems and root causes, 

and implement solutions. DOD has implemented 10 of 18 corrective 

actions in its Improvement Plan and is on track to implement the 
DOD Supply Chain Management

Page 12 GAO-19-157SP High-Risk Series 

remaining 8 by September 2019. Because of this progress, DOD’s 

monthly shipment reports have assessed performance against enhanced 

metrics across the distribution system. For example, in December 2017, 

TRANSCOM investigated performance standards for truck deliveries from 

its Defense Logistics Agency warehouses in Bahrain to customers in 

Kuwait due to frequent delays in shipments. TRANSCOM determined that 

inadequate time for clearing customs in Kuwait resulted in an unrealistic 

delivery standard. 

TRANSCOM, in coordination with distribution stakeholders, adjusted the 

delivery standard to adequately account for the in-theater customs 

process. In addition, TRANSCOM, in partnership with the Defense 

Logistics Agency and the General Services Administration, developed 

and implemented initiatives focused on distribution process and 

operational improvements to reduce costs and improve distribution 

services to the warfighter. According to DOD, these efforts have resulted 

in at least $1.56 billion in distribution cost avoidances to date. 

DOD has demonstrated commendable, sustained progress improving its 

supply chain management. This does not mean DOD has addressed all 

risk within this area. It remains imperative that senior leaders continue 

their efforts to implement initiatives and corrective actions to maintain 

visibility of supplies, track cargo movements, meet delivery standards, 

and maintain delivery data for shipments. Continued oversight and 

attention are also warranted given the recent reorganization of the Office 

of the Under Secretary of Defense for Acquisition and Sustainment and 

the resulting change in the oversight structure of Supply Chain 

Management. We will therefore continue to conduct oversight of supply 

chain management at DOD.

Defense Logistics: Improved Performance Measures and Information 

Needed for Assessing Asset Visibility Initiatives. GAO-17-183. 

Washington, D.C.: Mar. 16, 2017.

Defense Logistics: DOD Has Addressed Most Reporting Requirements 

and Continues to Refine its Asset Visibility Strategy. GAO-16-88. 

Washington, D.C.: Dec. 22, 2015. 

Defense Logistics: Improvements Needed to Accurately Assess the 

Performance of DOD’s Materiel Distribution Pipeline. GAO-15-226. 

Washington, D.C.: Feb. 26, 2015.

Monitoring After Removal

Related GAO 

Products
Mitigating Gaps in Weather Satellite Data 

Page 13 GAO-19-157SP High-Risk Series 

We are removing this high-risk area because—with strong congressional support and oversight—the National 

Oceanic and Atmospheric Administration (NOAA) and the Department of Defense (DOD) have made 

significant progress in establishing and implementing plans to mitigate potential gaps in weather satellite data. 

Why High-Risk Area Is Being 

Removed

In our 2017 High-Risk Report, we 

reported that NOAA had fully 

implemented criteria associated 

with demonstrating leadership 

commitment, having the needed 

capacity to address risks, and 

monitoring progress. 

We also reported that NOAA had 

partially implemented the criteria 

for establishing an action plan and 

demonstrating progress. In 

addition, our 2017 report noted 

DOD’s slow progress in 

establishing plans for its follow-on weather satellite program and for 

determining how it would fulfill other weather requirements in the early 

morning orbit. 

Since that time, (1) NOAA has fully implemented actions in response to 

the remaining two criteria that had previously been partially implemented 

and (2) DOD, pursuant to statutes and accompanying congressional 

direction, established and began implementing plans both for its follow-on 

weather satellite program and for addressing the key requirements that 

were not included in that satellite program. Consequently, we are 

removing the need to mitigate gaps in weather satellite data from our 

High-Risk List. 

Mitigating Gaps in Weather Satellite Data

Why Area Was High Risk

The United States relies on two satellite 

systems for weather forecasts and 

observations: (1) polar-orbiting satellites 

that provide a global perspective every 

morning and afternoon and (2) 

geostationary satellites that maintain a 

fixed view of the nation. NOAA is 

responsible for the polar satellite 

program that crosses the equator in the 

afternoon and for the geostationary 

satellite program. DOD is responsible for 

the polar satellite program that crosses 

the equator in the early morning orbit. 

These agencies are planning or 

executing major satellite acquisition 

programs to replace existing polar and 

geostationary satellites that are nearing 

the end of, or are beyond, their expected 

life spans. 

A gap in satellite data would result in 

less accurate and timely weather 

forecasts and warnings of extreme 

events—such as hurricanes and floods. 

Given the criticality of satellite data to 

weather forecasts, the likelihood of 

significant gaps in weather satellite data, 

and the potential impact of such gaps on 

the health and safety of the U.S. 

population and economy, we concluded 

that the potential gap in weather satellite 

data was a high-risk area and added it to 

the High-Risk List in 2013. More 

recently, in recognition of NOAA’s 

progress, we removed the geostationary 

satellite segment from the high-risk area 

in 2017.

Contact Information

For additional information about this 

high-risk area, contact Carol C. Harris at 

202-512-4456 or at harriscc@gao.gov.
Mitigating Gaps in Weather Satellite Data 

Page 14 GAO-19-157SP High-Risk Series 

Since our last high-risk update in 2017, 

NOAA continues to meet the criteria of 

leadership commitment, capacity, and 

monitoring and now also meets the criteria 

of action plan and demonstrated progress. 

Leadership commitment: met. NOAA 

program officials met the leadership 

commitment criteria in 2015 and have 

continued to sustain their strong leadership 

commitment to mitigating potential satellite 

data gaps since that time. For example, 

NOAA issued and frequently updated its polar satellite gap mitigation 

plan, which identifies the specific technical, programmatic, and 

management steps the agency is taking to ensure that satellite mitigation 

options are viable. In addition, NOAA executives continue to oversee the 

acquisition of polar-orbiting satellites through monthly briefings on the 

cost, schedule, and risks affecting the satellites’ development. 

Capacity: met. NOAA continues to meet the criterion of improving its 

capacity to address the risk of a satellite data gap. In December 2014, we 

recommended that NOAA investigate ways to prioritize the gap mitigation 

projects with the greatest potential benefit to weather forecasting, such as 

by improving its high-performance computing capacity. NOAA agreed 

with this recommendation and implemented it. For example, NOAA 

upgraded its high-performance computers, which allowed the agency to 

move forward on multiple other mitigation activities, including 

experimenting with other data sources and assimilating these data into its 

weather models.

Action plan: met. NOAA now meets the criterion for having a plan to 

address the risk of a polar satellite data gap, which is an increase over its 

rating in 2017. In June 2012, we reported that, while NOAA officials 

communicated publicly and often about the risk of a polar satellite data 

gap, the agency had not established plans to mitigate the gap. We 

recommended that NOAA establish a gap mitigation plan, and the agency 

did so in February 2014. However, in December 2014, we recommended 

that NOAA revise its plan to address shortfalls, including (1) adding 

recovery time objectives for key products, (2) identifying opportunities for 

accelerating the calibration and validation of satellite data products, (3) 

providing an assessment of available alternatives based on their costs 

and impacts, and (4) establishing a schedule with meaningful timelines 

and linkages among mitigation activities.

The agency agreed with the recommendation and subsequently 

addressed it. Specifically, NOAA issued three updates to its gap 

NOAA’s PolarOrbiting Weather 

Satellites
Mitigating Gaps in Weather Satellite Data 

Page 15 GAO-19-157SP High-Risk Series 

mitigation plan between January 2016 and February 2017. With the last 

of the updates, the agency addressed the shortfalls we had identified.

Monitoring: met. NOAA met this criterion in 2017, and continues to meet 

it now, by implementing our recommendations to more consistently and 

comprehensively monitor its progress on gap mitigation activities. For 

example, all three NOAA organizations responsible for gap mitigation 

projects regularly brief senior management on their progress.

Demonstrated progress: met. NOAA now meets the criterion for 

demonstrated progress, which is an increase over its prior rating. In our 

2017 High-Risk Report, we noted that NOAA had identified 35 different 

gap mitigation projects and was making progress in implementing them. 

These projects fell into three general categories: (1) understanding the 

likelihood and impact of a gap, (2) reducing the likelihood of a gap, and 

(3) reducing the impact of a gap. Nevertheless, one of the most important 

steps in reducing the likelihood of a gap—keeping the launch of the next 

polar satellite on schedule—had encountered problems. Specifically, 

agency officials decided to delay the launch due to challenges in 

developing the ground system and a critical instrument on the spacecraft. 

This delay exacerbated the probability of a satellite data gap. 

More recently, however, NOAA was able to demonstrate progress by 

successfully launching the satellite in November 2017. That satellite, now 

called NOAA-20, is currently operational and is being used to provide 

advanced weather data and forecasts. Moreover, the agency is also 

working to build and launch the next satellites in the polar satellite 

program.

Since our last high-risk update in 2017, 

DOD now meets all five high-risk criteria. 

Leadership commitment: met. With strong 

congressional oversight, DOD now meets 

this criterion. Pursuant to enactment of the 

Carl Levin and Howard P. ’Buck’ McKeon 

National Defense Authorization Act for 

Fiscal Year 2015 (NDAA for FY 2015), the 

National Defense Authorization Act for 

Fiscal Year 2016 (NDAA for FY 2016), and 

the Consolidated Appropriations Act, 2016, 

DOD leadership committed to developing and implementing plans to 

address its weather satellite requirements. For example, in late 2017, the 

department awarded a contract for its Weather System Follow-on—

Microwave satellite to fulfill core weather requirements. 

DOD’s Polar-Orbiting 

Weather Satellites
Mitigating Gaps in Weather Satellite Data 

Page 16 GAO-19-157SP High-Risk Series 

Capacity: met. With strong congressional oversight, DOD now meets the 

capacity criterion. Specifically, the NDAA for FY 2015 restricted the 

availability of 50 percent of the FY 2015 funds authorized for the Weather 

Satellite Follow-on System (now called the Weather System Follow-on—

Microwave satellite program) until DOD submitted to the congressional 

defense committees a plan to meet weather monitoring data collection 

requirements. In addition, the explanatory statement that accompanied 

the Consolidated Appropriations Act, 2016, recommended that the Air 

Force focus on ensuring that the next generation of weather satellites 

meet the full spectrum of requirements and work with civil stakeholders to 

leverage appropriate civil or international weather assets. 

As called for in the law and the explanatory statement, DOD established 

plans to meet weather monitoring data collection needs, including by 

acquiring satellites as part of a family of systems to replace its aging 

legacy weather satellites. Additionally, DOD formally coordinated with 

NOAA on weather monitoring data collection efforts. In January 2017, the 

Air Force and NOAA signed a memorandum of agreement, and in 

November 2017, signed an annex to that agreement, to allow for the 

exchange of information and collaboration on a plan for collecting weather 

monitoring data. The Air Force and NOAA are now developing plans to 

relocate a residual NOAA satellite over the Indian Ocean, an area of 

concern for cloud characterization and area-specific weather imagery 

coverage.

Action plan: met. In our 2017 High-Risk Report, we reported that DOD 

was slow to establish plans for its Weather System Follow-on–Microwave 

program and had made little progress in determining how it would meet 

weather satellite requirements for cloud characterization and area-specific 

weather imagery. Pursuant to the NDAA for FY 2015, the NDAA for FY 

2016, and the explanatory statement that accompanied the Consolidated 

Appropriations Act, 2016, the department developed and began 

implementing plans to address its weather satellite requirements. As 

mentioned above, in late 2017, the department awarded a contract for its 

Weather System Follow-on–Microwave satellite to fulfill core weather 

requirements. Under this program, the department may launch a 

demonstration satellite in 2021 and plans to launch an operational 

satellite in 2022. 

DOD also developed plans for providing its two highest-priority 

capabilities—cloud characterization and area-specific weather imagery 

data collection—that will not be covered by the Weather System Followon–Microwave satellite program. The department is planning a longerterm solution, called the Electro-Optical/Infrared Weather Systems 

program, to meet these needs, with a planned satellite launch in 2024. 
Mitigating Gaps in Weather Satellite Data 

Page 17 GAO-19-157SP High-Risk Series 

Monitoring: met. DOD now meets the monitoring criterion as evidenced 

by its actions to initiate a major acquisition program, the Weather System

Follow-on–Microwave, and award a contract for the first satellite. In 

addition, program officials stated that they plan to monitor the program’s 

progress toward addressing critical needs and assess its operations and 

sustainment costs.

Demonstrated progress: met. DOD now meets the demonstrated 

progress criterion because it has developed plans and taken actions to 

address gaps in weather data through its plans to launch the Weather 

System Follow-on–Microwave satellite in 2022. The department also 

plans to launch the Electro-Optical/Infrared Weather Systems satellite in 

2024. By developing these plans, DOD has reduced the risk of a gap in 

weather satellite data and addressed the concerns about a lack of 

planning that we identified in our 2017 High-Risk Report. DOD’s effective 

implementation of its plans will be key to further reducing the risks of gaps 

in weather satellite data in the future. 

Moving forward, we will continue to monitor both NOAA and DOD efforts 

to develop and launch the next satellites in their respective weather 

satellite programs. NOAA plans to launch its next geostationary weather 

satellite in 2021 and to launch its next polar weather satellite in 2022. 

DOD plans satellite launches in 2021 (potentially), 2022, and 2024. In 

addition, we will continue to monitor DOD’s efforts to develop long-term 

plans to meet its weather satellite requirements. 

Weapon Systems Annual Assessment: Knowledge Gaps Pose Risks to 

Sustaining Recent Positive Trends. GAO-18-360SP. Washington, D.C.: 

Apr. 25, 2018.

Satellite Acquisitions: Agencies May Recover a Limited Portion of 

Contract Value When Satellites Fail. GAO-17-490. Washington, D.C.: 

June 9, 2017. 

Defense Acquisitions: Assessments of Selected Weapon Programs. 

GAO-17-333SP. Washington, D.C.: Mar. 30, 2017. 

Defense Weather Satellites: DOD Faces Acquisition Challenges for 

Addressing Capability Needs. GAO-16-769T. Washington, D.C.: July 7, 

2016.

Polar Satellites: NOAA Faces Challenges and Uncertainties that Could 

Affect the Availability of Critical Weather Data. GAO-16-773T. 

Washington, D.C.: July 7, 2016.

Monitoring After Removal

Related GAO 

Products
Mitigating Gaps in Weather Satellite Data 

Page 18 GAO-19-157SP High-Risk Series 

Polar Weather Satellites: NOAA Is Working to Ensure Continuity but 

Needs to Quickly Address Information Security Weaknesses and Future 

Program Uncertainties. GAO-16-359. Washington, D.C.: May 17, 2016.

Defense Weather Satellites: Analysis of Alternatives Is Useful for Certain 

Capabilities, but Ineffective Coordination Limited Assessment of Two 

Capabilities. GAO-16-252R. Washington, D.C.: Mar. 10, 2016.
Page 19 GAO-19-157SP High-Risk Series 

Executive branch agencies are not meeting investigation timeliness 

objectives, and these processing delays have contributed to a significant 

backlog that the National Background Investigations Bureau (NBIB)—the 

agency responsible for personnel security clearance investigations—

reported to be approximately 565,000 investigations as of February 2019. 

In addition, the executive branch has not finalized performance measures 

to ensure the quality of background investigations and some longstanding key reform initiatives remain incomplete. Further, information 

technology (IT) security concerns may delay planned milestones for the 

development of a new background investigation IT system. 

We included the DOD program on our High-Risk List in 2005 and 

removed it in 2011 because of improvements in the timeliness of 

investigations and adjudications, and steps toward measuring the quality 

of the process. We put the government-wide personnel security clearance 

process on our High-Risk List in January 2018 because of significant 

challenges related to the timely processing of security clearances and 

completing the development of quality measures. In addition, the 

government’s effort to reform the personnel security clearance process, 

starting with the enactment of the Intelligence Reform and Terrorism 

Prevention Act of 2004, has had mixed progress, and key reform efforts 

have not been implemented government-wide.4 Since adding this area to 

the High-Risk List, the Security Clearance, Suitability, and Credentialing 

Performance Accountability Council (PAC), including its four principal 

members—the Deputy Director for Management of the Office of 

Management and Budget (OMB), the Director of National Intelligence 

(DNI); the Under Secretary of Defense for Intelligence; and the Director of 

the Office of Personnel Management (OPM)—have not fully met the five 

criteria for high-risk removal.

Several issues contribute to the risks facing the government-wide 

personnel security clearance process:

• Clearance processing delays. Executive branch agencies are not 

meeting most investigation timeliness objectives. The percentage of 

executive branch agencies meeting established timeliness objectives for 

initial secret clearances, initial top secret clearances, and periodic 

reinvestigations decreased each year from fiscal years 2012 through 

2018. For example, 97 percent of the executive branch agencies we 

 

4

Pub. L. No. 108-458, 118 Stat. 3638 (2004).

Government-wide 

Personnel Security 

Clearance Process Added 

to the High-Risk List
Page 20 GAO-19-157SP High-Risk Series 

reviewed did not meet the timeliness objectives for initial secret clearance

investigations in fiscal year 2018.

• Lack of quality measures. While the executive branch has taken steps 

to establish government-wide performance measures for the quality of 

background investigations—including establishing quality assessment 

standards and a quality assessment reporting tool—it is unclear when 

this effort will be completed. 

• Security clearance reform delays. The executive branch has reformed 

many parts of the personnel security clearance process—such as 

updating adjudicative guidelines to establish common adjudicative criteria 

for security clearances; however, some long-standing key initiatives 

remain incomplete—such as completing plans to fully implement and 

monitor continuous evaluation.

• IT security. DOD is responsible for developing a new system to support 

background investigation processes, and DOD officials expressed 

concerns about the security of connecting to OPM’s legacy systems 

since a 2015 data breach compromised OPM’s background investigation 

systems and files for 21.5 million individuals. As of December 2018, OPM 

has not fully taken action on our priority recommendations to update its 

security plans, evaluate its security control assessments, and implement 

additional training opportunities.

However, since we added this area to our High-Risk List, the PAC has 

demonstrated progress in some areas. For example, NBIB reported that

the backlog of background investigations decreased from almost 715,000 

cases in January 2018 to approximately 565,000 cases in February 2019. 

NBIB officials credit an Executive Memorandum—issued jointly in June 

2018 by the DNI and the Director of OPM and containing measures to 

reduce the investigation backlog—as a driver in backlog reduction. 

Further, in response to a requirement in the Securely Expediting 

Clearances Through Reporting Transparency (SECRET) Act of 2018, in 

September 2018, NBIB reported to Congress, for each clearance level, 

(1) the size of the investigation backlog, (2) the average length of time to 

conduct an initial investigation and a periodic reinvestigation, and (3) a 

discussion of the factors contributing to investigation timeliness.5 The 

PAC is also reporting publicly on the progress of key reforms through 

www.performance.gov, and for fiscal year 2018, the website contains 

quarterly action plans and progress updates, which present figures on the 

 

5

Pub. L. No. 115-173, § 3, 132 Stat. 1291, 1291–1292 (2018).
Page 21 GAO-19-157SP High-Risk Series 

average timeliness of initial investigations and periodic reinvestigations 

for the executive branch as a whole, investigation workload and backlog, 

and investigator headcounts.

We have made numerous recommendations to PAC members to address 

risks associated with the personnel security clearance process between 

2011—when we removed DOD’s personnel security clearance program 

from the High-Risk List, and 2018—when we placed the government-wide 

personnel security clearance process on the High-Risk List. We consider 

27 of these recommendations key to addressing the high-risk designation. 

Eight recommendations key to the high-risk designation have been 

implemented, including three since January 2018. 

Nineteen of these key recommendations remain open—including 

recommendations that the principal members of the PAC (1) conduct an 

evidence-based review of investigation and adjudication timeliness 

objectives, (2) develop and report to Congress on investigation quality 

measures, (3) prioritize the timely completion of efforts to modernize and 

secure IT systems that affect clearance holders government-wide, and (4) 

develop and implement a comprehensive workforce plan that identifies

the workforce needed to meet current and future demand for background 

investigations services and to reduce the investigations backlog.

See appendix II for additional detail on this high-risk area, including more 

details on actions that need to be taken.

VA spends tens of billions of dollars to procure a wide range of goods and 

services—including medical supplies, IT, and construction of hospitals, 

clinics, and other facilities—to meet its mission of providing health care 

and other benefits to millions of veterans. VA has one of the most 

significant acquisition functions in the federal government, both in 

obligations and number of contract actions. The Veterans Health 

Administration (VHA) provides medical care to veterans and is by far the 

largest administration in the VA. Since we began focusing on VA’s 

acquisition management activities in 2015, we have reported numerous 

challenges in this area. Since 2015, we have made 31 recommendations, 

21 of which remain open, that cover a range of areas to address 

challenges in VA’s acquisition management.

In fiscal year 2019, VA received the largest discretionary budget in its 

history—$86.5 billion, about $20 billion higher than in 2015. About a third 

of VA’s discretionary budget in fiscal year 2017, or $26 billion, has been 

VA Acquisition 

Management Added to the 

High-Risk List
Page 22 GAO-19-157SP High-Risk Series 

used to contract for goods and services. VA’s acquisition management 

continues to face challenges including (1) outdated acquisition regulations 

and policies; (2) lack of an effective medical supplies procurement 

strategy; (3) inadequate acquisition training; (4) contracting officer 

workload challenges; (5) lack of reliable data systems; (6) limited contract 

oversight and incomplete contract file documentation; and (7) leadership 

instability. 

In light of these challenges and given the significant taxpayer investment, 

it is imperative that VA show sustained leadership commitment to take 

steps to improve the performance of its procurement function so that it 

can use its funding in the most efficient manner possible to meet the 

needs of those who served our country.

This area has been added to the High-Risk List for the following reasons

in particular: 

• Outdated acquisition regulations and policies. VA’s procurement 

policies have historically been outdated, disjointed, and difficult for 

contracting officers to use. In September 2016, we reported that the 

acquisition regulations contracting officers currently follow have not been 

fully updated since 2008 and that VA had been working on completing a 

comprehensive revision of its acquisition regulations since 2011. VA’s 

delay in updating this fundamental source of policy has impeded the 

ability of contracting officers to effectively carry out their duties. We 

recommended in September 2016 that VA identify measures to expedite 

the revision of its acquisition regulations and clarify what policies are 

currently in effect. VA concurred with this recommendation but has not 

yet fully implemented it.

• Lack of an effective medical supplies procurement strategy. VA’s 

Medical Surgical Prime Vendor-Next Generation (MSPV-NG) program for 

purchasing medical supplies to meet the needs of about 9 million 

veterans at 172 medical centers has not been effectively executed, nor is 

it in line with practices at leading hospitals that have launched similar 

programs. We reported in November 2017 that VA’s approach to 

developing its catalog of supplies was rushed and lacked key stakeholder 

involvement and buy-in. As a result, VA was not able to accomplish some 

of the key efficiencies the program was intended to achieve, such as 

streamlining the purchase of medical supplies and saving money. We 

recommended in November 2017 that VA develop, document, and 

communicate to stakeholders an overarching strategy for the program. 

VA concurred with this recommendation and reported that it would 

develop a new strategy by March 2019.
Page 23 GAO-19-157SP High-Risk Series 

• Contracting officer workload challenges. The majority of our reviews 

since 2015 have highlighted workload as a contributing factor to the 

challenges that contracting officers face. Most recently, in September 

2018, we reported that about 54 percent of surveyed VA contracting 

officers said their workload was not reasonable. In addition, in September 

2016, we reported that VHA contracting officers processed a large 

number of emergency procurements of routine medical supplies, which 

accounted for approximately 20 percent of VHA’s overall contract actions 

in fiscal year 2016, with obligations totaling about $1.9 billion. 

Contracting officers told us that these frequent and urgent small-dollar 

transactions reduce contracting officers’ efficiency and ability to take a 

strategic view of procurement needs. We recommended in November 

2017 that VHA network contracting offices work with medical centers to 

identify opportunities to more strategically purchase goods and services 

frequently purchased on an emergency basis. VA concurred with this

recommendation and reported in December 2018 that it is utilizing a 

supply chain dashboard to track items purchased on an emergency basis 

and determine which of those items to include on the catalog. VA noted 

that it added 13,300 items to the catalog from June 2018 to December 

2018, including items often purchased on an emergency basis. We 

requested documentation showing which items added to the catalog were 

previously purchased on an emergency basis, but as of January 2019, VA 

had not yet provided it. 

Among other things, VA should implement our 21 open recommendations 

and specifically needs to take the following steps to demonstrate greater 

leadership commitment and strategic planning to ensure efficient use of 

its acquisition funding and staffing resources:

• Prioritize completing the revision of its acquisition regulations, which has 

been in process since 2011.

• Develop, document, and communicate to stakeholders a strategy for the 

Medical Surgical Prime Vendor program to achieve overall program 

goals.

• Identify opportunities to strategically purchase goods and services that 

are frequently purchased on an emergency basis.

See appendix II for additional detail on this high-risk area, including more 

details on actions that need to be taken.
Page 24 GAO-19-157SP High-Risk Series 

In addition to specific areas that we have designated as high risk, other 

important challenges facing our nation merit continuing close attention. 

One of these is the use of illicit drugs and the misuse of prescription 

drugs and the ways they affect individuals, their families, and the 

communities in which they live. Over 70,000 people died from drug 

overdoses in 2017—about 191 people every day—according to the 

Centers for Disease Control and Prevention, with the largest portion of 

these deaths attributed to opioids. Further, drug overdoses are the 

leading cause of death due to injuries in the United States. They are 

currently at their highest ever recorded level and, since 2011, have 

outnumbered deaths by firearms, motor vehicle crashes, suicide, and 

homicide, according to the Drug Enforcement Administration. The Council 

of Economic Advisors estimates that in 2015, the economic cost of the 

opioid crisis alone was more than $500 billion when considering the value 

of lives lost due to opioid-related overdose. 

Federal drug control efforts spanning prevention, treatment, interdiction, 

international operations, and law enforcement represent a considerable 

federal investment. According to the President’s fiscal year 2019 budget, 

federal drug control funding for fiscal year 2017 was $28.8 billion. Multiple 

federal agencies have ongoing efforts to respond to this crisis, including 

efforts to reduce the supply and demand for illicit drugs, to prevent 

misuse of prescription drugs, and to treat substance use disorders. 

However, we previously found that many efforts lacked measures to 

gauge the success of the federal response. Further, we have long 

advocated an approach to decision-making based on risk management. 

Such an approach would (1) link agencies’ plans and budgets to 

achieving their strategic goals, (2) assess values and risks of various 

courses of actions to help set priorities and allocate resources, and (3) 

provide for the use of performance measures to assess progress. 

The Office of National Drug Control Policy (ONDCP) is responsible for 

overseeing and coordinating the implementation of U.S. drug policy, 

including developing the National Drug Control Strategy (Strategy). 

ONDCP released the 2019 Strategy on January 31, 2019. The Strategy 

focuses on approaches related to prevention, treatment and recovery, 

and steps to reduce the availability of illicit drugs in the United States. We 

will continue to monitor the extent to which ONDCP and other federal 

agencies are employing a risk management and coordinated approach to 

their efforts to limit drug misuse. 

Emerging Issue Requiring 

Close Attention: Federal 

Efforts to Prevent Drug 

Misuse
Page 25 GAO-19-157SP High-Risk Series 

In particular, we have ongoing and planned work to assess ONDCP’s 

operations, including its (1) leadership and coordination of efforts across 

the federal government; (2) the effects of the drug crisis on labor force 

participation and productivity and on people with disabilities and other 

vulnerable populations; (3) key federal efforts to reduce the availability of 

illicit drugs; and (4) agency efforts around drug education and prevention. 

We will determine whether this issue should be added to the High-Risk 

List once we have completed this ongoing and planned work.

Agencies can show progress by addressing our five criteria for removal 

from the list: leadership commitment, capacity, action plan, monitoring, 

and demonstrated progress.6 As shown in table 3, 24 high-risk areas, or 

about two-thirds of all the areas, have met or partially met all five criteria 

for removal from our High-Risk List; 20 of these areas fully met at least 

one criterion. Compared with our last assessment, 7 high-risk areas 

showed progress in one or more of the five criteria without regressing in 

any of the criteria. Ten high-risk areas have neither met nor partially met 

one or more criteria. Two areas showed mixed progress by increasing in 

at least one criterion and also declining in at least one criterion. Three 

areas declined since 2017. These changes are indicated by the up and 

down arrows in table 3. 

Table 3: 2017 High-Risk Areas Rated Against Five Criteria for Removal from GAO’s High-Risk List

Number of criteria

High-risk area Change 

since 2017

Met Partially 

met

Not met

Department of Defense (DOD) Supply Chain Management  5 0 0

Mitigating Gaps in Weather Satellite Data  5 0 0

DOD Support Infrastructure Management  2 3 0

Medicare Program & Improper Paymentsa  2 3 0

DOD Financial Management  1 3 1

DOE’s Contract Management for the National Nuclear Security Administration and 

Office of Environmental Management

 1 3 1

DOD Business Systems Modernization  0 5 0

DOD Approach to Business Transformation  1 4 0

USPS Financial Viability  1 3 1

 

6

Additional detail on our high-risk criteria and ratings is in appendix I. 

High-Risk Areas That 

Made Progress
Page 26 GAO-19-157SP High-Risk Series 

Number of criteria

High-risk area Change 

since 2017

Met Partially 

met

Not met

NASA Acquisition Management  1 4 0

Transforming the Environmental Protection Agency’s (EPA) Processes for 

Assessing and Controlling Toxic Chemicals

 0 5 0

Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate 

Change Risks

 0 3 2

Strengthening Department of Homeland Security Management Functions ● 3 2 0

DOD Contract Management ● 1 4 0

DOD Weapon Systems Acquisition ● 1 4 0

Enforcement of Tax Laws ● 1 4 0

Ensuring the Cybersecurity of the Nation ● 1 4 0

Improving the Management of IT Acquisitions and Operations ● 1 4 0

Managing Federal Real Property ● 1 4 0

Protecting Public Health through Enhanced Oversight of Medical Products ● 1 4 0

Strategic Human Capital Management ● 1 3 1

Ensuring the Effective Protection of Technologies Critical to U.S. National Security 

Interests

● 0 5 0

Improving and Modernizing Federal Disability Programs ● 0 5 0

Management of Federal Oil and Gas Resources ● 0 5 0

Modernizing the U.S. Financial Regulatory System ● 0 5 0

National Flood Insurance Program ● 0 5 0

Strengthening Medicaid Program Integrity ● 0 5 0

Resolving the Federal Role in Housing Finance ● 0 4 1

Improving Federal Oversight of Food Safety ● 0 3 2

Managing Risks and Improving VA Health Care ● 0 2 3

2020 Decennial Censusb 1 4 0

Government-wide Personnel Security Clearance Processb 1 3 1

Improving Federal Management of Programs that Serve Tribes and Their Membersb 0 5 0

U.S. Government’s Environmental Liabilityb 0 1 4

Funding the Nation’s Surface Transportation Systemc

Pension Benefit Guaranty Corporation Insurance Programsc

( indicates one or more areas progressed;  indicates one or more areas declined since 2017;   indicates mixed progress; ● indicates no change) 

Source: GAO. | GAO-19-157SP

a

Medicare Program & Improper Payments was only rated on the Improper Payments program; we did 

not rate other elements of the Medicare program because the area is subject to frequent legislative 

updates and the program is in a state of transition. 

b

Four areas are receiving ratings for the first time because they were newly added in 2017 and 2018. 

c

Two high-risk areas were not rated because addressing them primarily involves congressional action 

(Funding the Nation’s Surface Transportation System and Pension Benefit Guaranty Corporation 

Insurance Programs). 
Page 27 GAO-19-157SP High-Risk Series 

Figure 3 shows that since our 2017 update, the most progress was made 

on the action plan criterion—four high-risk areas received higher ratings. 

We rated two areas lower on leadership commitment and two areas lower 

on monitoring.

Figure 3: High-Risk Areas’ Progress and Regress on High-Risk Criteria Since 2017

Table 4 shows that 17 of the 34 high-risk areas we rated have met the 

leadership commitment criterion while two high-risk area ratings 

regressed on leadership commitment from met to partially met since our 

last report. 

Leadership commitment is the critical element for initiating and sustaining 

progress, and leaders provide needed support and accountability for 

managing risks. Leadership commitment is needed to make progress on 

Leadership Attention 

Needed to Meet High-Risk 

Criteria
Page 28 GAO-19-157SP High-Risk Series 

the other four high-risk criteria. Table 4 shows that only three high-risk 

areas met the criterion for capacity, six met the criterion for action plan, 

and two met the criterion for demonstrated progress. One high-risk 

area—U.S. Government’s Environmental Liability—has partially met only 

one criterion since we added the area to our list in 2017 and the rest are 

not met.

Table 4: 2019 High-Risk Area Ratings on Five Criteria for Removal from GAO’s High-Risk List

Criteria

High-risk area Leadership 

commitment

Capacity Action

plan

Monitoring Demonstrated 

progress

Department Of Defense (DOD) Supply Chain Management 3 3 3 3 3 5 

Mitigating Gaps in Weather Satellite Data 3 3 3 3 3 5 

Strengthening Department of Homeland Security 

Management Functions

3 2 3 3 2 3 

Medicare Program & Improper Paymentsa

3 3 2 2 2 2.1

DOD Support Infrastructure Management 3 2 3 2 2 2 

2020 Decennial Census 3 2 2 2 2 1.8

DOD Contract Management 3 2 2 2 2 1.4

DOD Weapon Systems Acquisition 3 2 2 2 2 1.4

Enforcement of Tax Laws 3 2 2 2 2 1.4

Ensuring the Cybersecurity of the Nation 3 2 2 2 2 1.4

Improving the Management of Information Technology 

Acquisitions and Operations

3 2 2 2 2 1.4

Managing Federal Real Property 3 2 2 2 2 1.4

Protecting Public Health through Enhanced Oversight of 

Medical Products

DOD Approach to Business Transformation

NASA Acquisition Management

DOD Financial Management

Strategic Human Capital Management
Page 29 GAO-19-157SP High-Risk Series 

Criteria

High-risk area Leadership 

commitment

Capacity Action

plan

Monitoring Demonstrated 

progress

Government-wide Personnel Security Clearance Process

DOE’s Contract Management for the National Nuclear 

Security Administration and Office of Environmental 

Management

USPS Financial Viability

DOD Business Systems Modernization

Ensuring the Effective Protection of Technologies Critical to 

U.S. National Security Interests

Improving and Modernizing Federal Disability Programs

Improving Federal Management of Programs that Serve 

Tribes and Their Members

Management of Federal Oil and Gas Resources

Modernizing the U.S. Financial Regulatory System

National Flood Insurance Program

Strengthening Medicaid Program Integrity

Transforming the Environmental Protection Agency’s (EPA) 

Processes for Assessing and Controlling Toxic Chemicals

Resolving the Federal Role in Housing Finance

Limiting the Federal Government’s Fiscal Exposure by 

Better Managing Climate Change Risks

Improving Federal Oversight of Food Safety

Managing Risks and Improving VA Health Care

U.S. Government’s Environmental Liability

Legend: Met Partially Met Not Met 

Source: GAO. | GAO-19-157SP

Notes: Two high-risk areas—Funding the Nation’s Surface Transportation System and Pension 

Benefit Guaranty Corporation Insurance Programs—did not receive ratings against the five high-risk 

criteria because progress would primarily involve congressional action. 

a

Medicare Program & Improper Payments was only rated on the Improper Payments , and we did not 

rate other elements of the Medicare program 
Page 30 GAO-19-157SP High-Risk Series 

As noted, seven areas showed improvement in one or more criterion 

without regressing in any criteria. Two areas showed sufficient progress 

to be removed from the High-Risk List. The other five high-risk areas 

remaining on the 2019 list demonstrated improvement and are described 

below. Three of these five improving high-risk areas are the responsibility 

of the Department of Defense (DOD)—DOD Support Infrastructure 

Management, DOD Financial Management, and DOD Business Systems 

Modernization. The two other improving areas are Department of 

Energy’s (DOE's) Contract Management for the National Nuclear Security 

Administration and Office of Environmental Management, and Medicare 

Program & Improper Payments.

• DOD Support Infrastructure Management: DOD manages a portfolio of 

real property assets that, as of fiscal year 2017, reportedly included about 

586,000 facilities—including barracks, maintenance depots, 

commissaries, and office buildings. The combined replacement value of 

this portfolio is almost $1.2 trillion and includes about 27 million acres of 

land at nearly 4,800 sites worldwide. This infrastructure is critical to 

maintaining military readiness, and the cost to build and maintain it 

represents a significant financial commitment. Since our 2017 High-Risk 

Report, DOD’s rating for two criteria—leadership commitment and action 

plan—improved from partially met to met. 

DOD has demonstrated leadership commitment by stating its commitment 

to addressing key recommendations we have made by, for example, (1) 

better forecasting the initial Base Realignment and Closure (BRAC) costs 

for military construction, IT, and relocating military personnel and 

equipment; (2) better aligning infrastructure to DOD force structure needs 

by, for example, improving the accuracy and sufficiency of its excess 

capacity estimates; and (3) pursuing an effort to consolidate and 

standardize leases, which includes analyzing whether it is feasible to 

relocate functions from commercial leased space to existing space on an 

installation, thereby reducing leases and better utilizing excess space. 

DOD has developed action plans to better identify excess infrastructure 

and thus be positioned to dispose of it. For example, in the 2017 HighRisk Report, we stated that DOD’s Real Property Efficiency Plan includes 

DOD’s goals for reducing the footprint of its real property inventory and 

metrics to gauge progress, to be implemented by the end of 2020. We 

also found in 2018 that DOD was achieving cost savings and cost 

avoidances as it had begun using intergovernmental support agreements 

between military installations and local governments to obtain installation 

services, such as waste removal, grounds maintenance, and stray animal 

control. As a result of these and other actions, DOD now meets the action 

plan criterion for this high-risk area.

Progress in High-Risk 

Areas
Page 31 GAO-19-157SP High-Risk Series 

As of December 2018, 23 recommendations related to this high-risk area 

remain open. DOD continues to partially meet the criteria for capacity, 

monitoring, and demonstrated progress.

See appendix II for additional detail on this high-risk area, including more 

details on actions that need to be taken.

• DOD Financial Management: Since our 2017 High-Risk Report, ratings 

for the DOD Financial Management high-risk area improved for the 

criteria of leadership commitment and monitoring. For the leadership 

commitment criterion, the high-risk area rating improved from partially met 

to met in 2019 due to several DOD leadership actions. For example, in 

2018, DOD leadership met the goal of undergoing an agency-wide 

financial statement audit and established a process to remediate any 

audit findings—ultimately to improve the quality of financial information 

that is most valuable in managing the department’s day-to-day 

operations. In addition, according to a DOD official, audit remediation 

efforts have produced benefits in certain inventory processes that have 

led to operational improvements. 

DOD leadership demonstrated its commitment to making needed 

improvements by developing a database that tracks hundreds of findings 

and recommendations that came out of the audits. In addition, senior 

leadership has been meeting bimonthly with military services’ leadership 

for updates on the status of corrective action plans to address audit 

findings and recommendations, and the Under Secretary of Defense 

(Comptroller) has been meeting frequently with the Secretary of Defense 

to review the plans.

These same DOD actions also led to the high-risk area’s rating for the 

criterion of monitoring to improve from not met to partially met. For 

example, the database mentioned above is intended to capture, prioritize, 

and assign responsibility for auditor findings and related corrective action 

plans, which are meant to be used to measure progress towards 

achieving a clean audit opinion. 

Further, DOD leadership has held frequent meetings to discuss the status 

of corrective action plans. In addition, DOD also established councils in 

certain areas (e.g., financial reporting) to review the status of audit 

remediation activities and challenges. All of these actions demonstrate an 

improvement in DOD’s monitoring activities for its financial management 

function.

However, DOD’s efforts to improve its financial management continue to 

be impaired by long-standing issues—including its decentralized 

environment; cultural resistance to change; lack of skilled financial 
Page 32 GAO-19-157SP High-Risk Series 

management staff; ineffective processes, systems, and controls; 

incomplete corrective action plans; and the need for more effective 

monitoring and reporting. DOD remains one of the few federal entities 

that cannot accurately account for and report on its spending or assets. 

As of December 2018, 53 recommendations for this high-risk area are 

open. The DOD Financial Management high-risk area continues to 

partially meet the capacity and action plan criteria and not meet the 

demonstrated progress criterion. 

See appendix II for additional detail on this high-risk area, including more 

details on actions that need to be taken.

• DOD Business Systems Modernization: DOD spends billions of dollars 

each year to acquire modernized systems, including systems that 

address key areas such as personnel, financial management, health care, 

and logistics. This high-risk area includes three critical challenges facing 

DOD: (1) improving business system acquisition management, (2) 

improving business system investment management, and (3) leveraging 

DOD’s federated business enterprise architecture. 

DOD’s capacity for modernizing its business systems has improved over 

time and, since our 2017 High-Risk Report, DOD’s overall rating for the 

criterion of action plan improved from not met to partially met in 2019. 

DOD established a plan for improving its federated business enterprise 

architecture (i.e., description of DOD’s current and future business 

environment and a plan for transitioning to the future environment). 

Specifically, the rating improved for DOD’s federated business enterprise 

architecture segment of the high-risk area because DOD’s assistant 

deputy chief management officer approved a business architecture 

improvement plan in January 2017. 

Since 2017, we have made 10 recommendations related to this high-risk 

issue. As of December 2018, 27 recommendations are open. The 

leadership, capacity, monitoring, and demonstrated progress criteria 

remain partially met as in 2017.

See appendix II for additional detail on this high-risk area, including more 

details on actions that need to be taken.

• DOE's Contract Management for the National Nuclear Security 

Administration and Office of Environmental Management: DOE 

oversees a broad range of programs related to nuclear security, science, 

energy, and waste cleanup, among other areas. As the largest civilian 

contracting agency in the federal government, DOE relies primarily on 

contractors to carry out its programs. For instance, DOE spends about 90 
Page 33 GAO-19-157SP High-Risk Series 

percent of its annual budget on contracts and acquiring capital assets. In 

fiscal year 2018, DOE’s budget was $34.5 billion.

The high-risk area focuses on contracts, as well as major projects—those 

with an estimated cost of $750 million or greater—managed by DOE’s 

National Nuclear Security Administration (NNSA) and Office of 

Environmental Management (EM).

Since our 2017 High-Risk Report, DOE has made progress by improving 

from a not met to a partially met rating for the demonstrated progress 

criterion. Specifically, through its Office of Cost Estimating and Program 

Evaluation, NNSA has enhanced its capability to estimate costs and 

schedules, and to assess alternatives for programs and projects, among 

other things. NNSA also made progress by adopting best practices in 

several areas, such as those for estimating costs and schedules in 

nuclear weapons refurbishment activities and capital asset acquisitions. 

For example, we determined that DOE’s revised cost estimate of $17.2 

billion to construct a Mixed Oxide Fuel Fabrication Facility to dispose of 

surplus, weapons-grade plutonium substantially met best practices—

providing assurance that the estimated costs could be considered 

reliable. This finding contributed to DOE’s reevaluation of the project and 

ultimate termination, in October 2018, in favor of a potentially less costly 

disposal approach.

Fifty-one of our recommendations were open as of December 2018; 15 

recommendations were made since the last high-risk update in February 

2017. DOE continues to meet the criterion of leadership commitment, 

partially meet the criteria for action plan and monitoring, and not meet the 

criterion for capacity.

See appendix II for additional detail on this high-risk area, including more 

details on actions that need to be taken.

• Medicare Program & Improper Payments: In calendar year 2017, 

Medicare, which is overseen by the Centers for Medicare & Medicaid 

Services (CMS), financed $702 billion worth of health services for 

approximately 58 million elderly and disabled beneficiaries. Medicare 

faces a significant risk with improper payments—payments that either 

were made in an incorrect amount or should not have been made at all—

which reached an estimated $48 billion in fiscal year 2018. 

Since our 2017 High-Risk Report, estimated improper payment rates 

declined more than one percent across the Medicare program. In 

addition, CMS’ rating for the capacity criterion of the improper payments 

segment improved from partially met to met in 2019 due to several 

actions. First, the Center for Program Integrity’s (CPI) budget and 
Page 34 GAO-19-157SP High-Risk Series 

resources have increased over time and the agency has established work 

groups and interagency collaborations to extend its capacity. For 

example, CMS allocated more staff to CPI after Congress provided 

additional funding. CPI’s full-time equivalent positions increased from 177 

in 2011 to 419 in 2017. 

Additionally, in August 2017, we reported that CMS’s Fraud Prevention 

System, which analyzes claims to identify health care providers with 

suspect billing patterns, helped speed up certain fraud investigation 

processes. Further, the Healthcare Fraud Prevention Partnership helped 

improve information sharing among payers inside and outside of the 

government.

Since 1990, when we added Medicare to our High-Risk List, we have 

made many recommendations related to the Medicare program, 28 of 

which were made since the last high-risk update in February 2017. As of 

December 2018, more than 80 recommendations remain open. CMS 

continues to meet the criterion of leadership commitment and to partially 

meet the remaining three criteria of action plan, monitoring, and 

demonstrated progress.

See appendix II for additional detail on this high-risk area, including more 

details on actions that need to be taken.

Congress enacted several laws since our last report in February 2017 to 

help make progress on high-risk issues. Table 5 lists selected examples 

of congressional actions taken on high-risk areas.

Congressional Action 

Aided Progress on HighRisk Issues
Page 35 GAO-19-157SP High-Risk Series 

Table 5: Examples of Congressional Actions Taken on High-Risk Areas

High-risk area Congressional actions taken How GAO work contributed to 

congressional actions

Impact on high-risk area

Department of Defense 

(DOD) Approach to 

Business 

Transformation

Section 901(c) of the National 

Defense Authorization Act (NDAA) for 

Fiscal Year 2017 created the position 

of Chief Management Officer (CMO) 

within DOD, effective February 1, 

2018.a

The 2016 passage of the NDAA 

is consistent with our February 

2005 report, in which we 

identified the need for DOD to 

have a full-time CMO position 

created through legislation, with 

responsibility, authority, and 

accountability for DOD’s overall 

business transformation efforts. 

Based on congressional 

direction, DOD established and 

is beginning to restructure its 

CMO office to fulfill its 

responsibilities given by 

Congress. Continued leadership 

commitment at the highest 

levels will help sustain focus on 

this business transformation. 

The longer this critical position 

is filled by someone in an acting 

capacity, the greater the risk 

that DOD’s transformation 

efforts could be impacted. 

(Leadership commitment) 

Improving the 

Management of 

Information Technology 

(IT) Acquisitions and 

Operations

Subtitle G of title X of the NDAA for 

Fiscal Year 2018 established a 

Technology Modernization Fund and 

Board, and allowed agencies to 

establish agency information 

technology system modernization and 

working capital funds.b

 

We identified the need to better 

manage the billions of dollars 

the federal government spends 

annually on legacy IT when we 

added this area to the High-Risk 

List in 2015. We further 

examined the government’s 

heavy reliance on legacy IT 

systems in our 2016 report.

These provisions (1) allowed 

agencies to establish working 

capital funds for use in 

transitioning away from legacy 

IT systems and (2) created a 

technology modernization fund 

to help agencies retire and 

replace legacy systems, as well 

as acquire or develop new 

systems. (Capacity) 

Government-wide 

Personnel Security 

Clearance Process

Section 925(k) of the NDAA for Fiscal 

Year 2018 requires the Director of 

National Intelligence, in coordination 

with the Chair and other principals of 

the Suitability, Security, and 

Credentialing Performance 

Accountability Council, to provide an 

annual assessment of any 

impediments to the timely processing 

of personnel security clearances.c 

The 2017 passage of the NDAA 

is consistent with our December 

2017 report, in which we asked 

Congress to consider both 

reinstating and adding to the 

requirement in the Intelligence 

Reform and Terrorism 

Prevention Act of 2004 for the 

executive branch to report to 

appropriate congressional 

committees annually on its 

background investigation 

process. 

Annual assessments will help 

Congress monitor the timeliness 

of the executive branch’s 

background investigations to 

monitor its own timeliness. The 

act requires the executive 

branch to report the length of 

time for initiating and conducting 

investigations and finalizing 

adjudications, and case load 

composition and costs, among 

other matters deemed relevant 

by Congress. (Monitoring) 
Page 36 GAO-19-157SP High-Risk Series 

High-risk area Congressional actions taken How GAO work contributed to 

congressional actions

Impact on high-risk area

Mitigating Gaps in 

Weather Satellite Data

Provisions of the NDAA for Fiscal 

Year 2015 limited the availability of 

certain funds until the Secretary of 

Defense submitted to congressional 

defense committees a plan related to 

weather satellites.d Similarly, the 

NDAA for Fiscal Year 2016 limited the 

availability of certain funds until (1) 

the Secretary of Defense briefed the 

congressional defense committees on 

a plan for cloud characterization and 

theater weather imagery, and (2) the 

Chairman of the Joint Chiefs of Staff 

certified to the committees that the 

plan would meet DOD requirements 

without negatively affecting 

commanders of combatant 

commands.e 

We found that DOD was slow to 

establish plans for its Weather 

System Follow-on–Microwave 

program in our 2017 High-Risk 

Report. We also found it had 

made little progress in 

determining how it would meet 

weather satellite requirements 

for cloud descriptions and areaspecific weather imagery. 

These provisions (1) 

encouraged DOD to develop 

and implement plans to address 

its weather satellite 

requirements and (2) helped 

Congress monitor DOD plans 

and actions to address these 

requirements. (Action plan) 

Limiting the Federal 

Government’s Fiscal 

Exposure by Better 

Managing Climate 

Change Risks

Section 1234(a)(5) of the Disaster 

Recovery Reform Act of 2018 allows 

the President to set aside, with 

respect to each major disaster, a 

percentage of certain grants to use 

for pre-disaster hazard mitigation. 

Section 1206(a)(3) makes federal 

assistance available to state and local 

governments for building code 

administration and enforcement.f

We found that federal 

investments in resilience could 

be more effective if postdisaster hazard mitigation 

efforts were balanced with 

resources for pre-disaster 

hazard mitigation, as part of a 

comprehensive resilience 

investment strategy. We also 

found that enhancing state and 

local disaster resilience could 

help reduce federal fiscal 

exposure. 

These provisions could improve 

state and local resilience to 

disasters by increasing the 

amount of funding available for 

pre-disaster hazard mitigation 

and increasing state and local 

adoption and enforcement of 

the latest building codes. 

(Capacity) 

Ensuring the 

Cybersecurity of the 

Nation

An explanatory statement 

accompanying the Consolidated 

Appropriations Act, 2018 directed the 

National Protection and Programs 

Directorate to brief the appropriations 

committees on its specific plans to 

address GAO recommendations 

including the National Cybersecurity 

and Communications Integration 

Center’s (NCCIC) implementation of 

the recommendations for ensuring 

that it fulfills its statutory functions, 

such as sharing information about 

cyber threats, by timely reporting 

information that is relevant and 

actionable, and establishing 

appropriate performance metrics.g

We reported that NCCIC had 

taken steps to perform each of 

the Department of Homeland 

Security’s (DHS) statutorily 

required cybersecurity 

functions. However, the extent 

to which NCCIC performed the 

actions was unclear, in part,

because the center had not yet 

established metrics and 

methods by which to evaluate 

its performance.

As of January 2019, DHS had 

fully addressed two of the nine 

recommendations we made to 

enhance the effectiveness and 

efficiency of NCCIC, and had 

taken initial actions toward 

addressing several others. 

(Demonstrated progress) 
Page 37 GAO-19-157SP High-Risk Series 

High-risk area Congressional actions taken How GAO work contributed to 

congressional actions

Impact on high-risk area

Managing Risks and 

Improving VA Health 

Care

The No Veterans Crisis Line Call 

Should Go Unanswered Act directs 

the Department of Veterans Affairs 

(VA) to develop a quality assurance 

document for carrying out the toll-free 

Veterans Crisis Line, and requires VA 

to develop a plan to ensure that each 

telephone call, text message, and 

other communication received is 

answered in a timely manner.h

About 6 months prior to the 

passage of this legislation, our 

May 2016 report identified the 

need for VA to take several 

steps to better test, track, and 

assess the performance of the 

Veterans Crisis Line in order to 

improve the timeliness and 

quality of its responses to 

veterans and others.

In July 2017, VA updated a 

quality assurance plan with 

measurable targets and time 

frames for key performance 

indicators needed to assess 

Veterans Crisis Line 

performance. VA also 

established an Executive 

Leadership Council in March 

2017 to monitor data on the key 

performance indicators. These 

two actions will assist with the 

oversight and accountability of 

the Veterans Crisis Line, and 

the services provided to

veterans. (Leadership 

commitment, Action plan, and 

Monitoring) 

Improving Federal 

Management of 

Programs that Serve 

Tribes and Their 

Members

An explanatory statement 

accompanying the Consolidated 

Appropriations Act, 2018 directed the 

Indian Health Service (IHS) to report 

to the appropriations committees on 

the status of its efforts on improving 

wait times for patients seeking 

primary and urgent care, including an 

explanation of how these efforts will 

address GAO recommendations.i 

We found that IHS had not 

conducted any systematic, 

agency-wide oversight of the 

timeliness of primary care in its 

federally operated facilities and 

recommended that IHS 

communicate specific agencywide standards for patient wait 

times; monitor patient wait 

times; and ensure corrective 

actions are taken when 

standards are not met.

IHS developed specific 

standards for patient wait times 

and developed a plan and 

timeline for implementing an 

agency-wide standard for 

patient wait times. It is also in 

the process of updating its 

patient wait time policy to 

include emergency department 

wait times and developing 

automated data collection for 

wait times. (Leadership 

commitment, Action plan, 

Monitoring) 

Source: GAO analysis. | GAO-19-157SP

a

Pub. L. No. 114-328, § 901(c), 130 Stat. 2000, 2341 (2016). 

b

Pub. L. No. 115-91, §§ 1076–1078, 131 Stat. 1283, 1586–1594 (2017).

c

Pub. L. No. 115-91, § 925(k)(1)(F), (3)(I), 131 Stat. 1283, 1530, 1532 (2017). 

d

Carl Levin and Howard P. “Buck” McKeon National Defense Authorization Act for Fiscal Year 2015, 

Pub. L. No. 113-291, § 1612, 128 Stat. 3292, 3628 (2014). 

e

National Defense Authorization Act for Fiscal Year 2016, Pub. L. No. 114-92, § 1615, 129 Stat. 726, 

1105 (2015). 

f

FAA Reauthorization Act of 2018, Pub. L. No. 115-254, div. D, §§ 1206(a)(3), 1234(a)(5) 132 Stat. 

3186, 3440, 3462 (2018). 

g

Chairman Rodney P. Frelinghuysen of the Committee on Appropriations of the House of 

Representatives filed an explanatory statement relating to the House amendment of H.R. 1625 in the 

Congressional Record on March 22, 2016. 164 Cong. Rec. H2045, H2557. Section 4 of the 

Consolidated Appropriations Act, 2018, states that this explanatory statement shall have the same 

effect with respect to the allocation of funds and implementation of divisions A through L of the act as 

if it were a joint explanatory statement of a committee of conference. Pub. L. No. 115-141, § 4, 132 

Stat. 348, 350 (2018). 

h

Pub. L. No. 114-247, 130 Stat. 996 (2016). 
Page 38 GAO-19-157SP High-Risk Series 

i

Chairman Rodney P. Frelinghuysen of the Committee on Appropriations of the House of 

Representatives filed an explanatory statement relating to the House amendment of H.R. 1625 in the 

Congressional Record on March 22, 2016. 164 Cong. Rec. H2045, H2628. Section 4 of the 

Consolidated Appropriations Act, 2018, states that this explanatory statement shall have the same 

effect with respect to the allocation of funds and implementation of divisions A through L of the act as 

if it were a joint explanatory statement of a committee of conference. Pub. L. No. 115-141, § 4, 132 

Stat. 348, 350 (2018). 

Congressional oversight also plays a vital role in addressing high-risk 

issues. For example, at a May 2018 hearing, we testified that the Census 

Bureau’s (Bureau) cost estimate was not reliable, and that the actual cost 

could be higher than planned.7 Further, the Secretary of Commerce 

created a dedicated team to provide oversight and guidance to the 

Bureau on cost estimation. 

In addition to its instrumental role in supporting progress in individual 

high-risk areas, Congress also enacted the following statutes that, if 

implemented effectively, will help foster progress on high-risk issues 

government-wide:

• Fraud Reduction and Data Analytics Act of 2015 (FRDAA):8 FRDAA 

is intended to strengthen federal antifraud controls. FRDAA requires 

OMB to use our Fraud Risk Framework9 to create guidelines for federal 

agencies to identify and assess fraud risks, and then design and 

implement control activities to prevent, detect, and respond to fraud. 

Agencies, as part of their annual financial reports beginning in fiscal year 

2017, are further required to report on their fraud risks and their 

implementation of fraud reduction strategies, which should help Congress 

monitor agencies’ progress in addressing and reducing fraud risks. 

To aid federal agencies in better analyzing fraud risks, FRDAA requires 

OMB to establish a working group tasked with developing a plan for 

creating an interagency library of data analytics and data sets to facilitate 

the detection of fraud and the recovery of improper payments. This 

working group and the library should help agencies coordinate their fraud 

detection efforts and improve their ability to use data analytics to monitor 

databases for potential improper payments. The billions of dollars in 

improper payments, some of which may be a result of fraud, are a central 

 

7

GAO, 2020 Census: Actions Needed to Mitigate Key Risks Jeopardizing a Cost-Effective 

and Secure Enumeration, GAO-18-543T (May 8, 2018). 

8

Pub. L. No. 114-186, 130 Stat. 546 (2016).

9

GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP

(Washington, D.C.: July 2015). 
Page 39 GAO-19-157SP High-Risk Series 

part of the Medicare Program, Medicaid Program, and Enforcement of 

Tax Laws (Earned Income Tax Credit) high-risk areas.

We reported in 2018 that, among other things, OMB did not involve all 

agencies subject to the act as required by FRDAA or hold the required 

minimum number of working-group meetings in 2017.10 As shown in 

figure 4, a majority of the 72 agencies surveyed indicated a lack of 

involvement with and information from the working group as challenges in 

implementing FRDAA. We made three recommendations, including that 

OMB ensure the working group meets FRDAA’s requirements to involve 

all agencies that are subject to the act and ensure that mechanisms to 

share controls, best practices, and data-analytics techniques are in place. 

OMB did not concur with our recommendations. We continue to believe 

the recommendations are valid, as discussed in the 2018 report.

Figure 4: Percentage of Agencies That Identified Their Involvement with the Fraud Reduction and Data Analytics Act of 2015 

Working Group as a Great or Moderate Challenge

 

10GAO, Fraud Risk Management: OMB Should Improve Guidelines and Working-Group 

Efforts to Support Agencies’ Implementation of the Fraud Reduction and Data Analytics 

Act, GAO-19-34 (Washington, D.C.: December 4, 2018).
Page 40 GAO-19-157SP High-Risk Series 

• IT Acquisition Reform, statutory provisions known as the Federal 

Information Technology Acquisition Reform Act (FITARA):11 FITARA, 

enacted in December 2014, was intended to improve how agencies 

acquire IT and better enable Congress to monitor agencies’ progress in 

reducing duplication and achieving cost savings. Since the enactment of 

these provisions, OMB and federal agencies have paid greater attention 

to IT acquisition and operation, resulting in improvements to the 

government-wide management of this significant annual investment. 

These efforts have been motivated in part by sustained congressional 

support for improving implementation of this law, as highlighted in

agencies’ FITARA implementation scores issued biannually by the House 

Committee on Oversight and Reform. 

This continuing oversight has produced positive results. For example, in 

the committee’s December 2018 FITARA implementation scorecard, 18 

of the 24 major federal agencies received the highest possible rating for 

their efforts to improve the management of software licenses, of which we 

have found there are thousands annually across the government. Seven 

months earlier, in the prior scorecard, only eight agencies had achieved 

this rating. Moreover, federal agencies have taken actions to address 106 

of the 136 related recommendations that we have made in this area since 

2014.

FITARA includes specific requirements related to seven areas: the federal 

data center consolidation initiative, enhanced transparency and improved 

risk management, agency Chief Information Officer authority 

enhancements, portfolio review, expansion of training and use of IT 

acquisition cadres, government-wide software purchasing, and 

maximizing the benefit of the federal strategic sourcing initiative. 

In November 2017, Congress extended or removed the sunset dates of 

several of these statutory requirements that were originally to end in 2018 

and 2019.12 While all of the 24 federal agencies covered by this law have 

developed FITARA implementation plans, the agencies need to 

effectively execute these plans. Successfully addressing FITARA 

requirements is central to making progress in Improving the Management 

of IT Acquisitions and Operations, which has been on our High-Risk List 

since 2015.

 

11FITARA was enacted into law as part of the Carl Levin and Howard P. “Buck” McKeon 

National Defense Authorization Act for Fiscal Year 2015, Pub. L. No. 113-291 (2014), div. 

A, title VIII, subtitle D, §§ 831-837, 128 Stat. 3292, 3438-3450.

12FITARA Enhancement Act of 2017, Pub. L. No. 115-88, 131 Stat. 1278 (2017).
Page 41 GAO-19-157SP High-Risk Series 

• Program Management Improvement Accountability Act (PMIAA):13

Enacted in December 2016, the act is intended to improve program and 

project management in certain larger federal agencies. Among other 

things, the act requires the Deputy Director for Management of OMB to 

adopt and oversee implementation of government-wide standards, 

policies, and guidelines for program and project management in executive 

agencies. The act also requires the Deputy Director to conduct portfolio 

reviews to address programs we identify as high-risk. It further creates a 

Program Management Policy Council to act as the principal interagency 

forum for improving practices related to program and project 

management. The council is to review programs identified as high-risk 

and make recommendations to the Deputy Director or designee.

OMB has produced a general strategy for implementing the law through 

2022 and met some initial milestones required by PMIAA. For example, in 

June 2018, OMB issued OMB Memorandum M-18-19, which includes: (1) 

agency guidance for implementing PMIAA, (2) a five-year strategic outline 

for improving program and project management, and (3) initial program 

management standards and principles.14 Further, agencies have 

designated Program Management Improvement Officers to guide their 

implementation of PMIAA.

According to OMB, it began implementing PMIAA’s requirement to 

conduct portfolio reviews on high-risk areas by requiring relevant 

agencies to provide several items for discussion during the 2018 Strategic 

Review meetings. These annual meetings are to consist primarily of a 

discussion of agency progress towards each of the strategic objectives

outlined in their strategic plans, but also cover other management topics 

such as enterprise risk management and high-risk area progress. 

According to OMB documents, in advance of these meetings, OMB 

required agencies to provide a high-level summary of (1) any 

disagreements with our recommendations, (2) progress barriers, and (3) 

actions needed by OMB, other agencies, or Congress to help the agency 

achieve progress towards removal from our High-Risk List. 

OMB officials told us their 2018 Strategic Review meetings did not 

address each high-risk area but did address government-wide high-risk 

areas, such as cybersecurity, information technology, and strategic 

human capital as they related to the President’s Management Agenda.

 

13Pub. L. No. 114-264, 130 Stat. 1371 (2016).

14Office of Management and Budget, Improving the Management of Federal Programs 

and Projects through Implementing the Program Management Improvement Accountability 

Act (PMIAA), OMB Memorandum M-18-19 (Washington, D.C.: June 25, 2018).
Page 42 GAO-19-157SP High-Risk Series 

In the past, senior management officials from OMB, applicable agencies, 

and our agency have met to address areas where additional management 

attention could be beneficial to high-risk issues. These trilateral meetings, 

beginning in 2007 and pre-dating PMIAA’s 2016 enactment, have 

continued across administrations. 

However, OMB has organized only one of these high-risk meetings since 

the last high-risk update in 2017, on the Government-wide Personnel 

Security Clearance Process. In November 2018, OMB told us of plans to 

hold additional meetings on priority high-risk areas, including the 2020 

Decennial Census, Strategic Human Capital Management, Ensuring the 

Cybersecurity of the Nation, National Aeronautics and Space 

Administration (NASA) Acquisition Management, and Managing Federal 

Real Property. 

Effective implementation of PMIAA provides an important opportunity to 

enhance progress on high-risk areas by focusing leadership attention 

through the portfolio reviews and trilateral meetings. Further, a number of 

high-risk areas have longstanding or significant program and project 

management concerns, including the acquisition-related high-risk areas 

for DOD, DOE, NASA, and VA. These and other programs can benefit 

from improving program and project management. In December 2019, we 

will report on OMB’s progress in implementing PMIAA, including what 

further steps it has taken to use the portfolio review process required in 

PMIAA to address issues on our High-Risk List.

Agency leaders took actions to implement our recommendations. These 

resulted in numerous improvements to programs and operation and 

improved service. Further, these actions to implement our 

recommendations resulted in significant financial benefits. Table 6 shows 

some examples of the financial benefits achieved since our last High-Risk 

Report.

Executive Branch Action 

on Our Recommendations 

Aided Progress on HighRisk Issues
Page 43 GAO-19-157SP High-Risk Series 

Table 6: Examples of GAO High-Risk Area Recommendations Leading to Financial Benefits

High-risk area GAO recommendations leading to financial 

benefits

Financial benefits achieved

Strengthening Medicaid 

Program Integrity

In multiple reports, we found that demonstration 

spending limits approved by the Department of Health 

and Human Services (HHS) often were not budget 

neutral, as required by HHS policy. This increased the 

federal government’s fiscal liability by billions of 

dollars. We recommended that HHS better ensure that 

valid methods are used to determine spending limits. 

HHS responded by limiting the amount of 

unspent funds states may accrue and 

reducing the federal government’s fiscal 

liability. As a result, the Centers for 

Medicare & Medicaid Services was able to 

identify a total of $23.5 billion in financial 

benefits for fiscal year (FY) 2017.

Improving the Management of 

Information Technology (IT) 

Acquisitions and Operations

In multiple reports, we made recommendations for 

improving the management of IT portfolios, which 

resulted in reduced agency commodity IT spending 

and fewer duplicative investments.

Agencies have achieved about $2.5 billion

in savings from fiscal years 2012 to 2017 

through the Office of Management and 

Budget’s PortfolioStat that was intended to 

consolidate and eliminate duplicative 

systems. Agencies have the potential to 

achieve about $3.5 billion in additional 

savings. 

Resolving the Federal Role in 

Housing Finance

In June 2013, we recommended actions for the 

Federal Housing Administration (FHA) to increase 

returns on sales of foreclosed properties with FHAinsured mortgages.

FHA’s actions in response to our 

recommendations improved its returns and 

led to financial benefits totaling about $1.3 

billion in 2017.

Medicare Program & Improper 

Payments 

In December 2015, we recommended that Congress 

consider directing the Secretary of HHS to equalize 

payment rates between physician offices and hospital 

outpatient departments for evaluation and 

management services and to return the associated 

savings to the Medicare program. 

This change in reimbursement resulted in 

estimated cost savings to the program of 

$1.6 billion in FYs 2017 and 2018, and will 

result in additional savings going forward.

Enforcement of Tax Laws In June 2015, we expressed concerns to Internal 

Revenue Service (IRS) officials about fraudsters 

potentially using taxpayer account information stolen 

in the 2014 and 2015 “Get Transcript” online service 

data breach to file multiple fraudulent returns and 

receive refunds. In response, IRS changed its 

authentication and monitoring procedures for accounts 

affected by the breach. 

As a result of our suggestion and the new 

authentication procedures, in August 2017 

we found that IRS prevented paying a total 

of $480.2 million in fraudulent refunds in 

FYs 2015 and 2016. In 2018, we found 

that IRS prevented an additional $110 

million in FY 2017.

National Flood Insurance 

Program 

Staff from the Federal Emergency Management 

Administration (FEMA) identified a number of actions 

that the agency has taken or has underway to address 

issues we raised related to its rate-setting methods in 

June 2011. In response to a congressional matter we 

made, congressional staff notified us that Congress 

passed the Biggert-Waters Flood Insurance Reform 

Act of 2012 which eliminated or phased out subsidized 

premium rates for several types of properties. 

As a result of changes FEMA has made in 

rates for certain subsidized properties, we 

estimate that policyholders with these 

subsidized premiums paid $338.4 million 

(net present value) more in premiums as 

of the end of FY 2017 than they would 

have paid prior to the enactment of the 

Biggert-Waters Act. 

Source: GAO analysis. | GAO-19-157SP
Page 44 GAO-19-157SP High-Risk Series 

Successful outcomes in highly uncertain environments require leadership 

and commitment to managing risks and other complex outcomes. 

Enterprise Risk Management (ERM) is the practice of identifying and 

managing risks that cover an entire organization, including how risks 

interact, as an interrelated portfolio. To help ensure that agencies are 

effectively managing risks that could affect the achievement of agency 

strategic objectives, OMB added ERM in its Circular A-11 on budget 

preparation in July 2014 and its Circular A-123 on agencies’ responsibility 

for ERM and Internal Control in July 2016. In the spring of 2018, agencies 

were to follow the OMB guidance to profile their top risks as part of the 

discussion in OMB’s required Strategic Review meetings.

To further assist agencies in managing their risks, in December 2016 we 

identified six essential elements of ERM—along with agency good 

practices—that federal leaders can use to implement and sustain an 

effective risk management program.15 The consistent and regular use of 

ERM can help agency leaders identify and manage risks, including highrisk issues. Figure 5 shows the six essential elements we identified.

 

15GAO, Enterprise Risk Management: Selected Agencies' Experiences Illustrate Good 

Practices in Managing Risk, GAO-17-63 (Washington, D.C.: December 1, 2016).

Enterprise Risk 

Management Can Help 

Agencies Address HighRisk Challenges
Page 45 GAO-19-157SP High-Risk Series 

Figure 5: Essential Elements of Federal Government Enterprise Risk Management

In the 2 years since our last High-Risk Report, three areas—NASA 

Acquisition Management, Transforming EPA's Process for Assessing and 

Controlling Toxic Chemicals, and Limiting the Federal Government's 

Fiscal Exposure By Better Managing Climate Change Risks—have 

regressed in their ratings against our criteria for removal from the HighRisk List. In addition, while progress is needed across all high-risk areas, 

we have identified nine additional areas that require significant attention 

to address imminent, longstanding, or particularly broad issues affecting 

the nation.

High-Risk Areas 

Needing Significant 

Attention
Page 46 GAO-19-157SP High-Risk Series 

NASA plans to invest billions of dollars in the coming years to explore 

space, improve its understanding of the Earth’s environment, and conduct 

aeronautics research, among other things. We designated NASA’s 

acquisition management as high risk in 1990 in view of NASA’s history of 

persistent cost growth and schedule delays in the majority of its major 

projects.

Following several years of continuing a generally positive trend of limiting 

cost growth and schedule delays for its portfolio of major projects, we 

found that NASA’s average launch delay increased from 7 to 12 months 

between May 2017 and May 2018. Further, the overall development cost 

growth increased from 15.6 percent to at least 18.8 percent over the 

same time period. NASA’s largest science project, the James Webb 

Space Telescope, has experienced schedule delays of 81 months and 

cost growth of 95 percent since the project’s cost and schedule baseline 

was first established in 2009.

NASA is at risk for continued cost growth and schedule delays in its 

portfolio of major projects. Since our 2017 high-risk update, we have 

lowered NASA acquisition management from meeting the rating to 

partially meeting the rating in two criteria—leadership commitment and 

monitoring. The other three criteria ratings remained the same as in 2017. 

Ratings for capacity and demonstrated progress remain partially met and 

the rating for action plan remains met. 

Over the next several years, NASA plans to add new, large, and complex 

projects to the portfolio, including a lunar Gateway—currently being 

discussed as a platform in a lunar orbit to mature deep space exploration 

capabilities. In addition, many of NASA’s current major projects, including 

some of the most expensive ones, are in the phase of their life cycles 

when cost growth and schedule delays are most likely. 

NASA acquisition management requires significant attention for the 

following reasons:

• NASA leadership has approved risky programmatic decisions for 

complex major projects, which compounded technical challenges. For 

example, leadership has approved some programs to proceed (1) with 

low cost and schedule reserves, (2) with overly aggressive schedules, 

Three High-Risk Areas 

That Regressed 

NASA Acquisition 

Management
Page 47 GAO-19-157SP High-Risk Series 

and (3) without following best practices for establishing reliable cost and 

schedule baselines.

• NASA leadership has also not been transparent about cost and schedule 

estimates for some of its most expensive projects. Without transparency 

into these estimates, both NASA and Congress have limited data to 

inform decision making.

• NASA has not yet instituted a program for monitoring and independently 

validating the effectiveness and sustainability of the corrective action 

measures in its new action plan, which NASA finalized in December 

2018.

In addition, while NASA has taken some steps to build capacity to help 

reduce acquisition risk, including updating tools aimed at improving cost 

and schedule estimates, other areas still require attention. For example, 

we reported in May 2018 that several major NASA projects experienced 

workforce challenges, including not having enough staff or staff with the 

right skills. NASA has also identified capability gaps in areas such as 

scheduling, earned value management, and cost estimating, and has

efforts underway to try to improve capacity in these areas.

Since 2017, we have made 9 recommendations on this high-risk area, 

and as of December 2018, 15 recommendations remain open. These 

recommendations include that NASA needs to improve transparency of 

major project cost and schedule estimates, especially for its human 

spaceflight programs, as well as continue to build capacity to reduce 

acquisition risk. NASA will also need to implement its new action plan and 

track progress against it. See appendix II for additional detail on this highrisk area, including more details on actions that need to be taken.

The Environmental Protection Agency’s (EPA’s) ability to effectively 

implement its mission of protecting public health and the environment is 

dependent on it assessing the risks posed by chemicals in a credible and 

timely manner. Such assessments are the cornerstone of scientifically 

sound environmental decisions, policies, and regulations under a variety 

of statutes.

Based on our work since our 2017 High-Risk Report, the overall rating for 

leadership commitment decreased from met to partially met due to limited 

information for completing chemical assessments and proposed budget

cuts in the Integrated Risk Information System (IRIS) Program. The 

ratings for the remaining four criteria remain unchanged and are partially 

met.

Transforming EPA's Process 

for Assessing and Controlling 

Toxic Chemicals
Page 48 GAO-19-157SP High-Risk Series 

The EPA Acting Administrator indicated his commitment to fulfill the 

agency’s obligations under the Toxic Substances Control Act (TSCA) as 

amended by the 2016 Frank R. Lautenberg Chemical Safety for the 21 

Century Act (Lautenberg Act) and ensure chemicals in the marketplace 

are safe for human health and the environment. Nonetheless, EPA needs 

to give more attention to several areas to fully realize the benefits of the 

new law, and to demonstrate additional progress in the IRIS Program, 

such as:

• While EPA released a document in late December 2018 called the IRIS 

Program Outlook, the Outlook fails to list the projected date for most of 

the assessments and includes no information regarding assessment 

prioritization—including how these assessments will meet program and 

regional office needs.

• The Lautenberg Act increases both EPA’s responsibility for regulating 

chemicals and its workload. EPA recently issued a rule under the act to 

collect fees from certain companies to defray a portion of the 

implementation costs, but it is unclear whether the fees collected will be 

sufficient to support relevant parts of the program.

• EPA issued a First Year Implementation Plan in June 2016 noting that 

this document is intended to be a roadmap of major activities EPA will 

focus on during the initial year of implementation. As of mid-February 

2019 the plan has not been updated, according to publically available 

information, although EPA had indicated that it is a living document that 

will be further developed over time.

EPA needs to ensure that the people and resources dedicated to the 

IRIS Program and TSCA implementation are sufficient. Our March 2019 

report on chemical assessments provides information on what remains to 

be done to address challenges in the IRIS program and implement the 

Lautenberg Act.16 

Since we added this area to our High-Risk List in 2009, we have made 12 

recommendations to EPA related to IRIS and TSCA. As of February 

2019, seven recommendations remain open. See appendix II for 

additional detail on this high-risk area including actions that need to be 

taken.

 

16GAO, Chemical Assessments: Status of EPA’s Efforts to Produce Assessments and 

Implement the Toxic Substances Control Act. GAO-19-270. Washington, D.C.: March 4, 

2019.
Page 49 GAO-19-157SP High-Risk Series 

Numerous studies have concluded that climate change poses risks to 

many environmental and economic systems and creates a significant 

fiscal risk to the federal government. The rising number of natural 

disasters and increasing reliance on the federal government for 

assistance is a key source of federal fiscal exposure. As of December 

2018, total federal funding for disaster assistance since 2005 is 

approaching half a trillion dollars (about $430 billion), most recently for 

catastrophic hurricanes, flooding, wildfires, and other losses in 2017 and 

2018. The costliness of disasters is projected to increase as extreme 

weather events become more frequent and intense due to climate 

change. There are five areas where government-wide action is needed to 

reduce federal fiscal exposure, including, but not limited to, the federal 

government’s role as (1) the insurer of property and crops; (2) the 

provider of disaster aid; (3) the owner or operator of infrastructure; (4) the 

leader of a strategic plan that coordinates federal efforts and informs 

state, local, and private-sector action; and (5) the provider of data and 

technical assistance to decision makers.

Neither global efforts to mitigate climate change causes nor regional 

adaptation efforts currently approach the scales needed to avoid 

substantial damages to the U.S. economy, environment, and human 

health over the coming decades, according to the November 2018 Fourth 

National Climate Assessment. Government-wide action is needed to 

improve the nation’s resilience to natural hazards and reduce federal 

fiscal exposure to climate change impacts. 

Congress continues to show its commitment to progress on this high-risk 

issue by enacting legislation such as the National Defense Authorization 

Act of 2018, which among other things required DOD to report on climate 

impacts to its installations.17 However, the federal government has not 

made measurable progress since 2017 to reduce its fiscal exposure to 

climate change, and in some cases, has revoked prior policies designed 

to do so. Specifically, since 2017, the ratings for four criteria remain 

unchanged—three at partially met and one at not met. The rating for one 

criterion—monitoring—regressed to not met. 

Limiting the federal government’s fiscal exposure to climate change 

requires significant attention because the federal government has 

revoked prior policies that had partially addressed this high-risk area and 

has not implemented several of our recommendations that could help 

 

17Pub. L. No. 115-91, § 335, 131 Stat. 1283, 1357 (2017).

Limiting the Federal 

Government's Fiscal Exposure 

by Better Managing Climate 

Change Risks
Page 50 GAO-19-157SP High-Risk Series 

reduce federal fiscal exposure. For example, since our 2017 high-risk 

update, the federal government:

• revoked Executive Order 13690, which had established a governmentwide federal flood risk management standard to improve the resilience of 

communities and federal assets against the impacts of flooding. This 

action could increase federal fiscal exposure, as taxpayer-funded 

projects may not last as long as intended because they are not required 

to account for future changes in climate-related risk.

• rescinded its guidance directing agencies to consider climate change in 

their National Environmental Policy Act of 1969 reviews for certain types 

of federal projects. 

• has not implemented our July 2015 recommendation to establish a 

comprehensive investment strategy identifying, prioritizing, and 

implementing federal disaster resilience investments that could reduce 

federal fiscal exposure to climate change.

• has not implemented our November 2015 recommendations to create a 

national climate information system providing authoritative, accessible 

information useful for state, local, and private-sector decision making.

We have made 62 recommendations related to this high-risk area, 12 of 

which were made since our February 2017 high-risk update. As of 

December 2018, 25 remain open. The federal government needs a 

cohesive strategic approach with strong leadership and the authority to 

manage climate change risks across the entire range of federal activities. 

See appendix II for additional detail on this high-risk area, including 

actions that need to be taken.

Federal agencies and the nation’s critical infrastructures—such as 

energy, transportation systems, communications, and financial services—

are dependent on information technology systems to carry out operations. 

The security of these systems and the data they use is vital to public 

confidence and national security, prosperity, and well-being. The risks to 

systems underpinning the nation’s critical infrastructure are increasing as 

security threats evolve and become more sophisticated. 

Additional High-Risk Areas 

That Need Significant 

Attention

Ensuring the Cybersecurity of 

the Nation
Page 51 GAO-19-157SP High-Risk Series 

We first designated information security as a government-wide high-risk 

area in 1997. This was expanded to include protecting cyber critical 

infrastructure in 2003 and protecting the privacy of personally identifiable 

information in 2015. In 2018, we updated this high-risk area to reflect the 

lack of a comprehensive cybersecurity strategy for the federal 

government.

Since 2010, we have made over 3,000 recommendations to agencies 

aimed at addressing cybersecurity shortcomings, including protecting 

cyber critical infrastructure, managing the cybersecurity workforce, and 

responding to cybersecurity incidents. Of those 3,000 recommendations, 

448 were made since our last high-risk update in February 2017. 

Although many recommendations have been addressed, about 700 have 

not yet been implemented. 

Despite the number of unimplemented recommendations, since our 2017 

High-Risk Report, the administration has made progress in this high-risk 

area as it continues to meet the leadership commitment criterion through 

various actions. These include the President issuing (1) an executive 

order in May 2017 requiring federal agencies to take a variety of actions, 

including better managing their cybersecurity risks and coordinating to 

meet reporting requirements related to cybersecurity of federal networks 

and critical infrastructure18 and (2) a National Security Strategy in 

December 2017 citing cybersecurity as a national priority and identifying 

needed actions. Further, the administration issued a government-wide 

reform plan and reorganization recommendations in June 2018 with, 

among other things, proposals for solving the federal cybersecurity 

workforce shortage. Additionally, the administration released a National 

Cyber Strategy in September 2018 outlining activities such as securing 

critical infrastructure, federal networks, and associated information. 

However, additional actions are needed. We have identified four major 

cybersecurity challenges facing the nation: (1) establishing a 

comprehensive cybersecurity strategy and performing effective oversight, 

(2) securing federal systems and information, (3) protecting cyber critical 

infrastructure, and (4) protecting privacy and sensitive data. To address 

the four major cybersecurity challenges, we identified 10 critical actions 

the federal government and other entities need to take. These critical 

actions include, for example, developing and executing a more 

 

18Executive Order 13,800, 82 Fed. Reg. 22,391 (May 16, 2017). 
Page 52 GAO-19-157SP High-Risk Series 

comprehensive federal strategy for national cybersecurity and global 

cyberspace; addressing cybersecurity workforce management 

challenges; and strengthening the federal role in protecting the 

cybersecurity of critical infrastructure (see figure 6). 
Page 53 GAO-19-157SP High-Risk Series 

Figure 6: Ten Critical Actions Needed to Address Four Major Cybersecurity 

Challenges
Page 54 GAO-19-157SP High-Risk Series 

Until these shortcomings are addressed, federal agencies’ information 

and systems will be increasingly susceptible to the multitude of cyberrelated threats that exist. See appendix II for additional detail on this highrisk area, including more details on actions that need to be taken. 

The expanded federal role in housing finance that began during the 

2007–2009 financial crisis has substantially increased the government’s 

exposure to potential mortgage losses. Federally supported mortgages 

include those backed by the Federal National Mortgage Association 

(Fannie Mae) and the Federal Home Loan Mortgage Corporation (Freddie 

Mac)—collectively, the enterprises—which the Federal Housing Finance 

Agency (FHFA) placed into government conservatorships in 2008. 

Federal support also occurs through Federal Housing Administration 

(FHA) mortgage insurance and Government National Mortgage 

Association (Ginnie Mae) guarantees on mortgage-backed securities. The 

substantial financial assistance the enterprises required during and after 

the crisis, coupled with the large fiscal exposure they and other federal 

mortgage entities represent today, underscore the need to reform the 

federal role in housing finance. 

Delay in resolving the federal role in housing finance poses considerable 

risks. Through the enterprises, FHA, and Ginnie Mae, the federal 

government is exposed to potential losses on several trillion dollars in 

mortgage debt. A severe economic downturn could trigger significant 

taxpayer assistance to one or more of these entities. 

Congress and federal agencies have taken some steps to facilitate the 

transition to a revised federal role, such as holding hearings, introducing 

legislation, issuing regulations, and developing market monitoring tools. 

For example, in 2013 and 2014, housing and regulatory agencies 

finalized rules designed to prevent a recurrence of risky practices in 

originating and securing mortgages that contributed to the financial crisis. 

Additionally, FHFA and the Consumer Financial Protection Bureau have 

developed a representative database of mortgage information that could 

be useful for examining the effect of mortgage market reforms. However, 

overall progress on resolving the federal role will be difficult to achieve 

until Congress provides further direction by enacting changes to the 

housing finance system.

Several issues contribute to the risks facing federal housing finance, 

including the following:

Resolving the Federal Role in 

Housing Finance
Page 55 GAO-19-157SP High-Risk Series 

• More than 10 years after entering federal conservatorships, the 

enterprises’ futures remain uncertain and billions of taxpayer dollars 

remain at risk. Under agreements with the Department of the Treasury

(Treasury), the enterprises have received $191.4 billion in capital support 

as of the end of fiscal year 2018 and have paid dividends to the 

department exceeding that amount. If they were to incur major additional 

losses, they would draw required amounts from their remaining $254.1 

billion in Treasury commitments. In addition, prolonged conservatorships 

could hinder development of the broader mortgage securities market by 

creating uncertainty and crowding out private investment.

• Nonbanks (lenders and loan servicers that are not depository institutions) 

have played an increasingly large role in the mortgage market in recent 

years. While nonbanks have helped provide access to mortgage credit, 

they also may pose additional risks, in part because they are not federally 

regulated for safety and soundness. However, FHFA lacks statutory 

authority to examine nonbank mortgage servicers and other third parties 

who do business with and pose potential risks to the enterprises.

• The statutory 2 percent capital requirement for FHA’s $1.26 trillion 

mortgage insurance fund is not based on a specified risk threshold, such 

as the economic conditions the fund would be expected to withstand. As 

a result, it may not provide an adequate financial cushion under 

scenarios in which Congress may anticipate the fund would be selfsufficient. During the last housing downturn, the fund’s capital ratio fell 

below the required level and remained there for 6 consecutive years. At 

the end of fiscal year 2013, the fund required supplemental funds—about 

$1.7 billion—for the first time in its history. 

Six of our federal housing recommendations remain open, including those 

we made in June 2015 on assessing the effects of mortgage reforms 

already in place. 

Further, as we previously recommended in November 2016 and January 

2019, Congress should consider housing finance reform legislation that:

• establishes objectives for the future federal role in housing finance, 

including the role and structure of the enterprises within the housing 

finance system;

• provides a transition plan to a reformed system that enables the 

enterprises to exit federal conservatorship; and 

• addresses all relevant federal entities, including FHA and Ginnie Mae. 

As we recommended in March 2016 and November 2017, respectively, 

Congress also should consider granting FHFA explicit authority to 
Page 56 GAO-19-157SP High-Risk Series 

examine nonbank servicers and other third parties that do business with 

the enterprises, and specifying the economic conditions FHA’s insurance 

fund would be expected to withstand without a substantial risk of requiring 

supplemental funds. See appendix II for additional detail on this high-risk 

area, including more details on actions that need to be taken.

Due to the significance and risk associated with Resolving the Federal 

Role in Housing Finance, we are separating it from the high-risk area of 

Modernizing the U.S. Financial Regulatory System. These areas were 

combined in our 2017 High-Risk report.

The Pension Benefit Guaranty Corporation (PBGC) is responsible for 

insuring the defined benefit pension plans for nearly 37 million American 

workers and retirees, who participate in about 24,800 private sector 

plans. PBGC faces an uncertain financial future due, in part, to a longterm decline in the number of traditional defined benefit plans and the 

collective financial risk of the many underfunded pension plans that 

PBGC insures. 

PBGC’s financial portfolio is one of the largest of all federal government 

corporations. While PBGC’s single employer program had a net surplus 

of about $2.4 billion at the end of fiscal year 2018, its multiemployer 

program had a net deficit of about $54 billion—or a combined net 

accumulated financial deficit of over $51 billion. Its deficit has increased 

by nearly 45 percent since fiscal year 2013. PBGC has estimated that, 

without additional funding, its multiemployer insurance program will likely 

be exhausted by 2025 as a result of current and projected pension plan 

insolvencies. The agency’s single-employer insurance program is also at 

risk due to the continuing decline of traditional defined benefit pension 

plans, as well as premiums that are not well aligned to the financial risk 

presented by the plans it insures. 

While Congress and PBGC have taken significant and positive steps to 

strengthen the agency in the past 5 years, challenges related to PBGC’s 

funding and governance structure remain. Congress established a 

temporary Joint Select Committee on multiemployer pension plans in 

2018—with the goal of improving the solvency of the multiemployer 

program. However, the committee did not release draft legislation. 

Addressing the significant financial risk and governance challenges that 

PBGC faces will require additional congressional action. 

Over the years since we added PBGC to the High-Risk List, we have 

suggested a number of matters for congressional consideration, 

Pension Benefit Guaranty 

Corporation Insurance 

Programs
Page 57 GAO-19-157SP High-Risk Series 

including: (1) authorizing a redesign of PBGC’s single employer program 

premium structure to better align premium rates with sponsor risk; (2) 

adopting additional changes to PBGC’s governance structure—in 

particular, expanding the composition of its board of directors; (3) 

strengthening funding requirements for plan sponsors as appropriate 

given national economic conditions; (4) working with PBGC to develop a 

strategy for funding PBGC claims over the long term as the defined 

benefit pension system continues to decline; and (5) enacting additional 

structural reforms to reinforce and stabilize the multiemployer system, 

and balance the needs and potential sacrifices of contributing employers, 

participants, and the federal government.

Absent additional steps to improve PBGC’s finances, the long-term 

financial stability of the agency remains uncertain, and the retirement 

benefits of millions of American workers and retirees could be at risk of 

dramatic reductions. See appendix II for additional detail on this high-risk 

area, including more details on actions that need to be taken.

VA operates one of the largest health care delivery systems in the nation 

through its Veterans Health Administration (VHA), with 172 medical 

centers and more than 1,000 outpatient facilities organized into regional 

networks. VA has faced a growing demand by veterans for its health care 

services—due, in part, to the needs of an aging veteran population—and 

that trend is expected to continue. The total number of veterans enrolled 

in VA’s health care system rose from 7.9 million to more than 9 million 

from fiscal year 2006 through fiscal year 2017. Over that same period, 

VHA’s total budgetary resources have more than doubled, from $37.8 

billion in fiscal year 2006 to $92.3 billion in fiscal year 2017. 

Given the importance of VHA’s mission, coupled with its lack of progress 

in addressing its high-risk designation, we continue to be concerned 

about VHA’s ability to ensure its resources are being used effectively and 

efficiently to improve veterans’ timely access to safe and high-quality 

health care. We have identified five areas of concern: (1) ambiguous 

policies and inconsistent processes; (2) inadequate oversight and 

accountability; (3) IT challenges; (4) inadequate training for VA staff; and 

(5) unclear resource needs and allocation priorities. VHA has begun to 

address each of these areas but, prior to Secretary Robert Wilkie’s July 

2018 confirmation, its efforts were impeded by leadership instability. 

Since taking office, Secretary Wilkie has demonstrated his commitment to 

addressing the department’s high-risk designation by, among other 

things, creating an office to direct an integrated, focused high-risk 

Managing Risks and Improving 

VA Health Care
Page 58 GAO-19-157SP High-Risk Series 

approach and communicating to VA leaders the importance of addressing 

our recommendations. 

While VHA completed root cause analyses for each area of concern and 

developed an action plan in response, the plan lacks milestones and 

metrics needed to effectively monitor its implementation and demonstrate 

progress made in addressing the high-risk designation. Additionally, many 

of VHA’s capacity-building initiatives are either in the initial stages of 

development or are lacking necessary funding and resources. As such, 

VHA has not made sufficient progress since our 2017 update to improve 

its overall ratings, as two high-risk criteria remain partially met and three 

criteria remain unmet.

We remain concerned about VHA’s ability to oversee its programs, hold 

its workforce accountable, and avoid ambiguous policies and inconsistent 

processes that jeopardize its ability to provide safe, high-quality care to 

veterans: 

• In November 2017, we reported that, due in part to misinterpretation or 

lack of awareness of VHA policy, VA medical center officials did not 

always document or conduct timely required reviews of providers when 

allegations were made against them. As a result, we concluded that VA 

medical center officials may have lacked necessary information to 

reasonably ensure that their providers were competent to provide safe, 

high-quality care to veterans and to grant approvals about these 

providers’ privileges to perform specific clinical services at VA medical 

centers. We made four recommendations related to this and other 

findings, all of which remain open.

• In June 2018, we reported that VHA could not systematically monitor the 

timeliness of veterans’ access to Veterans Choice Program (VCP) care 

because it lacked complete, reliable data to do so. We also found that 

veterans, who were referred to the VCP for routine care because health 

care services were not available in a timely manner, could potentially wait 

for care up to 70 calendar days if the maximum amount of time allowed 

by VA processes is used. This wait time exceeds the statutory 

requirement that veterans receive VCP care within 30 days of the dates 

their VA health care providers indicated they should receive 

appointments, or if no such date existed, within 30 days of the veteran’s 

preferred date. We made 10 recommendations related to this and other 

findings, all of which remain open.

• Similarly, in July 2018, we reported that VA collected data related to 

employee misconduct and disciplinary actions, but data fragmentation 
Page 59 GAO-19-157SP High-Risk Series 

and reliability issues impeded department-wide analysis of those data. 

Additionally, we found that VA did not consistently ensure that allegations 

of misconduct involving senior officials were reviewed according to its 

investigative standards or ensure these officials were held accountable. 

We made 16 recommendations related to this and other findings, all of 

which remain open.

• In November 2018, we reported that VHA’s suicide prevention media 

outreach activities declined in recent years due to leadership turnover 

and reorganization. Additionally, we found that VHA did not assign key 

leadership responsibilities or establish clear lines of reporting for its 

suicide prevention media outreach campaign, which hindered its ability to 

oversee the campaign. Consequently, we concluded that VHA may not 

be maximizing its reach with suicide prevention media content to 

veterans, especially those who are at-risk. This is inconsistent with VHA’s 

efforts to reduce veteran suicides, which is VA’s highest clinical priority. 

We made two recommendations related to this and other findings, both of 

which remain open.

VA needs to further develop its capacity-building initiatives and establish 

metrics to monitor and measure its progress addressing the high-risk 

areas of concern. It is also important that our recommendations continue 

to be implemented. The department has implemented 209 of the 353 

recommendations related to VA health care that we made from January 

1, 2010 through December 2018, but more than 125 recommendations 

remain open as of December 2018. This includes 17 that are older than 3 

years. In addition to addressing our recommendations, VA needs to make 

systemic change to department management and oversight in order to 

fully address the high-risk issues and improve the health care provided to 

our nation’s veterans. 

See appendix II for additional detail on this high-risk area, including more 

details on actions that need to be taken.

Mission-critical skills gaps both within federal agencies and across the 

federal workforce impede the government from cost-effectively serving 

the public and achieving results. For example, the difficulties in recruiting 

and retaining skilled health care providers and human resource staff at 

VHA’s medical centers make it difficult to meet the health care needs of 

more than 9 million veterans. As a result, VHA’s 168 medical centers 

have large staffing shortages, including physicians, registered nurses, 

physician assistants, psychologists, physical therapists, as well as human 

resource specialists and assistants. 

Strategic Human Capital 

Management
Page 60 GAO-19-157SP High-Risk Series 

OPM continues to demonstrate top leadership commitment through its 

numerous efforts to assist agencies’ in addressing mission-critical skills 

gaps within their workforces. This includes providing guidance, training 

and on-going support for agencies on the use of comprehensive data 

analytic methods for identifying skills gaps and the development of 

strategies to address these gaps. However, since we first added strategic 

human capital management to our High-Risk List in 2001, we have 

reported on the need for agencies to address their workforce skills gaps. 

As of December 2018, OPM had not fully implemented 29 of our 

recommendations made since 2012 relating to this high-risk area. Staffing 

shortages and the lack of skills among current staff not only affect 

individual agencies but also cut across the entire federal workforce in 

areas such as cybersecurity and acquisition management. Skills gaps 

caused by insufficient number of staff, inadequate workforce planning, 

and a lack of training in critical skills are contributing to our designating 

other areas as high-risk. 

As table 7 shows, of the 34 other high-risk areas covered in this report, 

skills gaps played a significant role in 16 of the areas.

Table 7: Skills Gaps Related to High-Risk Areas

High-risk area Examples of skills gaps and causes

2020 Decennial Census Staffing: Lack of staff to oversee the $886 million contract for integrating the Information 

Technology (IT) systems needed to conduct the 2020 Census.

Strengthening DHS Management 

Functions

Workforce Planning: Lack of guidance on how to identify critical cybersecurity and 

acquisition skills needed to support its new IT delivery model. 

Training: Insufficient technical skills to support its biometric identification services program.

DOD Business Systems 

Modernization

Workforce Planning: Incomplete assessment of the extent to which DOD personnel meet IT 

management knowledge and skill requirements. 

Staffing: Slow and inefficient hiring processes have led to challenges in recruiting and 

retaining qualified chief information officers (CIO) and IT personnel.

Training: Statutorily required guidance and training for cross-functional team members and 

presidential appointees not completed.

DOD Financial Management Staffing: Financial management staff remains insufficient in number, qualifications, and 

expertise. 

DOD Contract Management Staffing: Challenges in recruiting talent for acquisition management.

DOE’s Contract Management for 

the National Nuclear Security 

Administration and Office of 

Environmental Management

Workforce Planning: Unmet critical staffing needs and evidence that the agency is 

understaffed across all functions.

Staffing: Competing agency priorities and limited hiring have contributed to critical staff 

shortages to manage and oversee strategic materials programs. 
Page 61 GAO-19-157SP High-Risk Series 

High-risk area Examples of skills gaps and causes

U.S. Government’s Environmental 

Liability

Workforce Planning: Lack of information to evaluate overall project and program 

performance, including number of staff and skills needed to meet its environmental 

management cleanup mission. 

Improving Federal Management of 

Programs that Serve Tribes and 

Their Members

Staffing: Lack of expert staff to review proposals for wind and solar projects, or petroleum 

engineers to review oil and gas proposals. Additionally, shortages of health care providers, 

including physicians, nurses, midwives, dentists, and pharmacists.

Training: Limited funding and lack of a safety training plan contributed to incomplete training 

to protect Bureau of Indian Education schools. 

Management of Federal Oil and 

Gas Resources

Workforce Planning: Lacks plan for identifying key oil and gas positions and their respective 

technical competencies. No evaluation of the effectiveness of its recruitment and retention 

incentives as well as its student loan repayment program. 

Training: No evaluation of its training needs, training effectiveness, or opportunities for its 

bureaus to share training resources. 

NASA Acquisition Management Staffing and Skills: Lacks staff or staff with skills in the areas of avionics, flight software, 

systems engineering, business management, software development for certain acquisition 

projects, as well as gaps in areas such as cost estimating and earned value management 

capabilities.

Protecting Public Health Through 

Enhanced Oversight of Medical 

Products

Staffing: At times, significant gaps in staffing still remain during the time staff complete 

necessary processes to be stationed overseas.

Improving and Modernizing 

Federal Disability Programs

Staffing: SSA’s disability appeals plan calls for increased hiring to reduce disability appeals 

backlogs and improve timeliness, and VA has not completed hiring and planning efforts to 

ensure it has the capacity to comprehensively update its disability eligibility criteria.

VA Acquisition Management Training: Lack of training for contracting officers.

Managing Risks and Improving VA 

Health Care

Workforce Planning: No annual tracking and reviewing of data related to IT skills needed in 

the future. 

Staffing: Insufficient number of community care staff and medical support assistants. 

Training: No assessment of the training needs or monitoring of completed training for patient 

advocate positions. 

Ensuring the Cybersecurity of the 

Nation 

Staffing and Training: The administration’s June 2018 government reform plan includes 

recommendations for solving the federal cybersecurity workforce shortage, including 

prioritizing and accelerating efforts to reform how the federal government recruits, evaluates, 

selects, pays, and places cyber talent.

Improving the Management of IT 

Acquisitions and Operations

Workforce Planning: None of the 24 major federal agencies had IT management policies that 

fully addressed the role of their CIOs. The majority of the agencies minimally addressed or did 

not address their CIO’s role in assessing agency IT workforce needs, and developing 

strategies and plans for meeting those needs.

Source: GAO analysis. | GAO-19-157SP

Over the years since we added this area to our High-Risk List, in addition 

to recommendations to address critical skills gaps in individual high-risk 

areas, we have made numerous recommendations to OPM related to this 

high-risk issue, 29 of which remain open. Agencies also need to take 

action to address mission-critical skills gaps within their own workforces – 

a root cause of many high-risk areas. See appendix II for additional detail 

on this high-risk area, including more details on actions that need to be 

taken.
Page 62 GAO-19-157SP High-Risk Series 

The 2010 Census was the costliest in history at about $12.3 billion; as of 

October 2017, the 2020 Census is projected to cost about $15.6 billion, a 

27 percent increase. For the 2020 Census, the U.S. Census Bureau 

(Bureau) plans to implement several innovations, including new IT 

systems. Implementing these innovations, along with other challenges, 

puts the Bureau’s ability to conduct a cost-effective census at risk. 

The decennial census is mandated by the U.S. Constitution and provides 

vital data for the nation. Census data are used, among other purposes, to 

apportion seats in the Congress and allocate billions of dollars in federal 

assistance to state and local governments. To ensure its success, this 

complicated and costly undertaking requires careful planning, risk 

management, and oversight. Census activities, some of which are new for 

the 2020 cycle, must be carried out on schedule to deliver the state 

apportionment counts to the President by December 31, 2020.

The Bureau and the Department of Commerce (Commerce) have 

strengthened leadership commitment with executive-level oversight of the 

2020 Census by holding regular meetings on the status of IT systems and 

other risk areas. In addition, in 2017 Commerce designated a team to 

assist senior Bureau management with cost estimation challenges. These 

examples demonstrate both the Bureau’s and Commerce’s strong 

leadership commitment to implementing the 2020 Census. 

One of the Bureau’s major challenges is to control any further cost growth 

and develop cost estimates that are reliable and reflect best practices for 

the 2020 Census. According to the Bureau, the total cost of the 2020 

Census is now estimated to be approximately $15.6 billion, more than $3 

billion higher than previously estimated by the Bureau. The higher 

estimated life-cycle cost is due, in part, to the Bureau’s failure to 

previously include all cost associated with the decennial census.

The Bureau’s schedule for developing IT systems has experienced delays 

that have compressed the time available for system testing, integration 

testing, and security assessments. These schedule delays have 

contributed to systems experiencing problems after deployment, as well 

as cybersecurity challenges. For example, as of December 2018, the 

Bureau had identified nearly 1,100 system security weaknesses that 

needed to be addressed. Continued schedule management challenges 

may compress the time available for the remaining system testing and 

security assessments, and increase the risk that deployed systems will 

either not function as intended, have security vulnerabilities, or both. 

2020 Decennial Census
Page 63 GAO-19-157SP High-Risk Series 

As of January 2019, 30 of our recommendations related to this high-risk 

area had not been implemented. To make continued progress, the 

Bureau needs to ensure that its approach to strategic planning, IT 

management, cybersecurity, human capital management, internal 

collaboration, knowledge sharing, as well as risk and change 

management are all aligned toward delivering more cost-effective 

outcomes. Among other things, the Bureau needs to ensure cost growth 

is controlled and that the development and testing of key systems is 

completed and fully integrated with all census operations before the 2020 

Census. In addition, the Bureau needs to address cybersecurity 

weaknesses in a timely manner and ensure that security risks are at an 

acceptable level before systems are deployed. See appendix II for 

additional detail on this high-risk area, including more details on actions 

that need to be taken.

An improper payment is any payment that should not have been made or 

that was made in an incorrect amount (including overpayments and 

underpayments) under statutory, contractual, administrative, or other 

legally applicable requirements. Reducing improper payments—such as 

payments to ineligible recipients or duplicate payments—is critical to 

safeguarding federal funds. However, the federal government has 

consistently been unable to determine the full extent of improper 

payments and reasonably assure that appropriate actions are taken to 

reduce them. 

Since 2003—when certain agencies were required by statute to begin 

reporting improper payments—cumulative improper payment estimates 

have totaled about $1.5 trillion. As shown in figure 7, for fiscal year 2018, 

federal entities estimated about $151 billion in improper payments. 

Medicare and Medicaid improper payments and the Earned Income Tax 

Credit (EITC) improper payments—a part of the Enforcement of Tax Laws 

high-risk area—accounted for about 68.5 percent of this total. 

Federal spending for Medicare programs and Medicaid is expected to 

significantly increase in the coming years, so it is especially critical to take 

appropriate measures to reduce improper payments in these programs. 

Internal Revenue Service estimates also show that the EITC has 

consistently had a high improper payment rate. OMB has designated 

Medicare programs, Medicaid, and EITC as high-priority programs for 

improper payments, indicating they are amongst the highest-risk 

programs where the government can achieve the greatest return on 

investment for the taxpayer by ensuring that improper payments are 

eliminated.

Medicare, Medicaid, and 

Earned Income Tax Credit 

Improper Payments 
Page 64 GAO-19-157SP High-Risk Series 

Figure 7: Improper Payment Estimates Were Concentrated in Three Areas in Fiscal 

Year 2018

Our work has identified a number of strategic and specific actions 

agencies can take to reduce improper payments, which could yield 

significant savings, and help ensure that taxpayer funds are adequately 

safeguarded. Continued agency attention is needed to (1) identify 

susceptible programs, (2) develop reliable methodologies for estimating 

improper payments, (3) report as required by statute, and (4) implement 

effective corrective actions based on root cause analysis. Absent such 

continued efforts, the federal government cannot be assured that 

taxpayer funds are adequately safeguarded.

See appendix II for additional detail on the Medicare Program & Improper 

Payments, Strengthening Medicaid Program Integrity, and Enforcement 

of Tax Laws high-risk areas including more details on actions that need to 

be taken.

The Internal Revenue Service (IRS) continues to face two pressing 

challenges in enforcing tax laws: addressing the tax gap—amounting to 

hundreds of billions of dollars each year when some taxpayers fail to pay 

the taxes that they owe—and combatting identity theft (IDT) refund fraud. 

Enforcement of Tax Laws has been on GAO’s high risk list since 1990.

Enforcement of Tax Laws
Page 65 GAO-19-157SP High-Risk Series 

IRS enforcement of tax laws helps fund the U.S. government by collecting 

revenue from noncompliant taxpayers and, perhaps more importantly, 

promoting voluntary compliance by giving taxpayers confidence that 

others are paying their fair share. In 2016, IRS estimated that the average 

annual net tax gap, the difference between taxes owed and taxes paid on 

time, was $406 billion, on average, for tax years 2008-2010. 

While IRS continues to demonstrate top leadership support to address 

the tax gap, IRS’s capacity to implement new initiatives and improve 

ongoing enforcement and taxpayer service programs remains a 

challenge. For example, IRS’s strategic plan includes a goal to facilitate 

voluntary compliance and deter noncompliance that could address the tax 

gap. However, IRS could do more to identify specific efforts for improving 

compliance in its strategic plan, measure the effects of compliance 

programs—such as those used for large partnerships—and develop 

specific quantitative goals to reduce the tax gap. Such efforts would help 

IRS make more effective use of its resources and gauge the success of 

its strategies.

The second challenge facing IRS is IDT refund fraud, which occurs when 

an identity thief files a fraudulent tax return using a legitimate taxpayer’s 

identifying information and claims a refund. IRS estimates that at least 

$12.2 billion in individual IDT tax refund fraud was attempted in 2016, of 

which it prevented at least $10.5 billion (86 percent). Of the amount 

attempted, IRS estimated that at least $1.6 billion (14 percent) was paid. 

IRS’s ability to combat IDT fraud continues to be challenged as more 

personally identifiable information has become readily available as a 

result of large-scale cyberattacks on various entities. This makes it more 

difficult for IRS to distinguish between fraudsters and legitimate 

taxpayers. 

While IRS has demonstrated some progress by developing tools and 

programs to further detect and prevent IDT refund fraud, it has not 

completed updating its authentication procedures to be in compliance 

with new government standards. As a result, IRS may be missing an 

opportunity to implement the most secure, robust technologies to protect 

taxpayers.

As of December 2018, 189 GAO recommendations related to this highrisk area had not been implemented. To make continued progress on 

closing the tax gap, IRS needs to re-establish goals for improving 

voluntary compliance and develop and document a strategy that outlines 
Page 66 GAO-19-157SP High-Risk Series 

how it will use its data to help address this issue. Reducing the tax gap 

will also require targeted legislative actions, including additional thirdparty information reporting, enhanced electronic filing, expanded math 

error authority (also referred to as correctible error authority), and paid 

preparer regulation. To help stay on top of IDT refund fraud, IRS should 

develop a comprehensive process to evaluate alternative options for 

improving taxpayer authentication. Given that IDT refund fraud continues 

to be a challenge, targeted legislative action, such as requiring a 

scannable code on returns prepared electronically but filed on paper 

could help IRS address such fraud.

See appendix II for additional detail on this high-risk area, including more 

details on actions that need to be taken.

The federal government currently invests more than $90 billion annually 

in IT, and OMB has implemented several key initiatives intended to help 

better manage this investment. Additionally, enactment of FITARA, in 

conjunction with greater attention paid to the acquisition and operation of 

IT, has helped further improve the government-wide management of this 

significant annual investment.19 OMB’s current level of top leadership 

support and commitment to ensure that agencies successfully execute its 

guidance on implementing FITARA and related IT initiatives has helped 

this high-risk area meet the leadership commitment high-risk criteria. 

Additional positive government-wide actions have enabled this high-risk 

area to partially meet the four remaining high-risk criteria. For example, 

OMB has established an IT Dashboard—a public website that provides 

detailed information on major IT investments at 26 federal agencies—and 

agencies’ data center consolidation efforts have resulted in a total savings 

of slightly more than 80 percent of the agencies’ planned $5.7 billion in 

savings since 2011. However, major federal agencies have yet to fully 

address the requirements of FITARA and realize billions of dollars in 

planned or possible savings and improved government performance 

through more efficient budgeting and management of IT. 

As government-wide spending on IT increases every year, the need for 

appropriate stewardship of that investment increases as well. However, 

OMB and federal agencies have not made significant progress since 

 

19FITARA was enacted into law as part of the Carl Levin and Howard P. “Buck” McKeon 

National Defense Authorization Act for Fiscal Year 2015, Pub. L. No. 113-291, div. A, title 

VIII, subtitle D, §§ 831-837, 128 Stat. 3292, 3438-3450 (2014).

Improving the Management of 

IT Acquisitions and Operations
Page 67 GAO-19-157SP High-Risk Series 

2017 in taking the steps needed to improve how these financial resources 

are budgeted and utilized. While OMB has continued to demonstrate its 

leadership commitment through guidance and sponsorship of key 

initiatives, agencies still have not fully implemented all requirements of 

FITARA, such as putting into place authorities the law requires for chief 

information officers (CIO). Additionally, while the President’s Management 

Agenda has a goal to improve IT spending transparency, agencies are 

underreporting IT contract obligations by billions of dollars. OMB and the 

agencies also have not yet implemented hundreds of our 

recommendations on improving shortcomings in IT acquisitions and 

operations.

In an August 2018 review of the 24 federal agencies covered by FITARA, 

none had IT management policies that fully addressed the role of their 

CIOs consistent with federal laws and guidance. Specifically, the majority 

of the agencies only minimally addressed, or did not address, their CIO’s 

role in assessing agency IT workforce needs and developing strategies 

and plans for meeting those needs. Correspondingly, the majority of the 

24 CIOs acknowledged that they were not fully effective at implementing 

IT management responsibilities, such as IT strategic planning and 

investment management.

Further, in January 2018, we reported that the majority of 22 agencies did 

not identify all of their IT acquisition contracts, totaling about $4.5 billion in 

IT-related contract obligations beyond those reported by agencies. In 

addition, in November 2018 we reported that four selected agencies 

lacked quality assurance processes for ensuring that billions of dollars 

requested in their IT budgets were informed by reliable cost information. 

Until agencies properly identify IT contracts and establish processes for 

ensuring the quality of cost data used to inform their budgets, agency 

CIOs are at risk of not having appropriate oversight of IT acquisitions and 

may lack adequate transparency into IT spending to make informed 

budget decisions.

As of December 2018, OMB and federal agencies had fully implemented 

only 59 percent of the recommendations we have made since fiscal year 

2010 to address shortcomings in IT acquisitions and operations. OMB 

and agencies should work toward implementing our remaining 456 open 

recommendations related to this high-risk area. These remaining 

recommendations include 12 priority recommendations to agencies to, 

among other things, report all data center consolidation cost savings to 

OMB, plan to modernize or replace obsolete systems as needed, and 
Page 68 GAO-19-157SP High-Risk Series 

improve their implementation of PortfolioStat—an initiative that is to 

consolidate and eliminate duplicative systems. 

OMB and agencies need to take additional actions to (1) implement at 

least 80 percent of our open recommendations related to the 

management of IT acquisitions and operations, (2) ensure that a 

minimum of 80 percent of the government’s major IT acquisitions deliver 

functionality every 12 months, and (3) achieve at least 80 percent of the 

over $6 billion in planned PortfolioStat savings.

See appendix II for additional detail on this high-risk area, including more 

details on actions that need to be taken.

Our high-risk program continues to be a top priority at GAO and we will 

maintain our emphasis on identifying high-risk issues across government 

and on providing recommendations and sustained attention to help 

address them, by working collaboratively with Congress, agency leaders, 

and OMB. As part of this effort, we hope to continue to participate in 

regular meetings with the OMB Deputy Director for Management and with 

top agency leaders to discuss progress in addressing high-risk areas. 

Such efforts have been critical for the progress that has been made.

We are providing this update to the President and Vice President, 

congressional leadership, other Members of Congress, OMB, and the 

heads of major departments and agencies.

Gene L. Dodaro

Comptroller General

of the United States
Appendix I: Background

Page 69 GAO-19-157SP High-Risk Series 

In 1990, we began a program to report on government operations that we 

identified as “high risk.” Since then, generally coinciding with the start of 

each new Congress, we have reported on the status of progress 

addressing high-risk areas and have updated the High-Risk List. Our last 

high-risk update was in February 2017.1 That update identified 34 highrisk areas. Since then, we added a high-risk area outside of our normal 

biennial reporting cycle in 2018—Government-wide Personnel Security 

Clearance Process. In 2019 we separated one high-risk area—

Modernizing the U.S. Financial Regulatory System and Federal Role in 

Housing Finance—into two high-risk areas—Modernizing the U.S. 

Financial Regulatory System and Resolving the Federal Role in Housing 

Finance—to provide additional clarity on what needs to be done to 

address both areas.

Overall, this program has served to identify and help resolve serious 

weaknesses in areas that involve substantial resources and provide 

critical services to the public. Since our program began, the federal 

government has taken high-risk problems seriously and has made longneeded progress toward correcting them. In a number of cases, progress 

has been sufficient for us to remove the high-risk designation. A summary 

of changes to our High-Risk List over the past 29 years is shown in table 

8. This 2019 update identifies 35 high-risk areas.

Table 8: Changes to the High-Risk List, 1990-2019

Number of areas

Original High-Risk List in 1990 14

High-risk areas added since 1990 48

High-risk areas removed since 1990 26

High-risk area separated out from existing area 1

High-risk areas consolidated since 1990 2

High-Risk List in 2019 35

Source: GAO. | GAO-19-157SP

 

1

GAO, High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts 

Needed on Others, GAO-17-317 (Washington, D.C.: Feb. 15, 2017).

Appendix I: Background

What Is the History of the 

High-Risk Program?
Appendix I: Background

Page 70 GAO-19-157SP High-Risk Series 

The five high-risk criteria form a road map for efforts to improve and 

ultimately address high-risk issues. Addressing some of the criteria leads 

to progress, while satisfying all of the criteria is central to removal from 

the list. Our April 2016 report provided additional information, drawn from 

our 2015 high-risk update, on how agencies had made progress 

addressing high-risk issues.2 We provided illustrative actions that 

agencies took that led to progress or removal from our High-Risk List. 

This information provides additional guidance to agencies whose 

programs are on the High-Risk List.

Figure 8 shows the five criteria and illustrative actions taken by agencies 

to address the criteria as cited in that report. Importantly, the actions 

listed are not “stand alone” efforts taken in isolation from other actions to 

address high-risk issues. That is, actions taken under one criterion may 

be important to meeting other criteria as well. For example, top leadership 

can demonstrate its commitment by establishing a corrective action plan 

including long-term priorities and goals to address the high-risk issue and 

using data to gauge progress—actions which are also vital to monitoring 

criteria.

 

2

GAO, High-Risk Series: Key Actions to Make Progress Addressing High-Risk Issues, 

GAO-16-480R (Washington, D.C.: Apr. 25, 2016).

How Can Agencies Use 

the Criteria to Make 

Progress on High-Risk 

Issues?
Appendix I: Background

Page 71 GAO-19-157SP High-Risk Series 

Figure 8: Criteria for Removal from the High-Risk List and Examples of Actions Leading to Progress
Appendix I: Background

Page 72 GAO-19-157SP High-Risk Series 

A summary of areas removed from our High-Risk List over the past 29 

years is shown in figure 9. 

Figure 9: History of Areas Removed from the High-Risk List

What Is the History of 

Programs Removed from 

the High-Risk List?
Appendix I: Background

Page 73 GAO-19-157SP High-Risk Series 

The areas on our 2019 High-Risk List, and the year each was designated 

as high risk, are shown in figure 10. 

Figure 10: Areas on GAO’s 2019 High-Risk List Were Designated as High Risk, by Year Added

When Were Areas Added 

to the High-Risk List?
Appendix II: Overview for Each High-Risk Area

Page 74 GAO-19-157SP High-Risk Series 

The following pages provide overviews of the 35 high-risk areas on our 

updated list. Each overview discusses (1) why the area is high risk, (2) 

the actions that have been taken and that are under way to address the 

problem since our last update in 2017, and (3) what remains to be done. 

Each of these high-risk areas is also described on our High-Risk List 

website, http://www.gao.gov/highrisk/overview. 

Appendix II: Overview for Each High-Risk

Area 
Strategic Human Capital Management 

Page 75 GAO-19-157SP High-Risk Series 

The Office of Personnel Management and federal agencies must continue developing the capacity to measure 

and address existing mission-critical skills gaps, and use workforce analytics to predict and mitigate future 

gaps so agencies can effectively carry out their missions.

For this high-risk area, all five 

criteria remain unchanged since 

our previous report in 2017. 

Leadership commitment: met.

The Office of Personnel 

Management (OPM) continues to 

demonstrate top leadership 

commitment through its numerous 

efforts to assist agencies in 

addressing mission-critical skills 

gaps within their workforces. 

OPM’s regulation on strategic 

human capital management, which 

took effect in April 2017, requires 

executive branch agencies to issue 

human capital operating plans that, in part, must describe the agencies’ 

skills gaps and the strategies to be used for closing these gaps. OPM has 

provided guidance, training, and on-going support for agencies on the use 

of comprehensive data analytic methods for identifying skills gaps and the 

development of strategies to address these gaps. Additionally, the 

Director of OPM uses the Chief Human Capital Officers (CHCO) Council’s 

quarterly meetings to review and discuss agency data on the closure of 

agency-specific skills gaps.

Capacity: partially met. OPM and the CHCO Council continue 

supporting the efforts of the Federal Agency Skills Teams (FAST), which 

consist of occupational leaders and CHCO representatives who are 

responsible for setting goals for closing skills gaps and using 

measureable targets and appropriate metrics. OPM staff meet quarterly 

with FASTs to provide guidance on the development of action plans and 

use of OPM’s multi-factor model, a methodology for identifying skills 

gaps. In mid-2019, OPM plans to launch an automated version of the 

multi-factor model to facilitate and promote its use among FASTs.

Action plan: partially met. On a quarterly basis, OPM staff review and 

provide feedback to FASTs on the content of their action plans, such as 

the identification of the root causes for the skills gap, assignment of roles 

and responsibilities for implementing strategies, and the creation of 

outcome-oriented performance metrics. Additionally, OPM staff stated 

that they continue to train FAST members on applying OPM’s multi-factor 

model, developing a sound action plan, and identifying strategies for 

addressing identified skills gaps.

Strategic Human Capital Management

Why Area Is High Risk

Mission-critical skills gaps both within 

federal agencies and across the federal 

workforce pose a high risk to the nation 

because they impede the government 

from cost-effectively serving the public 

and achieving results. This area was 

added to the High-Risk List in 2001.

We, along with OPM and individual 

agencies, have identified skills gaps in 

such government-wide occupations in 

the fields of science, technology, 

engineering, mathematics, cybersecurity, 

and acquisitions. Causes for these skills 

gaps vary; however, they often occur 

due to a shortfall in one or more talent 

management activities such as robust 

workforce planning or training. 

Additionally, the changing nature of 

federal work and the high percentage of 

employees eligible for retirement could 

produce gaps in leadership and 

institutional knowledge, and could 

threaten to aggravate the problems 

created from existing skills gaps. For 

example, 31.6 percent of permanent 

federal employees who were on board 

as of September 30, 2017, will be 

eligible to retire in the next five years 

with some agencies having particularly 

high levels of employees to retire.

Mission-critical skills gaps are a 

contributing factor in making other areas 

across the government high risk. Of the 

34 other high-risk areas, skill gaps 

played a significant role in 16 areas, 

such as veterans’ health care.

Contact Information

For additional information about this 

high-risk area, contact Robert Goldenkoff 

at (202) 512-2757 or 

goldenkoffr@gao.gov or Yvonne D. 

Jones at (202) 512-2717 or 

jonesy@gao.gov. 
Strategic Human Capital Management 

Page 76 GAO-19-157SP High-Risk Series 

Monitoring: partially met. On a quarterly basis, OPM provides to 

agencies’ management and FASTs a data dashboard of 12 metrics which 

gives a snapshot of agencies’ progress on closing identified skills gaps. In 

March 2019, OPM plans to begin a “midterm” review of agencies’ efforts 

to mitigate skills gaps by issuing a memo to agencies asking for the 

status on their specific skills gaps and a description of challenges 

encountered during their efforts.

Demonstrated progress: not met. On the one hand, OPM has, among 

other actions, issued a regulation and developed tools and processes that 

could help agencies better identify and address current and newly 

emerging skills gaps. Additionally, senior agency leaders are required to 

meet annually with OPM officials to hold high-level, data-driven 

discussions on agencies’ progress towards meeting their human capital 

goals. 

On the other hand, OPM needs to ensure that individual agencies 

implement guidance, tools, and training, and fully develop and implement 

effective strategies to mitigate and close skills gaps within their own 

workforces. For instance, the inability of the Veterans Health 

Administration’s human resource staff to implement an effective 

recruitment strategy has affected the ability of its medical centers to 

maintain an adequate team of medical professionals to meet veterans’ 

health care needs. 

Agencies’ critical skills gaps contributed to 16 other high-risk areas and 

are noted throughout this report. They include 2020 Decennial Census, 

Strengthening DHS Management Functions, DOD Business Systems 

Modernization, DOD Financial Management, DOD Contract Management, 

DOE’s Contract Management for the National Nuclear Security 

Administration and Office of Environmental Management, U.S. 

Government’s Environmental Liability, Improving Federal Management of 

Programs that Serve Tribes and Their Members, Management of Federal 

Oil and Gas Resources, NASA Acquisition Management, Protecting 

Public Health through Enhanced Oversight of Medical Products, 

Improving and Modernizing Federal Disability Programs, VA Acquisition

Management, Managing Risks and Improving VA Health Care, Ensuring 

the Cybersecurity of the Nation, and Improving the Management of IT 

Acquisitions and Operations.

Over the years since we added this area to our High-Risk List, in addition 

to recommendations to address critical skills gaps in individual high-risk 

areas, we have made numerous recommendations to OPM related to this 

high-risk issue, 29 of which remain open. OPM needs to fully address the 

recommendations in our January 2015 report which call on the Director of 

OPM to make more strategic use of government workforce data to build a 

predictive capacity for identifying and mitigating emerging skills gaps 

What Remains to Be Done
Strategic Human Capital Management 

Page 77 GAO-19-157SP High-Risk Series 

across government. Our January 2015 report also recommended that 

OPM work with agency CHCOs to bolster the ability of agencies to 

assess workforce competencies by sharing competency surveys, lessons 

learned, and other tools and resources. Agencies also need to take action 

to address mission-critical skills gaps within their own workforces—a 

significant factor contributing to many high-risk areas. 

Embassy Construction: Pace is Slower Than Projected, and State Could 

Make Program Improvements. GAO-18-653. Washington, D.C.: 

September 25, 2018.

Tax Administration: Opportunities Exist to Improve Monitoring and 

Transparency of Appeal Resolution Timeliness. GAO-18-659. 

Washington, D.C.: September 21, 2018.

Information Technology: IRS Needs to Take Actions to Address 

Significant Risks to Tax Processing. GAO-18-298. Washington, D.C.: 

June 28, 2018.

Cybersecurity Workforce: Agencies Need to Improve Baseline 

Assessments and Procedures for Coding Positions. GAO-18-466. 

Washington, D.C.: June 14, 2018.

Defense Acquisition Workforce: Opportunities Exist to Improve Practices 

for Developing Program Managers. GAO-18-217. Washington, D.C.: 

February 15, 2018.

Cybersecurity Workforce: Urgent Need for DHS to Take Actions to 

Identify Its Position and Critical Skill Requirements. GAO-18-175. 

Washington, D.C.: February 6, 2018.

Bureau of Prisons: Better Planning and Evaluation Could Help Ensure 

Effective Use of Retention Incentives. GAO-18-147. Washington, D.C.: 

December 7, 2017.

National Weather Service: Actions Have Been Taken to Fill Increasing 

Vacancies, but Opportunities Exist to Improve and Evaluate Hiring. 

GAO-17-364. Washington, D.C.: May 24, 2017.

Strategic Human Capital Management: NRC Could Better Manage the 

Size and Composition of Its Workforce by Further Incorporating Leading 

Practices. GAO-17-233. Washington, D.C.: April 27, 2017. 

Veterans Health Administration: Actions Needed to Better Recruit and 

Retain Clinical and Administrative Staff. GAO-17-475T. Washington, 

D.C.: March 22, 2017.

Related GAO 

Products
Managing Federal Real Property 

Page 78 GAO-19-157SP High-Risk Series 

The federal government would save millions of dollars by disposing of unneeded buildings and reducing lease 

costs. Federal departments and agencies should also improve data reliability and federal facility security. 

Since our 2017 High-Risk Report, 

overall, the five criteria remain 

unchanged although there was 

progress within some individual 

segments. Three agencies 

involved in managing, tracking, 

and protecting federal real 

property government-wide—

Office of Management and 

Budget (OMB), General Services 

Administration (GSA), and 

Department of Homeland Security 

(DHS)—have made steady 

progress over multiple 

administrations in addressing 

federal real property challenges.

However, momentum has slowed, due to delayed implementation of the 

Federal Assets Sale and Transfer Act of 2016 (FASTA) and decreased 

implementation of reforms by federal agencies. Over the years since we 

added this area to our High-Risk List, we have made numerous 

recommendations related to this high-risk issue, 40 of which were made 

since the last high-risk update in February 2017. As of December 2018, 

63 recommendations are open. 

Excess and Underutilized Property

Ratings for this segment remain unchanged 

since our 2017 High-Risk Report.

Leadership commitment: met. In 2015, 

OMB implemented our recommendation to 

issue government-wide guidance—the 

National Strategy for the Efficient Use of 

the Real Property (National Strategy)—

which identified actions to reduce the size 

of the federal real property portfolio by 

prioritizing consolidation, co-location, and 

disposal actions, consistent with the 

Reduce the Footprint policy that required agencies to set goals for 

reducing unneeded space. An OMB official said that the National Strategy 

and Reduce the Footprint Policy are still in place. 

Managing Federal Real Property

Why Area Is High Risk

The federal government’s real estate 

portfolio is vast and diverse—including 

about 267,000 domestic buildings as of 

September 2016 that cost billions of 

dollars annually to operate and maintain. 

OMB and GSA both provide 

management support to agencies. OMB 

establishes federal policies and chairs 

the Federal Real Property Council. GSA 

provides space for federal tenants and 

collects data on real property. 

Additionally, DHS has management-level 

responsibilities through the DHS-chaired 

Interagency Security Committee (ISC) 

that sets security standards, and its

Federal Protective Service (FPS) 

protects about 9,000 federal buildings. 

Federal managers, however, rely on 

other agencies to reduce unneeded 

properties, produce reliable data, and 

follow ISC standards.

Since federal real property management 

was placed on the High-Risk List in 

2003, the federal government has given 

high-level attention to this issue; 

however, federal agencies continue to 

face long-standing challenges, including: 

(1) effectively disposing of excess and 

underutilized property, (2) relying too 

heavily on leasing, (3) collecting reliable 

real property data for decision making, 

and (4) protecting federal facilities.

Contact Information

For additional information about this 

high-risk area, contact Lori Rectanus at 

rectanusl@gao.gov or (202) 512-2834
Managing Federal Real Property 

Page 79 GAO-19-157SP High-Risk Series 

In 2016, FASTA established a 7-member civilian board to recommend 

unneeded federal buildings for disposal. However, the administration has 

not yet appointed a chair, a full board, or staff. 

In 2018, the Administration released its plan on Delivering Government 

Solutions in the 21st Century. As part of this plan, the Administration 

proposed a series of improvements to streamline and accelerate the 

disposal of excess federal property. These improvements include 

reducing the number of steps needed to dispose of unneeded federal 

property and creating incentives for disposals by allowing agencies to 

retain the proceeds from sales. 

Capacity: partially met. As noted in our 2017 high-risk update, OMB 

created the National Strategy and the Reduce the Footprint Policy to 

assist agencies, which represented positive steps. However, the National 

Strategy does not address the extent to which underlying challenges, 

such as budget limitations, impede agencies’ abilities to dispose of or 

better use real property, nor does it offer guidance on how agencies can 

overcome these challenges. Once the board is appointed, FASTA has the 

potential to increase the federal government’s capacity by establishing a 

process for identifying and disposing of unneeded federal buildings.

Action plan: met. We noted in 2017 that OMB had, through the Reduce 

the Footprint policy, established a government-wide action plan to (1) use 

property as efficiently as possible, and (2) reduce portfolios through 

annual reduction targets. 

Monitoring: partially met. OMB and GSA monitor progress in meeting 

space reduction targets using the government-wide real property 

database called the Federal Real Property Profile (FRPP). However, the 

database is not yet sufficiently reliable to produce accurate results. The 

Department of Defense (DOD) has almost half of the federal 

government’s buildings. However, OMB chose not to use DOD’s real 

property data in reporting the 2017 results of the Reduce the Footprint 

policy—the most recent year for which data is available—because the 

data were not sufficiently reliable. We reported in 2018 that weaknesses 

in the quality of the DOD’s real property data result, in part, because DOD 

has not developed a strategy to identify and address risks with 

accompanying time frames and performance metrics. Without such a 

strategy, DOD may miss the opportunity to reasonably ensure that the 

information needed for effective decision making by DOD, Congress, and 

other federal agencies is available to meet real property accountability 

and reporting objectives. 

Demonstrated progress: partially met. The fiscal year 2016 results 

from Reduce the Footprint show progress with the federal government 

more than doubling its reduction goal. However, in fiscal year 2017, the 
Managing Federal Real Property 

Page 80 GAO-19-157SP High-Risk Series 

federal government failed to reach the halfway point of its more modest 

reduction goal.

As part of the reforms that OMB is considering, it should: 

• identify alternative approaches to address underlying causes of real 

property problems and address the extent to which challenges impede 

progress, as we recommended in 2016; and

• refocus agency attention on meeting space reduction targets, as 

discussed. 

Additionally, the Administration needs to appoint vacant FASTA board 

positions and hire staff. 

The ratings for capacity and action plan 

improved since our 2017 High-Risk Report 

and the remaining three criteria remain 

unchanged.

Leadership commitment: met. OMB and 

GSA continue to take action to reduce costly 

leasing. For example, OMB proposed the 

creation of a capital revolving fund designed 

to facilitate ownership over operating leases 

for large-dollar buildings, although no action 

has been taken to implement it. An OMB 

staff member said that the legislative proposal to establish a capital fund 

was similar to an option we identified in a 2014 report. Additionally, GSA 

has developed a strategy to reduce leasing costs by a projected $4.7 

billion by fiscal year 2023, through steps that include focusing resources 

on high-value lease renewals.

Capacity: partially met. GSA made improvements and now partially 

meets the capacity criterion. Specifically, GSA implemented our 

September 2013 recommendation to develop a strategy to increase 

ownership investments for a prioritized list of high-value leases. These 

leases are for properties where it would be less expensive in the long run 

to own. GSA plans to purchase at least one leased building in 2019. In 

addition, as noted in our 2017 high-risk update, GSA could potentially 

help tenant agencies save millions of dollars from some leases by loaning 

them funds to improve newly leased spaces instead of agencies financing 

these costs with private-sector owners at private-sector interest rates. 

While GSA officials agreed that doing so would save money in interest 

fees, it has not yet developed a legislative proposal to obtain the needed 

authority, as we recommended in 2016.

What Remains to Be Done

Costly Leasing
Managing Federal Real Property 

Page 81 GAO-19-157SP High-Risk Series 

Action plan: met. GSA has made improvements and now meets the 

action plan criterion. GSA created an action plan to purchase buildings 

when it is more cost-effective than leasing by establishing criteria to rank 

and prioritize leased spaces that would benefit from federal ownership as 

discussed above. Additionally, GSA is implementing strategies to better 

manage leases that include avoiding short-term extensions and 

identifying opportunities to enter into long-term and lower cost leases. 

Monitoring: partially met. GSA continues to partially meet this criterion 

through implementation of the National Strategy, as noted in our 2017 

high-risk update. However, GSA should also implement our 

recommendations to reduce the costs to tenants by exploring strategies 

to enhance competition for GSA leases and reducing unneeded fees.

Additionally, GSA has identified actions to better monitor leases at 

different points along the process in order to minimize the need to enter 

into short-term, costly lease extensions. 

Demonstrated progress: partially met. GSA has made some progress 

in reducing the long-term costs of leasing by stemming the growth in 

leasing according to GSA data and committing to further reducing leasing 

costs. However, GSA must follow through on its plans to purchase leased 

buildings and reduce costs. GSA could also further reduce costs by 

loaning tenant agencies the funds needed to improve newly leased 

spaces but still needs to develop a legislative proposal to obtain authority 

to do so. 

GSA should develop a legislative proposal to obtain authority to loan 

agencies funds needed to improve newly leased spaces, as we 

recommended in 2016.

Ratings for one criterion improved since our 

2017 High-Risk Report and the other four 

criteria remain unchanged. 

Leadership commitment: met. In 

December 2017, GSA continued efforts to 

improve data reliability by completing a 

major effort to make the Federal Real 

Property Profile (FRPP) public. Also, as we 

reported in our 2017 High-Risk Report, GSA 

issued its Federal Real Property Data 

Validation and Verification (V&V) Guidance 

in May 2016 and required agencies to address 13,257 data anomalies it 

found in fiscal year 2016 data. 

What Remains to Be Done

Data Reliability
Managing Federal Real Property 

Page 82 GAO-19-157SP High-Risk Series 

Capacity: met. OMB and GSA continue to help agencies’ increase their 

capacity to submit accurate data. For example, GSA revised certain data 

elements’ definitions in 2016 and incorporated them in the 2018 FRPP 

Data Dictionary. In addition, OMB and GSA have further increased the 

capacity of FRPP to act as a government-wide database since additional 

agencies are required to report. 

Action plan: met. GSA has made progress by developing an action plan 

in 2017 for federal agencies to develop processes to assess, address, 

and track FRPP data quality. Specifically, this plan identifies data 

elements to appropriately indicate data quality, identifies best practices 

and other methods that help agencies measure and assess 

improvements, and enables federal agencies to develop performance 

metrics.

Monitoring: partially met. While GSA required agencies to research the 

anomalies it found in its V&V process, only some agencies have identified 

and committed to correct mistakes. Further, of the 13,257 anomalies GSA 

identified in the fiscal year 2016 data, agencies overall acknowledged that 

less than 8 percent of the anomalies (1,004 anomalies) represented 

erroneous data to be corrected, while indicating that the others were 

correct. Furthermore, some agencies acknowledged less than 1 percent 

of the anomalies represented erroneous data. In addition, we found in 

2018 that DOD did not correct discrepancies identified by its own V&V 

process.

Demonstrated progress: partially met. While GSA and some agencies 

have taken action to correct data, serious data reliability challenges 

remain with some individual agencies that undermine the reliability of the 

FRPP. In 2018, we found that DOD’s real property data continue to be 

inaccurate and incomplete, and that DOD lacks a plan for making the 

necessary improvements.

OMB and GSA should continue working with federal agencies to improve 

the reliability of their real property data through V&V efforts and 

encouraging agencies to implement action plans to better assess, 

address, and track data quality, as discussed in the above action plan. In 

particular, DOD should take steps to ensure that DOD improves the 

reliability of its real property data, as we recommended in 2018.

What Remains to be Done
Managing Federal Real Property 

Page 83 GAO-19-157SP High-Risk Series 

Ratings for this segment remain 

unchanged since our 2017 High-Risk 

Report.

Leadership commitment: met. DHS’s 

Federal Protective Service (FPS) 

continues to take action to address our 

recommendations. The Interagency 

Security Committee (ISC), an organization 

chaired by DHS that sets standards for 

physical security for federal nonmilitary 

facilities, also continues to implement the 

updated Risk Management Process—a consolidated set of standards for 

physical security at federal facilities. In addition, in 2018, GSA, the 

Administrative Office of the U. S. Courts (AOUSC), the U.S. Marshals 

Service, and FPS implemented our 2017 recommendation to establish a 

national-level working forum for courthouse security, known as the 

Interagency Judicial Security Council. 

Capacity: partially met. FPS has taken several actions to address 

identified physical security issues since our 2017 High-Risk Report. For 

example, in 2018 FPS improved its risk assessment tool to incorporate all 

necessary elements recommended by the ISC, which has now certified it. 

In 2018, FPS also addressed our recommendation related to improving 

training for instructors and identified actions to address our 

recommendations associated with tracking guard training. Finally, in 

2018, FPS also implemented several actions associated with our 

recommendation to develop human capital-related performance 

measures to evaluate progress towards agency goals. 

Some agencies may not have the capacity to conduct adequate risk 

assessments because their processes do not fully align with the ISC Risk 

Management Process. To improve their capacity, the U.S. Customs and 

Border Protection, Federal Aviation Administration, and the Department of 

Veterans’ Affairs still need to complete an assessment of their policies 

against the ISC’s standards in response to our 2017 and 2018 

recommendations.

Action plan: partially met. In September 2018, FPS and GSA signed a 

memorandum of agreement (MOA) clarifying their respective roles and 

responsibilities for federal facility security. However, FPS, GSA, and the 

Department of Justice have not yet addressed our 2011 recommendation 

to address a number of courthouse security challenges. Specifically, FPS, 

the U.S. Marshals Service, AOUSC, and GSA are still working to finalize 

the draft MOA on courthouse security. 

Physical Security
Managing Federal Real Property 

Page 84 GAO-19-157SP High-Risk Series 

Monitoring: partially met. FPS continues to develop a system that will 

allow FPS to verify independently that FPS’s contract guards are current 

on all training and certification requirements, and are taking steps to close 

this recommendation as implemented. FPS expects that system to be in 

place in 2019. In 2018, we also found that actions were needed to better 

address various emerging security threats to federal facilities.

Demonstrated progress: not met. The federal government has not 

demonstrated progress to improve physical security. Although agencies 

have taken some actions, time is needed for agencies to demonstrate the 

results of these actions. Additionally, agencies need to complete other 

actions. For example, once FPS, the U.S. Marshals Service, AOUSC, and 

GSA sign their MOA on courthouse security, they will be able to better 

protect federal facilities. Further, once FPS fully implements its guard 

management system and it interacts with its training system, FPS will be 

able to obtain information to assess its guards’ capability to address 

physical security risks across its portfolio.

To improve the physical security of federal buildings, the following steps 

are necessary:

• Clarify roles and responsibilities for the protection of federal facilities by 

finalizing the MOA for federal courthouse security between GSA, FPS, 

the U.S. Marshals, and AOUSC, as we recommended in 2011. 

• FPS must validate training information being entered to ensure that 

guards are getting critical training, as we recommended in 2012.

• Implement our recommendations for agencies to improve their monitoring 

of collaborative efforts to protect federal facilities, as we recommended in 

2015.

• Take actions to better address emerging security threats to federal 

facilities, as we recommended in 2018.

Federal Facility Security: Actions Needed to Better Address Various 

Emerging Threats. GAO-19-32SU. Washington, D.C.: October 17, 2018.

Defense Real Property: DOD Needs to Take Additional Actions to 

Improve Management of Its Inventory Data. GAO-19-73. Washington, 

D.C.: November 13, 2018.

Federal Buildings: More Consideration of Operations and Maintenance 

Costs Could Better Inform the Design Excellence Program. GAO-18-420. 

Washington, D.C.: May 22, 2018.

What Remains to be Done

Related GAO 

Products
Managing Federal Real Property 

Page 85 GAO-19-157SP High-Risk Series 

Federal Real Property: Agencies Make Some Use of Telework in Space 

Planning but Need Additional Guidance. GAO-18-319. Washington, D.C.: 

March 22, 2018.

Federal Buildings: Agencies Focus on Space Utilization As They Reduce 

Office and Warehouse Space. GAO-18-304. Washington, D.C.: March 8, 

2018.

VA Facility Security: Policy Review and Improved Oversight Strategy 

Needed. GAO-18-201. Washington, D.C.: January 11, 2018. 

Federal Facility Security: Selected Agencies Should Improve Methods for 

Assessing and Monitoring Risk. GAO-18-72. Washington, D.C.: October 

26, 2017.

Federal Real Property: GSA Should Inform Tenant Agencies When 

Leasing High-Security Space from Foreign Owners. GAO-17-195. 

Washington, D.C.: January 3, 2017.
Funding the Nation’s Surface Transportation 

System

Page 86 GAO-19-157SP High-Risk Series 

Congress needs to pass a long-term, sustainable solution for funding surface transportation.

We are not rating this high-risk area 

because addressing the identified 

issues primarily involves 

congressional action.

Motor fuel taxes and additional 

truck-related taxes that support the 

Highway Trust Fund—the major 

source of federal surface 

transportation funding—are 

eroding. Federal motor fuel tax 

rates have not increased since 

1993, and we reported in 2012 that 

drivers of passenger vehicles with 

average fuel efficiency paid about 

$96 per year in federal gasoline taxes. Because of inflation, the 18.4 centper-gallon federal tax on gasoline has about one-third less purchasing 

power than it did when the tax was last raised in 1993.

To maintain spending levels of about $45-50 billion a year for highway 

and transit programs and to cover revenue shortfalls, Congress 

transferred a total of about $141 billion in general revenues to the 

Highway Trust Fund on eight occasions from 2008 through 2015. These 

transfers each represented a one-time infusion of funding, not a 

sustainable long-term source of revenues. This funding approach 

effectively ended the long-standing principle of “users pay” in highway 

finance, breaking the link between the taxes paid and the benefits 

received by highway users.

Most recently, the Fixing America’s Surface Transportation (FAST) Act 

authorized around $70 billion of the $141 billion in transfers for 2015 

through 2020. After 2021, the gap between projected revenues and 

spending will recur. In January 2019, the Congressional Budget Office 

estimated that $159 billion in additional funding would be required to 

maintain current spending levels plus inflation from 2022 through 2029, 

as shown in figure 11. 

Funding the Nation’s Surface Transportation 

System

Why Area Is High Risk

The nation’s surface transportation 

system—including highways, transit, 

maritime ports, and rail systems that 

move both people and freight—is under 

growing strain. Further, the cost to 

repair and upgrade the system to meet 

current and future demand is estimated 

in the hundreds of billions of dollars. The 

oldest portions of the Interstate Highway 

System are over 60 years old, and 

almost 9 percent of the nation’s bridges 

were rated as structurally deficient in 

2017.These challenges are intensified by 

a range of factors such as shifting 

demographics, a growing economy, and 

rapid development of new technologies. 

This issue has been on our High-Risk 

List since 2007.

These surface transportation challenges 

come at a time when traditional funding 

sources are eroding, and the federal 

government lacks a long-term 

sustainable strategy for funding surface 

transportation. Funding is further 

complicated by the federal government’s 

financial condition and fiscal outlook. 

The nation is on an unsustainable longterm fiscal path of deficits and debt, and 

Congress and the administration face 

difficult policy choices about federal 

revenues, spending and investment; 

choices that need to be accompanied by 

a broader fiscal plan to put the 

government on a more sustainable longterm fiscal path. 

Contact Information

For additional information about this 

high-risk area, contact Susan Fleming at 

(202) 512-2834 or flemings@gao.gov.
Funding the Nation’s Surface Transportation 

System

Page 87 GAO-19-157SP High-Risk Series 

Figure 11: Projected Cumulative Highway Trust Fund Balance, Fiscal Years 2022

through 2029 

Note: This projection assumes no further augmentation of highway-related taxes to the Highway Trust 

Fund after 2021 from general revenues or other sources. By law, the Highway Trust Fund cannot 

incur negative balances. 

A long-term sustainable plan for funding surface transportation requires 

congressional action and remains the pivotal action that will determine 

whether this issue remains on, or is removed from, our High-Risk List. 

However, it is also important that federal funding for surface 

transportation be spent wisely and efficiently. 

Over the last decade we have noted opportunities to improve 

performance and accountability in how surface transportation funds are 

spent by maximizing the use of existing resources and linking funding to 

performance. These opportunities include (1) implementing a 

performance-based approach to surface transportation funding, and (2) 

improving how surface transportation projects are selected through DOT’s 

discretionary grant programs.

Performance-based approach to surface transportation funding. 

Historically, spending for surface transportation programs has not 

effectively addressed key challenges, such as deteriorating infrastructure 

conditions and increasing congestion and freight demand. This is 

because federal goals and roles have been unclear, programs have 

lacked links to performance, and programs have not used the best tools 

and approaches to ensure effective investment decisions. Beginning in 

2008, we suggested that Congress consider a fundamental reexamination 

of these programs to improve performance and accountability by 
Funding the Nation’s Surface Transportation 

System

Page 88 GAO-19-157SP High-Risk Series 

clarifying federal goals and roles, establishing performance links, and 

improving investment decision-making.

Provisions enacted in 2012 in the Moving Ahead for Progress in the 21st 

Century Act (MAP-21) and affirmed in the 2015 FAST Act have begun to 

address these key challenges. Specifically, MAP-21 included provisions 

to move toward a more performance-based surface transportation 

program by establishing national performance goals in areas such as 

infrastructure condition, safety, and system performance. The act and its 

implementing regulations set forth a three-stage process in which (1) 

DOT establishes performance measures and standards, (2) states and 

other grantees set targets based on these performance measures and 

states report progress to DOT, and (3) DOT evaluates whether grantees 

have met or made significant progress toward their targets. 

DOT has been implementing the performance-based approach 

envisioned in MAP-21. For example, in January 2017, the Federal 

Highway Administration (FHWA) finalized the last of six interrelated rules 

establishing performance measures in the areas of safety, pavement and 

bridge conditions, and system performance. States and other grantees 

began setting targets in 2018. In July 2017 we reported that without a 

formal plan guiding and coordinating FHWA’s efforts, the agency might 

struggle to articulate the goals and purpose of the transition, and to 

identify and address the activities best suited to help states and others 

overcome challenges. As a result, we recommended that FHWA develop 

an implementation plan—including strategic goals for the transition to a 

performance-based approach, specific efforts FHWA plans to take to help 

states and other grantees successfully make the transition, and a 

timetable for when these efforts would be completed. In July 2018, FHWA 

publicly released an implementation plan that addressed the issues we 

identified and the recommendation we made in 2017. 

Discretionary grants. Discretionary grants are an important component 

in improving the performance and accountability of transportation funding 

decisions. We have reported that the historic approach to funding surface 

transportation, in particular highways, poses challenges because funding 

has been principally provided through formulas designed largely to return 

revenues to their attributed state of origin in order to closely align the 

states’ contributions to the Highway Trust Fund with the funding they 

receive. The FAST Act authorized about a dozen new discretionary grant 

programs. For example, the FAST Act established a grant program to 

fund freight and highway projects of regional or national importance, and 

in 2016 DOT awarded nearly $760 million for the Fostering 

Advancements in Shipping and Transportation for the Long-term 

Achievement of National Efficiencies (FASTLANE) grant program to 18 

projects. While over 90 percent of spending from the Highway Trust Fund 

will continue to be distributed by formula, the FAST Act represents a 
Funding the Nation’s Surface Transportation 

System

Page 89 GAO-19-157SP High-Risk Series 

promising development to address national and regional transportation 

priorities. 

We have found challenges with DOT’s implementation of discretionary 

grant programs, including problems with the transparency of the 

application review and selection process, and a lack of documentation of 

key decisions. For example, in November 2017 we reported that, due to 

inconsistencies in assessing applications for the FASTLANE program, we 

were unable to determine the rationale DOT used to award $759.2 million 

to the 18 projects it selected. Similarly, in December 2016, we found that 

the Federal Transit Administration (FTA) did not document key decisions 

in awarding $3.6 billion in discretionary grants for projects to increase the 

resilience of transit systems to withstand future disasters in areas affected 

by Hurricane Sandy. We have raised concerns about the lack of 

documentation of key decisions in DOT discretionary grant programs 

since 2011.

Given the continuing challenges we have found with DOT discretionary 

grant programs, and the number of new programs authorized by the 

FAST Act, we recommended in December 2016 that the Secretary of 

Transportation issue a directive governing department-wide and modal 

administration discretionary grant programs. Such a directive should 

include requirements to, among other things, (1) develop an up-front plan 

for evaluating project proposals to ensure DOT reviews applications 

consistently, and (2) document key decisions, including the reason for 

any rating changes, as well as how high-level concerns raised during the 

process were addressed. DOT concurred with the recommendation and 

stated it planned to implement it in 2019 by updating its Financial 

Assistance Guidance Manual. In order to fully implement this 

recommendation, DOT needs to issue a directive that incorporates all of 

the elements identified above.

Congress and the administration need to agree on a long-term plan for 

funding surface transportation. Continuing to augment the Highway Trust 

Fund with general revenues may not be sustainable, given competing 

demands and the federal government’s long-term fiscal challenges. A 

sustainable solution would balance revenues to and spending from the 

Highway Trust Fund. New revenues from users can come only from taxes 

and fees; ultimately, major changes in transportation spending or in 

revenues, or in both, will be needed to bring the two into balance. In 

2008, we reported that Congress should consider addressing the 

imbalance between federal surface transportation revenues and 

spending. That matter has not been addressed, and the current 

authorization for surface transportation funding expires in October 2020.

Congressional Actions

Needed
Funding the Nation’s Surface Transportation 

System

Page 90 GAO-19-157SP High-Risk Series 

While passage by Congress of a long-term sustainable plan for funding 

surface transportation is the pivotal action that is needed to remove this 

issue from our High-Risk List, it is also increasingly important that the 

effectiveness of surface transportation programs be improved by 

maximizing the use of existing resources and linking funding to 

performance. Specifically, DOT can: 

• continue to make progress implementing the performance-based 

framework established in MAP-21, and

• enhance the management of its discretionary grant programs and 

respond to our recommendation to develop a directive to help ensure the 

integrity of future DOT discretionary grant programs.

Discretionary Transportation Grants: DOT Should Take Actions to 

Improve the Selection of Freight and Highway Projects. GAO-18-38. 

Washington, D.C.: November 2, 2017.

Surface Transportation: A Comprehensive Plan Could Facilitate 

Implementation of a National Performance Management Approach. 

GAO-17-638. Washington, D.C.: July 27, 2017.

DOT Discretionary Grants: Problems with Hurricane Sandy Transit Grant 

Selection Process Highlight the Need for Additional Accountability. 

GAO-17-20. Washington, D.C.: December 14, 2016. 

Surface Transportation: DOT Is Progressing Toward a PerformanceBased Approach, but States and Grantees Report Potential 

Implementation Challenges. GAO-15-217. Washington, D.C.: January 16, 

2015. 

Surface Transportation: Actions Needed to Improve Documentation of 

Key Decisions in the TIGER Discretionary Grant Program. GAO-14-628R. 

Washington, D.C.: May 28, 2014. 

Highway Trust Fund: Pilot Program Could Help Determine the Viability of 

Mileage Fees for Certain Vehicles. GAO-13-77. Washington, D.C.: 

December 13, 2012. 

Highway Trust Fund: All States Received More Funding Than They 

Contributed in Highway Taxes from 2005 to 2009. GAO-11-918. 

Washington, D.C.: September 8, 2011. 

Surface Transportation: Restructured Federal Approach Needed for More 

Focused, Performance-Based, and Sustainable Programs. GAO-08-400. 

Washington, D.C.: March 6, 2008.

What Remains to Be Done

Related GAO 

Products
Modernizing the U.S. Financial Regulatory 

System

Page 91 GAO-19-157SP High-Risk Series 

Financial regulators need to strengthen systemic risk oversight and monitor progress on reforms, and 

Congress may want to consider options to address inefficiencies that hamper the financial regulatory system.

Since our 2017 High-Risk Report, 

ratings for all five criteria remain 

unchanged. Actions are needed 

by financial regulators and 

Congress to address this high-risk 

area. 

Leadership commitment: 

partially met. Since policymakers 

enacted the Dodd-Frank Wall 

Street Reform and Consumer 

Protection Act (Dodd-Frank Act) 

in July 2010, financial regulators 

have shown leadership 

commitment by finalizing rules to 

implement most of the DoddFrank Act’s rule-making 

requirements. While the act included provisions to better position the 

financial regulatory system to address key financial stability risks, it 

generally left the financial regulatory structure unchanged. In February 

2016, we reported that remaining fragmentation and overlap in the 

structure have created inefficiencies in regulatory processes and 

inconsistencies in how regulators oversee similar types of institutions. We 

also reported that while the Dodd-Frank Act created the Financial Stability 

Oversight Council (FSOC) to identify and address threats to financial 

stability, FSOC’s legal authorities may not allow it to respond effectively to 

systemic risks. 

Capacity: partially met. The Dodd-Frank Act created FSOC and 

included other provisions intended to increase the capacity of the financial 

regulatory system to identify and address risks to the stability of the 

financial system. While most of these reforms have been implemented, 

rulemakings for certain reforms have only recently been finalized or taken 

effect, while others are currently being modified under the May 2018 

Economic Growth, Regulatory Relief and Consumer Protection Act. In 

addition, FSOC and the Department of the Treasury’s Office of Financial 

Research (OFR) have not completed steps to clarify their respective 

responsibilities for monitoring financial stability risks.

Action plan: partially met. FSOC’s annual reports have served as the 

council’s key accountability document, as each report (1) discusses the 

progress regulators have made in implementing reforms, (2) identifies 

newly emerging threats, and (3) includes recommendations to address 

Modernizing the U.S. Financial Regulatory 

System

Why Area Is High Risk

The U.S. financial regulatory structure 

remains complex, with responsibilities 

fragmented among a number of 

regulators that have overlapping 

authorities. The current structure 

introduces significant challenges for 

efficient and effective oversight of

financial institutions and activities. 

Moreover, in the decades leading up to 

the financial crisis of 2007—2009, the 

financial regulatory system failed to 

adapt to significant changes. 

First, although the financial sector 

increasingly had become dominated by 

large, interconnected financial 

conglomerates, no single regulator was 

tasked with monitoring and assessing 

the risks that these firms' activities posed 

across the entire financial system. 

Second, entities that had come to play 

critical roles in the financial markets were 

not subject to sufficiently comprehensive 

regulation and oversight. Third, the 

regulatory system was not effectively 

providing key information and protections 

for new and more complex financial 

products for consumers and investors. 

Consequently, we added this area to the 

High-Risk List in 2009.

Modernizing the U.S. financial regulatory 

system and aligning it to current 

conditions is essential to reducing the 

likelihood that our nation will experience 

another major financial crisis.

Contact Information

For additional information about this 

high-risk area, contact Lawrance Evans, 

Jr. at (202) 512-8678 or 

evansl@gao.gov.
Modernizing the U.S. Financial Regulatory 

System

Page 92 GAO-19-157SP High-Risk Series 

them. While FSOC can respond to certain potential systemic risks, 

primarily through its designation authority, FSOC cannot compel 

regulators to act with respect to other sources of systemic risk. This 

presents a challenge to holding FSOC and the financial regulators 

accountable for addressing systemic risk. 

In addition, financial regulators are required to conduct retrospective 

reviews of the effects of their regulations. However, some have not yet 

developed plans for how these reviews will incorporate quantitative 

analysis and identify opportunities for streamlining bodies of regulation.

Monitoring: partially met. FSOC monitors and reports on indicators of 

financial stability and potential emerging threats to financial stability. 

Since the financial crisis, the Board of Governors of the Federal Reserve

System’s (Federal Reserve) stress test programs have played a key role 

in supervisory efforts to evaluate and maintain financial stability. In 

November 2016, we recommended that the Federal Reserve enhance the 

effectiveness of these stress test programs by further assessing—and 

adjusting as needed—the severity of the stress scenarios and other 

aspects of the test design.

Demonstrated progress: partially met. The new agencies and 

oversight bodies created under the Dodd-Frank Act have taken actions to 

carry out their missions. For example, FSOC meets regularly to discuss 

issues related to risks to the U.S. financial system. The Federal Reserve 

and the OFR have taken steps to reduce potential duplication and ensure 

comprehensive efforts to monitor systemic risks. For example, the two 

agencies coordinated semi-annual meetings to jointly discuss views from 

their respective monitoring of the financial system. In our continuing work 

to monitor this area, we determined that federal financial regulators could 

take additional steps to improve the efficiency and effectiveness of the 

financial regulatory system. For example, additional progress is needed in 

the areas of planning for retrospective reviews of rules and implementing

the Federal Reserve’s stress test programs.

Over the years since we added this area to our high-risk list, we have 

made numerous recommendations related to this area. As of December 

2018, 26 of these recommendations remain open. FSOC and its member 

agencies should implement our open recommendations related to 

strengthening oversight of risks to financial stability and assessing the 

effectiveness of Dodd-Frank Act reforms:

• FSOC and the OFR should clarify their respective responsibilities to 

monitor risks to financial stability to avoid gaps and duplication in these 

efforts.

What Remains to Be Done
Modernizing the U.S. Financial Regulatory 

System

Page 93 GAO-19-157SP High-Risk Series 

• To improve the effectiveness of its stress test programs, the Federal 

Reserve should further assess key aspects of stress scenario design and 

take steps to improve its ability to manage model risk (the potential for 

adverse consequences from decisions based on incorrect or misused 

model outputs). Although the Federal Reserve has taken responsive 

actions related to some of our recommendations in this area, taking the 

additional steps we recommended can help the Federal Reserve identify 

and manage the risks introduced into its models, and account 

appropriately for uncertainty and sensitivity of model results.

• Under their authority, FSOC should work with federal financial regulators 

to establish formal coordination policies that clarify issues such as when 

interagency coordination should occur around rulemakings and the role 

FSOC should play in facilitating that coordination.

• The Federal Reserve and the Office of the Comptroller of the Currency 

should develop plans for how they will conduct required retrospective 

analyses of rulemakings, including how and when they will collect, 

analyze, and report needed data.

Addressing weaknesses in the U.S. financial regulatory structure will 

require additional congressional leadership in the following two areas as 

suggested in our reports:

• Addressing fragmentation and overlap in the regulatory structure. 

Congress should consider whether additional changes to the financial 

regulatory structure are needed to reduce or better manage 

fragmentation and overlap in the oversight of financial institutions and 

activities to improve (1) the efficiency and effectiveness of oversight; (2) 

the consistency of consumer and investor protections; and (3) the 

consistency of financial oversight for similar institutions, products, risks, 

and services. 

For example, Congress could consider consolidating the number of 

federal agencies involved in overseeing the safety and soundness of 

depository institutions, combining the entities involved in overseeing the 

securities and derivatives markets, and determining the optimal federal 

role in insurance regulation, among other considerations.

• Clarifying FSOC’s authorities and mission. Congress should consider 

whether legislative changes are necessary to align FSOC’s authorities 

with its mission to respond to systematic risks. Congress could do so by 

making changes to FSOC’s mission, its authorities, or both, or to the 

missions and authorities of one or more of the FSOC member agencies 

to support a stronger link between the responsibility and capacity to 

respond to systemic risks.

Congressional Actions Needed
Modernizing the U.S. Financial Regulatory 

System

Page 94 GAO-19-157SP High-Risk Series 

Community Banks and Credit Unions: Regulators Could Take Additional 

Steps to Address Compliance Burdens. GAO-18-213. Washington, D.C.: 

February 13, 2018.

Federal Reserve: Additional Actions Could Help Ensure the Achievement 

of Stress Test Goals. GAO-17-48. Washington, D.C.: November 15, 

2016.

Resolution Plans: Regulators Have Refined Their Review Processes but 

Could Improve Transparency and Timeliness. GAO-16-341. Washington, 

D.C.: April 12, 2016.

Financial Regulation: Complex and Fragmented Structure Could Be 

Streamlined to Improve Effectiveness. GAO-16-175. Washington, D.C.: 

February 25, 2016.

Dodd-Frank Regulations: Impacts on Community Banks, Credit Unions 

and Systemically Important Institutions. GAO-16-169. Washington, D.C.: 

December 30, 2015.

Bank Regulation: Lessons Learned and a Framework for Monitoring 

Emerging Risks and Regulatory Response. GAO-15-365. Washington, 

D.C.: June 25, 2015.

Financial Stability Oversight Council: Further Actions Could Improve the 

Nonbank Designation Process. GAO-15-51. Washington, D.C.: November 

20, 2014.

Financial Stability: New Council and Research Office Should Strengthen 

the Accountability and Transparency of Their Decisions. GAO-12-886. 

Washington, D.C.: September 11, 2012.

Dodd-Frank Act Regulations: Implementation Could Benefit from 

Additional Analyses and Coordination. GAO-12-151. Washington, D.C.: 

November 10, 2011.

Financial Regulation: A Framework for Crafting and Assessing Proposals 

to Modernize the Outdated U.S. Financial Regulatory System. 

GAO-09-216. Washington, D.C.: January 8, 2009.

Related GAO 

Products
Resolving the Federal Role in Housing Finance

Page 95 GAO-19-157SP High-Risk Series 

Congress should consider establishing objectives for the future federal role in housing finance and establishing 

a transition plan that enables Fannie Mae and Freddie Mac—to exit federal conservatorship. Additionally, 

housing and regulatory agencies need to take actions to help manage mortgage-related risk. 

Our ratings for the five criteria 

remain unchanged from our 2017 

High-Risk Report. Actions are 

needed by housing and 

regulatory agencies and by 

Congress to address this highrisk area.

Leadership commitment: 

partially met. Housing and 

regulatory agencies have 

demonstrated some leadership 

commitment. For example, in 

January 2013 and December 

2014, respectively, agencies 

finalized “qualified mortgage” and 

“qualified residential mortgage” regulations designed to prevent a 

recurrence of risky practices in originating and securitizing mortgages that 

contributed to the financial crisis. 

Resolving the federal role in housing finance will require statutory 

changes. Congress held hearings and developed legislative proposals on 

housing finance reform since our 2017 High-Risk Report. However, it has 

not enacted legislation establishing objectives for the future federal role in 

housing finance or a transition plan that enables the enterprises—the 

Federal National Mortgage Association (Fannie Mae) and Federal Home 

Loan Mortgage Corporation (Freddie Mac)—to exit federal 

conservatorship. Also, some prior proposals have not had a system-wide 

focus. For example, some proposals address the enterprises but do not 

consider other entities such as the Federal Housing Administration (FHA) 

and the Government National Mortgage Association (Ginnie Mae). 

Capacity: partially met. Under the Federal Housing Finance Agency’s 

(FHFA) conservatorship, the enterprises—which guarantee more than $5 

trillion in mortgage-backed securities—generally have operated profitably 

since 2012. FHFA also has taken actions to assess the financial capacity 

of the enterprises and mitigate some of their risks by overseeing annual 

stress tests and directing them to take actions that have transferred 

increasing amounts of credit risk to private market entities. 

However, FHFA lacks statutory authority to examine nonbank mortgage 

servicers (nondepository institutions that collect loan payments, among 

Resolving the Federal Role in Housing 

Finance

Why Area Is High Risk

The expanded federal role in housing 

finance began during the 2007–2009 

financial crisis and has substantially 

increased the government’s fiscal 

exposure. Because objectives for the 

future role have not been established, 

we designated resolving the federal role 

in housing finance as a high-risk area in 

2013.

In recent years, the federal government 

has supported more than two-thirds of 

the value of new home mortgages. FHFA 

placed the enterprises into 

conservatorships in 2008 due to concern 

that their deteriorating financial condition 

threatened economic stability. As of 

September 2018, the enterprises had 

received $191.4 billion in capital support 

from the Department of the Treasury 

(Treasury) and paid dividends to 

Treasury exceeding that amount. If they 

were to incur major additional losses, 

they would draw required amounts from 

their remaining $254.1 billion in Treasury 

commitments. 

The federal government also supports 

mortgages through insurance and 

guarantee programs. FHA has an 

insured portfolio that exceeds $1.2 trillion 

and that required about $1.7 billion in 

supplemental funds in 2013. Ginnie Mae 

guarantees the performance of almost 

$2 trillion in securities backed by 

mortgages with FHA or other federal 

agency support.

Contact Information

For additional information about this 

high-risk area, contact Daniel GarciaDiaz at (202) 512-8678 or 

garciadiazd@gao.gov. 
Resolving the Federal Role in Housing Finance

Page 96 GAO-19-157SP High-Risk Series 

other functions) and other third parties who do business with and pose 

potential risks to the enterprises. Also, prolonged conservatorships could 

create uncertainties for market participants and hinder the development of 

the broader mortgage securities market. 

FHA has enhanced its risk-management practices in response to our 

recommendations, and while the agency’s Mutual Mortgage Insurance 

Fund did not meet its statutory minimum capital requirement in fiscal 

years 2009–2014, it has met the requirement each subsequent year. 

FHA’s capital requirement, however, is not based on a specified risk 

threshold, such as the economic conditions the fund would be expected 

to withstand. 

A severe economic downturn could strain the capacity of FHA and the 

enterprises, and require taxpayer funds to cover actual or expected 

losses, as occurred during the financial crisis and associated housing 

market crash.

Action plan: partially met. Although fundamental changes to the 

housing finance system have yet to be enacted, federal agencies have 

taken some planning steps to facilitate the transition to a future federal 

role. For example, FHFA has continued efforts to create a common 

securitization platform for the enterprises, with the ultimate goal of 

building an infrastructure that could be used by other market participants 

in the future. Additionally, in July 2016, the Department of the Treasury, 

FHFA, and the Department of Housing and Urban Development (of which 

FHA is a component) issued a report with guiding principles for future 

efforts to mitigate mortgage losses, based on lessons from the financial 

crisis. 

If Congress enacts changes to the housing finance system, relevant 

federal agencies will need to develop action plans to effectively 

implement the changes.

Monitoring: partially met. Federal agencies have taken some steps to 

provide the types of monitoring that may aid assessment of the effects of 

changes to the housing finance system. For example, FHFA and the 

Consumer Financial Protection Bureau monitor different aspects of the 

mortgage market, including emerging risks and consumer challenges, 

through activities such as examinations of regulated entities and analysis 

of consumer complaints. 

FHFA and the Consumer Financial Protection Bureau also have 

continued a joint initiative—the National Mortgage Database Program—

that could be useful for examining the effect of mortgage market reforms. 

One component is developing a representative database of loan-level 

information on the terms and performance of mortgages, as well as 

characteristics of the associated borrowers and properties. Another 
Resolving the Federal Role in Housing Finance

Page 97 GAO-19-157SP High-Risk Series 

component is a quarterly national survey of a representative sample of 

recent borrowers about their experiences in obtaining a mortgage. But 

housing and regulatory agencies have not taken all necessary steps, 

including specifying metrics and methods, to assess the effects of key 

mortgage regulations implemented in response to the last housing crisis. 

Demonstrated progress: not met. Overall progress on resolving the 

federal role in housing finance will be difficult to achieve until Congress 

provides further direction by enacting changes to the housing finance 

system. Assessing progress against specific goals is not yet possible 

because Congress has not provided an overall blueprint for the future

federal role in housing finance or determined the specific roles federal 

agencies will play.

Housing and regulatory agencies should implement our previous 

recommendations designed to help manage mortgage-related risks and 

assess the effects of mortgage reforms already in place:

• The Department of Housing and Urban Development should develop a 

plan that identifies the metrics, baselines, and analytical methods needed 

to conduct retrospective reviews of its qualified mortgage regulations 

(i.e., analyze how well the regulations work in practice), consistent with 

Executive Orders and Office of Management and Budget guidance. 

• Agencies responsible for the qualified residential mortgage regulations—

including the Federal Deposit Insurance Corporation, Board of Governors 

of the Federal Reserve System, Office of the Comptroller of the 

Currency, and Department of Housing and Urban Development—should 

develop plans that identify the metrics, baselines, and analytical methods 

to be used for retrospective reviews.

Over the years since we added this area to the High-Risk List, we have 

made numerous recommendations related to this high-risk issue, two of 

which were made since the last high-risk update in February 2017. As of 

December 2018, six recommendations are open.

Congressional actions we have previously recommended will be needed 

to help resolve the federal role in housing finance and manage federal 

fiscal exposure to the mortgage market. 

Specifically, Congress should consider housing finance reform legislation 

that 

• establishes objectives for the future federal role in housing finance, 

including the role and structure of the enterprises within the housing 

finance system, 

• provides a transition plan to a reformed system that enables the 

enterprises to exit federal conservatorship, and 

What Remains to Be Done

Congressional Actions Needed
Resolving the Federal Role in Housing Finance

Page 98 GAO-19-157SP High-Risk Series 

• considers all relevant federal entities, including FHA and Ginnie Mae.

Congress also should consider other actions we have previously 

recommended to help manage mortgage risks, such as

• granting FHFA explicit authority to examine nonbank servicers and other 

third parties that do business with the enterprises, and

• specifying the economic conditions that FHA’s Mutual Mortgage 

Insurance Fund would be expected to withstand without substantial risk 

of drawing on supplemental funds, and require FHA to specify and 

comply with a capital ratio consistent with these conditions. 

Housing Finance: Prolonged Conservatorships of Fannie Mae and 

Freddie Mac Prompt Need for Reform. GAO-19-239. Washington, D.C.: 

January 18, 2019.

Federal Housing Administration: Capital Standards and Stress Testing 

Practices Need Strengthening. GAO-18-92. Washington, D.C.: November 

9, 2017.

Federal Housing Finance Agency: Objectives Needed for the Future of 

Fannie Mae and Freddie Mac After Conservatorships. GAO-17-92. 

Washington, D.C.: November 17, 2016.

Nonbank Mortgage Servicers: Existing Regulatory Oversight Could Be 

Strengthened. GAO-16-278. Washington, D.C.: March 10, 2016.

Mortgage Reforms: Actions Needed to Help Assess Effects of New 

Regulations. GAO-15-185. Washington, D.C.: June 25, 2015. 

Housing Finance System: A Framework for Assessing Potential Changes. 

GAO-15-131. Washington, D.C.: October 7, 2014.

Related GAO 

Products
USPS Financial Viability 

Page 99 GAO-19-157SP High-Risk Series 

Comprehensive legislative reform and additional cost-cutting are needed for the U.S. Postal Service (USPS) to 

achieve sustainable financial viability.

Since our 2017 High-Risk Report, 

ratings for one criterion improved, 

one regressed, and three remain 

unchanged. The monitoring 

progress criterion is now met, but 

the demonstrated progress 

criterion regressed to not met.

Removal of USPS’s financial 

viability from the High-Risk List 

would require fundamental 

changes. Both Congress and 

USPS need to act to put it on a 

sustainable financial footing. 

USPS has lost $69.0 billion over 

the past 11 fiscal years—

including $3.9 billion in fiscal year 

2018—and has budgeted for a $6.6 billion net loss in fiscal year 2019. 

Leadership commitment: partially met. USPS continues to seek some 

legislative changes intended to improve its financial condition. For 

example, USPS has sought legislation that would integrate its retiree 

health program with Medicare, which would significantly reduce its total 

unfunded liabilities. USPS also has sought legislation that would require a 

rate increase for most mail. Further, USPS is seeking the elimination of 

the price cap that generally limits rate increases for most mail to the rate 

of inflation. 

USPS has implemented limited initiatives to manage its labor costs, such 

as a small reduction to its workforce in fiscal year 2018 through attrition. 

USPS has stated that opportunities for further cost savings are limited 

under the existing legal framework and would do little to close its financial 

gap. 

Capacity: partially met. USPS plans to increase capital spending in the 

coming decade to replace and modernize its infrastructure after years of 

reduced capital investment. For example, USPS plans to replace its aging 

fleet of delivery vehicles, which is intended to increase its capacity to 

deliver mail and packages in a more cost-efficient manner. 

However, given the uncertainty of USPS’s financial situation, the ability to 

carry out this spending may require tradeoffs with other commitments. 

USPS is only able to make capital investments and pay for its ongoing 

USPS Financial Viability

Why Area Is High Risk

USPS’s financial viability has been on 

our High-Risk List due to the need for 

action to address USPS’s poor financial 

condition. In July 2009, we reported that 

USPS’s financial condition needed 

attention by Congress and the executive 

branch to achieve broad-based 

restructuring. Currently one open Matter 

for Congressional Consideration is 

related to this high-risk area. 

USPS financial viability continues to be 

high-risk because USPS cannot fund its 

current level of services and financial 

obligations from its revenues. As an 

independent establishment in the 

executive branch, USPS has long been 

expected to provide affordable, quality, 

and universal postal service to all parts 

of the country while remaining selffinancing. Specifically, USPS is expected 

to be financially self-sufficient by 

covering its expenses through revenues 

generated from the sale of its products 

and services. 

However, USPS is no longer able to do 

so. USPS’s most profitable product—

First-Class Mail—is expected to continue 

declining for the foreseeable future, and 

USPS faces increasing competition in its 

less profitable package shipping 

business. Meanwhile, key costs, such as 

compensation and benefits, are rising. 

Contact Information

For additional information about this 

high-risk area, contact Lori Rectanus at 

(202) 512-2834 or rectanusl@gao.gov.
USPS Financial Viability 

Page 100 GAO-19-157SP High-Risk Series 

operations by not making certain required federal payments to fund 

accrued retirement benefits. 

Action plan: partially met. USPS issued its 5-year strategic plan for 

fiscal years 2017 to 2021 outlining its strategy for making progress 

towards financial viability, and developed annual performance plans that 

specify goals for each fiscal year. However, these plans fall short of 

maximizing what USPS can do within its existing authority to operate 

more efficiently and reduce its costs. For example, USPS has no plans to 

resume consolidating its processing facilities, recognizing that actions 

such as this would likely face stakeholder resistance.

Monitoring: met. USPS regularly monitors its financial condition and 

issues quarterly and independently-audited annual financial reports. The 

independent audits have consistently found that USPS’s financial 

statements conform with U.S. generally accepted accounting principles 

and fairly present, in all material aspects, USPS’s financial position at the 

end of each fiscal year, as well as the results of its operations and cash 

flows. USPS’s quarterly and annual financial reports provide information 

on key trends and measures, such as (1) revenues and expenses; (2) 

unfunded liabilities; and (3) debt obligations. USPS publishes the reports 

on its public website and provides quarterly public webcasts on its 

financial results. 

Demonstrated progress: not met. USPS’s overall financial condition is 

deteriorating and unsustainable. The savings from USPS cost-reduction 

efforts have dwindled in recent years and although USPS has stated it will 

aggressively reduce costs within its control, USPS’s plans will not achieve 

the kind of savings necessary to significantly reduce current operating 

costs. USPS expenses are now growing faster than its revenues, in part 

due to rising compensation and benefits costs combined with continuing 

declines in First-Class Mail. Further, USPS’s total unfunded liabilities and 

debt were $143 billion at the end of fiscal year 2018, an amount double its 

annual revenue.

As we testified in February 2017, a comprehensive package of legislative 

actions is needed to improve USPS’s financial viability. In that testimony, 

we also stated that USPS’s financial situation leaves Congress with 

difficult choices and trade-offs to achieve the broad-based restructuring 

that will be necessary for USPS to become financially sustainable.

In addition, USPS has missed $48.2 billion in required payments for 

postal retiree health and pension benefits through fiscal year 2018, 

including $42.6 billion in missed payments for retiree health benefits since 

fiscal year 2010, and $5.6 billion for pension benefits since fiscal year 

2014. USPS has stated that it missed these payments to minimize the 

risk of running out of cash, citing its precarious financial condition and the 

need to cover current and anticipated costs and any contingencies. 
USPS Financial Viability 

Page 101 GAO-19-157SP High-Risk Series 

USPS appears likely to miss required payments for retiree health benefits 

for the foreseeable future. Based on Office of Personnel Management 

projections, the fund supporting postal retiree health benefits would be 

depleted in fiscal year 2030 if USPS continues to miss all payments. If the 

fund is depleted, USPS would be required by law to make the payments 

necessary to cover its share of health benefits premiums for postal 

retirees. However, current law does not address what would happen if 

USPS misses those payments. Depletion of the fund, together with 

USPS’s potential inability to make remaining contributions, could affect 

postal retirees as well as USPS, customers, and other stakeholders, 

including the federal government.

As USPS has stated, it needs to aggressively pursue additional costreduction initiatives in areas in which it has managerial discretion. 

Because USPS actions under its existing authority will be insufficient to 

restore its financial viability, a balanced package of legislative reform 

continues to be needed. 

Congress should consider a comprehensive package of legislative 

actions to improve USPS’s financial viability, including (1) facilitating 

USPS’s ability to better align costs with revenues; (2) putting postal 

retiree health benefits on a more sustainable financial footing; and (3) 

requiring any binding arbitration in the negotiation process for USPS labor 

contracts to take USPS’s financial condition into account. Congress 

should consider various options to better align USPS costs with revenues, 

and address constraints and legal restrictions that limit USPS's ability to 

reduce costs and improve efficiency.

Postal Retiree Health Benefits: Unsustainable Finances Need to Be 

Addressed. GAO-18-602. Washington, D.C: August 31, 2018.

U.S. Postal Service: Projected Capital Spending and Processes for 

Addressing Uncertainties and Risks. GAO-18-515. Washington, D.C.: 

June 28, 2018.

International Mail: Information on Changes and Alternatives to the 

Terminal Dues System. GAO-18-112. Washington, D.C.: October 12, 

2017.

U.S. Postal Service: Key Considerations for Potential Changes to USPS’s 

Monopolies. GAO-17-543. Washington, D.C.: June 22, 2017.

U.S. Postal Service: Key Considerations for Restoring Fiscal 

Sustainability. GAO-17-404T. Washington, D.C.: February 7, 2017.

What Remains to Be Done

Congressional Actions Needed

Related GAO 

Products
USPS Financial Viability 

Page 102 GAO-19-157SP High-Risk Series 

U.S. Postal Service: Continuing Financial Challenges and the Need for 

Postal Reform. GAO-16-651T. Washington, D.C.: May 11, 2016.

U.S. Postal Service: Financial Challenges Continue. GAO-16-268T. 

Washington, D.C.: January 21, 2016.
Management of Federal Oil and Gas Resources 

Page 103 GAO-19-157SP High-Risk Series 

To enhance its oversight of oil and gas development on federal lands and waters, the Department of the 

Interior (Interior) needs to accurately determine and collect royalties; resolve its human capital challenges; and, 

address leadership commitment deficiencies within the Bureau of Safety and Environmental Enforcement. 

Since our 2017 update, Interior 

has partially met all criteria for this 

high-risk area. This high-risk area 

is composed of three segments: 

royalty determination and 

collection, human capital, and 

restructuring of offshore oil and 

gas oversight. Under human 

capital, for example, Interior has 

taken steps to assess its special 

salary rates but has not provided 

evidence that it evaluated its 

bureaus' training needs, training 

effectiveness, or opportunities for 

the bureaus to share training 

resources. Each of our five 

recommendations related to 

human capital, such as annually evaluating the bureaus' training 

programs, also remain open. 

In February 2016, we reported that BSEE had not addressed 

longstanding oversight deficiencies. In March 2017, we reported that 

BSEE needed to improve its leadership commitment toward completing 

strategic initiatives for enhancing offshore oversight and internal 

management. These reports were the basis for adding the third segment 

to this High-Risk area in 2017.

Over the years since we added this area to our High-Risk List, we have 

made numerous recommendations related to this high-risk issue, 4 of 

which were made since the last high-risk update in February 2017. As of 

December 2018, 17 recommendations are open or unimplemented. 

Management of Federal Oil and Gas 

Resources

Why Area Is High Risk

Management of federal oil and gas 

resources was added to the High-Risk 

List in 2011, based on challenges we 

identified in Interior’s management of oil 

and gas on leased federal lands and 

waters. This high-risk area has three 

segments: royalty determination and 

collection, human capital challenges, 

and restructuring of offshore oil and gas 

oversight.

Royalty determination and collection. 

Interior lacks reasonable assurance that 

it is collecting its fair share of revenue 

from oil and gas produced on federal 

lands and waters.

Human capital. Interior continues to 

experience problems hiring, training, and 

retaining sufficient staff to oversee and 

manage oil and gas operations on 

federal lands and waters.

Restructuring of offshore oil and gas 

oversight. Interior’s restructuring of 

BSEE has made limited progress 

addressing long-standing deficiencies in 

the bureau’s investigative, environmental 

compliance, and enforcement 

capabilities. Additionally, BSEE has 

struggled to implement strategic 

initiatives to improve offshore oversight 

and internal management.

Contact Information

For additional information about this 

high-risk area, contact Frank Rusco, 

(202) 512-4597, ruscof@gao.gov.
Management of Federal Oil and Gas Resources 

Page 104 GAO-19-157SP High-Risk Series 

Ratings for this segment remain largely 

unchanged since our previous High-Risk 

Report in 2017, though the rating for 

leadership commitment has been revised 

from met to partially met due to recent 

regulatory actions. Ratings for the four 

remaining criteria remain unchanged.

Leadership commitment: partially met.

We revised the rating from met to partially 

met in light of recent regulatory actions 

addressing methane emissions and oil and 

gas measurement that may adversely affect the agency’s past efforts to 

implement our recommendations. 

In October 2010 and July 2016, we found that Interior could take steps to 

better account for and manage methane emissions and issued several 

recommendations. For example, in October 2010, we found that 

economically capturing onshore vented and flared methane could 

increase federal royalty payments by $23 million annually. In response, 

Interior took steps to implement our recommendations. Specifically, in 

November 2016, Interior issued regulations intended to reduce wasteful 

methane emissions from onshore oil and gas production, which were 

consistent with our recommendations. In June 2017, however, Interior

postponed compliance dates with relevant sections of the new 

regulations, and then suspended certain requirements in December 

2017. Interior subsequently issued revised regulations in September 

2018. Interior’s revised regulations were not consistent with our prior work 

because they eliminated certain regulations that would potentially have 

addressed our recommendations. Better methane control is important for 

ensuring the federal government receives all the royalties it is due.

In April 2015, we found that Interior had not updated several oil and gas 

measurement and site security regulations in over 25 years. As a result, 

Interior’s measurement regulations did not reflect current measurement 

technologies and standards, and its site security regulations did not 

require the tracking of the number or location of its royalty measurement 

points. This hampered Interior’s ability to have reasonable assurance that 

oil and gas production was being accurately measured and verified, 

raising concerns about whether the federal government was receiving the 

royalties it was due. Accordingly, we recommended that Interior update 

those regulations. In response, Interior issued new regulations consistent 

with our recommendations, which went into effect in January 2017. Later 

that month, Interior announced a new rulemaking effort to begin in 

January 2019 to revise its oil and gas measurement and site security 

regulations. It is uncertain whether these revisions will be consistent with 

Royalty 

Determination and 

Collection
Management of Federal Oil and Gas Resources 

Page 105 GAO-19-157SP High-Risk Series 

our prior work and provide reasonable assurance that the federal 

government is receiving the royalties it is due. 

We will continue to monitor Interior’s regulatory actions and reevaluate its 

progress to regulate methane emissions and measurement, and site 

security.

Capacity: partially met. Interior has an uneven capacity to address 

weaknesses in its ability to determine and collect royalties. Interior was 

unable to consistently meet its oil and gas measurement goals—an 

important control for ensuring accurate royalty payments—for fiscal years 

2014 through 2017. In September 2018, Bureau of Land Management 

(BLM) officials stated that while BLM had generally met its goals for highpriority oil and gas measurement inspections for fiscal years 2014 through 

2017, it was unable to meet its goals for low-priority inspections, in part 

due to insufficient staff.

Action plan: partially met. In March 2017, the Secretary of the Interior 

established the Royalty Policy Committee, which is tasked with providing 

advice to the Secretary on the fair market value of and on the collection of 

revenues derived from development of energy and natural resources on 

Federal lands. Since then, the Committee has met several times. This 

effort is ongoing.

Monitoring: partially met. Interior has undertaken efforts to monitor its 

performance addressing royalty determination and collection 

weaknesses. For instance, Interior has implemented a majority of our 

recommendations addressing royalty determination and collection. 

However, it is uncertain if the effect of Interior’s recent regulatory actions 

on methane emissions and oil and gas measurement will be consistent 

with our prior work. Additionally, BLM has still not completed a planned 

internal review to assess the overall effectiveness of previously issued 

guidance on commingling requests—requests to combine oil or gas from 

public, state, or private leases prior to royalty measurement. 

Demonstrated progress: partially met. Interior has demonstrated 

progress addressing weaknesses in its revenue collection policies and 

practices. As of December 2018, Interior fully implemented 47 of our 50 

recommendations. However, the effect of Interior’s recent regulatory 

actions on methane emissions and oil and gas measurement may not be 

consistent with our prior work. Our recommendations related to methane 

emissions and oil and gas measurement are important for ensuring the 

government collects the royalties it is due. Interior may hinder its 

demonstrated progress if its recent regulatory actions jeopardize its prior 

efforts to implement our recommendations.
Management of Federal Oil and Gas Resources 

Page 106 GAO-19-157SP High-Risk Series 

Interior has made good progress addressing our recommendations yet 

needs to (1) continue to consider how to ensure the public gets a fair 

return from oil and gas produced from onshore and offshore leases, ( 2) 

complete its rulemaking to replace its recently issued onshore oil and gas 

measurement and site security regulations, (3) continue to assess 

technologies to minimize methane emissions, where applicable, (4) meet 

its goals for onshore and offshore oil and gas measurement inspections, 

and (5) consider technological options to more efficiently and effectively 

receive oil and gas volume data from companies. As of December 2018, 

3 of the 50 recommendations we have made related to this segment 

remain unimplemented. Interior generally concurred with the remaining 

unimplemented recommendations. However as stated above, some of 

Interior’s recent regulatory actions may not be consistent with our prior 

work. We will continue to monitor Interior’s regulatory actions and

reevaluate its progress to regulate methane emissions and measurement, 

and site security.

Interior continues to partially meet all criteria 

for this segment, as it did in 2017. 

Leadership commitment: partially met.

Interior has taken steps to implement each 

of our five recommendations related to 

human capital, such as evaluating the need 

for and viability of a certification program for 

BSEE inspectors. But Interior officials need 

to provide the guidance and direction to 

ensure Interior continues to work toward full 

implementation of these recommendations.

Capacity: partially met. In January 2017, Interior stated that it would 

direct BLM, BSEE, and the Bureau of Ocean Energy Management to 

identify their technical competency needs for key oil and gas personnel 

and develop a plan with milestones. In May 2018, Interior said it asked 

the bureaus to provide a plan for identifying key oil and gas positions and 

their respective technical competencies. As of December 2018, Interior 

had not provided us with a plan for developing technical competencies.

Action plan: partially met. Among other actions, Interior has taken initial 

steps to assess the effectiveness of its special salary rates by examining 

hiring and retention data from the fiscal year 2017 hiring cycle. However, 

as of December 2018, Interior had not evaluated the bureaus' training 

needs, training effectiveness, or opportunities for the bureaus to share 

training resources.

Monitoring: partially met. In September 2016, Interior outlined steps it 

will take to assess the effectiveness of special salary rates, as well as 

What Remains to Be Done

Human Capital 

Challenges
Management of Federal Oil and Gas Resources 

Page 107 GAO-19-157SP High-Risk Series 

recruitment, relocation, and retention incentives by tracking measures 

such as turnover and acceptance rates. As of December 2018, the three 

bureaus had taken initial steps to regularly evaluate the effectiveness of 

the special salary rates incentive by examining data from fiscal year 2017 

but had not yet evaluated the effectiveness of recruitment, relocation, and 

retention incentives, or its student loan repayment program. 

Demonstrated progress: partially met. In September 2016, we 

reported on Interior’s progress to hire, train, and retain staff, and made 

five recommendations. Interior has agreed with one recommendation, 

partially agreed with three, and disagreed with the remaining one. The 

agency has made some progress, but all recommendations remain open. 

In 2016, we made five recommendations to Interior and all remain open. 

Interior needs to fully implement our recommendations to address its 

human capital challenges.

To help ensure Interior can hire, retain, and train needed staff, we 

recommended that Interior (1) regularly evaluate the effectiveness of 

incentives, such as special salary rates, to hire and retain key oil and gas 

staff; (2) annually evaluate the bureaus' training programs, including 

training needs and effectiveness, and potential opportunities for the 

bureaus to share training resources; (3) develop technical competencies 

for all key oil and gas staff; (4) evaluate the need for and viability of a 

certification program for BSEE inspectors; and (5) create or use an 

existing mechanism to facilitate collaboration across the three bureaus in 

addressing their shared hiring, retention, and training challenges.

We added this segment to our 2017 HighRisk List and are rating it for the first time.

Leadership commitment: partially met. In 

March 2017, we reported that BSEE 

leadership had started several initiatives to 

improve its safety and environmental 

oversight capabilities, but its limited efforts 

to obtain and incorporate input from within 

the bureau hindered its progress. In March 

2017, we recommended that BSEE 

establish a mechanism for management to 

obtain and incorporate input from bureau personnel and any external 

parties that can affect the bureau's ability to achieve its objectives. We 

highlighted this recommendation as a top priority for the Secretary of the 

Interior. BSEE has taken some actions to address our concerns, including 

establishing an Ombudsman position within the bureau in May 2017, an 

Employee Engagement Council in February 2018, and an Innovation 

What Remains to Be Done

Restructuring of 

Offshore Oil and Gas 

Oversight
Management of Federal Oil and Gas Resources 

Page 108 GAO-19-157SP High-Risk Series 

Program in April 2018. However, BSEE has not yet demonstrated that 

these actions represent an enduring institutionalization of improved 

communication throughout the bureau.

Capacity: partially met. Since March 2017, BSEE has taken some 

actions for management to obtain and incorporate input from bureau 

personnel and any external parties that can affect the bureau's ability to 

achieve its objectives. However, BSEE has not completed other actions, 

such as a risk analysis of the regional-based reporting structure of the 

Environmental Compliance Division, including actions to mitigate any 

identified risk.

Action plan: partially met. In September 2016, BSEE issued a plan with 

milestones for implementing its case management system for 

investigations of offshore incidents. However, BSEE has not completed 

other actions, such as developing a plan to address documented 

environmental oversight staffing needs. 

Monitoring: partially met. In April 2016, BSEE issued a bureau manual 

chapter regarding the review and adjustment of civil penalty amounts, and 

in February 2018 added a supplementary standard operating procedure 

that defines business practices for civil penalty inflation adjustment and 

identifies specific bureau roles, responsibilities, and timelines. However, 

BSEE has not completed other actions. For example, BSEE has not 

coordinated with the Administrator of the Environmental Protection 

Agency to consider existing interagency agreements for monitoring 

operator compliance with National Pollutant Discharge Elimination 

System permits on the Outer Continental Shelf and, if necessary, update 

them to reflect current oversight needs.

Demonstrated progress: partially met. We made a total of 13 

recommendations to improve BSEE oversight capabilities and internal 

management, 9 of which remain open regarding its implementation of 

oversight divisions, ability to meet strategic objectives, and efforts to 

improve organizational trust.

Interior should implement all open recommendations to complete the 

restructuring of BSEE’s oversight functions and improve leadership 

commitment to its key strategic initiatives for improving offshore oversight 

and internal management. Interior neither agreed nor disagreed with our 

recommendations.

Oil and Gas Lease Management: BLM Could Improve Oversight of Lease 

Suspensions with Better Data and Monitoring Procedures. GAO-18-411. 

Washington, D.C.: June 4, 2018. 

What Remains to be Done

Related GAO 

Products
Management of Federal Oil and Gas Resources 

Page 109 GAO-19-157SP High-Risk Series 

Oil and Gas Wells: Bureau of Land Management Needs to Improve Its 

Data and Oversight of Its Potential Liabilities. GAO-18-250. Washington, 

D.C.: May 16, 2018. 

Oil and Gas Development: Improved Collection and Use of Data Could 

Enhance BLM's Ability to Assess and Mitigate Environmental Impacts. 

GAO-17-307. Washington, D.C.: April 25, 2017.

Oil and Gas Management: Stronger Leadership Commitment Needed at 

Interior to Improve Offshore Oversight and Internal Management. 

GAO-17-293. Washington, D.C.: March 21, 2017. 

Oil and Gas Oversight: Interior Has Taken Steps to Address Staff Hiring,

Retention More Evaluative and Collaborative Approach. GAO-16-742. 

Washington, D.C.: September 29, 2016.

Oil and Gas: Interior Could Do More to Account for and Manage Natural 

Gas Emissions. GAO-16-607. Washington, D.C.: July 7, 2016.

Oil and Gas Management: Interior’s Bureau of Safety and Environmental

Enforcement has Not Addressed Long-Standing Oversight Deficiencies. 

GAO-16-245. Washington, D.C.: February 10, 2016.

Oil and Gas Resources: Interior’s Production Verification Efforts and

Royalty Data Have Improved, but Further Actions Needed. GAO-15-39. 

Washington, D.C.: April 7, 2015.

Oil and Gas: Updated Guidance, Increased Coordination, and

Comprehensive Data Could Improve BLM’s Management and Oversight. 

GAO-14-238. Washington, D.C.: May 5, 2014.

Oil and Gas Resources: Actions Needed for Interior to Better Ensure a

Fair Return. GAO-14-50. Washington, D.C.: December 6, 2013.

Oil and Gas Management: Interior’s Reorganization Complete, but

Challenges Remain in Implementing New Requirements. GAO-12-423. 

Washington, D.C.: July 30, 2012.
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks 

Page 110 GAO-19-157SP High-Risk Series 

To reduce its fiscal exposure, the federal government needs a cohesive strategic approach with strong 

leadership and the authority to manage risks across the entire range of related federal activities. 

The rising number of natural 

disasters and increasing reliance 

on federal assistance is a key 

source of federal fiscal exposure. 

Since 2005, federal funding for 

disaster assistance is approaching 

half a trillion dollars (about $430 

billion), most recently for 

catastrophic hurricanes, flooding, 

wildfires, and other losses in 2017 

and 2018. Disaster costs are 

projected to increase as extreme 

weather events become more 

frequent and intense due to 

climate change—as observed and 

projected by the U.S. Global 

Change Research Program and 

the National Academies of Sciences, Engineering, and Medicine. 

One way to reduce federal fiscal exposure is to enhance resilience by 

reducing or eliminating long-term risk to people and property from natural 

hazards. For example, we reported that elevating homes and 

strengthened building codes in Texas and Florida prevented greater 

damages during the 2017 hurricane season. Additionally, in October 

2018, the Disaster Recovery Reform Act of 2018 was enacted, which, 

among other things, allows the President to set aside, with respect to 

each major disaster, a percentage of certain grants to use for pre-disaster 

hazard mitigation. However, for some Native American tribes and 

communities, such as Alaska Native villages, climate change impacts are 

an immediate threat, and we and others have reported on institutional 

barriers that limit proactive responses. We have ongoing work examining 

how to identify and prioritize resilience projects.

According to the November 2018 Fourth National Climate Assessment, 

neither global efforts to reduce emissions nor regional resilience efforts 

approach the scales needed to avoid substantial damages over the 

coming decades. However, beginning in 2017, the administration revoked 

policies that had identified addressing climate change as a priority and 

demonstrated top leadership support for executive branch action. 

Although leadership commitment remains partially met due to 

congressional action since our 2017 High-Risk Report, the federal 

Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate 

Change Risks

Why Area Is High Risk

Numerous studies have concluded that 

climate change poses risks to many 

environmental and economic systems 

and creates a significant fiscal risk to the 

federal government. For example, 

according to the November 2018 

National Climate Assessment report, the 

continued increase in the frequency and 

extent of high-tide flooding due to sea 

level rise threatens America’s trilliondollar coastal property market and public 

infrastructure, with cascading impacts to 

the larger economy. We added this area 

to the High-Risk List in 2013.

There are five areas where governmentwide action is needed to reduce federal 

fiscal exposure, including, but not limited 

to, the federal government’s role as (1) 

the insurer of property and crops; (2) the 

provider of disaster aid; (3) the owner or 

operator of infrastructure; (4) the leader 

of a strategic plan that coordinates 

federal efforts and informs state, local, 

and private-sector action; and (5) the 

provider of data and technical assistance 

to decision makers.

We have made 62 recommendations 

related to this high-risk area, 12 of which 

were made since the February 2017 

high-risk update. As of December 2018, 

25 remain open. 

Contact Information

For additional information about this 

high-risk area, contact J. Alfredo Gómez 

at (202) 512-3841 or gomezj@gao.gov.
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks 

Page 111 GAO-19-157SP High-Risk Series 

government has not made measurable progress to reduce its fiscal 

exposure to climate change. As a result, ratings for four criteria remain 

unchanged and monitoring has regressed to not met.

Federal flood and crop insurance programs 

were not designed to generate sufficient 

funds to fully cover all losses and expenses. 

The flood insurance program, for example, 

was about $21 billion in debt to the Treasury 

as of September, 2018. Further, the 

Congressional Budget Office estimated in 

January 2017 that federal crop insurance 

would cost the federal government an 

average of about $8 billion annually from 

2017 through 2026. Implementing our prior 

recommendations to improve the long-term 

resiliency of insured structures and crops and address structural 

weaknesses may decrease federal fiscal exposure to climate change. 

The ratings for this segment remain unchanged at partially met or not 

met.

Leadership commitment: partially met. Leadership commitment 

remains partially met to reflect action by Congress, such as passage of 

the Biggert-Waters Flood Insurance Reform Act of 2012. Specifically, the 

Biggert-Waters Act created the Technical Mapping Advisory Council 

(TMAC) and directed it to produce a “Future Conditions Risk Assessment 

and Modeling Report” with recommendations on how to ensure that (1) 

rate maps incorporate the best available climate science; and (2) the 

Federal Emergency Management Agency (FEMA) uses the best available 

methodology to consider the impact of rising sea levels and future 

development on flood risk. In its 2015 report, TMAC made several 

recommendations to FEMA for how to incorporate climate science into 

FEMA’s maps and tools on an advisory basis, which FEMA has plans to 

implement.

However, our rating for top leadership support within the executive branch 

has regressed because related executive orders have been rescinded. 

For example, the March 2017 E.O. 13783 Promoting Energy 

Independence and Economic Growth revoked E.O. 13653, which we 

previously found had partially met this criterion. Specifically, we had found 

that E.O. 13653 demonstrated top leadership support for federal 

agencies, such as FEMA and the United States Department of Agriculture 

(USDA), to incorporate adapting to climate change risks into their 

planning efforts. 

Federal Insurance 

Programs
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks 

Page 112 GAO-19-157SP High-Risk Series 

Capacity: partially met. FEMA and USDA continue to take actions to 

improve stakeholder capacity to increase their resilience to climate 

change. For instance, FEMA reported progress at developing information 

on future conditions for flood maps in June 2017. Additionally, USDA’s 

Climate Hubs continue to deliver relevant science-based knowledge that 

may improve producers’ capacity to manage climate change impacts for 

crop insurance.

Action plan: partially met. FEMA and USDA have previously identified 

actions to address aspects of climate change in their programs on an 

advisory basis, in FEMA’s 2015 TMAC Future Conditions report and 

USDA’s 2016 Building Blocks for Climate Smart Agriculture and Forestry 

initiative. In its 2017 annual report, TMAC identified additional actions 

FEMA could take to advance its development of future conditions 

products and services, such as assessing stakeholders’ highest-priority 

needs.

Monitoring: not met. FEMA has yet to publish metrics and milestones to 

assess its progress incorporating future conditions into flood map 

products. USDA established milestones for certain actions to improve 

resilience from 2016 through 2018, but it no longer monitors its progress.

Demonstrated progress: not met. The federal government has not 

implemented our recommendations to improve the resilience of federallyinsured property or address structural weaknesses in each program, as 

described in the following section.

The federal government needs to incentivize climate resilience by 

incorporating it into the requirements for federal insurance programs. 

Specifically, we made the following recommendations in October 2014:

• FEMA should consider amending the floodplain management minimum 

standards to incorporate forward-looking requirements, similar to the 

minimum flood risk reduction standard adopted by the Hurricane Sandy 

Rebuilding Task Force. FEMA agreed with this recommendation and 

plans to start implementing it in 2020.

• USDA should consider working with agricultural experts to incorporate 

long-term resilience into the good farming practices that are required for 

claim payments. USDA neither agreed nor disagreed with this 

recommendation; as of this report, USDA has not implemented it. 

Reducing federal fiscal exposure to climate change risks will also require 

congressional action to address other structural challenges in these 

insurance programs that send inaccurate price signals to policyholders 

about their risk of loss or increase the cost of these programs to 

taxpayers. For example, 

What Remains to Be Done

Congressional Actions Needed
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks 

Page 113 GAO-19-157SP High-Risk Series 

• In April 2017, we reported that Congress should consider comprehensive 

reform to the flood insurance program to improve its solvency and 

enhance the nation’s resilience to floods, including funding for flood 

mitigation and flood mapping.

• In July 2017, we reported that Congress should consider repealing 

certain provisions in the Agricultural Act of 2014 that hinder the crop 

insurance program’s ability to adjust participating private insurers’ rate of 

return and share of premiums as changing conditions warrant.

In September 2018, we reported that the 

four near-sequential hurricane and wildfire 

disasters in 2017 created an unprecedented 

demand for federal disaster resources and 

that hurricanes Harvey, Irma, and Maria 

ranked among the top five costliest 

hurricanes on record. Subsequently, fall of 

2018 brought additional catastrophic 

disasters such as Hurricanes Florence and 

Michael and devastating California wildfires, 

with further needs for federal disaster 

assistance. We have also reported that 

disaster costs are a key source of federal fiscal exposure and will likely 

continue to rise. Implementing our prior recommendations to improve 

state and local resilience and adopting adequate budgeting procedures to 

account for the costs of disasters could help decision makers better 

manage federal fiscal exposure to climate change.

In October 2018, the Disaster Recovery Reform Act (DRRA) of 2018 was 

enacted. DRRA, among other things, allows the President to set aside, 

with respect to each major disaster, a percentage of the estimated 

aggregate amount of certain grants to use for pre-disaster hazard 

mitigation and makes federal assistance available to state and local 

governments for building code administration and enforcement. It is too 

early to tell what impact the implementation of the act will have on state 

and local resilience and this high-risk rating. Additionally, we have 

ongoing work examining managed retreat from vulnerable areas as an 

option to reduce communities’ exposure to climate change impacts.

The ratings for this segment remain unchanged at partially met or not 

met. 

Leadership commitment: partially met. Leadership commitment 

remains partially met to reflect action by Congress, such as passage of 

DRRA in October 2018. Additionally, according to FEMA’s 2018–2022 

Strategic Plan, the agency will work with Congress and others to 

Disaster Aid and 

Resilience 
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks 

Page 114 GAO-19-157SP High-Risk Series 

incentivize investments that reduce risk, including pre-disaster mitigation, 

and increase the number of properties covered by flood insurance. 

However, top leadership support within the executive branch has 

regressed, as related executive orders have been rescinded. For 

example, the August 2017 E.O. 13807 Establishing Discipline and 

Accountability in the Environmental Review and Permitting Process for 

Infrastructure Projects revoked E.O. 13690, which we previously found 

had partially met this criterion. E.O. 13690 had established a governmentwide federal flood risk management standard to improve the resilience of 

communities and federal assets against the impacts of flooding. 

Capacity: partially met. FEMA has continued to improve federal 

capacity by implementing our July 2015 recommendation to improve its 

Public Assistance delivery model. Additionally, as noted previously, 

DRRA allows the president to set aside certain funding for pre-disaster 

hazard mitigation efforts and requires FEMA to issue guidance on the 

acquisition of property for open space as a mitigation measure, which 

may improve state and local capacity for resilience.

Action plan: not met. The federal government has yet to implement our 

July 2015 priority recommendation to establish a comprehensive 

investment strategy to identify, prioritize, and implement federal disaster 

resilience investments. FEMA and its partners have developed a draft 

National Mitigation Investment Strategy (NMIS) that may address this 

recommendation, but it is too early to assess its responsiveness because 

it has not been finalized, although FEMA plans to do so in February 2019. 

Additionally, FEMA’s 2018–2022 strategic plan—issued in March 2018— 

established the performance targets of doubling the number of properties 

covered by flood insurance and quadrupling the amount of pre-disaster 

mitigation by 2022. However, without a comprehensive strategy in place 

to identify and prioritize FEMA’s resilience investments, it is unclear 

whether these efforts will reduce federal fiscal exposure.

Monitoring: not met. The federal government has not established a 

mechanism to track the effectiveness of federal investments in disaster 

resilience government-wide. 

Demonstrated progress: not met. The federal government has not 

developed the information necessary to account for its fiscal exposure to 

climate change nor a strategy to reduce this exposure, as described 

below.

The federal government needs to develop the information needed to 

manage disaster assistance programs’ long-term exposure to climate 

change and fully implement measures that promote resilience from our 

What Remains to Be Done
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks 

Page 115 GAO-19-157SP High-Risk Series 

prior recommendations and the recently enacted DRRA. Specifically, the 

federal government should:

• implement our April 2018 recommendation to provide, concurrent with 

any future climate change funding reports to Congress, funding 

information for federal programs with fiscal exposure to climate change, 

including costs for disaster assistance programs. OMB disagreed with 

this recommendation and has not implemented it as of this report;

• implement our July 2015 priority recommendation to develop a 

comprehensive strategy for identifying, prioritizing, and implementing 

investments for disaster resilience by incorporating these elements into 

the draft NMIS and finalizing it, which FEMA plans to do in February 

2019.

• implement our September 2012 priority recommendation to update the 

methodology for assessing jurisdictions’ capability to respond and 

recover from a disaster without federal assistance. In 2017, FEMA had 

proposed establishing a disaster deductible but abandoned this effort in 

August 2018 in response to public comments. FEMA is currently 

exploring alternative options to update its methodology, but it has not 

provided a timetable for their implementation.

• implement our March 2011 recommendation to complete a national 

preparedness assessment of capability gaps at each jurisdiction’s level 

based on tiered, capability-specific performance objectives to enable 

better prioritization of FEMA grant funding to states and localities. FEMA 

reported that it plans on implementing a new methodology to assess core 

capabilities by December 2019 and will be able to provide complete 

assessment results in 2020.

• implement our 2003 recommendation to adopt adequate budgeting and 

forecasting procedures to account for fiscal exposures, such as major 

disaster costs, as part of the federal budget process. These procedures 

should provide a comprehensive view of overall funding and the tradeoffs between spending with long-term benefits, such as resilience 

investments and short-term benefits, such as post-disaster repairs and 

recovery. OMB neither agreed nor disagreed with this recommendation 

and has not taken any action to implement it as of this report;

• consistent with our criteria for removal from the High-Risk List, implement 

its efforts to manage disaster assistance programs’ long-term exposure 

by (1) defining the responsibilities of federal and other partners, (2) 

identifying the resources necessary to sustain its efforts, and (3) tracking 

its results.
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks 

Page 116 GAO-19-157SP High-Risk Series 

The federal government owns and operates 

hundreds of thousands of facilities and 

manages millions of acres of land that could 

be affected by a changing climate and 

represent a significant federal fiscal 

exposure. For example, the Department of 

Defense (DOD) owns and operates 

domestic and overseas infrastructure with 

an estimated replacement value of about $1 

trillion. In September 2018, Hurricane 

Florence damaged Camp Lejeune and other 

Marine Corps facilities in North Carolina, 

with a preliminary Marine Corps repair estimate of $3.6 billion. One month 

later, Hurricane Michael devastated Tyndall Air Force Base in Florida, 

with a preliminary Air Force repair estimate of $3 billion and upwards of 

five years to complete the work. Implementing our prior recommendations 

to improve the resilience of federally-owned and operated property by 

accounting for climate change impacts in planning processes and 

decisions could reduce federal fiscal exposure to climate change. 

Two ratings for this segment regressed to not met and three others 

remain unchanged at partially met and not met.

Leadership commitment: partially met. Leadership commitment 

remains partially met to reflect action by Congress, such as passage of 

the National Defense Authorization Act for Fiscal Year 2018, which 

requires DOD to report on climate change impacts to its installations and 

to provide an overview of mitigation actions to address them. 

However, top leadership support within the executive branch has 

regressed, as executive orders and agencies revoked policies indicating 

leadership support. The August 2017 E.O. 13807 revoked E.O. 13690, 

which we previously found had established a standard for reducing the 

flood risk of federally-funded projects in flood plains. This action 

potentially increases the federal government’s fiscal exposure to climate 

change, as taxpayer-funded projects may not last as long as intended 

because they are not required to account for future climate-related 

changes in risk.

Capacity: not met. The May 2018 E.O.13834 Regarding Efficient 

Federal Operations revoked E.O. 13693, which we previously found had 

partially met this criterion because it directed federal agencies to 

incorporate resilient design elements into their facilities as part of federal 

sustainability goals. Additionally, in April 2017, the Council on 

Environmental Quality (CEQ) rescinded its guidance directing agencies to 

consider climate change in their National Environmental Policy Act of 

1969 (NEPA) reviews for certain types of federal projects. We had 

Federal Government 

as Property Owner 
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks 

Page 117 GAO-19-157SP High-Risk Series 

previously found that this guidance helped partially meet this criterion. 

Without such guidance, agencies no longer have White House direction 

to consider climate change impacts, such as sea level rise, when 

planning federally-funded infrastructure.

Action plan: partially met. DOD has made some progress implementing 

our May 2014 recommendations to consider climate change impacts for 

its domestic installations. In November 2017, we made six 

recommendations to DOD to also consider climate change impacts for its 

overseas installations. DOD partially concurred with four of these 

recommendations and non-concurred with two. All six recommendations 

remain open as of this report. Further, as mentioned above, the National 

Defense Authorization Act for Fiscal Year 2018 requires DOD to provide 

an overview of mitigation actions to address climate change impacts.

Monitoring: not met. E.O. 13834 revoked E.O. 13693, which we 

previously found had partially met this criterion because it established a 

mechanism for OMB to monitor agencies’ progress toward sustainability 

goals. These goals included federal facilities’ resilience to climate change 

impacts. 

Demonstrated progress: not met. The federal government has not 

implemented our recommendations to improve resilience governmentwide, as described in the following section. 

The federal government needs a comprehensive approach to improve the 

resilience of the facilities it owns and operates, and land it manages. This 

involves incorporating climate change resilience into agencies’ 

infrastructure and facility planning processes, such as DOD’s efforts to 

implement our prior recommendations. It also involves accounting for 

climate change in NEPA analyses and working with relevant professional 

associations to incorporate climate change information into structural 

design standards. We made the following recommendations:

• In April 2013, we recommended that CEQ should finalize guidance on 

how federal agencies can consider climate change in their evaluations of 

proposed federal actions under NEPA. CEQ neither agreed nor 

disagreed with this recommendation but in August 2016, CEQ 

implemented it by issuing final guidance. However, in April 2017, CEQ 

rescinded this guidance.

• In November 2016, we recommended that the Department of Commerce 

should convene federal agencies to provide the best available forwardlooking climate information to standards-developing organizations. 

Commerce neither agreed nor disagreed with this recommendation and 

as of May 2018, Commerce had not implemented it.

What Remains to be Done
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks 

Page 118 GAO-19-157SP High-Risk Series 

Additionally, in our 2017 High-Risk Report, we reported that implementing 

the January 2015 federal flood risk management standard—which 

required all future federal investments in, and affecting, floodplains to 

meet a certain elevation level—would have enhanced federal flood 

resilience by ensuring agencies addressed current and future flood risk. 

The August 2017 E.O. 13807 rescinded this standard. 

Further, once the federal government provides leadership support to 

improve the resilience of federal property, it should identify the resources 

necessary to implement its plans, sustain its efforts over time and track its 

results.

As noted previously, as of December 2018, 

federal obligations and appropriations for 

disaster assistance are approaching half a 

trillion dollars since 2005. However, the 

federal government is currently not well 

organized to address the fiscal exposure 

presented by climate change, partly 

because of the inherently complicated 

crosscutting nature of the issue. 

Implementing our prior recommendations, 

such as developing a strategic approach to 

guide federal adaptation efforts and 

providing information on related fiscal exposures to Congress, could 

improve the nation’s ability to prepare for and adapt by reducing the 

government’s fiscal exposure. Additionally, we have ongoing work on how 

the federal government could identify and prioritize adaptation projects of 

national significance.

Four ratings regressed to not met and one remains unchanged at not met 

since our 2017 update.

Leadership commitment: not met. The March 2017 Executive Order 

E.O. 13783 revoked policies, including the Climate Action Plan and E.O. 

13653 that we previously found had demonstrated leadership support for 

reducing aspects of fiscal exposure to climate change. 

Capacity: not met. The May 2018 E.O.13834 revoked E.O. 13693, which 

we had previously found partially met this criterion. Specifically, E.O. 

13693 had directed the Office of Personnel Management to include 

resilience in federal training and also directed the creation of interagency 

workgroups to address, among other things, resilience planning in 

coordination with states and other stakeholders.

Federal Government 

as Leader of National 

Climate Strategic 

Plan
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks 

Page 119 GAO-19-157SP High-Risk Series 

Action plan: not met. Executive orders 13783 and 13834 withdrew 

previous direction to develop adaptation plans and strategic sustainability 

performance plans that identified agency actions to prepare for climate 

change impacts and improve resilience. As previously mentioned, FEMA 

and its partners have developed a draft National Mitigation Investment 

Strategy (NMIS) that may partially meet this criterion, if the final version 

includes a strategy to identify, prioritize, and implement federal disaster 

resilience investments. However, it is too early to assess the NMIS 

because it has not been finalized, although FEMA plans to do so in 

February 2019.

Monitoring: not met. Executive orders 13783 and 13834 also eliminated 

monitoring mechanisms that we previously found had partially met this 

criterion. Specifically, E.O. 13783 revoked E.O. 13653, which had 

directed agencies to submit adaptation plans to CEQ and OMB for review 

and E.O. 13834 revoked E.O. 13693, which had directed OMB to 

evaluate agencies’ strategic sustainability performance. 

Demonstrating progress: not met. The federal government has not 

implemented key recommendations in this area, as described in the 

following section.

The federal government could better reduce its fiscal exposure if federal 

efforts were coordinated and directed toward common goals such as 

improving climate resilience. For example, entities within the Executive 

Office of the President (EOP), including OMB should:

• implement our May 2011 recommendation to develop a strategic plan to 

guide the nation’s efforts to adapt to climate change, which includes clear 

priorities that reflect the full range of climate-related federal activities, as 

well as establishes clear roles, responsibilities, and working relationships 

among federal, state, and local governments;

• implement our September 2017 recommendation to use information on 

potential economic effects from climate change to help identify significant 

climate risks and craft appropriate federal responses; and

• implement our April 2018 recommendation to provide information on 

fiscal exposures related to climate change to Congress in conjunction 

with future reports on climate change funding.

EOP neither agreed nor disagreed with our 2011 recommendation to 

develop a strategic plan to guide adaptation efforts and our 2017 

recommendation to use information on potential economic effects from 

climate change to identify significant risks and responses. OMB disagreed 

with our 2018 recommendation to provide information on fiscal exposures 

related to climate change to Congress in conjunction with any future 

What Remains to be Done
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks 

Page 120 GAO-19-157SP High-Risk Series 

climate change funding reports. As of this high-risk update, EOP and 

OMB have not implemented any of these recommendations.

Further, to meet our criteria for removal from the High-Risk List, the 

federal government’s approach will need to include measurable goals; 

identify the responsibilities and relationships among federal, state, and 

other entities; determine how such efforts will be funded and staffed over 

time; and establish mechanisms to monitor and demonstrate its progress. 

Because decisions at the state and local levels drive much of the federal 

government’s fiscal exposure, coordination between levels of government 

is essential.

Decision makers at all levels of government 

can affect federal fiscal exposure to climate 

change. Specifically, state, local, and 

private-sector decision makers can drive 

federal fiscal exposures because they are 

responsible for planning, constructing, and 

maintaining certain types of vulnerable 

infrastructure paid for with federal funds, 

insured by federal programs, or eligible for 

federal disaster assistance. For example, 

the federal government annually invests 

billions of dollars in infrastructure that state 

and local governments plan and build. To reduce fiscal exposure, the 

federal government has a role to play in providing information to decision 

makers at all levels so they can make more informed choices about how 

to manage climate change risks. 

Two ratings for this segment regressed to not met and three others 

remain unchanged at not met.

Leadership commitment: not met. The March 2017 E.O. 13783 

revoked the Climate Action Plan and E.O. 13653 that we previously found 

had partially met this criterion because they demonstrated top leadership 

support for federal technical assistance. 

Capacity: not met. Under the Global Change Research Act of 1990, the 

administration released the Fourth National Climate Assessment in 

November 2018, which summarizes the impacts of climate change on the 

U.S. and provides some web-based tools to help people understand and 

manage their climate-related risk. However, this criterion remains not met 

because the resources and government-wide structure for providing 

technical assistance to decision makers—with clear roles, responsibilities, 

and working relationships among federal, state, local, and private-sector 

entities—remain undefined. We have made multiple recommendations to 

Technical Assistance 

to Federal, State, 

Local, and PrivateSector Decision 

Makers
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks 

Page 121 GAO-19-157SP High-Risk Series 

the EOP to address these issues; however, the EOP has yet to make 

progress implementing them. Additionally, E.O. 13783 revoked E.O. 

13653, which had directed federal agencies to develop and provide 

authoritative and accessible climate information to support federal and 

nonfederal decision makers.

Action plan: not met. We had previously found that E.O. 13653 and the 

Climate Action Plan had partially met this criterion because they outlined 

some steps for federal agencies to provide information to support 

resilience. However, these policies were revoked by E.O. 13783.

Monitoring: not met. There are still no programs or mechanisms to 

monitor government-wide progress in addressing the challenges we have 

identified related to the federal government’s role in providing climaterelated technical assistance. These challenges include clarifying the 

roles, responsibilities, and working relationships among federal, state, 

local, and private-sector entities; identifying the necessary resources and 

establishing the government-wide structure necessary to implement 

plans; and addressing the fragmentation of federal climate information 

across individual agencies that use the information in different ways to 

meet their missions.

Demonstrated progress: not met. The federal government has not 

implemented our recommendations to improve its technical assistance to 

decision makers, as described in the following section.

The federal government needs a government-wide approach for providing 

federal, state, local, and private-sector decision makers with (1) the best 

available climate-related information, and (2) assistance for translating 

climate-related data into accessible information. 

In November 2015, we found that federal efforts, such as the National 

Climate Assessment, provide useful information about climate change 

impacts. However, we also found that these efforts did not fully meet the 

climate information needs of federal, state, local, and private sector 

decision makers, which hinders their planning efforts. We found that 

these decision makers would benefit from a national climate information 

system that would develop and update authoritative climate observations 

and projections specifically for use in decision-making. As a result, we 

recommended that EOP should: 

• designate a federal entity to develop and periodically update a set of 

authoritative climate observations and projections for use in federal 

decision-making, which other decision makers could also access, and 

What Remains to be Done
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks 

Page 122 GAO-19-157SP High-Risk Series 

• designate a federal entity to create a national climate information system 

with defined roles for federal agencies and nonfederal entities with 

existing statutory authority.

EOP neither agreed nor disagreed with our recommendations and as of 

this report, has not implemented them.

2017 Hurricanes and Wildfires: Initial Observations on the Federal 

Response and Key Recovery Challenges. GAO-18-472. Washington, 

D.C.: September 4, 2018.

Climate Change: Analysis of Reported Federal Funding. GAO-18-223. 

Washington, D.C.: April 30, 2018.

Climate Change Adaptation: DOD Needs to Better Incorporate Adaptation 

into Planning and Overseas Installations. GAO-18-206. Washington, 

D.C.: November 13, 2017. 

Disaster Assistance: Opportunities to Enhance Implementation of the 

Redesigned Public Assistance Grant Program. GAO-18-30. Washington, 

D.C.: November 8, 2017.

Climate Change: Information on Potential Economic Effects Could Help 

Guide Federal Efforts to Reduce Fiscal Exposure. GAO-17-720. 

Washington, D.C.: September 28, 2017.

Crop Insurance: Opportunities Exist to Improve Program Delivery and 

Reduce Costs. GAO-17-501. Washington, D.C.: July 26, 2017.

Flood Insurance: Comprehensive Reform Could Improve Solvency and 

Enhance Resilience. GAO-17-425. Washington, D.C. April 27, 2017.

Climate Change: Improved Federal Coordination Could Facilitate Use of 

Forward-Looking Climate Information in Design Standards, Building 

Codes, and Certifications. GAO-17-3. Washington, D.C.: November 30, 

2016.

Climate Information: A National System Could Help Federal, State, Local, 

and Private Sector Decision Makers Use Climate Information. 

GAO-16-37. Washington, D.C.: November 23, 2015. 

Climate Change: Better Management of Exposure to Potential Future 

Losses Is Needed for Federal Flood and Crop Insurance. GAO-15-28. 

Washington, D.C.: October 29, 2014.

Related GAO 

Products 
Improving the Management of IT Acquisitions 

and Operations

Page 123 GAO-19-157SP High-Risk Series 

To better manage billions of dollars in information technology (IT) investments, the Office of Management and 

Budget (OMB) and other federal agencies should further implement the requirements of federal IT acquisition 

reforms. 

Since our 2017 High-Risk Report, 

ratings for all five criteria remain 

unchanged. 

Leadership commitment: met. 

OMB continues to demonstrate its 

leadership commitment by (1) 

issuing guidance for covered 

departments and agencies 

(agencies) to implement statutory 

provisions commonly referred to 

as the Federal Information 

Technology Acquisition Reform 

Act (FITARA), (2) optimizing 

federal data centers, and (3) 

acquiring and managing software 

licenses. It will be important for 

OMB to maintain its current level of top leadership support and 

commitment to ensure that agencies successfully execute OMB’s 

guidance on implementing FITARA and related IT initiatives. Sustained 

Congressional focus on implementing FITARA has led to improvement, 

as highlighted in agencies’ FITARA implementation scores issued 

biannually by the House Committee on Oversight and Reform. However, 

further Executive branch and Congressional attention is required.

Capacity: partially met. OMB has established guidance for FITARA and 

related IT management practices that addresses how agencies are to 

implement roles and responsibilities. The guidance covers, among other 

things, enhancing the authority of federal chief information officers (CIO) 

and ensuring that program staff has the necessary knowledge and skills 

to effectively acquire IT. As we reported in August 2018, none of the 24 

major federal agencies had IT management policies that fully addressed 

the role of their CIOs consistent with federal laws and guidance. The 

majority of the agencies minimally addressed or did not address their 

CIO’s role in assessing agency IT workforce needs, and developing 

strategies and plans for meeting those needs. Correspondingly, the 

majority of the 24 CIOs acknowledged they were not fully effective at 

implementing IT workforce responsibilities.

In November 2016, we reported that while the five agencies we reviewed 

had demonstrated important progress in implementing key IT workforce 

planning activities, each had shortfalls. For example, four agencies had 

Improving the Management of IT Acquisitions 

and Operations

Why Area Is High Risk

The executive branch has undertaken 

numerous initiatives to better manage 

the more than $90 billion that is annually 

invested in IT. However, federal IT 

investments too frequently fail or incur 

cost overruns and schedule slippages 

while contributing little to mission-related 

outcomes. These investments often 

suffered from a lack of disciplined and 

effective management, such as project 

planning, requirements definition, and 

program oversight and governance. In 

2015, we added the government’s 

management of IT acquisitions and 

operations to the High-Risk list.

Recognizing the severity of issues 

related to the government-wide 

management of IT, in December 2014, 

Congress and the President enacted 

federal IT acquisition reform legislation; 

in November 2017, the sunset dates of 

several of these statutory provisions 

were extended or removed. Among other 

things, these laws require covered 

agencies to: (1) enhance agency CIO 

authority, (2) enhance transparency and 

improve risk management, (3) 

consolidate federal data centers, (4) 

review IT investment portfolios, (5) 

purchase government-wide software 

licenses, (6) maximize the benefit of 

federal strategic sourcing and (7) expand 

training and use of IT acquisition cadres.

Contact Information

For additional information about this 

high-risk area, contact Carol Harris at 

202-512-4456 or harriscc@gao.gov. 
Improving the Management of IT Acquisitions 

and Operations

Page 124 GAO-19-157SP High-Risk Series 

not demonstrated an established IT workforce planning process. All five 

agencies either agreed or partially agreed with our recommendations and 

identified planned actions to address our recommendations to improve 

their IT workforce planning. However, as of December 2018, none of our 

recommendations had been fully implemented.

Action plan: partially met. In addition to requiring covered agencies to 

conduct self-assessments, OMB’s FITARA implementation guidance 

requires agencies to develop and implement plans describing changes 

they will make to ensure that IT management responsibilities for CIOs 

and other senior agency officials are effectively implemented. These 

plans are to address the areas of IT management that we have identified 

as high risk, such as reviewing poorly performing investments, managing 

agencies’ IT portfolios, and implementing incremental development. While 

all 24 major federal agencies have developed FITARA implementation 

plans, the agencies need to demonstrate additional progress in effectively 

implementing these plans. As of December 2018, our continuing work to 

monitor progress in this area showed that 22 of the 24 major federal 

agencies had publicly reported at least partial completion of their FITARA 

milestones; however, all 22 of those agencies also reported incomplete 

milestones.

Significant work remains for federal agencies to establish action plans to 

modernize or replace obsolete IT investments. In May 2016, we reported 

that agencies were using systems which had components that were, in 

some cases, at least 50 years old. To address this issue, we 

recommended that 12 agencies identify and plan to modernize or replace 

legacy systems, including establishing time frames, activities to be 

performed, and system functions to be replaced or enhanced. Of the 12 

agencies, 10 either concurred or partially concurred with our 

recommendations, while 2 stated they had no comment. However, as of

December 2018, only 3 of the 12 agencies had implemented our 

recommendation and made progress in planning to modernize their 

legacy systems.

Monitoring: partially met. The President’s Management Agenda 

identified improving IT spending transparency as one of the 

Administration’s 14 cross-agency priority goals and tasked OMB with 

leading the drive towards better agency reporting on IT spending. 

In January 2018, we reported that the majority of 22 agencies that we 

reviewed did not identify all of their IT contracts, leaving about $4.5 billion 

in IT-related contract obligations beyond those reported by agencies. 

Further, in November 2018, we reported that four selected agencies 

lacked quality assurance processes for ensuring that billions of dollars 

requested in their IT budgets were informed by reliable cost information. 

We made recommendations for those agencies to improve how IT 
Improving the Management of IT Acquisitions 

and Operations

Page 125 GAO-19-157SP High-Risk Series 

acquisitions are identified and to establish procedures for ensuring IT 

budgets are informed by reliable cost information. Until agencies properly 

identify IT acquisitions and establish processes for ensuring the quality of 

cost data used to inform their IT budgets, agency CIOs are at risk of not 

having appropriate oversight of IT acquisitions worth billions of dollars 

and not having adequate transparency into IT spending to make informed 

budget decisions. 

OMB has taken action to improve monitoring through its IT Dashboard—a 

public website that provides detailed information on major IT investments 

at 26 federal agencies, including ratings from CIOs that should reflect the 

level of risk facing each investment. However, in June 2016, we reported 

that our assessments of IT Dashboard risk ratings showed more risk on 

the majority of agency IT investments we sampled than did the 

associated CIO ratings. Consequently, we made 25 recommendations to 

15 agencies to improve their CIO’s risk ratings; 12 agencies generally 

agreed with or did not comment on our recommendations, and 3 

disagreed. As of December 2018, only 14 of the recommendations had 

been fully implemented. Agencies should continue to fully and accurately 

report on these risks to ensure their IT investments receive appropriate 

oversight.

An additional area of concern regarding the monitoring of IT acquisitions 

is agencies’ reported use of incremental development; OMB policy 

requires that IT investments deliver functionality in 6-month increments. 

However, our May 2014 report found that delivery rate to be challenging 

for agencies and, thus, we recommended that OMB instead require 

increments of 12 months. While OMB disagreed with our 

recommendation, our continuing work in this area has found that most 

agencies have reported progress in improving the rate at which their IT 

acquisitions deliver functionality at the 12-month rate. Nonetheless, in 

November 2017, we reported that most agencies lacked the required 

policies intended to ensure adequate consideration of incremental 

development approaches for major IT investments and we made 19 

recommendations to 17 agencies to address this issue. Eleven agencies 

agreed with our recommendations, 1 partially agreed, and 5 did not state 

whether they agreed or disagreed. As of December 2018, 11 of our 19 

recommendations remained open.

Demonstrated progress: partially met. In our 2017 high-risk update, we

identified agency plans to save $5.3 billion from data center consolidation, 

a number which included $3.3 billion planned through fiscal year 2015. 

Agencies subsequently reported achieving $2.8 billion of that amount. In 

2016, OMB issued new guidance on consolidating data centers and 

subsequently, a number of agencies revised their planned savings, 

resulting in $2.4 billion planned from fiscal years 2016 through 2018. As 

of August 2018, our continuing work to monitor progress in this area has 
Improving the Management of IT Acquisitions 

and Operations

Page 126 GAO-19-157SP High-Risk Series 

shown that over $1.9 billion of that savings had been achieved. The total 

achieved savings of $4.7 billion represents slightly more than 80 percent 

of the agencies’ planned $5.7 billion in savings since 2011. In our 2017 

high-risk update, we cited this 80 percent target as one of several actions 

that should be taken and recognize the positive government-wide 

progress this demonstrates. However, improvement is still needed in 

other areas. 

Since fiscal year 2010, we have made 1,242 recommendations to 

address shortcomings in IT acquisitions and operations; 514 since this 

area was added to the High-Risk List in February 2015. As of December 

2018, OMB and federal agencies had fully implemented only 735 (or 

about 59 percent) of the total recommendations and only 169 (about 33

percent) of the recommendations made since February 2015. In addition, 

agencies have made progress in achieving about $2.5 billion in savings 

across a key OMB initiative—PortfolioStat—intended to improve the 

management of IT investments by consolidating and eliminating 

duplicative systems, among other things. Through fiscal year 2016, 

agencies had saved almost $1.8 billion, with more than $754 million in 

fiscal year 2017. Nevertheless, agencies have approximately $3.5 billion 

in their reported planned savings still to be achieved.

As we have recommended, OMB and covered federal agencies should 

further implement the requirements of FITARA. OMB will need to provide 

sustained oversight to ensure that agency actions are completed and the 

desired results are achieved.

• Beyond implementing FITARA and OMB’s guidance to improve the 

capacity to address our high-risk area, agencies need to implement our 

recent recommendations related to improving CIO authorities, as well as 

past recommendations on improving IT workforce planning practices.

• Agencies must establish action plans to modernize or replace obsolete IT 

investments. 

• Agencies need to implement our recommendations to address 

weaknesses in their IT Dashboard reporting of investment risk and 

incremental development implementation.

• OMB and agencies should work toward implementing our remaining 456 

open recommendations related to this high-risk area. These remaining 

recommendations include 12 priority recommendations for agencies to, 

among other things, report all data center consolidation cost savings to 

OMB, plan to modernize or replace obsolete systems as needed, and 

improve their implementation of PortfolioStat. OMB and agencies need to 

take additional actions to (1) implement at least 80 percent of our open 

recommendations related to the management of IT acquisitions and 

operations, (2) ensure that a minimum of 80 percent of the government’s 

What Remains to Be Done
Improving the Management of IT Acquisitions 

and Operations

Page 127 GAO-19-157SP High-Risk Series 

major IT acquisitions deliver functionality every 12 months, and (3) 

achieve at least 80 percent of the over $6 billion in planned PortfolioStat 

savings.

Information Technology: Departments Need to Improve Chief Information 

Officers’ Review and Approval of IT Budgets. GAO-19-49. Washington, 

D.C.: November 13, 2018. 

Federal Chief Information Officers: Critical Actions Needed to Address 

Shortcomings and Challenges in Implementing Responsibilities. 

GAO-18-93. Washington, D.C.: August 2, 2018.

Data Center Optimization: Continued Agency Actions Needed to Meet 

Goals and Address Prior Recommendations. GAO-18-264. Washington, 

D.C.: May 23, 2018.

Information Technology: Agencies Need to Involve Chief Information 

Officers in Reviewing Billions of Dollars in Acquisitions. GAO-18-42. 

Washington, D.C.: January 10, 2018.

Information Technology: OMB Needs to Report On and Improve Its 

Oversight of the Highest Priority Programs. GAO-18-51. Washington, 

D.C.: November 21, 2017.

Information Technology Reform: Agencies Need to Improve Certification 

of Incremental Development. GAO-18-148. Washington, D.C.: November 

7, 2017.

Data Center Optimization: Agencies Need to Address Challenges and 

Improve Progress to Achieve Cost Savings Goal. GAO-17-448. 

Washington, D.C.: August 15, 2017. 

Data Center Optimization: Agencies Need to Complete Plans to Address 

Inconsistencies in Reported Savings. GAO-17-388. Washington, D.C.: 

May 18, 2017.

Information Technology: Opportunities for Improving Acquisitions and 

Operations. GAO-17-251SP. Washington, D.C.: April 11, 2017.

Related GAO 

Products
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 128 GAO-19-157SP High-Risk Series 

The Bureau of Indian Education (BIE), Indian Health Service (IHS), and Bureau of Indian Affairs (BIA) have 

demonstrated some progress in all high-risk area segments. All three agencies continue to face challenges 

retaining permanent leadership and a sufficient workforce. 

We added this area to our HighRisk List in 2017 and are 

assessing all three segments 

against our high-risk criteria for the 

first time. Overall, the three 

agencies have partially met the 

leadership commitment, capacity, 

action plan, monitoring, and 

demonstrated progress criteria for 

the education, health care, and 

energy areas. 

Since we added this area to our 

High-Risk List in 2017, we have 

testified at seven congressional 

hearings. We believe that it is vital 

for Congress to maintain its focus on improving the effectiveness with 

which federal agencies meet their responsibilities to serve tribes and their 

members in these areas.

When we added this area to our High-Risk List in February 2017, there 

were 39 open recommendations. Since then, we added 13 

recommendations. As of December 2018, 32 recommendations remain 

open.

Education

The education segment has partially met 

all five criteria for addressing high-risk 

issues.

Leadership commitment: partially met.

Indian Affairs leaders have shown 

commitment to addressing key 

weaknesses in the management of BIE 

schools. For example, the BIE Director 

formed an internal working group, 

convened meetings with other senior 

leaders within Indian Affairs, and publicly 

stated that his agency is committed to implementing our

recommendations. We also met with the new Assistant Secretary-Indian 

Affairs, who expressed her commitment to supporting the agency’s efforts 

Improving Federal Management of Programs 

that Serve Tribes and Their Members

Why Area Is High Risk

Because our work has shown federal 

agencies have ineffectively administered 

Indian education and health care 

programs, and inefficiently met their 

responsibility for managing the 

development of Indian energy resources, 

we added this area to our High-Risk List 

in 2017. It includes three components 

across agencies in two departments, 

including BIE and BIA under Interior’s 

Office of the Assistant-Secretary of 

Indian Affairs (Indian Affairs), and IHS in 

Health and Human Services. 

Education. BIE challenges included 

poor conditions at BIE school facilities 

that endangered students and the 

agency’s weak oversight of school 

spending. 

Health care. HHS’s inadequate 

oversight has hindered IHS’s ability to 

ensure that Indian communities have 

timely access to quality health care.

Energy. BIA mismanagement of Indian 

energy resources held in trust limited 

opportunities for tribes and their 

members to use those resources to 

create economic benefits and improve 

the well-being of their communities. 

Contact Information

For additional information about this 

high-risk area and our Indian Education 

work, contact Melissa Emrey-Arras at 

(617) 788-0534 or 

emreyarrasm@gao.gov; for our Indian 

Health work, contact Jessica Farb at 

(202) 512-7114 or farbj@gao.gov; and 

for our Indian Energy work, contact 

Frank Rusco at (202) 512-3841 or 

ruscof@gao.gov. 
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 129 GAO-19-157SP High-Risk Series 

to address weaknesses in the management of BIE schools. However, 

frequent turnover in key leadership positions in recent years has 

hampered Indian Affairs’ efforts to make improvements to Indian 

education. 

Capacity: partially met. BIE and other Indian Affairs offices that 

support BIE schools have made some progress in increasing their 

capacity to address risks to Indian education. For example, BIE officials 

hired a full-time program analyst to coordinate the agency’s working 

group and help oversee the implementation of our recommendations. 

However, about 50 percent of all BIE positions have not been filled and 

the bureau has not completed a workforce plan to address staffing and 

training gaps, as we previously recommended. BIE officials told us they 

are developing a workforce plan, which they plan to complete by the end 

of 2018.

Action plan: partially met. Among other actions, BIE implemented a 

new action plan, including written procedures and risk criteria for 

overseeing BIE school expenditures, which fully addressed two priority 

recommendations. However, Indian Affairs has not provided 

documentation that it has developed and put in place action plans on 

other important issues, such as a comprehensive, long-term capital asset 

plan to inform its allocation of school facility funds, which we 

recommended.

Monitoring: partially met. Indian Affairs, in consultation with 

Department of Interior’s Office of Occupational Safety and Health, has 

taken actions to monitor corrective measures that address weaknesses 

with the agency’s safety program—which covers safety at BIE schools. 

However, the agency has not yet demonstrated that it is monitoring 

several other areas, such as whether relevant employees are being held 

to the agency’s required performance standards for safety inspections.

Demonstrated progress: partially met. Since our 2017 High-Risk 

report, Indian Affairs has fully addressed 11 of our 23 outstanding 

recommendations on Indian education. Overall, this represents a 

substantial increase in implementing our recommendations on Indian 

education since we identified the area as high-risk. Significant work, 

however, remains to address our outstanding recommendations in 

several key areas, such as workforce planning and accountability for BIE 

school safety and school construction projects. 

Continued progress will depend on sustained direction and support of top 

management in Indian Affairs and BIE. In addition, to increase its capacity 

to support functions related to administering and overseeing BIE schools, 

BIE needs to conduct strategic workforce planning and determine how 

What Remains to Be Done
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 130 GAO-19-157SP High-Risk Series 

best to align its human capital program with its mission and programmatic 

goals, as we have recommended. As of December 2018, 12 

recommendations related to this high-risk area remain open and Indian 

Affairs concurred with all 12 recommendations. 

IHS has partially met all five criteria to 

address the health care high-risk segment.

Leadership commitment: partially met.

IHS officials have demonstrated 

leadership commitment by regularly 

meeting with us to discuss the agency’s 

progress in addressing our 

recommendations. In addition, IHS has 

chartered a policy advisory council that will 

focus on issues related to strategic 

direction, recommended policy, and 

organizational adjustments. According to IHS, this advisory council will, 

among other things, serve as a liaison among IHS leadership for issues 

involving strategic direction and policy, as well as monitor and facilitate 

related policy workgroups. However, IHS still does not have permanent 

leadership—including a Director of IHS.

Capacity: partially met. Among other actions, IHS officials stated that 

the agency is expanding the role of internal audit staff within its enterprise 

risk management program to augment internal audits and complement 

both the Department of Health and Human Services Inspector General 

and our audits. In addition, IHS has developed a new Office of Quality,

which is expected to develop and monitor agency-wide quality of care 

standards. However, according to IHS, there are still vacancies in several 

key positions.

Action plan: partially met. IHS is in the final stages of developing a 

strategic plan and a related work plan to address certain root causes of 

management challenges and define solutions and corrective measures 

for the agency. The draft strategic plan divides these challenges into 

three categories: (1) access to care, (2) quality of care, and (3) program 

management and operations. We will examine the final strategic plan and 

related work plan to determine whether they contain the needed elements 

of an action plan once issued.

Monitoring: partially met. IHS has taken some steps toward monitoring 

the agency’s progress in addressing the root causes of their management 

weaknesses. In addition to developing its new Office of Quality, IHS has 

taken steps to develop a patient experience of care survey, as well as 

standards for tracking patient wait times. These efforts should be 

Health Care
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 131 GAO-19-157SP High-Risk Series 

reflected in the agency’s corrective plan, as part of an overall framework 

for monitoring progress that includes goals and performance measures to 

track their efforts and ultimately verify the effectiveness of their efforts.

Demonstrated progress: partially met. IHS has made progress in 

implementing corrective actions related to the management of health care 

programs. Specifically, since our 2017 High-Risk report, IHS implemented 

four of our 13 open recommendations. For example, in response to our 

April 2013 recommendation, to ensure that IHS’s payment rates for 

contracted services do not impede patient access to physician and other 

nonhospital care, IHS developed an online tool that enables the agency to 

track providers that do not accept IHS’s payment rates. In addition, IHS 

officials told us that they plan to complete the implementation of additional 

recommendations in 2019. 

We have identified several priority actions for IHS in its role of providing 

accessible health care services to Indian tribes. 

• IHS needs to ensure stable, permanent leadership that can assign the 

tasks needed to address weaknesses and hold individuals accountable 

for progress. 

• IHS needs to continue to develop a corrective action plan that defines 

root causes, identifies solutions, and provides for substantially completing 

corrective measures. 

• IHS needs to set up goals and performance measures to monitor the 

outcomes from its action plan.

• IHS needs to continue to address our open recommendations in this 

area, including (1) ensuring that agency-wide standards for the quality of 

care are developed, that facility performance in meeting these standards 

is systematically monitored over time, and that enhancements are made 

to its adverse event reporting system, and (2) monitoring patient wait 

times and ensuring corrective actions are taken when standards are not 

met.

As of December 2018, 7 out of the 13 recommendations in our 2017 

High-Risk report remain open, and we have added one additional 

recommendation—for a total of 8 open recommendations related to this 

high-risk area. IHS fully concurred with these 8 recommendations. 

We have an open matter for Congress to consider requiring IHS to 

develop and use a new method to more equitably allocate 

Purchased/Referred Care program funds—which allow patients to receive 

care from external providers—across areas.

What Remains to Be Done

Congressional Actions Needed
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 132 GAO-19-157SP High-Risk Series 

BIA has partially met all five criteria to 

address the energy high-risk segment.

Leadership commitment: partially met.

In June 2018, a permanent Assistant 

Secretary for Indian Affairs was confirmed. 

This action provided an opportunity to 

improve Indian Affairs’ oversight of federal 

actions associated with energy 

development. However, BIA does not 

have a permanent Director, and BIA’s 

Office of Trust Services—which has 

significant responsibility over Indian energy activities—does not have a 

permanent Director or Deputy Director. 

Capacity: partially met. In November 2016, we recommended that BIA

establish a documented process for assessing the workforce at its agency 

offices. BIA conducted a survey to identify workforce needs related to 

energy development to support staffing decisions at the new Indian 

Energy Service Center. However, BIA officials said the agency does not 

have the staff or resources to implement a comprehensive workforce 

planning system to ensure it has staff in place at its agency offices to 

meet its organization needs. 

Action plan: partially met. BIA officials met with us several times in 

fiscal year 2018 to discuss actions and plans for implementing our 

recommendations related to Indian energy resources. BIA officials told us 

that they proposed several modifications to the bureau’s land records 

data management system that will enable increased tracking and 

monitoring of key documents that BIA must review prior to the 

development of Indian energy resources. However, the agency does not 

have a comprehensive plan in place to identify causes of long-standing 

management weaknesses or an action plan to address the problems. 

Monitoring: partially met. BIA has taken steps to improve monitoring by 

holding frequent meetings assessing its progress in implementing our 

recommendations. However, BIA has not taken steps to monitor its 

progress addressing the root causes of management weaknesses. 

Demonstrated progress: partially met. BIA has shown significant 

progress developing data collection instruments and processes needed to 

track and review response times for a number of different actions 

associated with energy development. However, more needs to be done 

to close open recommendations, as discussed below. 

Energy
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 133 GAO-19-157SP High-Risk Series 

BIA needs to (1) provide decision makers with key information on 

resources needed to assess the composition of its workforce and 

implement a comprehensive workforce planning system, and (2) continue 

to identify causes of weaknesses with the management of Indian energy 

and mineral resources, and develop a plan to address these problems 

with clear milestones, well-defined performance measures, and a 

monitoring approach. As of December 2018, 12 of the 14 

recommendations in our 2017 High-Risk report remain open. BIA fully 

concurred with all 12 recommendations. 

Indian Health Service: Agency Faces Ongoing Challenges Filling Provider 

Vacancies. GAO-18-580. Washington, D.C.: August 15, 2018. 

High Risk: Agencies Need to Continue Efforts to Address Management 

Weaknesses of Federal Programs Serving Indian Tribes. GAO-18-616T. 

Washington, D.C.: June 13, 2018. 

High Risk: Status of Prior Recommendations on Federal Management of 

Programs Serving Indian Tribes. GAO-17-790T. Washington, D.C.: 

September 13, 2017. 

Indian Affairs: Further Actions Needed to Improve Oversight and 

Accountability for School Safety Inspections. GAO-17-421. Washington, 

D.C.: May 24, 2017.

Indian Affairs: Actions Needed to Better Manage Indian School 

Construction Projects. GAO-17-447. Washington, D.C.: May 24, 2017. 

Indian Health Service: Actions Needed to Improve Oversight of Quality of

Care. GAO-17-181. Washington, D.C.: January 9, 2017.

Indian Energy Development: Additional Actions by Federal Agencies Are

Needed to Overcome Factors Hindering Development. GAO-17-43. 

Washington, D.C.: November 10, 2016.

Indian Health Service: Actions Needed to Improve Oversight of Patient

Wait Times. GAO-16-333. Washington, D.C.: March 29, 2016.

What Remains to be Done

Related GAO 

Products
2020 Decennial Census 

Page 134 GAO-19-157SP High-Risk Series 

For the 2020 Census, the U.S. Census Bureau (Bureau) plans to implement several innovations, including new 

IT systems. The challenges associated with successfully implementing these innovations, along with other 

challenges, puts the Bureau’s ability to conduct a cost-effective census at risk. 

The 2020 Decennial Census was 

first added in 2017 as a high-risk 

area. Since then, the Bureau has 

met the criterion for leadership 

commitment and made progress 

on the other four criteria.

Leadership commitment: met. 

The Bureau and the Department 

of Commerce have strengthened 

this area with executive-level 

oversight of the 2020 Census by 

holding regular meetings on the 

status of IT systems and other 

risk areas. In addition, in 2017 the 

Department of Commerce 

designated a team to assist senior Bureau management with cost 

estimation challenges. Moreover, on January 2, 2019, a new Director of 

the Census Bureau took office, a position that had been vacant since 

June 2017; and in June 2018 the once-vacant Deputy Director position 

was filled.

Capacity: partially met. To enhance the capacity of its Decennial 

Directorate, the Bureau brought in new leadership in October 2017 with 

significant experience in program execution. The Bureau also improved 

the cost estimation process of the decennial when it established guidance 

including: 

• roles and responsibilities for oversight and approval of cost estimation 

processes, 

• procedures requiring a detailed description of the steps taken to 

produce a high-quality cost estimate, and

• a process for updating the cost estimate and associated documents 

over the life of a project. 

However, the Bureau continues to experience skills gaps in the 

government program management office overseeing the $886 million 

contract for integrating the IT systems needed to conduct the 2020 

Census. Specifically, as of November 2018, 21 of 44 positions in this 

office were vacant. These vacant positions add risk that the office may 

not be able to provide adequate oversight of contractor cost, schedule, 

and performance.

2020 Decennial Census

Why Area Is High Risk

The U.S. Census is mandated by the 

Constitution and provides vital data for 

the nation. Census data are used, 

among other purposes, to apportion the 

seats of the U.S. House of 

Representatives; redraw congressional 

districts in each state; and allocate 

billions of dollars each year in federal 

financial assistance. Further, 

businesses use census data to market 

new services and products, and to tailor 

existing ones to demographic changes. 

The Bureau is seeking to control the cost 

of the census, which has been 

escalating with each decade. The 2020 

Census is now estimated to cost 

approximately $15.6 billion. Moreover, 

the average cost for counting a housing 

unit increased from about $16 in 1970 to 

around $92 in 2010 (in 2020 constant 

dollars), in part because the nation’s 

population is more difficult to count.

The Bureau is also implementing several 

new innovations that require managing 

the processes of acquiring and 

developing new and modified IT 

systems. In addition, because the 2020 

Census involves collecting personal 

information from over a hundred million 

households, it will be important that the 

Bureau addresses system security 

weaknesses in a timely manner, and that 

risks are at an acceptable level before 

systems are deployed. 

Contact Information

For additional information about this 

high-risk area, contact Robert Goldenkoff 

at 202-512-2757 or 

goldenkoffr@gao.gov, or Nick Marinos at 

202-512-9342 or marinosn@gao.gov. 
2020 Decennial Census 

Page 135 GAO-19-157SP High-Risk Series 

Action plan: partially met. In December 2018, the Bureau issued an 

updated operational plan for the 2020 Census that laid out risks, 

decisions made, issues to be resolved, and related milestones for each of 

its major operations. However, the 2020 Census schedule lacks a risk 

assessment and certain other best scheduling practices, which affects its 

overall reliability. In addition, during the 2018 End-to-End Test we found 

the Bureau’s data management reporting system did not always provide 

accurate information because of a software issue. As a result, Bureau 

staff had to rely on multiple systems to manage field operations, making 

monitoring inefficient.

Monitoring: partially met. The Department of Commerce holds biweekly 

meetings with Bureau leadership to discuss the status of 2020 Census 

operations, including our open recommendations. To track performance 

of decennial census operations, the Bureau relied on reports to track 

progress against pre-set goals for a test conducted in 2018. According to 

the Bureau, these same reports will be used in 2020 to track progress. 

The Bureau has also taken steps to improve its cost estimation process 

for 2020; however, it needs to implement a system to track and report 

variances between actual and expected cost elements. Further, the 

Bureau’s schedule for developing IT systems during the 2018 End-to-End 

Test experienced delays that compressed the time available for system 

testing, integration testing, and security assessments. These schedule 

delays contributed to systems experiencing problems after deployment, 

as well as cybersecurity challenges. For example, as of December 2018, 

the Bureau had identified nearly 1,100 system security weaknesses that 

needed to be addressed.

Demonstrated progress: partially met. According to Department of 

Commerce officials, in the summer of 2018, the Bureau began conducting 

an analysis of oversight recommendations, including ours, to determine 

the root cause of shortfalls and set a timeline for addressing those 

recommendations and related root causes. We have standing quarterly 

meetings with Senior Bureau officials to discuss the status and expected 

actions for our open recommendations related to the 2020 Census. We 

also periodically meet with the Under Secretary for Economic Affairs to 

discuss the Department of Commerce’s oversight of the decennial 

census.

The Bureau is also using the cost estimate as a management tool for 

making decisions and assessing tradeoffs. For example, the cost 

estimate served as the basis for the fiscal year 2019 funding request 

developed by the Bureau. The Bureau also said it used the 2020 Census 

cost estimate to establish cost controls during budget formulation 

activities and to monitor spending levels for fiscal year 2019 activities. 
2020 Decennial Census 

Page 136 GAO-19-157SP High-Risk Series 

While these actions and others are important steps forward, we found that 

the Bureau scaled back testing of new innovations in 2017 and 2018. 

Specifically, the Bureau cancelled the field portion of the 2017 test and 

then conducted a full operational test in only one site—Providence 

County, Rhode Island—instead of three test sites as originally planned. 

Moreover, the Bureau did not test all 2020 Census systems and IT 

capabilities during its operational test. Not fully testing innovations and IT 

systems as designed, increases the risk that innovations and IT systems 

will not function as intended during the 2020 Census. 

As of January 2019, we have made 97 recommendations related to the 

2020 Census. The Bureau has implemented 67 of these 

recommendations and 30 remain open. The Department of Commerce 

generally agreed with our recommendations and is taking steps to 

implement them. Moreover, in our April 2018 priority recommendation 

letter to the Department of Commerce we identified 15 recommendations 

as priority—seven of which have been closed as implemented over the 

past year. To make continued progress, the Bureau needs to ensure its 

approach to strategic planning, IT management, cybersecurity, human 

capital management, internal collaboration, knowledge sharing, as well as 

risk and change management are aligned toward delivering more costeffective outcomes. Specifically the Bureau needs to:

• fill vacant positions in its government program management office as 

needed to oversee the IT integration contractor;

• implement best practices for scheduling the thousands of activities that 

make up the 2020 Census;

• improve the management and oversight of its IT systems in order to meet 

milestones for system development and testing, and be ready for the 

major operations of the 2020 Census;

• address cybersecurity weaknesses in a timely manner and ensure that 

risks are at an acceptable level before systems are deployed;

• implement cost estimation best practices including a system to track and 

report variances between actual and expected costs for its 2020 Census 

cost estimate;

• resolve implementation issues that have arisen during testing, prior to the 

2020 Census; and 

• continue to address our recommendations, especially those designated 

priority recommendations.

In 2017 and 2018, we testified in five congressional hearings focused on 

the progress of the Bureau’s preparations for the decennial census. 

Going forward, continued congressional oversight will be needed to 

ensure decennial efforts stay on track, the Bureau has needed resources, 

What Remains to Be Done

Congressional Actions Needed
2020 Decennial Census 

Page 137 GAO-19-157SP High-Risk Series 

and Bureau officials are held accountable for implementing the 

enumeration as planned.

2020 Census: Additional Steps Needed to Finalize Readiness for Peak 

Field Operations, GAO-19-140. Washington, D.C.: December 10, 2018.

2020 Census: Continued Management Attention Needed to Address 

Challenges and Risks with Developing, Testing, and Securing IT 

Systems, GAO-18-655. Washington, D.C.: August 30, 2018.

2020 Census: Census Bureau Improved the Quality of Its Cost Estimation 

but Additional Steps Are Needed to Ensure Reliability, GAO-18-635. 

Washington, D.C.: August 17, 2018.

2020 Census: Bureau Has Made Progress with Its Scheduling, but 

Further Improvement Will Help Inform Management Decisions, 

GAO-18-589. Washington, D.C.: July 26, 2018.

2020 Census: Actions Needed to Address Challenges to Enumerating 

Hard-to-Count Groups, GAO-18-599. Washington, D.C.: July 26, 2018.

2020 Census: Actions Needed to Improve In-Field Address Canvassing 

Operation, GAO-18-414. Washington, D.C.: June 14, 2018.

2020 Census: Actions Needed to Mitigate Key Risks Jeopardizing a CostEffective and Secure Enumeration, GAO-18-543T. Washington, D.C.: 

May 8, 2018.

2020 Census: Continued Management Attention Needed to Mitigate Key 

Risks Jeopardizing a Cost-Effective and Secure Enumeration, 

GAO-18-416T. Washington, D.C.: April 18, 2018.

2020 Census: Actions Needed to Mitigate Key Risks Jeopardizing a CostEffective Enumeration, GAO-18-215T. Washington, D.C.: October 31, 

2017.

2020 Census: Continued Management Attention Needed to Oversee 

Innovations, Develop and Secure IT Systems, and Improve Cost 

Estimation, GAO-18-141T. Washington, D.C.: October 12, 2017.

2020 Census: Bureau Is Taking Steps to Address Limitations of 

Administrative Records, GAO-17-664. Washington, D.C.: July 26, 2017.

Related GAO 

Products
U.S. Government’s Environmental Liability 

Page 138 GAO-19-157SP High-Risk Series 

The federal government’s environmental liability is vast and growing, and the Departments of Energy (DOE) 

and Defense (DOD), which bear the bulk of this liability, need to take steps to address the environmental risks 

and to monitor, report on, and better understand this liability. 

The U.S. Government’s 

Environmental Liability was first 

added in 2017 as a high-risk area. 

Since then, DOD and DOE have 

partially met the leadership 

commitment criteria, but have not 

met any of the other criteria. 

Leadership commitment: 

partially met. Officials at both 

DOE and DOD have taken steps 

to focus more attention on the 

environmental liabilities of their 

respective agencies. For 

example, in July 2017, DOE’s 

Office of Environmental 

Management (DOE-EM) issued a new cleanup policy that established 

requirements for DOE’s environmental management cleanup program. In 

addition, the Assistant Secretary for Environmental Management 

acknowledged in September 2018 that additional work needs to be done 

to address DOE’s growing environmental liabilities and announced plans 

to develop a strategic plan, as well as specific plans for each of its sites.

DOD established an Environmental Liabilities Working Group in 2014 that 

is co-chaired by senior DOD officials and provides a forum for DOD and 

its components to share liability estimating methodologies, best practices, 

and lessons learned. In November 2018, as part of a department-wide 

audit conducted by the DOD Inspector General, DOD’s environmental 

liabilities were audited by an independent public accounting firm for the 

first time. The Inspector General issued a disclaimer of opinion on the 

department-wide financial statements, with environmental liabilities 

identified as one of the material weaknesses. 

Capacity: not met. Both DOE and DOD have significant gaps in their 

ability to effectively address their portions of the environmental liability. 

For instance, DOE-EM does not collect or maintain reliable cost, 

schedule, or milestone data on its projects. Therefore, it lacks the 

information needed to evaluate overall project and program performance, 

and assess whether it has sufficient staff—or the staff with the right 

skills—to carry out the cleanup mission. In addition, DOE’s budget 

requests do not disclose the future funding it anticipates needing to meet 

its schedule milestones for cleanup of legacy defense waste. 

U.S. Government’s Environmental Liability

Why Area Is High Risk

The federal government's environmental 

liability has been growing for the past 20 

years and this rise is likely to continue 

even as billions are spent each year on 

cleanup efforts. For fiscal year 2017, the 

federal government's estimated 

environmental liability was $465 billion—

up from $212 billion since fiscal year 

1997. We added this area to our HighRisk List in 2017.

DOE is responsible for the largest share 

of the liability ($384 billion or about 83 

percent) related primarily to retrieving, 

treating, and disposing of nuclear and 

hazardous waste. DOD is responsible for 

the second-largest share ($68 billion or 

about 15 percent), related primarily to 

environmental cleanup and restoration 

activities at its installations. The 

remaining liability is shared among other 

agencies, including the Departments of 

Transportation, Veterans Affairs, Interior, 

and Agriculture.

DOE’s liability grew by $110 billion (to 

$494 billion) in fiscal year 2018, primarily 

due to an increase in the estimated cost 

of the cleanup at the Hanford Site in 

Washington State. (The total liability for 

the rest of the federal government in 

fiscal year 2018 was not available at the 

time this report was published.) Even 

with the increase, however, DOE’s 

cleanup responsibilities may be 

underestimated because under federal 

accounting standards, environmental 

liability estimates do not include cost 

estimates for work for which reasonable 

estimates cannot currently be generated.

Contact Information

For additional information about this 

high-risk area, contact David Trimble at 

202-512-3841 or trimbled@gao.gov. 
U.S. Government’s Environmental Liability 

Page 139 GAO-19-157SP High-Risk Series 

The recent audit of DOD’s environmental liabilities found that DOD did not 

consistently design, document, and implement controls over its 

environmental and disposal liabilities and did not appropriately prepare 

cost estimates for certain types of environmental liabilities. For example, 

auditors found that in developing its environmental liabilities cost 

estimates, DOD did not (1) include all required cost elements, (2) adjust 

the estimates to reflect current dollars, (3) use current data and the 

correct inputs, and (4) ensure estimates were reviewed by an estimator 

with the appropriate training. 

Action plan: not met. Neither DOE nor DOD has fully identified the 

causes of their growing environmental liability or developed a formal plan 

to address it.

DOE has made at least two attempts recently to prioritize cleanup 

activities but neither has been fully implemented. First, in August 2017, 

DOE-EM instituted a 45-day review to gather input from sites regarding 

cleanup activities that could be completed quickly. However, this effort 

stalled with no action plan or report issued. Second, officials 

acknowledged they have not analyzed in detail the root causes of the 

growth in its environmental liability, and in August 2018, DOE-EM asked 

the sites to identify the key obstacles each faced in carrying out its 

cleanup mission. Senior DOE-EM leaders stated that they are developing 

corrective actions based on this information. 

This effort may provide some insights into challenges at each site, but it is 

not comprehensive enough to reveal why, each year, DOE’s 

environmental liabilities are increasing faster than DOE’s spending on 

cleanup efforts. Without a comprehensive effort that incorporates prior 

DOE efforts to conduct root cause studies regarding contract and project 

management issues, it is not clear that DOE will have the information to 

develop an action plan to effectively address its environmental liabilities. 

At DOD, officials acknowledged that the agency will likely incur costs for 

restoration initiatives in conjunction with base closures and with returning 

overseas DOD facilities to host nations. However, DOD reported that it is 

unable to provide a reasonable estimate of those costs because the 

extent of required restoration is unknown. Specifically, DOD has not 1) 

fully estimated costs for all its liabilities because the cost to clean up 

some known sites is not yet estimable, 2) fully inventoried all sites and 

general property, plant, and equipment needing cleanup, and 3) 

established a consistent methodology to adequately gather data and 

develop estimates.

Monitoring: not met. DOE and DOD do not have the information needed 

to monitor the effectiveness of their actions to address the environmental 

liabilities facing their departments. In February 2019, we found that DOE’s 

performance measures for cleanup activities do not provide a clear 
U.S. Government’s Environmental Liability

Page 140 GAO-19-157SP High-Risk Series 

picture of overall performance. Specifically, the systems used by DOE 

and its contractors to track cleanup progress do not follow project 

management best practices and do not link performance to cost and 

schedule. In April 2018, we found that DOE-EM does not have adequate 

quality control processes in place at Hanford’s Waste Treatment and 

Immobilization Plant—the largest project in DOE’s cleanup program—to 

monitor engineering and construction deficiencies. As a result, some 

problems have recurred, causing cost increases and schedule delays. 

DOD continues to face challenges in developing reliable information on its 

environmental liabilities. In April 2018, DOD provided guidance on a 

department-wide audit strategy and methodology for the military services 

and its components to use in developing auditable environmental liability 

estimates that would standardize the business practices for reporting 

environmental liabilities department-wide. However, in November 2018, 

the DOD Inspector General identified deficiencies within DOD’s 

environmental liabilities audit approach, specifically related to DOD’s 

ability to substantiate the completeness and amount of its environmental 

liability estimate. As a result, the Inspector General identified DOD’s 

environmental liability as a material weakness. 

Demonstrated progress: not met. DOE has made proposals to address 

some waste and legal challenges, but Congress may need to take action 

to provide more clarity on DOE’s authority in this area for it to 

demonstrate progress, as we noted in May 2017. DOE has begun to 

explore a less expensive waste treatment alternative—grouting waste 

rather than turning it into glass—aimed at reducing the overall cost of the 

cleanup at one of its largest and most expensive cleanup site at Hanford 

in Washington State. However, DOE’s effort to demonstrate alternative 

technologies for treating waste was not funded in the fiscal year 2019 

budget. 

Overall, DOE’s environmental liability continues to grow: In the past two 

fiscal years, DOE has spent over $12 billion on cleanup activities while 

the reported liability has grown by $122 billion. Similarly, DOD’s liability 

has remained largely unchanged in recent years despite billions spent on 

environmental cleanup projects. More remains to be done by DOE and 

DOD to demonstrate progress toward fully understanding, disclosing, and 

reducing their environmental liability.

Both DOE and DOD have open recommendations that, if implemented, 

would improve the quality of the environmental liability estimates and 

begin to address the growing liability. Among these are the following key 

recommendations.

What Remains to Be Done
U.S. Government’s Environmental Liability 

Page 141 GAO-19-157SP High-Risk Series 

DOE should:

• develop a program-wide strategy that outlines how DOE will direct 

available resources to address human health and environmental risks 

across and within sites;

• include information on annual growth in environmental liability estimates 

by site and the causes of that growth in DOE-EM’s Future Years Defense 

Environmental Management Plan, as well as an explanation of significant 

differences between lifecycle cost estimates in DOE-EM’s annual budget 

submission with the environmental liability estimates; and 

• disclose the funding needed to meet all of its enforceable cleanup 

milestones in, for example, supplemental reports or the annual FutureYears Defense Environmental Management Plan. 

DOD should:

• effectively implement its program for financial management review, 

approval, assessment, and monitoring of the estimation and reporting 

processes for environmental liabilities;

• improve compliance with federal accounting standards and Financial 

Management Regulations guidance; 

• design a process and controls at the department level to reconcile 

installation-level environmental records to installation property records 

and then using the corrected site inventories to determine that all sites 

with cleanup or corrective action costs are included in its financial reports 

of environmental liabilities; and

• report all costs required to complete environmental cleanup at each base 

realignment and closure installation.

In addition to taking the actions listed above, attention to open 

recommendations will be key to making progress to address this high-risk 

area. As of December 2018, 29 of our recommendations related to this 

high-risk area had not been implemented, 17 of which were made since 

we last reported on this high-risk area in 2017. 

Congress should consider clarifying, in a manner that does not impair the 

regulatory authorities of EPA and the state of Washington and in 

consultation with the Nuclear Regulatory Commission, DOE’s authority at 

Hanford to determine whether portions of the supplemental low activity 

waste can be managed as other high-level waste. Providing clear 

authority to DOE may allow it to use alternative waste treatment 

approaches to treat Hanford’s supplemental low activity waste, which 

could reduce certain risks by neutralizing the waste faster and save tens 

of billions of dollars.

Congressional Actions Needed
U.S. Government’s Environmental Liability 

Page 142 GAO-19-157SP High-Risk Series 

Nuclear Waste Cleanup: DOE Could Improve Program and Project 

Management by Better Classifying Work and Following Leading 

Practices. GAO-19-223. Washington, D.C.: February 19, 2019.

Department of Energy: Program-Wide Strategy and Better Reporting 

Needed to Address Growing Environmental Cleanup Liability. 

GAO-19-28. Washington, D.C.: January 29, 2019.

Hanford Waste Treatment Plant: DOE Needs to Take Further Actions to 

Address Weaknesses in Its Quality Assurance Program. GAO-18-241. 

Washington, D.C.: April 24, 2018.

Department of Energy: Continued Actions Needed to Modernize Nuclear 

Infrastructure and Address Management Challenges. GAO-18-374T. 

Washington, D.C.: Feb. 6, 2018.

Drinking Water: DOD Has Acted on Some Emerging Contaminants but 

Should Improve Internal Reporting on Regulatory Compliance. 

GAO-18-78. Washington, D.C.: Oct. 18, 2017.

Nuclear Waste: Opportunities Exist to Reduce Risks and Costs by 

Evaluating Different Waste Treatment Approaches at Hanford. 

GAO-17-306. Washington, D.C.: May 3, 2017.

Military Base Realignments and Closures: DOD Has Improved 

Environmental Cleanup Reporting but Should Obtain and Share More 

Information. GAO-17-151. Washington, D.C.: Jan. 19, 2017.

Military Base Closures: Opportunities Exist to Improve Environmental 

Cleanup Cost Reporting and to Expedite Transfer of Unneeded Property. 

GAO-07-166. Washington, D.C.: Jan. 30, 2007.

Environmental Liabilities: Long-Term Fiscal Planning Hampered by 

Control Weaknesses and Uncertainties in the Federal Government’s 

Estimates. GAO-06-427. Washington, D.C.: Mar. 31, 2006.

Related GAO 

Products
DOD Weapon Systems Acquisition 

Page 143 GAO-19-157SP High-Risk Series 

The Department of Defense (DOD) can get better returns on its over one trillion dollar weapon system 

investments by following knowledge-based practices and developing an action plan for performance measures.

Since our 2017 High-Risk Report, 

our assessment of DOD’s 

performance against our five 

criteria remains unchanged.

Leadership commitment: met. 

DOD has implemented reforms in 

its acquisition policies and 

undertaken initiatives aimed at 

improving program outcomes. 

DOD’s reforms included a 2015 

update of its acquisition 

instruction and a series of Better 

Buying Power initiatives 

implemented between 2010 and 

2015. The Office of the Under 

Secretary of Defense for Acquisition, Technology and Logistics led these 

efforts; however, in response to congressional direction, DOD dissolved

this office in February 2018. Since then, DOD has developed a new 

organizational structure that refocuses the Office of the Secretary of 

Defense’s principal role from program oversight to one intended to ensure 

that major DOD investments produce integrated, technically superior 

capability that consistently outpaces global threats. 

Within this structure, the new Under Secretary of Defense for Acquisition 

and Sustainment has retained milestone decision authority over 11 major 

defense acquisition programs, including the F-35 Lightning II Joint Strike 

Fighter—DOD’s most expensive program. Service acquisition executives 

in each of the three military departments are authorized to make 

milestone decisions for all other current, major defense acquisition 

programs. Although DOD’s executives share a collective commitment to 

improve program performance, specifics about the new organizational 

structure have not been fully determined.

Capacity: partially met. In February 2018, we reported that the military 

services aligned extensively with 4 of the 10 key practices leading 

organizations use to select, train, mentor, and retain program managers. 

We recommended that the military services improve practices that do not 

align extensively with leading practices, incorporate lessons learned from 

the Army’s experience with the Civilian Acquisition Workforce Personnel 

Demonstration Project, and make greater use of existing financial awards 

for good performance. DOD officials agreed with the recommendations 

and have identified its plans to implement them.

DOD Weapon Systems Acquisition

Why Area Is High Risk

In April 2018, we reported that the DOD 

expects to invest $1.66 trillion in total to 

develop and procure its portfolio of 86 

major defense acquisition programs. 

Congress and DOD have long sought to 

improve how major weapon systems are 

acquired, yet many DOD programs 

continue to fall short of cost, schedule, 

and performance goals. Consequently, 

DOD often pays more than anticipated, 

buys less than expected, and, in some 

cases, delivers fewer capabilities to the 

warfighter. We added this area to our 

High-Risk List in 1990.

Given substantial defense modernization 

and recapitalization needs, DOD must 

get better returns on its weapon system 

investments and find ways to deliver 

capabilities to the warfighter on time and 

within budget.

Contact Information

For additional information about this 

high-risk area, contact Michael J. 

Sullivan, Director, Contracting and 

National Security Acquisitions at (202) 

512-4841 or sullivanm@gao.gov or 

Shelby S. Oakley, Director, Contracting 

and National Security Acquisitions at 

(202) 512-4841 or oakleys@gao.gov. 
DOD Weapon Systems Acquisition 

Page 144 GAO-19-157SP High-Risk Series 

Action plan: partially met. DOD reported to Congress in August 2017 

that the department was at risk of not being able to acquire and sustain 

major weapon systems at sufficient levels due to increasing costs. To 

counter this risk, DOD’s new position of Under Secretary of Defense for 

Acquisition and Sustainment is to focus on major defense acquisition 

program performance and on reducing costs to free up resources for 

further investment. Although DOD has not yet identified a plan with 

specific goals or performance measures, its Better Buying Power 

initiatives address several steps DOD can take across its acquisition 

portfolio to achieve better results. These initiatives include measures such 

as setting and enforcing affordability constraints, instituting a long-term 

investment plan for portfolios of weapon systems, implementing “should 

cost” management to control contract costs, and eliminating redundancies 

within portfolios. The initiatives also emphasize the need to adequately 

grow and train the acquisition workforce.

Monitoring: partially met. In December 2008, GAO, DOD, and the 

Office of Management and Budget agreed on a set of metrics to measure 

DOD program cost growth over time. We have reported on those metrics 

since 2011; however, DOD no longer agrees with their use. In July 2018, 

GAO and DOD initiated discussions, which will continue in 2019, to 

develop a new set of metrics. DOD is also generally required under 

statute to submit selected acquisition reports to Congress that detail the 

cost, schedule, and performance status of individual major defense 

acquisition programs. DOD generally prepares these reports annually in 

conjunction with submission of the President’s Budget. Further, from 2013 

to 2016, DOD assessed and reported publicly on performance across its 

full portfolio of programs. DOD has not issued the portfolio reports since 

2016, relying instead on its selected acquisition reports to provide 

information to Congress. 

Demonstrated progress: partially met. In fiscal year 2017, we analyzed 

the cost growth of weapon systems in development since 2009, when 

DOD began implementing major acquisition reforms. We compared that 

to cost growth over the 10-years prior to acquisition reform and reported a 

75 percent reduction in cost growth that totaled $36 billion. Similarly, we 

reported in April 2018 that DOD programs initiated since 2010 had better 

cost performance between 2016 and 2017 than the rest of the portfolio—

an estimated $5.6 billion decrease versus a $60.3 billion increase. At the 

same time, we reported that most DOD programs continue to not fully 

implement knowledge-based acquisition practices, which increases the 

risk of undesirable cost and schedule outcomes.

Over the years since we added this area to our High-Risk List, we have 

made numerous recommendations related to this high-risk issue. As of 

November 2018, 88 recommendations remain open, 43 of which we 

made since the last high-risk update in February 2017. To improve its 

What Remains to Be Done
DOD Weapon Systems Acquisition 

Page 145 GAO-19-157SP High-Risk Series 

performance in the above areas, DOD should implement our 

recommendations on (1) knowledge-based acquisition practices, (2) 

defined cost and schedule goals, and (3) more extensive alignment with 

commercial practices on hiring and retaining quality program managers. 

Further, DOD should address our related open priority recommendations, 

which call for DOD to:

• Prepare cost and funding summaries for each individual ship in the Fordclass aircraft carrier program (CVN 78) within Selected Acquisition 

Reports.

• Track the costs to correct defects after ship delivery to help determine 

cases in which warranties could contribute to improvements in the cost 

and quality of Navy ships.

• Revise the Navy’s ship delivery policy to clarify what types of deficiencies 

need to be corrected, what capabilities must be achieved, and when. The 

Navy should also clearly define what constitutes a complete ship and 

when that status should be achieved.

• Require the Missile Defense Agency to make its cost estimates more 

comprehensive, to stabilize its element and program baselines by better 

understanding requirements before setting a baseline, and—once a 

baseline is set—to track revisions to enable meaningful comparisons 

over time.

• Establish a pilot program involving several current or new major defense 

acquisition programs to test, on a broad scale, different streamlined 

approaches for providing decision makers with only the most essential 

information needed to make decisions at each milestone throughout the 

acquisition process.

• Implement leading practices for managing science and technology 

programs by defining the appropriate mix of innovative, breakthrough 

technologies and more moderate, incremental technology 

enhancements; assessing whether that mix is achieved; using existing 

flexibilities to more quickly initiate or discontinue projects in response to 

the rapid pace of innovation; incorporating acquisition stakeholders into 

technology development programs; and promoting advanced prototyping 

of breakthrough technologies. 

Weapon Systems Cybersecurity: DOD Just Beginning to Grapple with 

Scale of Vulnerabilities. GAO-19-128. Washington, D.C.: October 9, 

2018.

F-35 Joint Strike Fighter: Development Is Nearly Complete, but 

Deficiencies Found in Testing Need to Be Resolved. GAO-18-321. 

Washington, D.C.: June 13, 2018.

Navy Shipbuilding: Past Performance Provides Valuable Lessons for 

Future Investments. GAO-18-238SP. Washington, D.C.: June 6, 2018.

Related GAO 

Products
DOD Weapon Systems Acquisition 

Page 146 GAO-19-157SP High-Risk Series 

Missile Defense: The Warfighter and Decision Makers Would Benefit from 

Better Communication about the System's Capabilities and Limitations. 

GAO-18-324. Washington, D.C.: May 30, 2018.

Weapon Systems Annual Assessment: Knowledge Gaps Pose Risks to 

Sustaining Recent Positive Trends. GAO-18-360SP. Washington, D.C.: 

April 25, 2018.

Defense Acquisition Workforce: Opportunities Exist to Improve Practices 

for Developing Program Managers. GAO-18-217. Washington, D.C.: 

February 15, 2018.

Columbia Class Submarine: Immature Technologies Present Risks to 

Achieving Cost, Schedule, and Performance Goals. GAO-18-158. 

Washington, D.C.: December 21, 2017.

Global Positioning System: Better Planning and Coordination Needed to 

Improve Prospects for Fielding Modernized Capabilities. GAO-18-74. 

Washington, D.C.: December 12, 2017.

Defense Science and Technology: Adopting Best Practices Can Improve 

Innovation Investments and Management. GAO-17-499. Washington, 

D.C.: June 29, 2017.

Ford-Class Aircraft Carrier: Follow-On Ships Need More Frequent and 

Accurate Cost Estimates to Avoid Pitfalls of Lead Ship. GAO-17-575. 

Washington, D.C.: June 13, 2017.
DOD Financial Management

Page 147 GAO-19-157SP High-Risk Series 

The Department of Defense (DOD) needs to assure that leaders across the department continue to improve 

their efforts to address long-standing financial management problems. 

Since our previous High-Risk 

Report, progress has been made 

to meet the criterion of leadership 

commitment and partially meet the 

criterion for monitoring. The other 

three criteria remain unchanged.

Leadership commitment: met. In 

2018, DOD leadership met the goal 

of undergoing the first agency-wide 

financial statement audit and 

established a process to remediate 

any audit findings—ultimately to 

improve the quality of financial 

information that is most valuable in 

managing the department’s day-today operations. The audit effort aligns with the department’s new national 

defense strategy which includes a priority to reform the department’s 

business practices. DOD’s fiscal year 2018 financial statement audit 

resulted in a disclaimer of opinion—the auditors were unable to express 

an opinion due to insufficient evidence. That said, according to a DOD 

official, audit remediation efforts have produced benefits in certain 

inventory processes that have led to operational improvements. We 

support DOD’s efforts to improve its financial management and will 

continue to oversee and monitor the financial statement audit results and 

provide constructive input through recommendations related to 

remediation efforts.

DOD leadership also demonstrated its commitment to make needed 

improvements by developing a database that tracks hundreds of findings 

and recommendations that came out of the audit. In addition, senior 

leadership has been meeting bimonthly with military services’ leadership 

for updates on the status of corrective action plans to address audit 

findings and recommendations, and the Under Secretary of Defense 

(Comptroller) has been meeting frequently with the Secretary of Defense 

to review the plans. As a result of these actions, this criterion has moved 

from partially met in 2017 to met in 2019.

Capacity: partially met. According to DOD Office of Inspector General 

(OIG) ineffective information technology systems’ controls hinder DOD’s 

ability to produce accurate, timely, and reliable financial information. 

DOD’s auditors issued more than 1,100 systems-related findings and 

recommendations during the fiscal year 2018 financial statement audit 

DOD Financial Management

Why Area Is High Risk

DOD’s financial management continues 

to face long-standing issues—including 

its decentralized environment; cultural 

resistance to change; lack of skilled 

financial management staff; ineffective 

processes, systems, and controls; 

incomplete corrective action plans; and 

the need for more effective monitoring 

and reporting. 

DOD financial management was first 

added to our High-Risk List in 1995. 

DOD remains one of the few federal 

entities that cannot accurately account 

for and report on its spending or assets. 

DOD’s discretionary spending makes up 

about half of the federal government’s 

discretionary spending, and its assets 

represent more than 70 percent of the 

federal government’s physical assets. 

Sound financial management practices 

and reliable, useful, and timely financial 

and performance information would help 

ensure DOD’s accountability over its 

extensive resources and more efficient 

management of its assets and budgets. 

Contact Information

For additional information about this 

high-risk area, contact Asif Khan, (202) 

512-9869, khana@gao.gov. 
DOD Financial Management

Page 148 GAO-19-157SP High-Risk Series 

and the DOD OIG has reported multiple material financial systems that do 

not comply with federal systems requirements. These weaknesses pose a 

significant risk to DOD operations and could, for example, result in 

payments and collections being lost, stolen, or duplicated. They may also 

open the department up to other cyber threats across different networks 

and systems. 

To conduct audits and support remediation of findings, DOD allocated the 

resources to complete its fiscal year 2018 financial statement audit, 

undergo a 2019 audit, and initiate related remediation efforts. These 

audits are expected to help guide DOD’s overall efforts to improve its 

financial information which is needed to support operational readiness. 

For example, the Navy expanded its use of automatic data feeds to 

prepare for the audit and improve its efficiency and operations. As a 

result, the Navy has avoided $65 million of charges for service provider

support that manual data entry would have required. 

Action plan: partially met. In the past several years, the Army, Navy, 

and Air Force have all undergone numerous audits, and have developed 

corrective action plans in varying detail to address some of their audit 

findings. DOD developed a centralized database to summarize 

information about the audit findings, recommendations, and related 

corrective action plans. The Financial Improvement and Audit 

Remediation (FIAR) directorate plans to use this information to describe 

specific actions that DOD plans to take to address audit findings. 

Audit remediation efforts have already provided some operational 

benefits. For example, according to a DOD official, during an initial audit, 

the Army found 39 Blackhawk helicopters that had not been recorded in 

the property system. Similarly, the Air Force identified 478 buildings and 

structures at 12 installations that were not in the real property systems. 

These benefits demonstrate how the department is leveraging audit 

findings to support the National Defense Strategy effort to reform 

business practices for greater performance and affordability. 

That said, hundreds of the same problems were identified again in the 

fiscal year 2018 audits, and hundreds of the same recommendations 

were re-issued. In addition, the military services have been addressing 

deficiencies in how they remediate audit findings and recommendations. 

However, the Army and Air Force continued to have deficiencies in how 

they identify, track, and prioritize financial management-related findings 

and recommendations, and develop and monitor the status of corrective 

action plans. 

Monitoring: partially met. DOD’s centralized database will be used to 

capture, prioritize, and assign responsibility for auditor findings and the 

related corrective action plans—used to measure progress towards 

achieving a clean audit opinion. A clean or unmodified opinion is the 
DOD Financial Management

Page 149 GAO-19-157SP High-Risk Series 

opinion expressed by the auditor when the auditor concludes that the 

financial statements are presented fairly, in all material respects, in 

accordance with the applicable financial reporting framework. DOD 

expects the database to improve its oversight and monitoring of pervasive 

deficiencies as well as their related remediation efforts. However, 

because the database is still being populated with findings and 

recommendations, it is too early to assess whether DOD will be able to 

successfully prioritize the findings and related corrective action plans, and 

report information to stakeholders. 

In addition, DOD leadership has held frequent meetings to discuss the 

status of corrective action plans. DOD also established councils in certain 

areas (e.g., financial reporting) to review the status of audit remediation 

activities and challenges. The DOD OIG reported that corrective action 

plans have not been developed for all long-standing material 

weaknesses. Without such plans to monitor and measure progress, these 

long-standing material weaknesses may continue to affect DOD’s ability 

to improve its financial management and get to a clean audit opinion. 

Demonstrated progress: not met. The DOD OIG’s disclaimer of opinion 

on DOD’s fiscal year 2018 financial statement was partially based on the 

disclaimers of opinion for the Army, Navy, Air Force, U.S. Marine Corps, 

Defense Health Program, Defense Logistics Agency, U.S. Transportation 

Command, and U.S. Special Operations Command. The DOD OIG also 

reported 20 material weaknesses in internal control across the 

department, contributing to its disclaimer of opinion. Some of these—such 

as an inability to account for its property and equipment—are examples of 

long-standing weaknesses that DOD has been unable to address.

In addition, the DOD OIG reported on several findings and 

recommendations regarding inventory and related property that could 

have operational impacts for DOD. For example, the auditor found:

• 107 rotor blades for Blackhawk helicopters that could not be used but 

remained on the inventory records,

• 24 Gyro Electronics for military aircraft that should not be used but 

remained in the inventory records,

• 20 fuel injector assemblies for Blackhawk helicopters did not have 

supporting documentation to demonstrate which military service owned 

them.

The results of prior audits and examinations further show the extent and 

complexity of improvements needed to provide reliable information for 

financial reporting and operational readiness. For example, DOD has 

multiple material financial management systems that do not comply with 

federal systems requirements. Further complicating this issue, DOD lacks 

internal controls over many of its financial systems which hinders its 
DOD Financial Management

Page 150 GAO-19-157SP High-Risk Series 

ability to generate accurate, reliable, and timely financial and performance 

information. 

However, DOD has seen some early signs of progress. For example, in 

preparing for and undergoing its first financial statement audit, Navy’s 

Commander, U.S. Pacific Fleet, strengthened internal controls to improve 

its operations. The initiative strengthened internal controls that resulted in 

freeing up purchasing power to fund $4.4 million in ship repair costs.

Further, DOD reports that Army successfully implemented a materialitybased physical inventory best practice to Army depot asset counts. This 

process improvement ensures a more accurate inventory count and Army 

avoids approximately $10 million of future cost annually.

Over the years, since we added this area to our High-Risk List, we have 

made numerous recommendations related to this issue, 9 of which were 

made since the last high-risk update in February 2017. As of December 

2018, 53 recommendations are open. To address its complex array of 

financial management challenges, DOD needs to take action in all areas 

of concern, such as: 

• DOD should continue to develop and deploy enterprise resource planning 

systems with appropriate functionality as a critical component of DOD’s 

financial improvement. In addition, DOD should make changes to the 

remaining legacy systems to satisfy audit requirements and improve data 

used for day-to-day decision making.

• DOD needs to continue building a workforce with the level of training and 

experience needed to support and sustain sound financial management. 

• Army and Air Force should continue to follow the steps in OMB’s 

guidance for addressing financial management related findings and 

recommendations reported by external auditors, including steps to 

identify, prioritize, and track them; develop effective action plans to 

remediate them; and monitor the implementation status of the plans. 

• DOD leadership needs to work on its centralized monitoring and reporting 

process by populating the database with all of the open financial 

management related findings and recommendations as well as their 

associated corrective action plans, and to prioritize them and track their 

completion. 

• DOD will also need to continue to ensure that it has corrective action 

plans to address all of its material weaknesses. 

Foreign Military Sales: Financial Oversight of the Use of Overhead Funds 

Needs Strengthening. GAO-18-553. Washington, D.C.: July 30, 2018.

What Remains to Be Done

Related GAO 

Products
DOD Financial Management

Page 151 GAO-19-157SP High-Risk Series 

DOD Financial Management: The Navy Needs to Improve Internal 

Control over Its Buildings. GAO-18-289. Washington, D.C.: May 10, 2018.

DOD Financial Management: Additional Actions Needed to Complete the 

Army’s Analyses of Unsupported Accounting Entries for Its General Fund. 

GAO-18-27. Washington, D.C.: October 20, 2017.

DOD Financial Management: Significant Efforts Still Needed for 

Remediating Audit Readiness Deficiencies. GAO-17-85. Washington, 

D.C.: February 9, 2017.
DOD Business Systems Modernization

Page 152 GAO-19-157SP High-Risk Series 

The Department of Defense (DOD) needs to improve management of its business system acquisitions, 

improve management of its portfolio of business system investments, and leverage its federated business 

enterprise architecture to identify and address potential duplication and overlap across systems.

Since our 2017 High-Risk Report, 

DOD has made improvements in 

this high-risk area by moving from 

a not met rating on the action plan 

criterion to a partially met rating. 

The department accomplished this 

by developing a plan for making 

improvements to its business 

enterprise architecture. However, 

DOD lacks a plan to address both 

the business system acquisition 

management and investment 

management process segments of 

this high-risk area. 

Our assessment of the leadership, 

capacity, monitoring, and demonstrated progress criteria remains partially 

met. 

DOD’s Business System Acquisition 

Management

Ratings for this segment of the high-risk 

area remain unchanged since our 

previous High-Risk Report in 2017, with 

DOD partially meeting three criteria 

elements and not meeting the remaining 

two.

Leadership commitment: partially met.

Since our 2017 High-Risk Report, DOD 

has developed updated policy and 

guidance for managing business system 

investments that reflects changes called 

for by the National Defense Authorization 

Act for Fiscal Year 2016. 

In addition, DOD’s April 2018 National Defense Business Operations Plan 

included a commitment that it would establish quantifiable measures for 

improvements to the business system environment by the end of fiscal 

year 2018, but DOD did not demonstrate that it established such metrics 

as planned. DOD has also faced frequent turnover in leadership positions 

associated with managing its business system investments and has not 

DOD Business Systems Modernization

Why Area Is High Risk

DOD spends billions of dollars each year 

to acquire modernized systems, 

including ones that address key areas 

such as personnel, financial 

management, health care, and logistics. 

While DOD’s capacity for modernizing its 

business systems has improved over 

time, significant challenges remain. We 

first added this area to our High-Risk List 

in 1995.

This high-risk area includes three critical 

challenges facing DOD: (1) improving 

business system acquisition 

management, (2) improving business 

system investment management, and (3) 

leveraging DOD’s federated business 

enterprise architecture.

Improving business system acquisition 

management would contribute to better 

cost, schedule, and performance 

outcomes for DOD systems. Improving 

business system investment 

management would allow DOD to more 

effectively and efficiently manage its 

portfolios of business system 

investments. Enhanced use of its 

federated business enterprise 

architecture would help DOD identify and 

address potential duplication and overlap 

across its business systems 

environment.

Contact Information

For additional information about this 

high-risk area, contact Carol C. Harris at 

(202) 512-4456 or harriscc@gao.gov. 
DOD Business Systems Modernization

Page 153 GAO-19-157SP High-Risk Series 

yet demonstrated how it intends to implement legislative provisions 

designating the chief management officer (CMO) as the chief information 

officer (CIO) for all DOD business systems. Regarding the legislative 

provisions, in November 2018, the acting CMO stated that she has a 

collaborative relationship with the DOD CIO and they are working to 

define their respective responsibilities. 

Capacity: not met. The Office of the CMO, which establishes policy and 

guidance for business system investments and oversees a subset of 

business system investments, has not demonstrated that it has 

conducted a human capital analysis, as we recommended in May 2013. 

In addition, the Office of the CMO does not have a plan to analyze and 

address skill gaps, thus limiting its capacity to lead improvement 

initiatives in these areas. 

In August 2018, we reported that the DOD CIO had only partially 

addressed roles and responsibilities associated with its information 

technology (IT) workforce, such as (1) annually assessing the extent to 

which DOD personnel meet IT management knowledge and skill 

requirements, and (2) developing strategies for hiring and training to 

rectify any knowledge and skill deficiencies.

Action plan: not met. DOD continues to lack a plan that includes specific 

actions and associated milestones to address what remains to be done 

for this segment of the high-risk area. As a result, DOD does not have a 

common baseline to document DOD-wide commitments and their 

associated timeframes.

Monitoring: partially met. DOD has begun to leverage the federal IT 

Dashboard to document progress in improving its business system 

acquisition outcomes. However, without an approved action plan for 

addressing gaps described in this segment of the high-risk area, DOD 

lacks the means to monitor broader progress in making improvements to 

its business system acquisition management efforts.

Demonstrated progress: partially met. Since our 2017 High-Risk 

Report, DOD has had mixed success in delivering business system 

investments that meet cost, schedule, and performance commitments. 

For example, we reported in May 2018 that the Global Combat Support 

System–Army met all six of its performance targets but was delayed by 

10 months. We also reported that the Defense Enterprise Accounting and 

Management System Increment 1 met three out of four performance 

targets but increased in cost by 60 percent. 

In addition, DOD has made progress in addressing certain of our 

recommendations associated with making improvements in this area. For 

example, since February 2017, DOD has implemented recommendations 

aimed at addressing best practices in risk management, project 
DOD Business Systems Modernization

Page 154 GAO-19-157SP High-Risk Series 

monitoring, and IT acquisition for a subset of its business system 

investments. DOD has also made progress in addressing 

recommendations associated with implementing incremental 

development. 

However, DOD still needs to address our long-standing recommendations 

associated with the establishment of timelines and issue monitoring that 

impact efficient and effective use of other specific systems, and another 

recommendation aimed at making further improvements associated with 

its use of incremental development.

DOD needs to take various steps, including:

• developing an action plan for addressing this high-risk area;

• following through with its commitment to develop measures to 

demonstrate improvements in its business systems environment;

• demonstrating improved success in meeting business system cost, 

schedule, and performance expectations; and

• addressing our various open recommendations associated with this highrisk area, including recommendations aimed at improving human capital 

management, CIO oversight of IT, incremental development, and 

recommendations associated with specific business systems. 

Ratings for this segment remain 

unchanged since our 2017 High-Risk 

Report, with DOD partially meeting three 

criteria and not meeting the remaining two.

Leadership commitment: partially met. 

DOD has made progress complying with 

legislative provisions for managing 

business system investments in the 

National Defense Authorization Act for 

Fiscal Year 2016, but more remains to be 

done. 

In addition, DOD has faced frequent turnover in leadership positions 

associated with managing its business system investments, and it has not 

yet demonstrated how it intends to implement legislative provisions 

designating the CMO as the CIO for all DOD business systems.

Capacity: partially met. DOD has established an investment review 

board and guidance for overseeing its largest business system 

investments. However, as we reported in April 2018, required guidance 

has yet to be developed at all levels throughout the agency. In addition, 

What Remains to Be Done

DOD’s Business 

System Investment 

Management Process
DOD Business Systems Modernization

Page 155 GAO-19-157SP High-Risk Series 

the Office of the CMO has not demonstrated that it has conducted a 

human capital analysis as we recommended in May 2013, and does not 

have a plan to analyze and address skill gaps. 

Action plan: not met. DOD continues to lack a plan with specific actions 

and associated milestones to address what remains to be done for this 

segment of the high-risk area. As a result, DOD does not have a common 

baseline to document DOD-wide commitments and their associated 

timeframes.

Monitoring: not met. Without an approved action plan for addressing 

this segment of the high-risk area, DOD lacks a means to monitor 

progress in making improvements to its business system investment 

management process.

Demonstrated progress: partially met. Since our 2017 High-Risk 

Report, DOD has taken steps to improve its business system investment 

management process by addressing some associated recommendations. 

For example, DOD has defined criteria for reviewing defense business 

systems at an appropriate level based on factors such as cost and risk, in 

support of the business system certification and approval process. 

However, DOD needs to show continued progress in addressing our 

remaining associated recommendations, such as developing improved 

investment management guidance and functional strategies, including 

measurable targets over the next 3 to 5 years.

DOD should implement our recommendations on improving its business 

system investment management efforts, including:

• taking a strategic approach to human capital management for the Office 

of the CMO,

• improving investment management policy and guidance at all levels of 

the organization, and 

• ensuring that functional strategies include all of the critical elements 

identified in DOD investment management guidance. 

Ratings for this segment have improved for 

two of the five high-risk criteria elements 

since our 2017 High-Risk Report. 

Leadership commitment: partially met.

Since our 2017 High-Risk Report, DOD’s 

assistant deputy CMO approved an 

improvement plan for DOD’s business 

enterprise architecture (i.e., description of 

DOD’s current and future business 

What Remains to Be Done

DOD’s Federated 

Business Enterprise 

Architecture
DOD Business Systems Modernization

Page 156 GAO-19-157SP High-Risk Series 

environment and plans for transitioning to the future environment).This 

plan is intended to improve DOD’s ability to achieve architecture-related 

outcomes, including identifying and reusing existing systems across the 

department. The plan demonstrates that DOD leadership is committed to 

making needed improvements. However, DOD has faced frequent 

turnover in leadership positions associated with managing its business 

system investments, and has not yet demonstrated how it will implement 

legislative provisions designating the CMO as the CIO for all DOD 

business systems. 

Capacity: met. As reported in our 2017 High-Risk Report, DOD has met 

the criterion for capacity. In particular, it has established tools and 

processes that are intended to improve its efforts to identify potentially 

duplicative systems.

Action plan: partially met. DOD has developed a project plan for how it 

will make improvements to its business enterprise architecture. However, 

it has not revised its plan to reflect updated milestones.

Monitoring: partially met. DOD has developed a plan for making 

needed improvements to its business enterprise architecture and receives 

monthly contractor status reports. However, monthly reports do not 

discuss progress relative to the plan and the plan has not been revised to 

reflect updated milestones.

Demonstrated progress: partially met. DOD has established the 

capacity to identify potentially duplicative investments and has developed 

a plan to further improve its capacity. DOD has also provided examples of 

benefits attributed, at least in part, to its business enterprise architecture. 

Nevertheless, DOD has not yet demonstrated that it is actively and 

consistently using assessments of potential duplication and overlap to 

eliminate duplicative systems. DOD’s business architecture improvement 

plan acknowledges this gap and identifies steps it intends to take to 

improve its ability to use the business enterprise architecture to achieve 

its intended goals.

Over the years since we added this area to our High-Risk List, we have 

made numerous recommendations related to this high-risk issue, 10 of 

which were made since the last high-risk update in February 2017. As of 

December 2018, 27 recommendations are open. DOD needs to continue 

to execute its plan for making needed improvements to its business 

enterprise architecture and demonstrate that it is actively and consistently 

using assessments of potential duplication and overlap to identify and 

eliminate duplicative systems.

What Remains to be Done
DOD Business Systems Modernization

Page 157 GAO-19-157SP High-Risk Series 

Federal Chief Information Officers: Critical Actions Needed to Address 

Shortcomings and Challenges in Implementing Responsibilities. 

GAO-18-93. Washington, D.C.: August 2, 2018.

Defense Management: DOD Senior Leadership Has Not Fully 

Implemented Statutory Requirements to Promote Department-Wide 

Collaboration. GAO-18-513. Washington, D.C.: June 25, 2018.

DOD Major Automated Information Systems: Adherence to Best Practices 

Is Needed to Better Manage and Oversee Business Programs. 

GAO-18-326. Washington, D.C.: May 24, 2018.

Defense Business Systems: DOD Needs to Continue Improving 

Guidance and Plans for Effectively Managing Investments. GAO-18-130. 

Washington, D.C.: April 16, 2018.

DOD Major Automated Information Systems: Improvements Can Be 

Made in Applying Leading Practices for Managing Risk and Testing. 

GAO-17-322. Washington, D.C.: March 30, 2017. 

Related GAO 

Products
DOD Support Infrastructure Management

Page 158 GAO-19-157SP High-Risk Series 

The Department of Defense (DOD) needs to better align its infrastructure capacity with its force structure 

needs and achieve efficiencies by reducing both excess infrastructure and base support costs, and maximizing 

the use of its underutilized facilities.

Since our 2017 High-Risk Report, 

DOD has made progress in two 

areas: meeting the criteria of 

leadership commitment and action 

plan. Our assessment of the other 

three criteria remains unchanged.

Leadership commitment: met. 

DOD has demonstrated leadership 

commitment by (1) agreeing to 

improve certain cost estimating 

processes in future Base 

Realignment and Closure (BRAC) 

rounds by implementing, for 

example, our recommendation to 

better forecast initial BRAC costs 

for military construction; (2) committing to improve its excess capacity 

estimating method by implementing, for example, our recommendation to 

use reasonable assumptions in estimating excess capacity; (3) pursuing 

an effort to relocate from costly commercial leased space to nearby 

installations when possible; and (4) highlighting its need to dispose of 

unneeded infrastructure by requesting and completing BRAC rounds. As 

a result, the rating for the leadership commitment criteria for this high-risk 

area has improved from partially met in 2017 to met. 

Between 2013 and 2017, DOD requested BRAC rounds to address 

excess capacity, which Congress did not authorize. DOD did not request 

a BRAC round in 2018. However, in the John S. McCain National 

Defense Authorization Act for Fiscal Year 2019, Congress provided DOD 

with additional authority to realign or close certain military installations if 

the governor of the relevant state or entity (including the District of 

Columbia, Puerto Rico, and Guam) recommends that the Secretary carry 

out the military installation’s realignment or closure. This authority 

includes several requirements, including statements of support for the 

realignment or closure from the local government, a plan for reuse, and a 

cost cap of $2.0 billion. DOD also has authority to close or realign 

installations under other circumstances, subject to certain civilian 

personnel thresholds and other statutory requirements. It will be important 

for DOD and Congress to work together to determine infrastructure needs 

in light of any force structure changes and to take action to dispose of 

excess infrastructure, as appropriate. 

DOD Support Infrastructure Management

Why Area Is High Risk

DOD manages a portfolio of real 

property assets that, as of fiscal year 

2017, reportedly included about 586,000 

facilities—including barracks, 

maintenance depots, commissaries, and 

office buildings. The combined 

replacement value of this portfolio is 

almost $1.2 trillion and includes about 27 

million acres of land at nearly 4,800 sites 

worldwide. This infrastructure is critical to 

maintaining military readiness, and the 

cost to build and maintain it represents a 

significant financial commitment.

Since designating this area as high-risk 

in 1997, we have reported on various 

long-term challenges DOD faces in 

managing its infrastructure. Specifically, 

DOD has experienced obstacles 

reducing excess infrastructure, more 

efficiently using underutilized facilities, 

and reducing base support costs. 

DOD has used the BRAC process 

primarily to reduce excess infrastructure, 

readjust bases to accommodate changes 

in the size and structure of DOD’s forces, 

and produce cost savings. Since 1988, 

Congress has authorized five BRAC 

rounds, most recently in 2005. Based on 

our analysis of the 2005 BRAC round, 

we found that opportunities exist for 

DOD and the Congress to improve future 

BRAC rounds. 

Contact Information

For additional information about this 

high-risk area, contact Brian J. Lepore at 

202-512-4523 or leporeb@gao.gov. 
DOD Support Infrastructure Management

Page 159 GAO-19-157SP High-Risk Series 

DOD officials have also stated that they intend to address key 

recommendations we have made by, for example, (1) better forecasting 

the initial BRAC costs for military construction, information technology, 

and relocating military personnel and equipment; (2) better aligning 

infrastructure to DOD force structure needs by, for example, improving 

the accuracy and sufficiency of its excess capacity estimates; and (3) 

pursuing an effort to consolidate and standardize leases, which includes 

analyzing whether it is feasible to relocate functions from commercial 

leased space to existing space on an installation, thereby reducing leases 

and better utilizing excess space.

As the responsibilities of the Assistant Secretary of Defense for Energy, 

Installations, and Environment are transferred to the recently established 

Assistant Secretary of Defense for Sustainment, it will be important for 

DOD to maintain its leadership commitment to aligning support 

infrastructure with the needs of its forces and achieving efficiencies.

Capacity: partially met. In 2017, we reported that DOD had 

demonstrated its capacity to align infrastructure with DOD force structure 

needs by disposing of excess infrastructure during past BRAC rounds 

and by consolidating some installation services at joint bases, among 

other efforts. However, we also reported that DOD needed to improve the 

accuracy of its real property data, including data on the utilization rates of 

its facilities. 

In November 2018, we reported that DOD’s Real Property Assets 

Database contained inaccurate data and lacked completeness, although 

certain data that we reviewed had improved in accuracy. We found that 

the percentage of DOD facilities with missing utilization data improved in 

fiscal year 2016 (14.4 percent) compared to fiscal year 2014 (23.3 

percent). However, DOD continues to be missing utilization data for about 

93,600 facilities. To address incomplete and inaccurate data in DOD’s 

database, we recommended that the department fully monitor its data 

recording processes, develop and implement corrective actions for 

identified data discrepancies, and develop a strategy to address risk 

associated with data quality. DOD generally concurred with these 

recommendations and identified a series of steps the department would 

take to implement them. 

Action plan: met. We reported in 2017 that DOD had developed plans, 

such as its Real Property Efficiency Plan, to better identify excess 

infrastructure and thus be positioned to dispose of it. This plan includes 

DOD’s goals for reducing the footprint of its real property inventory and 

metrics to gauge progress. The plan is scheduled to be implemented by 

the end of 2020. However, in 2018, the reduction numbers targeted for 

DOD under the Office of Management and Budget’s Reduce the Footprint 

Strategy could not be calculated because, according to Performance.gov 

(which tracks the goals and objectives of the President’s Management 
DOD Support Infrastructure Management

Page 160 GAO-19-157SP High-Risk Series 

Agenda), the data that DOD submitted was not of sufficient accuracy to 

support the calculation of its Reduce the Footprint portfolio relative to its 

baseline. 

In October 2018, we reported that DOD had begun using 

intergovernmental support agreements between military installations and 

local governments to obtain installation services, such as waste removal, 

grounds maintenance, and stray animal control. In our 2018 analysis of a 

sample of these agreements, we found that DOD was achieving cost 

savings and cost avoidances. DOD agreed to monitor whether 

installations are evaluating opportunities to use these agreements, stating 

that the military services will update their policies and procedures to 

include a process for conducting such monitoring. 

In June 2017, DOD also directed the joint bases to stop using the higher 

cost joint base common standards for installation services and instead 

use the standards of the military service in charge of providing services at 

any given joint base. In March 2009, we had reported that joint base costs 

were likely to increase because the services had not routinely funded 

installation support at amounts needed to meet joint base common 

standards. Since DOD directed the joint bases to stop using common 

standards, these expected increased costs are less likely to occur. As a 

result these actions, the rating for the action plan criteria for this high-risk 

area has improved from partially met in 2017 to met. 

Monitoring: partially met. We reported in 2017 that DOD had committed 

to improve its monitoring of any future BRAC rounds and had 

demonstrated some ability to monitor its efforts to achieve reductions and 

efficiencies in infrastructure. In May 2018, we reported that DOD needed 

to improve the accuracy of its excess capacity estimates. In response, the 

department agreed to update the baseline used for such estimates; 

clearly lay out any assumptions used and their rationale; and update 

guidance, definitions, and implementing instructions and apply them in a 

manner that ensures consistency, but with necessary flexibility.

We also reported in November 2018 that DOD still does not have fully 

reliable data in its Real Property Assets Database to effectively monitor 

its property needed for informed management decision-making. For 

example, we found that over 22 percent of DOD’s facilities (about 

125,000 facilities) did not have a physical inspection date in the last 5 

years, as required for properties not designated as historic. 

Additionally, DOD has not yet committed to implementing some related

prior recommendations for any future BRAC rounds. For example, DOD 

has not agreed to limit the practice of bundling multiple stand-alone 

realignments or closures into single BRAC recommendations. We 

reported in 2013 that such bundling did not itemize the costs and savings 

associated with each separate major action within the bundle, and thus 
DOD Support Infrastructure Management

Page 161 GAO-19-157SP High-Risk Series 

limited the visibility into the estimated costs and savings for individual 

closures and realignments. 

Demonstrated progress: partially met. DOD has demonstrated some 

progress in aligning its infrastructure to its force structure needs by 

reducing excess infrastructure through five BRAC rounds between 1988 

and 2005, and by disposing of and demolishing excess facilities. DOD 

has also begun taking other actions that could demonstrate progress in 

more efficiently using underutilized facilities and reducing base support 

costs. For example, as of March 2017, DOD and the General Services 

Administration had begun sharing information about the potential use of 

available space on DOD installations by other federal agencies. 

Additionally, in December 2017, a DOD official told us that the 

department had begun reviewing opportunities to relocate DOD 

organizations currently in commercial leased space to nearby installations 

with available space, thereby ending lease payments by the tenant 

organizations. Finally, DOD has started to reduce some installation 

support costs by using intergovernmental support agreements to obtain 

installation services from local governments at lower costs.

However, DOD’s ability to demonstrate further progress continues to be 

challenged by unreliable real property data, as we reported in November 

2018. For example, as of fiscal year 2016, nearly half of the facilities that 

have been identified as excess in DOD’s Real Property Assets Database 

do not have a date for when that determination was made, and thus their 

status cannot be verified as accurate. 

Additionally, we found facilities that existed but were not recorded in the 

military services’ data systems, as well as disposed facilities that no 

longer existed but were still reflected as active in the database. DOD has 

also not committed to setting targets for eliminating excess capacity in 

any future BRAC rounds, which would help DOD measure its reduction of 

excess infrastructure. As DOD examines and adjusts its force structure, it 

is important that DOD also assess how its infrastructure capacity aligns 

with its infrastructure needs, and work with Congress, as needed, to 

reduce any excess infrastructure.

Over the years since we added this area to the High-Risk List, we have 

made numerous recommendations related to this high-risk issue, 17 of 

which were made since the last high-risk update in February 2017. As of 

December 2018, 23 recommendations are open. 

DOD needs to:

• fully identify the cost requirements for military construction, information 

technology, relocating personnel and equipment, and alternatively 

financed projects for any future BRAC round;

What Remains to Be Done
DOD Support Infrastructure Management

Page 162 GAO-19-157SP High-Risk Series 

• limit the practice of bundling multiple stand-alone BRAC realignments or 

closures into single recommendations; 

• establish targets for eliminating excess capacity for any future BRAC;

• improve the accuracy of its excess capacity estimates by reliably 

updating the baseline for estimating excess infrastructure capacity, using 

reasonable assumptions in estimating excess capacity, and developing 

guidance to improve its analysis and ensure consistency;

• implement processes for monitoring the benefits from intergovernmental 

support agreements and whether installations are evaluating 

opportunities to use those agreements; and

• improve the accuracy and completeness of its real property data by fully 

monitoring its processes for recording all required real property 

information, developing and implementing corrective actions for identified 

data discrepancies, and developing a strategy to address risks 

associated with data quality and information accessibility.

DOD should continue to assess its infrastructure needs in light of ongoing 

changes in DOD force structure (including military service personnel 

numbers) and work with Congress, as needed, to reduce any excess 

infrastructure. 

If Congress were to authorize additional BRAC rounds, we have 

suggested that it consider amending BRAC legislation to require the 

Secretary of Defense to formally establish specific goals for a BRAC 

process. Congress may also want to consider requiring DOD to 

implement all our applicable recommendations related to BRAC.

We have also suggested that Congress consider directing DOD to 

evaluate the purpose of the joint basing program to help ensure it 

achieves its goals and leverages additional opportunities to reduce 

duplication of effort.

Defense Real Property: DOD Needs to Take Additional Actions to 

Improve Management of Its Inventory Data. GAO-19-73. Washington, 

D.C.: November 13, 2018.

DOD Installation Services: Use of Intergovernmental Support Agreements 

Has Had Benefits, but Additional Information Would Inform Expansion. 

GAO-19-4. Washington, D.C.: October 23, 2018.

Defense Infrastructure: DOD Needs to Improve the Accuracy of Its 

Excess Capacity Estimates. GAO-18-230. Washington, D.C.: May 24, 

2018.

Military Bases: Opportunities Exist to Improve Future Base Realignment 

and Closure Rounds. GAO-13-149. Washington, D.C.: March 7, 2013.

Congressional Actions Needed

Related GAO 

Products
DOD Approach to Business Transformation

Page 163 GAO-19-157SP High-Risk Series 

The Department of Defense (DOD) should accurately track efficiencies gained and costs reduced as it 

transforms its business functions through a transition to shared services and other efficiency initiatives.

Since our 2017 High-Risk Report, 

DOD has met the action plan 

criteria. Ratings for the leadership 

commitment, monitoring, and

demonstrated progress criteria 

are unchanged at partially met, 

and the rating for capacity 

declined to partially met.

Leadership commitment: 

partially met. In February 2017, 

the Secretary of Defense 

announced that DOD would 

undertake an effort to identify

business services and tasks that 

no longer merit individual military 

department approaches. In 

January 2018, DOD issued its National Defense Strategy, which included 

reforming the department’s business practices for greater performance 

and affordability. DOD has taken steps to achieve efficiencies in its 

business services and to implement certain statutory requirements in the 

National Defense Authorization Acts (NDAA) for Fiscal Years 2017 

through 2019. However, as we discuss in more detail below, the structure 

and processes and the involvement of a key leader on DOD’s Reform 

Management Group (RMG) have changed and remain unclear. 

Additionally, with the resignation of the Chief Management Officer (CMO), 

the Deputy Chief Management Officer (DCMO) assumed the role of the 

Acting CMO in December 2018. Given the importance of the CMO to 

achieving business reform, these developments raise concerns about the 

extent to which the department will be successful in its approach to 

business transformation. 

Congress included a provision in the National Defense Authorization Act 

for Fiscal Year 2018 to create a CMO position that is distinct from the 

Deputy Secretary of Defense, eliminated the position of DCMO and 

provides a number of key responsibilities set forth in section 132a of title 

10 of the U.S. Code. In February 2018, the Secretary of Defense 

implemented the statutory provision to establish the CMO position and 

disestablished the position of DCMO. Among other responsibilities, the 

CMO is responsible for (1) managing DOD’s enterprise business 

operations and shared services and (2) directing the secretaries of the 

military departments, and the defense agencies and field activities 

DOD Approach to Business Transformation

Why Area Is High Risk

DOD spends billions of dollars each year 

to maintain key business operations 

intended to support the warfighter, 

including systems and processes related 

to the management of contracts, 

finances, the supply chain, support 

infrastructure, and weapon systems 

acquisition. Weaknesses in these areas 

adversely affect DOD’s efficiency and 

effectiveness, and render its operations 

vulnerable to waste, fraud, and abuse. 

DOD’s approach to transforming these 

business operations is linked to DOD’s 

ability to perform its overall mission, 

directly affecting the readiness and 

capabilities of U.S. military forces.

We added DOD’s overall approach to 

managing business transformation as a 

high-risk area in 2005 because DOD had 

not taken the necessary steps to achieve 

and sustain business reform on a broad, 

strategic, department-wide, and 

integrated basis. Further, DOD’s 

historical approach to business 

transformation has not proven effective 

in achieving meaningful and sustainable 

progress in a timely manner. Also, DOD 

did not have an integrated plan for 

business transformation with specific 

goals, measures, and accountability 

mechanisms to monitor progress and 

achieve improvements.

Contact Information

For additional information about this 

high-risk area, contact Elizabeth Field at 

202-512-2775 or fielde1@gao.gov. 
DOD Approach to Business Transformation

Page 164 GAO-19-157SP High-Risk Series 

(DAFAs) that provide shared business services for the department or with 

regard to other matters for which the CMO is responsible. 

In February 2017, the Secretary of Defense also issued a memorandum 

tasking the Deputy Secretary of Defense with leading an effort to identify 

business services and tasks that no longer merit individual military

department approaches. In May 2018, DOD issued its National Defense 

Business Operations Plan, outlining the department's strategic goals and 

objectives for improving performance and reforming business operations. 

These actions demonstrate a leadership commitment to business 

transformation. However, it will be important for the department to sustain 

its focus on this effort at the highest levels. In April 2005, we testified on 

the importance of a full-time leadership position at the right level 

dedicated to the planning, integration, and execution of business 

transformation efforts. The longer this critical position is filled by someone 

in an acting capacity, the greater the risk that DOD’s transformation 

efforts could be impacted. 

Capacity: partially met. We have downgraded the capacity criterion from 

met in 2017 to partially met in 2019. In 2017, we reported that the DCMO 

had taken several steps to improve its capacity to monitor DOD’s 

business transformation efforts, including conducting a business process 

and systems review. However, with the planned establishment of the 

CMO position in February 2018, we reported that it would be critical that 

the Office of the CMO (OCMO) have the personnel and other resources 

needed to fulfill its significant responsibilities. While DOD has since 

established the OCMO and taken some steps to build its capacity, such 

as hiring a new Chief Data Officer and establishing plans to restructure 

the OCMO around its enhanced responsibilities, the OCMO may not yet 

have the capacity to perform certain key functions. For example, section 

921 of the John S. McCain NDAA for Fiscal Year 2019 requires the CMO 

to review the budgets of certain defense agencies and field activities, 

beginning in fiscal year 2020. OCMO officials told us they are working to 

develop a process for this review and to determine which DAFAs would 

be subject to the review. Until the OCMO has developed the process and 

determined how many DAFA budgets the review will include, it will not 

know what, if any, resource implications this requirement has for the 

office. 

Data show that DOD’s budget request for OCMO has declined from fiscal 

year 2017 to fiscal year 2019. At the same time, the CMO’s authorities 

and responsibilities have expanded. For example, the NDAA for Fiscal 

Year 2018 assigns the CMO the responsibility to serve as DOD’s Chief 

Information Officer for defense business systems. According to OCMO 

officials, DOD is still determining which responsibilities, if any, will transfer 

from the CIO to the CMO and what the resource implications of that 
DOD Approach to Business Transformation

Page 165 GAO-19-157SP High-Risk Series 

transfer will be. Moving forward, we will closely monitor the OCMO’s 

ability to assume these and other responsibilities. 

Additionally, DOD established nine reform teams, led by senior-level 

functional officials throughout the department who are charged with 

identifying and implementing initiatives to consolidate the department’s 

business operations. Our recent work indicates that some reform teams 

have encountered challenges that could impede their progress. For 

example, as we reported in January 2019, the OCMO did not request 

funding for reform team initiatives, and reform teams reported that they 

lack funding needed to implement some of their initiatives. OCMO officials 

told us that the teams submitted nine requests for funding in fiscal year 

2018, but OCMO did not have funding to support four of these requests 

as of the end of fiscal year 2018. 

Reform team membership relies on the military services’ and DAFAs’ 

continued willingness to provide members for each of the teams. Further, 

DOD senior leaders told us they plan to move many of the teams out of 

the OCMO to the components responsible for the functions they are trying 

to reform. This development raises questions about whether the teams 

will be fully empowered and sufficiently independent to drive change. We 

will continue to closely monitor development of the OCMO and progress 

of the reform teams to assess the extent to which they have the capacity 

to achieve their goals. 

Action plan: met. In our February 2017 High-Risk Report, we stated, 

among other things, that DOD should refine its performance action plan 

or develop a corrective action plan that identifies the processes, systems, 

personnel, and other resources needed to implement reform initiatives. 

As previously stated, in May 2018, DOD issued its National Defense 

Business Operations Plan. This plan establishes a strategic goal of 

reforming the department’s business practices for greater performance 

and affordability. The strategic objectives supporting that goal are to: (1) 

improve and strengthen business operations through a move to DODenterprise or shared services, and reduce administrative and regulatory 

burden; (2) optimize organizational structures; and (3) undergo an audit 

and improve the quality of budgetary and financial information. As a result 

of these actions, the rating for the action plan criteria for this high-risk 

area has improved from partially met in 2017 to met.

DOD’s Fiscal Year 2019 DOD Annual Performance Plan identifies 

performance goals and measures to achieve the strategic goals and 

objectives described in the National Defense Business Operations Plan, 

including the goal of reforming the department’s business practices. The 

Performance Plan designates several business reform team leaders as

responsible for meeting performance goals and measures. For example, 

the leader of the Information Technology and Business Systems Reform 

Team is responsible for transforming how the department delivers secure, 
DOD Approach to Business Transformation

Page 166 GAO-19-157SP High-Risk Series 

stable, and resilient information technology infrastructure in support of 

warfighter lethality. This goal is consistent with the team’s overarching 

objective to plan and execute the transformation of all business systems 

affecting support areas within the department. Moving forward, it will be 

important for DOD to demonstrate that it is using its National Defense 

Business Operations Plan to guide its reform efforts. 

Monitoring: partially met. According to officials, DOD established a 

Reform Management Group (RMG) in summer 2017; it was initially 

chaired by the Deputy Secretary of Defense and co-chaired by the CMO 

and the Director of Cost Assessment and Program Evaluation (CAPE), to 

identify opportunities for reform and provide support to the nine reform 

teams. The RMG was intended to (1) provide oversight and guidance, (2) 

make decisions on reform team recommendations, and (3) monitor the 

reform teams’ progress. However, according to officials, the structure and 

processes of the group have changed over time and remain unclear. For 

example, in October 2018, the Director of CAPE told us, and a senior 

OCMO official later confirmed, he was no longer co-chairing the group. 

In addition, OCMO officials are considering whether the RMG should 

meet bi-weekly rather than weekly; and whether teams should meet with 

the RMG only when a team is chartered and when it briefs the proposed 

solution for its initiatives, rather than throughout implementation as has 

been the case. It is unclear at this point what effect these and other 

changes may have on oversight of the teams’ progress. DOD has also 

developed a dashboard containing project milestones and metrics for 

monitoring reform team progress. Although not completely populated in 

September 2018, when we received a demonstration, the dashboard will 

indicate whether each of the initiative’s project milestones and metrics are 

on track. 

While these steps demonstrate progress in the area of monitoring, we 

remain concerned that the department has not clearly established reliable 

baselines for measuring progress and verifying cost savings estimates. In 

July 2017, we reported that DOD did not have a reliable estimate to 

support the cost savings it had identified for its past efficiency initiatives. 

As recently as May 2018, DOD provided a progress report to Congress 

on past efficiencies that included inconsistent documentation, raising 

questions about the accuracy of its prior cost savings estimates. 

According to the John S. McCain NDAA for Fiscal Year 2019, the CMO is 

required, by not later than January 2020, to develop a baseline of costs to 

perform certain business activities, such as real estate management. We 

will be reviewing this baseline to assess the extent to which it includes all 

elements required under the NDAA and helps DOD track cost reductions 

effectively. 

DOD is also working to develop a cost management framework to 

estimate cost savings for its reform efforts, but it is unclear what effect 
DOD Approach to Business Transformation

Page 167 GAO-19-157SP High-Risk Series 

this framework will have on improving the accuracy of the department’s 

future cost savings estimates. Without a reliable cost estimate that 

includes a cost baseline, DOD will be unable to determine and accurately 

report actual savings achieved from its reform efforts. For example, we 

reported in July 2017 that DOD’s projected cost savings estimates were 

unreliable because DOD-provided documentation, when compared with 

best practices for cost estimates, was not sufficiently detailed to support 

the estimates. 

Demonstrated progress: partially met. As noted above, DOD 

established nine reform teams aligned to its functional lines of business in 

February 2017 to achieve its goal of reforming business practices for 

greater performance and affordability. These include functional lines such 

as financial management, supply chain and logistics, human resources, 

and information technology and business systems. Each of these reform 

teams is to implement initiatives in its respective line of business that will 

transform some aspect of the department’s business operations and free 

up resources to reinvest in warfighter priorities. 

However, it remains to be seen how effective these reform teams, or the 

other reform initiatives in the department, will be. Notably, DOD has not 

met many of its internal goals and milestones for business operation 

reform, and the absence of a clear process for identifying and prioritizing 

available funding for reform teams may impede their progress. In 

November 2018, CMO officials told us they planned on narrowing the 

scope of reform efforts to focus on four areas: 1) fourth estate, or those 

organizations other than the military departments or combatant 

commands, such as the Office of the Secretary of Defense, the Joint 

Staff, the defense agencies, and DOD field activities; 2) information 

technology; 3) health care; and 4) DOD’s approach to buying goods and 

services more efficiently and cost effectively, called category 

management. This reduction in scope raises questions about the extent 

to which enterprise reform will be made in the areas that were 

deemphasized, such as human resources. 

Since we added this area to our High-Risk List, we have made numerous 

recommendations related to this high-risk issue, including 9 since the last 

high-risk update in February 2017. As of December 2018, all 9 remain 

open. 

In order to make progress in its approach to business transformation, 

DOD should:

• provide department-wide guidance on the CMO’s roles, responsibilities, 

and authorities; 

What Remains to Be Done
DOD Approach to Business Transformation

Page 168 GAO-19-157SP High-Risk Series 

• implement and communicate a process for providing resources to the 

reform teams, including funding to implement reform initiatives, as 

needed; 

• demonstrate that the National Defense Business Operations Plan is 

being used and updated, as needed, to guide reform efforts;

• ensure that the Reform Management Group continues to monitor and 

oversee reform team progress;

• fully populate and actively use the dashboard and the associated 

milestones and metrics to gauge team success in identifying and 

achieving efficiencies and cost savings; 

• establish the cost baseline required by section 921 of the John S. 

McCain NDAA for Fiscal Year 2019 and use it to accurately estimate 

savings anticipated within the business functions covered under the 

NDAA; 

• develop additional cost baselines, modeled on the baseline created in 

accordance with the NDAA for Fiscal Year 2019, to accurately track 

actual savings resulting from implementation of reform initiatives in 

additional business functions, such as health care management; 

• effectively consolidate key business functions in the department and 

show cost savings from the consolidation; and 

• demonstrate progress in implementing reform efforts outlined in the 

National Defense Business Operations Plan, including those not covered 

by the reform teams. 

Defense Management: DOD Needs to Implement Statutory Requirements 

and Identify Resources for Its Cross-Functional Reform Teams, 

GAO-19-165. Washington, D.C.: January 17, 2019.

Defense Efficiency Initiatives: Observations on DOD’s Reported 

Reductions to Its Headquarters and Administrative Activities. 

GAO-18-688R. Washington, D.C.: September 24, 2018.

Defense Management: DOD Needs to Address Inefficiencies and 

Implement Reform across Its Defense Agencies and DOD Field Activities. 

GAO-18-592. Washington, D.C.: September 6, 2018.

Defense Management: DOD Senior Leadership Has Not Fully 

Implemented Statutory Requirements to Promote Department-Wide 

Collaboration. GAO-18-513. Washington, D.C.: June 25, 2018.

Defense Management: DOD Needs to Take Additional Actions to 

Promote Department-Wide Collaboration. GAO-18-194. Washington, 

D.C.: February 28, 2018.

Related GAO 

Products
DOD Approach to Business Transformation

Page 169 GAO-19-157SP High-Risk Series 

Defense Management: DOD Has Taken Initial Steps to Formulate an 

Organizational Strategy, but These Efforts Are Not Complete. 

GAO-17-523R. Washington, D.C.: June 23, 2017.
Government-wide Personnel Security 

Clearance Process 

Page 170 GAO-19-157SP High-Risk Series 

The government-wide personnel security clearance process continues to face challenges in the timely 

processing of clearances, measuring the quality of investigations, and ensuring the security of related 

information technology (IT) systems.

Since we added the governmentwide personnel security clearance 

process to our High-Risk List in 

January 2018, the executive 

branch has taken some action 

and made some progress 

addressing our criteria for 

removal. The executive branch 

has met the criterion for 

leadership commitment, partially 

met the capacity, monitoring, and 

demonstrated progress criteria, 

and has not met the action plan 

criterion. In addition, the 

administration proposed 

transferring the background 

investigation function from the Office of Personnel Management’s (OPM) 

National Background Investigations Bureau (NBIB) to the Department of 

Defense (DOD) in June 2018, and plans to issue an Executive Order 

regarding the transfer.

Leadership commitment: met. The Security Clearance, Suitability, and 

Credentialing Performance Accountability Council (PAC), chaired by the 

Deputy Director for Management of the Office of Management and 

Budget (OMB), is the government-wide entity responsible for driving the 

implementation of and overseeing security clearance reform, among other 

reform efforts. The chair of the PAC, who is concurrently serving as the 

Acting Director of OPM, stated that the security clearance reform process 

is one of her top three government-wide priorities. Further, according to 

officials, the PAC assembled teams of stakeholders who meet regularly to 

focus on developing solutions to specific problems within the security 

clearance process. OPM and the Office of the Director of National 

Intelligence (ODNI) also issued a memo in June 2018 containing 

measures to reduce the backlog of background investigations. While the 

PAC has prioritized the prompt reduction of the backlog, it has not 

finalized a plan to reduce it to a manageable level or prioritized improving 

the timeliness of investigations. 

Senior DOD officials expressed commitment to the administration’s June 

2018 transfer proposal and have planning efforts underway related to the 

transfer and the modernization of the personnel vetting process. 

Continued and coordinated leadership by the PAC will be important as it 

Government-wide Personnel Security 

Clearance Process

Why Area Is High Risk

We placed the government-wide 

personnel security clearance process on 

the High-Risk List in January 2018 

because it faces significant challenges 

related to (1) the timely processing of 

clearances, (2) measuring investigation 

quality, and (3) ensuring IT security, 

among other things.

Timeliness. The executive branch has 

been unable to process personnel 

security clearances within established 

timeliness objectives, contributing to a 

backlog that the NBIB reported to be 

approximately 565,000 cases as of 

February 2019.

Quality. A high-quality personnel 

security clearance process minimizes the 

risks of unauthorized disclosures of 

classified information and helps ensure 

that information about individuals with 

criminal histories or other questionable 

behavior is identified and assessed. 

While the executive branch has taken 

some steps to address quality, it has not 

established measures to ensure the 

quality of background investigations and 

adjudications, and instead focused on 

reducing the backlog and redesigning 

the investigation process.

IT Security. DOD is building and 

managing the development of the NBIS, 

but security concerns posed by DOD 

regarding OPM legacy IT systems may 

delay planned milestones for the new 

system. OPM did not effectively monitor 

actions taken to remediate identified 

weaknesses in its IT systems to ensure 

that key security controls are in place 

and operating as intended.

Contact Information

For additional information about this 

high-risk area, contact Brenda S. Farrell, 

202-512-3604, or farrellb@gao.gov. 
Government-wide Personnel Security 

Clearance Process 

Page 171 GAO-19-157SP High-Risk Series 

works to complete other long-standing key reform initiatives, including the 

government-wide implementation of continuous evaluation. Focused 

leadership will also be critical throughout the transition of background 

investigative functions from OPM to DOD, as proposed by the 

administration, particularly during senior leadership changes at OPM and 

DOD.

Capacity: partially met. NBIB officials reported that NBIB has increased 

its workforce to approximately 8,700 federal and contract investigators to 

help address the investigations backlog. However, NBIB has not reported 

goals for increasing total investigator capacity or completed the 

development and implementation of a comprehensive strategic workforce 

plan, as we have recommended. Completing the workforce plan would 

better position the bureau to meet current and future demands for its 

services. 

In addition, in August 2017, DOD submitted to the congressional defense 

committees a plan for the transfer of certain DOD background 

investigations from OPM’s NBIB to DOD. This plan included estimates of 

the number of full-time equivalent employees necessary to execute the 

transfer. However, officials told us in November 2018 that the department 

is no longer using the plan because it was overcome by the 

administration’s June 2018 organizational reform proposal for the 

complete transfer of the NBIB background investigation program from 

OPM to DOD. According to officials, DOD is now preparing for the 

transfer of all NBIB investigative functions by developing a new plan 

which is based on the total inventory of OPM’s background investigations. 

In preparation for the transfer, DOD should consider our recommendation 

to the Director of NBIB to develop a strategic workforce plan as it 

assumes these responsibilities.

Executive Order 13467, as amended, which establishes the PAC, among 

other things, assigns the Secretary of Defense the role of developing and 

securely operating IT systems that support all background investigation 

processes conducted by NBIB (Exec. Order No. 13467, § 2.6(b), as 

amended through Exec. Order No. 13764, 82 Fed. Reg. 8115, 8126 (Jan. 

17, 2017). In addition, the National Defense Authorization Act (NDAA) for 

Fiscal Year 2018 included a provision that DOD conduct a review of the 

National Background Investigation Services (NBIS), the IT system it is 

developing to support background investigations, to determine whether 

certain enhancements are necessary (see Pub. L. No. 115-91, § 925(f) 

(2017)). According to officials, DOD has in place the resources needed 

for the development of NBIS, is actively identifying necessary system 

capabilities, and has begun small preliminary pilots of its services. 

However, according to officials, the necessary resources for full 

implementation of NBIS and the administration’s transfer proposal remain 

unclear. 
Government-wide Personnel Security 

Clearance Process 

Page 172 GAO-19-157SP High-Risk Series 

Action plan: not met. The leaders of the reform effort have developed 

various plans for more than a decade to improve the process. Most 

recently, in March 2018, the Director of National Intelligence (DNI) issued 

implementation guidelines for continuous evaluation—a process to review 

the background of clearance holders and individuals in sensitive positions 

at any time during the eligibility period. Further, DOD has begun 

reorganizing certain entities within the department that will enable DOD to 

begin the transfer of investigative functions from OPM’s NBIB. While the 

DNI and OPM have issued a joint Executive Correspondence that 

contains measures clarifying and adjusting certain elements of 

investigation requirements, the PAC lacks plans, including goals and 

milestones, to (1) reduce the backlog to a manageable level; (2) meet 

timeliness objectives for security clearance investigations and 

adjudications; and (3) assess and address the potential effects of 

continuous evaluation on agency resources. 

Officials from ODNI, DOD, and the PAC told us they are working on an 

initiative called Trusted Workforce 2.0, an effort to transform the 

fundamental approach to workforce vetting, and supporting policies that 

will also overhaul business processes and modernize the IT architecture. 

According to officials, this effort is an expansion of reform since our 

January 2018 high-risk designation that will consider both risk and trust. 

PAC and ODNI officials said Trusted Workforce 2.0 will focus on 

timeliness and quality goals in a future phase, after reducing the 

clearance backlog to a manageable level. The DNI and former Director of 

OPM committed to issuing this new policy framework and plans to 

transform vetting for the Executive Branch by the end of 2018. Officials 

told us in early 2019 that the issuance of related policies is expected 

throughout the calendar year.

Monitoring: partially met. The NDAA for Fiscal Year 2018 required the 

DNI, in coordination with the other PAC principals, to annually report for 

the prior fiscal year on the timeliness of initiations, investigations, and 

adjudications, by clearance level. This report is to cover both initial 

investigations and periodic reinvestigations for government and contractor 

employees (see Pub. L. No. 115-91, § 925(k)(1)). In November 2018, the 

DNI informed executive branch agencies that it intends to fulfill this and 

other legislative reporting requirements through a consolidated data call. 

In September 2018, NBIB reported to Congress, for each clearance level, 

(1) the size of the investigation backlog, (2) the average length of time to 

conduct an initial investigation and a periodic reinvestigation, and (3) a 

discussion of the factors contributing to investigation timeliness. The PAC 

is also reporting publicly on the progress of key reforms through 

www.performance.gov, where OMB began tracking security clearance 

and suitability reform as a cross-agency priority goal in March 2014. For 

fiscal year 2018, www.performance.gov contains quarterly action plans 
Government-wide Personnel Security 

Clearance Process 

Page 173 GAO-19-157SP High-Risk Series 

and progress updates, which present figures on the average timeliness of 

initial investigations and periodic reinvestigations for the executive branch 

as a whole, investigation workload and backlog, and investigator

headcounts. 

Our analysis of the latest available timeliness data showed that the 

number of executive branch agencies meeting investigative and 

adjudicative objectives decreased from fiscal years 2012 through 2018. 

Furthermore, the PAC has not implemented our December 2017 

recommendation to conduct an evidence-based review of the 

investigation and adjudication timeliness objectives for completing the 

fastest 90 percent of initial secret and initial top secret security 

clearances. In addition, the PAC has not yet established performance 

measures to monitor investigation and adjudication quality, continuous 

evaluation implementation, and government-wide reciprocity. 

Demonstrated progress: partially met. The PAC has demonstrated 

progress in some areas, specifically related to a reduction in the backlog 

of background investigations. NBIB officials report that the backlog 

decreased from almost 715,000 cases in January 2018—when we added 

the process to our High-Risk List—to approximately 565,000 cases in 

February 2019. Those officials credit an Executive Memorandum—issued 

jointly in June 2018 by the DNI and the Director of OPM and containing 

measures to reduce the investigation backlog—as a driver in backlog 

reduction. The measures adjust investigative requirements by, for 

example, temporarily allowing for video or telephone interviews in certain 

circumstances. We will continue to monitor the backlog and efforts to 

reduce it. 

While members of the PAC have taken positive steps to improve 

continuous evaluation and reciprocity, including the DNI’s March 2018 

continuous evaluation implementation guidelines and November 2018 

guidance providing requirements for reciprocity, the PAC has not 

demonstrated sustained progress to address other weaknesses we have 

identified. For example, PAC leaders have not completed the 

development of quality measures for investigations, and PAC officials told 

us they had not made plans to report quality to Congress. 

Further, the PAC has not demonstrated measurable improvements with 

regards to the timeliness of background investigations and adjudications. 

In fiscal year 2018, the percent of agencies meeting the timeliness 

objectives in which the fastest 90 percent are to be completed within a 

specified number of days are presented in Table 9 below.
Government-wide Personnel Security 

Clearance Process 

Page 174 GAO-19-157SP High-Risk Series 

Table 9: Percent of Executive Branch Agencies Meeting Security Clearance 

Processing Timeliness Objectives in Fiscal Year 2018

Phase Type Objective Percentage Meeting Objective

Investigation Initial Secret 40 days 3 percent

Initial Top Secret 80 days 13 percent

Periodic 

reinvestigations

150 days 13 percent

Adjudication Initial Secret 20 days 44 percent

Initial Top Secret 20 days 44 percent

Periodic 

reinvestigations

30 days 65 percent

Source: GAO analysis of Office of the Director of National Intelligence data. | GAO-19-157SP

Agencies without delegated authority rely on OPM to conduct their 

background investigations, while agencies with delegated authority have 

been authorized to conduct their own background investigations. As such,

investigative phase timeliness data for agencies without delegated 

authority is generally a reflection of OPM’s timeliness. While the data 

ODNI provided shows that timeliness continues to decline, OPM officials 

stated that NBIB internal monitoring shows recent improvement in 

investigation timeliness.

We have made numerous recommendations to PAC members to address 

risks associated with the personnel security clearance process between 

2011, when we removed DOD’s personnel security clearance program 

from the High-Risk List and 2018, when we placed the government-wide 

personnel security clearance process on the High-Risk List. We consider 

27 of those recommendations key to addressing the high-risk designation. 

Eight recommendations key to the high-risk designation have been 

implemented, including three since January 2018. Most recently, those 

recommendations implemented include ODNI formalizing plans and 

guidance for continuous evaluation. As of December 2018, 19 of these 

key recommendations remain open. Of the open recommendations, ODNI 

stated that it did not concur with our December 2017 recommendations 

on addressing investigation quality and timeliness, but did not provide 

specific information to explain why it did not concur. 

In addition, in March 2018, we outlined necessary actions and 

outcomes—anchored in each of our five criteria for removal from the 

High-Risk List—and our prior recommendations that need to be 

addressed for this area to be removed. These actions and outcomes are 

outlined below and should be considered by all four agencies, unless a 

lead agency is indicated.

What Remains to Be Done
Government-wide Personnel Security 

Clearance Process 

Page 175 GAO-19-157SP High-Risk Series 

To continue to meet the leadership commitment criterion, these agencies 

should:

• continue to demonstrate that the PAC is prioritizing the (1) prompt 

reduction of the government-wide investigative backlog to a manageable 

level; (2) improvement of the timeliness of background investigations; 

and (3) completion of long-standing, key reform initiatives;

• continue participating regularly in leadership meetings of the PAC 

principals;

• provide the necessary oversight and support to PAC members to 

effectively accomplish assigned reform initiatives, in accordance with the 

roles and responsibilities outlined in Executive Order 13467 (as 

amended), as Chair of the PAC (OMB); and

• oversee and support NBIB and DOD during the transition period while 

DOD stands up background investigative functions, to include supporting 

resource needs.

To make progress on meeting capacity, these agencies should:

• develop and implement a comprehensive strategic workforce plan that 

identifies the workforce needed to meet the current and future demand 

for its services, as well as reduce the current backlog to a manageable 

level (OPM, DOD); 

• coordinate with responsible executive branch agencies to identify the 

resources needed to effectively implement personnel security clearance 

reform effort initiatives within established timeframes (OMB, ODNI, 

DOD); and

• develop long-term funding estimates for changes to the federal 

government’s investigation practices resulting from the implementation of 

the 2012 Federal Investigative Standards. These long-term funding 

estimates should include, but not be limited to: (1) costs related to IT 

adjustments to enable government-wide data sharing; (2) costs related to 

implementing continuous evaluation; and (3) costs related to the changed 

frequency of periodic reinvestigations (OMB). 

To make progress on an action plan, these agencies should:

• develop a plan, including goals and milestones, for reducing the backlog 

of background investigations to a manageable level;

• develop a government-wide plan, including goals and interim milestones, 

to meet timeliness objectives for initial personnel security clearances, 

periodic reinvestigations, and adjudications; and

• assess the potential effects of continuous evaluation on agency 

resources and develop a plan to address those effects, such as 

modifying the scope of periodic reinvestigations, changing the frequency 
Government-wide Personnel Security 

Clearance Process 

Page 176 GAO-19-157SP High-Risk Series 

of periodic reinvestigations, or replacing periodic reinvestigations for 

certain clearance holders (ODNI). 

To make progress on monitoring, these agencies should:

• develop and report to Congress annually on government-wide, resultsoriented performance measures for the quality of security clearance 

background investigations and adjudications (ODNI); 

• develop performance measures for continuous evaluation that agencies 

must track and regularly report to ODNI; 

• develop metrics and government-wide baseline data for reciprocity 

determinations to measure the extent of reciprocity within the executive 

branch and report on those metrics to Congress (ODNI); and

• monitor the implementation of remedial actions intended to resolve 

known cybersecurity vulnerabilities, to include updating remedial action 

plans to reflect expected completion dates, and improve the timeliness of 

validating the effectiveness of actions taken to mitigate cybersecurity 

vulnerabilities that exposed agency information to cybersecurity incidents 

(OPM).

To improve on demonstrating progress, these agencies should:

• develop government-wide performance measures for the quality of 

background investigations and adjudications (OMB, ODNI);

• conduct an evidence-based review of the investigation and adjudication 

timeliness objectives for completing the fastest 90 percent of initial secret 

and initial top secret security clearances, and take action to adjust the 

objectives if appropriate;

• conduct an evidence-based review of the timeliness goal of 195 days for 

completing the fastest 90 percent of periodic reinvestigations and the 

associated goals for the different phases of periodic reinvestigations, and 

adjust the goal if appropriate; and

• improve and secure personnel security clearance IT systems, including 

implementing further security improvements to its IT environment, 

including contractor-operated systems, to ensure that key security 

controls are in place and operating as intended (OPM). 

The annual assessments of timeliness and quarterly briefings required by 

the NDAA for Fiscal Year 2018 will serve as mechanisms for Congress 

and the executive branch to monitor timeliness, costs, and continuous 

evaluation, among other things.

Personnel Security Clearances: Additional Actions Needed to Implement 

Key Reforms and Improve Timely Processing of Investigations. GAO-18-

431T. Washington, D.C.: March 7, 2018. 

Congressional Actions Needed

Related GAO 

Products 
Government-wide Personnel Security 

Clearance Process 

Page 177 GAO-19-157SP High-Risk Series 

Personnel Security Clearances: Additional Actions Needed to Ensure 

Quality, Address Timeliness, and Reduce Investigation Backlog. GAO-18-

29. Washington, D.C.: December 12, 2017.

Personnel Security Clearances: Plans Needed to Fully Implement and 

Oversee Continuous Evaluation of Clearance Holders. GAO-18-117. 

Washington, D.C.: November 21, 2017.

Information Security: OPM Has Improved Controls, but Further Efforts Are 

Needed. GAO-17-614. Washington, D.C: August 3, 2017. 

Information Security: Agencies Need to Improve Controls over Selected 

High-Impact Systems. GAO-16-501. Washington, D.C.: May 18, 2016. 

Personnel Security Clearances: Funding Estimates and Government-wide 

Metrics Are Needed to Implement Long-Standing Reform Efforts. GAO15-179SU. Washington, D.C.: April 23, 2015.
Ensuring the Cybersecurity of the Nation

Page 178 GAO-19-157SP High-Risk Series 

Federal agencies and other entities need to take urgent actions to implement a comprehensive cybersecurity 

strategy, perform effective oversight, secure federal systems, and protect cyber critical infrastructure, privacy, 

and sensitive data.

Since our previous 2017 HighRisk Report, our assessment of 

efforts to address all five criteria 

remains unchanged.

Leadership commitment: met.

In May 2017, the President 

issued an executive order 

requiring federal agencies to take 

a variety of actions, including 

better managing their 

cybersecurity risks and 

coordinating to meet reporting 

requirements related to 

cybersecurity of federal networks 

and critical infrastructure. 

Further, in December 2017, the President issued a National Security 

Strategy citing cybersecurity as a national priority and identifying needed 

actions, such as identifying and prioritizing risk and building defensible 

government networks. 

The administration further described its planned approach to 

cybersecurity with the release of a National Cyber Strategy in September 

2018. This national strategy outlines activities such as securing critical 

infrastructure, federal networks, and associated information, as well as 

developing the cybersecurity workforce. To lead the nation’s 

cybersecurity response activities, in November 2018, the President 

signed the Cybersecurity and Infrastructure Security Agency Act of 2018 

into law. Among other things, the law enables the Department of 

Homeland Security (DHS) to restructure the existing cybersecurity 

components within the National Protection and Programs Directorate to 

create a new cyber-focused agency. 

Capacity: partially met. In June 2018, the administration issued a 

government-wide reform plan and reorganization recommendations that 

included, among other things, proposals for solving the federal

cybersecurity workforce shortage. In particular, the plan notes the 

administration’s intent to prioritize and accelerate ongoing efforts to 

reform the way that the federal government recruits, evaluates, selects, 

pays, and places cyber talent. The plan further states that, by the end of 

the first quarter of fiscal year 2019, all 24 major federal agencies, in 

coordination with DHS and the Office of Management and Budget (OMB), 

are to develop a critical list of vacancies across their organizations. 

Ensuring the Cybersecurity of the Nation

Why Area Is High Risk

Federal agencies and our nation’s critical 

infrastructures—such as energy, 

transportation systems, communications, 

and financial services—are dependent 

on information technology (IT) systems 

and electronic data to carry out 

operations and to process, maintain, and 

report essential information. The security 

of these systems and data is vital to 

public confidence and national security, 

prosperity, and well-being.

Because many of these systems contain 

vast amounts of personally identifiable 

information (PII), agencies must protect 

the confidentiality, integrity, and 

availability of this information. In addition, 

they must effectively respond to data 

breaches and security incidents when 

they occur.

The risks to IT systems supporting the 

federal government and the nation’s 

critical infrastructure are increasing, 

including insider threats from witting or 

unwitting employees, escalating and 

emerging threats from around the globe, 

and the emergence of new and more 

destructive attacks.

We have designated information security 

as a government-wide high-risk area 

since 1997. We expanded this high-risk 

area in 2003 to include protection of 

critical cyber infrastructure and, in 2015, 

to include protecting the privacy of PII.

Contact Information: 

For additional information about this 

high-risk area, contact Nick Marinos at 

(202) 512-9342 or marinosn@gao.gov,

Gregory C. Wilshusen at (202) 512-6244

or wilshuseng@gao.gov, or Vijay

D'Souza at (202) 512-6240 or

dsouzav@gao.gov.
Ensuring the Cybersecurity of the Nation 

Page 179 GAO-19-157SP High-Risk Series 

Nevertheless, the federal government continues to face challenges in 

ensuring that the nation’s cybersecurity workforce has the appropriate 

skills. For example, we have previously reported that DHS and the 

Department of Defense had not fully addressed cybersecurity workforce 

management requirements set forth in federal laws. Further, as of June 

2018, most of the 24 major federal agencies had not fully implemented all 

requirements associated with the Federal Cybersecurity Workforce 

Assessment Act of 2015. For example, three agencies had not conducted 

a baseline assessment to identify the extent to which their cybersecurity 

employees held professional certifications. As a result, these agencies 

may not be able to effectively gauge the competency of individuals who 

are charged with ensuring the confidentiality, integrity, and availability of 

federal information and information systems. 

Action plan: partially met. In response to the May 2017 presidential 

executive order, DHS issued a cybersecurity strategy in May 2018 that 

articulated seven goals the department plans to accomplish in support of 

its mission related to managing national cybersecurity risks over the next 

5 years. Further, OMB issued the Federal Cybersecurity Risk 

Assessment and Action Plan in August 2018. The assessment stated that 

OMB and DHS examined the capabilities of 96 civilian agencies across 

76 cybersecurity metrics and found that 71 agencies had cybersecurity 

programs that were either at risk or at high risk. The assessment also 

stated that agencies were not equipped to determine how malicious 

actors seek to gain access to their information systems and data. The 

assessment identified core actions to address cybersecurity risks across 

the federal enterprise. 

Additionally, the September 2018 National Cyber Strategy outlined the 

administration’s approach to cybersecurity through a variety of priority 

actions, such as centralizing management and oversight of federal civilian 

cybersecurity. However, the strategy lacks key elements that we have 

previously reported can enhance the usefulness of a national strategy, 

including clearly defined roles and responsibilities, and information on the 

resources needed to carry out the goals and objectives. Although the 

strategy states that National Security Council staff are to coordinate with 

departments, agencies, and OMB to determine the resources needed to 

support the strategy’s implementation, it is unclear what official maintains 

overall responsibility for coordinating these efforts, especially in light of 

the elimination of the White House Cybersecurity Coordinator position in 

May 2018.1

 

 

1

The White House Cybersecurity Coordinator position was created in December 2009 to, 

among other things, coordinate interagency cybersecurity policies and strategies, and to 

develop a comprehensive national strategy to secure the nation’s digital infrastructure.
Ensuring the Cybersecurity of the Nation 

Page 180 GAO-19-157SP High-Risk Series 

Going forward, it will be critical for the White House to clearly define the 

roles and responsibilities of key agencies and officials in order to foster 

effective coordination and hold agencies accountable for carrying out 

planned activities to address the cybersecurity challenges facing the 

nation. We have work underway examining federal roles and 

responsibilities for protecting the nation against cyber threats, including 

the implications of the decision to eliminate the cybersecurity coordinator 

position. We expect to report on the results of our work by the end of 

fiscal year 2019.

Monitoring: partially met. DHS has established the National 

Cybersecurity and Communications Integration Center (NCCIC), which 

functions as the 24/7 cyber monitoring, incident response, and 

management center for the federal civilian government. The United 

States Computer Emergency Readiness Team, one of several 

subcomponents of the NCCIC, is responsible for operating the National 

Cybersecurity Protection System. Operationally known as Einstein, this 

system is intended to provide DHS with situational awareness related to 

cybersecurity of entities across the federal government, through intrusion 

detection and prevention capabilities. 

Nevertheless, DHS has continued to be challenged in measuring how the 

NCCIC is performing its functions in accordance with mandated 

implementing principles. For example, NCCIC is to provide timely 

technical assistance, risk management support, and incident response 

capabilities to federal and nonfederal entities; however, as of December 

2018, it had not established measures or other procedures for ensuring 

the timeliness of these assessments, as we previously recommended.

We also continued to find persistent weaknesses in federal agencies’ 

monitoring of their information security programs. The Federal Information 

Security Modernization Act of 2014 (and its predecessor the Federal 

Information Security Management Act of 2002) requires federal agencies 

in the executive branch to develop, document, and implement an 

information security program and evaluate it for effectiveness. Our 

numerous security control audits have identified hundreds of deficiencies 

related to agencies’ implementation of effective security controls. 

Demonstrated progress: partially met. Since 2010, we have made over 

3,000 recommendations to agencies aimed at addressing cybersecurity 

challenges facing the government—448 of which were made since the 

last high-risk update in February 2017. Nevertheless, many agencies face 

challenges in safeguarding their information systems and information, in 

part because many of these recommendations have not been fully 

implemented. Of the roughly 3,000 recommendations made since 2010, 

nearly 700 had not been fully implemented as of December 2018. We 

have also designated 35 as priority recommendations, meaning that we 

believe these recommendations warrant priority attention from heads of 
Ensuring the Cybersecurity of the Nation 

Page 181 GAO-19-157SP High-Risk Series 

key departments and agencies. As of December 2018, 26 of our priority 

recommendations had not been fully implemented.

Based on our prior work, we have identified four major cybersecurity 

challenges: (1) establishing a comprehensive cybersecurity strategy and 

performing effective oversight, (2) securing federal systems and 

information, (3) protecting cyber critical infrastructure, and (4) protecting 

privacy and sensitive data. To address these challenges, we have 

identified 10 critical actions that the federal government and other entities 

need to take (see figure 12). 

What Remains to Be Done
Ensuring the Cybersecurity of the Nation 

Page 182 GAO-19-157SP High-Risk Series 

Figure 12: Ten Critical Actions Needed to Address Four Major Cybersecurity 

Challenges

We also have previously suggested that Congress consider amending 

laws, such as the Privacy Act of 1974 and the E-Government Act of 2002, 

because they may not consistently protect PII. Specifically, we found that 

while these laws and guidance set minimum requirements for agencies, 

they may not consistently protect PII in all circumstances of its collection 

and use throughout the federal government, and may not fully adhere to 

Congressional Actions Needed
Ensuring the Cybersecurity of the Nation 

Page 183 GAO-19-157SP High-Risk Series 

key privacy principles. However, the relevant revisions to the Privacy Act 

and the E-Government Act had not yet been enacted as of the date of this 

report.

Further, we suggested that Congress consider strengthening the 

consumer privacy framework and review issues such as the adequacy of 

consumers’ ability to access, correct, and control their personal 

information; and privacy controls related to new technologies such as web 

tracking and mobile devices. However, these suggested changes had not 

yet been enacted as of the date of this report.

Information Security: OPM Has Implemented Many of GAO’s 80 

Recommendations, but Over One-Third Remain Open. GAO-19-143R. 

Washington, D.C.: November 13, 2018.

Cybersecurity: Office of Federal Student Aid Should Take Additional 

Steps to Oversee Non-School Partners’ Protection of Borrower 

Information. GAO-18-518. Washington, D.C.: September 17, 2018.

High-Risk Series: Urgent Actions Are Needed to Address Cybersecurity 

Challenges Facing the Nation. GAO-18-622. Washington, D.C.: 

September 6, 2018. 

Information Security: IRS Needs to Rectify Control Deficiencies That Limit 

Its Effectiveness in Protecting Sensitive Financial and Taxpayer Data. 

GAO-18-391. Washington, D.C.: July 31, 2018.

Data Protection: Actions Taken by Equifax and Federal Agencies in 

Response to the 2017 Breach. GAO-18-559. Washington, D.C.: August 

30, 2018.

High-Risk Series: Urgent Actions Are Needed to Address Cybersecurity 

Challenges Facing the Nation. GAO-18-645T. Washington, D.C.: July 25, 

2018. 

Information Security: Supply Chain Risks Affecting Federal Agencies. 

GAO-18-667T. Washington, D.C.: July 12, 2018. 

Electronic Health Information: CMS Oversight of Medicare Beneficiary 

Data Security Needs Improvement. GAO-18-210. Washington, D.C.: 

March 6, 2018.

Critical Infrastructure Protection: Additional Actions Are Essential for 

Assessing Cybersecurity Framework Adoption. GAO-18-211. 

Washington, D.C.: February 15, 2018. 

Related GAO 

Products
Ensuring the Cybersecurity of the Nation 

Page 184 GAO-19-157SP High-Risk Series 

Cybersecurity Workforce: Urgent Need for DHS to Take Actions to 

Identify Its Position and Critical Skill Requirements. GAO-18-175. 

Washington, D.C.: February 6, 2018.
Strengthening Department of Homeland 

Security Management Functions

Page 185 GAO-19-157SP High-Risk Series 

The Department of Homeland Security (DHS) needs to continue implementing its Integrated Strategy for HighRisk Management with a particular focus on building its capacity in the areas of acquisition, information 

technology (IT), and financial management.

Since our 2017 High-Risk Report, 

ratings for all five criteria remain 

unchanged. DHS has continued 

its efforts to strengthen and 

integrate its acquisition, 

information technology, financial, 

and human capital management 

functions. It has continued to 

meet three out of five criteria for 

removal from the High-Risk List 

(leadership commitment, action 

plan, and monitoring) and partially 

meet the remaining two criteria 

(capacity and demonstrated 

progress).

Leadership commitment: met. DHS top leadership, including the 

Secretary and Deputy Secretary of Homeland Security, has continued to 

demonstrate exemplary commitment and support for addressing the 

department’s management challenges. They have also taken actions to 

institutionalize this commitment to help ensure the long-term success of 

the department’s efforts. One such effort is the Under Secretary for 

Management’s Integrated Priorities initiative to strengthen the integration 

of DHS’s business operations across the department. During monthly 

leadership meetings with the Under Secretary for Management, the 

department’s Chief Executive Officers have been providing status 

updates on their respective actions to address this high-risk designation. 

Capacity: partially met. With regard to acquisition staffing, DHS has 

analyzed components’ acquisition program staffing assessments but has 

yet to conduct an in-depth analysis across components or develop a plan 

to address any gaps. 

With regard to IT staffing, DHS has not identified or reported to Congress 

or the Office of Personnel Management (OPM) on its department-wide 

cybersecurity specialty areas of critical needs, such as cybersecurity 

management or incident response, as required by law. In February 2018, 

we recommended that DHS take steps to ensure that (1) its cybersecurity 

workforce procedures identify position vacancies and responsibilities, (2) 

cybersecurity workforce data are complete and accurate, and (3) plans for 

reporting critical needs are developed. DHS concurred and stated it 

planned to provide further evidence addressing the recommendations by 

Strengthening Department of Homeland 

Security Management Functions

Why Area Is High Risk

In 2003, we designated implementing 

and transforming DHS as high risk 

because the department had to 

transform 22 agencies—several with 

major management challenges—into one 

department. Given the significant effort 

required to build and integrate a 

department as large and complex as 

DHS, our initial high-risk designation 

addressed the department’s 

implementation and transformation 

efforts to include associated 

management and programmatic 

challenges. Failure to effectively address 

these challenges could have serious 

consequences for U.S. national and 

economic security. 

Since 2003, the focus of this high-risk 

area has evolved in tandem with DHS’s 

maturation and evolution. In September 

2011, we reported in our assessment of 

DHS’s progress that the department had

implemented key homeland security 

operations and achieved important goals 

in many areas but continuing 

weaknesses in DHS’s management 

functions had been a key theme 

impacting the department’s 

implementation efforts. 

As a result, in our 2013 high-risk update, 

we narrowed the scope of the high-risk 

area to strengthening and integrating 

DHS management functions (human 

capital, acquisition, information 

technology, and financial).

Contact Information

For additional information about this 

high-risk area, contact Chris Currie (404) 

679-1875 or curriec@gao.gov. 
Strengthening Department of Homeland 

Security Management Functions

Page 186 GAO-19-157SP High-Risk Series 

the end of the first quarter of fiscal year 2019, which we will assess upon 

receipt.

With regard to financial management capacity, DHS has continued its 

efforts to identify and allocate resources for financial management but 

additional progress is needed. For example, DHS’s financial statement 

auditor has identified several capacity-related issues, including resource 

limitations and inadequate management and staff training, as causes for 

the material weaknesses reported. 

Action plan: met. In January 2011, DHS produced its first Integrated 

Strategy for High-Risk Management and has issued 14 updated versions, 

most recently in September 2018. The September 2018 strategy 

describes DHS’s progress to-date and planned corrective actions to 

further strengthen its management functions. DHS’s strategy and 

approach, if effectively implemented and sustained, provides a path for 

DHS to be removed from our High-Risk List.

Monitoring: met. In the most recent September 2018 Integrated Strategy 

for High-Risk Management, DHS included performance measures to 

monitor key management initiatives. For example, DHS monitors the 

percentage of components demonstrating effective internal controls for 

significant business processes as a way of gauging progress toward 

improving financial management. In addition, DHS is also better 

positioned to monitor its financial system modernization projects since it 

established a joint program management office in October 2017. This 

office is to, among other things, centralize program governance and 

streamline its decision-making processes, and provide DHS management 

with regular updates on the department’s financial system modernization 

efforts. 

Demonstrated progress: partially met. In 2010, we identified, and DHS 

agreed, that achieving 30 specific outcomes would be critical to 

addressing the challenges within the department’s management areas. 

As of September 2018, DHS has fully addressed 17 of the 30 needed 

outcomes, mostly addressed 4, partially addressed 6, and initiated 

actions to address the remaining 3. Since our 2017 High-Risk Report, 

DHS has taken steps to fully address two human capital outcomes by 

demonstrating that components are basing hiring decisions and 

promotions on human capital competencies and strengthening employee 

engagement efforts. In addition, DHS has fully addressed two IT 

outcomes by (1) providing ongoing oversight and support to troubled IT 

investments to help improve their cost, schedule, and performance; and 

(2) demonstrating significant progress in implementing its IT strategic 

workforce planning initiative. 
Strengthening Department of Homeland 

Security Management Functions

Page 187 GAO-19-157SP High-Risk Series 

Important progress and work remaining in key areas include:

• Acquisition management. DHS continues to face challenges in funding its 

acquisition portfolio. In May 2018, we found that recent enhancements to 

DHS’s acquisition management, resource allocation, and requirements 

policies largely reflect key portfolio management practices. However, we 

also found that of the 24 major acquisition programs we assessed with 

approved schedule and cost goals, only 10 were on track to meet those 

goals during 2017—a decrease from 2016. 

In addition, we found that DHS’s portfolio of major acquisition programs is 

not affordable from fiscal years 2018 to 2022. DHS has taken steps to 

strengthen requirements development across the department, such as 

reestablishing the Joint Requirements Council in June 2014. However, 

opportunities remain to further strengthen DHS’s acquisition process by 

using the Joint Requirements Council to impact DHS’s budget. The 

council could better fulfill its mission by identifying overlapping or common 

requirements, and by making recommendations to senior leadership to 

help ensure that DHS uses its finite investment resources wisely, and 

maintains a balanced portfolio of investments that combine near-term 

operational improvements with long-term strategic planning. 

• IT management. DHS has updated its approach for managing its 

portfolios of IT investments across all components. As part of the revised 

approach, the department is utilizing its capital planning and investment 

control process and the Joint Requirements Council to assess IT 

investments across the department on an ongoing basis. For example, as 

part of its capital planning process for the fiscal year 2020 budget, the 

Office of the Chief Information Officer worked with the components to 

assess each major IT investment to ensure alignment with DHS’s 

functional portfolios, and to identify opportunities to share capabilities 

across components. This updated approach should enable DHS to 

identify potentially duplicative investments and opportunities for 

consolidating investments, as well as reduce component-specific 

investments. 

Additionally, DHS has continued to take steps to enhance its information 

security program. In November 2018, the department’s financial 

statement auditor reported that DHS had made progress in correcting its 

prior year IT security weaknesses. However, for the 15th consecutive 

year, the auditor designated deficiencies in IT systems controls as a 

material weakness for financial reporting purposes. Work also remains in 

implementing our six open recommendations concerning DHS’s 

cybersecurity workforce assessment requirements.

• Financial management. DHS received a clean audit opinion on its 

financial statements for 6 consecutive years—fiscal years 2013 to 2018. 

However, its auditor reported two material weaknesses in the areas of 

financial reporting and information technology controls and financial 

systems, as well as instances of non-compliance with laws and 

regulations. These deficiencies hamper DHS’s ability to provide 
Strengthening Department of Homeland 

Security Management Functions

Page 188 GAO-19-157SP High-Risk Series 

reasonable assurance that its financial reporting is reliable and the 

department is in compliance with applicable laws and regulations. In 

addition, much work remains to modernize components' financial 

management systems and business processes. 

• Human capital management. DHS has continued to strengthen its 

employee engagement efforts by implementing our 2012 

recommendation to establish metrics of success within components’ 

action plans for addressing its employee satisfaction problems. Further, 

DHS has conducted audits to better ensure components are basing hiring 

decisions and promotions on human capital competencies. In addition, 

OPM’s 2018 Federal Employee Viewpoint Survey data showed that in the 

past 2 years, DHS’s score on the Employee Engagement Index (EEI) 

increased by 4 points—from 56 in 2016 to 60 in 2018—which was 1 point 

more than the government wide increase over the same period. While this 

improvement is notable, DHS’s current EEI score is 1 point below its EEI 

baseline score in 2010, suggesting that DHS is still working to regain lost 

ground after an 8 point drop between 2010 and 2015. DHS has 

considerable work ahead to improve its employee engagement as its 

2018 EEI score ranked 20th among 20 large and very large federal 

agencies. 

• Management integration. Since 2015, DHS has focused its efforts to 

address crosscutting management challenges through the establishment 

and monitoring of Integrated Priorities. The department updated these 

priorities in September 2017. Each priority includes goals, objectives, and 

measurable action plans that are monitored at monthly leadership 

meetings led by senior DHS officials, including the Under Secretary for 

Management. To achieve this outcome, DHS needs to continue to 

demonstrate sustainable progress integrating its management functions 

within and across the department, as well as fully address the other 13 

outcomes it has not yet fully achieved.

Over the years, we have made hundreds of recommendations related to 

DHS management functions and many have been implemented. 

Continued progress for this high-risk area depends primarily on 

addressing the remaining outcomes. In the coming years, DHS needs to 

continue implementing its Integrated Strategy for High-Risk Management 

to show measurable, sustainable progress in implementing corrective 

actions and achieving outcomes. In doing so, it remains important for 

DHS to

• maintain its current level of top leadership support and sustained 

commitment to ensure continued progress in executing its corrective 

actions through completion;

• continue to identify the people and resources necessary to make 

progress towards achieving outcomes, work to mitigate shortfalls and 

What Remains to Be Done
Strengthening Department of Homeland 

Security Management Functions

Page 189 GAO-19-157SP High-Risk Series 

prioritize initiatives as needed, and communicate to senior leadership 

critical resource gaps;

• continue to implement its plan for addressing this high-risk area and 

periodically provide assessments of its progress to us and Congress;

• closely track and independently validate the effectiveness and 

sustainability of its corrective actions, and make midcourse adjustments 

as needed; and 

• make continued progress in achieving the 13 outcomes it has not fully 

addressed and demonstrate that systems, personnel, and policies are in 

place to ensure that progress can be sustained over time.

DHS Acquisitions: Additional Practices Could Help Components Better 

Develop Operational Requirements. GAO-18-550 Washington, D.C.: 

August 8, 2018. 

Homeland Security Acquisitions: Leveraging Programs’ Results Could 

Further DHS’s Progress to Improve Portfolio Management. 

GAO-18-339SP Washington, D.C.: May 17, 2018.

Cybersecurity Workforce: Urgent Need for DHS to Take Actions to 

Identify Its Position and Critical Skill Requirements. GAO-18-175, 

Washington, D.C.: February 6, 2018.

DHS Financial Management: Better Use of Best Practices Could Help 

Manage System Modernization Project Risks. GAO-17-799 Washington, 

D.C.: September 26, 2017.

Homeland Security: Progress Made to Implement IT Reform, but 

Additional Chief Information Officer Involvement Needed. GAO-17-284 

Washington, D.C.: May 18, 2017.

Homeland Security Acquisitions: Identifying All Non-Major Acquisitions 

Would Advance Ongoing Efforts to Improve Management. GAO-17-396 

Washington, D.C.: April 13, 2017.

Homeland Security Acquisitions: Earlier Requirements Definition and 

Clear Documentation of Key Decisions Could Facilitate Ongoing 

Progress. GAO-17-346SP Washington, D.C.: April 6, 2017.

Related GAO 

Products
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 190 GAO-19-157SP High-Risk Series 

Agencies within this portfolio of programs have made some progress towards ensuring the effective protection 

of technologies, but several areas remain unaddressed including improved interagency coordination.

Since our 2017 High-Risk Report, 

ratings for all five criteria remain 

unchanged. 

Additional leadership commitment 

is still needed to promote 

interagency collaboration across 

the portfolio of critical technology 

programs. Officials at both the 

multi-agency Committee on 

Foreign Investment in the United 

States and the Department of 

Defense’s National Industrial 

Security Program need to take 

action to clarify resource needs. 

Additional efforts are also needed 

to implement recommendations we made in March 2012, May 2017, and 

August 2017 to develop and track metrics to monitor program 

performance for both export controls and other programs. Over the years 

since this area was added to the High-Risk List, we have made numerous 

recommendations related to this high-risk issue, 16 of which were made 

since the last high-risk update in February 2017. As of December 2018, 

25 recommendations are open. 

Export Controls

Since our 2017 High-Risk Report, ratings 

for all five criteria remain unchanged.

Leadership commitment: met. An 

interagency review to fundamentally reform 

the U.S. export control system—the Export 

Control Reform Initiative—was established 

in 2010, and it has demonstrated strong 

leadership commitment. Many of the actions 

under this initiative are complete, and 

leaders at key federal agencies continue to 

focus on remaining steps.

Ensuring the Effective Protection of 

Technologies Critical to U.S. National 

Security Interests

Why Area Is High Risk

The Department of Defense spends 

billions of dollars each year to develop 

and acquire sophisticated technologies 

that provide an advantage for the 

warfighter during combat or other 

missions. Many of these technologies 

are also sold or transferred to promote 

U.S. economic, foreign policy, and 

national security interests. These 

technologies can also be acquired by 

foreign entities through investment in the 

U.S. companies that develop or 

manufacture them. In addition, they are 

targets for unauthorized transfer, such as 

theft, espionage, reverse engineering, 

and illegal export. 

To identify and protect technologies 

critical to U.S. interests, the U.S. 

government has a number of programs 

and activities. These include export 

controls—those developed to regulate 

exports and ensure that items and 

information are transferred to foreign 

parties consistent with U.S. interests—as 

well as other activities, including the 

Foreign Military Sales program, antitamper policies, the National Industrial 

Security Program, and the Committee on 

Foreign Investment in the United States. 

These activities are administered by 

multiple federal agencies, including the 

Departments of Defense, Commerce, 

Homeland Security, Justice, State, and 

the Treasury. We designated this area 

as high risk in 2007 because these 

programs, established decades ago, 

were ill-equipped to address the evolving 

21st century challenge of balancing 

national security concerns and economic 

interests.

Contact Information

For additional information about this 

high-risk area, contact William T. Woods 

at (202) 512-4841 or woodsw@gao.gov. 
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 191 GAO-19-157SP High-Risk Series 

Capacity: partially met. The initial review of all 21 United States 

Munitions List categories is nearing completion and the transition to a 

single information technology system—USXPORTS—is complete. 

However, the absence of key stakeholders’ participation has slowed

progress for other efforts. The 15 federal agencies that are part of the 

Export Enforcement Coordination Center (E2C2) continue to coordinate 

and exchange investigation-related information, but according to E2C2 

officials, procedures for coordination between the investigative export 

control enforcement agencies and the intelligence community have not 

been finalized. 

Action plan: met. While the Export Control Reform Initiative is no longer 

formally active, leaders at key federal agencies told us they continue to 

implement efforts under the initiative—with reforms to export control lists, 

enforcement, and information technology.

Monitoring: partially met. We made four recommendations in March 

2012 that departments with responsibilities for export control enforcement 

take steps to more effectively monitor resources spent on export control 

enforcements activities, and develop and implement metrics for 

monitoring their effectiveness. Of the four recommendations, one remains 

open: for Homeland Security to establish procedures to facilitate data 

sharing between the enforcement agencies and the intelligence 

community to measure illicit transshipment activity. Homeland Security 

officials told us that the department has not yet formalized its planned 

intelligence analytical unit and, as a result, is unable to establish baseline 

and trend data analysis.

Demonstrated progress: partially met. Important steps have been 

completed for improving the efficiency and effectiveness of the export 

control process. For example, the export control licensing agencies have 

reviewed all of the 21 United States Munitions List categories to 

determine which items in those categories should remain under 

Department of State control or move to Department of Commerce control. 

According to State Department officials, the public comment period ended

in July 2018 for categories I-III (firearms, artillery, and ammunition, 

respectively), and a final decision on transfer of these items is expected in 

2019. 

In March 2019, we expect to issue a report reviewing export controls of 

firearms. Progress in export enforcement has stalled, however, because 

the enforcement and intelligence communities have not yet formally 

coordinated, and the E2C2 does not yet have a designated Intelligence 

Community Liaison. This liaison was mandated by Executive Order 

13558, which directed the establishment of the E2C2 and identified the 

participating departments and agencies. Specifically, the E2C2 has not 

yet implemented all seven of its standard operating procedures, including 
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 192 GAO-19-157SP High-Risk Series 

collaboration with the intelligence agencies. According to Homeland 

Security officials, currently the E2C2 is performing only de-confliction, a 

forum for sharing information among multiple export enforcement 

agencies and identifying and resolving conflicts between them.

The need for action remains in addressing Capacity, Monitoring, and 

Demonstrated Progress. The E2C2 is performing a critical role in 

coordinating export control enforcement activities, with participation 

across a wide breadth of federal agencies. However, according to 

Homeland Security officials, the E2C2 and the intelligence community’s 

lack of formal coordination limits E2C2’s effectiveness, stalling its efforts 

to develop standard operating procedures. Until this coordination occurs, 

the E2C2 is limited in its ability to realize its full potential to facilitate 

enhanced coordination and intelligence sharing. 

Key agencies have taken necessary steps to reconcile various definitions, 

regulations, and policies for export controls. If the agencies choose to 

proceed with consolidation activities initially planned under the 2010 

Export Control Reform Initiative, Congressional action will be required. 

For example, because there are currently separate statutory bases for the 

Departments of State and Commerce to review and issue export licenses, 

legislation would be required to consolidate the current system into a 

single licensing agency. 

Since our 2017 High-Risk Report, ratings for 

all five criteria remain unchanged. This 

segment was previously referred to as nonexport controls. 

Leadership commitment: partially met. 

Recent Congressional action may facilitate 

forward movement in this area. The John S. 

McCain National Defense Authorization Act 

for Fiscal Year 2019 included a requirement 

for the Department of Defense (DOD) to 

develop and annually update a critical 

technologies list, which has the potential to improve coordination among 

the critical technology programs. The act also made changes related to 

the Committee on Foreign Investment in the United States, an 

interagency group that reviews certain foreign acquisitions, mergers, or 

takeovers of U.S. businesses to determine their effects on U.S. national 

security.

Capacity: partially met. In February 2018, we reported on capacity 

concerns at the Committee on Foreign Investment in the United States, 

What Remains to Be Done

Congressional Actions Needed

Other Programs
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 193 GAO-19-157SP High-Risk Series 

noting that from 2011 to 2016, the number of transactions reviewed by 

this committee grew by 55 percent, while the staff assigned to the reviews 

increased by 11 percent. In the John S. McCain National Defense 

Authorization Act for Fiscal Year 2019, Congress cited our findings and 

provided for actions such as assessing whether adequate resources are 

needed for the committee and its member agencies. Likewise, in May 

2018, we reported that officials responsible for the National Industrial 

Security Program—which safeguards federal government classified 

information that current or prospective contractors may access—faced 

resource challenges, including an inability to manage staff workloads and 

complete necessary trainings. We recommended that they identify the 

resources needed by the program, among other things, and DOD 

concurred.

Action plan: partially met. In May 2018, we reported on Defense 

Security Service plans to transition to a new approach for the National 

Industrial Security Program. We cited challenges that the program is 

beginning to address. Similarly, we reported in May 2017 that DOD has 

issued policies and guidance that require planning for anti-tamper 

protections—which help preserve U.S. technological superiority from 

exploitation when weapon systems are lost on the battlefield or 

exported—early in the weapon system acquisition process.

Monitoring: partially met. In May 2017, we reported that DOD lacked 

metrics for tracking the effectiveness of changes to policies and 

procedures supporting anti-tamper protections. DOD concurred with our 

recommendation that it determine how to measure progress and develop 

corresponding metrics but has not yet done so. Similarly, in August 2017, 

we found that DOD had addressed most of our past recommendations on 

the Foreign Military Sales program, but had not collected relevant data 

necessary to measure program performance.

Demonstrated progress: partially met. We reported in 2015 that the

portfolio of critical technology programs is fragmented and poorly 

coordinated across the government. Individual programs and 

departments have taken steps to improve coordination individually within 

their agency or program, but collective coordination across the critical 

technologies portfolio still needs improvement and overall direction.

The need for action remains both at the individual program level and the 

portfolio level. In February 2015, we made recommendations aimed at 

improving coordination among the programs that are designed to protect 

technologies critical to national security. While progress has been made, 

challenges remain in several key areas. In particular, following up on 

resource recommendations to the Committee on Foreign Investment in 

the United States and the National Industrial Security Program could lead 

What Remains to Be Done
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 194 GAO-19-157SP High-Risk Series 

to significant improvements in capacity. Similarly, following up on data 

collection and tracking recommendations for the anti-tamper program and 

the Foreign Military Sales program could better enable these programs to 

monitor their efforts.

Committee on Foreign Investment in the United States: Action Needed to 

Address Evolving National Security Concerns Facing the Department of 

Defense. GAO-18-494. Washington, D.C.: July 10, 2018.

Defense Industrial Base: Integrating Existing Supplier Data and 

Addressing Workforce Challenges Could Improve Risk Analysis. 

GAO-18-435. Washington, D.C.: June 13, 2018.

Protecting Classified Information: Defense Security Service Should 

Address Challenges as New Approach Is Piloted. GAO-18-407. 

Washington, D.C.: May 14, 2018.

Committee on Foreign Investment in the United States: Treasury Should 

Coordinate Assessments of Resources Needed to Address Increased 

Workload. GAO-18-249. Washington, D.C.: February 14, 2018.

Foreign Military Sales: DOD Needs to Improve Its Use of Performance 

Information to Manage the Program. GAO-17-703. Washington, D.C.: 

August 22, 2017.

DOD Critical Technologies: Additional Actions Needed to Ensure 

Consistent Protection of Weapon Systems. GAO-17-292SU. Washington, 

D.C.: May 9, 2017.

Critical Technologies: Agency Initiatives Address Some Weaknesses, but 

Additional Interagency Collaboration Is Needed. GAO-15-288. 

Washington, D.C.: February 10, 2015.

Related GAO 

Products
Improving Federal Oversight of Food Safety

Page 195 GAO-19-157SP High-Risk Series 

A government-wide approach is needed to address fragmentation in the federal food safety oversight system.

Since our 2017 High-Risk Report, 

ratings for all five criteria remain 

unchanged.

Leadership commitment: 

partially met. The Department of 

Health and Human Services (HHS) 

demonstrated leadership by 

updating its strategic and 

performance-planning documents 

to better address crosscutting food 

safety efforts, as we recommended 

in December 2014. As of 

November 2018, however, the U.S. 

Department of Agriculture (USDA) 

had not fully implemented our 

recommendation to update its strategic and planning documents, 

although it agreed with our recommendation and took some steps to 

implement it. Moreover, in June 2018, the President proposed 

reorganizing USDA’s Food Safety and Inspection Service and the food 

safety functions of HHS’s Food and Drug Administration into a single 

agency. While a reorganization could be a step toward addressing our 

prior recommendations, additional information about the proposal, as well 

as additional executive and legislative branch actions, would be needed 

before such a proposal could be implemented.

Capacity: partially met. USDA has the capacity to more fully address 

crosscutting food safety efforts in its individual strategic and performance 

planning documents; however, Office of Management and Budget (OMB) 

action would be needed to build on HHS and USDA documents to 

develop a government-wide performance plan on food safety. Such action 

could address our March 2011 recommendation for a government-wide 

plan and our December 2014 matter for congressional consideration for 

government-wide planning. OMB has not taken action to develop such a 

plan.

Federal food safety agencies also have the capacity to participate in a 

centralized collaborative mechanism on food safety, such as the Food 

Safety Working Group (FSWG), which the President established in 2009 

to coordinate federal food safety efforts. This group, however, is no longer 

meeting. Congressional action would be required to formalize such a 

mechanism through statute.

Improving Federal Oversight of Food Safety

Why Area Is High Risk

The safety and quality of the U.S. food 

supply, both domestic and imported, are 

governed by a highly complex system 

stemming from at least 30 federal laws 

that are collectively administered by 15

federal agencies. For more than four 

decades, we have reported on the 

fragmented federal food safety oversight 

system, which has caused inconsistent 

oversight, ineffective coordination, and 

inefficient use of resources. We added 

federal oversight of food safety to the 

High-Risk List in 2007. In recent years, 

moreover, we have made 

recommendations aimed at helping to 

reduce fragmentation in federal food 

safety oversight. As of November 2018, 

two of three recommendations related to 

this high-risk area had not been 

implemented. 

A 2011 estimate by the Centers for 

Disease Control and Prevention (CDC)—

its most recent estimate—indicates that, 

as a result of foodborne illness, roughly 1 

in 6 Americans (48 million people) gets 

sick each year, 128,000 are hospitalized, 

and 3,000 die. CDC data also show that 

the number of reported multistate 

foodborne illness outbreaks is 

increasing. Although multistate 

outbreaks make up a small proportion of 

total outbreaks, they affect greater 

numbers of people. CDC cites several 

potential contributors to the increase in 

reported multistate outbreaks, including 

greater centralization of food processing 

practices, wider food distribution, and 

improved detection and investigation 

methods.

Contact Information

For additional information about this 

high-risk area, contact Steve Morris at 

morriss@gao.gov or (202) 512-3841.
Improving Federal Oversight of Food Safety

Page 196 GAO-19-157SP High-Risk Series 

Action plan: not met. Without a government-wide performance plan for 

food safety, Congress, program managers, and other decision makers 

are hampered in their ability to identify agencies and programs 

addressing similar missions and to set priorities, allocate resources, and 

restructure federal efforts, as needed, to achieve long-term goals. 

Moreover, without a centralized collaborative mechanism—like the 

FSWG—to address food safety, there is no forum for agencies to reach 

agreement on a set of broad-based food safety goals and objectives that 

could be articulated in a government-wide performance plan on food 

safety. 

Development of a national strategy for food safety could also fulfill these 

government-wide planning and leadership needs. Such a strategy should, 

among other things, have a clearly stated purpose, establish sustained 

leadership, identify resource requirements, and describe how progress 

will be monitored. 

Monitoring: not met. Without a government-wide performance plan for 

food safety, federal food safety efforts are not clear and transparent to the 

public. Congress, program managers, other decision makers, and the 

public must first understand what the federal government is currently 

doing to ensure the safety of the food supply. To do so, they must access, 

attempt to make sense of, and reconcile individual documents across the 

many federal agencies responsible for administering the numerous 

federal statutes governing food safety and quality. A government-wide 

performance plan would also enable Congress and the agencies to 

monitor the effectiveness of their food safety programs, particularly those 

involving more than one agency, and call attention to areas needing 

corrective measures. The need for government-wide monitoring could 

also be addressed through a national strategy for food safety. 

Demonstrated progress: partially met. In January 2018, USDA and 

FDA signed an agreement to formalize ongoing coordination and 

collaboration efforts in the areas of produce safety and regulation of 

biotechnology products and other areas. This agreement is a positive 

step. However, the development of a broader government-wide 

performance plan or a national strategy for food safety is still needed and 

could involve additional agencies, such as those that we have previously 

identified as having a role in food safety. These other agencies include (1) 

the Centers for Disease Control and Prevention, which is responsible for 

preventing the transmission, dissemination, and spread of foodborne 

illness to protect the public health; (2) the Department of Commerce’s 

National Marine Fisheries Service, which provides voluntary fee-forservice examinations of seafood for safety and quality; and (3) the 

Department of Homeland Security’s Customs and Border Protection, 

which, among other things, inspects imports, including food products, 

plants, and live animals, for compliance with U.S. law and assists all 

federal agencies in enforcing their regulations at the border. Such a 
Improving Federal Oversight of Food Safety

Page 197 GAO-19-157SP High-Risk Series 

document could also more comprehensively fulfill government-wide 

planning and leadership needs and foster sustained progress in 

addressing fragmentation in the federal food safety oversight system.

Actions are needed to address this high-risk area. Specifically:

• As we recommended in January 2017, the appropriate entities within the 

Executive Office of the President (EOP), in consultation with relevant 

federal agencies and other stakeholders, should develop a national 

strategy for food safety that, among other things, establishes sustained 

leadership, identifies resource requirements, and describes how progress 

will be monitored. The EOP did not provide comments on our 

recommendation. 

• USDA should implement our priority recommendation to more fully 

implement GPRA Modernization Act of 2010 requirements by providing in 

its strategic and performance planning documents additional detail on 

interagency food safety-related collaborations, as we recommended in 

December 2014. USDA agreed with this recommendation.

Congress should consider directing OMB to develop a government-wide 

performance plan for food safety that includes results-oriented goals, 

performance measures, and a discussion of strategies and resources. 

Congress should also consider formalizing the Food Safety Working 

Group through statute to help ensure sustained leadership across food 

safety agencies over time. In addition, if weaknesses in the food safety 

system persist over the next several years, Congress may wish to 

consider commissioning a detailed analysis of alternative organizational 

structures for food safety.

Food Safety: Federal Efforts to Manage the Risk of Arsenic in Rice. 

GAO-18-199. Washington, D.C.: March 16, 2018.

Imported Seafood Safety: FDA and USDA Could Strengthen Efforts to 

Prevent Unsafe Drug Residues. GAO-17-443. Washington, D.C.: 

September 15, 2017.

Food Safety: A National Strategy Is Needed to Address Fragmentation in 

Federal Oversight. GAO-17-74. Washington, D.C.: January 13, 2017.

Food Safety: FDA Coordinating with Stakeholders on New Rules but 

Challenges Remain and Greater Tribal Consultation Needed. 

GAO-16-425. Washington, D.C.: May 19, 2016.

Federal Food Safety Oversight: Additional Actions Needed to Improve 

Planning and Collaboration. GAO-15-180. Washington, D.C.: December 

18, 2014.

What Remains to Be Done

Congressional Actions Needed

Related GAO 

Products
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 198 GAO-19-157SP High-Risk Series 

The Food and Drug Administration (FDA) needs to increase monitoring of medical products manufactured 

overseas and improve planning for drug shortages. 

Since our 2017 High-Risk Report, 

our assessment of efforts to 

address ratings for all five criteria 

remains unchanged. FDA 

continues to demonstrate top 

leadership support for improving 

its oversight of medical products 

for both the globalization and 

drug availability segments. 

However, the agency has not fully 

met the remaining criteria. 

While the overall rating has not 

changed, FDA has now met the 

capacity criterion for the 

globalization segment, as FDA 

increased inspections of foreign manufacturers. However, FDA must 

continue to take actions to monitor foreign establishments and its foreign 

offices to meet the criterion for demonstrating progress.

In addition, while the overall rating has not changed, FDA now meets the 

monitoring criterion for the drug availability segment, as it has 

implemented and consistently used a new drug shortages information 

system and established procedures for using this system. FDA also now 

has a procedure to evaluate its response to drug shortages. However, 

FDA’s capacity and lack of an action plan to address drug availability 

remains a challenge, including the agency not using its drug shortage 

information system to also analyze trends and identify patterns to help 

predict future shortages.

Response to Globalization

Since our 2017 High-Risk Report, ratings 

for one criterion improved and four remain 

unchanged. FDA continues to meet the 

leadership commitment and action plan 

criteria, and has now met the criterion for 

capacity. 

Leadership commitment: met. FDA met 

this criterion in 2015. The agency has 

demonstrated leadership commitment by 

(1) creating an office dedicated to 

Protecting Public Health through Enhanced 

Oversight of Medical Products 

Why Area Is High Risk

Millions of medical products—drugs, 

biologics, and medical devices—are 

used daily by Americans at home, in the 

hospital, and in other health care 

settings. FDA has the vital mission of 

protecting the public health by 

overseeing the safety and effectiveness 

of these products marketed in the United 

States. The agency’s responsibilities 

begin long before a product is brought to 

market and continue after FDA approves 

a product, regardless of whether it is 

manufactured in the United States or 

abroad.

In recent years, FDA has been 

confronted with multiple challenges, 

including (1) rapid changes in science 

and technology, (2) globalization as 

more products are manufactured abroad, 

(3) unpredictable public health crises, (4) 

an increasing workload, and (5) the 

continuing need to monitor the safety of 

thousands of marketed medical 

products. The oversight of medical 

products was added to our High-Risk List 

in 2009 because these obstacles 

threatened to compromise FDA’s ability 

to protect public health. While progress 

has been made, challenges remain 

related to FDA’s ability to respond to 

globalization and to help ensure the 

availability of drugs.

Contact Information

For additional information about this 

high-risk area, contact Mary DeniganMacauley or John E. Dicken at (202) 

512-7114 or 

deniganmacauleym@gao.gov or 

dickenj@gao.gov. 
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 199 GAO-19-157SP High-Risk Series 

confronting the challenges of globalization and (2) identifying a goal of 

expanding its regulatory presence and partnerships overseas.

Capacity: met. FDA’s recent actions have met this criterion. Since 2015, 

FDA has consistently conducted an increased number of inspections of 

foreign manufacturers and selected facilities for inspection based on risk. 

In addition, FDA reported in 2018 that it reduced the number of foreign 

drug establishments with no inspection history from approximately 1,000 

to just over 100. Further, the agency has also improved the capacity of its 

overseas offices. Overall vacancy rates for these offices have declined in 

recent years, though significant gaps in staffing still remain at times, while 

staff complete necessary processes to be stationed overseas. FDA also 

signed mutual recognition agreements with many European countries that 

have allowed it to gain capacity by using information from inspectors from 

these countries. 

Action plan: met. FDA met this criterion in 2015. The agency has 

developed an action plan for building a stronger, more secure global 

product safety net. It also developed a plan to partner with other foreign 

regulatory authorities to leverage their resources. FDA has since 

determined that 20 foreign regulators are capable of conducting 

inspections that meet FDA’s requirements, and as of November 13, 2018, 

had reviewed 50 inspections conducted by foreign regulators. 

Monitoring: partially met. In December 2016, we reported that FDA took 

steps to better monitor its program for inspecting foreign and domestic 

establishments. Since then, FDA has taken steps to improve the accuracy 

and completeness of information used for that program. Starting in 2017, 

FDA began an effort to inspect, within 3 years, all establishments for 

which it had no prior history of inspection. FDA has made progress in 

inspecting these sites and expects to complete this task in fiscal year 

2019. FDA has also made progress monitoring the contributions of its 

overseas offices, though it has not fully developed measures that allow it 

to systematically track how office activities contribute to drug safety 

outcomes. 

Demonstrated progress: partially met. FDA has taken a variety of 

steps to respond to globalization, including improving the accuracy and 

completeness of its information on foreign manufacturers, and deciding 

that it will no longer allow more than 5 years to elapse between 

inspections at a specific establishment. However, FDA must continue to 

demonstrate that it can sustain its capacity to conduct more inspections.

Over the years since we added this area to our High-Risk List, we have 

made numerous recommendations related to the agency’s response to 

globalization. As of December 2018, two recommendations remain open. 

What Remains to Be Done
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 200 GAO-19-157SP High-Risk Series 

FDA should implement our recommendations to (1) develop performance 

measures and (2) assess the effectiveness of the foreign offices’ 

contributions by systematically tracking information to measure whether 

the offices’ activities specifically contribute to drug safety-related 

outcomes, such as inspecting facilities, issuing import alerts to block 

potentially dangerous products, and sending warning letters to 

manufacturers with significant regulatory violations. In addition to our two 

open recommendations, FDA should complete its efforts to inspect all 

establishments without an inspection history and ensure all 

establishments continue to be inspected at an appropriate frequency. 

Since our 2017 High-Risk Report, ratings 

for one criterion improved and four remain 

unchanged. FDA continues to meet the 

criteria of leadership commitment and has 

now met the criterion for monitoring. 

Leadership commitment: met. In the 

2015 High-Risk Report, we recognized 

FDA demonstrated leadership 

commitment by issuing a strategic plan for 

preventing and mitigating drug shortages, 

and also by including the agency’s ability 

to respond to drug shortages in its strategic priorities. FDA’s commitment 

to addressing this public health concern continues to be strong, as 

evidenced by its recent formation of a drug shortages task force. The task 

force is charged with delving more deeply into the reasons for persistent 

shortages and seeking solutions to address their underlying causes. FDA 

also held a public meeting in November 2018 to obtain advice from 

stakeholders on ways to avert drug shortages. 

Capacity: partially met. As noted in prior years, FDA improved its 

capacity to respond to drug shortages by increasing the number of 

dedicated personnel devoted to responding to drug shortages and 

prioritized its review of applications to market generic drugs. However, 

with the median time to approve prioritized generic drug applications at 

over a year, this approach is not an effective short-term solution. 

While FDA is taking steps to address drug shortages, it is important to 

recognize that FDA cannot resolve them alone. In the past 2 years, 

several agency actions may help support industry’s capacity to prevent or 

mitigate shortages related to manufacturing problems. First, using the 

authority it was given in 2016 through the 21st Century Cures Act, FDA 

has awarded research grants to several universities to study continuous 

manufacturing. This approach has the potential to shorten production 

times and improve the efficiency of manufacturing processes. Second, 

Drug Availability
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 201 GAO-19-157SP High-Risk Series 

FDA established its Emerging Technology Program to help encourage the 

industry to develop new technologies that may improve manufacturing

and reduce the chance of supply disruptions. Through the program, 

industry representatives can meet with FDA staff to discuss potential 

concerns related to these new technologies, such as the development of 

ultra-long-acting oral formulations, before seeking agency approval.

However, according to FDA officials, the agency may not have sufficient 

resources available to ensure the availability of drugs more broadly. 

Specifically, in 2017, FDA noted that its resources to conduct its over-thecounter drug responsibilities were inadequate. A lengthy regulatory 

process has hindered the availability of new drug ingredients to the U.S. 

market, such as those included in sunscreen. Consequently, the agency 

noted that it has not allowed the marketing of many new over-the-counter 

drugs, or made timely changes to existing over-the-counter drugs based 

on emerging safety issues or evolving science.

Action plan: partially met. FDA implemented a new data system in 2016 

to track potential and existing drug shortages and manage its workload. 

While it uses this system for monitoring, FDA has not made plans to use 

these data to analyze trends or identify patterns to help predict future 

shortages to assist with managing efforts. The formation of FDA’s new 

drug shortages task force may provide the opportunity to plan future 

actions strategically. According to FDA, the task force will evaluate the 

reimbursement policies of the Centers for Medicare & Medicaid Services 

and other payers that could be making it difficult for companies to

manufacture certain drugs profitably. It is also exploring ways to receive 

more timely information about potential supply disruptions. 

Nonetheless, FDA still needs to take actions to address shortcomings in 

its broader strategic planning efforts related to its oversight of drugs and 

other medical products. Also, in May 2016, we found weaknesses in the 

agency’s lack of measurable goals for advancing regulatory science—the 

science supporting its effort to assess the safety, efficacy, quality, and 

performance of the products it regulates. 

Monitoring: met. FDA has met this criterion through its recent actions. In 

June 2017, we determined while following up on open recommendations 

that FDA was consistently using its new drug shortage information system 

to track potential and existing shortages. This system remains in use for 

monitoring purposes. In addition, the agency established formal 

procedures for using the system and performance measures to evaluate 

its ability to respond when shortages occur. Also, in June 2018, FDA 

issued its annual report on drug shortages. This report contained a full 

year’s worth of data and provided policymakers with the ability to more 

closely monitor shortage information and obtain a more realistic view of 

this public health problem. 
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 202 GAO-19-157SP High-Risk Series 

Demonstrated progress: partially met. FDA has implemented some of 

our recommendations, including consistently using its drug shortage 

information system to improve its ability to respond to drug shortages. 

However, drug shortages remain a public health concern and FDA has 

not fully addressed the recommendations that we have made, such as 

periodically analyzing its shortage data to proactively identify risk factors, 

and better collecting, tracking, and analyzing data related to safety of 

drugs after they are marketed. 

Over the years since we added this area to our High-Risk List, we have 

made numerous recommendations related to drug availability, 5 of which 

were made since the last high-risk update in February 2017. As of 

December 2018, 12 recommendations remain open. Although FDA alone 

cannot guarantee drug availability, the agency can take important steps to 

help ensure that safe and effective drugs are accessible to patients. FDA 

should implement our recommendations, including to:

• conduct periodic analyses to assess drug shortage information to 

proactively identify risk factors for potential drug shortages;

• develop comprehensive plans, including goals and time frames, to 

correct problems with its data for monitoring safety after a product is on 

the market, and ensure that these data can be easily used for oversight;

• plan strategically to identify challenges that cut across FDA’s multiple 

centers that oversee medical products, and document how the agency 

will achieve measurable goals and objectives in these areas; and

• develop and document measurable goals, such as targets and time 

frames, for FDA’s regulatory science efforts so it can consistently assess 

and report on the agency's progress in regulatory science efforts.

Generic Drugs: FDA Should Make Public Its Plans to Issue and Revise 

Guidance on Nonbiological Complex Drugs. GAO-18-80. Washington, 

D.C.: December 14, 2017.

Sunscreen: FDA Reviewed Applications for Additional Active Ingredients 

and Determined More Data Needed. GAO-18-61. Washington, D.C.: 

November 15, 2017. 

Investigational New Drugs: FDA Has Taken Steps to Improve the 

Expanded Access Program but Should Further Clarify How Adverse 

Events Data Are Used. GAO-17-564. Washington, D.C.: July 11, 2017.

Generic Drug User Fees: Application Review Times Declined, but FDA 

Should Develop a Plan for Administering Its Unobligated User Fees. 

GAO-17-452. Washington, D.C.: May 25, 2017.

What Remains to Be Done

Related GAO 

Products
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 203 GAO-19-157SP High-Risk Series 

Antibiotics: FDA Has Encouraged Development, but Needs to Clarify the 

Role of Draft Guidance and Develop Qualified Infectious Disease Product 

Guidance. GAO-17-189. Washington, D.C.: January 31, 2017.

Drug Safety: FDA Has Improved Its Foreign Drug Inspection Program, but 

Needs to Assess the Effectiveness and Staffing of Its Foreign Offices. 

GAO-17-143. Washington, D.C.: December 16, 2016.

Drug Shortages: Public Health Threat Continues, Despite Efforts to Help 

Ensure Product Availability. GAO-14-194. Washington, D.C.: February 

10, 2014.
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 204 GAO-19-157SP High-Risk Series 

The Environmental Protection Agency (EPA) has taken steps to manage chemicals that pose risks to human 

health and the environment, but leadership and implementation challenges remain. 

Since our 2017 High-Risk Report, 

four criteria remain unchanged. 

However, the leadership 

commitment rating decreased from 

met to partially met in 2019. 

For more information on EPA’s 

recent progress toward producing 

chemical assessments and 

implementing TSCA, see our 

March 2019 chemical assessments 

report GAO-19-270.

Integrated Risk Information System (IRIS) 

Since our 2017 High-Risk Report, ratings 

for capacity, action plan, monitoring, and 

demonstrated progress remain 

unchanged. However, the rating for 

leadership commitment declined to 

partially met. 

Leadership commitment: partially met. 

This rating has declined from met in 2017. 

In our 2017 High-Risk Report, we reported 

that the EPA Administrator demonstrated 

leadership commitment to the IRIS 

Program by identifying action on toxics and chemical safety as one of her 

top seven priorities for the agency—priorities that included the IRIS 

Program. However, current EPA leadership has not made a similar 

statement. While EPA released a document in late December 2018 called 

the IRIS Program Outlook, identifying ongoing chemical assessments, 

EPA leadership also proposed significant cuts to the program’s budget. 

For the past two years, EPA’s budget justification for human health risk 

assessment work was reduced to about $22 million from its fiscal year 

2017 budget of $40.5 million, contributing to a lower rating than we gave 

in 2017. Congress did not support these reductions. Specifically, 

according to the joint explanatory statements accompanying the 

Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Why Area Is High Risk

EPA’s ability to effectively implement its 

mission of protecting public health and 

the environment is dependent on 

assessing the risks posed by chemicals 

in a credible and timely manner. Such 

assessments are the cornerstone of 

scientifically sound environmental 

decisions, policies, and regulations 

under a variety of statutes, such as the 

Safe Drinking Water Act and the Clean 

Air Act. EPA prepares assessments of 

chemical hazards to human health under 

its IRIS Program, among others. The 

importance of IRIS has increased over 

time as EPA program offices and regions 

have relied on the program’s toxicity 

assessments in making environmental 

protection and risk management 

decisions.

EPA is also authorized under TSCA to 

obtain information on the risks of 

chemicals and to control chemicals the 

agency determines pose an 

unreasonable risk. This act was 

amended in 2016 by the Frank R. 

Lautenberg Chemical Safety for the 21st 

Century Act. The Lautenberg Act 

provides EPA with greater authority to 

address chemical risks, but 

implementation will take years because 

of the complexity and scope of the 

legislation. 

Because EPA had not developed 

sufficient chemical assessment 

information under these programs to limit 

exposure to many chemicals that may 

pose substantial health risks, we added 

this issue to the High-Risk List in 2009 

as a government program in need of 

broad-based transformation. 

Contact Information

For additional information about this 

high-risk area, contact J. Alfredo Gómez 

at (202) 512-3841 or gomezj@gao.gov . 
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 205 GAO-19-157SP High-Risk Series 

Consolidated Appropriations Act, 2018, and Consolidated Appropriations 

Act, 2019, Congress has agreed to continue providing funding at fiscal 

year 2017 enacted levels. 

EPA leadership’s long-term accountability for actions has been limited, as 

demonstrated by four IRIS assessments that were in the later stages of 

development on the 2015 Multi-Year agenda but have not been released, 

or included on the December 2018 list of assessments. EPA provided no 

information on the status of these assessments or whether it plans to 

discontinue working on them or restart them at another time. As we have 

previously reported, an overarching factor that affects EPA’s ability to 

complete IRIS assessments in a timely manner is that once a delay in the 

assessment process occurs, work that has been completed can become 

outdated, necessitating rework throughout some or all of the assessment 

process. Thus, it remains to be seen when these assessments can be 

expected to move to the next step in the IRIS process or be completed. 

Capacity: partially met. As our March 2019 chemical assessments 

report indicates, the IRIS program has made progress in addressing 

some challenges to its assessment process, including adopting project 

management principles, and new software; streamlining the peer review 

process; implementing systematic review; and making changes to the 

frequency and type of communication, among others. It will take 

resources to implement all of these process improvements. We will 

continue to monitor EPA’s efforts and assess the progress the agency is 

making. Our previous work has shown that decision makers in the United 

States and around the world rely on information from IRIS assessments. 

Because of this key role, we are concerned that without adequate 

funding, untimely implementation of IRIS assessments could have 

profound impacts on chemical risk management activities. 

Action plan: partially met. As we reported in our 2017 High-Risk Report, 

EPA had not evaluated the demand for IRIS toxicity assessments with 

input from users inside and outside EPA. EPA issued an IRIS Multi-Year 

Agenda in December 2015. According to EPA, the purpose of the 2015 

agenda was to: (1) identify IRIS assessments currently under way and 

their status; (2) prioritize IRIS assessments that will be initiated over the 

next few years; and (3) evaluate assessment needs and develop an 

updated process for existing IRIS values. In December 2018, EPA issued 

the IRIS Program Outlook, but it was missing some key information. The 

Outlook identifies assessments currently underway and lists the next 

anticipated step in the IRIS process. However, the Outlook fails to list the 

projected date for most of the assessments and includes no information 

regarding assessment prioritization—including how these assessments 

will meet program and regional office needs. Moreover, we recommended 

in May 2013 that EPA should develop an Action Plan or strategy, among 

other things, to address the needs of EPA program offices and regions 
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 206 GAO-19-157SP High-Risk Series 

when IRIS toxicity assessments are not available; the agency is still 

working to do so. 

Monitoring: met. The IRIS Program produced a report to Congress, 

which offered an overview of progress in January 2018, and took part in a 

National Academies of Sciences (NAS) review of the program in February 

2018, which offered a third-party assessment of the program’s efforts. 

The resulting NAS report provided a supportive assessment of ongoing 

transformations aimed at ensuring data quality, new systematic 

approaches for data analysis and expanded stakeholder engagement 

efforts, and increasing efficiency of assessments. According to the report, 

NAS reviewers were impressed with the changes being instituted in the 

IRIS Program since 2014, including substantive reforms by new IRIS 

Program leadership, such as the development, implementation, and use 

of systematic review methods to conduct IRIS assessments. For EPA to 

sustain the rating for the monitoring criterion, the agency will need to 

provide clear milestones and metrics for its action plan and monitor 

progress toward them.

Demonstrated progress: partially met. EPA provided a list of chemicals

in the December 2018 IRIS Program Outlook. However, it is not clear 

what data and priorities EPA used to establish its current priorities or 

when it will assign time frames and future resources to ensure sustained 

performance. For example, according to the 2015 IRIS Multi-Year 

Agenda, the formaldehyde assessment was being revised to incorporate 

elements of systematic review and was to be released for public comment 

and external peer review. However, the December 2018 IRIS Program 

Outlook does not list the formaldehyde assessment and provides no 

explanation of why the assessment was not included. The IRIS Program 

issued an assessment of Hexahydro-1,3,5-trinitro-1,3,5-triazine (RDX) in 

August 2018, although it took almost 2 decades. 

Since we added the IRIS Program to our High-Risk List in 2009, we have 

made nine recommendations related to the IRIS segment of this high-risk 

issue. As of mid-February 2019, six recommendations remain open. EPA 

will need to implement these recommendations, along with meeting the 

High-Risk criteria discussed above, to make progress. As noted in several 

of our recommendations, EPA should, among other things:

• Assess the feasibility and appropriateness of the established time frames 

for each step in the IRIS assessment process, including whether different 

time frames should be established for different types of IRIS 

assessments. 

• Publish IRIS agendas on which chemicals EPA is actively assessing and 

when it plans to start assessments of the other listed chemicals to 

demonstrate progress.

What Remains to Be Done
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 207 GAO-19-157SP High-Risk Series 

• Develop a strategy to address the needs of EPA Program Offices and 

regions when IRIS toxicity assessments are not available. 

In addition, our March 2019 chemical assessments report provides 

information on what remains to be done to address challenges, (e.g. 

producing assessments) in the IRIS Program.

EPA and Congress should continue to ensure that the resources 

dedicated to IRIS are sufficient to implement it and to maintain a viable 

database of chemical assessments. 

Since our 2017 High-Risk Report, ratings for 

capacity, monitoring, and demonstrated 

progress progressed to partially met. The 

rating for leadership commitment remains 

unchanged at met and for action plan at 

partially met. 

Leadership commitment: met. In January 

2019, the Acting Administrator indicated his 

commitment to fulfill EPA obligations under 

TSCA. He stated that EPA had, among 

other things, released guidance and policy 

on confidential business information, a strategy to reduce animal testing, 

and a final mercury reporting rule. In addition, EPA's First Year 

Implementation Plan identified actions taken to meet the deadlines in the 

new law, such as (1) identifying the initial 10 work plan chemicals to be 

assessed under TSCA, (2) establishing a process and criteria for 

identifying high-priority chemicals for risk evaluation under TSCA, and (3) 

issuing a rule that establishes EPA’s process for evaluating risks from 

high-priority chemicals under TSCA. 

Further, as of December 2018, EPA had implemented two of our 

recommendations made in 2013 regarding TSCA. As we elaborate in our

March 2019 chemical assessments report, EPA has encountered some 

challenges in implementing the Lautenberg Act and as of mid-February 

2019, several lawsuits were pending. In our chemical assessments 

report, we discuss, for example, EPA's capacity to implement the 

program, collect appropriate fees, and demonstrate progress. How EPA 

addresses these matters will be key to continuing to meet the leadership 

criterion in the future. 

Capacity: partially met. The Lautenberg Act provides EPA with greater 

authority to address chemical risks, but in turn increases both EPA’s 

responsibility for regulating chemicals and its workload. EPA recently 

issued a rule under the act to collect fees from certain companies to 

defray a portion of TSCA implementation costs, but it is unclear whether 

Congressional Actions Needed

Toxic Substances 

Control Act (TSCA)
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 208 GAO-19-157SP High-Risk Series 

the fees collected will be sufficient to support relevant parts of the 

program. According to EPA, the agency will be tracking its costs and use 

that information to adjust future fees, if appropriate. As required by law, 

EPA will evaluate and readjust, if necessary, the fees every 3 years. 

Action plan: partially met. EPA’s strategic plan discusses general 

approaches for meeting statutory requirements and mandatory deadlines 

of TSCA. EPA issued a First Year Implementation Plan in June 2016 

noting that this document is intended to be a roadmap of major activities 

EPA will focus on during the initial year of implementation. As of midFebruary 2019, the plan had not been updated, although EPA had 

indicated that the plan would be further developed over time.

Monitoring: partially met. The Lautenberg Act provided EPA with 

significant new authorities to regulate chemicals, but EPA's full 

implementation will take many years. EPA has partially met the criterion

for monitoring because it is too soon to determine whether EPA’s 

approach to managing chemicals within the new TSCA authorities will 

position the agency to achieve its goal of ensuring the safety of 

chemicals. We will continue to monitor TSCA as the agency implements 

this important legislation.

Demonstrated progress: partially met. As our chemical assessments 

report describes, EPA has responded to many of the new provisions in 

the Lautenberg Act. For example, EPA has issued rules governing the 

prioritization and conduct of chemical assessments under TSCA. In 

addition, EPA told us about efforts to engage EPA offices in a variety of 

ways to obtain information necessary to conduct risk evaluations and to 

leverage the expertise and experience of experts within the agency. 

However, EPA did not provide us with documentation that these activities 

have occurred. Moreover, EPA has additional Lautenberg Act 

requirements to address in the years ahead. 

Since we added TSCA implementation to our High-Risk List in 2009, we 

have made three recommendations related to this high-risk issue. EPA 

will need to implement one open recommendation, along with meeting the 

high-risk criteria discussed above, to make progress. As noted in several 

criteria above, EPA needs to maintain leadership commitment and ensure 

that it has the resources and plans in place to facilitate progress. For 

example, for the demonstrated progress criterion, EPA will need to 

respond to provisions in the Lautenberg Act, such as having 20 ongoing 

risk evaluations by December 2019 and making findings on the safety of 

all new chemicals. In addition, our March 2019 chemical assessments 

report discusses what remains to be done to address challenges (e.g. 

process improvements) in implementing the Lautenberg Act.

What Remains to Be Done
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 209 GAO-19-157SP High-Risk Series 

EPA and Congress should consider ensuring that the resources 

dedicated to TSCA activities are sufficient to implement TSCA reform 

activities.

Chemical Assessments: Status of EPA’s Efforts to Produce Assessments 

and Implement the Toxic Substances Control Act. GAO-19-270. 

Washington, D.C.: March 4, 2019.

Chemical Innovation: Technologies to Make Processes and Products 

More Sustainable. GAO-18-307. Washington, D.C.: February 8, 2018.

Chemicals Management: Observations on Human Health Risk 

Assessment and Management by Selected Foreign Programs. GAO-16-

111R. Washington, D.C.: October 9, 2015.

Chemical Assessments: Agencies Coordinate Activities, but Additional 

Action Could Enhance Efforts. GAO-14-763. Washington, D.C.: 

September 29, 2014.

Chemical Regulation: Observations on the Toxic Substances Control Act 

and EPA Implementation. GAO-13-696T. Washington, D.C.: June 13, 

2013.

Chemical Assessments: An Agencywide Strategy May Help EPA Address 

Unmet Needs for Integrated Risk Information System Assessments. 

GAO-13-369. Washington, D.C.: May 10, 2013.

Toxic Substances: EPA Has Increased Efforts to Assess and Control 

Chemicals but Could Strengthen Its Approach. GAO-13-249. Washington, 

D.C.: March 22, 2013.

Chemical Assessments: Challenges Remain with EPA’s Integrated Risk 

Information System Program. GAO-12-42. Washington, D.C.: December 

9, 2011.

Chemical Assessments: Low Productivity and New Interagency Review 

Process Limit the Usefulness and Credibility of EPA’s Integrated Risk 

Information System. GAO-08-440. Washington D.C: March 7, 2008

Congressional Actions Needed

Related GAO 

Products
VA Acquisition Management

Page 210 GAO-19-157SP High-Risk Series 

The Department of Veterans Affairs (VA) Acquisition Management is a new high-risk area as VA must 

demonstrate greater leadership commitment and strategic planning to ensure efficient use of its acquisition 

funding and staffing resources. 

We are adding VA Acquisition 

Management as a new high-risk 

area in light of numerous 

contracting challenges and given 

the significant investment in 

resources to fulfill its critical 

mission of serving veterans. The 

department needs to use these 

resources in the most efficient 

manner possible when acquiring

goods and services to meet the 

needs of those who served our 

country.

Outdated acquisition regulations and policies. VA’s procurement 

policies have historically been outdated, disjointed, and difficult for 

contracting officers to use. In September 2016, we reported that (1) the 

acquisition regulations contracting officers currently follow have not been 

fully updated since 2008 and (2) VA had been working on completing a 

comprehensive revision of its acquisition regulations since 2011. 

VA’s delay in updating this fundamental source of policy has impeded the 

ability of contracting officers to effectively carry out their duties. We 

recommended in September 2016 that VA identify measures to expedite 

the revision of its acquisition regulations and clarify what policies are 

currently in effect. VA concurred with this recommendation and has made 

some progress in updating its acquisition regulations and rescinding 

outdated policies, but more work remains to be done over the next 

several years. 

Of the 41 parts in the new version of VA’s acquisition regulations, VA 

reports that: 

• 14 have been published as final rules,

• 5 have completed the public comment process and VA is addressing 

the comments received,

• 1 is undergoing further evaluation by the Office of Management and 

Budget, and

VA Acquisition Management

Why Area Is High Risk

VA spends tens of billions of dollars to 

procure a wide range of goods and 

services—including medical supplies and 

construction—to meet its mission of 

providing health care and other benefits 

to millions of veterans. In fiscal year 

2019, the VA received the largest 

discretionary budget in its history—$86.5 

billion. About a third of VA’s discretionary 

budget in fiscal year 2017, or $26 billion, 

has been used to contract for goods and 

services. VA has one of the most 

significant acquisition functions in the 

federal government, both in obligations 

and number of contract actions. VHA 

provides medical care to veterans and is 

VA’s largest administration.

Since 2015, we have made 31 

recommendations (10 have been 

implemented; 21 remain open) to 

address challenges in VA’s acquisition 

management, including (1) outdated 

acquisition regulations and policies; (2) 

lack of an effective medical supplies 

procurement strategy; (3) inadequate 

acquisition training; (4) contracting officer 

workload challenges; (5) lack of reliable 

data systems; (6) limited contract 

oversight and incomplete contract file 

documentation; and (7) leadership 

instability. In light of these challenges 

and given the significant taxpayer 

investment, it is imperative that VA use 

its funding in the most efficient manner 

possible when acquiring goods and 

services. As such, we have added VA 

Acquisition Management as a new highrisk area in 2019. 

Contact Information

For additional information about this 

high-risk area, contact Shelby S. Oakley 

at 202-512-4841 or oakleys@gao.gov. 
VA Acquisition Management

Page 211 GAO-19-157SP High-Risk Series 

• 21 are at an earlier stage of the rulemaking process.

VA reported that it is unsure when all parts will be out for public comment 

but the updated final version of its acquisition regulations will not be 

complete until April 2021. VA has also reported that it has rescinded 

many irrelevant policy documents and updated those that remain 

relevant. Officials said they plan to rescind or update the few remaining 

outdated policy documents in January 2019.

Lack of an effective medical supplies procurement strategy. VA’s 

program for purchasing medical supplies has not been effectively 

executed, nor is it in line with practices at leading hospitals. To support 

more efficient purchasing of medical supplies for its 172 medical centers 

that serve the needs of about 9 million veterans, VA launched the Medical 

Surgical Prime Vendor-Next Generation (MSPV-NG) program in 

December 2016. MSPV-NG was part of its overall effort to transform its 

supply chain and achieve $150 million in cost avoidance. 

In November 2017, we reported that VA’s approach to developing its 

catalog of supplies was rushed, lacked key stakeholder involvement and 

buy-in, and relied on establishing non-competitive blanket purchase 

agreements for the overwhelming majority of products, resulting in low 

utilization by medical centers. VA had set a target that medical centers 

would order 40 percent of their supplies from the MSPV-NG catalog, but 

utilization rates were below this target with a nationwide average 

utilization rate across medical centers of about 24 percent as of May 

2017. This low utilization adversely affected VA’s ability to achieve its cost 

avoidance goal. We recommended in November 2017 that VA develop, 

document, and communicate to stakeholders an overarching strategy for 

the program. VA concurred with this recommendation and reported that it 

would develop and communicate a new medical supplies procurement 

strategy to clinical and logistics staff. This strategy was originally planned 

to be completed by December 2017 but has now been delayed to March

2019.

Inadequate acquisition training. VA acquisition training, at times, has 

not been comprehensive nor provided to staff that could benefit from it. A 

2006 statute required, and a 2016 Supreme Court decision 

(Kingdomware Technologies, Inc. v. United States) reaffirmed, that VA is 

to give preference to veteran-owned small businesses when competitively 

awarding contracts—a program known as Veterans First. In September 

2018, we reported that training on VA’s Veterans First policy did not 

address some of its more challenging aspects. For example, many of the 

contracting officers we interviewed were uncertain about how to balance 

the preference for veteran-owned small businesses with fair and 

reasonable price determinations when lower prices might be found on the 

open market. 
VA Acquisition Management

Page 212 GAO-19-157SP High-Risk Series 

In addition, VA provided several installments of online training sessions 

on the Veterans First policy to contracting officers but did not make them 

mandatory. As a result, only 52 percent of VA contacting officers 

completed the follow-up training by the spring of 2018. We recommended 

in September 2018 that VA provide more targeted training to contracting 

officers on how to implement the Veterans First policy, particularly in the 

area of making fair and reasonable price determinations, and assess 

whether this training should be designated as mandatory. VA concurred 

with these recommendations and stated that it is taking steps to 

implement them.

Contracting officer workload challenges. The majority of our reviews 

since 2015 have highlighted workload as a contributing factor to the 

challenges that contracting officers face. Most recently, in September 

2018, we reported that about 54 percent of surveyed VA contracting 

officers said their workload was not reasonable and found that workload 

stresses have exacerbated the struggles that they face implementing the 

department’s Veterans First policy. 

In addition, in September 2016, we reported that the contracting officers 

at the Veterans Health Administration (VHA) processed a large number of 

small dollar-value actions to support medical center operations, many of 

which involve emergency procurements of routine items to support 

immediate patient care. Contracting officers and the department’s Acting 

Chief Acquisition Officer (CAO) told us that these frequent and urgent 

small-dollar transactions reduce contracting officers’ efficiency and ability 

to take a strategic view of VHA’s overarching procurement needs. We 

reported in November 2017 that emergency procurements accounted for 

approximately 20 percent—$1.9 billion—of VHA’s overall contract actions 

in fiscal year 2016. Figure 13 shows the percent of VHA contract actions 

designated as emergencies in fiscal year 2016 by each network 

contracting office.
VA Acquisition Management

Page 213 GAO-19-157SP High-Risk Series 

Figure 13: Percent of VHA Contract Actions Designated as Emergencies, Fiscal Year 2016

a

Veterans Integrated Service Networks (VISNs), organizations that manage medical centers and 

associated clinics across a given geographic area, are served by a corresponding network 

contracting office. Some VISNs have been consolidated over time, and in fiscal year 2016, there were 

19 VISNs despite being numbered up to 23. As of fiscal year 2017, there are only 18 in total. 

We recommended in November 2017 that VHA network contracting 

offices work with medical centers to identify opportunities to more 

strategically purchase goods and services frequently purchased on an 

emergency basis. VA concurred with this recommendation and reported 

in December 2018 that it is utilizing a supply chain dashboard to track 

items purchased on an emergency basis and determine which of those 

items to include on the catalog. VA noted that it added 13,300 items to 

the catalog from June 2018 to December 2018, including items often 

purchased on an emergency basis. We requested documentation 

showing that items added to the catalog were previously purchased on an 

emergency basis, but as of January 2019, VA had not yet provided it. If 

implemented, this would allow for both greater contracting officer 

efficiency and cost savings. For example, based on a similar 

recommendation we made in 2012, VA reported about $10 billion in 

savings over a 5-year period. 

Lack of reliable data systems. The lack of accurate data has been a 

long-standing problem at VA. In September 2016, we reported that VA 

had not integrated its contract management and accounting systems, 

resulting in duplicative efforts on the part of contracting officers and 

increased risk of errors. We and VA’s Inspector General each 

recommended that VA perform data checks between the two systems. VA

concurred with this recommendation and some VA contracting 

organizations have made efforts to address this risk. Further, VA reported 
VA Acquisition Management

Page 214 GAO-19-157SP High-Risk Series 

in December 2016 that it had selected the Department of Agriculture as 

the service provider for a new integrated financial system, but told us in 

June 2018 that the new system would not be piloted until fiscal year 2020.

In November 2017, we reported that the MSPV-NG program office relied 

almost exclusively on flawed data to identify medical and surgical items to 

be included in the catalog. The program office estimated that the items in 

the initial release of the MSPV-NG catalog would meet 80 percent or 

more of the medical centers’ needs. However, the contracting office 

managing the program indicated that, as of June 2017, only a third of the 

items in the initial MSPV-NG catalog would meet medical centers’ needs. 

Senior VHA acquisition officials attributed this mismatch to shortcomings 

with VA’s historical purchase data.

Limited contract oversight and incomplete contract file 

documentation. VA has had difficulty ensuring that its contracts are 

properly monitored and documented. In September 2018, we reported 

that, although VA obligated $3.9 billion to veteran-owned small 

businesses in fiscal year 2017, its contracting officers were not effectively 

monitoring compliance with key aspects of the department’s Veterans 

First policy, such as limits on subcontracting (which ensure that the goal 

of the program—to promote opportunities for veteran-owned 

businesses—is not undermined). In many cases, we found that clauses 

requiring compliance were not included in the VA’s contracts and orders 

with veteran businesses because the contracting officers either forgot to 

include them or were unaware of the requirement. 

The contracting officers we spoke with also said that they do not have 

sufficient time or knowledge to conduct oversight. Through limited 

reviews, VA has identified a number of violations that would warrant a 

broader assessment of the fraud risks to the program. We recommended 

in September 2018 that VA establish a mechanism to ensure that 

mandatory subcontracting-related clauses be consistently incorporated 

into set-aside contracts with veteran-owned businesses and that VA 

conduct a fraud risk assessment for the Veterans First program. VA 

concurred with these recommendations and is taking steps to implement 

them.

We also reported in September 2016 that a number of VA contract files 

we reviewed were missing key documents, increasing the risk that key 

processes and regulations were not followed. We recommended that VA 

focus its internal compliance reviews to ensure that required contract 

documents are properly prepared and documented. VA concurred with 

this recommendation and stated that it plans to hold quarterly reviews of 

compliance review results in order to improve the quality of contract file 

documentation.
VA Acquisition Management

Page 215 GAO-19-157SP High-Risk Series 

Leadership instability. We have previously reported, most recently in 

September 2018, that procurement leadership instability has made it 

difficult for the VA to execute and monitor the implementation of key 

acquisition programs and policies. For example, changes in senior 

procurement leadership, including the CAO and VHA’s Chief 

Procurement and Logistics Officer, occurred during the implementation of 

MSPV-NG and similar instability in leadership affected the MSPV-NG 

program office itself. Overall, the MSPV-NG program office has had four 

directors, two of whom served in an acting capacity, since its inception in 

2014. 

To address this instability, we recommended in November 2017 that VA 

appoint a non-career employee as the CAO and prioritize the hiring of the 

MSPV-NG program office’s director position on a permanent basis. VA 

concurred with these recommendations and implemented them in 2018. 

Stable leadership should help bring consistent and much needed 

direction to the MSPV-NG program, but we recently identified other areas 

within the VA where sustained leadership is also needed. For instance, in 

September 2018, we reported there have been six Acting Directors within 

the past two and a half years within an oversight office that helps assess 

whether VA is in compliance with aspects of its Veterans First policy.

Since 2015, we have made 31 recommendations to improve VA 

acquisition management. As of December 2018, VA has implemented 10 

of these recommendations; 21 of them remain open including those listed 

below. We have identified the following steps, among others, that VA 

needs to take to demonstrate greater leadership commitment and 

strategic planning to ensure efficient use of its acquisition funding and 

staffing resources. VA should:

• prioritize completion of the revision of its acquisition regulations, which 

has been in process since 2011;

• develop, document, and communicate to stakeholders a strategy for the 

Medical Surgical Prime Vendor program to achieve overall program 

goals;

• provide targeted training for the more challenging aspects of 

implementing the Veterans First policy;

• identify opportunities to strategically purchase goods and services that 

are frequently purchased on an emergency basis;

• update its contract management system’s functionality; and 

• conduct a fraud risk assessment of its Veterans First program.

What Remains to Be Done
VA Acquisition Management

Page 216 GAO-19-157SP High-Risk Series 

Veterans First Program: VA Needs to Address Implementation 

Challenges and Strengthen Oversight of Subcontracting Limitations. 

GAO-18-648. (Washington, D.C.: September 24, 2018).

Veterans Affairs Contracting: Improvements in Buying Medical and 

Surgical Supplies Could Yield Cost Savings and Efficiency. GAO-18-34. 

(Washington, D.C.: November 9, 2017).

Veterans Affairs Contracting: Improvements in Policies and Processes 

Could Yield Cost Savings and Efficiency. GAO-16-810. (Washington, 

D.C.: September 16, 2016).

Veterans Affairs Contracting: Improved Oversight Needed for Certain 

Contractual Arrangements. GAO-15-581. (Washington, D.C.: July 2, 

2015).

Strategic Sourcing: Improved and Expanded Use Could Save Billions in 

Annual Procurement Costs. GAO-12-919. (Washington, D.C.: September 

20, 2012).

Related GAO 

Products
DOE’s Contract and Project Management for 

the National Nuclear Security Administration 

and Office of Environmental Management

Page 217 GAO-19-157SP High-Risk Series 

The National Nuclear Security Administration (NNSA) has made progress in a number of areas. However, the 

Office of Environmental Management (EM) needs to take action to understand the root causes of its 

challenges and incorporate program and project management best practices into its policies.

Since our 2017 High-Risk Report, 

DOE has made progress in the 

demonstrated progress criterion. 

Our assessment of the ratings for 

the four other criteria remains 

unchanged.

Leadership commitment: met. In 

September 2018, the Deputy 

Secretary of Energy issued a 

memorandum laying out a series 

of reforms to improve the 

department’s management of 

major contracts, including NNSA 

and EM. To ensure leadership 

engagement on major contracts, 

DOE plans to either expand the 

scope of the Energy Systems Acquisition Advisory Board or establish a 

second board to review them. This effort is recent, and we will follow 

DOE’s progress in implementing these reforms.

In addition, in September 2017, NNSA agreed to implement our 

recommendation to strengthen its program management by applying lifecycle cost and schedule management to one of its major programs. One 

of NNSA’s core offices, the Office of Defense Programs, strengthened 

program management by further implementing its Program Execution 

Instruction, which applies to the management of billions of dollars of 

nuclear weapons science and production efforts.

In July 2017, EM issued a new cleanup policy that requires EM senior 

leadership approval of any contracts for $200 million or more. In 

December 2017, DOE reorganized EM under the Office of Science—the 

third move for EM in 10 years. The Assistant Secretary for the Office of 

Environmental Management also announced an intention to develop a 

strategic plan to address EM’s large and growing environmental liabilities, 

as well as a new approach to contracting focused on accelerating the 

cleanup and closure of sites.

Capacity: not met. In August 2018, a statutorily required internal review 

of NNSA’s capacity identified unmet critical staffing needs, especially 

DOE’s Contract and Project Management for 

the National Nuclear Security Administration 

and Office of Environmental Management

Why Area Is High Risk

The Department of Energy (DOE) 

oversees a broad range of programs 

related to nuclear security, science, 

energy, and waste cleanup, among other 

areas. As the largest civilian contracting 

agency in the federal government, DOE 

relies primarily on contractors to carry 

out its programs. DOE spends 

approximately 90 percent of its annual 

budget on contracts and acquiring 

capital assets. In fiscal year 2018, DOE’s 

budget was $34.5 billion.

In 1990, we designated DOE’s contract 

management—which has included both 

contract administration as well as project 

and program management—as a highrisk area because DOE’s record of 

inadequate management and oversight 

of contractors left the department 

vulnerable to fraud, waste, abuse, and 

mismanagement. 

In January 2009, recognizing the 

progress at DOE’s Office of Science, we 

narrowed the focus of DOE’s high-risk 

designation to two DOE program 

elements—NNSA and EM. In February 

2013, we further narrowed the focus of 

the high-risk designation to NNSA’s and 

EM’s contracts, as well as major 

projects—those with an estimated cost of 

$750 million or greater—to acknowledge 

progress made in managing nonmajor 

projects.

Contact Information

For additional information about this 

high-risk area, contact David C. Trimble 

at (202) 512-3841 or trimbled@gao.gov, 

or Allison B. Bawden at (202) 512-3841 

or bawdena@gao.gov.
DOE’s Contract and Project Management for 

the National Nuclear Security Administration 

and Office of Environmental Management

Page 218 GAO-19-157SP High-Risk Series 

staffing to manage and oversee work on the agency’s uranium and

plutonium missions, which are expected to grow. In addition, in June 

2018, an Office of Personnel Management (OPM) study found that the 

agency was understaffed across all functions. The number of additional 

staff that OPM recommended in the study would exceed the statutory cap 

on NNSA’s full-time equivalent employees. 

DOE revised its program and project management guidance in May 2016 

to direct that capital asset acquisitions have adequate oversight staff. In 

recent years, NNSA has increased the number of oversight staff in some 

of its major project management offices, including for the Uranium 

Processing Facility in Tennessee and the Mixed Oxide Fuel Fabrication 

Facility in South Carolina. However, EM has not benefitted from this 

change because it does not follow DOE’s program and project 

management requirements for the majority of its cleanup activities. In 

addition, EM’s July 2017 cleanup policy does not sufficiently address the 

need for EM to have adequate staff for its work. 

Action plan: partially met. The Deputy Secretary’s 2018 contract 

management reform memorandum lists several areas for improvement—

including increasing capacity and improving performance measures—

which, if realized, will strengthen DOE’s management of major contracts. 

After a comprehensive review of lessons learned from a multi-billion dollar 

warhead life extension program, NNSA has also implemented 

management reforms to support similar programs.

EM continues to need to identify the root causes of its contract and 

project management problems. DOE has conducted multiple studies over 

the years and closed many corrective actions plans as successful. 

However, these plans were not comprehensive, and their results were not 

linked to each other. In June 2017, EM initiated a 45-day review to 

identify decision-making priorities at each site, but this study was never 

finalized. In August 2018, EM initiated an ad-hoc root cause analysis—

DOE’s fourth since 2008. EM officials stated that they are working on a 

continuous improvement plan based on the 2018 ad-hoc analysis, but this 

effort did not connect to DOE’s previously identified problems or previous 

corrective measures. Until EM takes steps to identify the root causes of 

its problems, developing an effective action plan will be challenging. 

Notably, EM’s 2017 cleanup policy does not direct EM to develop a root 

cause analysis and corrective action plan at either a program or project 

level when there is evidence that a cost or schedule baseline will not be 

met or there are cost overruns.

Monitoring: partially met. NNSA continues to make progress, most 

notably in managing contracts. For example, as it renews or recompetes 

contracts, NNSA has taken steps to include new contract clauses that 

strengthen management oversight and reporting of management 
DOE’s Contract and Project Management for 

the National Nuclear Security Administration 

and Office of Environmental Management

Page 219 GAO-19-157SP High-Risk Series 

information. NNSA has also taken steps to more actively monitor and 

address contract performance that does not meet expectations, for 

example, by recompeting one multibillion-dollar contract early after two 

instances of poor performance. In addition, NNSA has taken steps to 

implement our recommendation to re-establish a process for reviewing 

the effectiveness of field offices' contractor oversight by conducting four

peer reviews as of October 2018, with more planned. 

NNSA has also taken action to manage all contract documentation in a 

central recordkeeping system, as we recommended in August 2018. 

However, we reported in February 2019 that cost performance 

information was not a significant performance measure in NNSA’s review 

and monitoring of some types of contract evaluations. NNSA agreed with 

our recommendation that it should include quality cost information in its 

contractor performance evaluations to enable better performance 

assessments.

In contrast to NNSA’s progress, EM’s monitoring continues to face 

challenges. In February 2019, we found that EM’s 2017 cleanup policy 

does not follow most selected best practices for program or project 

management. For example, the policy does not require that DOE offices 

outside EM conduct independent project reviews, as is the case for 

capital asset projects over $50 million. We also found that the data and 

metrics EM uses to monitor its work do not accurately reflect cleanup 

performance, leaving decision makers without adequate information 

about what EM is achieving with its funding. EM agreed with our 

recommendations that it incorporate program and project management 

leading practices—especially by directing independent monitoring and 

oversight of its cleanup operations—into its 2017 cleanup policy, and 

generally agreed that it should integrate its data and metrics to provide a 

clear picture of performance.

DOE generally concurred with our March 2017 recommendation to 

implement leading practices for managing its risk of fraud and other 

improper payments but has not taken sufficient steps to implement it. The 

Deputy Secretary’s 2018 contract management reform memorandum, 

which commits DOE to using objective performance measures, including 

cost controls, indicates that the agency plans to take steps to improve its 

future monitoring. 

Demonstrated progress: partially met. Through its Office of Cost 

Estimating and Program Evaluation, NNSA has enhanced its capability to 

estimate costs and schedules, and to assess alternatives, for programs 

and projects, among other things. NNSA also made progress by 

implementing best practices in several areas, such as those for 

estimating costs and schedules in nuclear weapons refurbishment 

activities and capital asset acquisitions. For example, we determined that 
DOE’s Contract and Project Management for 

the National Nuclear Security Administration 

and Office of Environmental Management

Page 220 GAO-19-157SP High-Risk Series 

DOE’s revised cost estimate of $17.2 billion to construct a Mixed Oxide 

Fuel Fabrication Facility to dispose of surplus, weapons-grade plutonium 

substantially met best practices—providing assurance that the estimated 

costs could be considered reliable. This finding contributed to DOE’s 

reevaluation of the project and ultimate termination, in October 2018, in 

favor of a potentially less costly disposal approach.

However, NNSA’s cost estimates for a new uranium enrichment 

capability—an effort that could cost billions of dollars—did not fully meet 

best practices. Also, while NNSA has taken steps to implement statutorily 

required common financial reporting across the nuclear security 

enterprise, we found in January 2019 that NNSA’s plan for this effort does 

not follow leading project management practices—including having a 

detailed schedule and budget for implementing the project. NNSA 

generally agreed with our recommendations that it should follow leading 

practices in its approach to planning and implementing common financial 

reporting.

EM is close to completing one major cleanup project—the River Corridor 

Closure Project in Washington. However, another major EM cleanup 

project continues to face significant cost and schedule challenges. In 

particular, construction of the Waste Treatment and Immobilization Plant 

(WTP) at the Hanford site in Washington has faced persistent challenges, 

including quality assurance problems that have delayed it by decades and 

increased costs well beyond its last total program cost estimate of $17 

billion. Six years after major nuclear safety and quality issues were 

discovered, we found in April 2018 that the contractor has not fully 

implemented all planned corrective measures. 

Furthermore, EM has not ensured that all WTP quality assurance 

problems—such as engineering errors and construction deficiencies—

have been identified and some previously identified problems are 

recurring. DOE generally agreed with our recommendations that it require 

the contractor to determine the extent of problems in WTP structures, 

systems, and components, and order work stops when problems recur. 

Even so, in December 2018, DOE announced that EM had increased its 

estimate of the total costs to clean up the Hanford site by $82 billion—to a 

total of $242 billion—with part of that increase attributed to WTP 

construction and operating costs.

Fifty-one recommendations were open as of December 2018; 15 

recommendations were made since the last high-risk update in February 

2017. DOE, including NNSA and EM, should implement our 

recommendations to use sound contract, program, and project 

management practices to enhance oversight and reduce the risk of fraud, 

waste, and abuse.

What Remains to Be Done
DOE’s Contract and Project Management for 

the National Nuclear Security Administration 

and Office of Environmental Management

Page 221 GAO-19-157SP High-Risk Series 

Congress should consider working with NNSA to ensure that the statutory 

cap on staffing is re-examined and consistent with NNSA’s human capital 

needs, as evaluated in two recent studies.

Department of Energy: Performance Evaluations Could Better Assess 

Management and Operating Contractor Costs. GAO-19-5. Washington, 

D.C.: February 26, 2019.

Nuclear Waste Cleanup: DOE Could Improve Program and Project 

Management by Better Classifying Work and Following Leading 

Practices. GAO-19-223. Washington, D.C.: February 19, 2019.

National Nuclear Security Administration: Additional Actions Needed to 

Collect Common Financial Data. GAO-19-101. Washington, D.C.: 

January 31, 2019.

Project Management: DOE and NNSA Should Improve Their LessonsLearned Process for Capital Asset Projects. GAO-19-25. Washington, 

D.C.: December 21, 2018.

Management Report: Actions Needed to Improve National Nuclear 

Security Administration Contract Document Management. GAO-18-246R. 

Washington, D.C.: August 1, 2018.

Hanford Waste Treatment Plant: DOE Needs to Take Further Actions to 

Address Weaknesses in Its Quality Assurance Program. GAO-18-241. 

Washington, D.C.: April 24, 2018.

Department of Energy: Continued Actions Needed to Address 

Management Challenges. GAO-18-438T. Washington, D.C.: March 14, 

2018.

Nuclear Nonproliferation: NNSA Needs to Improve Its Program 

Management Policy and Practices. GAO-17-773. Washington, D.C.: 

September 28, 2017.

Nuclear Waste: Opportunities Exist to Reduce Risks and Costs by 

Evaluating Different Waste Treatment Approaches at Hanford. 

GAO-17-306. Washington, D.C.: May 3, 2017.

Department of Energy: Use of Leading Practices Could Help Manage the 

Risk of Fraud and Other Improper Payments. GAO-17-235. Washington, 

D.C.: March 30, 2017.

Congressional Actions Needed

Related GAO 

Products
NASA Acquisition Management

Page 222 GAO-19-157SP High-Risk Series 

In light of deteriorating cost and schedule performance, the National Aeronautics and Space Administration 

(NASA) needs to address management weaknesses and implement an action plan.

Since our 2017 High-Risk Report, 

we have lowered two criteria 

ratings for NASA’s acquisition 

management from met to partially 

met—leadership commitment and 

monitoring. Our assessment of 

the other three criteria remains 

the same. Capacity and 

demonstrated progress remain 

partially met and corrective action 

plan remains met. 

Leadership commitment: 

partially met. NASA is no longer 

fully meeting the criteria for 

leadership commitment because 

of 1) a lack of transparency in 

major project cost and schedules, especially for its human spaceflight 

programs, 2) a lack of information on long-term human exploration 

program costs, and 3) leadership approval of risky programmatic 

decisions for complex major projects. When we determined that NASA 

met the criteria in 2015, NASA’s senior leadership had implemented key 

components of the agency’s action plan, which had resulted in 

improvements in the cost and schedule performance of its major projects 

for several years. Specifically, NASA is no longer meeting the criteria for 

leadership commitment in 2019 for the following reasons: 

• In our May 2018 assessment of major projects, we were unable to 

determine the cost performance for NASA’s portfolio of major projects 

for the first time because NASA lacked a current cost estimate for its 

Orion Multi-Purpose Crew Vehicle (Orion)—one of the largest projects 

in the portfolio. In addition, the approved cost estimate for the Space 

Network Ground Segment Sustainment project underestimated the 

expected life-cycle cost because it did not include the full scope of the 

project’s effort. 

Further, we reported in July 2018 that the Commercial Crew Program 

did not provide Congress with the results of its schedule analysis 

showing a risk of schedule delays beyond what each of its two 

contractors’ had previously provided. As a result, Congress does not 

have complete information for decision-making regarding U.S. access 

to the International Space Station.

• NASA has not taken action on several recommendations we made 

related to understanding the long-term costs of its human exploration 

NASA Acquisition Management

Why Area Is High Risk

NASA plans to invest billions of dollars in 

the coming years to explore space, and 

conduct aeronautics research, among 

other things. We designated NASA’s 

acquisition management as high-risk in 

1990 in view of NASA’s history of 

persistent cost growth and schedule 

delays in the majority of its major 

projects. We have identified 

management weaknesses that have 

exacerbated the inherent technical and 

engineering risks faced by NASA’s 

largest projects.

In more recent years, we found that 

NASA had taken steps to improve its 

management of its major projects—those 

projects and programs with an estimated 

life-cycle cost over $250 million. 

However, we reported in May 2018 that 

the cost and schedule performance of 

NASA’s portfolio of major projects 

deteriorated. One of NASA’s largest 

projects, the James Webb Space 

Telescope, has experienced delays of 81 

months and cost growth of 95 percent 

since 2009.

In 2018, we found that additional cost 

and schedule growth is likely for the 

portfolio. Many major projects, including 

some of the most expensive ones, are in 

the phase of their life cycles when cost 

and schedule growth is most likely. 

Further, NASA faces significant 

challenges largely driven by the need to 

improve the completeness and reliability 

of its cost and schedule estimates, 

update cost and schedule estimates as 

new risks emerge, and ensure that 

programmatic decisions are not 

increasing risks to projects.

Contact Information 

For additional information about this 

high-risk area, contact Cristina T. 

Chaplain at (202) 512-4841 or 

chaplainc@gao.gov. 
NASA Acquisition Management

Page 223 GAO-19-157SP High-Risk Series 

programs. For example, two human spaceflight programs—

Exploration Ground Systems (EGS) and Space Launch System 

(SLS)—do not have a cost and schedule baseline that covers 

activities beyond the first planned flight. In addition, the third 

program—Orion—does not have a baseline beyond the second 

planned flight. As a result, NASA is now committing itself to spend 

billions of dollars for missions that do not have a cost and schedule 

baseline against which to assess progress.

• NASA leadership has approved programmatic decisions that 

compounded technical challenges. These decisions included 

establishing insufficient cost and schedule reserves, operating under 

aggressive schedules, and not following best practices for 

establishing reliable cost and schedule baselines for some of its most 

expensive major projects, including Orion, SLS, and the James Webb 

Space Telescope. As a result, these programs have been at risk of 

cost growth and schedule delays since NASA approved their 

baselines. 

Further, the Mars 2020 project experienced cost growth stemming 

from technical challenges on a technology demonstration instrument 

designed to convert carbon dioxide to oxygen. NASA approved the 

project to proceed through its preliminary design review without 

maturing a critical technology for this instrument. In our prior work on 

best practices for systems entering product development, we have 

found that such decisions can increase risk for these systems. 

Capacity: partially met. NASA has taken steps to build capacity to 

reduce acquisition risk including updating tools aimed at improving cost 

and schedule estimates but continues to experience challenges. For 

example:

• NASA has not always followed best practices in areas such as 

estimating costs and schedules and earned value management, and 

projects are reluctant to update their cost and schedule estimates as 

new risks emerge. For example, NASA partially agreed with our July 

2016 recommendation that the Orion program should update its joint 

cost and schedule confidence analysis—a point-in-time estimate that, 

among other things, includes all cost and schedule elements, and 

incorporates and quantifies known risks that support each program’s 

cost and schedule baseline. In January 2018, however, NASA officials 

stated that they have no plans to update this analysis. An updated 

analysis would be beneficial given numerous conditions and risks 

have changed since the analysis was completed, including delays to 

its first planned flight.

• In our May 2018 assessment of major projects, we found that several 

NASA major projects experienced workforce challenges, including not 

having enough staff or staff with the right skills. NASA has also 

identified capability gaps in areas such as scheduling, earned value 
NASA Acquisition Management

Page 224 GAO-19-157SP High-Risk Series 

management, and cost estimating, and has efforts underway to try to 

improve capacity in these areas.

Action plan: met. NASA is meeting the criteria for a corrective action 

plan as the agency finalized a new plan in December 2018. NASA 

determined that it was necessary to develop a new plan because several 

of its highest-profile missions recently experienced cost and schedule 

growth. The plan contains several initiatives that could help the agency 

manage its acquisitions, if implemented. For example, NASA plans to 

implement a training program to increase the agency’s programmatic 

capabilities, including those related to cost and schedule estimation and 

assessment. In addition, the agency plans to establish new requirements 

for projects over $1 billion to conduct a joint cost and schedule confidence 

level assessment at additional reviews throughout a project’s lifecycle, or 

as required by the Associate Administrator. Further, the plan includes an 

effort to improve portfolio analysis and planning for NASA human 

spaceflight programs by enhancing cross-portfolio assessments. We plan 

to follow up with NASA to better understand how this effort could help 

improve outcomes for these programs and enhance transparency into 

human exploration program costs. 

Monitoring: partially met. NASA is no longer fully meeting the criteria for 

monitoring because it will need to institute a program for monitoring and 

independently validating the effectiveness and sustainability of corrective 

action measures in conjunction with its new action plan. NASA has been 

reporting metrics for its prior action plan to us on a semiannual basis; 

however, the agency is not performing within some of the parameters 

outlined in the plan—such as meeting metrics for cost and schedule 

performance. In addition, NASA officials stated that they plan to revise 

these metrics because they are outdated. 

Demonstrated progress: partially met. We reported in May 2018 that 

the cost and schedule performance of NASA’s portfolio of major projects 

had deteriorated. The average launch delay increased from 7 months in 

our May 2017 report to 12 months in our May 2018 report. As mentioned 

above, we were not able to determine the extent of cost performance 

deterioration because NASA lacked a current cost estimate for its Orion 

crew capsule. Even without including expected Orion cost growth, the 

overall development cost growth for the portfolio of 17 development 

projects increased to 18.8 percent, up from 15.6 percent in 2017. We 

found that the decline in cost and schedule performance was driven by 

major projects encountering technical issues that were compounded by 

risky program management decisions; technical challenges that resulted 

in delays in the integration and test phase; and factors largely outside of 

the projects’ control, such as delays related to their launch vehicles.

In addition, NASA approved new cost and schedule commitments for the 

James Webb Space Telescope project in June 2018. As a result, the 

project has experienced total schedule delays of 81 months and cost 
NASA Acquisition Management

Page 225 GAO-19-157SP High-Risk Series 

growth of 95 percent since the project’s cost and schedule baseline was 

first established in 2009. The project office updated its cost and schedule 

estimates after experiencing a series of delays largely due to 

complications with spacecraft element integration, and various technical 

and workmanship issues. The project’s ability to execute to its new 

schedule will continue to be tested through the remainder of its 

challenging integration and test phase, which includes executing several 

first-time activities such as integrating the spacecraft and telescope 

elements. 

Further, we reported in May 2018 that NASA’s portfolio of major projects 

was at risk for continued cost growth and schedule delays as new, large, 

and complex projects enter the portfolio and expensive projects remain in 

the portfolio for longer than expected. For example, NASA expects to 

begin development on a lunar Gateway—currently being discussed as a 

platform in a lunar orbit to mature deep space exploration capabilities. 

Since we initially designated this area as high-risk, we have made 

numerous recommendations. As of December 2018, 15 

recommendations related to this high-risk area remain open. Of the 9 

recommendations we have made since the last high-risk update in 

February 2017, 6 remain open. 

NASA should take action in the following areas to reduce acquisition risk 

to its portfolio of major projects and demonstrate progress.

• Increase transparency of project costs and decline to approve cost and 

schedule baselines or programmatic decisions that increase risk to 

projects. This includes not approving project cost and schedule baselines 

that do not meet best practices and that do not have adequate cost and 

schedule reserves. 

• Implement recommendations related to the long-term costs of its human 

exploration programs. This will be especially important for NASA to 

determine the affordability of its portfolio, especially now that it plans to 

begin developing other large, complex projects.

• Build capacity by ensuring that NASA’s workforce has the right skills to 

develop project cost and schedule estimates that meet best practices.

• Ensure that NASA updates project cost and schedule estimates as risks 

change.

• Implement the new corrective action plan and track progress against it. 

Continue to develop and refine outcome metrics for the human 

spaceflight portfolio analysis and planning effort to provide better metrics 

to assess improvements in program outcomes.

What Remains to Be Done
NASA Acquisition Management

Page 226 GAO-19-157SP High-Risk Series 

• In conjunction with its new corrective action plan, institute a program for 

monitoring and independently validating the effectiveness and 

sustainability of corrective measures.

In October 2017, we raised a matter for Congressional consideration that 

Congress should consider requiring the NASA Administrator to direct the 

Exploration Systems Development organization within the Human 

Exploration and Operations Mission Directorate to establish separate cost 

and schedule baselines for work required to support Space Launch 

System and Exploration Ground Systems for the second combined 

exploration mission and establish separate cost and schedule baselines 

for each additional capability that encompass all life-cycle costs, to 

include operations and sustainment. We made this a matter for 

Congressional consideration because NASA has not acted on our May 

2014 recommendation to establish baselines for these programs or for 

capabilities beyond NASA’s first test flight, and does not have plans to do 

either. 

NASA Commercial Crew Program: Plan Needed to Ensure Uninterrupted 

Access to the International Space Station. GAO-18-476. Washington, 

D.C.: July 11, 2018.

NASA Major Projects: Portfolio Is at Risk for Continued Cost Growth and 

Schedule Delays. GAO-18-576T. Washington, D.C.: June 14, 2018.

NASA: Assessments of Major Projects. GAO-18-280SP. Washington, 

D.C.: May 1, 2018.

James Webb Space Telescope: Integration and Test Challenges Have 

Delayed Launch and Threaten to Push Costs Over Cap. GAO-18-273. 

Washington, D.C.: February 28, 2018.

NASA Commercial Crew Program: Continued Delays Pose Risks for 

Uninterrupted Access to the International Space Station. GAO-18-317T. 

Washington, D.C.: January 17, 2018.

NASA: Preliminary Observations on the Management of Space 

Telescopes. GAO-18-277T. Washington, D.C.: December 6, 2017. 

NASA Human Space Exploration: Integration Approach Presents

Challenges to Oversight and Independence. GAO-18-28. Washington, 

D.C.: October 19, 2017.

NASA: Assessments of Major Projects. GAO-17-303SP. Washington, 

D.C.: May 16, 2017.

NASA Human Space Exploration: Delay Likely for First Exploration 

Mission. GAO-17-414. Washington, D.C.: April 27, 2017.

Congressional Actions Needed

Related GAO 

Products
DOD Contract Management

Page 227 GAO-19-157SP High-Risk Series 

The Department of Defense (DOD) faces challenges in how it defines, strategically manages, and budgets for 

its contracted services, which typically account for about half of the department’s $300 billion in annual contract 

obligations.

Since our 2017 High-Risk Report, 

our assessment of all five criteria 

remains unchanged for DOD 

Contract Management. DOD 

continues to demonstrate top 

leadership support for addressing 

challenges in its (1) acquisition 

workforce, (2) service 

acquisitions, and (3) operational 

contract support (OCS), which is 

defined as planning for and 

obtaining supplies, services, and 

construction from commercial 

sources in support of joint 

operations. 

DOD has taken steps to improve 

its capacity, but continues to face challenges. DOD’s progress on the 

action plan criterion was mixed across the segments. While the 

monitoring criterion remains partially met overall, we saw significant 

improvement within the OCS segment as DOD changed its strategy for 

addressing tasks that we previously found would be difficult to monitor. 

DOD continues to take action to meet the demonstrated progress 

criterion—with additional management attention needed for service 

acquisition. 

Over the years since we added this area to our High-Risk List, we have 

made numerous recommendations related to this high-risk issue, 18 of 

which were made since the last high-risk update in February 2017. As of 

November 2018, 41 recommendations related to this high-risk area are 

open.

DOD Contract Management

Why Area Is High Risk

DOD obligates hundreds of billions of 

dollars annually on contracts for goods 

and services. We added DOD’s contract 

management to our High-Risk List in 

1992 and have identified three major 

areas of challenges: acquisition 

workforce, service acquisitions, and 

operational contract support.

DOD reduced the size of its acquisition 

workforce in the mid-1990s as defense 

budgets decreased. Amid concerns 

about skill gaps and a growing reliance 

on contractors, DOD has been rebuilding 

its workforce since 2009. A skilled 

acquisition workforce is vital to 

maintaining military readiness, 

increasing DOD’s buying power, and 

achieving savings.

DOD’s long-standing challenges in 

managing service contracts are evident 

in its difficulties clearly defining 

requirements, a fragmented and 

uncoordinated approach to acquiring 

services, and limited information on what 

the department plans to spend on 

specific types of contracted services in 

its budget forecasts. 

DOD has spent billions of dollars on 

contractors to support military activities it 

conducts around the world. Since 2010, 

we have reported that DOD has faced 

difficulties in identifying capability gaps, 

developing guidance, and integrating 

operational contractor support into plans 

and training. 

Contact Information

For additional information about this 

high-risk area, contact Timothy J. 

DiNapoli at (202) 512-4841 or 

dinapolit@gao.gov. 
DOD Contract Management

Page 228 GAO-19-157SP High-Risk Series 

Ratings for this segment remain unchanged 

since our 2017 High-Risk Report, with DOD 

meeting one criterion and making mixed 

progress on the other four criteria. 

Leadership commitment: met. DOD 

continues to exhibit leadership commitment 

to sustaining the size and improving the 

professionalism of its acquisition workforce. 

Specifically, DOD issued an updated 

acquisition workforce strategic plan in 

October 2016. Additionally, DOD issued a 

workforce rationalization plan in September 2017, which reinforces the 

need for the department to ensure that the civilian workforce is sized 

appropriately to complement its military personnel and to avoid artificial 

constraints on civilian workforce size and arbitrary reductions.

Capacity: partially met. DOD increased the size of its acquisition 

workforce beyond its initial 2015 target of 147,000 to more than 169,000 

as of the third quarter of fiscal year 2018. It has also taken steps to 

ensure that the acquisition workforce has the requisite skills, tools, and 

training to perform key tasks. For example, DOD is conducting follow-up 

career field competency assessments to determine which skill gaps 

identified in initial assessments have been addressed based on a 

recommendation we made in December 2015. 

However, other improvements need to be made. For example, while 

DOD’s October 2016 strategic plan provides an overall framework for the 

acquisition workforce, it does not identify time frames, metrics, or 

projected budgetary requirements associated with key goals or strategic 

priorities. Further, in a February 2018 report, we recommended ways the 

military departments could improve how they train, mentor, retain, and 

ultimately select program managers—a critical acquisition career field—

based upon practices used by leading organizations. The military 

departments agreed with those recommendations but have not yet 

identified a strategy for how they will be implemented. 

Action plan: partially met. In October 2016, DOD issued an updated 

acquisition workforce strategic plan which, among other things, assessed 

its current capacity and capability, and identified risks that DOD needed 

to manage to meet future needs. In addition, in September 2017, DOD 

issued its workforce rationalization plan. However, neither the October 

2016 strategic plan nor the September 2017 workforce rationalization 

plan established specific targets. 

Further, we reported in March 2018 that the military departments 

generally had not developed plans to use an annual inventory of 

Acquisition Workforce
DOD Contract Management

Page 229 GAO-19-157SP High-Risk Series 

contracted services for workforce and budget decisions, as statutorily 

required. Using an annual inventory could help it make more strategic 

decisions about the right workforce mix of military, civilian, and contractor 

personnel, and better align resource needs through the budget process to 

achieve that mix. DOD stated in its comments on that report that it is 

committed to improving its inventory processes. 

Monitoring: partially met. DOD continues to track workforce growth 

metrics, as well as education and training metrics, on a quarterly basis. 

DOD acknowledged that it will need to develop and implement other 

metrics to track progress toward meeting the goals identified in its 

October 2016 strategic workforce plan, including those related to shaping 

the future acquisition workforce. 

Demonstrated progress: partially met. Metrics tracked by DOD provide 

evidence that DOD is sustaining the size of the acquisition workforce and 

making progress in improving the workforce quality. DOD has not, 

however, verified that the current composition of the workforce will meet 

its future requirements. Until DOD develops metrics to track progress 

associated with shaping the future acquisition workforce, such as 

workforce targets as a whole or by specific career fields, it will not be able 

to demonstrate that their strategic workforce planning efforts and 

associated initiatives are successful.

As of November 2018, 14 recommendations related to this high-risk area

had not been implemented. To help ensure DOD’s acquisition workforce 

has sufficient capacity and capability to meet future needs, DOD needs to

• conduct follow-up competency assessments to assess whether identified 

skill gaps have been closed, and

• continue efforts to improve the utility of the inventory of contracted 

services. 

Ratings for this segment have not changed 

since our 2017 High-Risk Report. DOD has 

met one criterion and made mixed progress 

on the other four criteria.

Leadership commitment: met. DOD has 

demonstrated sustained leadership 

commitment through its ongoing efforts to 

revise its January 2016 service acquisition 

instruction. This instruction established 

policy, assigned responsibilities, and 

provided procedures for defining, assessing, 

reviewing, and validating requirements for service acquisitions. The 

What Remains to Be Done

Service Acquisitions
DOD Contract Management

Page 230 GAO-19-157SP High-Risk Series 

instruction formalized a hierarchical approach to more strategically 

manage service acquisitions at both the DOD and the component level. 

Our August 2017 report concluded that DOD’s efforts, simply stated, were 

not successful, in part because it was met with strong cultural resistance 

to changing DOD’s traditional decentralized approach to managing 

services. Our prior work had cautioned that a top-down, one-size-fits-all 

approach may not work. 

Further, our August 2017 report showed that certain commands already 

managed or awarded the majority of a particular service, and were more 

closely aligned to the commanders that are responsible for executing the 

mission. In turn, this finding suggested that these commands might be in 

a better position to strategically manage specific service portfolios. A 

DOD official stated that DOD expects to issue a revised instruction by 

early to mid-2019. Further, DOD’s Chief Management Office is assessing 

ways to improve how it manages service acquisitions, including aligning 

its portfolios with those established under the Office of Management and 

Budget’s (OMB’s) category management initiative.

Capacity: partially met. In 2013, DOD established leadership positions 

in the Office of the Secretary of Defense (OSD) and at the military 

departments that were intended to strategically manage service 

acquisitions by portfolio. In August 2017 we reported, however, that 

individuals in these positions had multiple responsibilities and limited 

capacity to do so. We recommended DOD reassess the roles, 

responsibilities, authorities, and organizational placement of these

positions. DOD concurred and is rewriting its 2016 service acquisition 

instruction to address our recommendation, among other things.

Action plan: not met. DOD does not have a comprehensive action plan 

but has or is undertaking a number of specific efforts to improve how it 

acquires services. These efforts, however, have produced limited results. 

For example, DOD’s January 2016 services acquisition instruction 

required that OSD-level leaders for each portfolio of services develop 

appropriate metrics to actively manage and report improvements in 

service acquisition. Similarly, senior leaders at the component level were 

to use portfolio metrics and data to effectively monitor cost and postaward performance to improve the efficiency and effectiveness of the 

contracted services. Further, the instruction developed a process to 

implement Services Requirements Review Boards to prioritize and 

approve services in a portfolio-based manner, but we found that they had 

minimal effect on supporting trade-off decisions within and across service 

portfolios or helping inform budgeting decisions. DOD is revising its 

instruction, in part to address these issues, which it hopes to issue by 

early- to mid-2019.

As part of its ongoing efforts, DOD intends to align its services portfolios 

with OMB’s category management initiative, which is intended to 
DOD Contract Management

Page 231 GAO-19-157SP High-Risk Series 

streamline and manage entire categories of spending across the 

government more like a single enterprise. DOD has established goals and 

metrics associated with the use of OMB’s designated “best-in-class” 

contracting vehicles (contracting vehicles recommended for agency use) 

and the amount of services that it considers to be strategically managed. 

DOD is also assessing ways to include its projected spending on services 

in its future-years defense plan, which we recommended in 2016. 

Relatedly, Congress has mandated that, effective October 2021, DOD 

include certain information on amounts requested for services contracts in 

the future-years defense program.

Monitoring: partially met. Because DOD lacks an action plan and 

cannot determine how future budgetary requirements are affected by its 

ongoing initiatives, it is not yet positioned to fully assess its progress in 

improving service acquisition overall. DOD is monitoring, however, its use 

of best-in-class vehicles and the amount of services it considers to be 

strategically managed under the category management initiative.

Demonstrated progress: partially met. While DOD’s fiscal year 2018 

performance results are not expected to be finalized until January 2019, a 

DOD official reported that DOD expects that it will meet OMB’s target that 

nearly $60 billion in DOD contract obligations would be considered to be 

strategically managed, but will fall short of OMB’s target that about $12 

billion would be obligated under OMB’s designated best-in-class vehicles.

As of November 2018, 10 recommendations related to this high-risk area 

had not been implemented. To improve the acquisition of services, DOD 

needs to 

• define desired outcomes for service acquisitions by establishing goals 

and measures and obtaining data needed to measure progress; 

• ensure that components revise their requirements review processes so 

that service acquisitions are prioritized and approved in a 

comprehensive, portfolio-based manner;

• reassess the roles, responsibilities, and organizational placement of key 

leadership positions as it revises its January 2016 instruction; and 

• establish milestones to measure progress toward achieving the statutory 

requirement to include projected spending on services in its future-years 

defense program.

What Remains to Be Done
DOD Contract Management

Page 232 GAO-19-157SP High-Risk Series 

For this segment, the monitoring criterion 

improved to met since our 2017 High-Risk 

Report. The ratings for the other four criteria 

remain unchanged. 

Leadership commitment: met. DOD 

continues to demonstrate sustained 

commitment and strong leadership support 

in addressing OCS issues. For example, in 

August 2018, the Joint Requirements 

Oversight Council issued an OCS 

memorandum approving 15 critical actions 

to institutionalize OCS across DOD, strengthen DOD’s ability to perform 

OCS, and ensure OCS contributes to all phases and ranges of joint 

military operations. DOD transitioned OCS responsibilities of the Deputy 

Assistant Secretary of Defense (Program Support) to the newly 

established Office of the Deputy Assistant Secretary of Defense 

(Logistics) in the summer of 2018. DOD officials stated that this change 

was due to the reorganization of the Office of the Under Secretary of 

Defense (Acquisition, Technology, and Logistics).

Moving forward, it will be important for DOD to demonstrate that this 

reorganization supports a continued commitment to OCS at the level of 

senior leadership. DOD officials stated in November 2018 that the 

Functional Capabilities Integration Board would still serve as the 

governance forum for OCS issues. DOD is in the process of revising and 

expanding the board’s charter, which it anticipates completing in 2019.

Capacity: partially met. DOD continues to face challenges in OCS 

capability shortfalls that create risk to operational effectiveness, timelines, 

and resource expenditures, and prevent DOD from reaching full OCS 

capacity. However, efforts are underway to address these shortfalls. For 

example, one of the 15 critical actions identified in the August 2018 Joint 

Requirements Oversight Council memorandum is the development of a 

functional competency model to capture OCS skill sets that according to 

DOD will be used to inform DOD-wide budgeting and manpower 

decisions. 

Action plan: met. In September 2017, DOD issued its fifth OCS Action 

Plan, which is organized around 10 capability gaps that needed to be 

closed to institutionalize OCS capability. The action plan is DOD’s primary 

mechanism for measuring progress toward closing the capability gaps. 

Monitoring: met. DOD monitors and documents progress against the 

OCS Action Plan’s identified tasks and goals. Because of these efforts, 

DOD has now met the monitoring criterion. In addition, DOD adjusted 

certain approaches to allow it to better gauge progress. For example, in 

Operational Contract 

Support
DOD Contract Management

Page 233 GAO-19-157SP High-Risk Series 

our 2017 High-Risk Report, we reported that some of the subtasks in a 

Joint Staff annex supplementing the 2016 OCS Action Plan were not 

clearly defined and would be difficult to monitor. In response, the 2017 

action plan noted that those efforts would be addressed directly under a 

logistics working group that would track performance measures. To better 

integrate OCS into guidance, the 2017 OCS Action Plan identified a new 

effort to develop and implement procedures to analyze, update, and 

create tools to support integration of OCS data into (1) planning and 

deployment systems, and (2) training on accessing and using OCS data. 

Demonstrated progress: partially met. DOD continues to make 

progress in addressing recommendations we have previously identified 

as high priority. For example, DOD issued a directive-type memorandum 

in April 2018 that identified several key DOD offices to jointly develop 

comprehensive, department-wide vendor vetting guidance, among other 

things. A dedicated working group is developing the guidance. 

Additionally, DOD is revising instructions detailing how OCS should be 

integrated into plans and training, among other things. Senior DOD 

officials expect to issue the instruction in 2019. Moreover, in response to 

our recommendation that the military departments develop OCS 

guidance, the Army, Air Force, Navy, and Marine Corps have done so. 

As of November 2018, 17 recommendations related to this high-risk area

had not been implemented. To enhance DOD’s ability to effectively 

manage OCS for current and future operations, DOD needs to 

• address identified OCS capability shortfalls, 

• develop comprehensive vendor vetting guidance, and

• integrate lessons learned into existing OCS guidance.

Operational Contract Support: Actions Needed to Strengthen DOD 

Vendor Vetting Efforts. GAO-19-37C. Washington, D.C.: December 20, 

2018.

DOD Contracted Services: Long-Standing Issues Remain about Using 

Inventory for Management Decisions. GAO-18-330. Washington, D.C.: 

March 29, 2018.

Defense Acquisition Workforce: Opportunities Exist to Improve Practices 

for Developing Program Managers. GAO-18-217. Washington, D.C.: 

February 15, 2018.

Defense Contracted Services: DOD Needs to Reassess Key Leadership 

Roles and Clarify Policies for Requirements Review Boards. 

GAO-17-482. Washington, D.C.: August 31, 2017.

What Remains to be Done

Related GAO 

Products
DOD Contract Management

Page 234 GAO-19-157SP High-Risk Series 

Operational Contract Support: Actions Needed to Enhance Capabilities in 

the Pacific Region. GAO-17-428. Washington, D.C.: June 23, 2017.

Defense Acquisition Workforce: DOD Has Opportunities to Further 

Enhance Use and Management of Development Fund. GAO-17-332. 

Washington, D.C.: March 28, 2017.
Enforcement of Tax Laws

Page 235 GAO-19-157SP High-Risk Series 

The Internal Revenue Service (IRS) needs to increase its capacity to implement new initiatives, improve 

ongoing enforcement and taxpayer service programs, and combat identity theft refund fraud.

Since our 2017 High-Risk Report, 

ratings for all five criteria remain 

unchanged. IRS continues to 

demonstrate top leadership 

commitment for improving tax 

compliance and has made strides 

in improving tax gap data. The 

agency has also taken steps to 

address identity theft (IDT) refund 

fraud through continued 

development and deployment of 

the Return Review Program 

(RRP), a system which screens 

returns for potential IDT and other 

refund fraud before IRS issues 

refunds.

However, IRS’s capacity to implement new initiatives, carry out ongoing 

enforcement and taxpayer service programs, and combat IDT refund 

fraud remains a challenge. IRS continues to take actions toward meeting 

three other criteria for removal from our High-Risk List: developing a 

corrective action plan, monitoring, and demonstrating progress. 

Addressing the Tax Gap

Ratings for this segment of the high-risk 

area remain unchanged since our previous 

High-Risk Report in 2017, with IRS meeting 

one criterion, partially meeting three, and 

not meeting one. 

Leadership commitment: met. IRS 

adopted a more strategic approach to 

identifying and selecting budget program 

priorities, among other steps. For instance, 

IRS’s fiscal year 2018-2022 strategic plan 

includes a goal to facilitate voluntary 

compliance and deter noncompliance that could help address the tax gap. 

Capacity: not met. IRS continues to face capacity challenges because it 

does not calculate return on investment estimates for each enforcement 

Enforcement of Tax Laws

Why Area Is High Risk

This high-risk area, added to the list in 

1990, comprises two pressing 

challenges for IRS—addressing the tax 

gap and combatting IDT refund fraud. In 

2016, IRS estimated that the average 

annual net tax gap, the difference 

between taxes owed and taxes paid on 

time, was $406 billion, on average, for 

tax years 2008-2010. IRS enforcement 

of the tax laws helps fund the U.S. 

government by collecting revenue from 

noncompliant taxpayers and, perhaps 

more importantly, promoting voluntary 

compliance by giving taxpayers 

confidence that others are paying their 

fair share.

IDT refund fraud occurs when an identity 

thief files a fraudulent tax return using a 

legitimate taxpayer’s identifying 

information and claims a refund. IRS 

estimates that at least $12.2 billion in 

individual IDT tax refund fraud was 

attempted in 2016, of which it prevented 

at least $10.5 billion (86 percent). Of the 

amount attempted, IRS estimated that at 

least $1.6 billion (14 percent) was paid.

Contact Information

For additional information about this 

high-risk area, contact James R. 

McTigue, Jr. or Jessica Lucas-Judy at 

202-512-9110 or mctiguej@gao.gov or 

lucasjudyj@gao.gov
Enforcement of Tax Laws

Page 236 GAO-19-157SP High-Risk Series 

program—information IRS could use to inform resource allocation 

decisions. IRS has also not evaluated the costs and benefits of expanding 

RRP to address more tax enforcement activities, such as underreporting 

and noncompliance more broadly. Moreover, IRS still faces challenges for 

implementing new initiatives and carrying out ongoing enforcement and 

taxpayer service programs under an uncertain budgetary environment.

Action plan: partially met. IRS has a strategic plan that discusses 

general approaches to make voluntary compliance easier for taxpayers 

and to ensure taxes owed are paid. However, in some areas, the strategic 

plan does not include specific efforts for improving compliance. In 

addition, IRS has not documented a comprehensive strategy that shows 

how it intends to use National Research Program (NRP) data to develop 

or improve compliance strategies. IRS collects data through NRP audits 

to measure and report tax compliance for different types of taxes and 

taxpayers.

Monitoring: partially met. IRS continues to use tax gap data to study 

compliance behaviors and update formulas designed to identify tax 

returns with a high likelihood of noncompliance. In addition, the Large 

Business and International division is implementing a new approach to 

compliance that focuses on specific issues, such as partnerships that 

underreport certain types of income. However, IRS does not adequately 

measure the effect of some compliance programs, such as those used for 

large partnerships, because it has not clearly defined them, tracked the 

results from auditing such entities, or analyzed how to better use audit 

resources for these types of returns.

Demonstrated progress: partially met. IRS implemented some 

corrective measures to improve compliance and reduce the tax gap, 

including its use of RRP to screen individual returns claiming refunds, but 

more work remains to meet this criterion. IRS also lacks specific 

quantitative goals to reduce the tax gap or improve voluntary compliance. 

Without long-term, quantitative voluntary compliance goals and related 

performance measures, it will be more difficult for IRS to determine the 

success of its strategies. 

Over the years since we added this area to our high-risk list, we have 

made numerous recommendations related to this high-risk issue, 103 of 

which were made since the last high-risk update in February 2017. As of 

December 2018, 189 recommendations are open. IRS should implement 

all of our recommendations on improving audit effectiveness and 

resource investments, such as:

• re-establishing goals for improving voluntary compliance and developing 

and documenting a strategy that outlines how it will use its data to update 

compliance strategies that could help address the tax gap,

What Remains to Be Done
Enforcement of Tax Laws

Page 237 GAO-19-157SP High-Risk Series 

• developing and documenting plans to assess the NRP employment tax 

study results to estimate the current state of the employment tax gap, 

and

• evaluating the costs and benefits of expanding RRP to analyze individual 

returns not claiming refunds to support other enforcement activities. 

Given that the tax gap has been a persistent issue, reducing the tax gap 

will require targeted legislative actions, including additional third-party 

information reporting, enhanced electronic filing, math error authority, and 

paid preparer regulation. Specifically, Congress should consider:

• expanding third-party information reporting to IRS, which could increase 

voluntary tax compliance. For example, reporting could be required for 

certain payments that rental real estate owners make to service 

providers, such as contractors who perform repairs on their rental 

properties, and for payments that businesses make to corporations for 

services; 

• requiring additional taxpayers to electronically file tax and information 

returns to help IRS improve compliance efficiency;

• providing IRS with authority—with appropriate safeguards—to correct 

math errors and to correct errors in cases where information provided by 

the taxpayer does not match information in government databases, 

among other things, could help IRS correct errors and avoid burdensome 

audits and taxpayer penalties; and

• establishing requirements for paid tax return preparers to help improve 

the accuracy of the tax returns they prepare. 

Ratings for this segment of the high-risk 

area remain unchanged since our previous 

High-Risk Report in 2017, with IRS meeting 

two criteria and partially meeting the other 

three. 

Leadership commitment: met. IRS has 

demonstrated leadership commitment in 

addressing IDT refund fraud. For example, 

IRS has taken significant actions to facilitate 

information sharing with states and industry 

partners through the Identity Theft Tax 

Refund Fraud Information Sharing and Analysis Center. 

Capacity: partially met. In October 2016, IRS began operating RRP as 

its primary pre-refund system for detecting IDT and other refund fraud, 

automating some of IRS’s manual processes for screening returns, and 

identifying fraud schemes. Although IRS can adjust RRP during the filing 

season to respond to emerging threats or other concerns, IRS’s ability to 

combat IDT fraud continues to be challenged as a result of large-scale 

Congressional Actions Needed

Refund Fraud 

Related to Identify 

Theft
Enforcement of Tax Laws

Page 238 GAO-19-157SP High-Risk Series 

cyberattacks on various entities. However, identity theft refund fraud is an 

evolving and costly problem, the risks of which have increased as more 

personally identifiable information has become readily available.

Action plan: met. IRS has a strategic plan that identifies refund fraud 

and IDT as major challenges facing the nation’s tax system over the next 

several years. IRS has also identified several strategic objectives relevant 

to its efforts to combat IDT. Further, IRS is using RRP to automatically 

detect IDT and other refund fraud in individual returns, and is working to 

expand RRP to detect fraud in business returns.

Monitoring: partially met. Following a security breach with the Get 

Transcript program, IRS changed its authentication procedures for 

affected taxpayers and has prevented a total of about $591 million in 

fraudulent payments between fiscal years 2015 through 2017. In addition, 

RRP prevented about $4.4 billion in invalid refunds during the 2017 filing 

season. However, in July 2018 we found ways to improve and expand the 

program—such as increasing the amount of data available, including 

loading W-2 data into it more frequently and digitizing paper returns. As 

we reported in June 2018, IRS also lacks internal controls to effectively 

monitor telephone, in-person, and correspondence authentication.

Demonstrated progress: partially met. IRS has demonstrated some 

progress by developing tools and programs to further detect and prevent 

IDT refund fraud, such as RRP, which uses advanced analytic techniques 

and business rules to compare taxpayer-reported information to W-2s. 

IRS has also improved telephone authentication procedures and 

enhanced its authentication efforts for some online services by requiring a 

multi-factor process using the Secure Access platform. However, in June 

2018 we reported that IRS could further demonstrate progress by 

updating its authentication procedures to be in compliance with new 

government standards. Further, IRS has not articulated priorities for its 

foundational authentication initiatives or the resources it will require to 

complete them, sufficiently assessed and monitored risks, or developed a 

comprehensive process to evaluate potential new authentication 

technologies and approaches. As a result, IRS may be missing an 

opportunity to implement the most secure, robust technologies to protect 

taxpayers.

IRS should implement all of our recommendations for addressing IDT 

refund fraud, including:

• finding ways to improve and expand RRP, such as increasing the 

frequency at which incoming W-2 information is available to the program;

• assessing the benefits and costs of additional uses and applications of 

W-2 data for pre-refund compliance checks, such as other fraud or 

noncompliance before issuing refunds; 

What Remains to Be Done
Enforcement of Tax Laws

Page 239 GAO-19-157SP High-Risk Series 

• prioritizing foundational authentication initiatives and the resources 

required to complete them; and

• developing a comprehensive process to identify and evaluate alternative 

options for improving taxpayer authentication. 

Given that IDT refund fraud has been an ongoing issue, combating it will 

require targeted legislative actions, including:

• requiring that returns prepared electronically but filed on paper include a 

scannable code printed on the return to better leverage RRP’s 

capabilities; and 

• providing the Secretary of the Treasury with the regulatory authority to 

lower the threshold for electronic filing of W-2s from 250 returns annually 

to between 5 to 10 returns, as appropriate. 

Tax Fraud and Noncompliance: IRS Could Further Leverage the Return 

Review Program to Strengthen Tax Enforcement, GAO-18-544. 

Washington, D.C.: July 24, 2018.

Identity Theft: IRS Needs to Strengthen Taxpayer Authentication Efforts, 

GAO-18-418. Washington, D.C.: June 22, 2018. 

Tax Fraud and Noncompliance: IRS Can Strengthen Pre-refund 

Verification and Explore More Uses, GAO-18-224. Washington, D.C.: 

January 30, 2018.

Identity Theft: Improved Collaboration Could Increase Success of IRS 

Initiatives to Prevent Refund Fraud, GAO-18-20. Washington, D.C.: 

November 28, 2017.

Tax Gap: IRS Needs Specific Goals and Strategies for Improving 

Compliance, GAO-18-39. Washington, D.C.: October 31, 2017.

Employment Taxes: Timely Use of National Research Program Results 

Would Help IRS Improve Compliance and Tax Gap Estimates, 

GAO-17-371. Washington, D.C.: April 18, 2017.

IRS Return Selection: Improved Planning, Internal Controls, and Data 

Would Enhance Large Business Division Efforts to Implement New 

Compliance Approach, GAO-17-324. Washington, D.C.: March 28, 2017.

2016 Filing Season: IRS Improved Telephone Service but Needs to 

Better Assist Identity Theft Victims and Prevent Release of Fraudulent 

Returns, GAO-17-186. Washington, D.C.: January 31, 2017.

Congressional Actions Needed

Related GAO 

Products
Enforcement of Tax Laws

Page 240 GAO-19-157SP High-Risk Series 

Tax Debt Collection: IRS Needs to Define Field Program Objectives and 

Assess Risks in Case Selection, GAO-16-787. Washington, D.C.: 

September 13, 2016.

IRS 2017 Budget: IRS Could Improve Presentation of Budget Data in Its 

Congressional Justification, GAO-16-695. Washington, D.C.: July 21, 

2016.
Medicare Program & Improper Payments 

Page 241 GAO-19-157SP High-Risk Series 

The Centers for Medicare & Medicaid Services (CMS) made some progress reducing improper payments but 

needs to take further action to address Medicare’s financial and oversight challenges.

Since our 2017 High-Risk Report, 

Medicare program officials have 

continued to address challenges 

in managing the program better. 

First, CMS has made progress in 

addressing improper payments. 

Specifically, CMS has 

demonstrated it is now meeting 

the capacity criterion, has 

maintained its leadership 

commitment to addressing 

Medicare improper payments, 

and partially meets the remaining 

three criteria.

The Medicare program has faced 

challenges in three additional 

broad segments—(1) payments, provider incentives, and program 

management under Medicare fee-for-service (FFS); (2) Medicare 

Advantage (MA) and other Medicare health plans; and (3) design and 

oversight of the Medicare program and the effects on beneficiaries. We 

are not rating CMS’s progress against the high-risk criteria for the 

remaining three segments for two main reasons. First, the Medicare 

program is subject to frequent legislative updates to provider payments 

and other policies. This active congressional participation in the details of 

the program means that many factors are outside of the agency’s control. 

Second, the Medicare program is in a profound state of transition from a 

payment system that rewards providers based on the volume and 

complexity of health care services they deliver to one that ties payments 

to the quality and efficiency of care. While this shift ultimately may save 

money and lead to beneficiaries receiving better care, it may be several 

years before we can judge the results.

Since we added Medicare to our High-Risk List in 1990, we have made 

more than 700 recommendations related to this high-risk area, 28 of 

which were made since the last high-risk update in February 2017. As of 

December 2018, more than 80 recommendations remain open.

Medicare Program & Improper Payments

Why Area Is High Risk

In calendar year 2017, Medicare 

financed $702 billion worth of health 

services for approximately 58 million 

elderly and disabled beneficiaries. This 

represents approximately 17 percent of 

federal spending, and spending is 

expected to increase significantly over 

the next ten years. Due to its size, 

complexity, and susceptibility to 

mismanagement and improper 

payments, we first designated Medicare 

as a high-risk program in 1990. Medicare 

continues to challenge the federal 

government because of (1) its outsized 

impact on the federal budget and the 

health care sector as a whole, (2) the 

large number of beneficiaries it serves, 

and (3) the complexity of its 

administration. 

Medicare also faces a significant risk 

with improper payments—payments that 

either were made in an incorrect amount 

or should not have been made at all—

which reached an estimated $48 billion 

in fiscal year 2018. CMS—which 

administers and oversees the Medicare 

program—should continue to take 

actions to prevent and reduce improper 

payments in the program. 

Contact Information

For additional information about this 

high-risk area, contact James Cosgrove 

or Jessica Farb at (202) 512-7114 or 

cosgrovej@gao.gov and farbj@gao.gov. 
Medicare Program & Improper Payments 

Page 242 GAO-19-157SP High-Risk Series 

Since our 2017 High-Risk Report, the 

capacity criterion has progressed from 

partially met to met and ratings for the 

remaining four criteria remain unchanged. 

Leadership commitment: met. CMS has 

continued to demonstrate leadership 

commitment by naming a new Director for 

the Center for Program Integrity (CPI)—

CMS’s centralized entity for Medicare and 

Medicaid program integrity issues—and 

implementing some of our 

recommendations. In December 2017, we reported CMS has committed 

to reducing fraud—one source of improper payments—by creating an 

organizational culture and structure conducive to fraud risk management. 

Capacity: met. CPI’s budget and resources have increased over time, 

and the agency has established work groups and interagency 

collaborations to extend its capacity. For example, CMS allocated 

additional staff to CPI after Congress provided additional funding. CPI’s 

full-time equivalent positions increased from 177 in 2011 to 419 in 2017. 

In August 2017, we reported CMS’s Fraud Prevention System, which 

analyzes claims to identify health care providers with suspect billing 

patterns, has also helped speed up certain investigation processes. 

Further, the Healthcare Fraud Prevention Partnership has helped improve 

information sharing among payers inside and outside of the government. 

Action plan: partially met. CMS continues to identify and report 

progress on corrective actions related to Medicare improper payments. It 

reported this progress in the Department of Health and Human Services’ 

(HHS) annual Agency Financial Report and started a Medicare FFS 

action plan based on our suggestions. However, work remains to be done 

to meet this criterion. As of October 2018, CMS’s action plan had yet to 

include clear metrics and timeframes as we suggested, and does not

address MA—the private plan alternative to FFS, or Medicare Part D—the 

outpatient prescription drug program. In addition, as we reported in 

December 2017, CMS has neither conducted a complete fraud risk 

assessment nor created a risk-based antifraud strategy for Medicare. This 

strategy, if implemented, would allow the agency to better ensure it is 

addressing the full portfolio of risks and strategically targeting the most 

significant fraud. 

Monitoring: partially met. CMS made progress to improve monitoring in 

some areas, such as its oversight of Medicare provider education efforts. 

However, to make further progress, CMS needs to implement our open 

recommendations related to overseeing its enrollment screening process 

and evaluating Medicare Administrative Contractor effectiveness in 

Improper Payments
Medicare Program & Improper Payments 

Page 243 GAO-19-157SP High-Risk Series 

preventing improper payments. CMS should also monitor metrics 

developed for its improper payment action plan. 

Demonstrated progress: partially met. Estimated improper payment 

rates declined more than one percent from fiscal year 2016 to 2018 for all 

parts of Medicare—to 8.12 percent, 8.10 percent, and 1.66 percent for 

FFS, MA, and Medicare Part D, respectively. However, according to the 

Office of Management and Budget, the rate and amount of improper 

payments made in Medicare still represent some of the highest in the 

government. Many of our recommendations that could further lower these 

rates remain open. For example, CMS has not implemented 

recommendations to improve MA improper payment recovery or sought 

legislative authority to permit payment for recovery auditors to conduct 

prepayment claims reviews. Reviewing Medicare claims before payment 

can prevent improper payment. Further, CMS made some progress 

implementing recommendations related to expanding the use of prior 

authorizations based on our April 2018 report. However, CMS has yet to 

fully implement prior authorization expansion to additional items and 

services with high improper payment rates.

To better prevent, identify, and recover improper payments across all 

parts of the Medicare program, CMS should fully implement our open 

recommendations related to Medicare program integrity. CMS should:

• seek legislative authority to allow the Recovery Auditors to conduct 

prepayment reviews in addition to postpayment claims reviews; 

• provide Medicare Administrative Contractors—contractors that process 

and pay Medicare claims—with written guidance on how to accurately 

calculate and report savings from prepayment claim reviews; 

• improve the processes for selecting contracts to include in its risk 

adjustment data validation audits—audits of MA organizations that help 

CMS recover improper payments in cases where beneficiary diagnoses 

are unsupported by medical records; 

• take steps, based on the results from evaluations, to continue prior 

authorization, such as by resuming paused demonstrations, extending 

demonstrations, or by identifying new opportunities to expand prior 

authorization to additional items and services; and

• provide and require fraud-awareness training to its employees, conduct 

fraud risk assessments, and create an antifraud strategy for Medicare, 

including an approach for evaluation.

What Remains to Be Done
Medicare Program & Improper Payments 

Page 244 GAO-19-157SP High-Risk Series 

As CMS progresses towards full implementation of its value-based 

payment system, it will be important for the agency to use reliable quality 

and efficiency measures and methodological approaches that maximize 

the number of physicians for whom value can be determined. 

We have not rated this segment because (1) the Medicare program is 

subject to frequent legislative updates to provider payments and other 

policies and (2) the Medicare program is currently in a state of transition 

from a payment system that rewards providers based on volume and 

complexity of health care services to one that ties payment to the quality 

and efficiency of care.

Appeals process. In May 2016, we reported Medicare had seen 

significant growth in the number of appeals submitted by providers, 

beneficiaries, and others dissatisfied with the program’s decisions to deny 

or reduce payments for claims. While CMS has implemented a more 

efficient way to adjudicate repetitive claims as we had recommended, 

other recommendations regarding the appeals process remain open, as 

discussed later in this section.

Medicare program management. CMS has faced challenges managing 

the Medicare program, including efforts to improve program efficiency and 

provide better service to beneficiaries. For example, we reported in 

September 2016 that implementation of the Durable Medical Equipment, 

Prosthetics, Orthotics, and Supplies Competitive Bidding Program had 

resulted in Medicare savings, and available evidence did not indicate 

widespread effects on beneficiary access; however, stakeholders have 

reported some specific access issues, such as difficulty locating contract 

suppliers that will furnish certain items. CMS suspended its competitive 

bidding program as of January 1, 2019, to further assess concerns raised 

by stakeholders and to determine whether changes were needed to 

improve the program’s overall effectiveness.

Hospital value-based purchasing program. The Hospital Value-Based 

Purchasing program provides financial incentives to acute-care hospitals 

to provide efficient, high-quality care to Medicare beneficiaries. In June 

2017, we reported some hospitals with high efficiency scores received 

bonuses despite having relatively low quality scores. This contradicts 

CMS’s intention to reward high-quality care provided at a lower cost. We 

have an open recommendation related to the hospital value-based 

purchasing program, discussed later in this section. 

Cancer hospitals. Unlike teaching hospitals paid under Medicare’s 

prospective payment systems (PPS), the methodology for paying PPSexempt cancer hospitals (PCH) provides little incentive for efficiency. In 

our February 2015 report, we recommended Congress consider requiring 

Medicare to pay PCHs in the same manner it pays PPS teaching 

hospitals, or provide the Secretary of HHS with the authority to otherwise 

Payments, Provider 

Incentives, and 

Program 

Management under 

Medicare Fee-forservice
Medicare Program & Improper Payments 

Page 245 GAO-19-157SP High-Risk Series 

modify how Medicare pays PCHs. We have an open matter related to 

cancer hospitals, discussed later in this section.

Hospital-physician consolidation. Because Medicare often pays more 

for services performed in a hospital outpatient department than a 

physician’s office, hospitals may have an incentive to acquire physician 

practices and hire physicians as salaried employees—a financial 

arrangement known as vertical consolidation. In December 2015, we 

reported that, from 2007 through 2013, the number of vertically 

consolidated hospitals increased from about 1,400 to 1,700 and the 

number of vertically consolidated physicians increased from 96,000 to 

182,000. In our December 2015 report, we recommended Congress 

direct the Secretary of HHS to equalize payment rates between hospital 

outpatient departments and physician offices for evaluation and 

management office visits, and other services as appropriate. We have an 

open matter related to hospital-physician consolidation, discussed later in 

this section. 

While Congress enacted legislation to exclude services furnished by offcampus hospital outpatient departments from higher payment, this 

exclusion does not apply to services furnished by providers under 

construction or billing as hospital outpatient departments prior to 

November 2015, or to services provided by on-campus hospital outpatient 

departments. However, CMS has taken some action. In November 2018, 

CMS issued a final rule capping payment rates for certain services 

furnished by off-campus hospital outpatient departments existing or under 

construction in 2015 at the physician fee schedule rate. Since these 

services furnished by these off-campus hospital outpatient departments 

are currently paid under a higher rate, the payment cap would equalize 

payment rates for clinical visits between settings. The application of the 

payment cap will take place over 2 years. In 2019, 50 percent of the 

payment reduction will be applied and in 2020 and subsequent years, 100 

percent of the payment reduction will be applied. However, CMS’s 

authority to implement this rule has been challenged in federal district 

court.

We have recommended to the Secretary of HHS or CMS several actions, 

including the following:

• The Secretary of HHS should direct relevant agencies to modify the 

various Medicare appeals data systems to collect consistent data, 

including data on appeal categories and appeal decisions.

• CMS should revise the formula for calculating a hospital’s total 

performance score under the Hospital Value-Based Purchasing Program 

or take other actions so the efficiency score does not have a 

disproportionate effect on the total performance score.

What Remains to Be Done
Medicare Program & Improper Payments 

Page 246 GAO-19-157SP High-Risk Series 

We have also identified areas that would require Congressional actions to 

be addressed:

• In our February 2015 report, we recommended that Congress consider 

requiring Medicare to pay PCHs as it pays PPS teaching hospitals, or 

provide the Secretary of HHS with the authority to otherwise modify how 

Medicare pays PCHs. In doing so, Congress should provide that all 

forgone outpatient payment adjustment amounts be returned to the 

Supplementary Medical Insurance Trust Fund. 

• As mentioned above, Medicare pays for evaluation and management 

services in all hospital outpatient departments regardless of whether they 

are deemed on-campus or off-campus. Congress should consider 

equalizing payment rates Medicare pays for certain health care services, 

as we suggested in December 2015, between all hospital outpatient 

settings, and return the associated savings to the Medicare program. 

The MA program provides health care coverage to Medicare beneficiaries 

through private health plans. The number and percentage of Medicare 

beneficiaries enrolled in MA has grown steadily over the past several 

years, increasing from approximately 10 million (21 percent of all 

Medicare beneficiaries) in 2008 to about 19 million (32 percent of all 

Medicare beneficiaries) in 2017. Similar to the FFS program, the MA 

program has been in a period of transition. For example, in April 2018, 

CMS finalized guidance for 2019 intended to provide more flexibility to 

sponsors of MA plans in how they design plans, such as by expanding 

the types of supplemental benefits plans can offer to include services that 

compensate for physical impairments.

We have not rated this segment because (1) the Medicare program is 

subject to frequent legislative updates to provider payments and other 

policies and (2) the Medicare program is currently in a state of transition 

from a payment system that rewards providers based on volume and 

complexity of health care services to one that ties payment to the quality 

and efficiency of care.

Network adequacy. In August 2015, we reported on shortcomings in 

CMS’s criteria for determining network adequacy, how the agency 

oversees MA organizations’ adherence to its requirements, and how it 

ensures enrollees are properly notified about provider network changes. 

We have an open recommendation related to network adequacy, 

discussed later in this section.

MA plan payment adjustments. In January 2012 and 2013, we reported 

that CMS’s adjustments to account for differences between FFS and MA 

providers’ coding of medical diagnoses were too low, resulting in billions 

of excess payments to MA plans. We have an open recommendation 

related to MA plan payment adjustments, discussed later in this section.

Congressional Actions Needed

Medicare Advantage 

and Other Medicare 

Health Plans
Medicare Program & Improper Payments 

Page 247 GAO-19-157SP High-Risk Series 

Encounter data. As we reported in January 2017, CMS has begun to use 

encounter data—claims-like data collected from the sponsors of MA 

plans—in its methodology for risk adjusting payments to MA plans. While 

the encounter data were intended to improve the accuracy of risk 

adjustment, the data have yet to be fully validated. We have an open 

recommendation related to the encounter data, discussed later in this 

section.

We have recommended to CMS several actions, including to:

• augment MA network adequacy criteria to address provider availability;

• take steps to improve the accuracy of risk score adjustments by, for 

example, accounting for additional beneficiary characteristics such as sex 

and health status; and

• (1) establish specific plans and time frames for using encounter data for 

all purposes other than risk adjusting payments to MA organizations; and 

(2) complete all the steps necessary to validate the data, including 

performing statistical analyses, reviewing medical records, and providing 

MA organizations with summary reports on findings. 

The design and CMS’s oversight of the Medicare program affect both 

beneficiaries’ out-of-pocket costs and the quality and safety of care they 

receive. Medicare FFS’s benefit design does not include a cap on the 

maximum cost-sharing amount a beneficiary can be responsible for 

during a given year for covered services, which could leave beneficiaries 

vulnerable to catastrophic costs, especially if they do not have 

supplemental insurance. In addition, Medicare spending can affect the 

premiums beneficiaries pay. In 2018, the Medicare Trustees estimated 

Medicare spending will grow at a faster rate than workers’ earnings and 

the economy overall, which will impose a significant burden on many 

Medicare beneficiaries and the country. With regard to quality, CMS 

reported that Medicare Quality Improvement Organizations provided 

oversight that helped to prevent tens of thousands of beneficiaries from 

being admitted or readmitted to hospitals, and reduced the number of 

nursing home patients with pressure ulcers or who were restrained, from 

fiscal years 2011 through 2014.

We have not rated this segment because (1) the Medicare program is 

subject to frequent legislative updates to provider payments and other 

policies and (2) the Medicare program is currently in a state of transition 

from a payment system that rewards providers based on volume and 

complexity of health care services to one that ties payment to the quality 

and efficiency of care.

End-stage renal disease. In October 2015, we reported that only a small 

fraction of Medicare patients had used the Kidney Disease Education 

What Remains to be Done

Design and Oversight 

of the Medicare 

Program and the 

Effects on 

Beneficiaries
Medicare Program & Improper Payments 

Page 248 GAO-19-157SP High-Risk Series 

benefit, which provides pre-dialysis education intended to inform 

treatment decisions. Benefit utilization may be limited because of 

statutory limitations on the types of providers who are permitted to furnish 

the benefit and on the patients eligible to receive it. We have an open 

recommendation related to the Kidney Disease Education benefit, 

discussed later in this section. 

Prescription Opioids. In October 2017, we reported that while CMS 

oversees the prescribing of drugs at a high risk of abuse, it does not 

analyze data specifically on opioids. We have three open 

recommendations related to prescription opioids, one of which is 

discussed later in this section.

We have recommended to CMS several actions, including to:

• examine the Kidney Disease Education benefit and, if appropriate, seek 

legislation to revise provider and patient eligibility criteria for the benefit; 

and

• take three actions related to prescription opioids, including Identifying the 

number of at-risk beneficiaries receiving high doses of opioids.

Medicare: CMS Should Take Actions to Continue Prior Authorization 

Efforts to Reduce Spending. GAO-18-341. Washington, D.C.: April 20, 

2018.

Medicare and Medicaid: CMS Needs to Fully Align Its Antifraud Efforts 

with the Fraud Risk Framework. GAO-18-88. Washington, D.C.: 

December 5, 2017.

Prescription Opioids: Medicare Needs to Expand Oversight Efforts to 

Reduce the Risk of Harm. GAO-18-15. Washington, D.C.: October 6, 

2017.

Medicare: CMS Fraud Prevention System Uses Claims Analysis to 

Address Fraud. GAO-17-710. Washington, D.C.: August 30, 2017.

Hospital Value-Based Purchasing: CMS Should Take Steps to Ensure 

Lower Quality Hospitals Do Not Qualify for Bonuses. GAO-17-551. 

Washington, D.C.: June 30, 2017.

Medicare Advantage: CMS Should Use Data on Disenrollment and 

Beneficiary Health Status to Strengthen Oversight. GAO-17-393. 

Washington, D.C.: April 28, 2017.

What Remains to be Done

Related GAO 

Products
Medicare Program & Improper Payments 

Page 249 GAO-19-157SP High-Risk Series 

Medicare Provider Education: Oversight of Efforts to Reduce Improper 

Billing Needs Improvement. GAO-17-290. Washington, D.C.: March 10, 

2017.
Strengthening Medicaid Program Integrity

Page 250 GAO-19-157SP High-Risk Series 

The Centers for Medicare & Medicaid Services (CMS) has taken steps, but further efforts are needed to reduce 

improper payments, ensure the appropriate use of program dollars, and improve program data. 

Since our 2017 High-Risk Report, 

CMS has taken important steps to 

strengthen Medicaid program 

integrity. Further, leadership has 

demonstrated a commitment to 

continuing these efforts by 

outlining a high-level program 

integrity strategy. Still, work 

remains to fully “meet” all of the 

high-risk criteria. 

As of November 2018, more than 

70 of our recommendations 

related to Medicaid remain open, 

and several major steps remain to 

improve Medicaid program 

integrity. For example, more efforts are needed to mitigate the risks not 

captured in CMS’s improper payment estimate—particularly for managed 

care. CMS can also do more to target risk in overseeing the use of 

program dollars and to expedite the use of improved Medicaid data in 

program oversight. For this report, we are rating three segments of the 

Medicaid program, all of which are priority areas identified by CMS. CMS 

has met our criteria for leadership commitment for improper payments, 

the one segment we rated in 2017, and the other four criteria remain 

partially implemented. For the remaining two segments—the appropriate 

use of Medicaid dollars and Medicaid data—CMS partially meets nearly 

all criteria. 

Improper Payments

Since our 2017 High-Risk Report, we have 

increased one of the five criteria.

Leadership commitment: met. CMS has 

shown an increased commitment to 

oversight of improper payments. In June 

2018, CMS communicated the agency’s 

strategy for improving program integrity, 

including plans for a number of new and 

enhanced efforts to detect and respond to 

improper payments. For example, the 

strategy highlighted a commitment to 

Strengthening Medicaid Program Integrity

Why Area Is High Risk

The size, growth, and diversity of the 

joint federal-state Medicaid program 

present oversight challenges and we 

designated Medicaid a high-risk program 

in 2003. Since then, we have made more 

than 270 recommendations related to 

the program.

In fiscal year 2018, Medicaid covered an 

estimated 75 million low-income and 

medically needy individuals at a cost of 

$629 billion, of which $393 billion was 

financed by the federal government. 

Services are increasingly delivered 

through managed care, under which 

organizations are paid a set amount per 

beneficiary for care. 

Our recent work highlights oversight 

challenges in three areas: improper 

payments, appropriate use of program 

dollars, and data. First, Medicaid 

improper payments represented about 

9.8 percent of federal program 

spending—$36.2 billion—in fiscal year 

2018. Second, CMS can waive certain 

Medicaid requirements and authorize 

states to incur new types of expenditures 

through demonstrations; as of November 

2016, CMS had done so for nearly threequarters of states. Supplemental 

payments—made to providers, such as 

local government hospitals and not 

linked to specific beneficiary services—

grew to over $48 billion in 2016, the most 

recent year for which data are available. 

Third, CMS’s oversight of Medicaid often 

relies on state-reported expenditure and 

utilization data. Incomplete and 

inconsistent state data complicate 

program oversight. 

Contact Information

For additional information about this 

high-risk area, contact Carolyn L. Yocom 

at (202) 512-7114 or yocomc@gao.gov. 
Strengthening Medicaid Program Integrity

Page 251 GAO-19-157SP High-Risk Series 

enhanced auditing efforts and monitoring compliance with new managed 

care rules established in 2016. Further, CMS has taken important steps 

towards coordinating oversight with state auditors as a means of 

expanding its oversight of improper payments. 

Capacity: partially met. CMS has taken actions to enhance the 

resources and guidance available to states for program integrity 

purposes. Based on its reviews of states’ program integrity activities, 

CMS has targeted high-risk areas in each state, including managed care, 

and expanded federal-state collaborative audits to include Medicaid 

managed care organizations (MCO). In 2018, CMS reported working to 

improve federal-state collaborative audits, such as by meeting with all 

states to discuss how operational audit issues will be handled moving 

forward, including planning for new collaborative audits. However, efforts 

to date do not ensure CMS can estimate an improper payment rate for 

managed care that reflects all program risks. Additionally, as we reported 

in July 2018, impediments to conducting audits of managed care—such 

as a focus on states with certain provisions around overpayments in MCO 

contracts—continue.

Action plan: partially met. In June 2018, CMS outlined a strategy to 

reduce Medicaid improper payments, including plans to check the 

accuracy of MCO’s financial statements, assist states with screening 

Medicaid providers, and initiate audits of certain state beneficiary 

eligibility determinations. If fully implemented, these steps could address 

some of the concerns we raised in January 2017 and May 2018. 

However, CMS has not detailed the scope and timing of this strategy. For 

example, the strategy does not include how many states will be part of 

the targeted audits for MCO financial statements nor does it specify 

implementation dates. 

Monitoring: partially met. Our work has detailed concerns related to the 

accuracy of provider eligibility and beneficiary enrollment, both of which 

can have an impact on CMS’s ability to monitor improper payments. To 

improve the effectiveness of managed care provider screening, CMS 

analyzed 22 databases used by MCOs and formally incorporated 6 into 

the agency’s provider screening process. However, efforts to enhance 

screening are ongoing and the agency does not require states to report 

MCO overpayments. Gaps also remain in CMS’s efforts to ensure that 

only eligible individuals are enrolled and expenditures for enrollees, 

mainly those eligible through the Patient Protection and Affordable Care 

Act expansion, are matched appropriately by the federal government. 

Demonstrated progress: partially met. CMS’s overall estimated 

Medicaid improper payment rate declined from 10.5 percent in fiscal year 

2016 to 9.8 percent in fiscal year 2018. This rate is comprised of three 

components: (1) fee-for-service (FFS) payments to providers, (2) 

payments to MCOs, and (3) the accuracy of beneficiary eligibility 
Strengthening Medicaid Program Integrity

Page 252 GAO-19-157SP High-Risk Series 

determinations. The FFS component of the error rate is 14.3 percent, 

primarily due to state’s non-compliance with provider screening, 

enrollment, and identification requirements. The reduction in the overall 

error rate occurred as spending shifted from FFS to managed care, where 

estimates of improper payments—at 0.22 percent in 2018—do not 

account for all program risks. In particular, CMS’s estimates of MCO 

improper payments do not include a medical review of services or reviews 

of MCO records or data, which likely minimizes the appearance of 

program risks in Medicaid managed care. The beneficiary eligibility 

component of the error rate is 3.1 percent, a rate that CMS has not 

updated since 2014, raising further questions regarding the accuracy of 

the overall rate. CMS plans to resume eligibility component measurement 

in 2019. 

Since designating Medicaid as a high-risk area in 2003, we have made at 

least 45 recommendations related to improper payments, 17 of which 

were open as of November 2018. To reduce improper payments, CMS 

needs to: 

• mitigate program risks not measured through its estimate of MCO 

improper payments, such as overpayments and unallowable costs—such 

efforts could include actions such as revising the payment error rate 

methodology or focusing additional audit resources on managed care; 

• expedite the issuance of planned guidance on MCO program integrity, 

address impediments to MCO audits, and ensure states account for 

overpayments when setting future payment rates; and

• review federal determinations of Medicaid eligibility for accuracy, use the 

information obtained from the eligibility reviews to inform expenditure 

reviews, and increase assurances that expenditures for different eligibility 

groups are correctly reported and appropriately matched.

We are rating this segment for the first time. 

CMS has taken important steps—such as 

improved reporting of payments and steps to 

mitigate federal financial exposure—to better 

ensure the appropriate use of Medicaid 

dollars. Our work has identified risks—and 

potential actions to mitigate these risks—

related to oversight of demonstration 

spending under section 1115 of the Social 

Security Act, supplemental payments, and 

Medicaid expenditures more broadly.

Leadership commitment: partially met. With respect to demonstrations, 

CMS began implementing a policy in 2016 that significantly improves 

efforts to assure demonstrations are budget neutral—that is, that the 

What Remains to Be Done

Appropriate Use of 

Medicaid Dollars
Strengthening Medicaid Program Integrity

Page 253 GAO-19-157SP High-Risk Series 

demonstration does not increase federal costs. Further, as we previously 

recommended in June 2013 and April 2017, the agency issued guidance 

to states in August 2018 articulating the agency’s budget neutrality policy, 

which improves transparency in how CMS approves demonstration 

spending limits and consistency in oversight of demonstration spending. 

However, additional policy changes are needed to address other 

questionable methods—particularly relying on hypothetical rather than 

actual expenditures—used to set spending limits and to provide 

policymakers with timely findings from evaluations of demonstrations. 

With regard to supplemental payments—payments made to providers 

such as local government hospitals and other providers in addition to 

claims-based payments—CMS anticipates issuing a proposed rule in 

early 2019 designed to increase transparency by establishing new 

requirements for states. However, until CMS issues a final rule, its 

potential effect on program integrity efforts will remain unclear. 

Capacity: partially met. With regard to demonstrations, CMS actions 

show promise, but are, to date, incomplete. As of November 2018, CMS 

had developed a standard reporting tool to ensure that states consistently 

report the data elements needed for CMS to assess compliance with 

demonstration spending limits and was beginning to test this tool. The 

agency also was developing procedures for CMS staff to consistently 

track spending compared with spending limits. Until these procedures are 

fully implemented, the impact on oversight of demonstrations remains 

unclear.

With regard to supplemental payments, as of November 2018, CMS had 

issued letters to some states clarifying that the distribution of 

supplemental payments must be linked to the provision of Medicaidcovered services. Because supplemental payments are not linked directly 

to services for beneficiaries, there is risk that they may not be made for 

Medicaid activities or services. CMS has not taken action on our 

recommendation that the agency issue guidance on the appropriate 

distribution of supplemental payments to all states, nor has it issued other 

needed guidance, including criteria to assure that payments meet 

statutory requirements. 

With regard to oversight of states’ reported expenditures and in response 

to our findings, CMS plans to conduct a national assessment of whether 

oversight resources are adequate and target areas of greatest risk. This 

is critical, as the complexity of expenditure reporting has increased while 

staff resources used to review states’ expenditures has decreased, thus 

hindering CMS’s ability to target risk and protect federal and state dollars.

Action plan: partially met. With respect to demonstrations, the agency 

has issued guidance to states in 2017 and 2018 with the intent to improve 

efforts to ensure demonstrations are budget neutral and effectively 
Strengthening Medicaid Program Integrity

Page 254 GAO-19-157SP High-Risk Series 

evaluated. However, this guidance addresses some, but not all, of the 

concerns we raised in January 2018 about how CMS sets spending limits 

and evaluates demonstrations. For example, CMS has not yet 

implemented its plan to establish written procedures for all states to 

submit a final evaluation report at the end of each demonstration cycle, 

nor has it established criteria for when the agency will allow limited 

evaluations. Further, CMS has not made progress with regard to an 

action plan for improving its oversight of supplemental payments.

Monitoring: partially met. For demonstrations, CMS has begun 

assessing the effect of its new budget neutrality policy with the renewal of 

each demonstration. Agency officials told us that CMS has developed a 

reporting tool for states that will allow for monitoring of the policy over 

time. Until CMS implements the tool, it will lack the data it needs to 

effectively monitor this new policy.

For supplemental payments, CMS has taken action when we and others 

identified questionable payments (payments where the appropriateness 

of the amounts or use of funds were questionable). CMS reviewed 

excessive payments we identified in April 2015 in New York and made 

retroactive payment reductions totaling more than $1.5 billion, of which 

the federal share was about $771 million. However, CMS continues to 

lack a strategy for systematically identifying questionable payments.

Demonstrated progress: partially met. CMS has not made significant 

progress towards improving its oversight of supplemental payments, for 

which reporting remains incomplete. With regard to oversight of 

demonstration spending, CMS estimated its budget neutrality policy 

reduced total demonstration spending limits by $109 billion for 2016 

through 2018, the federal share of which is $62.9 billion. Another 

component of that policy does not take effect until 2021 and will be 

implemented as demonstrations come up for renewal—which should 

further reduce federal liabilities. 

Since designating Medicaid as a high-risk area in 2003, we have made at 

least 55 recommendations related to the appropriate use of program 

dollars, 18 of which were open as of November 2018. CMS needs to take 

the following steps to better assure the appropriate use of Medicaid 

dollars:

• address questionable methods—particularly relying on hypothetical 

rather than actual expenditures—used to set demonstration spending 

limits, develop and document standard operating procedures for 

monitoring spending under demonstrations, assure timely state 

evaluation of demonstrations, and develop a policy for publicly releasing 

findings from federal evaluations of demonstrations;

What Remains to Be Done
Strengthening Medicaid Program Integrity

Page 255 GAO-19-157SP High-Risk Series 

• ensure complete and accurate reporting on supplemental payments 

made to individual hospitals and institutional providers, as well as the 

sources of funds states use to finance their share of Medicaid payments; 

outline clear criteria, data, and a review process to ensure supplemental 

payments are economical and efficient; and write guidance clarifying its 

policy that requires a link between the distribution of supplemental 

payments and Medicaid-covered services; and

• complete a risk assessment and take steps, as needed, to assure that 

resources to oversee expenditures reported by states are adequate and 

allocated according to risk. 

Congressional action could improve oversight of Medicaid expenditures, 

particularly related to supplemental payments and demonstrations: 

• Congress should consider establishing statutory requirements for the 

Secretary of the Department of Health and Human Services to improve 

the demonstration review process to more clearly outline the methods 

used to demonstrate budget neutrality, and

• Congress should consider broadening supplemental payment 

requirements around reporting and auditing to include all types of 

supplemental payments. 

We are rating the Medicaid data segment 

for the first time. CMS has taken steps to 

improve data quality across the Medicaid 

program, primarily through a reenvisioning of states’ data reporting. 

However, CMS needs to take additional 

steps to ensure data quality and specify 

how and when it will use improved data 

for oversight. Accurate and complete data 

on beneficiary access and use of services 

and the costs of providing such services 

are critical to effectively managing and 

overseeing this multibillion dollar program. 

Leadership commitment: partially met. CMS has made progress in 

improving Medicaid data through the ongoing implementation of the 

Transformed Medicaid Statistical Information System (T-MSIS). As of 

June 2018, all states, the District of Columbia, and Puerto Rico were 

submitting at least some T-MSIS data. However, we reported in 

December 2017 that these data were not complete, nor were they 

comparable across states. We recommended CMS take steps to expedite 

the use of T-MSIS data for oversight. CMS noted in July 2018 that its 

primary goal is to improve data quality, and more work is needed before it 

can use these data for oversight. 

Congressional Actions Needed

Medicaid Data
Strengthening Medicaid Program Integrity

Page 256 GAO-19-157SP High-Risk Series 

Capacity: partially met. The 2016 managed care final rule includes 

several requirements that could improve the reliability of state-collected 

MCO utilization data, known as encounter data. These requirements 

include requiring states to conduct an independent audit of the encounter 

data reported by each MCO, providing CMS with an annual assessment 

of these data, and validating data reliability. However, it remains unclear 

whether state efforts to validate encounter data will be sufficient, in part 

because CMS has not provided minimum standards to states for doing 

so. 

Action plan: not met. CMS needs to develop an action plan for using 

quality program data for program oversight. In December 2017, we 

recommended CMS articulate a plan and associated time frames for 

using T-MSIS data for oversight. The agency concurred, but has yet to 

specify such a plan. It notes the use of these data for oversight is 

contingent upon ongoing CMS and state efforts to ensure their quality. 

Similarly, in January 2017, we recommended CMS develop a plan for 

using data on personal care services (PCS)—assistance with activities of 

daily living such as bathing, dressing, and toileting, for beneficiaries with 

limited ability to care for themselves—to inform oversight efforts. CMS 

has yet to develop this plan. 

Monitoring: partially met. In February 2018, CMS issued guidance on 

Medicaid PCS reported by states, which suggests that states include key 

data elements in PCS claims reported through T-MSIS and could address 

information gaps we identified. T-MSIS also includes data elements for 

states to report provider-specific supplemental payments, which CMS did 

not previously collect. However, we reported in December 2017 that 

several selected states were not reporting all these data elements. 

Without complete information, CMS’s oversight of PCS and supplemental 

payments will be limited.

Demonstrated progress: partially met. The ongoing implementation of 

T-MSIS has been a significant, multi-year effort. With all states now 

reporting at least some T-MSIS data, CMS is focused on assessing and 

improving data quality. CMS identified 12 top priority items and issued a 

State Health Official letter in August 2018 that informed states they are 

expected to resolve data quality issues related to these priority items 

within 6 months. CMS stated that it will request states that do not meet 

this time frame to submit a corrective action plan. CMS also noted that it 

intends to expand data reviews beyond the 12 top priority items, but has 

not specified a time frame for completing this and other data quality 

efforts or its plans for using these data for oversight. 

Since designating Medicaid as a high-risk area in 2003, we have made 

over 35 recommendations related to Medicaid data, 13 of which were 

What Remains to be Done
Strengthening Medicaid Program Integrity

Page 257 GAO-19-157SP High-Risk Series 

open as of November 2018. To improve the quality of Medicaid data for 

use in program oversight, CMS needs to: 

• provide states with guidance that includes minimum standards for 

encounter data validation procedures;

• provide states with information on scope and methodology requirements 

for MCO encounter data audits, required content of the annual 

assessment report, and circumstances for deferring or disallowing 

matching funds in response to noncompliant encounter data 

submissions; and 

• continue efforts to assess and improve T-MSIS data, such as refining the 

overall data priority areas to identify those variables most critical for 

reducing improper payments, and articulate specific plans and associated 

timeframes for using T-MSIS data.

Medicaid Managed Care: Additional CMS Actions Needed to Help Ensure 

Data Reliability. GAO-19-10. Washington, D.C.: October 19, 2018

Medicaid: CMS Needs to Better Target Risks To Improve Oversight of 

Expenditures. GAO-18-564. Washington, D.C.: August 6, 2018.

Medicaid Managed Care: Improvements Needed to Better Oversee 

Payment Risks. GAO-18-528. Washington, D.C.: July 26, 2018.

Medicaid Demonstrations: Evaluations Yielded Limited Results, 

Underscoring Need for Changes to Federal Policies and Procedures. 

GAO-18-220. Washington, D.C.: January 19, 2018. 

Medicaid: Further Action Needed to Expedite Use of National Data for 

Program Oversight. GAO-18-70. Washington, D.C.: December 8, 2017.

Medicaid Demonstrations: Federal Action Needed to Improve Oversight 

of Spending. GAO-17-312. Washington, D.C.: April 3, 2017.

Medicaid: Program Oversight Hampered by Data Challenges, 

Underscoring Need for Continued Improvements. GAO-17-173. 

Washington, D.C.: January 6, 2017.

Medicaid: Federal Guidance Needed to Address Concerns About 

Distribution of Supplemental Payments. GAO-16-108. Washington, D.C.: 

February 5, 2016.

Medicaid: Additional Efforts Needed to Ensure that State Spending is 

Appropriately Matched with Federal Funds. GAO-16-53. Washington, 

D.C.: October 16, 2015.

Related GAO 

Products
Strengthening Medicaid Program Integrity

Page 258 GAO-19-157SP High-Risk Series 

Medicaid: CMS Oversight of Provider Payments is Hampered by Limited 

Data and Unclear Policy. GAO-15-322. Washington, D.C.: April 10, 2015.

Medicaid: More Transparency of and Accountability for Supplemental 

Payments Are Needed. GAO-13-48. Washington, D.C.: November 26, 

2012.

Medicaid Demonstration Waivers: Recent HHS Approvals Continue to 

Raise Cost and Oversight Concerns. GAO-08-87. Washington, D.C.: 

January 31, 2008.
Improving and Modernizing Federal Disability 

Programs

Page 259 GAO-19-157SP High-Risk Series 

Management attention and efforts are needed across the government to ensure that disability programs 

provide benefits in a timely manner, reflect current ideas about disability, and achieve positive employment 

outcomes. 

Since our 2017 High-Risk Report, 

our assessment of ratings for all 

five criteria remains unchanged.

Both the Social Security 

Administration (SSA) and the 

Department of Veterans Affairs 

(VA) made mixed progress in 

addressing their claims 

workloads. Leadership of both 

agencies demonstrated 

commitment to reducing backlogs 

in their appeals workloads. 

However, these backlogs remain 

large, and persistent 

shortcomings in agency plans 

and capacity challenges could hinder progress.

Both SSA and VA demonstrated leadership commitment toward updating 

the criteria on which their disability determinations are made. However, 

action plans for both lack details on some necessary tasks that could 

result in delays in updating disability criteria now and in the future.

The Office of Management and Budget (OMB) reported that the 

administration is pursuing additional legislative and administrative 

changes and demonstration projects to increase workforce participation 

for people with disabilities. However, many efforts are still underway, and 

OMB continues to lack a larger vision for coordinating disability programs, 

which includes creating appropriate, government-wide goals and 

strategies.

Improving and Modernizing Federal 

Disability Programs

Why Area Is High Risk

An estimated one in six working-age 

Americans reported a disability in 2010. 

Many of these Americans need help 

finding or retaining employment, or rely 

on cash benefits if they cannot work. 

However, federal disability programs 

struggle to meet their needs.

Three of the largest federal disability 

programs—two managed by SSA and 

one by VA—dispensed about $270 

billion in cash benefits to 21 million 

people with disabilities in fiscal year 

2017. Both agencies struggle to manage 

their workloads, specifically appealed 

claims. 

In addition, when determining whether 

individuals qualify for disability benefits, 

SSA and VA rely on outdated criteria. 

While both agencies have efforts 

underway to update medical or 

occupational information used to make 

eligibility decisions, they continue to rely 

on information that can be decades old.

In addition to the aforementioned cash 

benefit programs, we previously 

identified over 40 programs managed by 

nine different agencies that provide a 

patchwork of employment support for 

people with disabilities. We reported in 

2012 that these programs lacked a 

unified vision, strategy, or set of goals to 

guide their outcomes.

We designated improving and 

modernizing federal disability programs 

as high risk in 2003. 

Contact Information

For additional information about this 

high-risk area, contact Elizabeth H. 

Curda at (202) 512-7215 or 

curdae@gao.gov. 
Improving and Modernizing Federal Disability 

Programs

Page 260 GAO-19-157SP High-Risk Series 

Since our 2017 High-Risk Report, our 

assessment of ratings for all five criteria 

remains unchanged.

Leadership commitment: met. SSA 

leadership set a goal to process appeals 

within 270 days by fiscal year 2022, and 

made reducing its disability appeals 

backlog a key initiative in its fiscal year 

2019 annual performance plan.

Capacity: partially met. SSA continues to 

face capacity challenges in addressing its disability appeals backlog. 

SSA’s 2017 disability appeals plan called for increased hiring and other 

measures to reduce disability appeals backlogs and improve timeliness. 

SSA has also transferred appeals cases between offices to better utilize 

its capacity to make decisions. However, we reported in July 2018 that 

SSA lacks metrics to assess the effect of transfers on timeliness, and 

SSA agreed with our recommendation to implement such metrics. We 

also reported that SSA hiring freezes could affect its capacity.

Action plan: partially met. SSA’s 2017 appeals plan addresses large 

disability appeals workloads through improvements in information 

technology and business processes, and through increased hiring. 

However, it is too early to determine the extent to which this plan will 

allow SSA to achieve its goal of processing claims within 270 days. More 

broadly, SSA’s Vision 2025 strategic plan recognizes the need to provide 

a number of different service delivery methods, including online. 

However, in 2017 we reported that that SSA had not developed 

performance measures for or analyzed common issues with online 

services. SSA agreed with our recommendations to do so, but had not 

completed its efforts as of January 2019.

Monitoring: met. SSA continues to monitor and report on the timeliness 

of processing its initial disability claims and appeals workloads.

Demonstrated progress: partially met. While SSA has seen a decline 

in applications for benefits in recent years, SSA’s inventory of initial 

disability claims increased somewhat from 523,000 at the end of fiscal 

year 2017 to 565,000 at the end of fiscal year 2018. The number of 

pending appeals declined from approximately 1.1 million at the end of 

fiscal year 2017 to 858,000 in fiscal year 2018, and average processing 

times improved from 605 days to 595 days during this same period. 

However, additional progress is needed if SSA is to meet its goal of 

processing appeals within 270 days by the end of fiscal year 2022.

Managing Disability 

Claims Workloads 

(SSA)
Improving and Modernizing Federal Disability 

Programs

Page 261 GAO-19-157SP High-Risk Series 

Since 2003, we have made 35 recommendations related to this high-risk 

segment. As of December 2018, 10 remain open.

SSA should continue to make and implement plans for managing its 

workloads. This includes continuing to:

• refine and implement plans to address its disability appeals backlog, and

• operationalize its long-term strategic plan to ensure that the agency is 

well positioned to serve its customers in the future.

Since our 2017 High-Risk Report, our 

assessment of ratings for all five criteria 

remains unchanged.

Leadership commitment: met. VA has 

maintained leadership focus on managing 

initial disability claims and appeals 

workloads through various initiatives to 

improve benefits processing and reduce 

backlogs. Enhancing and modernizing VA’s 

disability claims and appeals processes are 

goals in its 2018–2024 strategic plan. 

Capacity: partially met. VA has continued building the capacity to 

process initial disability claims, such as using an electronic system to 

distribute claims ready for decisions to available staff. On appeals, VA is 

reforming its process, onboarding hundreds of new staff, and 

implementing new technology. However, as we reported in March 2018, 

VA’s appeals planning does not provide reasonable assurance that it will 

have the capacity to implement the new process and manage risks. VA 

agreed with our recommendation to better assess risks associated with 

appeals reform.

Action plan: partially met. VA continues to implement plans to reduce 

the initial disability claims backlog. For appeals reform, VA submitted its 

appeals plan in November 2017 and provided several progress reports 

throughout 2018. In December 2018, we reported that while VA had taken 

steps, it had not fully addressed our recommendations on planning the 

new appeals process and assessing its efficacy. As of December 2018, 

VA officials said they continue to address our recommendations.

Monitoring: partially met. VA monitors the timeliness of initial disability 

claims and legacy appeals, and has set timeliness goals for three of five 

appeal options under the new process. VA’s plans also signal how it 

intends to monitor the allocation of staff for concurrent workloads in its 

What Remains to Be Done

Managing Disability 

Claims Workloads 

(VA)
Improving and Modernizing Federal Disability 

Programs

Page 262 GAO-19-157SP High-Risk Series 

legacy and new appeals processes. However, as of December 2018, VA 

had not established complete metrics and interim goals for all appeal 

options, and it was unclear how and when VA will monitor implementation 

and efficacy of the new appeal process.

Demonstrated progress: partially met. VA reported it reduced the 

backlog of initial disability claims from 611,000 in March 2013 to just over 

85,000 in August 2018. However, VA’s Office of Inspector General 

reported in September 2018 that VA overstated its performance by only 

reporting about 79 percent of the backlog. For appeals, VA addressed 

some gaps in its plan for implementing appeals reform, in accordance 

with our 2017 and 2018 recommendations, and has prioritized processing 

of legacy appeals. However, as of August 2018, VA still had a backlog of 

over 400,000 appeals. 

Since 2003, we have made 65 recommendations related to managing VA 

workloads. As of December 2018, 13 remain open.

VA should continue updating and implementing plans to address its initial 

disability claims and appeals workloads at both levels. This includes: 

• maintaining focus on initial claims and appeals processing, 

• ensuring VA has detailed plans for creating capacity and reforming its 

appeals process, including modifications to information technology 

systems, and

• determining how well the new process is performing relative to the legacy 

process.

Since our 2017 High-Risk Report, ratings for 

the action plan criterion regressed while the 

other four remain unchanged. 

Leadership commitment: met. SSA has 

maintained leadership focus on updating 

both the medical and occupational criteria 

used to determine eligibility for Social 

Security disability benefits.

Capacity: met. Consistent with our past 

recommendations in June 2012, SSA 

continues to leverage the Bureau of Labor Statistics to develop an 

occupational information system (OIS) to replace SSA’s outdated 

Dictionary of Occupational Titles to assist in making disability 

determination decisions. 

What Remains to Be Done

Updating Disability 

Benefit Eligibility 

Criteria (SSA)
Improving and Modernizing Federal Disability 

Programs

Page 263 GAO-19-157SP High-Risk Series 

Action plan: partially met. SSA has developed project plans to guide 

the completion of OIS and update its medical criteria now and in the 

future. However, we are lowering SSA’s prior rating of met to partially 

met. Since our 2017 high-risk update, SSA told us that it began work on 

its Vocational Regulations Modernization (VRM) initiative—an effort SSA 

says will update its vocational rules to reflect labor market changes—but 

has not released a plan or any supporting documentation related to VRM.

Monitoring: met. SSA continues to monitor progress toward updating its 

medical criteria and has a timetable against which to monitor OIS 

development.

Demonstrated progress: partially met. A September 2018 status report 

from SSA stated that the agency promulgated final regulations for 13 of 

the 14 body systems (listings of diseases and disorders in each part of 

the body) and proposed a rule for comprehensively updating the last body 

system. SSA also reported that, once the final rule is complete, it will 

begin targeting updates to body systems per its plans to review and 

update them every 3 to 5 years. For OIS, SSA reported it planned to 

complete its final year of occupational data collection in 2018, and 

expects to start using it in deciding disability claims in calendar year 2020. 

Since 2003, we have made seven recommendations related to this highrisk segment, all of which were implemented.

SSA should continue to develop and implement plans to update its 

disability criteria. Specifically, SSA should:

• develop an action plan for implementing its VRM initiative that addresses 

when and how updates to its vocational rules will align with 

implementation of OIS, and

• finalize its comprehensive updates of medical criteria and begin using 

occupational data collected through its OIS.

Since our 2017 High-Risk Report, ratings for 

the action plan and monitoring criteria 

regressed while the other three remain 

unchanged. 

Leadership commitment: met. VA has 

sustained leadership focus on updating its 

Veterans Affairs Schedule for Rating 

Disabilities (VASRD)—used to assign 

degree of disability and compensation levels 

for veterans with military service-connected 

What Remains to be Done

Updating Disability 

Benefit Eligibility 

Criteria (VA)
Improving and Modernizing Federal Disability 

Programs

Page 264 GAO-19-157SP High-Risk Series 

injuries or conditions—to reflect advances in medicine and labor market 

changes. 

Capacity: partially met. In August 2017, VA officials told us that it had 

taken actions to hire more staff for the regulations updates and leverage 

outside researchers to evaluate veterans’ loss of earnings in the current 

economy. However, as of September 2018, the agency was still working 

to hire these staff. Moreover, VA’s current earnings loss study covers only 

8 of over 900 diagnostic codes and 2 of 15 body systems. VA needs to 

continue its current hiring and earnings loss planning efforts to ensure it 

has the capacity to comprehensively update the VASRD.

Action plan: partially met. As of August 2018, VA’s efforts to update the 

VASRD included new plans to conduct earnings loss studies for eight 

diagnostic codes under two body systems. The agency intends to 

determine whether its current approach for evaluating earnings loss is 

applicable to updating other diagnostic codes. However, we are lowering 

VA’s prior rating of met to partially met because its August 2018 updated 

plan, issued since our 2017 high-risk update, provides limited detail on 

key planned activities. For example, VA’s plans do not indicate how and 

when VA will assess the applicability of its current approach, and does 

not include plans for updating earnings loss information for the remaining 

diagnostic codes and body systems.

Monitoring: partially met. According to VA officials, VA continues to 

track its progress toward finishing the medical updates by fiscal year 2020 

and has updated its project plan to reflect delayed timeframes. However, 

we are lowering VA’s prior rating for this criterion from met to partially met 

because VA’s plans have changed since our last update, and although it 

is conducting a study to update earnings loss information for some 

diagnostic codes and body systems, its plan does not include timetables

for monitoring these or future updates to earnings loss information. 

Demonstrated progress: partially met. VA reported that as of 

December 2018, it promulgated final regulations for 6 of 15 body 

systems, proposed regulations for 2, and is reviewing draft regulations for 

the remaining 7. However, VA has fallen about 4 years behind in its 

efforts to fully update the VASRD and has not completed earnings loss 

updates.

Since 2003, we have made three recommendations related to 

modernizing disability criteria, all of which were implemented.

VA should continue to develop and implement plans for updating medical 

criteria and earnings loss information. This includes:

What Remains to be Done
Improving and Modernizing Federal Disability 

Programs

Page 265 GAO-19-157SP High-Risk Series 

• ensuring sufficient resources are dedicated to this effort, 

• developing a viable plan for monitoring progress in updating earnings 

loss information, and

• refining plans to revisit criteria at least once every 10 years.

Since our 2017 High-Risk Report, our 

assessment of ratings for all five criteria 

remains unchanged.

Leadership commitment: partially met. In 

September 2018, OMB reported that the 

administration is pursuing several legislative 

changes, administrative actions, and 

demonstration projects intended to either 

improve collaboration across multiple federal 

agencies or address the relatively low levels 

of employment of people with disabilities. 

However, OMB continues to lack a larger vision for coordinating over 40 

programs that support employment of people with disabilities, and 

establishing overarching goals to improve employment of people with 

disabilities in both federal and non-federal sectors. 

Capacity: partially met. According to OMB, the administration has 

proposed continued funding for several interagency demonstration 

projects that have potential to inform the development of reasonable 

goals and measures for federal programs that support employment for 

people with disabilities. However, it is too early to conclude whether these 

demonstrations will inform government-wide goals and measures, and 

OMB has not indicated that it will build capacity for establishing 

government-wide goals and improving agency coordination.

Action plan: not met. OMB has yet to establish government-wide goals 

and associated plans for the employment of people with disabilities 

outside of the federal sector. 

Monitoring: partially met. Since 2017, some progress has been made 

toward monitoring the hiring of individuals with disabilities in the federal 

sector. For example, in 2018, OMB reported that it would have sufficient 

data by the end of the year to assess progress toward a goal the 

Department of Labor set in 2013 that individuals with disabilities should 

comprise 7 percent of the workforce for federal contractors and 

subcontractors. 

Demonstrated progress: partially met. While progress has been made 

on previous goals related to federal-sector hiring, OMB has yet to develop 

Programs with Unified 

Strategies and Goals 

(OMB)
Improving and Modernizing Federal Disability 

Programs

Page 266 GAO-19-157SP High-Risk Series 

government-wide goals for all federal programs that support employment 

of people with disabilities across all sectors. 

As of December 2018, two actions related to this high-risk segment had 

not been fully addressed from our 2012 annual report on opportunities to 

reduce fragmentation, overlap, and duplication for the federal 

government. 

Moving forward, OMB should develop a set of unifying government-wide 

goals for employment of people with disabilities. OMB’s efforts to this end 

might benefit from an action plan. In general, agencies can make 

progress in addressing high-risk areas by developing action plans that 

identify and analyze the root causes of problems, and identify critical 

actions and outcomes to address those root causes.

VA Disability Benefits: Some Progress, but Further Steps Needed to 

Improve Appeals Reform Planning. GAO-18-661T. Washington, D.C.: 

July 24, 2018.

Social Security Disability: Better Timeliness Metrics Needed to Assess 

Transfers of Appeals Work. GAO-18-501. Washington, D.C.: July 19, 

2018.

VA Disability Benefits: Improved Planning Practices Would Better Ensure 

Successful Appeals Reform. GAO-18-352. Washington, D.C.: March 22, 

2018.

Social Security Disability: Additional Measures and Evaluation Needed to 

Enhance Accuracy and Consistency of Hearings Decisions. GAO-18-37. 

Washington, D.C.: December 7, 2017.

Social Security Administration: Improvements Needed in Facilities 

Planning and Service Delivery Evaluation. GAO-17-597. Washington, 

D.C.: July 25, 2017.

VA Disability Benefits: Additional Planning Would Enhance Efforts to 

Improve the Timeliness of Appeals Decisions. GAO-17-234. Washington, 

D.C.: March 23, 2017.

What Remains to be Done

Related GAO 

Products
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 267 GAO-19-157SP High-Risk Series 

The financial stability of the Pension Benefit Guaranty Corporation’s (PBGC) single- and multiemployer 

programs faces many structural challenges that require congressional action. 

As with our last High-Risk Report 

in 2017, we are not rating this 

high-risk area because 

addressing the identified issues 

primarily involves congressional 

action.

While PBGC faces a long-term 

challenge with its single-employer 

program, it faces an immediate 

and critical challenge with its 

multiemployer program. In a 

March 2013 report on PBGC’s 

multiemployer program, we 

recommended that Congress 

consider comprehensive and 

balanced structural reforms to reinforce and stabilize the multiemployer 

system. 

In 2014, Congress took action to address this growing crisis by passing 

the Multiemployer Pension Reform Act (MPRA) that enacted several 

reforms responsive to our report. Specifically, MPRA provided severely 

underfunded plans, under certain conditions and only with the approval of 

federal regulators, the option to reduce the retirement benefits of current 

retirees to avoid plan insolvency. The act also expanded PBGC’s ability to 

intervene when plans are in financial distress. In addition, MPRA more 

than doubled the flat-rate, or per participant, premiums paid by 

multiemployer plans (from $12 per participant in plan year 2014 to $26 

per participant in plan year 2015) and provided for future increases 

indexed to inflation. For plan year 2019, the per participant, flat-rate 

premium is $29.

Even though these reforms were intended to improve the program’s 

financial condition, PBGC's projections suggest that the insolvency of the 

multiemployer program remains highly likely within the next 6 years. 

Since 2013, the agency’s net financial deficit for the multiemployer 

program has grown nearly sixfold (see figure 14). Prior to passage of 

MPRA, PBGC estimated that the multiemployer insurance fund would 

likely be exhausted by 2022 as a result of current and projected plan 

insolvencies. In February 2017, we reported that PBGC officials said that 

the act did not fully address the crisis in the multiemployer program. 

Officials predicted the act's changes would only forestall insolvency by 

about an additional 3 years. As of year-end 2018, 25 multiemployer plans 

Pension Benefit Guaranty Corporation 

Insurance Programs

Why Area Is High Risk

With over $112 billion in assets, PBGC’s 

portfolio is one of the largest of any 

federal government corporation. Through 

its single-employer and multiemployer 

insurance programs, PBGC insures the 

pension benefits of nearly 37 million 

American workers and retirees who 

participate in about 24,800 private-sector 

defined benefit plans. PBGC’s financial 

future remains uncertain, due in part to a 

long-term decline in the number of 

traditional defined benefit plans and the 

collective financial risk of the many 

underfunded pension plans PBGC 

insures. We designated the singleemployer program as high risk in 2003 

and the multiemployer program in 2009.

Since fiscal year 2013, PBGC’s financial 

deficit has increased by nearly 45 

percent. At the end of fiscal year 2018, 

PBGC’s net accumulated financial deficit 

was over $51 billion—an increase of 

about $16 billion since 2013. The singleemployer program, composed of about 

23,400 plans, accounted for a surplus of 

$2.4 billion—an improvement of about 

$30 billion since 2013. The 

multiemployer program, composed of 

about 1,400 plans, accounted for a 

deficit of about $54 billion. In addition, 

PBGC estimated that its exposure to 

potential future losses for underfunded 

plans in both the single- and 

multiemployer programs was nearly 

$185 billion. According to past PBGC 

projections, it is nearly certain that the 

multiemployer program does not have 

the needed resources to satisfy the 

agency's long-term obligations.

Contact Information

For additional information about this 

high-risk area, contact Charles A. 

Jeszeck at (202) 512-7215 or 

jeszeckc@gao.gov. 
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 268 GAO-19-157SP High-Risk Series 

submitted, under MPRA, 34 applications to suspend previously accrued 

and protected benefits. Of the applications submitted for Treasury review, 

10 have been approved, 5 have been denied, 12 have been withdrawn, 

and 7 are pending review or awaiting determination.

Figure 14: Pension Benefit Guaranty Corporation’s (PBGC) Net Financial Position of the Single-Employer and Multiemployer 

Programs Combined, Fiscal Years 1990 through 2018

While changes were made with passage of MPRA, PBGC's projections of 

the multiemployer program's pending insolvency have become more 

concerning since 2017. Based on fiscal year 2017 projections, PBGC 

officials believe there is an over 40 percent chance that the multiemployer 

program will be insolvent by the year 2024. After that, the risk of 

insolvency rises rapidly—reaching over 90 percent by 2025 and 99 

percent by 2026. If the multiemployer program becomes insolvent, 

participants in insolvent pension plans that receive financial assistance 

from PBGC will receive a small fraction of current statutory guarantees. 

Though guaranteed benefits depend on the years of service a participant 

earned through qualifying work, the maximum guarantee is currently 

$12,870 per year for a retiring participant that had 30 years of service. 

PBGC estimates that under its projection, most participants would receive 

less than $2,000 per year and in many cases, much less.
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 269 GAO-19-157SP High-Risk Series 

The Bipartisan Budget Act of 2018 established a Joint Select Committee 

on Solvency of Multiemployer Pension Plans. The goal of the joint 

committee is to improve the solvency of multiemployer pension plans and 

PBGC. The joint committee held five hearings on the multiemployer 

system and PBGC as well as how stakeholders—particularly current 

workers, retirees, and employers—are likely to be affected by potential 

insolvencies. The act tasked the joint committee, which by law was set to 

terminate by December 31, 2018, with voting on a report that includes 

any findings, conclusions and recommendations—as well as proposed 

legislative language to carry out any recommendations—by November 

30, 2018. However, the co-chairmen of the joint committee released a 

statement committing to working to solve the multiemployer pension crisis 

past the November 30th deadline. On January 9, 2019 the chairman of 

the House Ways and Means Committee introduced legislation with bipartisan co-sponsorship that would establish a new agency within 

Treasury that would be tasked with providing and overseeing loans to 

certain troubled multiemployer plans.

Although the net deficit for the single-employer program has improved 

significantly since we last reported, PBGC continues to face longstanding, structural funding challenges due to an overall decline in the 

defined benefit pension system. While tens of thousands of companies 

continue to offer traditional defined benefit plans, the number of singleand multiemployer plans and participants have declined significantly. 

Since 1985, there has been a 78 percent decline in the number of plans 

insured by PBGC—from about 114,400 plans to about 24,800 plans in 

2018. In addition, nearly 13 million fewer workers are actively participating 

in these plans. 

While the PBGC's single-employer program currently is in surplus, it is not 

certain that the program will remain in surplus into the future. Further, 

PBGC's net financial position is highly sensitive to prevailing economic 

conditions. PBGC's past experience with large claims shows that the 

single-employer program’s condition can change quickly and 

precipitously. For example, the spate of plan terminations in the airline 

and steel industries from 2001 through 2006 resulted in more than $20 

billion of net claims. The possibility for large, future claims persists as 

underfunded plans sponsored by companies with credit ratings below 

investment grade represent $175 billion in potential exposure as of fiscal 

year-end 2018.

The structure of PBGC’s premium rates—a key component of its 

funding—has long been another area of concern. Despite periodic 

increases in premium rates, which are set according to statute, the 

premiums do not align with the multiplicity of risks PBGC insures against. 

Currently, plan underfunding is the only risk factor currently considered in 

determining a sponsor’s premium rate. Under the current premium 
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 270 GAO-19-157SP High-Risk Series 

structure for its single-employer program, PBGC collects from sponsors a 

per-participant flat-rate premium and a variable-rate premium that is 

based on a plan’s level of underfunding. To date, no legislation 

incorporating additional risk factors, such as company financial health or 

plan investment mix, into PBGC’s premium structure has been enacted.

PBGC’s governance structure is another area of weakness noted in 

several of our past reports. In particular, we have long recommended that 

PBGC’s board—currently composed of the Secretary of the Treasury, the 

Secretary of Labor, and the Secretary of Commerce—be expanded to 

include additional members who possess diverse knowledge and 

expertise useful to PBGC’s mission. In addition, the National Academy of 

Public Administration recommended in a 2013 report to Congress that 

PBGC's board be expanded if PBGC is provided greater responsibility 

over its policies. We have long emphasized that PBGC requires strong 

and stable leadership to ensure it can meet its future financial challenges.

Although Congress and PBGC have taken significant and positive steps 

to strengthen the agency over the past 5 years since the passage of 

MPRA, concerns are becoming increasingly urgent with particular respect 

to the multiemployer program and PBGC’s overall funding structure and 

governance. Also, the premium structure for PBGC’s single-employer 

program continues to result in rates that do not align with the risk the 

agency insures against. Absent additional steps to improve PBGC’s 

finances, the long-term financial stability of the agency remains uncertain 

and the retirement benefits of millions of American workers and retirees 

could be at risk of dramatic reductions.

As we have previously recommended over the years since we added 

PBGC to the High-Risk List, Congress should consider improving the 

long-term financial stability of both of PBGC’s insurance programs by: 

• authorizing a redesign of PBGC’s single-employer program premium 

structure to better align premium rates with sponsor risk; 

• adopting additional changes to PBGC’s governance structure—in 

particular, expanding the composition of its board of directors; 

• strengthening funding requirements for plan sponsors, as appropriate 

given national economic conditions; 

• working with PBGC to develop a strategy for funding PBGC claims over 

the long term as the defined benefit pension system continues to decline; 

and 

• enacting additional structural reforms to reinforce and stabilize the 

multiemployer system, and balance the needs and potential sacrifices of 

contributing employers, participants, and the federal government.

What Remains to Be Done

Congressional Actions Needed
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 271 GAO-19-157SP High-Risk Series 

Central States Pension Fund: Investment Policy Decisions and 

Challenges Facing the Plan. GAO-18-106. Washington, D.C.: June 4, 

2018.

Pension Plan Valuation: Views on Using Multiple Measures to Offer a 

More Complete Financial Picture. GAO-14-264. Washington, D.C.: 

September 30, 2014.

Private Pensions: Timely Action Needed to Address Impending 

Multiemployer Plan Insolvencies. GAO-13-240. Washington, D.C.: March 

28, 2013.

Private Pensions: Multiemployer Plans and PBGC Face Urgent 

Challenges. GAO-13-428T. Washington, D.C.: March 5, 2013.

Pension Benefit Guaranty Corporation: Redesigned Premium Structure 

Could Better Align Rates with Risk from Plan Sponsors. GAO-13-58. 

Washington, D.C.: November 7, 2012.

Pension Benefit Guaranty Corporation: Asset Management Needs Better 

Stewardship. GAO-11-271. Washington, D.C.: June 30, 2011.

Pension Benefit Guaranty Corporation: Improvements Needed to 

Strengthen Governance Structure and Strategic Management. GAO-11-

182T. Washington, D.C.: December 1, 2010.

Private Pensions: Changes Needed to Better Protect Multiemployer 

Pension Benefits. GAO-11-79. Washington, D.C.: October 18, 2010.

Related GAO 

Products
National Flood Insurance Program

Page 272 GAO-19-157SP High-Risk Series 

Congress should consider comprehensive reform of the National Flood Insurance Program (NFIP) to improve 

the program’s solvency and enhance the nation’s resilience to floods. The Federal Emergency Management 

Agency (FEMA) should also take steps to complete the implementation of improvements to its rate-setting 

methods and compensation of insurance companies, among other actions. 

Since our 2017 High-Risk Report, 

there have been no changes to 

the five criteria ratings because 

action on open recommendations 

has not yet been completed by 

FEMA, and comprehensive 

reform of the program has not yet 

been enacted by Congress.

Leadership commitment: 

partially met. FEMA leadership 

continues to show a commitment 

to implementing our 

recommendations, for example, 

by eliminating some potential 

barriers to the private flood 

insurance market. FEMA also 

took steps to protect the program’s financial stability such as purchasing 

reinsurance. However, Congress has yet to enact comprehensive 

program reforms. 

Capacity: partially met. FEMA’s capacity remains strained as it deals 

with multiple challenges, including responding to multiple natural 

disasters and implementing provisions of recent legislation and leadership 

changes in the flood insurance program. 

Action plan: partially met. FEMA identified actions to address our 

recommendations and tracks outstanding recommendations through an 

internal controls program to guide its own efforts and provide us with 

status updates. For example, they track and provide us with regular 

updates on their efforts to update their methodology for calculating 

premium rates. However, FEMA lacks a comprehensive plan to address 

the issues that placed NFIP on our High-Risk List. Such a plan could help 

FEMA define causes and identify effective solutions.

Monitoring: partially met. FEMA has a process to monitor progress in 

implementing our recommendations, including regular discussions at 

FEMA and the Department of Homeland Security. However, FEMA lacks 

a process to evaluate the effectiveness of those actions. Additional 

monitoring would help ensure appropriate corrective actions are taken.

Demonstrated progress: partially met. FEMA has taken steps to 

implement many of our recommendations, for example, by addressing a 

National Flood Insurance Program

Why Area Is High Risk

NFIP has experienced significant 

challenges because FEMA is tasked with 

two competing goals—keeping flood 

insurance affordable and keeping the 

program fiscally solvent. Emphasizing 

affordability has led to premium rates 

that in many cases do not reflect the full 

risk of loss and produce insufficient 

premiums to pay for claims. In turn, this 

has transferred some of the financial 

burden of flood risk from individual 

property owners to taxpayers as a whole. 

Accordingly, we added this area to our 

High-Risk List in 2006.

NFIP has had to borrow from the 

Department of the Treasury to pay 

claims from major natural disasters. As 

of September 2018, FEMA’s debt stood 

at $20.5 billion despite Congress having 

canceled $16 billion in debt in October 

2017. Without reforms, the financial 

condition of NFIP could continue to 

worsen. 

Contact Information

For additional information about this 

high-risk area, contact Alicia Puente 

Cackley at 202-512-8678 or 

cackleya@gao.gov. 
National Flood Insurance Program

Page 273 GAO-19-157SP High-Risk Series 

potential challenge to consumers who wish to purchase private flood 

insurance. However, FEMA’s efforts to address our recommendations in 

other areas are in progress or could take years to complete. For example, 

FEMA is in the process of updating its premium rate-setting methodology, 

but these changes will not begin until 2020. Congress held hearings on 

reforming NFIP and passed several short-term reauthorizations. 

However, Congress has yet to enact reforms related to the six areas we 

identified in April 2017 (program debt, full-risk-rates, affordability, 

consumer participation, private-sector involvement, and flood mitigation).

Over the years since we added this area to our High-Risk List, we have 

made numerous recommendations related to this high-risk issue. As of 

December 2018, 13 recommendations are open. The flood insurance 

program has improved in a number of areas, but to demonstrate 

progress, FEMA should:

• complete implementation of the Biggert-Waters Flood Insurance Reform 

Act of 2012 and Homeowner Flood Insurance Affordability Act of 2014,

• develop a comprehensive plan for removing NFIP from the High-Risk 

List,

• initiate broader monitoring of the effectiveness and sustainability of 

actions to implement our recommendations,

• continue ongoing efforts to improve NFIP rate-setting methods and 

evaluate approaches to obtain flood risk information needed to determine 

full-risk rates for properties with previously subsidized rates, and

• complete efforts to establish a new information technology system for 

NFIP.

We have an open matter for Congress to consider from our April 2017 

report that examined actions Congress and FEMA could take to reduce 

federal fiscal exposure and improve resilience to floods. We stated that 

Congress should consider comprehensive reform, which could include 

actions in six areas: (1) addressing the current debt, (2) removing existing 

legislative barriers to FEMA’s ability to revise premium rates to reflect the 

full risk of loss, (3) addressing affordability, (4) increasing consumer 

participation, (5) removing barriers to private-sector involvement, and (6) 

protecting NFIP flood resilience efforts.

Flood Insurance: Comprehensive Reform Could Improve Solvency and 

Enhance Resilience. GAO-17-425. Washington, D.C.: April 27, 2017.

Flood Insurance: FEMA Needs to Address Data Quality and Consider 

Company Characteristics When Revising Its Compensation Methodology. 

GAO-17-36. Washington, D.C.: December 8, 2016.

What Remains to Be Done

Congressional Actions Needed

Related GAO 

Products
National Flood Insurance Program

Page 274 GAO-19-157SP High-Risk Series 

Flood Insurance: Potential Barriers Cited to Increased Use of Private 

Insurance. GAO-16-611. Washington, D.C.: July 14, 2016.

National Flood Insurance Program: Continued Progress Needed to Fully 

Address Prior GAO Recommendations on Rate-Setting Methods. 

GAO-16-59. Washington, D.C.: March 17, 2016.

National Flood Insurance Program: Options for Providing Affordability 

Assistance. GAO-16-190. Washington, D.C.: February 10, 2016.
Managing Risks and Improving VA Health Care 

Page 275 GAO-19-157SP High-Risk Series 

The Department of Veterans Affairs (VA) has taken steps to maintain its leadership commitment and develop 

its action plan, but still needs to demonstrate capacity and establish metrics to monitor and demonstrate 

progress addressing VA health care concerns. 

Since our 2017 High-Risk Report, 

ratings for all five criteria remain 

unchanged. 

Specifically, the leadership 

commitment and action plan 

criteria remain partially met. 

Although VA has experienced 

leadership instability over the past 

2 years in several senior positions, 

a new Secretary was confirmed in 

July 2018. Secretary Robert Wilkie 

has demonstrated his commitment 

to addressing the department’s 

high-risk designation by, among 

other things, creating an office to 

direct an integrated, focused high-risk approach and communicating to 

VA leaders the importance of addressing our recommendations. The 

Secretary’s actions, to date, have allowed the department to maintain its 

leadership commitment rating. The action plan criterion also remains 

partially met. In March 2018, VA submitted an action plan to address the 

underlying causes of its high-risk designation, but the plan did not clearly 

link actions to stated outcomes and goals or establish a framework to 

assess VA’s progress. VA officials have indicated that they are currently 

working to revise their action plan, and that the January 2019 draft VHA 

Plan for Modernization is intended, among other things, to address our 

long-standing concerns. 

The monitoring, demonstrated progress, and capacity criteria remain 

unmet since our 2017 High-Risk Report. In order to address the 

monitoring and demonstrated progress criteria, VA’s ongoing revisions to 

its action plan need to include the addition of certain essential 

components, including metrics, milestones, and mechanisms for 

monitoring and demonstrating progress in addressing the high-risk areas 

of concern. VA’s capacity rating also remains not met. Though the 

department took steps to establish offices, workgroups, and initiatives to 

address its high-risk designation, many of these efforts are either in the 

initial stages of development or resources have not been allocated.

We have made 353 recommendations related to VA health care since 

2010, 175 of which were made after VA health care was put on the HighRisk List in 2015. As of December 2018, the department has 

Managing Risks and Improving VA Health 

Care

Why Area Is High Risk

The VA operates one of the largest 

health care delivery systems in the 

nation, providing health care to more 

than 9 million veterans. Since we 

designated VA health care as a high-risk 

area in 2015, VA has begun to address 

each of the identified five areas of 

concern: (1) ambiguous policies and 

inconsistent processes; (2) inadequate 

oversight and accountability; (3) 

information technology challenges; (4) 

inadequate training for VA staff; and (5) 

unclear resource needs and allocation 

priorities. 

Since we issued our 2017 High-Risk 

Report, VA has undergone significant 

transition. Prior to Secretary Wilkie’s 

confirmation in July 2018, VA’s 

leadership was in a state of flux with 

numerous senior-level vacancies, 

including the Secretary, Under Secretary 

for Health, Chief Financial Officer, Chief 

Information Officer, and the Deputy 

Under Secretary for Health for 

Community Care positions. During this 

period of leadership instability, VA began 

implementing several major 

modernization initiatives. It is 

transitioning to the same electronic 

health record system the Department of 

Defense is currently deploying, and VA’s 

community care program has undergone 

major structural change and received 

significant funding increases. 

Contact Information

For additional information about this 

high-risk area, contact Debra A. Draper 

at (202) 512-7114 or draperd@gao.gov, 

or Sharon Silas at (202) 512-7114 or 

silass@gao.gov. 
Managing Risks and Improving VA Health Care 

Page 276 GAO-19-157SP High-Risk Series 

implemented nearly 60 percent of the recommendations related to VA 

health care made since January 2010.

Since our 2017 High-Risk Report, ratings for 

all five criteria remain unchanged. 

Leadership commitment: partially met.

VA has implemented a structure for 

leadership input into the policy process, 

such as at the Veterans Health 

Administration (VHA) Chief of Staff level. 

However, senior leadership has lacked the 

stability needed to ensure issued policy 

meets agency goals.

Capacity: not met. Since 2017, VA has issued an updated directive on 

policy management, and put in place procedures to train staff and obtain 

input from all levels on policy development. However, VA continues to 

face challenges in this area because it is reliant on contracts and 

information technology (IT) resources, which if delayed, can impede 

progress toward meeting goals.

Action plan: partially met. Since 2017, VA has further refined its root 

cause analysis for this area of concern. VA relied on these root causes as 

the foundational drivers for a January 2019 draft of the VHA Plan for 

Modernization. However, VA has not used the root cause analysis to 

develop and prioritize appropriate milestones and metrics in the action 

plan. Additionally, VA’s action plan did not include all goals and 

substantive actions taken. For example, in its March 2018 action plan, VA 

described its future plans to determine the roles of national and local 

policy in agency operations. However, VA’s action plan did not reflect the 

October 2017 establishment of an inventory of approximately 55,000 local 

policies, which set a baseline for understanding policy burden, or explain 

how it will use that inventory to inform the pilot process for national policy 

development that is mentioned in the action plan. 

Monitoring: not met. Since the March 2018 action plan lacked specific 

metrics and mechanisms for assessing and reporting progress, it is not 

clear how VA is monitoring its progress.

Demonstrated progress: not met. Our work continues to indicate VA is 

not yet able to demonstrate progress in this area. Since its 2015 high-risk 

designation, we have made 48 new recommendations in this area of 

concern, 30 of which were made since our 2017 report was issued. For 

example, in September 2017, we found that VHA does not have a 

process to systematically ensure that local policies align with national 

policies. Without such a process, VHA may be unable to ensure that its 

Ambiguous Policies 

and Inconsistent 

Processes
Managing Risks and Improving VA Health Care 

Page 277 GAO-19-157SP High-Risk Series 

facilities consistently implement national policies as intended to ensure 

timely, high-quality care for the nation’s veterans. As a result, we 

recommended that VHA establish a standard process to periodically 

monitor that local policies align with national policies. VA concurred with 

this recommendation, which remains open.

We have made 90 recommendations related to this area of concern since 

2010. As of December 2018, 35 recommendations remain open. In 

addition to implementing those recommendations, VA should improve its 

policies and processes by building capacity and finalizing its action plan.

Since our 2017 High-Risk Report, ratings for 

one criterion improved and four remain 

unchanged. 

Leadership commitment: partially met. 

Since this area of concern’s 2015 

designation, VA has made organizational 

changes, including establishing the Office of 

Integrity, to standardize and streamline the 

agency’s oversight of its programs and 

personnel. However, since 2017, the lack of 

stability in the Under Secretary for Health 

position has hindered its ability to demonstrate sustained commitment to 

improving this area of concern. 

Capacity: not met. VA has begun to implement capacity-building 

initiatives directed at improving oversight and accountability. For example, 

VHA’s Office of Internal Audit and Risk Assessment, a key component of 

the department’s oversight and accountability model, began conducting 

audits in 2018. However, according to VA’s action plan, the department 

has yet to allocate resources for this office, such as sufficient staff to carry 

out its activities. 

Action plan: partially met. In 2018, VA conducted an analysis of the root 

causes contributing to findings of inadequate oversight and accountability, 

an important step in identifying the underlying factors contributing to this 

area of concern. However, the resulting action plan lacked key elements, 

including clear metrics to monitor and assess progress. 

Monitoring: not met. The March 2018 action plan lacked specific metrics 

and mechanisms for assessing and reporting progress in this area. 

Demonstrated progress: not met. Our work continues to indicate VA is 

not demonstrating progress in this area. Since its 2015 designation, we 

made 85 new recommendations in this area of concern, 50 of which were 

What Remains to Be Done

Inadequate Oversight 

and Accountability
Managing Risks and Improving VA Health Care 

Page 278 GAO-19-157SP High-Risk Series 

made since our 2017 report was issued. For example, in June 2018, we 

reported that VHA could not systematically monitor the timeliness of 

veterans’ access to Veterans Choice Program care because it lacked 

complete, reliable data to do so. As a result, we recommended that VA 

take steps to improve its oversight of the future consolidated community 

care program that will replace the Veterans Choice Program when 

authority sunsets on June 6, 2019. VA concurred with this 

recommendation, which remains open.

We have made 148 recommendations related to this area of concern 

since 2010. As of December 2018, 59 recommendations remain open. In 

addition to implementing those recommendations, VA should 

demonstrate commitment to oversight and accountability by building 

capacity and finalizing its action plan.

Congress should consider continuing to hold hearings and receive 

periodic updates from VA, through which it can examine and address VA 

health care challenges and bring increased visibility to VA’s progress in 

addressing its high-risk designation. 

Since our 2017 High-Risk Report, ratings for 

one criterion regressed, one improved, and 

three remain unchanged. 

Leadership commitment: not met. In 

January 2019, the Senate confirmed a new 

VA Chief Information Officer. This is the 

fourth official to lead VA’s IT organization 

since our 2017 High-Risk Report, and the 

frequent turnover in this position raises 

concerns about VA’s ability to address the 

department’s IT challenges.

Capacity: not met. In May 2018, VA awarded a contract to acquire the 

same commercial electronic health record system as the Department of 

Defense (DOD). However, VA is early in the transition and its actions are 

ongoing. Additionally, VA has developed a strategy for decommissioning 

its legacy IT systems, which are tying up funds that could be reallocated 

for new technology to enable improved veteran care, but has made 

limited progress in implementing this effort. 

Action plan: partially met. In 2018, VA conducted an analysis to identify 

the root causes of IT challenges, which informed the goals in its action 

plan. However, VA’s action plan contained significant information gaps, 

including missing interim milestone dates. These information gaps raise 

What Remains to Be Done

Congressional Actions Needed

Information 

Technology 

Challenges
Managing Risks and Improving VA Health Care 

Page 279 GAO-19-157SP High-Risk Series 

questions about VA’s commitment to addressing IT-related root causes 

and need to be addressed before we can consider this criterion met. 

Monitoring: not met. The March 2018 action plan lacked specific metrics 

and mechanisms for assessing and reporting progress. 

Demonstrating progress: not met. Our work continues to indicate VA is 

not yet able to demonstrate progress in this area. Since its 2015 high-risk 

designation, we have made 14 new recommendations in this area, 12 of 

which were made since our 2017 report was issued. For example, in June 

2017, to address deficiencies we found related to VA’s pharmacy system, 

we recommended that VA take 6 actions to provide clinicians and 

pharmacists with improved tools to support pharmacy services to 

veterans and reduce risks to patient safety, including assessing the extent 

to which the interoperability of VA and DOD’s pharmacy systems impacts 

transitioning service members. VA generally concurred with these 

recommendations, all of which remain open.

We have made 25 recommendations related to this area of concern since 

2010. As of December 2018, 15 recommendations remain open. In 

addition to implementing those recommendations, VA should 

demonstrate commitment to addressing its IT challenges by stabilizing 

senior leadership, building capacity, and finalizing its action plan.

Since our 2017 High-Risk Report, ratings for 

one criterion improved and four remain 

unchanged.

Leadership commitment: not met. VA 

officials have reported progress in 

establishing a process to develop an 

enterprise-wide annual training plan to 

better ensure that VA staff are adequately 

trained to provide high-quality care to 

veterans. However, the actions necessary to 

complete and implement this training plan 

are not reflected in VA’s March 2018 action plan for the training area of 

concern, raising questions about the process through which it will be 

developed. The lack of progress in setting clear goals for improving 

training demonstrates that VA lacks leadership commitment to address 

our concerns in this area.

Capacity: not met. VA has created working groups and task forces—

such as the Learning Organization Transformation Subcommittee in the 

National Leadership Council—with specific responsibilities. However, 

VA’s ability to demonstrate capacity is limited because, according to VA’s 

What Remains to be Done

Inadequate Training 

for VA Staff
Managing Risks and Improving VA Health Care 

Page 280 GAO-19-157SP High-Risk Series 

March 2018 action plan, the department relies on external contractor 

support services to meet training goals, and that funding has not been 

allocated. 

Action plan: partially met. VA completed a root cause analysis for 

training deficiencies, which informed the goals underlying its action plan, 

resulting in an increased rating. However, the action plan continues to 

have deficiencies identified in 2017. For example, not all goal descriptions 

correspond to planned actions and the action plan lacks detail about how 

and which data will be collected to assess progress. 

Monitoring: not met. The March 2018 action plan lacked specific metrics 

and mechanisms for assessing and reporting progress. 

Demonstrated progress: not met. Our work continues to indicate that 

VA is not yet able to demonstrate progress in this area. Since its 2015 

designation, we have made 10 new recommendations in this area of 

concern, 2 of which were made since our 2017 report was issued. For 

example, in April 2018 we reported that, while the department has 

recommended training for patient advocates—staff members who receive 

and document feedback from veterans or their representatives—it has not 

developed an approach to routinely assess their training needs or 

monitored training completion. The failure to conduct these activities 

increases VA’s risk that staff may not be adequately trained to advocate 

on behalf of veterans. As a result, we recommended VHA develop an 

approach to routinely assess training needs and monitor training 

completion. VA concurred with our recommendations, which remain open.

We have made 16 recommendations related to this area of concern since 

2010. As of December 2018, 3 recommendations remain open. In 

addition to implementing those recommendations, VA should improve 

training by stabilizing senior leadership, finalizing its action plan, and 

allocating necessary resources.

Since our 2017 High-Risk Report, ratings for 

one criterion improved and four remain 

unchanged. 

Leadership commitment: partially met. In 

December 2017, a VA Chief Financial 

Officer (CFO) was confirmed after the 

department spent over 2.5 years under an 

interim CFO. In addition, VA is in the 

process of establishing a new office to 

estimate workforce resource requirements. 

What Remains to be Done

Unclear Resource 

Needs and Allocation 

Priorities
Managing Risks and Improving VA Health Care 

Page 281 GAO-19-157SP High-Risk Series 

Capacity: not met. VA has established functions intended to inform cost 

analyses of major VA initiatives, including a new financial management 

process to replace its outdated financial systems. However, it is unclear in 

its action plan the extent to which VA has identified the resources needed 

to establish and maintain these functions.

Action plan: partially met. Since our 2017 High-Risk Report, VA 

conducted a root cause analysis of this area of concern. However, VA’s 

action plan lacks metrics for monitoring progress and does not include all 

of VA’s ongoing actions, such as efforts to assess current and future 

regional demand for veterans’ health care services.

Monitoring: not met. Since VA’s action plan lacks specific metrics and 

mechanisms for assessing and reporting progress, it is not clear how VA 

is monitoring its progress. 

Demonstrating progress: not met. Our work continues to indicate VA is 

not yet able to demonstrate progress in this area. Since its 2015 

designation, we have made 16 new recommendations in this area of 

concern, 10 of which were made since our 2017 report. For example, in 

May 2017, we reported identifying several limitations with VA’s clinical 

productivity metrics and statistical models for tracking clinical efficiency 

that limit VA’s ability to assess whether resources are being used 

effectively to serve veterans. We recommended VA establish an ongoing 

process to systematically review its medical centers’ plans for addressing 

low clinical productivity and inefficiency, and ensure that the plans are 

being successfully implemented. VA concurred with this recommendation, 

which remains open. 

We have made 64 recommendations related to this area of concern since 

2010. As of December 2018, 13 recommendations remain open. In 

addition to implementing those recommendations, VA should improve 

resource allocation by building capacity, identifying and allocating needed 

staff and funds, and finalizing its action plan.

VA Health Care: Improvements Needed in Suicide Prevention Media 

Outreach Campaign Oversight and Evaluation. GAO-19-66. Washington, 

D.C.: November 15, 2018.

Veterans Choice Program: Improvements Needed to Address AccessRelated Challenges as VA Plans Consolidation of its Community Care 

Programs. GAO-18-281. Washington, D.C.: June 4, 2018.

VA Health Care: Actions Needed to Improve Oversight of CommunityBased Outpatient Clinics. GAO-18-375. Washington, D.C.: April 12, 2018.

What Remains to be Done

Related GAO 

Products
Managing Risks and Improving VA Health Care 

Page 282 GAO-19-157SP High-Risk Series 

VA Health Care: Improved Guidance and Oversight Needed for the 

Patient Advocacy Program. GAO-18-356. Washington, D.C.: April 12, 

2018.

VA Health Care: Improved Policies and Oversight Needed for Reviewing 

and Reporting Providers for Quality and Safety Concerns. GAO-18-63. 

Washington, D.C.: November 15, 2017.

Veterans Health Administration: Better Data and Evaluation Could Help 

Improve Physician Staffing, Recruitment, and Retention Strategies. 

GAO-18-124. Washington, D.C.: October 19, 2017.

Veterans Health Care: Additional Actions Could Further Improve Policy 

Management. GAO-17-748. Washington, D.C.: September 22, 2017.

VA Health Care: Improvements Needed in Data and Monitoring of Clinical 

Productivity and Efficiency. GAO-17-480. Washington, D.C.: May 24, 

2017.

VA Health Care: Actions Needed to Ensure Medical Facility Controlled 

Substance Inspection Programs Meet Agency Requirements. 

GAO-17-242. Washington, D.C.: February 15, 2017.
Appendix III: GAO’s 2019 High-Risk List 

Page 283 GAO-19-157SP High-Risk Series 

Table 10: GAO’s 2019 High-Risk List

Strengthening the Foundation for Efficiency and Effectiveness

• Strategic Human Capital Management

• Managing Federal Real Property

• Funding the Nation’s Surface Transportation Systema

• Modernizing the U.S. Financial Regulatory Systema

• Resolving the Federal Role in Housing Financea

• USPS Financial Viabilitya 

• Management of Federal Oil and Gas Resources

• Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risksa

• Improving the Management of IT Acquisitions and Operations

• Improving Federal Management of Programs That Serve Tribes and Their Membersa

• 2020 Decennial Censusa

• U.S. Government Environmental Liabilitya

Transforming DOD Program Management

• DOD Weapon Systems Acquisition

• DOD Financial Management

• DOD Business Systems Modernization

• DOD Support Infrastructure Managementa

• DOD Approach to Business Transformation 

Ensuring Public Safety and Security

• Government-wide Personnel Security Clearance Process (new)a

• Ensuring the Cybersecurity of the Nationa

• Strengthening Department of Homeland Security Management Functions

• Ensuring the Effective Protection of Technologies Critical to U.S. National Security Interestsa

• Improving Federal Oversight of Food Safetya 

• Protecting Public Health through Enhanced Oversight of Medical Products

• Transforming Environmental Protection Agency’s Processes for Assessing and Controlling Toxic Chemicalsa

Managing Federal Contracting More Effectively

• VA Acquisition Management (new)

• DOE’s Contract Management for the National Nuclear Security Administration and Office of Environmental Managementa

• NASA Acquisition Managementa

• DOD Contract Management

Assessing the Efficiency and Effectiveness of Tax Law Administration

• Enforcement of Tax Lawsa

Appendix III: GAO’s 2019 High-Risk List
Appendix III: GAO’s 2019 High-Risk List 

Page 284 GAO-19-157SP High-Risk Series 

Modernizing and Safeguarding Insurance and Benefit Programs

• Medicare Program & Improper Paymentsa

• Strengthening Medicaid Program Integritya

• Improving and Modernizing Federal Disability Programs

• Pension Benefit Guaranty Corporation Insurance Programsa

• National Flood Insurance Programa

• Managing Risks and Improving VA Health Carea 

Source: GAO. | GAO-19-157SP

a

Legislation is likely to be necessary in order to effectively address this area. 
GAO Related Products

Page 285 GAO-19-157SP High-Risk Series 

The following GAO reports reflect our High-Risk Series reports issued 

since 2000. For additional GAO related products issued specific to each 

of the 35 high-risk areas on our updated list, see our High-Risk List 

website, http://www.gao.gov/highrisk/. 

High-Risk Series: Progress on Many High-Risk Areas, While Substantial 

Efforts Needed on Others. GAO-17-317. Washington, D.C.: February 15, 

2017.

High-Risk Series: Key Actions to Make Progress Addressing High-Risk 

Issues. GAO-16-480R. Washington, D.C.: April 25, 2016.

High-Risk Series: An Update. GAO-15-290. Washington, D.C.: February 

11, 2015.

High-Risk Series: An Update. GAO-13-283. Washington, D.C.: February 

14, 2013.

High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 

16, 2011.

High-Risk Series: An Update. GAO-09-271. Washington, D.C.: January 

22, 2009.

High-Risk Series: An Update. GAO-07-310. Washington, D.C.: January 

31, 2007.

High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January 1, 

2005.

High-Risk Series: An Update. GAO-03-119. Washington, D.C.: January 1, 

2003.

High-Risk Series: An Update. GAO-01-263. Washington, D.C.: January 1, 

2001.

Determining Performance and Accountability Challenges and High Risks. 

GAO-01-159SP. Washington, D.C.: November 1, 2000.

GAO Related Products

(102080)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (https://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to https://www.gao.gov

and select “E-mail Updates.” 

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, https://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at https://www.gao.gov. 

Contact FraudNet:

Website: https://www.gao.gov/fraudnet/fraudnet.htm

Automated answering system: (800) 424-5454 or (202) 512-7700

Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.