a

GAO

United States General Accounting Office

Report to the Committee on 

Governmental Affairs, U.S. Senate

October 2002 PERFORMANCE AND 

ACCOUNTABILITY

Reported Agency 

Actions and Plans to 

Address 2001 

Management 

Challenges and 

Program Risks

GAO-03-225
Overall, 18 of the 23 federal agencies in our review reported in their fiscal year

2001 performance reports that they had taken action on all of the major

management challenges. In their fiscal year 2003 performance plans, the agencies

discussed, for the most part, performance goals and measures directly or

indirectly related to the major management challenges. Specifically, 8 of the 23

agencies discussed directly related goals and measures for all of the challenges,

and 8 others listed directly related goals and measures for most of the challenges.

The 15 agencies that did not provide directly related goals and measures for all of

their challenges varied in the extent to which they did address the challenges.

Nine of the 15 agencies discussed goals and measures that were indirectly related

to at least one of their major management challenges. Nine of the 15 agencies

discussed strategies for addressing at least one of the challenges, but did not

provide goals or measures. Five agencies mentioned no goals, measures, or

strategies for one or more challenges.

PERFORMANCE AND ACCOUNTABILITY

Reported Agency Actions and Plans to

Address 2001 Management Challenges

and Program Risks

www.gao.gov/cgi-bin/getrpt?GAO-03-225.

To view the full report, including the scope

and methodology, click on the link above.

For more information, contact Patricia A.

Dalton at (202) 512-6806 or

daltonp@gao.gov.

Highlights of GAO-03-225, a report to the

Committee on Governmental Affairs, U.S.

Senate

October 2002

In January 2001, GAO issued its

special series of reports entitled the

Performance and Accountability

Series: Major Management

Challenges and Program Risks

which described major

management challenges and highrisk areas facing 21 federal

agencies. This report describes

both agency-specific challenges

and two governmentwide high-risk

areas—strategic human capital

management and information

security—that were identified in

our January 2001 reports and how

agencies have reported responding

to these challenges.

GAO was asked to review for each

of the major management

challenges discussed in our January

2001 series, the actions agencies

reported in their fiscal year 2001

performance reports, and the goals,

measures, and strategies agencies

reported in their fiscal year 2003

performance plans.

We did not address the progress

agencies may have made in

addressing their management

challenges during fiscal year 2002

because this information had not

yet been published.

22% of agencies (5) did not report progress on all the

challenges in their fiscal year 2001 performance reports

78% of agencies (18) reported progress on all the

challenges in their fiscal year 2001 performance reports

Most Agencies Did Report Progress on Management Challenges

Most Agencies Did Not Provide Directly Related Measures for All Challenges

65% of agencies (15) did not provide directly related goals or

measures for all of the challenges in their fiscal year 2003

performance plans

35% of agencies (8) provided directly related goals or

measures for all of the challenges in their fiscal year 2003

performance plans

9 9

5

0

2

4

6

8

10

Agencies with 

indirect goals 

and measures 

Agencies with no 

goals, measures, 

or strategies

Agencies with 

strategies but 

no goals and 

measures 

Agencies That Did Not

Provide Directly

Related Goals for All

Challenges Varied in

the Extent to Which

They Address Them

Note: Agencies that have at

least one challenge in category.

Source: GAO analysis.
Page i GAO-03-225 Status of Addressing Major Management Challenges

Contents

Letter 1

Background 1

Objective, Scope, and Methodology 2

Results in Brief 3

Agency Comments 6

Appendixes

Appendix I: Observations on the Department of Agriculture’s Efforts to 

Address Its Major Management Challenges 7

Appendix II: Observations on the Department of Commerce’s Efforts to 

Address Its Major Management Challenges 14

Appendix III: Observations on the Department of Education’s Efforts to 

Address Its Major Management Challenges 24

Appendix IV: Observations on the Department of Energy’s Efforts to 

Address Its Major Management Challenges 30

Appendix V: Observations on the Environmental Protection Agency’s 

Efforts to Address Its Major Management Challenges 41

Appendix VI: Observations on the Federal Emergency Management 

Agency’s Efforts to Address Its Major Management 

Challenges 47

Appendix VII: Observations on the General Services Administration’s 

Efforts to Address Its Major Management Challenges 54

Appendix VIII: Observations on the Department of Health and Human 

Service’s Efforts to Address Its Major Management 

Challenges 61

Appendix IX: Observations on the Department of Housing and Urban 

Development’s Efforts to Address Its Major Management 

Challenges 73

Appendix X: Observations on the Department of the Interior’s Efforts to 

Address Its Major Management Challenges 80

Appendix XI: Observations on the Department of Justice’s Efforts to 

Address Its Major Management Challenges 87

Appendix XII: Observations on the Department of Labor’s Efforts to 

Address Its Major Management Challenges 97
Contents

Page ii GAO-03-225 Status of Addressing Major Management Challenges

Appendix XIII: Observations on the National Aeronautics and Space 

Administration’s Efforts to Address Its Major Management 

Challenges 104

Appendix XIV: Observations on the Nuclear Regulatory Commission’s 

Efforts to Address Its Major Management Challenges 109

Appendix XV: Observations on the National Science Foundation’s Efforts 

to Address Its Major Management Challenges 116

Appendix XVI: Observations on the Office of Personnel Management’s 

Efforts to Address Its Major Management Challenges 119

Appendix XVII: Observations on the Small Business Administration’s Efforts 

to Address Its Major Management Challenges 124

Appendix XVIII: Observations on the Social Security Administration’s Efforts 

to Address Its Major Management Challenges 131

Appendix XIX: Observations on the Department of State’s Efforts to 

Address Its Major Management Challenges 144

Appendix XX: Observations on the Department of Transportation’s Efforts 

to Address Its Major Management Challenges 154

Appendix XXI: Observations on the Department of the Treasury’s Efforts to 

Address Its Major Management Challenges 163

Appendix XXII: Observations on the U.S. Agency for International 

Development’s Efforts to Address Its Major Management 

Challenges 177

Appendix XXIII: Observations on the Department of Veterans Affairs’ Efforts 

to Address Its Major Management Challenges 182

Appendix XXIV: GAO Contact and Staff Acknowledgments 189

Tables Table 1: Number of Management Challenges on Which Agencies 

Reported 5

Table 2: Major Management Challenges for USDA 8

Table 3: Major Management Challenges for Commerce 15

Table 4: Major Management Challenges for Education 25

Table 5: Major Management Challenges for Energy 31

Table 6: Major Management Challenges for EPA 42

Table 7: Major Management Challenges for FEMA 48

Table 8: Major Management Challenges for GSA 55

Table 9: Major Management Challenges for HHS 63

Table 10: Major Management Challenges for HUD 74

Table 11: Major Management Challenges for Interior 81
Contents

Page iii GAO-03-225 Status of Addressing Major Management Challenges

Table 12: Major Management Challenges for Justice 88

Table 13: Major Management Challenges for Labor 98

Table 14: Major Management Challenges for NASA 105

Table 15: Major Management Challenges for NRC 110

Table 16: Major Management Challenges for NSF 117

Table 17: Major Management Challenges for OPM 120

Table 18: Major Management Challenges for SBA 125

Table 19: Major Management Challenges for SSA 132

Table 20: Major Management Challenges for State 145

Table 21: Major Management Challenges for DOT 155

Table 22: Major Management Challenges for Treasury 164

Table 23: Major Management Challenges for USAID 178

Table 24: Major Management Challenges for VA 183

Abbreviations

ACF Administration for Children and Families

ADAMS Agencywide Document Access and Management System

ATF Bureau of Alcohol, Tobacco, and Firearms

BIS Bureau of Industry and Security

BLM Bureau of Land Management

CARES Capital Asset Realignment for Enhanced Services

CDR Continuing Disability Review

CFO chief financial officer

CIP Critical Infrastructure Protection

CISSCO Consolidated Information Support Services

COPS Community Oriented Policing Service

CPO chief people officer

CMS Centers for Medicare & Medicaid Services

CSRIC Computer Security Incident Response Capability

DDB dependent database

DEA Drug Enforcement Administration

DOD Department of Defense

DOE Department of Energy

DOT Department of Transportation

EDA Economic Development Administration

EDP electronic data processing

EIE Electronic Information Exchange

EITC Earned Income Tax Credit

EOWS Executive Office for Weed and Seed
Contents

Page iv GAO-03-225 Status of Addressing Major Management Challenges

EPA Environmental Protection Agency

ETA Employment and Training Administration

FAA Federal Aviation Administration

FDA Food and Drug Administration

FECA Federal Employees’ Compensation Act

FEMA Federal Emergency Management Agency

FHA Federal Housing Administration

FMFIA Federal Managers’ Financial Integrity Act

FMS Financial Management Service

FR Financial Report of the U.S. Government

FSS Federal Supply Service

FTE full-time equivalents

FTS Federal Technology Service

FWS Fish and Wildlife Service

GISRA Government Information Security Reform Act

GPRA Government Performance and Results Act

GSA General Services Administration

HEU highly enriched uranium

HHS Department of Health and Human Services

HUD Department of Housing and Urban Development

IFS Integrated Financial System

INS Immigration and Naturalization Service

IRS Internal Revenue Service

ISS International Space Station

IT information technology

ITA International Trade Administration

MARAD Maritime Administration

MBDA Minority Business Development Agency

MIT Management Improvement Team

NASA National Aeronautics and Space Administration

NCLB No Child Left Behind Act

NHC National Hiring Center

NIF National Ignition Facility

NIST National Institute for Standards and Technology

NNSA National Nuclear Security Administration

NOAA National Oceanic and Atmospheric Administration

NSF National Science Foundation

NRC Nuclear Regulatory Commission

PBGC Pension Benefit Guaranty Corporation

OASDI Old Age, Survivors, and Disability Insurance

OGP Office of Governmentwide Policy
Contents

Page v GAO-03-225 Status of Addressing Major Management Challenges

OHREEO Office of Human Resources and Equal Employment

Opportunity

OIG Office of Inspector General

OJP Office of Justice Programs

OMB Office of Management and Budget

OPM Office of Personnel Management

PKI public key infrastructure

PRA Probabilistic Risk Assessment

REAP Resource Estimation Allocation Process

RHIIP Rental Housing Integrity Improvement Project

SBA Small Business Administration

SES Senior Executive Service

SSA Social Security Administration

SSI Supplemental Security Income

SSBG Social Services Block Grant

TANF Temporary Assistance for Needy Families

TSA Transportation Security Administration

USAID U.S. Agency for International Development

USDA Department of Agriculture

VA Department of Veterans Affairs

WIA Workforce Investment Act

WtW Welfare-to-Work
Page 1 GAO-03-225 Status of Addressing Major Management Challenges

United States General Accounting Office

Washington, D.C. 20548

A

October 31, 2002 Letr

The Honorable Joseph I. Lieberman

Chairman

The Honorable Fred Thompson

Ranking Minority Member

Committee on Governmental Affairs

United States Senate

This report is in response to your request that we examine the actions and 

plans agencies reported in addressing the high-risk areas and major 

management challenges that were previously identified by GAO in its 

January 2001 Performance and Accountability and High-Risk Series. 1

 In 

fulfilling the request, except as otherwise noted, we reviewed the fiscal 

year 2001 performance report and fiscal year 2003 performance plan 

required by the Government Performance and Results Act of 1993 (GPRA) 

for 23 of the 24 Chief Financial Officers Act (CFO) agencies. The 

Department of Defense was not included in this review since it had not 

issued its combined performance report and performance plan.

Background Since 1990, GAO has periodically reported on government operations that 

it identifies as “high risk.” Historically, GAO has designated federal 

programs and operations, either at the agency level or governmentwide, as 

high risk because of their greater vulnerability to fraud, waste, abuse, and 

mismanagement. More recently, GAO has given added emphasis to 

identifying as high risk those major programs and operations that need 

urgent attention in order to ensure our national government functions in 

the most economical, efficient, and effective manner possible. GAO 

removes the high-risk designations when legislative and agency actions, 

including those in response to our recommendations, result in significant 

progress toward resolving a high-risk problem, or when other factors affect 

a high-risk area, such as the occurrence of a time-related event. 

In January 1999, GAO first issued a special series of reports entitled the 

Performance and Accountability Series: Major Management Challenges 

and Program Risks. The reports in this series described the major 

1 Performance and Accountability Series, GAO-01-241 through 262 (Washington, D.C.: 

January 2001) and High-Risk Series: An Update, GAO-01-263 (Washington, D.C.: January 

2001).
Page 2 GAO-03-225 Status of Addressing Major Management Challenges

management challenges and high-risk areas that the agencies needed to 

address to improve their performance and accountability. Updated 2 years 

later, the 2001 Performance and Accountability Series covered 21 

agencies, including each cabinet department, most major independent 

agencies, and the U.S. Postal Service.

This report describes agencies’ reported progress in addressing the two 

governmentwide high-risk areas, information security and strategic human 

capital management, as well as in addressing the major management 

challenges and high-risk issues that GAO identified at each agency in the 

2001 Performance and Accountability and High-Risk Series. Hereafter, 

we refer to the two governmentwide high risks, agency major management 

challenges, and agency high-risk issues collectively as “major management 

challenges.”

In January 2003, we will issue our latest performance and accountability 

series, which will discuss agencies’ progress and identify new management 

challenges and program risks.

Objective, Scope, and 

Methodology

The objective of this report was to review for each of the major 

management challenges we discussed in our January 2001 series actions 

agencies reported in their fiscal year 2001 performance reports, as well as 

the goals, measures, and strategies agencies reported in their fiscal year 

2003 performance plans.

To assess agency responses to the management challenges, we reviewed 

the fiscal year 2001 GPRA performance report and fiscal year 2003 

performance plan for 22 of the 24 CFO agencies. The Department of 

Education did not submit a performance report or performance plan; 

instead, it submitted a report of its Management Improvement Team, which 

we reviewed in lieu of the report and plan. As noted above, the Department 

of Defense did not submit a fiscal year 2001 performance report or fiscal 

year 2003 performance plan and was not included in our review. In 

evaluating agency responses to the information security management 

challenge, we also considered certain agency reports, including 

accountability reports, and prior GAO work. For each challenge, we 

evaluated whether the agency (1) discussed its progress in addressing its 

major management challenges and (2) had performance goals and 

measures directly or indirectly related to the challenge and, if not, whether 

it had management strategies to deal with the challenge. Unless otherwise 

noted, our review was based on the fiscal year 2001 performance reports 
Page 3 GAO-03-225 Status of Addressing Major Management Challenges

and fiscal year 2003 performance plans. We did not include any changes or 

modifications the agencies may have made to the reports or plans after 

they were issued, except in cases in which agency comments provided 

information from a published update to a report or plan.

Although many agencies chose to discuss how they are addressing their 

management challenges, such as those identified by GAO, in their 

performance reports and plans, there is no legal requirement to do so. 

However, according to Office of Management and Budget guidance to 

agencies,2

 performance goals for management problems should be 

included in the annual plan, particularly for problems whose resolution is 

mission critical or which could potentially impede achievement of program 

goals. Also, that an agency chose not to discuss its efforts to address major 

management challenges in its performance reports or plans does not 

necessarily mean that the agency is not addressing the challenges. 

Furthermore, because of the scope and timing of this review, information 

on the progress agencies may have made on addressing their management 

challenges during fiscal year 2002 was not yet available.

We conducted our review from September through October 2002, in 

accordance with generally accepted government auditing standards.

Results in Brief As shown in table 1, 18 of the 23 federal agencies in our review reported in 

their fiscal year 2001 performance reports that they had made progress on 

all of the major management challenges. For example, the Department of 

Energy, in response to the strategic human capital management challenge, 

reported that it held a human capital summit, and the Department of 

Housing and Urban Development, in response to an agency-specific 

challenge, discussed undertaking a number of initiatives to improve 

oversight of its single-family mortgage programs. However, 5 of the 

agencies did not discuss progress on one or more of the challenges.

In their fiscal year 2003 performance plans, the agencies discussed, for the 

most part, performance goals and measures directly or indirectly related to 

the major management challenges. Specifically, 8 of the 23 agencies 

discussed directly related goals and measures for all of the challenges, and 

2

 Office of Management and Budget, Circular A-11, Part 6, Preparation and Submission of 

Strategic Plans, Annual Performance Plans, and Annual Program Performance Reports, 

Sec. 220.3(f).
Page 4 GAO-03-225 Status of Addressing Major Management Challenges

8 others listed directly related goals and measures for most of the 

challenges.

The 15 agencies that did not provide directly related goals and measures for 

all of their challenges varied in the extent to which they did address the 

challenges. Nine of the 15 agencies discussed goals and measures that 

were indirectly related to at least one of their major management 

challenges. Nine of the 15 agencies discussed strategies for addressing at 

least one of the challenges, but did not provide goals or measures. Five 

agencies—the departments of Agriculture, Justice, Transportation, and the 

Treasury, and the United States Agency for International Development 

(USAID)—mentioned no goals, measures, or strategies for one or more 

challenges. However, as noted in appendix XI, a Justice official stated that 

Justice believes that those challenges are no longer significant enough to 

be addressed in their performance report or plan. Furthermore, as noted in 

appendix XXI, Treasury has made progress in addressing two challenges, 

improving performance measures related to criminal access to firearms 

and the management of its asset forfeiture program.

All 23 agencies in our review discussed progress in dealing with strategic 

human capital management, and 21 of the 23 agencies discussed 

information security. However, not all the agencies provided performance 

measures for evaluating progress on these challenges. For example, in the 

area of strategic human capital management, the Environmental Protection 

Agency reported having a specific target for fiscal year 2003 of having five 

offices use its newly developed workforce planning model. In contrast, the 

Federal Emergency Management Agency (FEMA) has goals of streamlining 

its organization and developing its workforce, but listed no measures to 

gauge progress for either goal. In the area of information security, the 

Department of the Interior reported it has a specific target of fiscal year 

2003 for having its critical computer systems achieve compliance level 3 on 

the Federal Information Technology Security Assessment Framework,3

 and 

of fiscal year 2005 for achieving level 5, the highest possible. On the other 

hand, FEMA stated that information technology presented several 

management challenges, but did not present specific performance 

measures designed to measure the effectiveness of information security.

3

 The National Institute of Standards and Technology developed a security assessment 

framework and related tools that agencies can use to determine the status of their 

information security programs and that describe standards for five levels of information 

security status.
Page 5 GAO-03-225 Status of Addressing Major Management Challenges

Table 1: Number of Management Challenges on Which Agencies Reported

Note: The columns for fiscal year 2003 represent the number of challenges that agencies have 

addressed in each category and are not mutually exclusive. Therefore, the numbers in these columns 

may not add to the total number of challenges.

Source: GAO analysis.

Appendixes I through XXIII have detailed information for each of the 

agencies reviewed concerning the response to each agency’s challenges. 

Fiscal year 2003 performance plan

Agency

Number of

challenges

Challenges on

which agencies

reported progress

in fiscal year 2001

performance

reports

Challenges

with directly

related goals

and measures

Challenges

with indirectly

related goals

and measures

Challenges with

strategies but

no goals or

measures

Challenges with

no goals,

measures, or

strategies

Agriculture 9 9 6 1 0 2

Commerce 6 6 6 0 0 0

Education 6 4 5 0 1 0

Energy 8 8 8 0 0 0

EPA 4 4 2 0 2 0

FEMA 5 2 3 2 0 0

GSA 2 2 2 2 0 0

HHS 7 7 5 2 0 0

HUD 5 5 5 0 0 0

Interior 4 4 2 0 2 0

Justice 14 10 9 1 0 4

Labor 5 5 5 0 0 0

NASA 5 5 4 3 1 0

NRC 6 5 2 0 4 0

NSF 2 2 2 0 0 0

OPM 2 2 2 0 0 0

SBA 6 6 1 1 4 0

SSA 6 6 5 0 1 0

State 7 7 6 1 0 0

Transportation 8 8 3 0 4 1

Treasury 7 7 3 2 0 2

USAID 5 4 1 2 1 1

VA 6 6 6 0 0 0
Page 6 GAO-03-225 Status of Addressing Major Management Challenges

Agency Comments We sent drafts of all agency appendixes to the respective agencies for 

comments. The comments we received were largely of a technical nature, 

and these were incorporated where appropriate. The Department of 

Transportation (DOT) commented that it was not possible to address all of 

its management challenges in the 2001 performance report, since the 2001 

performance plan, which served as the basis for the 2001 performance 

report, was published in March 2000—several months before we issued our 

management challenges report. While we agree that DOT could not predict 

all of the challenges we were to cite and develop related targets, there was 

nothing to preclude DOT from discussing in its 2001 performance report 

the progress it had made in addressing its major management challenges. 

DOT also commented that it has taken or is in the process of taking a 

number of actions not addressed in the plan to address concerns we raised 

under some of the management challenges. These actions address issues 

concerning the Deepwater Acquisition Project, information security, air 

traffic control modernization, aviation, and safety and security. As noted 

above, we recognize that agencies may have taken actions or made plans to 

address their major management challenges that were not discussed in 

their performance reports or plans.

As agreed with your offices, unless you announce the contents of this 

report earlier, we plan no further distribution until 30 days after its date. At 

that time, we will send copies to the President, the Director of the Office of 

Management and Budget, the congressional leadership, other Members of 

the Congress, and the heads of major departments and agencies.

If you have any questions about this report, please contact me or Elizabeth 

Curda on (202) 512-6806 or daltonp@gao.gov. Major contributors to this 

report are listed in appendix XXIV.

Patricia A. Dalton

Director, Strategic Issues
Page 7 GAO-03-225 Status of Addressing Major Management Challenges

Appendix I

Observations on the Department of Apendxies

Agriculture’s Efforts to Address Its Major 

Management Challenges ApendxiI

The following table identifies the major management challenges 

confronting the Department of Agriculture (USDA), including the 

governmentwide, high-risk areas of strategic human capital management 

and information security. The first column lists the major management 

challenges identified by our office. The second column discusses what 

progress, as discussed in their fiscal year 2001 performance report, the 

agency has made in resolving these challenges. The third column discusses 

the extent to which USDA’s fiscal year 2003 performance plans include 

performance goals and measures to address the challenges that we 

identified. 

We found that USDA’s performance report discussed the agency’s progress 

in resolving all of its challenges, except that USDA stated that it could not 

directly address GAO’s recommendation to establish a single food safety 

agency because such an action is beyond the legal authority of any federal 

department.

Of the agency’s nine major management challenges, its performance plan 

had

1. goals and measures that were directly related to 6 of the challenges,

2. goals and measures that were indirectly applicable to the one of the 

challenges, including

• strategic human capital management

3. no goals and measures related to two of the challenges, although USDA 

did discuss strategies to address the challenges, which were

• food safety and

• forest service performance accountability.
Appendix I

Observations on the Department of 

Agriculture’s Efforts to Address Its Major 

Management Challenges

Page 8 GAO-03-225 Status of Addressing Major Management Challenges

Table 2: Major Management Challenges for USDA

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management:

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic, including strategic human capital 

planning and organizational alignment; 

leadership continuity and succession 

planning; acquiring and developing a staff 

whose size, skills, and deployment meet 

agency needs; and creating results-oriented 

organizational cultures.

USDA did not address strategic human 

capital management as a challenge in its 

2001 performance report. USDA stated that 

it should ensure the department has a 

skilled, satisfied workforce and strong 

prospects for retention of its best 

employees. USDA concluded that it met its 

target for this outcome because a survey 

had found that 67 percent of USDA 

employees were satisfied with their work, 

exceeding the governmentwide result by 4 

percent.

USDA’s 2003 performance plan included a 

new departmentwide goal of improving 

organizational productivity, accountability, 

and performance. USDA included strategic 

human capital management within this goal. 

USDA also stated that it developed a 

Strategic Human Capital Management Plan, 

in line with the President’s Management 

Agenda, which included a 5-year 

restructuring plan to enable USDA to deliver 

mission-critical services cost effectively.

USDA stated that it faces a potential “brain 

drain” because by 2005, 77 percent of the 

department’s senior executives will be 

eligible for regular retirement and another 17 

percent could take early retirement. USDA 

further recognized that skill gaps are 

emerging in key areas, such as information 

technology, and that it needs to maintain and 

develop a talented, flexible, and diverse 

workforce that can thrive in the digital era.
Appendix I

Observations on the Department of 

Agriculture’s Efforts to Address Its Major 

Management Challenges

Page 9 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, audits 

continue to show that federal computer 

systems are riddled with weaknesses that 

make them highly vulnerable to computerbased attacks and place a broad range of 

critical operations and assets at risk of 

fraud, misuse, and disruption. Further, the 

events of September 11, 2001, underscored 

the need to protect America’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both.

GAO and USDA’s Office of Inspector 

General (OIG) have identified significant 

weaknesses in the department’s information 

security program and its two major data 

centers that place the department’s 

computer systems, which support billions of 

dollars in benefits, at risk. USDA has taken 

positive steps to improve its information 

security by developing its August 1999 

action plan to address vulnerabilities and 

potential threats. However, significant 

progress was needed to implement many 

components of the action plan that are 

critical to strengthening departmentwide 

information security. USDA also needed to 

develop and document a detailed strategy 

with time frames and milestones to fully 

implement the action plan. Because of this, 

we also recommended that USDA report 

information security weaknesses as a 

material internal control weakness under the 

Federal Managers’ Financial Integrity Act 

(FMFIA).

USDA reported that reviews by GAO and 

others had documented that the integrity 

and availability of the department’s critical 

information assets continued to remain at 

risk. As GAO recommended, USDA stated 

that these weaknesses were material. 

USDA also stated that it had made some 

progress in strengthening cyber security, 

and that it was revisiting its Cyber Security 

Action Plan.

USDA’s performance report indicated 

information security as a material weakness 

that includes shortcomings in entitywide 

security, access controls, segregation of 

duties, application controls, and service 

continuity. Reviews of the agency’s security 

program have found integrity and availability 

of the agency’s critical information assets to 

be a continued risk. USDA management 

also recognizes this risk and reports that the 

agency is continuously working to improve 

information security across USDA. 

The OIG similarly reported significant 

information security weaknesses, with 

inadequately restricted access to sensitive 

data being the most widely reported 

problem. The OIG identified widespread 

and serious weaknesses in the 

department’s ability to adequately protect 

(1) assets from fraud and misuse, (2) 

sensitive information from inappropriate 

disclosure, and (3) critical operations from 

disruption. This and other types of 

weaknesses identified place critical 

departmental operations, as well as the 

assets associated with these operations, at 

great risk of fraud, disruption, and 

inappropriate disclosures.

USDA’s plan recognized significant systemic 

information security issues. USDA adopted 

a new goal for 2003 to develop, implement, 

and maintain a secure information 

technology environment, and included four 

measures of performance. USDA reported 

on these measures and stated that it had (1) 

achieved 10 percent of its plan to implement 

information security architecture, and that its 

2003 target was to complete this 

architecture, (2) achieved 5 percent of its 

plan to implement an information 

survivability program, and that its 2003 

target was to achieve 50 percent 

implementation, and (3) achieved 5 percent 

of its goal to implement a system 

certification program, and that its 2003 

target was to achieve 50 percent 

implementation; and (4) achieved 25 

percent of its goal to implement a risk 

management methodology, which it planned 

to complete during 2002. USDA also stated 

that (1) it was developing standard risk 

assessment tools for use throughout the 

department, (2) risk assessment training 

was being provided to staff, and (3) riskbased facility reviews were under way to 

assess USDA’s critical infrastructure. 

In addition to Government Performance and 

Results Act reporting, the Office of 

Management and Budget’s guidance for 

fiscal year 2002 reporting under the 

Government Information Security Reform 

Act (GISRA) requires specific performance 

measures as well as corrective action plans 

with quarterly status updates.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix I

Observations on the Department of 

Agriculture’s Efforts to Address Its Major 

Management Challenges

Page 10 GAO-03-225 Status of Addressing Major Management Challenges

USDA’s performance report outlined the 

following actions taken during fiscal year 

2001 to help address information security 

problems:

• developed model personnel position 

descriptions to be used in hiring cybersecurity specialists.

• trained security technicians and managers.

• conducted onsite risk assessments at key 

USDA computer facilities.

• developed training courses for USDA 

security technicians and managers.

• engaged industry expertise to develop 

comprehensive risk assessment tools and 

procedures to provide agencies with 

standardized tools and techniques.

GAO-designated major management 

challenge

Farm Service delivery: USDA has an 

important role in distributing benefits and 

addressing farmers’ concerns. Since 1995, 

USDA has been engaged in a 

reorganization and modernization effort 

targeted at achieving operational efficiencies 

and better customer service. While USDA 

has co-located its county field offices into 

service centers, USDA needs to improve 

how these centers deliver program benefits 

to their customers.

USDA stated that it was working to acquire 

the capability to offer electronic filing and 

other key improvements to farmers. It stated 

that the standardization of the information 

technology infrastructure for its countybased agencies was well under way and 

would be completed within the next 18 

months. 

USDA’s plan stated that it would undertake a 

number of reviews aimed at improving 

service delivery to farmers. USDA said it 

would examine its office locations, and 

business processes, and accelerate its 

efforts to use business processes based on 

global information systems. USDA has 

three goals related to establishing an on-line 

electronic environment for the public that 

apply to all USDA agencies including 

agencies engaged in farm service delivery: 

(1) transition to a fully integrated egovernment environment, (2) simplify and 

reduce financial assistance program forms 

(a new goal), and (3) improve electronic 

processes for USDA financial assistance 

programs (a new goal). However, USDA did 

not adopt a quantifiable measure for its 

efforts to transition to a fully integrated egovernment environment, and USDA stated 

that targets for its other two measures are to 

be determined. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix I

Observations on the Department of 

Agriculture’s Efforts to Address Its Major 

Management Challenges

Page 11 GAO-03-225 Status of Addressing Major Management Challenges

The Food Stamp program: Food Stamp 

benefits are in the form of paper coupons or 

electronic benefits on debit cards. USDA 

needs to prevent improper payments to 

program participants, such as 

overpayments. States made $1.4 billion in 

erroneous Food Stamp payments to 

recipients in 2001. 

In addition, USDA needs to implement 

electronic benefit transfer nationwide and 

ensure adequate controls. Also, trafficking 

of food stamps continues to be a problem.

Based on fiscal year 2000 data, USDA 

reported that the accuracy rate of 91.1 

percent that was achieved for making 

correct Food Stamp payments exceeded its 

target accuracy rate of 90.5 percent. USDA 

stated that the most important factor in 

maintaining improved performance in this 

area is the need for its state partners to 

continue and renew their commitment to 

using findings from the quality control 

system to improve payment accuracy.

USDA reported that 82.8 percent of food 

stamps were issued through electronic 

benefit transfer, exceeding its target of 81 

percent. USDA also stated that it expected 

to achieve its goal for the proportion of 

benefits issued by electronic benefit transfer 

by the end of fiscal year 2002.

USDA’s fiscal year 2001 Performance 

Report stated that it reported on corrective 

actions taken to address trafficking of Food 

Stamps as a material weakness in its 

Financial Management Financial Integrity 

Act Report for fiscal year 2001.

To address the complexity of the Food 

Stamp Program and its high error rate, the 

2002 Farm Bill contained a number of 

administrative and simplification reforms, 

such as allowing states to use greater 

flexibility in considering the income of 

recipients for eligibility purposes and to 

extend simplified reporting procedures for all 

program recipients. USDA will need to 

respond to the statutory changes by 

modifying its performance goal and 

measures on improper payments, and 

especially overpayments.

USDA’s plan stated that it is exploring the 

feasibility of developing an outcome-based 

measure to better estimate the extent of 

Food Stamp trafficking.

Child and Adult Care Food Program: This 

program provides for the nutritional wellbeing of young children and adults in day 

care homes and centers and for teenagers 

in after school programs. USDA needs to 

improve state and local management and 

program controls to reduce fraud and abuse.

USDA reported that it did not meet its target 

of completing management evaluations of 

all state agencies administering the 

program—but that it did complete 

evaluations in all but three states. USDA 

also reported that unanticipated delays 

occurred in the publication of regulations 

implementing program administrative 

changes brought about by legislation. 

USDA’s plan adopted a revised goal of 

evaluating the management performance of 

half of the states each year with more indepth management evaluations conducted 

on a 2-year cycle.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix I

Observations on the Department of 

Agriculture’s Efforts to Address Its Major 

Management Challenges

Page 12 GAO-03-225 Status of Addressing Major Management Challenges

Civil rights complaints: There continues to 

be problems in the timely processing of 

discrimination complaints in USDA’s Office 

of Civil Rights. Processing delays have 

caused a significant backlog in both program 

and employee discrimination complaints 

resulting in USDA’s failure to comply with 

federal regulations that affect the livelihood 

and well-being of individuals who believe 

they have been discriminated against. 

Complaints involve the treatment of minority 

farmers when they applied for farm loans or 

loan servicing and employees’ civil rights.

USDA reported that it had reduced the 

average processing time of civil rights cases 

by 1 percent in 2001, while it had a target of 

reducing processing time by 5 percent. 

Also, USDA reported that in October 2000, it 

had completed an improvement plan for its 

civil rights functions and for processing civil 

rights complaints. However, USDA 

cautioned that implementation of the plan 

began “so far as resources permitted,” and 

that implementation would continue in fiscal 

year 2002 and beyond as resources 

permitted.

USDA’s plan set a new target of reducing 

the average number of days it takes to 

resolve USDA civil rights complaints by 20 

percent in fiscal year 2002. The report 

stated that the fiscal year 2003 budget was 

seeking an increase of $2 million to provide 

staffing and other resources needed to 

make substantial reductions in complaint 

processing time.

In September 2002, GAO reported that 

although USDA’s Office of Civil Rights had 

made some modest improvements, it was 

still not completing investigative reports in a 

timely manner. For example, the Office had 

reduced the average timeframe for 

completing investigative reports from 365 

days in fiscal year 2000 to 315 days in fiscal 

year 2001, but this timeframe substantially 

exceeded the requirement to complete the 

reports in 180 days. In response to our 

report, USDA agreed to establish timeframe 

goals for all stages of its process for 

addressing civil rights complaints, and to 

address staff turnover and morale problems 

in its Office of Civil Rights. Also, the 2002 

Farm Bill creates the position of Assistant 

Secretary for Civil Rights within USDA.

Financial management: USDA continues 

to lack financial accountability over billions 

of dollars in assets. As such, USDA does 

not have meaningful and accurate financial 

information with which to evaluate its 

financial performance and provide 

assurance that its consolidated financial 

statements are reliable and presented in 

conformity with U.S. generally accepted 

accounting principles. In addition, in 1999, 

GAO designated financial management at 

the Forest Service high risk on the basis of 

serious financial and accounting 

weaknesses that had been identified, but 

not corrected, in the agency’s financial 

statements for a number of years. 

USDA reported that it did not meet its goal 

of achieving a qualified opinion on its 

financial statements in 2001. Nevertheless, 

USDA also reported that (1) it had made 

significant progress in reconciling USDA’s 

fund balance with Treasury, (2) the OIG had 

lifted its qualification on the Rural 

Development’s financial statements, and (3) 

the Forest Service was working 

cooperatively with USDA to improve the 

reliability of its real and personal property 

accounting.

USDA’s plan retained its goal of achieving a 

clean audit opinion on its financial 

statements. In addition, USDA stated that 

the Forest Service is the primary focus for 

corrective actions needed for obtaining a 

clean opinion on its departmental financial 

statements.

In addition, USDA stated that its new 

accounting system—the Foundation 

Financial Information System—will provide 

auditable financial data that can be used to 

prepare USDA’s consolidated financial 

statements. USDA stated that it decided to 

measure progress toward this goal by 

tracking the percentage of USDA’s 

workforce that is served by the system. 

USDA’s target is to serve 100 percent of its 

workforce with the Foundation Financial 

Information System in 2003.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix I

Observations on the Department of 

Agriculture’s Efforts to Address Its Major 

Management Challenges

Page 13 GAO-03-225 Status of Addressing Major Management Challenges

Food safety: The number of food-borne 

illnesses has heightened concerns about 

the effectiveness of the federal food safety 

system. GAO has found that the current 

multi-agency federal food safety system 

needs to be replaced by a single food safety 

agency. 

USDA reported that the creation of a single 

food safety agency is beyond the legal 

scope of USDA or any federal department. 

In addition, USDA stated that concerns 

about the need for fundamental changes in 

food safety programs and about overcoming 

perceived food safety fragmentation are 

being addressed through crossdepartmental partnerships and program 

coordination activities.

USDA’s plan reiterated the same 

observations as contained in its 2001 

report—that USDA does not have the legal 

authority to create a single food safety 

agency and that USDA is addressing food 

safety fragmentation concerns by 

coordinating with other departments.

Forest Service—Improving performance 

accountability: 

GAO concluded that it is important for the 

Forest Service to provide Congress and the 

public with a better understanding of what is 

achieved with the funds that are being 

spent. The Forest Service is refocusing its 

activities, resulting in a significant change in 

its mission and funding priorities. The 

Service’s fiscal year 2002 performance plan 

and the on-the-ground activities funded 

through the annual budget process.

USDA reported that the Forest Service 

continued to develop outcome-oriented 

performance measures and the baseline 

data needed to support the new 

performance measures. USDA did not 

specifically report on these measures in its 

performance report. It did state that new 

measures for Forest Service 

accomplishments were developed as part of 

a new budget formulation and execution 

system, which the Forest Service started 

during fiscal year 2001.

USDA’s plan stated that in fiscal year 2001 

and fiscal year 2002, the Forest Service 

would transition to a new, outcome-oriented 

budget and planning structure that will show 

links between resources, program activities, 

and results. USDA said that this process 

would debut during the fiscal year 2003 

budget cycle. Also, USDA said that it would 

be driven by a performance plan that 

articulates annual performance targets that 

support the Forest Service’s long-term 

objectives. Also, the Forest Service reported 

that (1) it will complete a strategic plan by 

September 30, 2003 and (2) it is developing 

a performance accountability system to 

integrate its annual budget plans with the 

accomplishment of strategic plan goals that 

will be implemented between 2002 and 

2005.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 14 GAO-03-225 Status of Addressing Major Management Challenges

Appendix II

Observations on the Department of 

Commerce’s Efforts to Address Its Major 

Management Challenges ApendxiI

The following table identifies the major management challenges 

confronting the Department of Commerce, which include the 

governmentwide high-risk areas of strategic human capital management 

and information security. The first column lists the challenges identified by 

our office. The second column discusses what progress, as discussed in its 

fiscal year 2001 performance report, Commerce made in resolving its 

challenges. The third column discusses the extent to which Commerce’s 

fiscal year 2003 performance plan includes performance goals and 

measures to address the challenges that we identified. 

We found that Commerce’s performance report discussed the agency’s 

progress in resolving these challenges. For the most part, the progress was 

discussed either under the departmental management section of the 

performance report or in the sections detailing the progress of the Bureau 

of Industry and Security (BIS) (formerly called the Bureau of Export 

Administration), the Economic Development Administration (EDA), the 

International Trade Administration (ITA), the Minority Business 

Development Agency (MBDA), and the National Oceanic and Atmospheric 

Administration (NOAA). 

The agency’s performance plan has goals and measures that were directly 

related to all six of the major management challenges. 
Appendix II

Observations on the Department of 

Commerce’s Efforts to Address Its Major 

Management Challenges

Page 15 GAO-03-225 Status of Addressing Major Management Challenges

Table 3: Major Management Challenges for Commerce

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management:

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures.

Under the Departmental Management 

section of the report, Commerce describes 

activities undertaken to address this 

departmentwide management challenge. 

To ensure that its workforce has the skills 

and competencies needed to carry out 

mission-critical activities over the long run, 

Commerce reports that it has combined 

efforts with its component bureaus to 

develop a common approach to analyze 

workforce needs, plan recruitment and 

outreach efforts, and modify how human 

resource professionals integrate policies 

and services. Other recent departmental 

efforts reported include completing a 

comprehensive workforce analysis; 

completing workforce restructuring plans 

during fiscal year 2002; improving an 

automated hiring system; reducing the time 

needed to advertise and fill vacancies; and, 

broadening outreach efforts to expand the 

pool of job applicants.

Under the same section of the report, 

Commerce included a performance goal of 

“Strategic Management of Human Capital” 

accompanied by six performance measures. 

Commerce reported that it met or exceeded 

the targets for four of the six performance 

measures and did not meet the targets for 

two measures. For the targets that it met or 

exceeded, Commerce reported that it used 

automated workforce planning tools in three 

offices; sponsored 19 recruitment activities 

and marketed over 352 resumes with 

Commerce managers—more than twice the 

targeted number of resumes; designed a 

tracking system for aligning ratings with 

mission accomplishments or overall 

recognition; and completed two balanced 

scorecard systems that were to identify the 

strategic human resources functions that 

were most critical to management. (Note: 

Under the Departmental Management 

section of the report, Commerce includes 

six performance measures related to the 

performance goal of managing human 

capital. 

The six measures reported include ensuring 

competency in leadership and in mission 

critical occupations; ensuring 

comprehensive training and development 

strategies; ensuring diverse candidate 

recruitment; efficiency and effectiveness of 

hiring systems; increasing the alignment of 

performance management with mission 

accomplishment; and implementing a 

telecommuting program. 

EDA included human capital issues in its 

priorities, but did not include specific 

performance goals or measures related to 

human capital management. For fiscal year 

2002, MBDA included a new measure to 

track the employees training hours under its 

performance goal to “Improve 

Organizational Effectiveness, 

Responsiveness, and Efficiencies” and ITA 

included a new measure of employees’ job 

satisfaction under the performance goal to 

“Improve Customer and Stakeholder 

Satisfaction.”
Appendix II

Observations on the Department of 

Commerce’s Efforts to Address Its Major 

Management Challenges

Page 16 GAO-03-225 Status of Addressing Major Management Challenges

Commerce reported that it plans to replace 

this measure with new or refined measures 

beginning with fiscal year 2002.)

For the measures that it reported as not met, 

Commerce explained its performance. For 

example, Commerce reported that it filled 

vacancies in 38 days, which was 4 days 

more than its target of 34 days. Also, 

Commerce reported that its telecommuting 

policy is being developed and, thus, it could 

not determine whether it met the target of 

having 25 percent of the eligible workforce 

involved in telecommuting. Consequently, 

Commerce reported the target as unmet 

and noted that 13.5 percent of all employees 

were telecommuting.

For each of its component agencies, 

Commerce provides a table of resource 

requirements, including full-time equivalent 

positions and summary of the skills needed 

in that component agency. For example, the 

skill summary for BIS includes having an 

extensive knowledge of the legislation and 

executive orders related to controlling dualuse commodities; knowledge of world 

political and economic systems, current 

trends in U.S. trade, and national security 

and foreign policy issues; and analytical 

abilities for complex licensing and policy 

decisions, as well as regulatory 

interpretations.

EDA and MBDA included human capital 

management issues under their respective 

sections on priorities. Both EDA and MBDA 

discuss the importance of aligning 

resources, having a management process, 

hiring and retaining skilled employees, and 

having a competency based performance 

system. Neither EDA nor MBDA had 

specific performance goals or measures for 

fiscal year 2001.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix II

Observations on the Department of 

Commerce’s Efforts to Address Its Major 

Management Challenges

Page 17 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show federal computer systems 

are riddled with weaknesses that make them 

highly vulnerable to computer-based attacks 

and place a broad range of critical 

operations and assets at risk of fraud, 

misuse, and disruption. Further, the events 

of September 11, 2001, underscored the 

need to protect America s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both.

Under the Departmental Management 

section of the report, Commerce includes 

performance goals and measures related to 

information security. For example, under the 

goal to “Ensure Effective Resource 

Stewardship in Support of the Commerce 

Department’s Programs,” Commerce 

includes a performance measure called 

“Ensure a Secure Workplace for All 

Commerce Employees.” Commerce says 

that it met all fiscal year 2001 targets for this 

performance measure since it conducted 32 

inspections of classified systems, while the 

2001 target was to conduct 10 inspections. 

In addition, under the performance goal to 

“Acquire and Manage the Technology 

Resources to Support Program Goals,” 

Commerce includes a performance 

measure on information technology (IT) 

security program maturity. According to 

Commerce, it has met its target related to 

program maturity because 100 percent of 

the IT security programs at Commerce have 

documented policy and 60 percent have 

documented procedures, exceeding the goal 

of having documented policy and 

procedures for 50 percent of the programs. 

Commerce also reported that it met the 

2001 target of having a documented policy 

for Commerce’s systems. 

In Commerce’s FY 2001 Accountability 

Report, the Inspector General identified 

weaknesses in information security 

throughout Commerce as a top 

management challenge. The Commerce 

Inspector General also said that “because 

information security has not received 

adequate attention in the past—and 

because of rapidly changing technologies, 

capabilities, and concerns—substantial 

efforts are required to develop and oversee 

an effective security program.” While the 

accountability report does not list 

information security as a strategic goal for 

Commerce or include information security 

performance measures, the report does list 

acquiring and managing technology and 

related resources to support program goals 

as part of its Management Integration Goal.

In its 2003 performance plan, Commerce 

has four security-related measures. 

Commerce has set targets for performance 

measures that include planning and 

conducting compliance reviews of security 

programs and classified systems, 

documenting policies and implementing 

procedures and controls, completing IT 

system security plans, and limiting 

successful intrusion attempts.

Commerce’s measures may not specifically 

measure the effectiveness of information 

security and the agency’s progress in 

implementing corrective actions. In addition 

to GPRA reporting, the Office of 

Management and Budget’s guidance for 

fiscal year 2002 reporting under the 

Government Information Security Reform 

Act (GISRA) requires performance 

measures, as well as corrective action plans 

with quarterly status updates. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix II

Observations on the Department of 

Commerce’s Efforts to Address Its Major 

Management Challenges

Page 18 GAO-03-225 Status of Addressing Major Management Challenges

GAO-designated major management 

challenge

The economy in distressed communities:

EDA works with local, state, and national 

organizations to help distressed 

communities compete in regional, national, 

and global markets. EDA provides grants for 

economic planning, technical assistance, 

research, and infrastructure improvements. 

These investments are intended to be 

catalysts to stimulate other public and 

private investments in distressed 

communities. Revolving loan funds help 

communities and businesses respond to 

severe economic dislocations caused by 

layoffs, plant shutdowns, trade impacts, 

natural disasters, and the closure of military 

bases and energy labs. 

Commerce discusses this challenge under 

EDA’s performance goal called “Promote 

Private Enterprise and Job Creation.” 

Commerce lists two program outcome (longterm) measures and two interim and 

process measures for this goal and 

concludes that it met or exceeded the 

targets for all four measures. Specifically, 

Commerce reported that 

• private sector investments in distressed 

communities as a result of EDA’s fiscal 

year 1998 investments totaled $971 

million, exceeding the target of $130 

million;

• 12,989 jobs were created or retained in 

distressed communities as a result of 

EDA’s fiscal year 1998 investments, 

exceeding the target of 5,400 jobs; 

• the ratio of state and local dollars 

committed per EDA dollar met the target of 

$1 to $1; and

• 43 percent of EDA’s investments were in 

areas of highest distress, exceeding the 40 

percent target.

Commerce also discontinued one interim 

measure that it did not meet—to reduce the 

processing time for applications—because it 

was not an outcome measure. Commerce 

reported that processing time increased 

from 72.5 to 82 days—missing the target of 

68.1 days—due to the unavailability of 

funds, which kept it from obligating funds in 

a timely manner. Commerce plans to 

continue to monitor processing time for 

internal purposes.

Commerce discusses this challenge under 

EDA’s performance goal called “Promote 

Private Enterprise and Job Creation.” 

Commerce includes both program outcome 

(long-term) measures and interim and 

process measures for this goal. These 

include

• private sector investments in distressed 

communities as a result of EDA’s 

investments,

• jobs created or retained in distressed 

communities as a result of EDA’s 

investments,

• the ratio of state and local dollars 

committed per EDA dollar,

• percentage of EDA investments in areas of 

highest distress, and

• the percentage of EDA dollars invested in 

technology-related projects in distressed 

areas, which will be assessed for the first 

time for fiscal year 2002.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix II

Observations on the Department of 

Commerce’s Efforts to Address Its Major 

Management Challenges

Page 19 GAO-03-225 Status of Addressing Major Management Challenges

Accurate and timely weather forecasts 

and warnings: NOAA is responsible for 

providing accurate and timely weather 

forecasts and warnings to protect human life 

and property. Every year hundreds of lives 

and billions of dollars are lost due to severe 

storms, floods, and other natural hazards. 

While preventing these occurrences is not 

possible, improved prediction capabilities 

can minimize impact.

Commerce addresses this challenge under 

the performance goal “Advance Short-term 

Warnings and Forecasts,” which includes 

measures of lead time, accuracy, and false 

alarm rates related to warnings and 

forecasts. Of the 11 measures under this 

goal, Commerce reports that it met the 

targets for 7 measures and did not meet the 

targets for 4 measures. 

Specifically, Commerce reported

• the false alarm rates for severe weather 

warnings for tornadoes and for aviation 

forecasts met the targets of 73 percent and 

51 percent, respectively; 

• flash flood warnings had an average lead 

time of 46 minutes—longer than the 45-

minute target—and an accuracy rate equal 

to the target of 86 percent;

• winter storm warnings had an average 

lead time equal to the target of 13 hours 

and an accuracy rate of 90 percent, 

exceeding the target of 86 percent; and 

• marine forecasts had an accuracy rate of 

52 percent, compared to a target of 51 

percent.

Commerce also reported that the lead time 

of 10 minutes and the accuracy rate of 67 

percent for tornado warnings did not meet 

the respective targets of 13 minutes and 68 

percent; and the accuracy of aviation 

forecasts, which was18 percent, and 3-day 

forecasts of precipitation, which was 19 

percent, did not meet the respective targets 

of 21 percent and 22 percent. NOAA 

indicated that it has studied the data from 

these warnings and forecasts and plans 

actions that include refining its models and 

adjusting its targets. 

Commerce addresses this challenge under 

the performance goal “Advance Short-term 

Warnings and Forecasts.” Performance 

measures include targets for

• lead times for severe weather warnings for 

tornadoes, flash floods, and winter storm 

warnings;

• the percentages of accuracy for severe 

weather warnings for tornadoes and flash 

floods, for winter storm warnings, for 3-day 

forecasts of precipitation, and for aviation 

and marine forecast;

• the percentages of false alarms for severe 

weather warnings for tornadoes and for 

aviation forecasts; and 

• the accuracy of hurricane track forecasts, 

which Commerce will measure beginning 

with fiscal year 2002.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix II

Observations on the Department of 

Commerce’s Efforts to Address Its Major 

Management Challenges

Page 20 GAO-03-225 Status of Addressing Major Management Challenges

Businesses’ access to international 

markets: ITA works to promote U.S. foreign 

trade by monitoring the international 

exchange of goods and services and by 

helping U.S. companies export, partner with 

industry, and open markets. ITA also works 

with a variety of government agencies and 

other organizations to formulate policy and 

monitor market access to ensure that U.S. 

companies are competitive in foreign 

markets while protecting American security. 

Commerce discusses this challenge under 

four of ITA’s performance goals—“Increase 

trade opportunities for U.S. firms,” “Broaden 

and deepen U.S. exporter base,” “Ensure 

fair competition in international trade,” and 

“Improve the U.S. competitive advantage 

through global e-commerce.” Commerce 

includes 10 performance measures for fiscal 

year 2001 across these goals and reported 

that 5 of the targets were exceeded and 5 

were not met. 

Specifically, Commerce reported the 

following targets that were exceeded:

• As a result of ITA’s involvement, 11,160 

export transactions were made, exceeding 

the target of 9,253 transactions.

• The number of new-to-market firms—

those introduced to foreign markets—was 

63,719, exceeding the target of 54,779. 

• The number of exporters entering a new 

market was 5,386, exceeding the target of 

4,540.

• The number of U.S. firms exporting for the 

first time was 742, exceeding the target of 

679.

• The value of gross exports supported was 

$12.5 billion, exceeding the target of $11 

billion.

ITA states that it is discontinuing the last two 

measures and replacing them with new 

measures such as the number of U.S. 

exporters entering a new market for the first 

time and the dollar value of completed 

advocacies.

Commerce also reported that it did not meet 

the targets for five measures. These were 

the following:

• The number of counseling sessions held 

was 138,165 compared with a target of 

281,165. ITA reported that it will 

discontinue and replace this measure 

because it is not accurate or useful.

Commerce reports that in fiscal year 2001 

ITA undertook a major effort to recast its 

mission statement, performance goals, and 

supporting performance measures. This 

effort resulted in identifying six performance 

goals and new measures related to this 

challenge.

ITA’s six performance goals are

• increase trade opportunities for U.S. firms, 

• broaden and deepen the U.S. exporter 

base, 

• ensure fair competition in international 

trade, 

• advance the United States’ international 

commercial and strategic interest, 

• improve customer and stakeholder 

satisfaction, and

• improve the U.S. competitive advantage 

through global e-commerce. 

ITA reports that it has formulated new 

performance measures, which include the 

following

• the percentage of undertaken advocacy 

actions completed successfully,

• the dollar value of completed advocacies,

• the percentage of antidumping or 

countervailing duty cases completed on 

time,

• the number of market access and 

compliance cases initiated, 

• the dollar value of the trade barriers 

addressed,

• dollar exports in priority markets,

• customer satisfaction with and level of 

awareness of ITA’s products and services, 

and

• the percentage of ITA business processes 

provided electronically to external 

customers. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix II

Observations on the Department of 

Commerce’s Efforts to Address Its Major 

Management Challenges

Page 21 GAO-03-225 Status of Addressing Major Management Challenges

• The number of new-to-export firms was 

20,422 compared with a target of 30,336. 

ITA stated that the target was not met due 

to the significant economic downturn and 

overly optimistic projections. It plans to 

discontinue this measure and replace it 

with the number of firms exporting for the 

first time.

• The number of antidumping/ countervailing 

duty cases processed was 136 compared 

with a target of 185. ITA plans to 

discontinue this measure because it is not 

under ITA’s control. ITA plans to add a new 

measure on the timeliness of completing 

such cases.

• The number of new subscribers using 

BuyUSA.com E-services, which was 338, 

did not meet the target of 5,000 due to a 

delay in the start of the Web site.

• The dollar value of market openings of 

$2.5 billion missed the target of $4.1 billion 

due to the downturn in the economy and 

overly optimistic projections. ITA plans to 

discontinue this measure and replace it 

with a measure of the dollar value of trade 

barriers addressed.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix II

Observations on the Department of 

Commerce’s Efforts to Address Its Major 

Management Challenges

Page 22 GAO-03-225 Status of Addressing Major Management Challenges

Control of exports of dual-use 

commodities and chemical weapons: The 

United States controls the export of certain 

goods and technologies for national security 

and foreign policy (including 

nonproliferation) purposes. BIS issues 

licenses authorizing businesses to export 

certain dual-use commodities. Controls on 

dual-use items must balance the need to 

protect national security and foreign policy 

interests with the desire not to unduly 

hamper trade opportunities and 

competitiveness.

Commerce discusses this challenge under 

BIS’s performance goals “Enhance the 

efficiency of the export control system while 

protecting U.S. national security interests,” 

“Detect illegal export transactions and 

penalize violators,” “Assist key nations to 

establish effective export control programs,” 

and “The U.S. defense industrial base is 

healthy and competitive.” Commerce lists 

10 performance measures under these 

goals and reports that the targets were met 

for 4 measures and not met for 6 measures. 

For the targets that were met, BIS accepted 

81 investigations for criminal or 

administrative remedies, exceeding the 

target of 70; conducted 693 end use visits, 

exceeding the target of 680; conducted 43 

nonproliferation and export control 

international cooperative exchange 

activities, exceeding the target of 37; and 

conducted 1,046 enforcement outreach 

visits, exceeding the target of 1,010. BIS 

stated that it plans to discontinue the 

measure related to end use visits because 

those are largely outside BIS’s control. It 

also plans to discontinue the enforcement 

outreach measure due to a policy decision 

to focus on developing criminal cases, rather 

than conducting outreach.

For the targets that were not met, 

Commerce reported that 

• BIS processed export licenses in an 

average of 40.4 days compared with the 

target of 32 days. BIS noted that it 

depends on other agencies to act promptly 

in order to meet this measure and will 

continue to strive to reduce processing 

times.

• BIS made 10,773 licensing decisions and 

missed the target of 14,000 due to U. S. 

policy changes. BIS plans to discontinue 

this measure and incorporate it into a 

measure of the timeliness of processing 

export licenses.

Last year, BIS refined its performance goals 

and measures by focusing on quality and 

exporter satisfaction, developing measures 

using “plain language,” and developing new 

measures that accurately monitor BIS’s 

program performance. These goals and 

measures relate directly to this challenge. 

The refined performance goals include

• enhance the efficiency of the export control 

system while protecting U.S. national 

security interests, 

• ensure U.S. industry compliance with the 

Chemical Weapons Convention,

• detect illegal export transactions and 

penalize violators,

• assist key nations in establishing effective 

export control programs, and

• coordinate activities for the protection of 

critical infrastructures and to ensure that 

the federal government continues to be 

able to deliver services essential to the 

nation’s security, economy, or the health 

and safety of its citizens.

BIS reports that it has formulated new 

performance measures such as 

• average processing time for commodity 

classification requests and for issuing draft 

regulations,

• level of exporter understanding of BIS 

export control requirements,

• number of site assistance visits conducted 

to assist companies preparing for 

Chemical Weapons Convention 

international inspections,

• timely recommendations made on license 

applications,

• number of targeted deficiencies remedied 

in the export control systems of key 

nations, and

• the number of outreach conferences or 

seminars held.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix II

Observations on the Department of 

Commerce’s Efforts to Address Its Major 

Management Challenges

Page 23 GAO-03-225 Status of Addressing Major Management Challenges

• The number of high-risk transactions that 

were deterred was 225, less than the 

target of 512. BIS attributed this 

performance to unforeseeable shifts in U. 

S. policy. It plans to discontinue this 

measure because of the difficulty in 

measuring certain aspects of deterrence 

and new measures developed for fiscal 

year 2003 are stronger performance 

indicators.

• The export assistance seminars or 

conferences conducted totaled 106 

instead of the 120 targeted due to program 

priority changes and staff shortages. BIS 

reported that it will discontinue this 

measure and will measure its outreach 

using the level of exporter understanding 

of BIS export control requirements. 

• BIS completed 1,181 export investigations 

and missed the target of 1,225 because of 

shifting focus on criminal cases. BIS plans 

to discontinue this measure and replace it 

with better measures of its enforcement 

effectiveness, such as the number of 

investigations accepted for administrative 

or criminal remedies.

• The number of strategic industry analyses 

completed was 278 versus a target of 300. 

BIS attributed this performance to having 

fewer memoranda of understanding 

reviewed than anticipated. BIS also noted 

that this measure will be discontinued 

because it relies on the actions of others 

and other measures are stronger BIS 

performance indicators.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 24 GAO-03-225 Status of Addressing Major Management Challenges

Appendix III

Observations on the Department of 

Education’s Efforts to Address Its Major 

Management Challenges ApendxiI

The following table identifies the major management challenges 

confronting the Department of Education (Education), including the 

governmentwide high-risk areas of strategic human capital management 

and information security. The first column lists the challenges identified by 

our office in 2001. The second column discusses the progress Education 

made in resolving its challenges, as reported in its Management 

Improvement Team (MIT) Accomplishments Report. Education did not 

submit a Government Performance and Results Act report for fiscal year 

2001 because, according to agency officials, the department was revising its 

strategic plan. Instead, Education issued a MIT Accomplishments Report 

in October 2001 to reflect some of the department’s progress in resolving its 

challenges.4

 The third column discusses the extent to which Education’s

2002-2003 annual plan includes goals, strategies and performance measures 

to address the challenges that we identified5

. 

We found that Education’s MIT Accomplishments Report discussed the 

agency’s progress in resolving many of its challenges, but it did not discuss 

the agency’s progress in resolving the following challenges 

• encouraging states to improve performance information and upgrade 

federal evaluations used to assess how well all children reach 

challenging academic standards and

• promoting coordination with other federal agencies and school districts 

to help build a solid foundation of learning for all children.

Of the agency’s six major management challenges, its performance plan 

had 

1. goals and measures that were directly related to five of the challenges 

and

2. no goals and measures related to one of the challenges, but discussed 

strategies to partly address 

4

 In April 2001, the Secretary of Education established a Management Improvement Team 

(MIT) comprised of senior-level managers within Education to formulate strategies to 

address key financial and management problems. 

5

 In March 2002, the Department of Education published its Annual Plan: 2002-2003. This 

document lists goals, measures, and strategies for the department over an 18-month period.
Appendix III

Observations on the Department of 

Education’s Efforts to Address Its Major 

Management Challenges

Page 25 GAO-03-225 Status of Addressing Major Management Challenges

• promoting coordination with other federal agencies and 

• school districts to help build a solid foundation of learning for all 

children.

Table 4: Major Management Challenges for Education

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s 

Management Improvement Team (MIT) 

Accomplishments Report

Applicable goals, measures, and 

strategies as discussed in agency’s 

2002-2003 annual plan

GAO-designated governmentwide high 

risk areas

Strategic human capital 

management:GAO has identified 

shortcomings at multiple agencies involving 

key elements of modern strategic human 

capital management, including strategic 

human capital planning and organizational 

alignment; leadership continuity and 

succession planning; acquiring and 

developing a staff whose size, skills, and 

deployment meet agency needs; and 

creating results-oriented organizational 

cultures.

The MIT Accomplishments Report 

discussed human capital management. The 

report refers to a workforce analysis and 

states that Education will be expanding its 

recruitment, retention, and training 

strategies to be able to compete for the 

highest quality employees and appropriately 

train and retain them. Further, the report 

provides specific actions taken to address 

leadership continuity and succession 

planning. The report states that Education 

launched a yearlong leadership 

development program and selected 24 

professional staff as participants. This 

program will help participants develop their 

leadership skills and requires them to 

complete a project that addresses the 

Secretary’s management improvement 

goals. The report also states that Education 

completed a training needs assessment and 

the results are being used to identify 

performance improvement areas to guide 

future training initiatives. However, the MIT 

report did not include information on longterm human capital planning and 

organizational alignment nor did the report 

discuss Education’s progress in creating a 

results-oriented organizational culture. 

In its 2002-2003 annual plan, Education 

reports the following strategies for improving 

the strategic management of the 

department’s human capital: (1) developing 

a five-year human capital plan, (2) 

identifying and obtaining needed skills, (3) 

improving employee performance and 

accountability, (4) improving core processes 

related to human capital management, such 

as recruitment efforts and expanded 

personnel flexibility, and (5) improving the 

use of competitive sourcing. Education has 

developed some performance targets 

related to strategic human capital that 

include measures on employee satisfaction 

and workforce skill gap reduction.

In addition, the department is addressing 

human capital management through its 

“One-ED” initiative. This initiative identifies 

four critical human capital strategies and 

several action steps for implementing them. 

The strategies are (1) provide leadership for 

improving performance and work processes, 

(2) align performance management 

systems, (3) improve employee skills, and 

(4) focus on current and potential leaders.
Appendix III

Observations on the Department of 

Education’s Efforts to Address Its Major 

Management Challenges

Page 26 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agency and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show federal computer systems 

are riddled with weaknesses that make them 

highly vulnerable to computer-based attacks 

and place a broad range of critical 

operations and assets at risk of fraud, 

misuse, and disruption. Further, the events 

of September 11, 2001, underscored the 

need to protect America ’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both.

Education continued to report information 

system controls as a material weakness in 

its Federal Managers’ Financial Integrity Act 

report for 2001. To improve the 

department’s information security program, 

Education reported in its MIT 

Accomplishment Report that it established a 

temporary off-site disaster recovery facility 

for the department ‘s computer network and 

financial records and accounting system. It 

also finalized plans for a permanent disaster 

recovery facility. In addition, Education 

developed an information technology (IT) 

security training curriculum for IT 

professionals and held initial classroom 

training. The department also reported that 

it performed security reviews of all IT 

systems and developed a plan to correct 

deficiencies. 

In its 2002-2003 annual plan Education 

acknowledges that improved department 

accountability requires that it protect data 

integrity and confidentiality. Education 

identifies several strategies and action steps 

to help ensure the security of its IT 

infrastructure, such as: (1) all general 

support systems and major applications will 

be certified and accredited or receive interim 

approval to operate to ensure the safety of 

the IT infrastructure, (2) remedial actions will 

be completed on all problems identified in 

the Government Information Security 

Reform Act (GISRA) reviews and Critical 

Infrastructure Protection assessments, (3) 

the department’s vulnerability and threat 

assessment will be completed and remedial 

action plans will begin, and (4) inform and 

train department officials on the new IT 

system. The department will also develop 

and test disaster recovery plans that are 

updated annually. 

However, these actions may not specifically 

measure the effectiveness of information 

security and the agency’s progress in 

implementing corrective steps. While the 

department stated that it has taken steps to 

improve its security program modeled on 

guidance from the National Institute of 

Standards and Technology (NIST), its 

annual plan does not include specific 

information on performance measures the 

department is using to identify progress in 

improving information security. NIST 

developed a security assessment framework 

and related tools that agencies can use in 

determining the status of their information 

security programs. Also, Office of 

Management and Budget (OMB) guidance 

for fiscal year 2002 reporting under GISRA 

requires agencies to use tools developed by 

NIST for evaluating the security of 

unclassified systems or groups of systems. 

In addition, OMB’s GISRA reporting 

guidance requires specific performance 

measures as well as corrective action plans 

with quarterly status updates.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s 

Management Improvement Team (MIT) 

Accomplishments Report

Applicable goals, measures, and 

strategies as discussed in agency’s 

2002-2003 annual plan
Appendix III

Observations on the Department of 

Education’s Efforts to Address Its Major 

Management Challenges

Page 27 GAO-03-225 Status of Addressing Major Management Challenges

GAO-designated major management 

challenges

Encouraging states to improve 

performance information and upgrade 

federal evaluations used to assess how 

well all children reach challenging 

academic standards.

This challenge was not addressed in the 

MIT Accomplishments Report.

In the No Child Left Behind (NCLB) Act, 

states are required to report their progress 

on a number of performance indicators 

annually. To help them meet their new 

requirements, Education states in its 2002-

2003 annual plan that it will provide 

technical assistance to states on the 

utilization of online assessments. Education 

also acknowledges that there are steps the 

department can take to transform the field of 

education into an evidence-based field, such 

as developing and enforcing high standards 

for research initiatives that it funds. 

Education has set fiscal year 2003 

performance targets related to this 

challenge, such as increasing the 

percentage of states with complete school 

accountability systems in place as required 

by the NCLB Act and increasing the number 

of projects and publications that are deemed 

to be of high quality by an independent 

group of scientists. 

Promoting coordination with other 

federal agencies and school districts to 

help build a solid foundation of learning 

for all children.

This challenge was not addressed in the 

MIT Accomplishments Report.

While this challenge is not identified as a 

specific strategic goal in the 2002-2003 

annual plan, Education acknowledges the 

need for building partnerships across the 

federal government. For example, the 

department discusses continuing its work 

with the Department of Health and Human 

Services to improve educational services to 

preschool children, especially those from 

underserved populations. The department 

does not discuss any specific efforts to 

coordinate with school districts nor does it 

identify any performance targets for this 

challenge.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s 

Management Improvement Team (MIT) 

Accomplishments Report

Applicable goals, measures, and 

strategies as discussed in agency’s 

2002-2003 annual plan
Appendix III

Observations on the Department of 

Education’s Efforts to Address Its Major 

Management Challenges

Page 28 GAO-03-225 Status of Addressing Major Management Challenges

Improving financial management to help 

build a high performing agency.

Education identified several 

accomplishments related to this issue in its 

MIT Accomplishments Report. These 

accomplishments included: (1) 

implementing a payment system that checks 

incoming bills and permits only authorized 

officials to approve payments, (2) requiring 

appropriate review/approval of all 

purchases—ensuring appropriate 

separation of duties to minimize risk of 

fraud, waste and abuse, (3) establishing an 

Office of Chief Financial Officer group that 

promotes employee awareness of internal 

control, (4) beginning the process for 

implementing a new accounting system, and 

(5) for the first time, preparing interim 

financial statements on a quarterly basis. 

In its 2002-2003 annual plan, Education lists 

strategies and action steps for how the 

department will develop and maintain 

financial integrity and management and 

internal controls. Education has listed the 

following strategies to meet this challenge: 

(1) update and integrate financial systems, 

(2) prepare financial statements to provide 

data on department performance, (3) 

analyze data to reduce fraud, (4) review 

existing internal controls and implement 

changes where necessary, and (5) increase 

the use of performance-based contracting. 

Education also intends to align its budget 

and planning process to ensure that 

effective programs continue to be funded. 

Education has set some performance 

targets for fiscal year 2003 related to 

improving the financial management of the 

agency. Measures include decreasing the 

number and amount of erroneous payments, 

decreasing the administrative cost per grant 

transaction, and decreasing the number of 

open audit recommendations remaining 

from the previous year’s financial statement 

audit. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s 

Management Improvement Team (MIT) 

Accomplishments Report

Applicable goals, measures, and 

strategies as discussed in agency’s 

2002-2003 annual plan
Appendix III

Observations on the Department of 

Education’s Efforts to Address Its Major 

Management Challenges

Page 29 GAO-03-225 Status of Addressing Major Management Challenges

Ensure access to postsecondary 

education while reducing the 

vulnerability of student aid programs to 

fraud, waste, error, and mismanagement.

The MIT Accomplishments Report states 

that the department is concentrating on 

removing the student financial aid programs 

from the GAO high-risk list. The report 

discusses Education’s actions in addressing 

the problems with the department’s student 

financial aid programs. For example, the 

department has been able to collect $153 

million as a result of locating defaulted 

borrowers by matching with the Department 

of Health and Human Services “National 

Directory of New Hires” database. 

Education has also resolved 93 percent of 

school audits within six months.

In its 2002-2003 annual plan, Education 

outlines various activities to help ensure the 

removal of the Federal Student Assistance 

programs from GAO’s high-risk program list. 

The department plans to continue improving 

and integrating its financial and 

management information systems and to 

improve program monitoring. In addition, 

Education plans to create a study group to 

examine the factors that contribute to the 

rising costs of postsecondary education and 

investigate postsecondary funding 

strategies. Education has set fiscal year 

2003 performance targets for establishing 

effective funding mechanisms for 

postsecondary education by modestly 

decreasing (1) the average national 

increase in college tuition and (2) the unmet 

needs for cost of attendance for low-income 

students. Education has developed 

performance targets for fiscal year 2003 

related to its Federal Student Assistance 

Program that include being removed from 

GAO’s high-risk list, increasing the default 

recovery rate, and decreasing grant 

overpayments to students. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s 

Management Improvement Team (MIT) 

Accomplishments Report

Applicable goals, measures, and 

strategies as discussed in agency’s 

2002-2003 annual plan
Page 30 GAO-03-225 Status of Addressing Major Management Challenges

Appendix IV

Observations on the Department of Energy’s 

Efforts to Address Its Major Management 

Challenges ApendxiIV

The following table identifies the major management challenges 

confronting the Department of Energy (DOE), including the 

governmentwide high-risk areas of strategic human capital management 

and information security. The first column lists the challenges identified by 

our office. The second column discusses what progress, as discussed in its 

fiscal year 2001 performance report, DOE made in resolving its challenges. 

The third column discusses the extent to which DOE’s fiscal year 2003 

performance plan includes performance goals and measures to address the 

challenges that we identified. We found that DOE’s performance report 

discussed the agency’s progress in resolving its challenges. 

The agency’s performance plan had goals and measures that were directly 

related to all eight of the major management challenges.
Appendix IV

Observations on the Department of Energy’s 

Efforts to Address Its Major Management 

Challenges

Page 31 GAO-03-225 Status of Addressing Major Management Challenges

Table 5: Major Management Challenges for Energy

Major management challenge

Progress in resolving major management 

challenges as discussed in agency’s 

fiscal year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management: 

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing staffing whose 

size, skills, and deployment meet agency 

needs; and creating results-oriented 

organizational cultures.

DOE’s fiscal year 2001 report recognized 

human capital management as a 

departmental challenge. DOE reported 

progress in meeting this challenge in fiscal 

year 2001 through a human capital summit 

in July 2001 that identified concerns and 

possible solutions. In addition, DOE 

submitted a 5-year workforce restructuring 

plan to the OMB with the fiscal year 2003 

budget submission.

DOE reported that it met its human capital 

performance target by completing all 

scheduled milestones in its Corporate 

Training Plan and increasing the electronic 

transfer of documents in its personnel 

system to more than 49 percent. 

In addition, DOE reported that it met all but 

two of the fiscal year 2001 milestones in the 

Federal Managers’ Financial Integrity Act 

(FMFIA) corrective action plan for the 

departmental challenge of human capital 

management. The two unmet milestones, 

developing a mechanism to forecast mission 

needs/project skills gaps and developing 

succession planning strategies have been 

extended into fiscal years 2002 and 2003 

due to revised initiatives included in the 

DOE 5-Year Workforce Restructuring Plan. 

DOE claims to have completed these in 

fiscal year 2002. 

DOE’s Science, National Nuclear Security, 

Environmental Quality, and Energy 

Resources business lines generally did not 

include specific goals or measures related to 

human capital. DOE’s Science business line 

articulated a goal to provide extraordinary 

tools, scientific workforce, and infrastructure 

to support DOE’s science mission. However, 

while the science line mentions it will 

continue the advanced education and 

training of young scientists we could only 

find one related performance target and 

DOE’s fiscal year 2003 plan lists one 

strategic objective to implement the 

President’s Management Agenda initiatives 

on Strategic Management of Human Capital. 

In addition, the plan lists a strategic 

performance goal to implement DOE’s 5-

year workforce restructuring plan. The 

performance indicator for these goals will be 

achievement of established milestones in 

the plan. In addition, under the different 

business lines, the plan lists two more 

strategic performance goals. A goal to 

attract and retain the best laboratory and 

production workforce is listed under National 

Nuclear Security but no performance 

indicator has been developed. Energy 

Resources lists a goal to increase overall 

university enrollment for nuclear engineers 

and scientists by 3 percent per year over the 

next 5 years. Success will be measured by 

undergraduate and graduate enrollments in 

nuclear engineering. Indirectly related, 

Corporate Management lists promotion of 

inclusion and diversity in all aspects of 

human capital. Performance indicators 

include a comparison of workplace diversity 

with national and local populations and 

workplace satisfaction surveys. 
Appendix IV

Observations on the Department of Energy’s 

Efforts to Address Its Major Management 

Challenges

Page 32 GAO-03-225 Status of Addressing Major Management Challenges

result. DOE reported recruiting 24 new 

fellows under its Computational Science 

Graduate Fellowship program. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenges as discussed in agency’s 

fiscal year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix IV

Observations on the Department of Energy’s 

Efforts to Address Its Major Management 

Challenges

Page 33 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agency and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show federal computer systems 

are riddled with weaknesses that make them 

highly vulnerable to computer-based attacks 

and place a broad range of critical 

operations and assets at risk of fraud, 

misuse, and disruption.

In fiscal year 2001, DOE did not specifically 

identify information security as a 

departmental challenge. DOE did, however, 

recognize the management of information 

technology and the broader field of security 

as separate management challenges. DOE 

noted that it had created a focal point for 

information technology issues by moving the 

Office of Chief Information Officer to report 

directly to the Secretary of Energy. Although 

we did not evaluate DOE’s efforts, DOE 

reported that it met seven of eight planned 

critical milestones contained in the FMFIA 

corrective action plan for meeting the 

challenge of information technology 

management. 

Under the goal of providing security and 

emergency operations, DOE reported that it 

is modernizing its information security 

program to allow for analysis and deterrence 

of major incidents involving the compromise 

of classified information. In this effort, DOE 

reported it had nearly met its goal but 

provided little detail on how it had done so. 

DOE also reported that its Office of 

Independent Oversight and Performance 

Assurance completed 17 cyber security 

inspections during fiscal year 2001. 

However, DOE did not report on the findings 

of these inspections. 

In addition, DOE reported that its 

counterintelligence program is developing 

an enhanced intrusion detection capability 

for DOE to address cyber threats. DOE 

reported it had nearly met its goal for fiscal 

year 2001 but, again, provided few details. 

Last, DOE’s independent auditors’ report for 

fiscal year 2001, included in the fiscal year 

2001 performance report, identified 

unclassified information systems security as 

a reportable condition because of network 

vulnerabilities and access control 

weaknesses. Although this condition is not 

believed to be a material weakness, it was 

first reported in 1999. DOE reports 

DOE discusses information security in a 

number of different places in its fiscal year 

2003 performance plan. In the Corporate 

Management section, the plan lists a 

strategic objective to ensure the operation of 

secure, efficient, effective, and economical 

Information Technology Systems and 

infrastructure. Underneath this objective, 

the plan lists a performance goal to ensure 

that DOE’s information assets are secure 

through effective policies, implementation, 

and oversight. The plan then lists three 

performance indicators: (1) number of 

employees trained in cyber security, (2) 

cyber incident response time, and (3) cyber 

intrusion detection and reporting efficiency. 

The plan also lists a strategic objective to 

reduce adverse security incidents through 

oversight of information assets. A related 

performance goal is the development of 

security policy and management of security 

operations for DOE facilities in the national 

capital area. Indicators include DOE 

findings specific to security policy and the 

number of incidents at headquarters 

facilities. Another performance goal is to 

provide inspections that contribute to the 

security of assets. Performance indicators 

include reportable events that impact 

national security and cyber attacks on 

information technology systems that lead to 

a breach in security. Finally, another 

performance goal is to increase the 

protection of sensitive and classified 

information against attempts by foreign 

intelligence organizations to acquire nuclear 

weapons information from the National 

Laboratories and other National Nuclear 

Security Administration (NNSA) facilities. 

However, no performance indicators have 

been developed. 

Under the National Nuclear Security 

business line, the plan lists a goal to protect 

classified information and assets. However, 

the plan notes that for all goals under 

National Nuclear Security, quantitative 

performance indicators are to be developed. 

DOE claims the performance indicators 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenges as discussed in agency’s 

fiscal year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix IV

Observations on the Department of Energy’s 

Efforts to Address Its Major Management 

Challenges

Page 34 GAO-03-225 Status of Addressing Major Management Challenges

progress through security upgrades and 

development of a cyber security 

performance improvement plan.

DOE did not explicitly state how all these 

various efforts will be integrated across 

business lines and organizational 

boundaries. While DOE believes this is an 

excellent idea and will look for opportunities 

to include this information, it must balance 

this with demands to streamline its report.

listed in the plan are deemed to be “subgoals” and do not need any description. 

Like the fiscal year 2001 report, the fiscal 

year 2003 plan does not explicitly state how 

all these various efforts will be integrated 

across business lines and organizational 

boundaries. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenges as discussed in agency’s 

fiscal year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix IV

Observations on the Department of Energy’s 

Efforts to Address Its Major Management 

Challenges

Page 35 GAO-03-225 Status of Addressing Major Management Challenges

GAO-designated major management 

challenge

Financial management: For the past 3 

years, the independent auditor’s report on 

DOE’s consolidated financial statements 

has reported financial management 

concerns at the Western Area Power 

Administration (WAPA or Western). Western 

markets and transmits electric power and 

provides related services.

DOE’s independent auditors’ report for fiscal 

year 2001, included in the fiscal year 2001 

performance report, identified financial 

management at Western as a reportable 

condition. The report noted that Western 

has made improvements over the past year 

but did not uniformly perform necessary 

reconciliations and could not promptly 

prepare account analyses. This reportable 

condition was not deemed to be a material 

weakness. The audit report recommended 

that DOE’s Chief Financial Officer (CFO) 

monitor Western’s management actions to 

improve Western’s overall financial 

management. The CFO agreed with the 

recommendation and plans to oversee 

development of a corrective action plan and 

to monitor implementation. However, DOE 

did not list this as a departmental challenge 

in its fiscal year 2001 performance report.

DOE’s fiscal year 2003 plan includes a 

strategic performance goal to manage 

financial resources and obtain an 

independent auditor’s unqualified opinion on 

the department’s annual financial 

statements. However, DOE did not address 

the reportable condition for financial 

management at Western as a performance 

indicator in its plan under this goal. 

Addressing the reportable condition would 

be an appropriate target to assist in meeting 

the objective of receiving an unqualified 

audit opinion in the future. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenges as discussed in agency’s 

fiscal year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix IV

Observations on the Department of Energy’s 

Efforts to Address Its Major Management 

Challenges

Page 36 GAO-03-225 Status of Addressing Major Management Challenges

Nonproliferation issues: Achieving 

nonproliferation goals requires improved 

priority setting and program coordination. 

GAO identified three main challenges that 

DOE’s nonproliferation programs face.

These include obtaining better access to 

information and Russian nuclear weapons 

laboratories to better target program 

resources to the greatest risks, verifying the 

use of program funds, and coordinating 

several DOE programs involving the newly 

independent states to increase their 

effectiveness. Our reviews of DOE’s 

nonproliferation programs recognize that 

there are inherent difficulties involved in 

working with Russia and the other newly 

independent states.

DOE reported on 26 performance targets 

related to reducing danger of global nuclear 

proliferation. Several of these measures 

addressed some aspects of the 

management challenges we identified for 

this area (see below). For example, DOE 

reported that its Initiatives for Proliferation 

Prevention projects and Nonproliferation and 

International Security institutes engaged 

over 5000 Russian and former-Soviet 

engineers and technicians in fiscal year 

2001. In addition, DOE reported progress in 

monitoring the conversion of Russian highly 

enriched uranium (HEU) into low enriched 

uranium and in conducting special 

monitoring visits to Russian nuclear 

processing facilities. At the same time, DOE 

reported delays, for the second straight year, 

in installation of monitoring equipment at 

one Russian blending facility and delays in 

the negotiating the opening of a monitoring 

facility at another Russian processing 

facility.

DOE did list U.S. and Russian surplus fissile 

materials as a management challenge. 

DOE’s report contains 10 performance 

measures related to this challenge and 

continues to report that the department has 

made mixed progress in this area. For 

example, DOE reported that it had 

successfully completed most of the material 

control and accountability upgrades it had 

planned for Russian facilities for fiscal year 

2001. However, some important activities, 

such as the installation of monitoring 

equipment at a Russian HEU facility, and the 

shipping of surplus HEU to the United 

States Enrichment Corporation, fell behind 

schedule. The department reported 

completion of the Title 1 design of the mixed 

oxide fuel facility for surplus U.S. plutonium. 

However, it did not report that completion of 

Title 1 design work for its Pit Disassembly 

and Conversion Facility had been delayed 

from the previous goal of fiscal year 2001 to 

fiscal year 2002. 

Under the National Nuclear Security 

business line, DOE’s plan lists a strategic 

objective to detect, prevent, and reverse the 

proliferation of weapons of mass destruction 

while promoting nuclear safety worldwide. 

Underneath this objective, the plan lists 

three performance goals related to 

nonproliferation including enhancing the 

capability to detect and prevent the 

proliferation of weapons of mass destruction 

as well as eliminating weapons and 

redirecting foreign weapons expertise to 

civilian enterprises. However, as mentioned 

before, the plan notes that for all goals under 

National Nuclear Security, quantitative 

performance indicators are to be developed. 

Indirectly, the plan lists a performance goal 

to deploy new business practices to create 

an integrated nuclear security enterpriseintegrated information system; a new 

planning, programming, budgeting, and 

evaluation system; human capital initiatives, 

and efforts to increase accountability at all 

levels of NNSA. This may eventually help to 

verify the use of program funds, improve 

coordination, and establish priorities. 

However, no quantifiable performance 

indicators have been developed yet. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenges as discussed in agency’s 

fiscal year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix IV

Observations on the Department of Energy’s 

Efforts to Address Its Major Management 

Challenges

Page 37 GAO-03-225 Status of Addressing Major Management Challenges

Nuclear weapons stockpile: GAO and 

others have found pervasive and longstanding problems with DOE’s ability to 

address project management, planning and 

budgeting, organizational alignment, and 

human capital challenges, while effectively 

and efficiently maintaining nuclear weapons 

capabilities. DOE has sought to maintain 

through the Stockpile Stewardship Program, 

the safety and reliability of U.S. nuclear 

weapons under a nuclear testing 

moratorium in the post-Cold War era. The 

Congress created NNSA to deal with many 

of these problems.

DOE’s report discussed three performance 

goals and eight performance measures 

involving DOE’s Stockpile Stewardship 

Program. This small number of 

performance measures is disproportionate 

to the over one-third of DOE’s budget that is 

spent on this business line. In addition, 

some of the measures are too highly 

aggregated to be useful.

DOE reported that Stockpile Surveillance 

and Testing is a management challenge. 

Other areas that DOE recognizes as 

departmental management challenges – 

project management, managing physical 

assets, human capital management – also 

apply to the nuclear weapons stockpile 

program.

DOE reported that it progressed in some 

stockpile areas, including certifying to the 

President that the nuclear weapons 

stockpile was safe and reliable for the sixth 

straight year. However, DOE noted that it 

had failed for the fifth straight year to meet 

its schedules for stockpile surveillance tests. 

In addition, DOE reported that it had not 

been meeting internally established time 

frames for initiating and conducting 

investigations into defects and malfunctions 

in nuclear weapons. Both activities are vital 

to ensuring the nuclear weapons stockpile 

remain safe and reliable. DOE also reported 

that it was addressing project management 

challenges for the stockpile (see discussion 

under the contract management challenge).

DOE also said that it sought to ensure the 

availability of a workforce with the critical 

skills necessary to meet long-term 

requirements. It further said that it had 

completed some of the milestones listed in 

its FMFIA corrective action plan for 

managing physical assets. The goals and 

results of these initiatives, however, are so 

highly aggregated that it is difficult to discern 

where progress is being made. 

Under the National Nuclear Security 

business line, DOE’s plan lists a strategic 

objective to maintain and enhance the 

safety, security, and reliability of the nation’s 

nuclear weapons stockpile to counter the 

threats of the 21st century. Under this 

objective, the plan lists two performance 

goals including conducting a program of 

warhead evaluation, maintenance, 

refurbishment, and production in partnership 

with DOD and developing science, design, 

engineering, testing and manufacturing 

capabilities needed for long-term 

stewardship of the stockpile. 

The plan also lists another strategic 

objective to ensure the vitality and readiness 

of the NNSA’s nuclear security enterprise. 

Listed under this objective, two related 

performance goals are to attract and retain 

the best laboratory and production 

workforce and to provide state-of-the art 

facilities and infrastructure. However, as 

mentioned before, the plan notes that for all 

goals under National Nuclear Security, 

quantitative performance indicators have not 

been developed. Importantly, DOE offers no 

performance measures on how it intends to 

reduce the stockpile surveillance and testing 

backlog, an area that it recognizes as a 

management challenge. According to 

NNSA, the department plans to complete 

the remaining backlog by the end of fiscal 

year 2003, except for a few gas transfer 

systems.

Indirectly, as mentioned earlier under 

nonproliferation, the plan lists a performance 

goal to deploy new business practices to 

create an integrated nuclear security 

enterprise such as a new planning, 

programming, budgeting, and evaluation 

system. This may eventually help to verify 

the use of program funds, improve 

coordination, and establish priorities. 

However, no quantifiable performance 

indicators have been developed yet. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenges as discussed in agency’s 

fiscal year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix IV

Observations on the Department of Energy’s 

Efforts to Address Its Major Management 

Challenges

Page 38 GAO-03-225 Status of Addressing Major Management Challenges

Contract management: Problems in 

contract management (which includes 

project management) place DOE at high risk 

for fraud, waste, abuse, and 

mismanagement. This has been a challenge 

for DOE since 1990, especially because 

DOE relies heavily on contractors to achieve 

most of its missions. DOE has begun a 

number of initiatives to improve contractor 

management, but it is too soon to tell 

whether the initiatives will be effective in the 

long-run. In addition, several Office of 

Inspector General (OIG) audits have found 

that many of DOE’s contract reform goals 

have yet to be achieved.

DOE’s report addressed contract/project 

management challenges under two 

business lines—Corporate Management 

and National Nuclear Security. In the 

Corporate Management overview section, 

DOE reported continuing improvement 

efforts aimed at implementing National 

Research Council recommendations to 

improve project management. To date, 

reforms reported as implemented include: a 

watch list of projects for stringent review, 

external independent reviews, and DOEwide policy and operating procedures. 

Regarding contract management for 2001, 

DOE reported that it met the goal of 

converting all of its management and 

operating contracts awarded to 

performance-based contracts. As part of 

the department’s ongoing effort to drastically 

change its contract management policies 

and practices for major facility contracts, 

DOE reported issuing final rules in fiscal 

year 2001 to overhaul its regulations and 

adopt the federal acquisition regulations for 

these contracts.

Under the National Nuclear Security 

business line, DOE reported creating a new 

project management organization to assist 

in completing important projects. For 

example, the National Ignition Facility (NIF) 

was rebaselined in fiscal year 2000 because 

it was over budget and behind schedule. 

DOE reported developing a six point plan for 

NIF and certifying a new project baseline. 

DOE also reported that its tritium production 

program was on track. However, on some 

projects, schedule slippages and cost 

overruns still exist. For example, a recent 

DOE Inspector General’s report found that 

the tritium production project was both 

behind schedule and over budget.

DOE’s fiscal year 2003 performance plan 

continues to address contract management 

under the Corporate Management goal. 

The plan has a strategic objective to 

effectively manage DOE by implementing 

competitive sourcing. The plan has one 

strategic performance goal to improve 

DOE’s contract management to become a 

model for government. The three 

performance indicators under this goal are: 

the percent of eligible service contracts that 

are performance-based, the status of 

contract management as a management 

challenge, and the percentage of new 

competitive awards made electronically. 

However, these limited measures do not 

directly address the challenges of the large 

management and operating contracts that 

have been the focus of outside criticism and 

contract reform. 

The plan includes other goals and measures 

that indirectly address the contract 

management challenge. For example, 

under a Corporate Management 

performance goal to conduct audits, the 

DOE Office of Inspector General has a 

target to ensure that at least 90 percent of 

its performance audits incorporate 

approaches to evaluate the use of 

performance measures —a fundamental 

tool of contract reform. Also, the 

Environmental Quality business line has a 

goal and related indicators that pertain to 

timely completion of cleanup projects at 

geographic sites. 

The plan lists two performance targets that 

address the project management 

component of the contract management 

challenge. Under Corporate Management, 

the department plans to pilot six courses on 

the Project Manager Career Development 

Program. Under National Nuclear Security, 

NNSA plans to meet established 

construction schedules to properly maintain 

needed facilities. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenges as discussed in agency’s 

fiscal year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix IV

Observations on the Department of Energy’s 

Efforts to Address Its Major Management 

Challenges

Page 39 GAO-03-225 Status of Addressing Major Management Challenges

Security: Numerous studies have identified 

pervasive weaknesses in DOE’s security 

controls. Our reports have highlighted 

weaknesses in computerized information 

systems, foreign visitor, and foreign travel 

programs. While DOE has responded to 

many recommendations, the department 

has not always followed through to ensure 

that improvements are consistently 

implemented. In addition, the September 

11, 2001 terrorist attacks pose new 

challenges for DOE security.

Overall, the department reports that it is 

making progress in improving security. DOE 

says it is meeting most of its FMFIA 

milestones for the security management 

challenge and the security aspects of 

counterintelligence. DOE also reported that 

its Office of Independent Oversight and 

Performance Assurance met its goals for 

conducting safeguards and security and 

cyber security inspections. Nevertheless, 

while a variety of activities have been 

completed, DOE and NNSA are still 

developing methods for evaluating those 

activities’ effectiveness in improving security. 

Until these methods are in place, DOE and 

NNSA cannot determine the impact of the 

individual initiatives or their effect on 

security. 

As discussed under information security, 

DOE’s plan lists a strategic objective to 

reduce adverse security incidents through 

policy development, counterintelligence, 

intelligence, and oversight of the nation’s 

energy infrastructure, nuclear weapons, 

materials, facilities, and information assets. 

A related performance goal is the 

development of security policy and 

management of security operations for DOE 

facilities in the national capital area. 

Indicators include DOE findings specific to 

security policy and number of incidents at 

headquarters facilities. However, the plan 

goes on to list some different “proposed 

targets” under this goal including meeting 

FMFIA security milestones, improving 

headquarters security; centralized tracking 

of controlled nuclear material; centralized 

tracking of foreign national visitors to DOE 

facilities; and, completing the audit of 

classified materials at the National Archives 

and Records Administration.

Another performance goal is to provide 

inspections that contribute to the security of 

assets. Performance indicators include 

reportable events that affect national 

security and cyber attacks on information 

technology systems that lead to a breach in 

security. Finally, another performance goal 

is to increase the protection of information. 

However, no performance indicators have 

been developed, although, as a proposed 

target, DOE indicates it will inspect a 

number of site counterintelligence programs 

in fiscal year 2003. Finally, under the 

National Nuclear Security business line, the 

plan lists a goal to protect classified 

information and assets. However, no 

quantitative performance indicators have 

been developed. 

Overall, in the fiscal year 2003 plan, neither 

DOE nor NNSA devotes much attention to 

the physical security challenges that have 

resulted since the terrorist attacks of 

September 11, 2001. While the fiscal year 

2001 report notes that additional funding will 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenges as discussed in agency’s 

fiscal year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix IV

Observations on the Department of Energy’s 

Efforts to Address Its Major Management 

Challenges

Page 40 GAO-03-225 Status of Addressing Major Management Challenges

be needed to address physical security 

issues and the fiscal year 2003 plan 

discusses additional funding to provide for 

the continued safe and secure transport of 

nuclear material and weapons conducted by 

NNSA’s Secure Transportation Asset, there 

appear to be few performance measures 

directly related to physical security.

Environmental cleanup: Over 50 years of 

nuclear weapons research and production 

have left a legacy of environmental 

contamination that poses unacceptable 

risks. The magnitude of the cleanup effort, 

which includes technical complexities and 

uncertainties at 44 remaining sites, ensures 

that it will remain a departmental challenge 

for the foreseeable future. The OIG reported 

that the department has made progress in 

defining the cleanup effort, estimating its 

scope, and prioritizing individual projects; 

however, increased management attention 

is needed to achieve intended 

environmental outcomes.

DOE continued to report progress towards 

most of the six general performance goals 

that address the environmental cleanup 

effort. Under these six goals, the specific 

performance targets continued to track the 

progress of measurable cleanup steps such 

as completing site remediation, disposing of 

radioactive wastes, and issuing a site 

suitability evaluation to support the 

recommendation of a site for geologic 

disposal of civilian radioactive wastes. The 

department’s report also provides 

information on how much additional cleanup 

work remains, for example, by stating that 

the target of producing 225 canisters of 

high-level waste will complete about 7.4 

percent of the total canisters that will be 

produced from fiscal year 1998 to life cycle 

completion. In addition to progressing 

toward its general performance goals, the 

department reported that it was conducting 

a top to bottom review of the environmental 

management program that will identify 

opportunities for achieving more and faster 

cleanup. 

The department’s fiscal year 2003 

performance plan has a specific strategic 

objective to safely and expeditiously 

manage waste, clean up facilities and the 

environment; and stabilize and store nuclear 

material and spent nuclear fuel. Under this 

objective, the plan lists 4 performance goals: 

(1) to clean up specific sites, (2) to safely 

dispose of waste generated by DOE during 

past and current operations, (3) to stabilize 

nuclear material and spent nuclear fuel and 

reduce exposure risk, and (4) to deploy 

innovative cleanup and treatment 

technologies. The plan goes on to list 13 

performance indicators for these goals, 

however, no indicators have been developed 

for the innovative technologies goal. DOE 

commented that it recognizes this problem; 

however, a top to bottom review of the entire 

program forced a delay in developing 

measures until the direction of the 

technology development program became 

clear. DOE states that appropriate 

measures will appear in future planning 

documents now that the review is complete.

Some of the indicators include completion of 

environmental cleanup at one additional 

geographic site and disposal of an additional 

80,000 cubic meters of low-level radioactive 

waste. The department made some 

changes to other strategic objectives and 

goals related to environmental cleanup. The 

fiscal year 2003 plan no longer specifically 

addresses the disposal of depleted uranium 

hexafluoride or excess natural uranium 

inventories—a goal that was not met during 

fiscal year 2001.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenges as discussed in agency’s 

fiscal year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 41 GAO-03-225 Status of Addressing Major Management Challenges

Appendix V

Observations on the Environmental 

Protection Agency’s Efforts to Address Its 

Major Management Challenges ApendxiV

The following table identifies the major management challenges 

confronting the Environmental Protection Agency (EPA), including the 

governmentwide high-risk areas of strategic human capital management 

and information security. The first column lists the challenges identified by 

our office. The second column discusses what progress, as discussed in its 

fiscal year 2001 performance report, EPA made in resolving its challenges. 

The third column discusses the extent to which EPA’s fiscal year 2003 

performance plan includes performance goals and measures to address the 

challenges that we identified. We found that EPA’s performance report 

discussed the agency’s progress in resolving all of its challenges.

Of the agency’s four major management challenges, its performance plan 

had

1. goals and measures that were directly related to two of the challenges 

and

2. no goals and measures related to two of the challenges but discussed 

strategies to address the challenges, which were

• environmental and performance information management to set 

priorities and measure program results and

• working relationships with states.
Appendix V

Observations on the Environmental 

Protection Agency’s Efforts to Address Its 

Major Management Challenges

Page 42 GAO-03-225 Status of Addressing Major Management Challenges

Table 6: Major Management Challenges for EPA

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management:

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures.

EPA has recognized that it must devote 

considerable attention to building a 

workforce with the highly specialized skills 

and knowledge required to accomplish its 

work or risk seriously weakening its ability to 

fulfill even the most basic of its legal, 

regulatory, and fiduciary responsibilities. 

EPA’s fiscal year 2001 performance report 

did not include any specific performance 

goals and measures associated with this 

management challenge. In the agency’s 

discussion of its fiscal year 2001 

performance, however, the agency stated 

that managing human capital was one of the 

overarching priorities it focused on in fulfilling 

its management commitments. 

In November 2000, EPA developed a human 

capital strategy, Investing in Our People: 

EPA’s Strategy for Human Capital, 2001-

2003, to refine its human capital policies and 

practices. This strategy identified the 

agency’s vision and major objectives. It also 

included the development of a workforce 

planning system, implementation plans for 

achieving the objectives, and identification 

of the agency units responsible for carrying 

out the implementation plans. The agency 

reported that with its Human Capital Strategic 

Plan in place, it has a blueprint for the initial 

and long-term steps needed to begin 

addressing this issue.

EPA reported that in fiscal year 2001 it had 

begun to implement its Human Capital 

Strategic Plan by initiating development of a 

competency-based workforce-planning 

model. Other accomplishments for 2001, as 

reported by the agency, included: (1) 

graduating a second class of interns and 

hiring another class, (2) launching a senior 

executive service candidate development 

program, (3) developing and launching a 

course for new supervisors and managers, 

and (4) beginning the rollout of courses 

created as part of the agency’s mid-level 

development program. EPA further stated 

that it planned to dedicate additional 

resources to this effort in fiscal year 2002, 

including obtaining contractor support to 

develop a competency-based workforceplanning model and selecting candidates for 

EPA reported that it is developing a 

comprehensive strategy to attract, develop, 

and retain a diversified workforce that is 

prepared to meet the agency’s future 

challenges. To do this it will continue to 

implement its action plan in support of the 

agency’s strategy for human capital. The 

agency’s goals will focus on implementing 

a workforce-planning model, completing a 

comprehensive pay review, and developing 

delivery systems and processes to 

enhance the training and development of 

its workforce. EPA included the number of 

agency offices using the workforceplanning model, which identifies skills and 

competencies needed by the agency for 

strategic recruitment, retention, and 

development training, as a performance 

measure in its fiscal year 2003 plan. Its 

fiscal year 2003 goal is for five offices to 

use the model.

In July 2001, GAO reported that, although 

the strategy represented a positive step, it 

did not (1) explain how achieving the 

human capital objectives would improve 

the agency’s performance in meeting its 

strategic goals, (2) identify either the 

resources needed or the specific 

milestones for implementing the objectives, 

and (3) provide outcome measures to track 

the agency’s progress and evaluate its 

success in achieving those objectives. We 

also reported that EPA did not know the 

appropriate size, skills, and deployment of 

staff needed to achieve its strategic goals; 

was unprepared for the potential loss in 

leadership and institutional knowledge that 

was likely to occur as more than half of its 

senior executives become eligible to retire 

by 2006; and had no systematic means to 

recruit and develop staff with the scientific 

and technical skills needed to effectively 

carry out environmental programs. 
Appendix V

Observations on the Environmental 

Protection Agency’s Efforts to Address Its 

Major Management Challenges

Page 43 GAO-03-225 Status of Addressing Major Management Challenges

its senior executive service development 

program. Finally, the agency stated that it 

planned to complete all corrective actions by 

fiscal year 2004.

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show federal computer systems 

are riddled with weaknesses that make them 

highly vulnerable to computer-based attacks 

and place a broad range of critical 

operations and assets at risk of fraud, 

misuse, and disruption. Further, the events 

of September 11, 2001, underscored the 

need to protect U.S. cyberspace against 

potentially disastrous cyber attacks—attacks 

that also could be coordinated to coincide 

with physical terrorist attacks to maximize 

the impact of both.

EPA provided no information security 

performance goals or measures in its fiscal 

year 2001 performance report. The report, 

however, refers in general language to the 

agency’s commitment to make 

“improvements in providing secure, costeffective telecommunications and computing 

capabilities.” The agency also reported that, 

in fiscal year 2001, it had improved its 

security measures for electronic information 

exchange with its external business partners 

by using virtual private network technology.

More detailed information on agency actions 

to address risks to its information system 

security are discussed in the agency’s fiscal 

year 2001 Integrity Act report included in its 

annual performance report. In this report, 

EPA stated that it had made substantial 

progress in strengthening its information 

security program by establishing a 

comprehensive strategy that addressed all 

security-related deficiencies. Corrective 

actions it reported included improving the 

agency’s risk assessment and planning 

process, implementing major new technical 

and procedural controls, issuing new policies, 

and beginning a regular process of testing 

and evaluation.

Specifically, the agency reported that during 

fiscal year 2001 it completed risk 

assessments for security-critical applications 

and systems, conducted training and 

awareness activities for information security 

officers and senior managers, and provided 

general awareness training for all agency 

employees. The agency also reported 

installing network intrusion-detection and 

monitoring controls on its centrally managed 

environment and plans to install additional 

tools on its distributed systems environment. 

It reported that all corrective actions are 

expected to be complete by the end of fiscal 

year 2002.

Strengthening and securing the agency’s 

information infrastructure is one of eight 

specific activities EPA identified as a 

means for accomplishing its environmental 

information goal for fiscal year 2003. In the 

plan, EPA also recognizes that it must 

remain vigilant in maintaining a strong and 

secure information infrastructure that 

directly supports its mission and homeland 

security.

Performance measures for information 

security are included in EPA’s fiscal year 

2003 performance plan. In the plan, the 

agency describes three objectives for the 

strategic goal “Quality Environmental 

Information,” one of which is to improve the 

agency’s information infrastructure and 

security. The performance goals and 

measures listed for this objective include 

(1) documenting critical infrastructure, 

financial, and mission critical environmental 

systems risk assessment findings to be 

completed in fiscal year 2002, (2) obtaining 

75 percent compliance with the 13 criteria 

OMB uses to assess agency security 

programs, and (3) making sure that 75 

percent of intrusion detection monitoring 

sensors are installed and operational. 

The last two performance measures and 

goals apply only to fiscal year 2003.

GAO believes, however, that these 

measures may not specifically measure the 

effectiveness of information security and 

the agency’s progress in implementing 

corrective actions.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix V

Observations on the Environmental 

Protection Agency’s Efforts to Address Its 

Major Management Challenges

Page 44 GAO-03-225 Status of Addressing Major Management Challenges

GAO-designated major management 

challenge

Environmental and performance 

information management to set priorities 

and measure program results: In 2002, 

GAO reported that EPA needs high-quality 

scientific and environmental information to 

establish priorities that reflect risks to human 

health and the environment, and that 

compare risk reduction strategies across 

programs and pollution problems.a

 GAO 

found that, although the agency has 

collected a vast amount of scientific and 

environmental data, much of the data is not 

complete and accurate enough to credibly 

assess risks and establish corresponding 

risk reduction strategies. We reported, for 

example, that historically, EPA’s ability to 

assess risks and establish risk-based 

priorities has been hampered by data quality 

problems, including critical data gaps, 

databases that are not compatible with one 

another, and persistent concerns about the 

accuracy of the data in many of its data 

systems.

EPA did not have any performance goals or 

measures to address this specific challenge 

in its fiscal year 2001 annual report. It did, 

however, describe and summarize agency 

activities to address “Data Management 

Practices,” which is one of 13 major 

management challenges identified by GAO, 

OMB, the EPA Inspector General, and EPA.

According to EPA, data management 

practices include the need to improve the 

management, comprehensiveness, 

consistency, reliability, and accuracy of its 

data to better measure performance and 

achieve environmental results. It also 

includes the need to develop error detection 

processes to make sure that errors in its 

databases are addressed appropriately and 

in a timely and documented fashion. The 

agency reported it was working both 

internally and with the states to address this 

challenge. 

EPA reported that in fiscal year 2001, it had 

promulgated six key data standards and their 

rules for implementation; and the 

Environmental Data Standards Council had 

developed four additional standards that are 

expected to be implemented in fiscal year 

2002. It also reported that it was working to 

expand its implementation of an error 

correction process, which provides an 

effective feedback mechanism for reporting 

and resolving errors identified by the public 

on EPA Web sites. It also identified two 

activities the agency planned to complete in 

fiscal year 2002 -- a formal data architecture 

document and a strategic plan for addressing 

data gaps.

EPA’s fiscal year 2003 performance plan 

includes a general objective to improve 

agency information infrastructure and 

security, but provides no specific 

performance goals and measures related 

to improving data quality. 

In discussing the means and strategy the 

agency plans to follow in meeting its quality 

environmental information goal, it states 

that strengthening its information 

infrastructure is fundamental to increasing 

the availability, usability, and reliability of 

environmental information.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix V

Observations on the Environmental 

Protection Agency’s Efforts to Address Its 

Major Management Challenges

Page 45 GAO-03-225 Status of Addressing Major Management Challenges

a

U.S. General Accounting Office, Environmental Protection: Observations on Elevating the 

Environmental Protection Agency to Cabinet Status, GAO-02-552T (Washington, D.C.: Mar. 21, 2002.)

b

U.S. General Accounting Office, Environmental Protection: Overcoming Obstacles to Innovative State 

Regulatory Programs, GAO-02-268 (Washington, D.C.: Jan. 31, 2002.)

Working relationships with states: GAO 

identified the need for EPA to strengthen its 

working relationships with the states. More 

recently, GAO has recognized that working 

relationships with states are hindered by the 

statutorily imposed regulatory framework 

under which EPA operates.b

 GAO has found 

that this framework, often criticized for being 

costly, inflexible, and ineffective in 

addressing some of the nation’s most 

pressing environmental problems, has also 

constrained EPA and state innovation 

efforts. In 2002, GAO reported that to 

overcome the constraints on innovation 

imposed by strict interpretation of existing 

prescriptive regulations, EPA would need 

legislative changes providing the agency 

with broad statutory authority, or a “safe 

legal harbor,” for allowing states and others 

to use innovative approaches in carrying out 

federal environmental statutes.c

EPA has reported that it relies on state 

partners for successful completion of 8 of 

the 10 goals included in its strategic plan. 

The agency further states that during the 

past two decades environmental and human 

health protection programs have grown in 

size, scope, and complexity; many 

environmental problems transcend media 

and geographic boundaries and that 

solutions may require innovative, flexible, 

cross-media approaches. Thus, according 

to EPA, the agency and the states have 

realized that traditional arrangements for 

addressing environmental problems are not 

as effective and efficient as they need to be. 

EPA maintains that the National 

Environmental Performance Partnership 

System establishes a framework to build a 

result-based management system focusing 

on joint planning and priority setting and 

using environmental indicators and outcome 

measures for accountability. 

EPA’s 2001 performance report did not 

include any specific goals and measures to 

address this management challenge. The 

report, however, does discuss indirectly the 

agency’s progress in addressing this 

challenge in both the general discussion of its 

“Effective Management” goal and as one of 

its 13 major management challenges.

This information states that in August 2001, 

the EPA Administrator issued a major policy 

memo calling for senior leadership to 

advance the National Environmental 

Performance Partnership System through 

increasing the agency’s flexibility for states to 

address the highest priority environmental 

problems, working with the states to improve 

performance measures, and generally 

increasing the incentives for states to improve 

results-based management under the 

system. The agency also reported that it had 

solicited formal input from the Environmental 

Council of the States and the Tribal Caucus 

on state and tribal priorities for the EPA 

budget at the beginning of its annual planning 

and budgeting process for fiscal year 2003 

and that representatives of both 

organizations presented their recommended 

priorities for EPA’s budget at its fiscal year 

2003 annual planning meeting with senior 

management. It reported that these 

recommendations were considered as part of 

the budget decision-making process. To 

facilitate this process, EPA reported that it 

was developing tools that state and EPA 

regional partnership system negotiators can 

use to clarify the appropriate performance 

expectations. It also reported that the 

agency and the Environmental Council of the 

States had established an active joint working 

group to address continuing implementation 

issues and to identify and remove barriers to 

effective implementation of the partnership 

system. 

EPA’s performance plan for fiscal year 

2003 does not include any specific 

performance goals or measures for this 

management challenge. However, in 

discussing its means and strategies for 

attaining its “Effective Management” goal, 

the agency states that developing 

partnerships with stakeholders to ensure 

that mutual goals are met is one of the 

strategies that cuts across all 

organizational boundaries and is a key to 

performing the agency’s mission.

Because existing environmental statutes 

do not contain explicit language authorizing 

the use of innovative environmental 

approaches in lieu of specific regulatory 

requirements, GAO has reported that EPA 

and its stakeholders should closely monitor 

the effectiveness of future innovative efforts 

to determine whether legislative changes 

are needed.d

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix V

Observations on the Environmental 

Protection Agency’s Efforts to Address Its 

Major Management Challenges

Page 46 GAO-03-225 Status of Addressing Major Management Challenges

c

GAO-02-552T.

d

GAO-02-268.
Page 47 GAO-03-225 Status of Addressing Major Management Challenges

Appendix VI

Observations on the Federal Emergency 

Management Agency’s Efforts to Address Its 

Major Management Challenges ApendxiVI

The following table identifies the major management challenges 

confronting the Federal Emergency Management Agency (FEMA), 

including the governmentwide high-risk areas of strategic human capital 

management and information security. The first column lists the 

challenges identified by our office. The second column discusses what 

progress, as discussed in its fiscal year 2001 performance report, FEMA

made in resolving its challenges. The third column discusses the extent to 

which FEMA’s fiscal year 2003 performance plan includes performance 

goals and measures to address the challenges that we identified. We found 

that the FEMA 2001 performance report discussed the agency’s progress in 

resolving all its challenges. However, for three challenges, it is difficult to 

discern how FEMA addresses these challenges because they are not clearly 

linked to a specific goal, including

• strategic human capital management,

• information security, and

• reduce the cost of disaster assistance.

FEMA does not have a specific goal for strategic human capital 

management but does consider it a future management challenge that is 

discussed generally in the report. 

Of the agency’s 5 major management challenges, its 2003 performance plan 

had

1. goals and measures that were directly related to 3 of the challenges, 

including

• determine the cost-effectiveness of disaster mitigation efforts,

• reduce the cost of disaster assistance, and

• improve the financial condition of the National Floor Insurance 

Program (NFIP) 

2. goals and measures that were indirectly applicable to 2 of the 

challenges, including

• strategic human capital management and

• information security.
Appendix VI

Observations on the Federal Emergency 

Management Agency’s Efforts to Address Its 

Major Management Challenges

Page 48 GAO-03-225 Status of Addressing Major Management Challenges

Table 7: Major Management Challenges for FEMA

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management: 

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures.

FEMA’s ability to attract and retain a 

qualified and motivated workforce and to 

provide employment opportunities to 

adequately respond to current and future 

organizational challenges is a major 

challenge facing the agency. This is critical 

since FEMA estimates that 70 percent of its 

workforce is from 40-59 years old, with 

about 17 percent of the agency’s permanent 

full-time workforce eligible for voluntary 

retirement.

The report noted that the agency is working 

to develop a 5-year comprehensive 

enterprisewide human capital strategy that 

can be integrated with its mission, goals, 

operational requirements, and financial 

resources. 

FEMA’s fiscal year 2003 performance plan 

has two human-capital-related goals but no 

measures to quantify achieving the goals. 

The first goal—streamlined organizations—

was established as an OMB universal 

government initiative. This goal calls for 

streamlining FEMA’s workforce while 

focusing on the number of mission-related 

emergency management jobs. It will also 

enable FEMA to estimate the level of 

management needed to perform its mission, 

including the new emphasis on terrorism 

preparedness. Further, FEMA plans to 

establish criteria that will be used 

agencywide to meet approved management 

levels and set management authority levels. 

The second goal—workforce development—

will include workforce planning and 

developing initiatives to address imbalances 

in staff talent and skill requirements in 

addition to addressing anticipated surges of 

voluntary retirements over the next 3 to 5 

years and the attrition factors that normally 

affect the stability of the workforce. 

Through this goal, FEMA plans to initiate its 

comprehensive 5-year strategy to create a 

motivating and challenging performancebased, customer-focused work environment 

for employees. This strategy will address 

the important issues of retention and 

recruitment, professional development, 

employee performance, managerial 

performance, and a safe and healthy work 

environment. 
Appendix VI

Observations on the Federal Emergency 

Management Agency’s Efforts to Address Its 

Major Management Challenges

Page 49 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show that federal computer 

systems are riddled with weaknesses that 

make them highly vulnerable to computerbased attacks and place a broad range of 

critical operations and assets at risk of 

fraud, misuse, and disruption. Further, the 

events of September 11, 2001, underscored 

the need to protect America s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both. 

In its fiscal year 2001 performance report, 

FEMA reported that its antivirus software 

had scanned approximately 35 million 

messages and removed over 49,000 

infections, and its capabilities allowed FEMA 

to restore all of its e-mail services in less 

than 24 hours after the agency was attacked 

by the NIMDA virus.

While FEMA continues to progress in 

addressing its information technology 

management and performance challenges, 

its independent auditors continue to identify 

system deficiencies and vulnerabilities, such 

as poor authentication procedures and 

excessive user access and permissions, 

which undermine the security of FEMA’s 

information management systems. Material 

weaknesses in internal controls over 

FEMA’s financial management systems and 

processes, including information security 

controls for the financial systems 

environment, contributed to its 

noncompliance with the Government 

Information Security Reform Act (GIRSA), 

the Clinger-Cohen Act, the Federal 

Managers’ Financial Integrity Act, and the 

Federal Financial Management 

Improvement Act.

As part of FEMA’s report, the Inspector 

General (IG) stated that the agency 

continued to lack an effective entitywide 

security program in fiscal year 2001. In 

response to major management and 

performance challenges identified by the IG 

under the Reports Consolidation Act, FEMA 

reported that it took the following actions to 

address some of its information technology 

(IT) security related challenges. Specifically, 

FEMA

• conducted vulnerability assessments and 

prepared security plans for all of its 

Presidential Decision Directive 63 (PDD63) critical systems;

In its fiscal year 2003 annual performance 

plan, FEMA stated that IT presented several 

management challenges; however, it did not 

present specific performance measures 

designed to measure the effectiveness of 

information security.

The National Institute of Standards and 

Technology (NIST) developed a security 

assessment framework and related tools 

that agencies can use in determining the 

status of their information security programs. 

Also, OMB guidance for fiscal year 2002 

reporting under GISRA requires agencies to 

use tools developed by NIST to evaluate the 

security of unclassified systems or groups of 

systems. In addition, OMB’s GISRA 

reporting guidance requires specific 

performance measures, as well as 

corrective action plans with quarterly status 

updates.

In its plan, FEMA acknowledged that the 

increasing connectivity between systems, 

especially through the Internet, and 

constantly changing and evolving 

technology and communications 

dramatically increase its security risks. 

FEMA’s information management strategies 

included several high-level approaches for 

addressing these challenges but no specific 

performance measures. For example, in its 

plan, FEMA stated that it had initiated a 

major functional and organizational 

realignment of its IT operations to improve 

service delivery, provide better control over 

IT investments, and ensure that program 

and administrative requirements are fulfilled. 

In addition, FEMA indicated that it is 

reengineering its processes to ensure better 

control of its IT environment and increase 

the efficiency of its resources.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VI

Observations on the Federal Emergency 

Management Agency’s Efforts to Address Its 

Major Management Challenges

Page 50 GAO-03-225 Status of Addressing Major Management Challenges

• is drafting a comprehensive security plan 

and guidelines for both classified and 

unclassified systems so that system 

owners can assess, mitigate, and certify 

their systems.

• tasked the newly organized Configuration 

Management Branch,a

 which reports 

directly to the Chief Information Officer, to 

develop and enforce security policy and 

conduct internal information systems 

security reviews and audits;

• developed a three-phase remediation plan 

to address FEMA’s noncompliance with 

the Federal Financial Management 

Improvement Act of 1996 and Office of 

Management and Budget (OMB) Circular 

A-11, which requires continual financial 

process improvement and system 

modifications (including implementation of 

system and data security elements);

• published FEMA Information Technology 

Architecture, Version 2.0: The Road to eFEMA in May 2001; and

• began making several system 

improvements to increase the reliability 

and capability of its National Emergency 

Management Information System.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VI

Observations on the Federal Emergency 

Management Agency’s Efforts to Address Its 

Major Management Challenges

Page 51 GAO-03-225 Status of Addressing Major Management Challenges

GAO-designated major management 

challenge

Determine the cost-effectiveness of 

disaster mitigation efforts: In August, 

1999, GAO recommended that FEMA, 

among other things, establish an analytical 

basis to support the cost-effectiveness of 

acquiring substantially damaged properties 

in floodplains and conduct periodic reviews 

of projects after they have been 

implemented to determine whether they are 

cost-effective. To provide the best available 

data for analyzing the cost-effectiveness of 

proposed flood hazard mitigation projects, 

GAO also recommended that FEMA

• conduct post disaster verifications of flood 

hazards for use in evaluating and possibly 

revising flood hazard map information and 

• make the agency’s information on past 

insurance more readily available for FEMA 

staff conducting benefit-cost analyses.

The report contains the goal to “support the 

development of disaster resistance in 

communities and states.”

The goal indicates that FEMA has a number 

of mitigation efforts under way to reduce the 

risk of disaster damage. By reducing risk, 

FEMA would be able to reduce costs 

associated with disaster damage. For 

example, in concert with state and local 

governments, FEMA has acquired and 

shared risk management information and 

coordinated and supported community 

efforts to identify and assess potential risks, 

to develop plans and address the risks, and 

to take actions to reduce or eliminate the 

risks, according to the report. 

The report states that mitigation programs 

are aimed specifically at taking people and 

property out of harm’s way to mitigate losses 

due to earthquakes, hurricanes, flooding, 

and other destructive events.

The report also states that FEMA exceeded 

its measurable goals in support of the 

development of disaster resistance in 

communities and states. According to the 

report, FEMA reduced the number of lies, 

structures, and infrastructures at risk and 

increased the number of communities that 

have taken disaster resistance actions.

The fiscal year 2003 performance plan 

generally contains the same goals 

established in fiscal year 2002. FEMA’s 

disaster mitigation efforts can be costeffective by

(1) reducing the number of lives, structures, 

and elements of infrastructure at risk, and by 

increasing the number of communities 

actively committed in fiscal year 2003 to 

building their disaster resistance programs, 

and 

(2) maintaining an estimated avoidance of 

approximately $1 billion in flood losses 

through FEMA’s National Flood Insurance 

Program (NFIP) activities.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VI

Observations on the Federal Emergency 

Management Agency’s Efforts to Address Its 

Major Management Challenges

Page 52 GAO-03-225 Status of Addressing Major Management Challenges

Reduce the cost of disaster assistance: 

One way to reduce federal disaster 

assistance costs is to change the eligibility 

criteria under the public assistance program. 

In 1996, GAO made several 

recommendations regarding changing the 

eligibility criteria. FEMA has since made 

changes to eligibility, but eligibility and 

oversight issues remain.

As a result of consolidating a number of 

goals, specifics to this challenge are spread 

throughout the report among various FEMA 

programs and are not linked to a specific 

goal. 

In fiscal year 2001, FEMA recalculated the 

projected $1 billion in savings from the 

reduction of flood losses. Using a new 

methodology, some prior year estimates 

were lower than originally reported but even 

with these revised figures all goals were met 

according to FEMA’s annual report.

During 2001, FEMA continued to update its 

aging flood map inventory that will involve a 

7-year upgrade to the 100,000-panel flood 

map inventory and an enhancement of 

products, services, and processes that 

potentially reduce or eliminate disaster 

costs. On February 12, 2002, the FEMA 

Flood Map Store opened as part of its egovernment initiative for the sale of flood 

maps products via the Internet.

The fiscal year 2003 performance plan 

contains three goals directly related to this 

management objective.

(1) FEMA plans to maintain at least a 90 

percent success rate in the return of 

equipment from field offices following 

disasters. By recovering and restoring used 

equipment, savings can be realized by 

avoiding the purchase of new items.

(2) FEMA plans to establish on-line 

procurement and e-government services 

training to all contracting staff. 

(3) Under two disaster recovery programs—

Individual Assistance and Public 

Assistance—FEMA plans to increase 

customer satisfaction by streamlining its 

recovery programs that provide a more 

efficient delivery of services.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VI

Observations on the Federal Emergency 

Management Agency’s Efforts to Address Its 

Major Management Challenges

Page 53 GAO-03-225 Status of Addressing Major Management Challenges

a

This Branch has been renamed the Office of Cyber Security.

Improve the financial condition of the 

NFIP: The program has had to borrow 

funds from the Treasury to cover operating 

losses resulting from heavy flooding in 

recent years that produced flood insurance 

losses exceeding the premiums collected 

from policyholders. Two major factors 

underlie financial difficulties—the program, 

by design, is not actuarially sound and it has 

experienced repetitive losses.

FEMA’s report provides two performance 

goals related to this challenge

(1) Operating the mitigation program for 

repetitive-loss properties and implementing 

measures to reduce the subsidy to pre-flood 

insurance rate map properties as measures 

to improve the Program’s underwriting ratio.

(2) Implementing and completing NFIP 

business improvements and information 

system studies.

To address the first goal, FEMA has started 

to reduce the almost $200 million per year in 

losses to repetitive-loss properties. To 

decrease expenses, in 2001, the Federal 

Insurance and Mitigation Administration 

identified about 10,000 repetitive-loss 

properties that are most at risk. If FEMA 

could mitigate the risk to these properties, it 

could expect cost savings.

To address the second goal, NFIP’s 

Community Rating System (CRS) 

recognizes and encourages community 

floodplain management and related 

activities to exceed the minimum standards. 

CRS adjusts the insurance rates to reflect 

the reduced flood risk resulting from 

community and state activities that meet the 

goals of the system. In fiscal year 2001, the 

number of CRS communities increased to a 

total of 938 communities and another 119 

improved their ratings.

FEMA’s Annual Performance Plan for fiscal 

year 2003 calls for improving the NFIP’s 

income-to-expense ratio by 1 percent in 

fiscal year 2002 and the four following years.

To achieve this goal, NFIP will work to 

increase income, decrease expenses, and 

operate more efficiently by implementing 

business processes that improve the 

exchange of information, turnaround time, 

and reduce costs. 

Increasing income will be accomplished by 

FEMA’s efforts to seek year-to-year 

increases in policies-in-force for the 5-year 

period from fiscal year 2002 to fiscal year 

2007.

To decrease expenses, the Federal 

Insurance and Mitigation Administration will 

continue to work to reduce the risk of 

repetitive loss properties to NFIP. As the 

number of these structures decrease, NFIP 

policyholders will save and NFIP will reduce 

repetitive flood losses.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 54 GAO-03-225 Status of Addressing Major Management Challenges

Appendix VII

Observations on the General Services 

Administration’s Efforts to Address Its Major 

Management Challenges ApendxiVI

The following table identifies the major management challenges 

confronting the General Services Administration (GSA), which include the 

governmentwide high-risk areas of strategic human capital management 

and information security. The first column lists the challenges identified by 

our office. The second column discusses what progress, as discussed in its 

fiscal year 2001 performance report, GSA made in resolving its challenges. 

The third column discusses the extent to which GSA’s fiscal year 2003 

performance plan includes performance goals and measures to address the 

challenges that we identified. We found that GSA’s performance report 

discussed the agency’s progress in resolving both of its challenges.

In addition, we noted that GSA’s fiscal year 2003 performance plan had 

goals and measures that directly and indirectly related to both 

governmentwide management challenges. 
Appendix VII

Observations on the General Services 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 55 GAO-03-225 Status of Addressing Major Management Challenges

Table 8: Major Management Challenges for GSA 

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management: 

GAO has identified shortcomings at 

multiple agencies involving key elements of 

modern strategic human capital 

management, including strategic human 

capital planning and organizational 

alignment; leadership continuity and 

succession planning; acquiring and 

developing a staff whose size, skills, and 

deployment meet agency needs; and 

creating results-oriented organizational 

cultures.

GSA’s performance report and plan 

recognize that GSA has a human capital 

management challenge and state that GSA 

is prepared to meet this challenge. GSA 

recognizes that it has lost, and will continue 

to lose, significant knowledgeable staff and 

that staff have not been added to replace 

the voids left by these departures. 

Specifically, GSA has significantly 

downsized and restructured its 

organization since 1993. Much of the 

downsizing was accomplished through 

early retirements and buyout authority and 

by filling job vacancies sparingly. In 

addition, GSA recognizes that it has an 

aging workforce and faces the potential 

for significant loss of institutional 

knowledge in the coming years as these 

staff leave the workforce. 

In response to the challenge, GSA 

identified human capital planning and 

organizational alignment, leadership 

continuity and succession planning, and 

recruitment and retention of staff with the 

right skills as key areas needing attention.

GSA’s performance report discusses the 

actions GSA is taking to address its human 

capital management challenge. Specifically, 

the report discusses a new strategic goal, a 

more effective human capital management 

process, and five categories in which human 

capital performance is intended to be 

measured. In addition, the report has seven 

specific performance goals addressing the 

human capital management challenge. GSA 

reported that its performance exceeded the 

targets for five goals and achieved success in 

two goals.

GSA’s performance report explained that GSA 

had added a new strategic goal--“Maintain a 

world-class workforce and a world-class 

workplace”--to reflect human capital’s 

importance. Under this goal, GSA specified 

the need to recruit, hire, develop, and retain 

staff with strategic competencies for mission 

critical occupations; promote a knowledgesharing culture and a climate for intellectual 

honesty; promote continuous learning and 

improvement; and ensure that agency 

leadership inspires, motivates, and develops 

staff, adapts to various situations, and models 

standards of honesty, integrity, trust, and 

respect.

GSA’s performance report also explains that 

GSA is developing a more effective human 

capital management process that is to be 

integrated with GSA’s strategic goals and 

performance management process. The 

human capital management process is to 

address the need for specific recruitment, 

training, retention, and exit/succession 

planning that is required to maintain the skills 

and competencies needed to achieve high 

performance and continuous improvement at 

GSA. 

The report also states that GSA plans to focus 

on measuring human capital performance in 

five categories—strategic competencies, 

GSA’s fiscal year 2003 performance plan 

discusses general strategies and goals 

beyond those in the 2001 performance 

report that relate to its efforts to deal with 

its human capital challenges. The 

strategies are related to GSA actions on 

the President’s governmentwide 

management agenda and sections specific 

to CPO, the Federal Supply Service (FSS), 

and FTS. The performance plan has eight 

goals—six for CPO and two for OGP—

directed at the human capital management 

challenge. These goals primarily focus on 

recruiting, training, and retaining staff.

The performance plan has a section that 

addresses how GSA stands on the human 

capital initiative, which was part of the 

President’s governmentwide management 

agenda. Specifically, GSA states in this 

section that it has prepared an agencywide 

human capital strategic plan. This plan 

outlines the actions GSA expects to take to 

meet the challenges linked with an aging 

workforce, many of whom are eligible for 

retirement.

CPO says in the performance plan that the 

workforce challenge has moved to the 

forefront of the federal government’s and 

GSA’s agendas. The plan says GSA is 

prepared for the challenge of keeping its 

human capital “need” from becoming a 

human capital “crisis.” The GSA human 

capital management process is to address 

the need for specific recruitment, training, 

retention, and exit/succession planning. 

GSA plans to use a template designed by 

the Human Resources Management 

Council, which is made up of the human 

resource directors from major federal 

agencies and executives from the federal 

government’s Office of Personnel 

Management (OPM), to help measure its 

success in human resource management. 
Appendix VII

Observations on the General Services 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 56 GAO-03-225 Status of Addressing Major Management Challenges

leadership, performance culture, learning, and 

strategic awareness—to measure success. 

The strategic competencies category is 

described as encompassing recruiting, 

developing, and retaining staff with the 

strategic competencies for mission critical 

occupations. The leadership category is to 

address ensuring that agency leadership 

inspires, motivates, and models high 

standards. The performance culture category 

is to focus on creating a culture that motivates 

staff while ensuring fairness in the workplace. 

The learning category is to be concerned with 

promoting knowledge sharing, intellectual 

honesty, and continuous learning and 

improvement. The strategic awareness 

category is intended to align human capital 

policies to support GSA’s mission, values, and 

goals. 

In addition to the five categories for measuring 

human capital performance, GSA’s 

performance report includes seven goals—

three for GSA’s Office of Chief People Officer 

(CPO) and four for the Office of 

Governmentwide Policy (OGP)—that relate to 

GSA’s efforts to address its human capital 

management challenge. These goals 

generally focus on recruiting and training staff.

CPO is responsible for providing GSA with 

workforce, organization, and workplace 

solutions. Efforts that CPO reported include 

an increased emphasis on hiring recent 

college graduates, improving the skills of 

current staff, and holding a series of meetings 

with managers to share best practices in the 

areas of recruiting, energizing staff, and 

developing leaders, contracting with the Office 

of Personnel Management to develop a 

succession plan for Public Buildings Service 

leadership, and hiring a private vendor to 

deploy additional training in GSA’s Federal 

Technology Service (FTS). 

CPO had three human capital management 

performance goals. The goals were to 

increase customer satisfaction with filling 

vacancies, to improve the cycle time for 

The FSS section of the plan also addresses 

the need to invest in and develop a worldclass workforce. FSS reports that it 

implemented an initiative that places 

special emphasis on recruiting new staff, 

energizing the current workforce, and 

developing leadership skills. In addition, the 

plan states that FSS is focusing on 

recruiting new staff, determining how to 

reallocate existing staff to ensure they are 

deployed in a manner appropriate for 

mission accomplishment, and identifying 

areas where out-sourcing may be a useful 

way of offsetting shortages. To help 

improve its performance, FSS explains in 

the plan that it is implementing a 

performance management and incentives 

system to link performance and results. 

The intent is to reward FSS staff and 

programs that meet or exceed standards of 

high performance. 

In addition, the FTS section of the plan 

addresses human capital management. 

The plan states that FTS will strive to hire 

and retain staff that are highly trained in the 

acquisition, telecommunications, and 

information technology fields. FTS 

perceives this as critical to help achieve 

customer satisfaction and the effective 

procurement of technology. In addition, in 

order to foster a culture in which all staff 

can succeed and be respected, FTS states 

that it is implementing initiatives to increase 

internal communication, recognize and 

develop staff, and provide current 

technology so that its workforce excels at 

customer service.

The CPO section of the fiscal year 2003 

performance plan has six goals related to 

the human capital challenge. The goals 

generally focus on recruiting, training, and 

retaining staff. Two 2003 performance 

goals—(1) to improve cycle time for 

recruiting and (2) to increase the use of 

GSA online university as a cost-effective 

method to improve employee skills—were 

also included in GSA’s 2002 plan. For the 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VII

Observations on the General Services 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 57 GAO-03-225 Status of Addressing Major Management Challenges

recruiting, and to increase the use of its online 

university as a cost-effective method for 

improving staff skills. The 2001 performance 

report says CPO exceeded its targets for each 

of these goals.

OGP, which is charged with shaping and 

maintaining a governmentwide framework that 

helps agencies better serve the public by 

improving management in the federal 

government, had two goals directly related to 

the human capital management challenge. 

The first goal was to invest in the 

competencies of its workforce to ensure that 

all OGP staff have the necessary knowledge 

and skills to support the organization’s 

mission. Although data had not been 

developed to measure performance on this 

goal, OGP reported being successful. OGP 

cited results such as providing employees with 

continuing education opportunities, making 

additional funds available for the training 

budget, and using specialized software to 

assess the competence of some staff 

members as evidence of its success. The 

second goal, which was a new goal, was to 

increase the satisfaction and effectiveness of 

its workforce by encouraging innovation and 

increasing staff satisfaction with OGP-wide 

communications, cooperation, and information 

assets. Although OGP did not have a 

performance target for this goal, OGP 

reported that it had achieved success in that it 

had used a survey to assess impediments and 

then focused on addressing them.

OGP also had two performance goals that 

were not directly related to training GSA’s 

employees but to training employees of all 

agencies. Since GSA employees could take 

advantage of the offerings under these goals, 

we discuss them here. One goal was to 

establish and maintain a core curriculum of 

Internet-based courses and to increase the 

number of training instances. The other goal 

was to improve the professional skills of 

present and future federal information 

technology leaders. OGP reported that it 

exceeded its performance targets for both 

goals.

first goal, CPO will measure the days it 

takes to process relevant personnel 

actions. The basic strategy to achieve the 

target performance is to identify and 

encourage cost-effective methods to 

streamline the recruitment process. For the 

second goal, the measure is to increase the 

number of course registrations. CPO’s 

strategy to meet this goal is to encourage 

online university use, promote the 

advantages of online over traditional 

training, and add quality courses to the 

curriculum. 

In addition, the 2003 plan includes four new 

human capital management performance 

goals. CPO has added two goals related to 

improving staff competencies needed in 

three job categories—acquisition, real 

estate, and technology. One goal is to 

increase the professional competency of 

GSA’s acquisition workforce and the other 

is to develop competency models for key 

real estate and technology positions. The 

basic strategy for both goals is to develop 

information on the existing and desired 

competencies for staff in these areas and 

develop plans for improving the level of 

competencies where needed. CPO is 

examining ways to measure these goals. 

The third new goal is to identify high 

performing staff in GSA’s critical job 

categories to enable GSA to improve its 

strategies to recruit and retain talented 

staff. CPO’s approach is to develop 

strategies using financial and other 

incentives that will encourage high 

performing staff in critical jobs to stay with 

the agency. CPO reports that it is in the 

process of developing measures for this 

goal. 

The fourth new goal addressing the human 

capital challenge is to have GSA rank in the 

75th percentile in the Gallup Q12 survey. 

This survey measures employee attitudes 

about their workplace environments. 

According to the plan, Gallup has 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VII

Observations on the General Services 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 58 GAO-03-225 Status of Addressing Major Management Challenges

determined that organizations in the 75th

percentile are considered “World-Class 

Workplaces” and this is GSA’s goal for 

fiscal year 2003. The strategy is (1) to use 

the results of this survey to identify 

employees’ concerns and (2) to develop, 

measure, and implement action plans to 

improve in areas needing attention. The 

ultimate end is to attract and retain talented 

employees.

OGP also had two human capital 

management goals in the performance 

plan. The fiscal year 2003 performance 

plan explained that OGP had consolidated, 

modified, and restructured its goals to 

make them more customer-focused and 

outcome-oriented. As such, the fiscal year 

2003 human capital goals are different from 

those of the prior year. One goal is directly 

and the other is indirectly related to GSA’s 

human capital management challenge. The 

first is to improve the overall score on the 

Gallup Q12 survey. This survey measures 

employees’ satisfaction with their 

workplace environments, and OGP will use 

the results to help identify and improve the 

workplace and thus improve staff 

satisfaction, productivity, and retention. 

OGP will measure progress by monitoring 

improvement in its total mean survey score. 

The other goal—establish core technical 

and general competencies and 

governmentwide standards for program 

areas within OGP’s responsibility—is 

aimed at the government in general and, as 

such, could indirectly be used to help GSA. 

Measures are yet to be developed for this 

goal, but OGP’s strategy includes working 

with government and nongovernment 

entities to identify (1) competencies 

essential for federal workers to be 

successful and (2) ways to impart these 

needed skills to staff.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VII

Observations on the General Services 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 59 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agency and 

governmentwide efforts to strengthen 

information security have gained 

momentum and expanded. Nevertheless, 

recent audits continue to show federal 

computer systems are riddled with 

weaknesses that make them highly 

vulnerable to computer based attacks and 

place a broad range of critical operations 

and assets at risk of fraud, misuse, and 

disruption. 

The performance report and plan recognize 

that GSA’s challenges in the information 

technology area continue to increase. Many 

of its systems process and store sensitive 

information. Specific to information security, 

GSA reported its major management 

challenge is to ensure that systems 

continue to operate as intended, agency 

assets are protected, and privacy is 

assured. 

GSA’s performance report discusses some 

general strategies related to the information 

technology security challenge and includes 

one goal related to it. In the report, GSA 

recognizes that its systems have had security 

vulnerabilities and weaknesses and outlined 

the following steps it took during fiscal year 

2001 to help address these challenges:

• development and funding of a new 

information technology center of expertise;

• development and execution of an information 

technology security plan;

• development and distribution of agencywide 

information technology security guidelines 

and procedures;

• development and implementation of 

procedures for performing vulnerability and 

risk assessments;

• monitoring of access attempts and security 

violations;

• development and implementation of security 

training; and

• monitoring and reporting of policies and 

guidelines for compliance by Services, staff 

offices, and regions.

The Office of the Chief Information Officer 

(CIO) has a goal that directly relates to GSA’s 

efforts to address this challenge. Specifically 

this goal is to resolve all high-risk 

vulnerabilities detected by information 

technology audits or reviews within 30 days of 

the findings and recommendations. CIO 

reports that in fiscal year 2001 four high-risk 

security vulnerabilities were identified and all 

were resolved within the 30-day time frame. In 

addition, the report says that all vulnerabilities 

found during testing were resolved in less than 

an hour.

The GSA fiscal year 2003 performance 

plan includes some additional discussion 

related to this management challenge that 

was not in the 2001 performance report 

and one direct and one indirect goal related 

to it.

The performance plan’s section on the 

President’s governmentwide management 

agenda on E-government discusses how 

GSA stands on the information security 

initiative. This section states that GSA 

recognized that it has significant 

information technology security 

weaknesses and has submitted a report 

with plans to remedy them. The plan 

identifies two groups within FTS that 

provide governmentwide assistance in the 

area of information security. The 

Information Technology Solutions group 

specifically says that, among other things, it 

provides security solution services and the 

Office of Information Assurance and Critical 

Infrastructure Protection, among other 

things, helps federal agencies meet the 

challenges of securing operations in the 

Internet environment. 

The CIO continues its goal, which is directly 

related to the challenge, to resolve all highrisk vulnerabilities and conditions detected 

by information technology audits or reviews 

within 30 days of findings and 

recommendations. CIO measures its time 

frame to ensure its performance meets the 

30-day standard. Basically, its strategy is to 

monitor reports of problems, monitor action 

plans to see if they seem responsive to the 

problem, and track the timeliness of 

corrective actions. 

Although not specific to GSA, the plan also 

has an information security goal that 

addresses the challenge governmentwide. 

Specifically, the FTS goal is to raise the 

level of awareness of information security 

across the federal government. As 

background, the plan explains that the 

Government Information Security Reform 

Act requests federal agencies to report

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VII

Observations on the General Services 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 60 GAO-03-225 Status of Addressing Major Management Challenges

computer security incidents to GSA. GSA’s 

Federal Computer Incident Response 

Center is its focal point for computer 

security incident recognition, reporting, 

handling, and prevention. To assess 

awareness, GSA tracks the number of 

agencies who report incidents to the 

center. GSA’s strategy for this goal is 

basically to interact with agencies and 

educate them on the importance of incident 

reporting.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 61 GAO-03-225 Status of Addressing Major Management Challenges

Appendix VIII

Observations on the Department of Health 

and Human Service’s Efforts to Address Its 

Major Management Challenges ApendxiVI

The following table identifies the major management challenges 

confronting the Department of Health and Human Services (HHS), 

including the governmentwide, high-risk areas of strategic human capital 

management and information security. The first column lists the major 

management challenges identified by our office. The second column 

discusses what progress, as discussed in their fiscal year 2001 performance 

reports, HHS and three of its component agencies—the Centers for 

Medicare & Medicaid Services (CMS)6

, the Food and Drug Administration 

(FDA), and the Administration for Children and Families (ACF)—have 

made in resolving these challenges. We chose to review these agencies’ 

plans because they are the responsible agencies for addressing the five 

agency-specific management challenges. The third column discusses the 

extent to which HHS’s, CMS’s, FDA’s, and ACF’s fiscal year 2003 

performance plans include performance goals and measures to address the 

challenges that we identified. 

We found that all seven of the major management challenges identified by 

GAO were discussed, to some extent, in at least one or more of the 

agencies’ fiscal year 2001 performance reports. Regarding how the 

department and its agencies addressed the government-wide challenge of 

strategic human capital in their fiscal year 2003 performance plans, we 

found that, although HHS and its component agencies did not directly 

address all four elements of the challenge, each had some goals that related 

to some aspects of human capital management. Regarding the 

government-wide challenge of information security, we found that HHS 

only referred to having goals to address this challenge and CMS had a 

specific goal that directly addressed it, but FDA and ACF did not. Because 

HHS and the agencies we reviewed were uneven in their approach to these 

government-wide management challenges, we considered them to have 

goals and measures indirectly related to these challenges.

Of the agency’s seven major management challenges, its performance plan 

had

1. goals and measures that were directly related to the five agencyspecific challenges and

6

 In this appendix, we refer to the Centers for Medicare & Medicaid Services (CMS), 

formerly known as the Health Care Finance Administration (HCFA) as “CMS” throughout 

the text because that is how the agency referred to itself in its Performance Report and Plan.
Appendix VIII

Observations on the Department of Health 

and Human Service’s Efforts to Address Its 

Major Management Challenges

Page 62 GAO-03-225 Status of Addressing Major Management Challenges

2. goals and measures that were indirectly applicable to both of the 

governmentwide management challenges, including

• strategic human capital management and

• information security.
Appendix VIII

Observations on the Department of Health 

and Human Service’s Efforts to Address Its 

Major Management Challenges

Page 63 GAO-03-225 Status of Addressing Major Management Challenges

Table 9: Major Management Challenges for HHS

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk 

Strategic human capital management:

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures.

HHS’s report did not address departmental 

performance relating to the four key 

elements of this challenge. However, CMS, 

FDA, and ACF did report on some human 

capital activities, which were related to some 

aspects of this challenge.

For CMS, see discussion below under the 

management challenge “Provide current 

and future generations with a well-designed 

and administered Medicare program.”

FDA reported that its strategic goal was to 

provide a streamlined and efficient hierarchy 

within the agency that aligned itself with 

HHS’s guidelines for consolidating 

administrative functions. FDA’s fiscal year 

2001 performance goal was to increase the 

number of employees per supervisor to one 

supervisor to every 7.28 employees. FDA 

reported that it exceeded its goal by 

obtaining a ratio of 1:7.69. Although FDA 

did not establish a performance goal to 

consolidate administrative functions in the 

agency until fiscal year 2002, FDA merged 

its management information systems and 

evaluation staffs in fiscal year 2001.

ACF reported that it has tracked its efforts to 

develop and retain a highly skilled, strongly 

motivated staff since fiscal year 2000, but its 

performance report does not include any 

data that show progress it has made. In 

fiscal year 2001, ACF had only one 

performance measure related to strategic 

human capital management, that each ACF 

staff member have at least one training 

opportunity directly related to increasing job 

skills. ACF reported that data were not 

available to assess whether this goal was 

achieved, but it reported developing an 

agency training strategy to increase and 

broaden technical and nontechnical training 

opportunities for all employees.

Overall, the fiscal year 2003 performance 

plans for HHS, CMS, FDA, and ACF did not 

directly address all four key elements of this 

challenge. However, each plan contained 

some goals that are related to some aspects 

of this challenge.

HHS’s main human capital management 

goal is to reduce unnecessary layers and 

develop a more efficient organizational 

structure. To achieve this, it plans to 

consolidate its management layers, reduce 

the number of personnel offices, and 

consolidate the public affairs and legislative 

affairs functions. 

For CMS, see discussion below under the 

management challenge “Provide current 

and future generations with a well-designed 

and administered Medicare program.”

FDA’s fiscal year 2003 performance goals 

include developing and implementing a plan 

to reduce organizational layers in all of 

FDA’s components. In addition, FDA plans 

to review 15 percent of its full time 

equivalents that are in functions that might 

be candidates for outsourcing to determine if 

additional opportunities for outsourcing 

exist. FDA did not retain a goal for its 

supervisor to employee ratio.

ACF’s fourth strategic goal is to build a 

results-oriented organization. Two 

objectives under this goal relate to strategic 

human capital management and are major 

administration initiatives: (1) develop and 

retain a highly skilled, strongly motivated 

staff and (2) streamline ACF organizational 

layers. 
Appendix VIII

Observations on the Department of Health 

and Human Service’s Efforts to Address Its 

Major Management Challenges

Page 64 GAO-03-225 Status of Addressing Major Management Challenges

In fiscal year 2002, ACF reinstated a fiscal 

year 1999-2000 performance measure to 

increase ACF’s staff relative to the number 

of its managers. In addition, ACF is in the 

process of developing a restructuring plan 

and analyzing information gathered for 

workforce planning purposes in order to 

identify additional performance measures in 

this area. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VIII

Observations on the Department of Health 

and Human Service’s Efforts to Address Its 

Major Management Challenges

Page 65 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show that federal computer 

systems are riddled with weaknesses that 

make them highly vulnerable to computerbased attacks and place a broad range of 

critical operations and assets at risk of 

fraud, misuse, and disruption. Further, the 

events of September 11, 2001, underscored 

the need to protect America ’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both.

Overall, only CMS’s fiscal year 2001 

performance report discussed steps it took 

that were directly related to this 

management challenge. 

HHS’s fiscal year 2001 performance report 

did not provide information on steps the 

agency had taken to improve information 

security.

CMS had three objectives related to its goal 

of improving information security in fiscal 

year 2001. 

First, CMS met its objective to increase by 

one-third the proportion of Medicare 

contractor sites whose information security 

practices were reviewed. However, it did not 

meet its second objective of eliminating the 

material weakness found in the fiscal year 

2001 CFO audit related to information 

security. Auditors of HHS’s fiscal year 2001 

financial statement noted numerous 

problems with the security of Medicare 

information systems, which had also been 

noted in prior CFO audits. These audits 

stated that these problems could result in 

unauthorized access to sensitive Medicare 

data. CMS’s report did not address the 

nature of these problems or whether the 

problems were corrected. In its technical 

comments to this appendix, CMS reported 

that it implemented a control to address this 

weakness. Finally, CMS did not meet its 

objective of providing security awareness 

training to 95 percent of its workforce; it 

trained only 20 percent of its workforce on 

this topic. In its technical comments, CMS 

reported that it implemented computerbased security awareness training in late 

2002 and that approximately 70 percent of 

CMS employees had completed the training.

FDA’s fiscal year 2001 report did not 

generally address information security, 

except in how the need to increase security 

requirements contributed to missing a target 

to implement an adverse event reporting 

system for medical devices.

Overall, HHS’s fiscal year 2003 performance 

plan only referenced the fact that the 

department had goals related to the 

information security challenge. However, of 

its component agencies, only CMS’s plan 

contained a specific goal relating to this 

challenge.

HHS states in its plan that it has added 

information security goals as a result of our 

January 2001 report. It does not address 

them further. 

For fiscal year 2003, CMS has four 

objectives related to its goal of improving 

information security. These include

• eliminating all material weaknesses in 

information security, as measured by the 

CFO audit;

• implementing an improved access control 

management system to prevent 

unauthorized access;

• continuing contractor security reviews; and

• conducting penetration testing and 

vulnerability assessments at a subset of 

Medicare contractors and CMS service 

providers.

In its technical comments, CMS reported 

that it has now revised its fiscal year 2003 

information security objectives by 

eliminating the latter two objectives.

FDA did not generally address information 

security in its fiscal year 2003 plan. 

While ACF has an objective to improve 

automated data and management systems, 

the objective does not specifically address 

issues related to information security.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VIII

Observations on the Department of Health 

and Human Service’s Efforts to Address Its 

Major Management Challenges

Page 66 GAO-03-225 Status of Addressing Major Management Challenges

ACF’s fiscal year 2001 performance plan did 

not provide information on steps the agency 

had taken to improve information security.

GAO-designated major management 

challenge

Provide current and future generations 

with a well-designed and administered 

Medicare program: GAO has identified a 

number of human capital challenges facing 

CMS. First, despite Medicare’s size and 

complexity, there is no official whose sole 

responsibility is to run the program. In 

addition to Medicare, CMS’s Administrator 

and top-level management have oversight 

and administrative responsibilities for other 

major health-related programs and 

initiatives, such as Medicaid, the State 

Children’s Health Insurance Program, and 

nursing homes. Second, frequent changes 

in leadership have inhibited the 

implementation of long-term Medicare 

initiatives and the pursuit of a consistent 

management strategy. Third, CMS’s staff 

lacks the experience and training to deal 

with some of the complex new 

responsibilities mandated by the Balanced 

Budget Act of 1997. Finally, with one-third of 

its staff eligible to retire within the next 5 

years, CMS faces the loss of valuable 

institutional knowledge.

CMS’s fiscal year 2001 report indicated that 

it took some steps to address the human 

capital aspects of this management 

challenge even though CMS did not draft its 

goals relating to our strategic human capital 

management challenge until its 2002 and 

2003 plans. 

First, CMS began implementing a fourphase process to systematically assess its 

workforce needs. As part of this process, 

CMS identified gaps in staff skills and 

knowledge by using a voluntary, agencywide 

assessment process. Second, CMS 

initiated the design of an intranet-based 

system to house workforce planning data. 

Third, CMS continued implementation of 

competency-based recruitment and 

selection for non-SES managers. Fourth, in 

fiscal year 2001, it offered continuous 

learning courses in core management skills. 

CMS reported that it intends to make some 

of these courses mandatory for newer 

managers. However, the CMS report did not 

address the lack of a single individual 

overseeing Medicare or frequent changes in 

agency leadership.

For fiscal year 2003, the CMS plan outlines 

three goals to improve human capital 

management. By fiscal year 2003, CMS 

anticipates fully implementing an automated 

workforce planning system for all employees 

and a performance-based management 

system and award and recognition program 

for non-SES managers. Additionally, CMS 

plans to consolidate administrative functions 

and reduce FTE usage through other 

administrative initiatives. However, the CMS 

report addresses neither the lack of a single 

individual overseeing Medicare nor the 

frequent changes in agency leadership.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VIII

Observations on the Department of Health 

and Human Service’s Efforts to Address Its 

Major Management Challenges

Page 67 GAO-03-225 Status of Addressing Major Management Challenges

Better safeguard the integrity of the 

Medicare program: Because of the 

program’s vast size and complexity, 

Medicare is at risk of considerable losses 

from waste, fraud, abuse, and 

mismanagement. As a result, we have 

designated it a high-risk program and 

identified several management challenges, 

which are outlined below. 

First, in Medicare’s fee-for-service 

component, there are several weaknesses 

in CMS’s monitoring of contractor claims 

review and payment. Second, CMS faces 

challenges in establishing appropriate prices 

to pay for covered services through its 

prospective payment methods. Third, 

Medicare’s managed care component, 

known as Medicare+Choice, is subject to 

improper payment problems, such as 

overpayment and failure to deliver 

necessary services. Finally, a major 

problem underlying CMS’s effort to ensure 

proper claims payment is that its information 

systems are outmoded and many of its 

financial management procedures are not 

yet in order.

 

In fiscal year 2001, CMS had eight goals 

relating to the program integrity 

management challenge. CMS met six of 

these goals; did not meet one; and, pending 

final data, expects to meet another. These 

goals partly addressed the management 

issues we identified. However, CMS 

changed some of its program integrity goals 

from prior years, making it difficult to assess 

CMS’s progress in addressing the challenge 

we identified.

First, CMS sought to reduce the percentage 

of improper payments made under the feefor-service program to 7 percent. The 

agency met this goal. For fiscal year 2001, 

the HHS Office of Inspector General 

estimated that 6.3 percent of fee-for-service 

claims were paid improperly. 

Second, in fiscal year 2001, CMS reported 

meeting its goal to implement initiatives for 

measuring program integrity outcomes. 

These included taking steps to implement 

the Comprehensive Error Rate Testing 

program. CMS anticipates that the program 

will serve to provide ongoing measures of 

improper payments.

Third, CMS reported that, pending final 

data, it expected to meet its goal of 

implementing the Comprehensive Plan for 

Program Integrity. This plan outlined the 

agency’s overall program integrity strategy 

and 10 specific short-term initiatives that 

addressed certain vulnerable areas, such as 

effectiveness of medical review of claims, 

efforts to safeguard payments, and provider 

integrity and benefit areas including 

inpatient care, managed care, community 

mental health, and nursing homes.

Fourth, regarding its goal to increase 

Medicare secondary payer liability and nofault dollar recoveries, in fiscal year 2001, 

CMS changed its focus from no-fault dollar 

recoveries to increasing Medicare 

secondary payer credit balance recoveries 

CMS has 10 goals for fiscal year 2003 

related to the program integrity challenge. 

First, it plans to reduce the percentage of 

improper payments made under the 

Medicare fee-for-service program to 5 

percent. In conjunction with this goal, CMS 

expects to have fully implemented the 

Comprehensive Error Rate Testing program, 

which is expected to produce a more 

accurate Medicare fee-for-service error rate 

than current estimates. 

Second, to increase Medicare secondary 

payer credit balance recoveries and 

decrease the time to collect improper 

payments, CMS plans to implement and 

monitor the use of revised credit balance 

instructions by its regional offices, fiscal 

intermediaries, and providers. 

Third, CMS plans to develop a goal to 

measure and improve beneficiary and 

provider satisfaction with the way the 

agency and its contractors conduct program 

safeguard activities. 

Fourth, CMS plans to improve the provider 

enrollment process by implementing the 

Provider Enrollment Chain Ownership 

System, which will create a centralized 

depository of information on Medicare 

providers. In conjunction with this goal, CMS 

also plans to revalidate its current 

information on 20 percent of Part A 

providers.

Fifth, CMS plans to continue development of 

its information technology architecture and 

develop architectural support services for 

the agency. 

Sixth, CMS’s objective for its financial 

statements is to maintain an unqualified 

opinion. 

Seventh, CMS plans to implement an 

integrated general ledger accounting 

system. The system is currently in the pilot 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VIII

Observations on the Department of Health 

and Human Service’s Efforts to Address Its 

Major Management Challenges

Page 68 GAO-03-225 Status of Addressing Major Management Challenges

and decreasing recovery time. CMS 

reported that it met its target by hiring a 

consulting firm to gather information on 

provider credit balance identification, the 

submission and resolution process, and 

contractor monitoring and resolution of 

credit balances.

Fifth, CMS continued to develop an 

information technology architecture to help it 

plan and develop an information systems 

environment that is more responsive to 

current and future business demands, less 

expensive to maintain, and better able to 

support program operations and policy 

decision making. However, CMS did not 

meet all of its fiscal year 2001 targets in this 

area, which it attributed to budget and 

staffing shortfalls. 

Sixth, HHS met its goal of maintaining an 

unqualified, or “clean,” audit opinion of its 

fiscal year 2001 financial statement. In 

other words, HHS’s financial statements 

fairly presented its financial position, 

including net costs, changes in net position, 

budgetary resources, and financing. 

However, the agency continued to have a 

material weakness related to its financial 

processes and controls, in addition to the 

weakness related to information systems 

security. As a result, the agency has taken 

steps to strengthen financial management.

Seventh, as required by the Social Security 

Act, CMS exceeded its goal of paying 95 

percent of Medicare electronic claims on 

time. 

Finally, CMS met its goal of improving the 

oversight of Medicare fee-for-service 

contractors. With the objective of national 

uniform contractor evaluation, CMS 

conducted on-site reviews using 

standardized review protocols. 

design, development, and implementation 

phase. In its fiscal year 2003 performance 

plan, CMS stated that it expected to 

complete implementation by fiscal year 

2006. However, in its technical comments, 

CMS stated that it now expects to complete 

implementation by fiscal year 2007.

Eighth, in order to meet the requirements of 

the Debt Collection Improvement Act of 

1996, CMS has a goal to increase referrals 

of eligible delinquent debt to the Department 

of the Treasury or to a Treasury-designated 

debt collection center. In fiscal year 2003, 

CMS plans to refer all eligible delinquent 

debt and improve the procedures for 

identifying, monitoring, and tracking these 

debts. 

Ninth, with respect to timeliness of payment, 

as required by the Social Security Act, CMS 

plans to continue to meet the Act’s 

requirement of paying at least 95 percent of 

its electronic claims within 14 to 30 days of 

receipt. 

Finally, in fiscal year 2003 CMS plans to 

continue its goal to improve its oversight of 

Medicare fee-for-service contractors, but did 

not set a fiscal year 2003 target to measure 

performance.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VIII

Observations on the Department of Health 

and Human Service’s Efforts to Address Its 

Major Management Challenges

Page 69 GAO-03-225 Status of Addressing Major Management Challenges

Improve oversight of nursing homes so 

that residents receive quality care: Citing 

complaints of harm to residents, in our 

January 2001 report, we identified two 

challenges. First, CMS needs to address 

weaknesses in federal and state oversight of 

nursing homes. Second, to improve 

oversight, CMS needs to better use 

management information to verify and 

assess states’ oversight activities and 

analyze and monitor nursing home 

performance. 

In fiscal year 2001, CMS had three goals 

that relate to improving oversight of nursing 

homes and ensuring quality of care. CMS 

did not meet its target for its first goal—

decreasing the prevalence of restraint use in 

nursing homes. Its target was 10 percent, 

and interim data indicated that restraint use 

was at 10.2 percent. In the text of its report, 

CMS did not adequately explain how it 

measured restraint use.

With respect to its second goal—to 

decrease the prevalence of pressure ulcers 

in nursing homes—CMS reported that, 

based on interim data, it did not meet its 

target of 9.6 percent. Here, as with restraint 

use, the text of its report did not adequately 

explain how CMS measured pressure ulcer 

prevalence. CMS was unsure of the cause 

for the increase in pressure ulcers and was 

examining the data. However, its report did 

not address what measures it would take in 

response to an actual increase in the 

incidence of pressure ulcers.

CMS reported that it met the objectives of its 

third goal—to improve the management of 

the survey budget process. It increased 

budget allocations to states within a specific 

threshold and developed performance 

measures and baselines for the quality of 

survey work performed. 

For fiscal year 2003, CMS’s plan has the 

same three quality of care goals as it did in 

fiscal year 2001, which are to

• decrease the prevalence of restraints in 

nursing homes,

• decrease the prevalence of pressure 

ulcers in nursing homes, and

• improve the management of the survey 

budget process. 

With respect to the latter, CMS states in its 

plan that it will use the performance 

measures and associated baselines to 

measure the quality of the survey work 

performed. However, its plan does not 

indicate what action it intends to take if state 

agencies fall below the baselines. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VIII

Observations on the Department of Health 

and Human Service’s Efforts to Address Its 

Major Management Challenges

Page 70 GAO-03-225 Status of Addressing Major Management Challenges

Ensure the safety and efficacy of medical 

products: Our January 2001 report noted 

two major management challenges for FDA 

in this area. First, FDA’s efforts to monitor 

medical product manufacturing needed 

improvement. Specifically, the number of 

inspections completed by FDA had been far 

fewer than the number required by statute. 

Second, FDA’s risk-based inspection 

strategy for foreign pharmaceutical 

manufacturers did not ensure timely followup. 

FDA reported that it met or exceeded seven 

of the nine goals that we identified in its 

fiscal year 2001 performance report that 

related to this challenge.

FDA reported meeting or exceeding its fiscal 

year 2001 goals for

• inspecting 9 percent of foreign device 

manufacturers,

• assuring that 90 percent of the domestic 

drug industry conformed with FDA 

requirements,

• assuring that 90 percent of domestic 

biologics industry conformed to FDA 

standards,

• assuring that 90 percent of the domestic 

medical device manufacturers conformed 

to FDA requirements,

• inspecting 17 percent of domestic medical 

device manufacturers,

• ensuring at least 97 percent of 

mammography facilities met FDA 

standards, and 

• inspecting 50 percent of blood banks.

FDA did not address the progress it made in 

inspecting 50 percent of source plasma 

operations and biologics manufacturing 

establishments. In its technical comments, 

FDA stated that it reported meeting this goal 

in its fiscal year 2002 Congressional 

Justification.

FDA reported not meeting its goals for

• inspecting 26 percent of registered 

domestic human drug manufacturers,

• inspecting repackers, relabelers, and 

medical gas repackers, and

• assuring that 80 percent of plasma 

fractionator establishments remain in 

compliance with FDA requirements.

In its technical comments, FDA 

acknowledged that it did not meet statutory 

inspection levels for product manufacturers 

but stated that the agency is operating with 

limited resources and must focus those on 

inspections of facilities posting the greatest 

risk.

FDA established fiscal year 2003 goals to 

inspect

• 9 percent of foreign medical device 

manufacturers,

• 26 percent of registered domestic human 

drug manufacturers, repackers, relabelers, 

and medical gas repackers,

• 20 percent of domestic medical device 

manufacturers,

• mammography facilities to ensure that at 

least 97 percent of the facilities meet 

inspection standards, and

• 50 percent of blood banks, source plasma 

operations and biologics manufacturing 

establishments. 

FDA has eliminated its performance goals to 

assure that domestic drug, biologics, and 

medical device industries conform to FDA 

requirements. According to FDA, these 

goals are routinely being met by industry 

and are no longer needed. FDA did not 

establish a performance goal for the 

percentage of plasma fractionator 

establishments that should be in compliance 

with FDA requirements. According to FDA, 

it combined its performance goal for plasma 

fractionators with its goal to inspect 50 

percent of registered blood banks, source 

plasma operations, and biologics 

manufacturing establishments.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VIII

Observations on the Department of Health 

and Human Service’s Efforts to Address Its 

Major Management Challenges

Page 71 GAO-03-225 Status of Addressing Major Management Challenges

Enhance the economic independence 

and well-being of children and families: 

Our report identified two management 

challenges in this area. First, changes in 

social support programs due to welfare 

reform have heightened the importance of 

HHS, its component agencies, and partners, 

such as states, having adequate information 

systems in place to manage programs and 

provide data to determine the effectiveness 

and efficiency of program approaches. 

Second, with major programs for low-income 

children and families in the hands of so 

many state and local agencies, HHS and its 

component agencies face the challenge of 

holding its partners accountable for their use 

of funds to ensure the well-being of children 

and families. 

As in past years, ACF reported that it lacked 

fiscal year 2001 performance data for most 

measures linked to reaching this key 

outcome. ACF was unable to obtain these 

data due to the time lag in receiving and 

validating data reports from states, localities, 

and other program partners. Of the 35 

measures listed in the fiscal year 2001 

performance report related to the Temporary 

Assistance for Needy Families (TANF), Child 

Support Enforcement, Child Care, Social 

Services Block Grant (SSBG), Refugee 

Resettlement, and Developmental 

Disabilities programs, data on only two 

performance measures related to the 

Developmental Disabilities programs were 

available for fiscal year 2001.

Performance data were available on 20 of 

the 24 measures used to assess progress 

for fiscal year 2000. ACF reported that it 

achieved or exceeded its targets for 5 of the 

20 measures for which data were available 

for fiscal year 2000, and did not meet its 

performance targets for 15 of the 20 

measures. Specifically, ACF reported that it 

met three of its targets related to its 

Developmental Disabilities programs and 

one target associated with its Child Support 

Enforcement program, increasing the 

number of paying child support cases. ACF 

reported that it also met one target related to 

TANF; in fiscal year 2000 all states met the 

TANF work participation rates for families. 

As we reported last year, some target 

performance levels may be set beyond what 

ACF can reasonably hope to achieve. For 

example, the employment retention and 

earnings gains rates under TANF and the 

employment-related performance measures 

for the refugee resettlement program have 

ambitious targets that may not be met in 

fiscal year 2002 or in fiscal year 2003.

With regard to its information technology 

performance, the ACF fiscal year 2001 

performance report noted that the agency 

replaced its audit resolution tracking process 

The first strategic goal in ACF’s plan—to 

“increase economic independence and 

productivity for families”—corresponds most 

closely to this management challenge. The 

ACF goal has the following four objectives:

• increase employment,

• increase independent living,

• increase parental responsibility, and

• increase affordable child care.

Each objective has a number of related 

performance measures associated with 

specific programs.

In addition, to improve program 

effectiveness and assist states in reaching 

desired outcomes, ACF plans to continue to 

support training and technical assistance, 

share best practices, and sponsor research.

The ACF performance plan for fiscal year 

2003 briefly discusses strategies to 

eliminate time delays in reporting data 

where appropriate for the TANF, 

Developmental Disabilities, Refugee 

Resettlement, SSBG, Child Support 

Enforcement, and Child Care programs. 

These strategies include training, technical 

assistance, and additional communication 

with program partners. However, the plan 

does not include any goals or indicators 

related to these strategies.

CMS reports setting goals for fiscal year 

2003 that partly address this management 

challenge. As part of a new goal for fiscal 

year 2003, CMS plans to begin working with 

states on the Performance Measurement 

Partnership Project. The purpose of this 

project is to use performance measures to 

improve the delivery and quality of health 

care for Medicaid and State Children’s 

Health Insurance Program populations.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix VIII

Observations on the Department of Health 

and Human Service’s Efforts to Address Its 

Major Management Challenges

Page 72 GAO-03-225 Status of Addressing Major Management Challenges

in August 2000. Enhancements to the 

system were planned for 2001. The report 

did not discuss any efforts to work with 

states and grantees to improve information 

systems nor any progress made in 

developing a plan to reduce delays in 

receiving state administrative data. Finally, 

although we recommended that ACF work 

with other federal agencies to address 

issues surrounding state automated data 

systems, the report did not include 

information on progress made in this area. 

In fiscal year 2001, CMS reported taking 

some steps to address each of the 

management challenges we outlined. In the 

area of information systems, CMS met its 

target to provide 56 states and territories 

with linked Medicare and Medicaid data files 

for dually eligible beneficiaries. This allowed 

states to have Medicare utilization data and 

link it with their Medicaid files. In the area of 

program effectiveness and accountability, 

CMS worked with states to develop a 

methodology, baselines, and performance 

measures for state- specific immunization 

rates of 2-year-old children enrolled in 

Medicaid. However, CMS’s progress in 

addressing this accountability challenge was 

limited to one specific aspect of its program, 

rather than the Medicaid program as a 

whole.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 73 GAO-03-225 Status of Addressing Major Management Challenges

Appendix IX

Observations on the Department of Housing 

and Urban Development’s Efforts to Address 

Its Major Management Challenges ApendxiIX

The following table identifies the major management challenges 

confronting the Department of Housing and Urban Development (HUD),

including the governmentwide high-risk areas of strategic human capital 

management and information security. The first column lists the 

challenges identified by our office. The second column discusses what 

progress, as discussed in its fiscal year 2001 performance report, HUD

made in resolving its challenges. The third column discusses the extent to 

which HUD’s fiscal year 2003 performance plan includes performance 

goals and measures to address the challenges that we identified. We found 

that HUD’s performance report discusses actions the agency has taken to 

address all of the management challenges we identified in January of 2001. 

In its performance plan, HUD reported that it fully focused on resolving the 

remaining high-risk issues and management challenges. The agency’s 

performance plan had goals and measures that were directly related to all 

five of the challenges. 
Appendix IX

Observations on the Department of Housing 

and Urban Development’s Efforts to Address 

Its Major Management Challenges

Page 74 GAO-03-225 Status of Addressing Major Management Challenges

Table 10: Major Management Challenges for HUD

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management:

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures.

As we reported in July 2002, human capital 

management is the most pressing 

crosscutting management challenge facing 

HUD. The need for HUD to recruit and hire 

is exacerbated by the upcoming wave of 

potential retirements that HUD faces. More 

than half of HUD’s professional workforce 

(staff in grades GS 9 through 15) will be 

eligible to retire by August 2003. HUD has 

done little outside hiring in the past decade. 

The performance report discusses steps 

HUD is taking to improve its human capital 

management under the strategic goal to 

“ensure public trust.” Most significantly, the 

report states that HUD adopted and 

implemented a Resource Estimation and 

Allocation Process (REAP) by December 

2001 and started secession planning 

through development of an intern program. 

HUD has also developed new appraisal 

standards for senior executives, managers, 

and supervisors. The report also discusses 

HUD’s organizational realignment that, 

among other things, was intended to reduce 

reporting layers and increase program 

oversight and accountability. However, HUD 

has not achieved the targets set for the 

specific performance measures that relate 

to its human capital activities. The report 

states that HUD plans to use a survey to 

measure its process toward achieving a 

workforce that is empowered, capable, and 

focused on results, but the survey results will 

not be available until next year. HUD also 

has not met its objectives to increase the 

number of Hispanics and white women in 

the department which was part of its 

measure to increase the representation of 

underrepresented groups. We have 

reported that HUD needs to develop a 

comprehensive human capital strategy to 

address this management challenge.

The performance plan includes five 

measures directly related to HUD’s human 

capital activities: 

• The REAP will be fully implemented and 

will establish a baseline for managing 

resource requirements and prioritizing 

staffing allocations by program and office.

• HUD will continue implementing its 5-year 

plan to reduce the number of managers 

and supervisors and organizational layers.

• HUD will pursue training and development 

and recruitment strategies designed to 

ensure that critical positions are filled.

• HUD will increase the representation of 

underrepresented groups by 0.3 percent.

• HUD employees will become more 

satisfied with the department’s 

performance and work environment.
Appendix IX

Observations on the Department of Housing 

and Urban Development’s Efforts to Address 

Its Major Management Challenges

Page 75 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show that federal computer 

systems are riddled with weaknesses that 

make them highly vulnerable to computerbased attacks and place a broad range of 

critical operations and assets at risk of 

fraud, misuse, and disruption. Further, the 

events of September 11, 2001, underscored 

the need to protect America’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both. We have reported since 1994 on open 

recommendations on computer security at 

HUD. 

HUD reports highlights major 

accomplishments during 2001, including 

identifying all major application and general 

support systems, developing security plans 

for these systems, identifying all sensitive 

and critical applications systems for critical 

infrastructure protection, implementing 

access control software, and initiating the 

planning and development of an entitywide 

security awareness and training program. 

Ongoing initiatives include developing 

security policies and procedures, assigning 

security responsibilities to appropriate 

personnel, requiring completion of 

background investigations for individuals 

who have access to HUD’s critical and 

sensitive systems, and reporting and 

correcting unauthorized penetration attempt 

incidents. HUD also identifies improvements 

and planned actions to correct long-reported 

control weaknesses in its procedures for 

managing and controlling changes to work 

products and systems’ hardware and 

software (configuration management). 

Office of Inspector General (OIG) reports 

recognize some improvements in HUD 

information security, but emphasize that 

HUD has still not placed adequate emphasis 

on information security. In its evaluation of 

HUD’s security program and practices 

required by the Government Information 

Security Reform Act (GISRA), the OIG 

reported that HUD’s information security 

program lacks executive-level leadership 

and direction, with weaknesses identified in 

many important aspects of HUD’s 

information security program, including the 

lack of a risk management program to 

assess and mitigate risk, system security 

plans not updated and completed, and 

inadequate computer access controls. Also, 

in its audit of HUD’s financial statements for 

fiscal years 2001 and 2000, the OIG 

reported that while HUD actions had 

significantly strengthened general controls 

for the UNISYS mainframe-computing 

environment, controls for HUD’s computing 

To address information security, the 

performance plan includes a measure that 

identifies five milestones to be completed 

during fiscal year 2003. HUD will

• prepare its annual GISRA report;

• verify its list of sensitive systems;

• complete a review of access rights to 

sensitive data and systems to identify 

individuals who need background 

investigations;

• conduct an external penetration test; and 

• provide enterprise security awareness 

training to all employees in all four critical 

infrastructure protection areas—data, 

people, facilities, and systems. 

However, these measures may not 

specifically assess the effectiveness of 

information security and the agency’s 

progress in implementing corrective actions. 

In addition to the Government Performance 

and Results Act reporting, the Office of 

Management and Budget’s guidance for 

fiscal year 2002 reporting under GISRA 

requires specific information security 

performance measures as well as corrective 

action plans with quarterly status updates. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix IX

Observations on the Department of Housing 

and Urban Development’s Efforts to Address 

Its Major Management Challenges

Page 76 GAO-03-225 Status of Addressing Major Management Challenges

environment were a reportable condition 

with improvements needed in configuration 

management, network access controls, and 

physical access. It also reported personnel 

security as a reportable condition with 

weaknesses including a continued backlog 

in obtaining background investigations for 

users granted access to HUD’s critical and 

sensitive systems. Corrective actions for 

these weaknesses did not address physical 

security weaknesses at two of its computer 

facilities, such as the lack of barriers around 

the building and magnetometer and X-ray 

screening of incoming personnel. HUD 

reported that the cost and practicality of 

changing the facilities outweighed any 

advantages and also that it is recompeting 

the contract that provides the computing 

services at these facilities.

GAO-designated major management 

challenges

Continued improvements needed to 

reduce HUD’s single-family mortgage 

insurance risk: To reduce financial risks, 

HUD’s Federal Housing Administration 

(FHA) needs to continue to improve its 

management over home mortgage loans 

made by private lenders that it insures 

against nearly all losses. While FHA has 

accumulated capital reserves of about $16.6 

billion on insured home loans valued at 

about $454 billion, we estimate that FHA lost 

about $1.9 billion during fiscal year 2000 on 

the sale of foreclosed loans that it had 

insured. We reported that HUD has 

opportunities to strengthen FHA’s 

management and internal controls that 

include strengthening the loan origination 

process; promoting better monitoring of 

lenders, appraisers, and property 

management and marketing contractors; 

and ensuring that sufficient staff with the 

right skills are available to carry out FHA’s 

home loan mission.

HUD reports that it has a number of 

initiatives in process or under development 

to improve oversight of its single-family 

programs, including enhancing qualifications 

for lender participation, implementation of 

an accelerated claims demonstration as an 

alternative to traditional note servicing and 

property disposition activity, and several 

proposed rules on appraisers, excessive 

fees, and property flipping. The report 

includes three measures related to its efforts 

to reduce single-family mortgage insurance 

risk, and HUD met or exceeded its goals for 

all three. HUD increased the share of FHA 

mortgage defaults resolved by loss 

mitigation by 12 percentage points, 

exceeding its goal by 10 percentage points. 

The FHA Mutual Mortgage Insurance Fund 

exceeded congressionally mandated capital 

reserve targets. HUD reports it also 

achieved a net recovery of FHA real estate 

owned sales of 65.5 percent, 4 percentage 

points above fiscal year 2000, exceeding the 

goal to increase recovery by 1 percentage 

point. 

The plan includes nine performance 

measures related to HUD’s single-family 

programs, four of which are directly related 

to issues that GAO has raised about the 

need to improve the control environment in 

HUD’s single-family mortgage insurance 

programs. The plan includes three new 

measures for 2003:

• By the end of fiscal year 2003, FHA will 

prevent the issuance of FHA mortgage 

insurance on properties that have been 

transferred within 6 months.

• FHA will exceed the rate of net recovery 

received on the sale of property through 

the Accelerated Claim Program 

Demonstration (Section 601).

• HUD will implement procedures to hold 

lenders accountable for the selection and 

performance of FHA-insured mortgages.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix IX

Observations on the Department of Housing 

and Urban Development’s Efforts to Address 

Its Major Management Challenges

Page 77 GAO-03-225 Status of Addressing Major Management Challenges

Continued improvements needed to 

ensure that HUD’s rental housing

assistance programs are used effectively 

and efficiently: Because HUD is able to 

serve fewer than half of the households that 

are eligible for assisted housing, it is 

essential that it ensure that its programs are 

used efficiently and effectively to maximize 

the number of households that can be 

assisted. Significant opportunities still exist 

to reduce excess subsidy payments, 

estimated to total over $5 billion for the last 5 

years, by ensuring that only eligible families 

occupy units and that they pay the correct 

rents; ensure that providers of rental 

housing maintain housing that is decent, 

safe, sanitary, and in good condition; and be 

certain that HUD has the capital resources 

and controls needed to detect and address 

problems that exist in its rental housing 

assistance programs.

The plan describes HUD’s strategy for 

resolving inaccurate subsidies using the 

Rental Housing Integrity Improvement 

Project (RHIIP), established in 2001. RHIIP 

was developed to resolve the management 

control weaknesses in HUD’s rental 

assistance programs by focusing on frontend controls (at the time beneficiaries apply 

for housing subsidies) to address the root 

cause of error and improper payments. HUD 

reports success in improving the physical 

conditions of HUD-supported public and 

assisted housing projects, as reflected in the 

percentage of projects or units that met 

HUD’s physical condition standards. The 

report includes 16 measures (1 of which 

was used under two goals) that directly 

relate to the issues associated with this 

management challenge—improving the 

quality of housing and ensuring that 

accurate subsidies are paid to eligible 

persons. HUD reported that it did not meet 

5 of the stated goals or that the data were 

not available; set baselines for two 

measures; and met 9 of the performance 

goals. 

The plan includes 24 measures on various 

aspects of ensuring that quality housing is 

provided to eligible households that pay the 

correct amount of rent. These measures 

include the following:

• The high incidence of program errors and 

improper payments in HUD’s rental 

assistance housing programs will be 

reduced.

• The unit-weighted average Public Housing 

Assessment System score increases by 5 

percent.

• The household-weighted average Section 

8 Management Assessment Program 

score increases.

• The share of public housing and assisted 

multifamily units that meet HUDestablished physical standards increases 

by 1.5 percentage points.

• The share of HUD-Assisted Properties 

observed with exigent health and safety or 

fire safety deficiencies decreases by 1.0 

percent for public housing and 0.6 

percentage points for assisted multifamily 

housing.

• As part of the effort to eliminate 100,000 

units of the worst public housing, demolish 

13,000 units during fiscal year 2003.

• The Departmental Enforcement Center will 

complete three enforcement milestones to 

improve management practices of 

multifamily housing partners and reduce 

fraud, waste, and abuse.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix IX

Observations on the Department of Housing 

and Urban Development’s Efforts to Address 

Its Major Management Challenges

Page 78 GAO-03-225 Status of Addressing Major Management Challenges

Resolution needed for programmatic and 

financial management information 

systems and human capital issues: HUD 

has determined that its financial 

management systems do not meet all of its 

needs and has plans under development to 

address this issue. We reported that HUD 

must continue to focus on improving its 

information technology management 

processes to help ensure success in 

systems initiatives across the department. 

HUD must also resolve a number of human 

capital issues, such as adjusting workload to 

consider implementation of the new centers, 

completing actions to measure workload, 

and staffing its programs adequately.

HUD reports considerable achievements in 

addressing its programmatic and financial 

management information systems 

management challenge. HUD has 

developed an Enterprise Architecture model 

that expands upon core elements included 

in the framework developed by the Federal 

Chief Information Officer Council, initiated a 

data quality improvement program, and 

addressed two of the Inspector General’s 

previous management concerns about the 

reliability and security of its financial 

systems and controls over fund balances 

with Treasury reconciliations. The report 

includes measures that address certain 

aspects of the systems management 

challenge and HUD reports that it achieved 

its targets for these measures. Under its 

performance measure to have data systems 

that are rated highly for usefulness and 

reliability, HUD reports it successfully 

completed a pilot project to develop a 

performance measurement methodology for 

its information systems. HUD reports that 

this effort resulted in establishing 

performance measures for the entire 

information technology (IT) portfolio. Under 

another measure to earn data quality 

certifications, HUD reports that two missioncritical data systems, which it reports are 

crucial to HUD’s financial management, 

earned data quality certifications. A third 

measure from the 2001 plan, that the Office 

of Housing would review a sample of 

transactions for compliance with data quality 

standards, is not reported in the 2001 

performance report. However, under the 

data quality certification measure, HUD 

states that it completed data quality 

assessments for seven mission-critical 

systems. It is not clear whether this refers to 

the third measure that is no longer included 

in the performance report.

As discussed under the governmentwide 

challenge, HUD reports it has made 

progress on addressing its human capital 

issues. Although it has not met its targets, 

HUD reports on two measures related to the 

The performance plan continues the 

emphasis on addressing these management 

challenges as part of HUD’s strategy to 

improve HUD’s management and internal 

controls, including strategies to train 

employees, improve equipment, and 

develop a long-term staffing strategy to deal 

with expected retirements. The plan 

includes 14 measures related to the 

programmatic and financial management 

information systems and human capital 

challenges. For example,

• FHA will address financial management 

and system deficiencies through the 

phased implementation of an integrated 

financial system to support FHA functions, 

which will be completed by December 

2006;

• the number of noncompliant financial 

management systems will be reduced from 

17 to 14;

• during fiscal year 2003, eight additional 

mission critical data systems will be 

certified, increasing the total number of 

certified systems to 15;

• REAP will be fully implemented and will 

establish a baseline for managing resource 

requirements and prioritizing staffing 

allocations by program and office;

• HUD will continue implementing its 5-year 

plan to reduce the number of managers 

and supervisors and organizational layers 

in the department; and

• HUD will pursue training and development 

and recruitment strategies designed to 

ensure that critical positions are filled.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix IX

Observations on the Department of Housing 

and Urban Development’s Efforts to Address 

Its Major Management Challenges

Page 79 GAO-03-225 Status of Addressing Major Management Challenges

human capital management challenge. 

HUD does not yet have results for one 

measure—whether HUD’s workforce is 

empowered—because the results of that 

measure will be determined from a survey 

that will be conducted in fiscal year 2002. 

HUD has not met its targets for increasing 

the representation of underrepresented 

groups, because it did not meet its 

objectives for increasing the number of 

Hispanics and white women in the 

department. While HUD did not achieve its 

specific performance measures, it reports 

that the final stages of REAP were 

completed in December 2001. The results 

were used to support the development of 

HUD’s fiscal year 2002 staffing plan and 

fiscal year 2003 staffing budget request. As 

part of ongoing efforts to improve its 

resource allocation activities, HUD reports it 

will validate the results of the REAP during 

2002 using the Total Estimation and 

Allocation Mechanism.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 80 GAO-03-225 Status of Addressing Major Management Challenges

Appendix X

Observations on the Department of the 

Interior’s Efforts to Address Its Major 

Management Challenges ApendxiX

The following table identifies the major management challenges 

confronting the Department of the Interior, including the governmentwide 

high-risk areas of strategic human capital management and information 

security. The first column lists the challenges identified by our office. The 

second column discusses what progress, as discussed in its fiscal year 2001 

performance report, Interior made in resolving its challenges. The third 

column discusses the extent to which Interior’s fiscal year 2003 

performance plan includes performance goals and measures to address the 

challenges that we identified. 

We found that the Department of the Interior’s performance report 

discussed the agency’s progress in resolving all of its challenges. Of the 

agency’s four major management challenges, its performance plan had

1. goals and measures that were directly related to two of the challenges

• improve management of national parks and

• improve management of ecosystem restoration efforts

2. no goals and measures related to two of the challenges, but discussed 

strategies to address the challenges, which were

• address persistent management problems in Indian trust programs and

• address challenges in managing an expanding land base.
Appendix X

Observations on the Department of the 

Interior’s Efforts to Address Its Major 

Management Challenges

Page 81 GAO-03-225 Status of Addressing Major Management Challenges

Table 11: Major Management Challenges for Interior

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

 Strategic human capital management: 

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures.

In September 2002, Interior issued its 5-year 

Strategic Human Capital Management Plan 

for fiscal years 2003 through 2007. The plan 

identified technical skill gaps in nine areas, 

including three areas that are receiving 

special attention due to their extreme 

urgency and importance—Indian trust fund 

management, wildland fire management, 

and law enforcement and security.

Interior achieved its goal of completing the 

departmentwide Workforce Planning Policy. 

In fiscal year 2001, Interior’s Office of 

Personnel Policy led the development of the 

department’s first workforce analysis, which 

was submitted to the Office of Management 

and Budget (OMB) on June 30, 2001. The 

workforce analysis addressed numerous 

strategic human capital management issues 

facing the department over the next 5 years. 

The Office of Personnel Policy also 

completed the development of the 

departmentwide Workforce Planning Policy. 

The policy was completed in early 

September; however, events on September 

11, 2001, delayed the actual policy issuance 

until October 30, 2001.

The departmental Workforce Planning 

Policy requires that all bureaus develop 

comprehensive 5-year workforce plans by 

the end of fiscal year 2003 to support the 

President’s Management Agenda, the 

department’s Strategic Plan, and future 

budget submissions. The plans will address 

all areas of strategic human capital 

management and will include information on 

critical mission skills and competencies; 

retirement and attrition projections; 

workforce shaping requirements; and 

budgetary projections on required 

recruitment, intern, retention, training and 

development, and relocation programs.
Appendix X

Observations on the Department of the 

Interior’s Efforts to Address Its Major 

Management Challenges

Page 82 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show that federal computer 

systems are riddled with weaknesses that 

make them highly vulnerable to computerbased attacks and place a broad range of 

critical operations and assets at risk of 

fraud, misuse, and disruption. Further, the 

events of September 11, 2001, underscored 

the need to protect America’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both.

Interior continues to report information 

security controls as a material weakness on 

its Federal Managers’ Financial Integrity Act 

report for 2001. To improve its information 

security program, Interior achieved its goal 

of completing a National Critical Information 

Technology Infrastructure Protection Plan. 

The plan was completed and implemented 

in September 2001. Interior also reported 

that it met its goal of achieving compliance 

level 1 on the Federal Information 

Technology Security Assessment 

Framework for all of its national critical 

infrastructure systems, all of its national 

security information systems, and all of its 

mission-critical systems. Achieving level 1 

compliance requires establishing 

documented security policies and 

standards. 

Interior’s fiscal year 2003 performance plan 

includes a goal to achieve compliance level 

3 on the Federal Information Technology 

Security Assessment Framework for all of its 

national critical infrastructure systems, all of 

its national security information systems, 

and all of its mission-critical systems. 

Achieving level 3 compliance requires that 

security policies and procedures are 

adopted, system certification procedures 

are established, and a security awareness 

program is in place. Interior’s overall target 

is to achieve compliance level 5 by fiscal 

year 2005, the highest level achievable in 

this assessment framework. To meet the 

compliance requirement for this level, an 

agency must establish an enterprisewide 

security program.

In addition to Government Performance and 

Results Act reporting, the Office of 

Management and Budget’s guidance for 

fiscal year 2002 reporting under the 

Government Information Security Reform 

Act (GISRA) requires specific performance 

measures, as well as corrective action plans 

with quarterly status updates. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix X

Observations on the Department of the 

Interior’s Efforts to Address Its Major 

Management Challenges

Page 83 GAO-03-225 Status of Addressing Major Management Challenges

GAO-designated major management 

challenge

Improve management of national parks: 

The National Park Service needs to (1) 

place a higher priority on gathering more 

scientific information on the condition of 

natural resources, (2) gather more accurate 

data on its maintenance backlog, (3) 

improve park managers’ accountability, (4) 

address management problems with its 

concessions program, and (5) ensure the 

safety of park visitors and employees.

The Park Service reported meeting its goal 

of developing or acquiring 30.4 percent of 

the 2,527 data sets needed for natural 

resource inventories for all parks. In 

addition, the agency reported exceeding its 

goal of having 5 percent of the 270 parks 

with significant natural resources identify 

their vital signs for natural resources 

monitoring—13 percent of the parks 

accomplished this in fiscal year 2001. 

The Park Service reported that it is 

developing the capability to determine and 

monitor the physical condition of its facilities. 

It plans to use facility condition as a 

performance indicator beginning in 2003. 

The Park Service did not have a fiscal year 

2001 goal for this activity, thus there was no 

associated performance to report. 

The Park Service no longer reports on this 

specific issue since it no longer has a 

specific goal linked to this challenge. 

Instead the agency states that it will use 

goal achievement as an element of park 

managers’ performance evaluations. 

The Park Service reported meeting its goal 

of having concession contracts average a 

7.3 percent return to the government for 

fiscal year 2001. The agency does not 

have specific goals related to concessions 

management issues. 

The Park Service reported exceeding its 

goal to reduce visitor accidents to 8.72 per 

100,000 visitor days. Actual visitor 

accidents for fiscal year 2001 were 8.64 per 

100,000 visitor days. In addition, the agency 

reported exceeding its goal of reducing the 

employee lost time injury rate in 2001—its 

goal was 4.67 per 200,000 hours worked; it 

achieved a rate of 3.67 per 200,000 hours 

worked. 

The Park Service plans to develop or 

acquire 59.3 percent of its 2,527 data sets 

needed for natural resource inventories in 

fiscal year 2003. In addition, the agency 

plans to identify vital signs for 40 percent of 

the 270 parks by the end of fiscal year 2003. 

By the end of fiscal year 2003, the Park 

Service’s goal is to deploy a new facility 

management software system at each park 

and to complete the initial annual facility 

condition assessments at all parks. 

According to the Park Service’s fiscal year 

2003 performance plan, all seven regions in 

the Park Service are using goal 

achievement as an element in park 

managers’ performance evaluations. Full 

implementation of accountability will improve 

the Park Service’s ability to achieve all of its 

goals. 

The Park Service revised its goal for 

concessions contracts for fiscal year 2003. 

Essentially, it redefined how the rate of 

return to the government is calculated. This 

change led to changing the performance 

goal from 7.3 percent of gross concessioner 

revenue to 4 percent. There are no specific 

goals related to concessions management 

issues. 

The Park Service’s goal is to continue to 

improve visitor and employee safety, 

lowering the visitor incident/accident rate to 

8.29 per 100,000 visitor days, and the 

employee lost time injury rate to 3.312 per 

200,000 hours worked.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix X

Observations on the Department of the 

Interior’s Efforts to Address Its Major 

Management Challenges

Page 84 GAO-03-225 Status of Addressing Major Management Challenges

Address persistent management 

problems in Indian trust programs: 

Interior needs to ensure that Indian trust 

assets are well managed. Interior cannot do 

this currently, although it is updating its trust 

fund management systems.

Interior reported that the Office of the 

Special Trustee did not achieve its goal of 

completing 64 milestones of the 11 

subprojects in the High-Level 

Implementation Plan. Only 47 milestones 

were reported completed. The Office was 

created in fiscal year 1996 specifically to 

reform Interior’s Indian trust management. 

Reform plans, consisting of 11 subprojects 

to improve trust management, are contained 

in the High Level Implementation Plan, 

which was updated in February 2000. The 

Office is currently deeply involved in 

responding to court orders relating to a 

class-action lawsuit over trust fund 

management and reports quarterly to the 

court. The Office did not prepare a separate 

fiscal year 2001 performance report. The 

goal to complete 64 milestones was in 

Interior’s fiscal year 2001 overview plan.

The Office did not prepare a separate fiscal 

year 2003 plan. In addition, Interior’s fiscal 

year 2003 overview plan does not have any 

annual performance goals on Indian trust 

fund reform. 

In January 2002, in Interior’s eighth 

quarterly report to the court, the Secretary 

of the Interior announced that the HighLevel Implementation Plan, which has 

guided trust reform activities since 1998, 

was obsolete. The Secretary concluded that 

the plan did not reflect an adequately 

coordinated and comprehensive view of the 

trust reform process. Fiscal year 2002 was 

the beginning of a transition from a narrow, 

nonintegrated, task-oriented set of activities 

related to trust reform, to an integrated, 

goal-focused approach to managing and 

accounting for Indian trust assets. Interior’s 

senior management team will coordinate the 

development of a new management 

strategic plan to replace the High Level 

Implementation Plan.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix X

Observations on the Department of the 

Interior’s Efforts to Address Its Major 

Management Challenges

Page 85 GAO-03-225 Status of Addressing Major Management Challenges

Improve management of ecosystem 

restoration efforts: Interior needs to 

improve its management of ecosystem 

restoration efforts by working to develop 

plans and strategies; coordinating with the 

multiple entities involved, such as states and 

tribes; and preparing for the attrition of key 

personnel related to ecosystem restoration 

efforts, such as fire managers.

Interior has a departmentwide long-term 

goal of maintaining healthy natural systems. 

As part of this long-term goal, Interior has 

annual performance goals dealing with the 

South Florida Ecosystem Restoration 

Program, the California Desert Project, and 

wildland fire management. 

Interior reported that it did not have a fiscal 

year 2001 performance target for the South 

Florida ecosystem restoration effort. 

However, Interior and its partners in the 

South Florida ecosystem restoration effort 

constructed 18,088 acres of stormwater 

treatment areas and acquired 28,917 acres 

of land for habitat protection. 

Interior and its partners in the California 

Desert Project—which seeks to restore the 

population of the federally listed desert 

tortoise—reported meeting their goals of 

developing protocols for identifying and 

counting tortoises and assessing 

populations in five recovery units. 

With regard to wildland fires, Interior 

reported that it did not meet its goal of 

treating 1.4 million acres (it treated 728,000 

acres). According to Interior’s report, 

several factors contributed to the lower than 

anticipated fuel treatment levels. For 

example, drought conditions in many parts 

of the country forced agencies to postpone 

treatments or to accomplish treatment by 

more costly means (mechanical and 

chemical treatments), rather than by 

prescribed methods.

Interior has a departmentwide long-term 

goal of maintaining healthy natural systems. 

As part of this long-term goal, Interior has 

annual performance goals dealing with the 

South Florida Ecosystem Restoration 

Program, the California Desert Project, and 

wildland fire management. 

For fiscal year 2003, Interior and its partners 

in the South Florida ecosystem restoration 

effort plan to build 4,100 acres of 

stormwater treatment areas for a total of 

28,438 acres constructed. They also plan to 

acquire 40,000 acres of land for habitat 

protection purposes. 

For the California Desert Project, Interior 

and its partners plan to remove 1,000 wild 

burros from tortoise habitats, clean up five 

illegal dumps on public lands, and install 40 

miles of fence along highways to prevent 

tortoises from being hit on these roads. 

With regard to wildland fires, Interior plans 

to contain 95 percent of fires in the initial 

attack, provide assistance to 33 percent, or 

1,085, rural fire departments to improve 

safety, training, and equipment standards; 

complete 9 percent of the highest priority 

community-at-risk projects; build or improve 

15 fire facilities; and treat 1.1 million acres of 

land with accumulated fuels. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix X

Observations on the Department of the 

Interior’s Efforts to Address Its Major 

Management Challenges

Page 86 GAO-03-225 Status of Addressing Major Management Challenges

Address challenges in managing an 

expanding land base: Interior oversees 

many land transactions. In particular, the 

Bureau of Land Management (BLM) needs 

to ensure that the lands are needed and are 

exchanged for approximately equal value. 

Once Interior gets new land, either through 

exchange or acquisition, it needs to highlight 

the need for increased funding to operate 

and maintain those lands. In particular, the 

Fish and Wildlife Service (FWS) needs to 

include operations and maintenance 

information in its budgets when it 

establishes refuges.

Interior did not have any departmentwide 

performance goals or measures, and BLM 

did not have any performance goals or 

measures, applicable to this challenge for 

fiscal year 2001. However, BLM’s fiscal year 

2001 performance report did discuss how 

the agency had addressed this challenge. 

According to the report, BLM has 

incorporated new requirements into its 

Appraisal Manual for improving the appraisal 

process for land exchanges, developed 

appraisal training, and revised its Land 

Exchange Handbook to incorporate revised 

policies and guidance to ensure that land 

exchanges are in the public interest. 

Furthermore, the report indicates that the 

National Land Exchange Evaluation and 

Assistance Team continues to conduct 

technical review and oversight for all land 

exchange feasibility reports and decision 

documents. 

Interior did not have any departmentwide 

performance goals or measures, and FWS 

did not have any performance goals or 

measures, related to reporting operations 

and maintenance funding needs for fiscal 

year 2001. However, FWS’s fiscal year 

2001 performance report did discuss how 

the agency had addressed this challenge. 

According to the report, beginning in fiscal 

year 2001, FWS included in its budget a 

table of land that will be added during the 

year, including the operation and 

maintenance costs needed.

Interior’s fiscal year 2003 overview plan and 

BLM’s fiscal year 2003 plan do not have any 

goals or measures related to this challenge. 

According to BLM’s fiscal year 2003 plan, 

the necessary actions to address this 

challenge have been completed.

Interior does not address the need for 

operations and maintenance fund 

information in its fiscal year 2003 plan. FWS 

does not have a goal to address this, but 

plans to maintain an inventory of unmet 

operating needs and to request funding for 

them.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 87 GAO-03-225 Status of Addressing Major Management Challenges

Appendix XI

Observations on the Department of Justice’s 

Efforts to Address Its Major Management 

Challenges ApendxiXI

The following table identifies the major management challenges 

confronting the Department of Justice’s (Justice) including the 

governmentwide high-risk areas of strategic human capital management 

and information security. The first column lists the challenges identified by 

our office. The second column discusses what progress, as discussed in its 

fiscal year 2001 performance report, Justice made in resolving its 

challenges. The third column discusses the extent to which Justice’s fiscal 

year 2003 performance plan includes performance goals and measures to 

address the challenges that we identified. We found that Justice’s 

performance report discussed the agency’s progress in resolving many its 

challenges, but it did not discuss the agency’s progress in resolving the 

following challenges, including

• Asset Forfeiture Program, 

• program management weaknesses remain in Weed and Seed Program,

• internal control weaknesses at the Drug Enforcement Administration 

(DEA), and 

• efforts to reduce unauthorized employment face impediments.

Of the agency’s 14 major management challenges, its performance plan had

1. goals and measures that were directly related to 9 of the challenges

2. goals and measures that were indirectly applicable to the 1 of the 

challenges, including

• strategic human capital management and

3. no goals, measures or strategies to address four of the challenges, 

including

• Asset Forfeiture Program,

• program management weaknesses remain in Weed and Seed Program,

• internal control weaknesses at DEA, and

• efforts to reduce unauthorized employment face impediments. 
Appendix XI

Observations on the Department of Justice’s 

Efforts to Address Its Major Management 

Challenges

Page 88 GAO-03-225 Status of Addressing Major Management Challenges

A Justice official stated that it did not address these challenges because 

Justice believes that those challenges are no longer significant enough to 

be addressed in their performance report or plan.

Table 12: Major Management Challenges for Justice

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management:

GAO has identified shortcomings at 

multiple agencies involving key elements of 

modern human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose 

size, skills, and deployment meet agency 

needs; and creating results-oriented 

organizational cultures.

Justice’s performance report did not 

specifically address its progress toward 

resolving this management challenge. 

However, it had one performance measure 

that addressed part of this challenge—the 

number of border patrol agents on board at 

the Immigration and Naturalization Service 

(INS). For fiscal year 2001, the performance 

target was 9,807 border patrol agents on 

board and the actual number was 9,859 

agents.

Justice’s 2001 performance report states 

that Justice has given priority attention to the 

recruitment of border patrol agents and that 

it has been quite successful. Further, the 

report states that INS will continue 

improvements in this area through the 

implementation of the following five 

initiatives: (1) increase the Internet recruiting 

system that involves 12 sites, (2) establish 

overseas testing involving military bases 

around the world, (3) develop the capacity to 

conduct walk-in testing or mobile testing, (4) 

revise the compressed testing process to 

allow on-site drug testing, and (5) initiate an 

integrity interview and full field investigation 

prior to the oral board. Justice believes that 

valuable staff hours and resources will be 

saved by utilizing the Internet and walk-in 

testing.

Justice’s performance report does not 

discuss how it is addressing this challenge 

for any of its other agencies

Relative to this management challenge, 

Justice’s 2003 performance plan has a 

performance target of 10,974 border patrol 

agents on board for fiscal year 2003.

Justice’s 2003 performance plan also states 

that the ability of INS to hire up to the full 

complement of border patrol agents (and 

other occupations) that are authorized and 

funded by Congress means that the mission 

of INS can expand as intended. INS projects 

that new border patrol agents will be 

deployed in key operational zones along the 

southwest border and at northern border 

sites. The National Hiring Center (NHC) will 

continue as the centralized processing facility 

for entry-level hiring for border patrol agents. 

NHC assumes full responsibility for the 

Border Patrol Registry, oral board scheduling, 

preappointment processing, entry-on-duty 

and attendance at the Border Patrol 

Academy, and the Border Patrol 

Reinstatement Program.

Justice’s performance plan does not have any 

goals, measures, or strategies for addressing 

this challenge within its other departments.
Appendix XI

Observations on the Department of Justice’s 

Efforts to Address Its Major Management 

Challenges

Page 89 GAO-03-225 Status of Addressing Major Management Challenges

Information security:

Our January 2001 high-risk update noted 

that agencies’ and governmentwide efforts 

to strengthen information security have 

gained momentum and expanded. 

Nevertheless, recent audits continue to 

show that federal computer systems are 

riddled with weaknesses that make them 

highly vulnerable to computer-based 

attacks and place a broad range of critical 

operations and assets at risk of fraud, 

misuse, and disruption. Further, the events 

of September 11, 2001, underscored the 

need to protect America’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both.

In Justice’s fiscal year 2001 financial audit, 

the department’s Office of Inspector General 

(OIG) reported information security 

weakness in access controls, segregation of 

duties, system and application software 

controls, service continuity, and entitywide 

security program management. Justice 

acknowledged that it has information 

security weaknesses and reported 

information system controls as a material 

weakness in its Federal Managers’ Financial 

Integrity Act report for 2001.

To improve the department’s information 

technology (IT) security program, Justice 

reported in its performance report that it 

issued a new security policy, continued to 

verify and accredit its key systems, and 

integrated IT security into its capital planning 

and investment controls process. Further, 

Justice reported that it will continue its 

program of penetration tests and 

independent assessments, develop 

remedial plans for identified vulnerabilities, 

and reevaluate and assess the department’s 

critical infrastructure and planning initiatives.

Justice’s 2001 performance report indicates 

that it did not meet its fiscal year 2001 

performance target of 100 percent for 

certifying and accrediting its information 

systems by department components. The 

department reported that the target was not 

met (83 percent certified and accredited) 

due to resource constraints in two bureaus.

Justice’s 2003 plan includes management 

performance goals, which focus on (1) 

meeting an ongoing requirement to certify 

department networks and systems and (2) 

testing major systems contingency plans. 

These goals are measured based on the 

percentage of information systems that are 

certified by the department components (100 

percent) and major systems with tested 

contingency plans (85 percent). 

While these measurements provide an 

indication of progress in these two areas, 

they may not specifically measure the 

effectiveness of information security and the 

agency’s progress in implementing corrective 

actions. NIST developed a security 

assessment framework and related tools that 

agencies can use in determining the status of 

their information security programs. Also, 

OMB guidance for fiscal year 2002 reporting 

under the Government Information Security 

Reform Act (GISRA) requires agencies to use 

tools developed by NIST for evaluating the 

security of unclassified systems or groups of 

systems. In addition, OMB’s GISRA 

reporting guidance requires specific 

performance measures, as well as corrective 

action plans with quarterly status updates.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Appendix XI

Observations on the Department of Justice’s 

Efforts to Address Its Major Management 

Challenges

Page 90 GAO-03-225 Status of Addressing Major Management Challenges

GAO-designated major management 

challenge

Asset Forfeiture Program:

Justice needs to address weaknesses in its 

asset forfeiture program, specifically, its 

management and accountability of seized 

and forfeited property.

GAO has designated Justice’s asset 

forfeiture program as high-risk since 1990 

because (1) over the years, neither Justice 

nor Treasury adequately focused on 

managing and accounting for seized and 

forfeited items and (2) Justice and Treasury 

had not formed a plan to consolidate 

postseizure administration of certain 

properties to eliminate duplication of 

resources and reduce administrative costs. 

In recent years, Justice has taken many 

actions to improve the management and 

disposition of seized and forfeited property. 

However, challenges remain to address the 

program’s inadequate information systems 

and financial management weaknesses, 

including accountability over seized assets.

Progress in resolving this management 

challenge was not discussed.

The 2003 performance plan had no goals, 

measures, or strategies directly related to this 

management challenge.

Program management weaknesses 

remain in the Weed and Seed Program:

While Justice has made some progress 

toward addressing administrative and 

management weaknesses, challenges 

remain related to developing better 

performance measures for the Weed and 

Seed program. We recommended that 

Justice’s Executive Office for Weed and 

Seed (EOWS) develop additional 

performance measures to track program 

outcomes, noting that indicators would help 

EOWS make more informed program 

decisions, such as whether to continue 

existing funding.

Progress in resolving this management 

challenge was not discussed.

The 2003 performance plan had no goals, 

measures, or strategies directly related to this 

management challenge. The fiscal year 2001 

performance report and 2003 performance 

plan merely state that EOWS helps 

communities build stronger, safer 

neighborhoods by implementing the Weed 

and Seed strategy, a community-based, 

multidisciplinary approach to combating 

crime.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Appendix XI

Observations on the Department of Justice’s 

Efforts to Address Its Major Management 

Challenges

Page 91 GAO-03-225 Status of Addressing Major Management Challenges

Police Corps program had a slower than 

expected start, due to funding and 

staffing limitations:

While Justice has made some progress 

toward addressing administrative and 

management weaknesses, challenges 

remain related to increasing states’ 

participation in the Police Corps program. 

We reported in February 2000 that the 

majority of participant slots for the Police 

Corps program, under the Community 

Oriented Policing Service (COPS), 

remained unfilled.a

Several states indicated that participation in 

the program and reasons for the program’s 

slow growth were related to the Police 

Corps statute (42 U.S.C. 14091-14119) not 

providing funding to pay states for program 

administration or for recruitment and 

selection of participants. We also reported 

that according to federal and state officials, 

a factor contributing to unfilled positions 

was that COPS dedicated insufficient staff 

to the program, which led to delays in 

providing program guidance, processing 

program applications and payments, and 

answering participants’ questions about the 

program.

In December 1998, the Police Corps 

program was transferred from COPS to the 

Office of Justice Programs (OJP). We 

reported that OJP had made significant 

progress in obligating funds and 

establishing interagency agreements with 

participating states and providing program 

guidance. However, at the time of our 

review, it was too soon to tell whether OJP 

would succeed in filling empty participant 

slots promptly.

The fiscal year 2001 performance report had 

two performance measures associated with 

this management challenge, both under the 

COPS initiative.

Regarding the Police Corps Program, 

Justice had a performance measure—the 

number of Police Corps graduates serving in 

1-year community patrols—in its fiscal year 

2000 performance report. But this measure 

was discontinued because of streamlining 

the departmental plan and was not 

specifically discussed in the context of 

achieving any of its goals. However, in its 

discussion of discontinued measures in an 

appendix, Justice’s performance report 

states that the fiscal year 2001 target was 

490 and the fiscal year 2001 actual was 470. 

The report also noted in the appendix that 

the fiscal year 2001 target was not met 

because the Office of Police Corps and Law 

Enforcement Education encouraged states 

to use a more selective recruitment process 

to reduce the number of resignations and 

removals.

Regarding COPS, Justice’s performance 

report had two performance measures—the 

number of new police officers funded and on 

the street and the number of school 

resource officers funded/hired. COPS fell 

short of the target for officers funded 

(targeted performance was 116,299 and 

actual performance was 114,124), and for 

number of officers on the street (targeted 

performance was 91,000 and actual 

performance was 83,024). However, COPS 

exceeded the number of school resource 

offices funded and hired. The targeted 

performance was 4,511 funded and 3,078 

hired while the actual performance was 

4,532 funded and 3,191 hired.

The 2003 performance plan has goals and 

measures directly applicable to the 

management challenge.

Justice’s performance plan had a 

performance target of 117,901 officers 

funded and 100,000 on the street. The plan 

also noted that the number of officers funded 

may be inflated, as discretion exist to use this 

additional funding for equipment as well as 

officers.

Justice reports that COPS grants have 

funded more than 114,000 officers in more 

than 12,400 police and sheriffs’ departments. 

According to Justice, independent studies 

have proven that the hiring initiatives resulted 

in significant reductions in local crime rates in 

cities with populations greater than 10,000. 

With over 90 percent of the U.S. population 

living in areas of this size, the COPS hiring 

and innovative grant programs appear to 

have had a significant crime-reducing effect 

on the vast majority of the United States.

Justice’s performance plan also states that 

OJP will continue to support existing grants 

and evaluate the effects of community 

policing on crime, fear of crime, and trust in 

law enforcement among its grantees. COPS 

will also continue to support the advancement 

of community policing through training and 

technical assistance, community policing 

innovation conferences, development and 

sharing of best practices through publications 

and Web sites, and pilot community policing 

programs. To meet critical law enforcement 

needs, the OJP will continue to work in 

partnership with law enforcement agencies to 

enhance police integrity.

While Justice’s performance plan indicated 

that school resource officers assist schools 

and communities in ensuring a safe 

environment for students and staff by acting 

as problem solvers and liaisons to the 

community, safety experts and law enforcers, 

and educators, there was no performance 

target set because the program was not 

funded for fiscal year 2003.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Appendix XI

Observations on the Department of Justice’s 

Efforts to Address Its Major Management 

Challenges

Page 92 GAO-03-225 Status of Addressing Major Management Challenges

Develop measurable DEA performance 

targets to determine progress in 

reducing the availability of illegal drugs:

Consistent with the Office of National Drug 

Control Policy strategy to reduce the supply 

of illegal drugs to our nation, one of 

Justice’s strategic objectives is to reduce 

the threat and trafficking of illegal drugs by 

identifying, disrupting, and dismantling drug 

trafficking organizations that are 

international, multijurisdictional, or have an 

identified local impact. Despite progress 

that DEA made in developing strategic 

goals and objectives and in enhancing its 

programs and initiatives, which are 

consistent with the National Drug Control 

Strategy, limitations in DEA’s performance 

measures make it difficult to determine its 

progress in reducing the availability of 

illegal drugs.

Justice’s performance report had two 

performance measures associated with this 

management challenge.

According to Justice’s performance report, a 

new performance measure, reduction in the 

supply of drugs entering the United States, 

is being established and will be baselined 

during fiscal year 2002. DEA, in conjunction 

with the Office of National Drug Control 

Policy and an interagency group, is 

developing national estimates for the 

amount of cocaine, heroin, 

methamphetamine, and marijuana available 

for consumption in the United States each 

year.

The second performance measure in 

Justice’s performance report was the 

number of priority drug trafficking 

organizations to be targeted and 

dismantled/disrupted. According to the 

report, the fiscal year 2001 performance 

target was 538 such organizations targeted 

and 27 dismantled/disrupted, a 5 percent 

reduction. The actual performance measure 

was reported as 632 organizations targeted 

and 66 dismantled/disrupted, a 10 percent 

reduction.

The 2003 performance plan has goals and 

measures directly related to this 

management challenge.

Justice’s performance plan has a fiscal year 

2003 performance target of 5 percent for the 

reduction of the supply of drugs entering the 

United States. According to the plan, a 

reduction in the availability of drugs entering 

the United States will strengthen our 

communities, improve our economy, and 

reduce violent crime and the profits of 

terrorist organizations.

The performance plan has a fiscal year 2003 

performance target of 7 percent reduction (45 

organizations) in the number of priority drug 

trafficking organizations to be 

dismantled/disrupted. According to the plan, 

as these organizations are disrupted and 

dismantled, America’s communities will 

become safer, due to less drug-related violent 

crime. The expected long-term benefit is that, 

as those arrested cooperate and identify their 

sources of supply, DEA will be able to identify, 

target, disrupt, and dismantle higher-level 

priority drug trafficking organizations (e.g., 

those operating out of Colombia and Mexico) 

that supply the drugs to the violent street 

trafficking organizations.

Internal control weaknesses at DEA:

Although DEA obtained an unqualified 

opinion on its fiscal year 1999 financial 

statements, the number of reported internal 

control weaknesses at DEA increased from 

fiscal year 1998 to 1999. These material 

weaknesses include, among other things, 

information system controls, the lack of a 

system to accurately and completely 

account for property and equipment, and a 

weak financial reporting process.

Progress in resolving this management 

challenge relative to DEA was not 

specifically addressed in Justice’s 

performance report. It was, however, 

covered indirectly under the departmentwide 

focus on financial statements and systems, 

which is discussed later in this table.

The 2003 performance plan had no goals, 

measures, or strategies to address this 

challenge. However, as previously noted, this 

management challenge is addressed 

indirectly under the departmentwide 

management challenge on financial 

statements and systems.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Appendix XI

Observations on the Department of Justice’s 

Efforts to Address Its Major Management 

Challenges

Page 93 GAO-03-225 Status of Addressing Major Management Challenges

INS’s organizational structure remains 

undecided:

Proposals to restructure INS have been 

issued as a result of several critics’ 

conclusion that “mission overload” has 

impeded INS from succeeding at either of 

its primary functions. To remedy problems 

identified, various entities and several 

members of Congress have proposed a 

wide range of reorganization options.

Justice’s performance report had a 

performance measure to streamline 

selected agencies and programs by 

delayering management levels. As this was 

a new initiative, there was no specific 

performance target set for this measure for 

fiscal year 2001.

The report also indicated that INS proposed 

reorganizing itself into two separate but 

connected bureaus, one to handle 

enforcement of immigration laws and one to 

provide services and benefits to immigrants. 

According to the report, this reorganization 

would address systemic problems related to 

INS’s dual missions of service and 

enforcement by creating two separate 

chains of command and accountability, 

reporting to a single policy leader. INS’s 

restructuring would also address the need to 

streamline the organization to emphasize 

frontline enforcement and service delivery 

functions.

Justice’s performance plan indicated that INS 

would begin implementing its reorganization 

in fiscal year 2002, continue implementation 

in fiscal year 2003, and complete the 

restructuring in fiscal year 2004.

Efforts to reduce unauthorized 

employment face impediments:

The effectiveness of the verification 

process has been undermined by aliens’ 

use of fraudulent documents. In addition, 

employers face little chance of being 

investigated by INS, in part because 

resources for worksite enforcement have 

been relatively small. Furthermore, INS 

issued an interior enforcement strategy that 

called for INS to pursue the criminal 

investigation of employers who are flagrant 

or grave violators. However, the strategy left 

unclear what was meant by a flagrant or 

grave violation, what criteria would be used 

for opening investigations of employers 

suspected of criminal activities, and how 

INS would measure the effectiveness of its 

strategy.

Specific progress in this area was not 

discussed. In its performance report under 

the discussion of efforts to reduce the 

number of illegal aliens, Justice limited its 

discussion to noting that the reduction in the 

illegal resident population reinforces 

immigration laws and reduces the supply of 

illegal aliens for unauthorized employment.

The 2003 performance plan had no goals, 

measures, or strategies to address this 

management challenge. Justice’s fiscal year 

2002 performance plan stated that the 

measure related to employer sanctions was a 

discontinued measure. However, under 

program evaluations for one of its strategic 

goals, Justice notes that Employment 

Verification Pilots, which were begun in fiscal 

year 1999 and include statistics and 

interpretation of the impact of the pilot in 

providing alien status verification services for 

employers, will be evaluated in fiscal years 

2002 and 2003. Moreover, one of the 

strategies listed under the strategic objective 

addressing criminal aliens is to block and 

remove employers’ access to undocumented 

workers and help reduce worker exploitation.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Appendix XI

Observations on the Department of Justice’s 

Efforts to Address Its Major Management 

Challenges

Page 94 GAO-03-225 Status of Addressing Major Management Challenges

Shortcomings in programs to control 

alien smuggling:

The country’s ability to combat the 

significant and growing problem of alien 

smuggling is hampered by management 

and operational problems at INS, such as 

fragmented and uncoordinated 

investigative efforts and lack of staff to 

perform intelligence functions.

Justice’s performance report had two 

performance measures associated with this 

management challenge.

The first performance measure was to 

identify, disrupt, and dismantle targeted 

alien smuggling and trafficking 

organizations. There was no specified 

performance target set for fiscal year 2001, 

but the performance report indicated that the 

actual numbers achieved were five such 

organizations identified, one disrupted, and 

one dismantled.

The second performance measure was the 

number of interceptions of mala fide and 

offshore travelers en route to the United 

States. The fiscal year 2001 performance 

target was 9,324 and the actual report 

number was 34,594. The report noted that 

INS overseas offices significantly exceeding 

their goal was due to a pilot in INS’s Mexico 

City office established in cooperation with 

the governments of Mexico and Guatemala, 

Operation Bus Bound. The pilot involved the 

interception and repatriation of Central 

American and third-country nationals.

The 2003 performance plan has goals, 

measures, and strategies to address this 

management challenge.

The performance target for the number of 

targeted alien smuggling and trafficking 

organizations identified, disrupted, and 

dismantled was three, zero, and zero 

respectively. According to Justice’s 

performance plan, zero targets were set for 

the number of organizations to be disrupted 

and dismantled as a result of the changes in 

enforcement priorities since the recent 

terrorist attacks.

The performance target for the number of 

interceptions of mala fide and offshore 

travelers en route to the United States was 

set at 20,000 for fiscal year 2003.

Financial statements and systems:

Achieve excellence in financial 

management, including, but not limited to, a 

departmentwide unqualified opinion for 

fiscal year 2000 and beyond.

Justice’s performance report had a 

performance measure associated with this 

management challenge.

Justice’s targets were to receive an 

unqualified opinion on all statements and to 

resolve one material weakness. According 

to the report, actual fiscal year 2001 

performance was an unqualified opinion on 

all statements, and three material 

weaknesses were corrected. The report 

also noted that Justice received its first fully 

unqualified audit opinion on all six of the 

financial statements for fiscal year 2001. 

Further, Federal Prison Industries corrected 

one material weakness and implemented 

improvements that resulted in two material 

weaknesses being reclassified as 

nonmaterial.

The 2003 performance plan has a goal and 

measure related to this management 

challenge.

Justice has set a goal to achieve a 

departmentwide, unqualified audit opinion on 

all statements and to resolve six material 

weaknesses. According to Justice’s 

performance plan, the department and its 

components will focus on continuing 

substantive progress in improving financial 

operations and financial systems. The Chief 

Financial Officer will continue to closely 

measure component progress in reducing 

internal control weaknesses and in making 

improvements to financial systems. To 

facilitate achievement of the department’s 

goal, a unified financial system will be 

implemented to replace three systems 

currently requiring replacement and replace 

the other systems when new systems are 

required.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Appendix XI

Observations on the Department of Justice’s 

Efforts to Address Its Major Management 

Challenges

Page 95 GAO-03-225 Status of Addressing Major Management Challenges

Information systems planning and 

implementation:

Justice’s mission-critical computer systems 

were poorly planned, experienced long 

delays in implementation, or did not provide 

timely, useful, and reliable data.

The performance report discussed Justice’s 

efforts to implement disciplined IT 

investment processes with the issuance of 

an IT investment management policy and 

guide in fiscal year 2001. Justice also 

reported revising its system development life 

cycle to align with the IT investment 

management process.

The report also noted INS’s continued move 

towards a strategic approach to managing 

IT. The report states that management 

approaches to IT planning and 

implementation are still undergoing 

significant long-term changes.

Justice’s 2003 performance plan discusses 

the department’s strategy for meeting this 

challenge. Specifically, Justice plans to 

continue investing in an IT management 

framework built around a capital 

programming process that is closely aligned 

with its enterprise architecture.

The 2003 plan also has goals and measures 

for Justice that are directly related to this 

management challenge. The plan establishes 

a measure for the number of systems that will 

be managed according to its approved IT 

investment management processes, with a 

target of 100 percent in fiscal year 2003. 

However, the plan does not indicate if the 

measure will apply to all Justice systems or 

simply new IT investments.

The 2003 performance plan discusses INS’s 

strategy for meeting its goal, stating that INS 

will use its newly developed enterprise 

architecture to guide and justify its use of 

resources.

The 2003 plan also has goals and measures 

for INS that are directly related to this 

management challenge. Specifically, the plan 

includes a performance goal to provide an 

adequate, cost-effective, and compliant IT 

environment. This goal will be measured by 

the percentage of IT systems that comply 

with security requirements and system 

development life-cycle standards, and are 

supported with technologically adequate 

workstations. 

However, the 2003 plan does not specifically 

describe the system development life-cycle 

standards.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Appendix XI

Observations on the Department of Justice’s 

Efforts to Address Its Major Management 

Challenges

Page 96 GAO-03-225 Status of Addressing Major Management Challenges

a U.S. General Accounting Office. Police Corps: Some Problems Resolved, But Most Positions Remain 

Unfilled, (GAO/GGD-00-69, Washington, D.C.: Feb. 22, 2000).

.

INS southwest border strategy:

Although INS generally allocated newly 

hired border patrol agents in accordance 

with its strategy, INS was not able to meet 

its goal of increasing its onboard strength of 

border patrol agents by at least 1,000 in 

fiscal year 1999. INS saw an increase of 

only 369 agents in fiscal year 1999 due to 

recruitment and retention problems.

INS lacks performance information to 

determine the overall impact of its strategy 

to reduce the illegal alien flow across the 

border, reduce flow to the border, and 

reduce the number of illegal aliens who 

reside in the United States.

Justice’s performance report had a 

performance measure to have eight highpriority corridors demonstrating optimum 

deterrence. The report indicated that the 

performance target of eight such corridors 

was met for fiscal year 2001.

According to Justice’s performance report, 

the primary indicator of successful 

deterrence is the significant reduction and 

leveling off of attempted entry. Optimum 

deterrence is defined as the level at which 

applying more border patrol agents and 

resources is no longer justifiable considering 

the areas current or future potential to 

facilitate successful illegal entry.

According to Justice’s performance plan, the 

performance target for the number of highpriority border corridors demonstrating 

optimum deterrence was set at nine corridors 

for fiscal year 2003.

Removal of illegal aliens:

We found that for fiscal year 1999, 43 

percent of the aliens released from 

detention prior to determination of their 

asylum status had not appeared for 

subsequent removal hearings.

We recommended that INS analyze the 

characteristics of those aliens who 

appeared and those who did not appear for 

their removal hearings and use the results 

to reevaluate its policy for when to release 

aliens in cases when an asylum officer 

determined the aliens to have a credible 

fear of persecution or torture.

Justice’s performance report had a new 

performance measure—to reduce the 

annual entries of illegal aliens residing in the 

United States. Since it was a new measure 

there was no performance target for fiscal 

year 2001, but the report indicated that the 

actual number of new entrants was 

estimated at 625,000.

Justice’s performance plan had a 

performance target of 510,000 new entrants 

for the number of annual entries of illegal 

aliens residing in the United States for fiscal 

year 2003.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Page 97 GAO-03-225 Status of Addressing Major Management Challenges

Appendix XII

Observations on the Department of Labor’s 

Efforts to Address Its Major Management 

Challenges ApendxiXI

The following table identifies the major management challenges 

confronting the Department of Labor (Labor), which include the 

governmentwide high-risk areas of strategic human capital management 

and information security. The first column lists the challenges identified by 

our office. The second column discusses what progress, as discussed in its 

fiscal year 2001 performance report, Labor made in resolving its challenges. 

The third column discusses the extent to which Labor’s fiscal year 2003 

performance plan includes performance goals and measures to address the 

challenges that we identified. We found Labor’s performance report 

discussed the agency’s progress in resolving its challenges. 

The agency’s performance plan has goals and measures that were directly 

related to all five of the major management challenges.
Appendix XII

Observations on the Department of Labor’s 

Efforts to Address Its Major Management 

Challenges

Page 98 GAO-03-225 Status of Addressing Major Management Challenges

Table 13: Major Management Challenges for Labor

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management:

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures.

In addition, our January 2001 reporta

 on 

major management challenges and program 

risks at the Department of Labor identified 

human capital management issues at the 

Pension Benefit Guaranty Corporation 

(PBGC). PBGC had not adequately linked 

its decisions to contract out for services to 

longer-term strategic planning 

considerations; as a result, PBGC could not 

be assured that it had a cost-beneficial mix 

of contractor and federal employees, and 

risked being unprepared for future workload 

changes. We recommended that PBGC 

conduct a comprehensive review of its 

human capital needs. Our subsequent work 

has also identified human capital 

management issues at Labor’s Pension and 

Welfare Benefits Administration that could 

undermine the continuity and effectiveness 

of its enforcement programs.

Of its four human capital performance goals, 

Labor reported that it achieved two goals 

and did not achieve two goals. Labor 

reported it achieved its goal to recruit, 

develop, and retain a highly competent and 

diverse workforce; and exceeded its goal to 

comply with applicable civil rights laws and 

achieve equal opportunity workplaces. 

Labor did not achieve its goals to reduce the 

rate of lost production days; and reduce the 

injury/illness rate, and improve the 

timeliness of filing injury claim forms.

In its fiscal year 2003 performance plan, 

Labor has three human capital performance 

goals rather than the four goals reported in 

fiscal year 2001. The performance goal 

related to complying with civil rights laws 

and equal opportunity workplaces was 

discontinued in Labor’s fiscal year 2002 

performance plan because Labor had been 

achieving this goal since fiscal year 1999 

and needed to redirect resources to other 

activities. The other three performance 

goals are generally the same as the 2001 

goals.

To meet its human capital performance 

goals, Labor’s significant, new, or enhanced 

efforts include

• using workforce projection tools to refine 

Labor’s 5-year workforce planning and 

restructuring efforts,

• identifying gaps for mission-critical 

occupations based on core competencies, 

and

• using OMB’s human capital scorecard.

The human capital scorecard focuses on 5 

important dimensions of human capital 

management: strategic alignment, strategic 

competencies, leadership, performance 

culture, and learning. Using the fiscal year 

2001 scorecard results for ten of its 

agencies as a baseline, Labor found that 

one agency met the standard, four agencies 

had mixed results, and five agencies were 

unsatisfactory. Although Labor plans to use 

the 2001 scorecard results as its baseline 

and as a data source, Labor does not have 

any targets listed in its 2003 performance 

plan.
Appendix XII

Observations on the Department of Labor’s 

Efforts to Address Its Major Management 

Challenges

Page 99 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show federal computer systems 

are riddled with weaknesses that make them 

highly vulnerable to computer-based attacks 

and place a broad range of critical 

operations and assets at risk of fraud, 

misuse, and disruption.

Labor reported in its 2001 performance 

report that it had taken steps to strengthen 

its information security. For example, it 

reported that it had developed computer 

security guidance and issued a computer 

security handbook, established an 

emergency incident response team, 

installed an intrusion detection system on 

the department’s core network backbone, 

upgraded the firewall on its core network, 

and conducted risk assessments of key 

systems.

Labor’s fiscal year 2003 performance plan 

noted that the department established a 

performance goal to improve organizational 

performance and communication through 

effective information management and 

deployment of IT resources. To meet this 

performance goal, Labor has developed five 

performance indicators. One indicator is 

related to information security and the other 

four are related to improving organizational 

performance and communication. The 

information security indicator calls for 

reducing severe unauthorized intrusions by 

50 percent of the baseline. However, this 

indicator addresses only one aspect of 

information security.

While Labor reported that it had adopted the 

Federal Security Assessment Framework, it 

did not establish specific performance goals 

for achieving each of the levels addressed in 

this framework. These goals would facilitate 

the department’s ability to measure its 

progress in improving its overall information 

security program. Further, the Office of 

Management and Budget’s guidance for 

fiscal year 2002 reporting under the 

Government Information Security Reform 

Act (GISRA) requires specific information 

security performance measures as well as 

corrective action plans with quarterly status 

updates. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XII

Observations on the Department of Labor’s 

Efforts to Address Its Major Management 

Challenges

Page 100 GAO-03-225 Status of Addressing Major Management Challenges

GAO-designated major management 

challenge

Increasing the employment and earnings 

of America’s workforce.

In its fiscal year 2001 performance report, 

Labor reported its progress in achieving 

three outcome goals related to this 

challenge: increasing employment, 

earnings, and assistance; assisting youth in 

making the transition to work; and 

increasing employment and earnings for 

retrained workers. For these three outcome 

goals, Labor reported it achieved four 

performance goals, substantially achievedb

three performance goals, and did not 

achieve one performance goal.

Labor reported it achieved the following 

performance goals: increasing employment 

and earnings under the Workforce 

Investment Act (WIA) adult program; 

preparing women for the labor force; 

assisting 19-21-year-old youths in making 

the transition to work; and providing jobs for 

dislocated workers. Of the three goals 

Labor reported it substantially achieved, 

these goals related to assisting 14-18-yearold youths with training, post-secondary 

education, military service, apprenticeships, 

or in becoming employed; enhancing job 

placement and wages for Job Corps 

graduates; and assisting trade-affected 

workers to find jobs. The goal not achieved 

measured the extent Welfare-to-Work (WtW) 

participants retained employment and 

received wage increases. Labor believed 

two factors may have contributed to not 

meeting this goal: employment declined in 

the service and retail sectors, both of which 

were a significant source of entry-level 

placements, and WtW grantees were 

reporting questionable data. Labor’s 

strategy for improving these outcomes 

included implementing new initiatives and 

issuing technical assistance products. 

Labor did not report on two of its 

performance goals related to increasing 

services to disabled individuals and 

awarding youth opportunity grants. For the 

In its fiscal year 2003 performance plan, 

Labor listed the same goals discussed in its 

2001 performance report. In addition, the 

WtW performance goal also became a 

performance indicator for the Employment 

and Training Administration (ETA). In fiscal 

year 2003, Labor added two new goals for 

this challenge relating to training for 

individuals significantly disabled and 

registrants for the apprenticeship program.

Labor’s 2003 performance plan also cited 

strategies to improve performance 

measurement and organizational alignment. 

With regard to performance measurement, 

Labor said that it will complete plans to 

improve the quality and timeliness of data in 

its performance management systems for its 

WIA adult program. With regard to 

organizational alignment, Labor said it will 

continue to work with the states to identify 

and develop strategies to better serve 

employers through one-stop systems to 

increase the numbers of jobs listed with onestops and job seekers that enter 

employment.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XII

Observations on the Department of Labor’s 

Efforts to Address Its Major Management 

Challenges

Page 101 GAO-03-225 Status of Addressing Major Management Challenges

services to disabled individuals goal, Labor 

reported that data were not available and 

stated it would report on this goal in its fiscal 

year 2002 Performance and Accountability 

Report. For the youth grant program goal, 

Labor stated that this program was not 

funded in 2001 and would not be reported in 

its 2002 Performance and Accountability 

Report.

Our January 2001 report that discussed 

Labor’s major management challenges 

indicated that Labor could better meet its 

challenges by improving its performance in 

three other areas: performance 

measurement, strategic planning, and 

organizational alignment. Labor’s 

performance report cites actions taken in 

some of these areas. For example with 

regard to performance measurement, Labor 

reported it developed a comprehensive 

labor exchange performance measurement 

system that included newly developed 

performance measures and an improved 

system of obtaining employment outcome 

information. In addition, Labor stated the 

ETA developed a verification and validation 

process to ensure the accuracy of 

performance data submitted to Labor. With 

regard to organizational alignment, Labor 

stated it was working with a network of 

partners from business coalitions, public 

interest groups, and community and faithbased organizations to implement the WIA 

program improvements to assure a more 

consistent policy.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XII

Observations on the Department of Labor’s 

Efforts to Address Its Major Management 

Challenges

Page 102 GAO-03-225 Status of Addressing Major Management Challenges

Protecting the benefits of workers. In its fiscal year 2001 performance report, 

Labor reported its progress in achieving two 

outcome goals related to this challenge: 

protecting worker benefits and increasing 

compliance with worker protection laws. 

Under these two outcome goals, Labor 

reported it achieved six out of 13 

performance goals. These six goals were: 

expanding pension coverage particularly 

among women, minorities, and small 

business workers; producing cumulative 

first-year savings in the Federal Employees’ 

Compensation Act (FECA) program; issuing 

timely and accurate Davis-Bacon wage 

determinations; reducing processing time for 

pension benefit determinations; providing for 

secure pension plans by increasing the 

number of cases with fiduciary results; and 

providing for secure health and welfare 

plans. Labor reported it did not achieve 7 

performance goals: making timely 

determination and payment of 

unemployment benefits; reducing lost 

production days due to federal employees’ 

injuries; reducing selected medical costs; 

increasing pension benefit recoveries; 

increasing compliance with labor standards 

in targeted industries; increasing 

compliance with labor standards among 

previous violators; and increasing timely 

union financial reporting. 

Labor analyzed the performance goals not 

achieved and generally provided reasons 

why the goals were not met. For example, 

for the recovering pension benefits 

recoveries goal, Labor said that the 

contributing factors included the volatile 

nature of benefit recoveries, the large 

recoveries that occurred in the prior year, 

and a hiring freeze that left numerous Labor 

positions unfilled.

In addition, Labor recognized that some of 

its performance goals needed to be modified 

or terminated. For example, Labor’s goal for 

recovery of pension benefits for individual 

participants is being considered for revision 

Of the 13 goals listed in its 2001 

performance report, Labor included 11 of 

them in its fiscal year 2003 performance 

plan. These goals were: (1) producing 

cumulative first-year savings in the FECA 

program; (2) providing for secure pension 

plans by increasing the number of cases 

with fiduciary results; (3) reducing 

processing time for pension benefit 

determinations; (4) providing for secure 

health and welfare plans; (5) making timely 

determination and payment of 

unemployment benefits; (6) reducing lost 

production days due to federal employees’ 

injuries; (7) reducing selected medical costs; 

(8) increasing pension benefit recoveries; 

(9) increasing compliance with labor 

standards in targeted industries; (10) 

increasing compliance with labor standards 

among previous violators; and (11) 

increasing timely union financial reporting.

The two performance goals related to wage 

determinations and expanding pension 

coverage were not included in Labor’s fiscal 

year 2003 performance plan because Labor 

eliminated these goals. The Davis-Bacon 

wage determinations goal was eliminated in 

Labor’s fiscal year 2002 performance plan 

because Labor successfully achieved this 

goal during fiscal year 2001 and said that it 

needed to refocus its resources. Also, as 

stated earlier, Labor eliminated its 

expanding pension coverage to women, 

minorities, and small business workers 

performance goal due to difficulties 

evaluating the extent its program influenced 

the pension coverage for these types of 

workers. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XII

Observations on the Department of Labor’s 

Efforts to Address Its Major Management 

Challenges

Page 103 GAO-03-225 Status of Addressing Major Management Challenges

a

See U.S. General Accounting Office, Department of Labor: Major Management Challenges and 

Program Risks, GAO-01-251 (Washington, D.C., Jan. 2001).

b

Labor defines substantially achieved as attaining 80 percent or more of the targeted goal.

because Labor believes the goal does not 

adequately measure the total impact of its 

customer assistance program. Also, Labor 

terminated its expanding pension coverage 

to women, minorities, and small business 

workers performance goal for fiscal year 

2002. Labor reported it had difficulties 

evaluating the extent its program influenced 

the pension coverage for these types of 

workers due to the significant impact the 

economy has on this goal.

Fostering safe and healthy workplaces. Of Labor’s six performance goals in its 

outcome goal related to reducing workplace 

injuries, illnesses, and fatalities, Labor 

reported it achieved five goals and did not 

achieve one goal. The goals achieved were: 

reducing the number of mine fatalities and 

nonfatal injuries; reducing the percentage of 

coal dust samples and silica dust samples 

that exceed standards; reducing three of the 

most significant types of workplace injuries; 

reducing injuries and illnesses in at least 

75,000 workplaces with Occupational Safety 

and Health Administration intervention; and 

decreasing fatalities in the construction 

industry. Labor reported it did not achieve 

its goal to reduce three of the most 

significant types of workplace injuries and 

causes of illnesses. Labor selected 

exposure to silica and lead and the number 

of amputations as the three items to 

measure. During the year, Labor’s tests for 

exposure to lead showed an increase of 21 

percent, whereas the test results for silica 

exposure and the number of amputations 

significantly decreased.

All six goals discussed in the fiscal year 

2001 performance report were included in 

Labor’s fiscal year 2003 performance plan. 

In addition, all six goals had higher 

performance targets or expanded the 

coverage of the performance goal. For 

example, one goal for fiscal year 2001 called 

for the reduction of coal and silica dust but 

the 2003 goal was expanded to also include 

reducing noise exposure in all mines and the 

number of citations/orders for diesel 

particulate matter in mines.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 104 GAO-03-225 Status of Addressing Major Management Challenges

Appendix XIII

Observations on the National Aeronautics and 

Space Administration’s Efforts to Address Its 

Major Management Challenges ApendxiXI

The following table identifies the major management challenges 

confronting the National Aeronautics and Space Administration (NASA) 

which include the governmentwide high-risk areas of strategic human 

capital management and information security. The first column lists the 

challenges identified by our office. The second column discusses what 

progress, as discussed in its fiscal year 2001 performance report, NASA 

made in resolving its challenges. The third column discusses the extent to 

which NASA’s fiscal year 2003 performance plan includes performance 

goals and measures to address the challenges that we identified. We found 

that NASA’s performance report discussed the agency’s progress in 

resolving all of its challenges.

Of the agency’s five major management challenges, its performance plan 

had

1. goals and measures that were directly related to four of the challenges, 

including

• strategic human capital management,

• information security,

• contract management, and

• international space station costs

2. goals and measures that were indirectly applicable to three of the 

challenges, including

• strategic human capital management,

• contract management, and

• faster, better, cheaper approach to space exploration projects

3. no goals related to one of the challenges, but discussed measures 

and/or strategies to address the challenge, which was

• faster, better, cheaper approach to space exploration projects.
Appendix XIII

Observations on the National Aeronautics 

and Space Administration’s Efforts to 

Address Its Major Management Challenges

Page 105 GAO-03-225 Status of Addressing Major Management Challenges

Table 14: Major Management Challenges for NASA

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management:

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures.

In January 2001, we reported the need to 

implement a human capital approach in 

NASA’s workforce management strategies 

as a major management challenge. We 

reported that NASA’s shuttle workforce had 

declined significantly in recent years to the 

point of reducing the agency’s ability to 

safely support the shuttle program.

In September 2001, we reported in 

testimony that while NASA continued to 

make progress in revitalizing the shuttle 

program’s workforce, considerable 

challenges remained. 

In July 2002 testimony, we reported that 

NASA believes that similar workforce 

problems affect the entire agency, and was 

taking further steps to address its workforce 

challenges. 

NASA’s fiscal year 2001 performance report 

states that the strategic management of 

human capital remains a top priority of the 

agency, particularly since human capital is 

one of the five major initiatives on the 

President’s Management Agenda. The 

report indicates that NASA failed to meet the 

President’s executive scorecard criteria in 

this area, but the agency is responding to 

this challenge by improving recruitment, 

retention, training, career development, and 

workforce planning. In the report, NASA 

acknowledges that it fell short of achieving 

its targeted increases in workforce diversity 

levels, but does report that it increased 

representation of minorities and women, 

and implemented numerous initiatives 

during the year to recruit and retain a highly 

technical workforce. The report states that 

NASA achieved its performance indicators

of increasing training opportunities and the 

use of technology-based learning 

opportunities through increased funding for 

training, career development, and 

succession planning. The report also states 

that in fiscal year 2002 NASA will begin 

implementation of a consistent agency-wide 

workforce planning and reporting system at 

all centers to track distribution of its 

workforce across programs and facilitate 

critical skill gap analyses.

In our July 2002 testimony, we noted that 

additional steps being taken by NASA to 

address its workforce problems included 

developing an agencywide integrated 

workforce planning and analysis system to 

track the distribution of its workforce across 

programs and facilitate skill gap analyses. 

NASA also developed a strategic human 

capital plan which identifies human capital 

goals, problems, improvement initiatives, 

intended outcomes, and strategies and 

metrics to support the goals. NASA also 

submitted legislative proposals to Congress 

NASA’s fiscal year 2003 performance plan 

retains the strategic objective to invest 

wisely in its use of human capital and annual 

performance goals and indicators that (1) 

align management of human resources to 

achieve agency strategic goals and 

objectives and (2) attract, retain, and 

maximize the individual performances of a 

diverse workforce through training and 

development experiences. The plan states

that by the end of fiscal year 2003, NASA 

plans to increase the availability of 

assessment tools used in agency-wide 

leadership and project management training 

and development. It states that in fiscal year 

2003, NASA will continue to develop and 

implement consistent workforce planning 

that links staffing, funding, mission activities, 

and core competencies allowing each center 

to plan its own recruitment, retention, 

succession, and training and development 

activities. 

The fiscal year 2003 plan structure remains 

basically the same as that for fiscal year 

2002; it still does not yet relate NASA’s 

human capital annual performance goals 

and indicators to specific programs with 

critical skill gaps. In a May 2002 agreement 

between NASA and OMB, NASA 

acknowledged that it needed to complete 

and submit to OMB a transformation 

workforce restructuring plan, which, in 

conjunction with its strategic human capital 

plan, will be critical to ensuring that no skill 

gaps or deficiencies exist in mission-critical 

occupations. The agreement, which 

documents NASA’s plans for addressing the 

governmentwide initiatives in the President’s 

Management Agenda, indicated that NASA 

was still in the process of identifying its 

critical skills and competencies at risk 

across the agency.
Appendix XIII

Observations on the National Aeronautics 

and Space Administration’s Efforts to 

Address Its Major Management Challenges

Page 106 GAO-03-225 Status of Addressing Major Management Challenges

requesting further flexibilities and authorities 

for attracting and retaining a skilled 

workforce.

Information security: 

Our January 2001 high-risk series update 

report noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show that federal computer 

systems are riddled with weaknesses that 

make them highly vulnerable to computerbased attacks and place a broad range of 

critical operations and assets at risk of 

fraud, misuse, and disruption. Further, the 

events of September 11, 2001, underscored 

the need to protect America’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both.

NASA’s fiscal year 2001 performance report 

states that the agency achieved its annual 

performance goal related to the information 

technology infrastructure improvement 

challenge. NASA reported that it had 

implemented a number of steps to address 

the challenge. These steps included, but 

were not limited to, approving a partitioned 

firewall for the agency network, 

implementing Web-based information 

security training accessible to all employees, 

conducting network vulnerability analyses, 

conducting self-assessment of continuity 

plans, reviewing user authentication and 

data protection activities, purchasing smart 

card and token technologies for evaluation, 

and implementing a Critical Infrastructure 

Protection Program to enhance intrusion 

detection and response capabilities. 

Additionally, the report indicates that NASA

conducted security awareness training for all 

levels of civil service employees. By the end 

of fiscal year 2001, NASA reported that 93 

percent of all civil service employees, 100 

percent of civil service managers, and 98 

percent of all civil service system 

administrators had completed the 

specialized training through NASA’s 

expanded use of Web-based training. In 

addition, NASA completed reviews of 98 

percent of all information technology 

security plans for critical systems. However, 

NASA does not specifically address the 

influence of private contractors in its results. 

This is important because contractors make 

up a substantially larger proportion of NASA 

overall workforce than civil service 

employees.

However, in spite of the achievements listed 

above, NASA reported that given the extent 

of its systems and the magnitude and 

variety of security threats, its security 

program remains a key challenge. A recent 

NASA Office of Inspector General audit 

NASA’s fiscal year 2003 performance plan 

also continues to identify information 

technology security as a significant area of 

management concern. NASA’s fiscal year 

2003 performance plan maintains a strategic 

objective to enhance the security of its 

information technology resources by 

meeting an annual performance goal and 

indicators in three critical areas:

• Reduce system vulnerabilities specified for 

the year across all NASA centers to at 

least the targeted ratios.

• Meet established targets for information 

technology security awareness training for 

all NASA employees, managers, and 

system administrators.

• Complete the information technology 

security plans at a targeted level, including 

authorization to process, for critical NASA 

systems. 

However, these efforts may not specifically 

measure the overall effectiveness of 

information security and the agency’s 

progress in implementing corrective actions.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XIII

Observations on the National Aeronautics 

and Space Administration’s Efforts to 

Address Its Major Management Challenges

Page 107 GAO-03-225 Status of Addressing Major Management Challenges

reporta noted that while NASA reported its 

information technology infrastructure 

improvement goal as having been achieved 

in its performance report, it did not disclose 

in the report several limitations in the 

supporting data related to the system 

vulnerabilities and security awareness 

training. NASA had earlier agreed that the 

data limitations should be described in the 

report.

The need to correct weaknesses in 

NASA’s contract management: 

We have reported that NASA’s contract 

management is a continuing area of high 

risk. Implementation of the financial 

management system and its integration with 

full cost accounting has been delayed. Until 

the financial management system is 

operational, performance assessments 

relying on cost data may be incomplete.

In our July 2002 testimony, we pointed out 

that much work remains to be done to 

strengthen contract oversight. According to 

NASA, the agency’s financial management 

environment consists of decentralized, 

nonintegrated systems with policies, 

procedures, and practices that are unique to 

its centers. For the most part, data formats 

are not standardized, automated systems 

are not interfaced, and on-line financial 

information is not readily available to 

program managers. Thus, it is difficult to 

ensure contracts are being effectively and 

efficiently implemented and budgets are 

executed as planned.

NASA’s fiscal year 2001 performance report 

states that NASA exceeded its goals for 

both obligating available funds against 

performance-based contracts and 

increasing awards of contract dollars to 

small disadvantaged businesses. According 

to the report, a new integrated financial 

management system remains a high priority 

for NASA. NASA plans to implement the 

core financial module of the integrated 

financial management system at the 

Marshall and Glenn centers in October 2002 

and at the rest of the centers by June 2003. 

NASA’s fiscal year 2003 performance plan 

has performance goals to (1) renew its 

management systems and facilities through 

use of updated automated systems and 

facilities revitalization and (2) improve the 

agency’s financial management and 

accountability. The plan also includes 

performance goals to continue taking 

advantage of opportunities for improved 

contract management by (1) maintaining a 

high proportion of performance-based 

contracts and (2) significantly involving small 

businesses, minority institutions, and 

businesses owned by women as NASA 

contractors. NASA’s plan provides specific 

indicators for each goal.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XIII

Observations on the National Aeronautics 

and Space Administration’s Efforts to 

Address Its Major Management Challenges

Page 108 GAO-03-225 Status of Addressing Major Management Challenges

a

National Aeronautics and Space Administration, Audit Report: Validation And Verification Of Selected 

NASA Fiscal Year 2001 Performance Data Related To The Government Performance And Results Act, 

IG-02-025 (Sept. 27, 2002).

The need to control International Space 

Station development and support costs: 

Development costs for the International 

Space Station (ISS) have soared to the point 

where NASA has had to make substantial 

cutbacks in the program. This has 

negatively affected NASA’s credibility with 

Congress and raised concern among 

international partners and the scientific 

community about the viability of the space 

station. We reported in July 2002 that 

NASA is instituting a number of 

management and cost reforms, but the 

agency still faces considerable challenges in 

successfully implementing the reforms.

NASA’s fiscal year 2001 performance report 

discusses several actions that address ISS 

cost control issues. The report states that 

projected future space station cost growth 

from fiscal year 2003 through fiscal year 

2006 continues to constrain the program. To 

keep ISS within its planned budget, the 

administration scaled it down to a core 

station. In response to fiscal year 2002 

budget constraints, the agency developed 

the Program Management Action Plan, July 

2001, which provides a set of management 

and resource control actions to address 

institutional and program reforms. Several 

of these reforms have already been 

implemented, including increasing 

headquarters oversight, strengthening 

business management functions, improving 

cost estimating and control methodologies, 

and instituting independent financial 

assessment capabilities.

NASA’s fiscal year 2003 performance plan 

contains an annual performance goal that 

addresses ISS cost control issues. The goal 

is to develop and execute a management 

plan and open future station hardware and 

service procurements to innovation and 

cost-saving ideas. The Integrated Program 

Management Plan contains reforms that 

strengthen headquarters involvement, 

increase communications, provide more 

accurate assessment, and maintain budget 

accountability. Timely and successful 

completion of the initiatives is vitally 

important, but NASA faces significant 

challenges in implementing these reforms. 

For example, NASA currently lacks a 

modern integrated financial management 

system to track and maintain data needed 

for estimating and controlling costs.

The need to effectively implement the 

faster-better-cheaper approach to space 

exploration projects: 

Although NASA has recently decided that its 

faster-better-cheaper approach will no 

longer be used as a preference for 

managing its programs and projects, we 

have reported that NASA has been following 

this management philosophy to reduce cost, 

become more efficient, and increase 

scientific results by conducting more and 

smaller missions in less time. While NASA 

has had many successes, the failures of two 

Mars probes show that there are limits to 

this approach, particularly in terms of 

NASA’s ability to learn from past mistakes. 

NASA has taken steps in recent years to 

strengthen lessons learned within the 

agency.

In January 2002, we reported that more 

needs to be done to overcome cultural and 

organizational impediments. NASA plans to 

implement our recommendations to improve 

its current knowledge sharing mechanisms.

The status of this challenge has been 

overtaken by events. As discussed under 

our characterization of this challenge, NASA 

has decided to end this approach. 

Regarding lessons learned, the 

performance report states that NASA failed 

to achieve its performance target to capture 

a set of “best practices/lessons learned” 

from each program. 

As discussed, the status of this challenge 

has been overtaken by events. 

NASA’s performance plan provides a 

general discussion of a strategic objective, 

but no specific performance goals or 

indicators directly related to this 

management challenge. The plan’s 

strategic objective is to capture engineering 

and technological best practices and 

process knowledge that will continually 

improve NASA’s program/project 

management. According to the plan, the

NASA Integrated Action Team’s efforts 

represent a systems solution for effectively 

executing its programs and projects. Each 

action plan defines how, when, and by 

whom the plan is being implemented. The 

plan states that (1) most actions will be fully 

implemented by the end of fiscal year 2002 

and (2) revision of NASA Procedures and 

Guidelines 7120.5,which is approaching 

completion, includes extensive 

changes/clarifications of the processes 

involved in program/project management. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 109 GAO-03-225 Status of Addressing Major Management Challenges

Appendix XIV

Observations on the Nuclear Regulatory 

Commission’s Efforts to Address Its Major 

Management Challenges ApendxiXIV

The following table identifies the major management challenges 

confronting the Nuclear Regulatory Commission (NRC), which include the 

governmentwide high-risk areas of strategic human capital management 

and information security. The first column lists the challenges identified by 

our office. The second column discusses what progress, as discussed in its 

fiscal year 2001 performance report, NRC made in resolving its challenges. 

The third column discusses the extent to which NRC’s fiscal year 2003 

performance plan includes performance goals and measures to address the 

challenges that we identified. We found that NRC’s performance report 

discussed the agency’s progress in resolving many of its challenges, but it 

did not discuss NRC’s progress in resolving the challenge relating to its new 

document system.

Of NRC’s six major management challenges (as determined by GAO), its 

performance plan had

1. goals and measures that were directly related to two of the challenges, 

including;

• development and implementation of a risk-informed approach for 

commercial nuclear power plants and

• inherent difficulties in applying a risk-informed approach to nuclear 

material licensees

2. no goals related to four of the challenges, but discussed measures 

and/or strategies to address the challenges, which were

• strategic human capital management,

• information security,

• improving financial management systems, and

• information technology issues.
Appendix XIV

Observations on the Nuclear Regulatory 

Commission’s Efforts to Address Its Major 

Management Challenges

Page 110 GAO-03-225 Status of Addressing Major Management Challenges

Table 15: Major Management Challenges for NRC

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management:

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures.

GAO also identified NRC’s continued efforts 

to cope with significant human capital issues 

as a major management challenge for the 

agency. In a highly technical, complex 

industry, NRC is facing the loss of a 

significant percentage of its senior 

managers and technical staff. For example, 

for the NRC office responsible for achieving 

the outcome of preventing radiation-related 

deaths or illnesses due to civilian nuclear 

reactors, about 22 percent of the technical 

staff and 16 percent of senior executive 

service staff were eligible to retire in 2001. 

And, by 2005, the number eligible for some 

type of retirement is about 42 percent and 

77 percent, respectively. At the same time, 

NRC will need to rely on these staff to 

achieve its strategic and performance goals.

In contrast to its fiscal year 2000 

performance report, in its fiscal year 2001 

report NRC discussed several steps it is 

taking to respond to its human capital 

challenges. First, it is integrating its 

strategic workforce planning efforts into the 

NRC Planning, Budgeting, and Performance 

Management process for the fiscal year 

2004 budget. In addition, NRC noted that it 

is instituting performance goals and 

measures for human capital management in 

its fiscal year 2003 performance plan. 

Second, NRC states that it is using all 

available personnel flexibilities and tools, as 

well as adding new measures to provide 

needed flexibility, to recruit and retain 

qualified staff. These flexibilities and tools 

include approving selected waivers of dual 

compensation limitations under delegated 

authority from OPM; using retention 

allowances for current employees; 

increasing the number of recruitment 

bonuses offered to new applicants; 

instituting a student loan repayment 

program; and creating a new undergraduate 

fellowship program to help pay the expenses 

of promising college seniors. Third, NRC 

states that it is building a capability to 

inventory current agency skills and 

competencies and forecast future skills and 

competency needs. NRC completed a pilot 

effort in fiscal year 2001 to identify highly 

specialized skills and competencies 

currently available in the agency, the skills 

and competencies needed over the next 5 

years, and the gap closure strategies 

necessary for acquiring and maintaining the 

needed skills and competencies. In fiscal 

year 2002, NRC states that it will review the 

results of this pilot to develop and implement 

an agencywide skills assessment and needs 

forecasting process. By fiscal year 2004, 

NRC plans to have a fully integrated process 

and an automated skills database to support 

human capital management throughout the 

agency.

 NRC’s 2003 performance plan does not 

contain any performance goals that directly 

address human capital management. 

However, it does contain corporate 

management strategies, implementing 

strategies, and output measures to help 

NRC accomplish its strategic and 

performance goals. One of these corporate 

strategies is to sustain a high-performing, 

diverse workforce. To implement this 

strategy NRC will employ seven strategies. 

One of these strategies includes designing a 

strategic workforce plan to address critical 

skill gaps and guide the agency in the 

recruitment, development, and retention of a 

highly skilled diverse workforce. Following 

the initial assessment of agency technical 

skills and competencies, and based on 

lessons learned in the course of that 

undertaking, this effort will be expanded to 

address skills and competency 

requirements in IT, and management and 

support areas. The plan also states that in 

fiscal year 2003, NRC will direct additional 

focus on managing human capital 

investment programs, including waivers of 

dual compensation limitations, expanded 

usage of retention allowances and 

recruitment bonuses, Senior Fellowships, 

Graduate Fellowships, Undergraduate 

Fellowships, a student loan repayment 

program, and an agencywide intern 

program. One output measure to judge the 

success of whether NRC’s strategic 

workforce planning efforts adequately 

address its core competency requirements 

is to hire 20 percent of its new professional 

staff at the entry level and retain 75 percent 

of these new hires over their first 3 years of 

their employment.
Appendix XIV

Observations on the Nuclear Regulatory 

Commission’s Efforts to Address Its Major 

Management Challenges

Page 111 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show federal computer systems 

are riddled with weaknesses that make them 

highly vulnerable to computer-based attacks 

and place a broad range of critical 

operations and assets at risk of fraud, 

misuse, and disruption. Further, the events 

of September 11, 2001, underscored the 

need to protect America ’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both.

(NRC’s OIG identified information security 

as part of a broader challenge related to the 

identification, acquisition, and 

implementation of information technologies.)

NRC does not have a specific performance 

goal for information security. No targets for 

information security were provided or 

measured by NRC in fiscal year 2001. The 

NRC’s fiscal year 2001 Performance and 

Accountability Report says that “the agency 

did not have a process to consistently 

implement its program and recently received 

a grade “F” in computer security from a 

congressional score card” but that NRC had 

“issued a Corrective Action Plan to address 

these issues.” 

Information security is addressed by the IG 

in the management challenge of 

“identification, acquisition, implementation, 

and protection of information resources.” 

According to the IG, NRC has made some 

progress in addressing security. 

Specifically in the areas of (1) development 

of a centralized information security 

oversight and performance measurement 

process based on the Federal IT Security 

Assessment Framework developed by the 

National Institute of Standards and 

Technology and the Chief Information 

Officer’s Council; (2) use of monitoring 

techniques so that no interruptions to or loss 

of data from NRC’s business applications 

were due to computer viruses in fiscal year 

2001; (3) independent review (penetration 

test) of its cyber protection mechanisms; 

and (4) online training in computer security 

awareness. 

NRC’s fiscal year 2003 budget and 

performance plan does discuss the issue of 

information security. In its management 

support section, NRC describes several 

program output measures that address its 

system security plan, network security, and 

the security and availability of critical e-mail 

and Web access infrastructure services. 

For example, one performance measure will 

be to “respond to any new network security 

vulnerability within 24 hours of discovery.” 

Another will be to “restore e-mail and Web 

access to operational status within one hour 

of discovery of a security incident.” 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XIV

Observations on the Nuclear Regulatory 

Commission’s Efforts to Address Its Major 

Management Challenges

Page 112 GAO-03-225 Status of Addressing Major Management Challenges

GAO-designated major management 

challenge

Development and implementation of a 

risk-informed approach for commercial 

nuclear power plants: NRC faces 

numerous challenges in implementing a 

risk-informed approach for nuclear power 

plants. Whatever processes NRC ultimately 

adopts must be consistent, visible, and 

clear. A clearly defined strategy would help 

NRC and the utilities address the public’s 

concerns as it implements a risk-informed 

regulatory approach. Although NRC initially 

agreed on the need for a comprehensive 

strategy, it has not followed through to 

develop one. Instead, NRC developed a 

Risk-Informed Regulation Implementation 

Plan, but the plan is not as comprehensive 

as it needs to be because it does not identify 

those items critical to achieving its 

objectives, activities that cut across the 

agency, resources, performance measures, 

or the relationships among these various 

activities.

NRC’s fiscal year 2001 performance report 

stated that NRC met this challenge in fiscal 

year 2001 by implementing an important 

transition to an improved Reactor Oversight 

Process. The improved processes included 

developing and implementing a riskinformed inspection program to provide 

increased focus on aspects of plant 

performance, which had the greatest impact 

on safe plant operation. NRC stated that it 

used licensee-reported performance 

indicator information to improve the 

program’s objectivity, and to make it more 

understandable and predictable. In addition, 

NRC’s report stated that:

• the Commission was provided with 

recommendations for using risk analysis 

as a basis for revising nuclear reactor 

regulations;

• the Commission is making significant 

progress toward developing a riskinformed rule on the special treatment 

requirements for systems, structures, and 

components of reactor facilities.

NRC’s 2003 performance plan contains 

three performance goals, one performance 

measure, and seven implementing 

strategies that relate to this challenge. The 

performance goals are: (1) to maintain 

safety, protection of the environment, and 

the common defense and security; (2) to 

make NRC activities and decisions more 

effective, efficient, and realistic; and (3) to 

reduce unnecessary regulatory burden on 

stakeholders. The performance measure is 

to complete milestones in the Risk-Informed 

Regulation Implementation Plan. The seven 

implementing strategies are: (1) to sharpen 

the focus on safety to include a transition to 

a revised NRC reactor oversight program for 

inspection, assessment, and enforcement 

activities; (2) to evaluate operating 

experience and the results of risk 

assessments for safety implications; (3) to 

identify, evaluate, and resolve safety issues, 

including age-related degradation, and 

ensure that an independent technical basis 

exists to review license submittals to ensure 

that safety is maintained; (4) to continue to 

develop and incrementally use risk-informed 

and, where appropriate, less prescriptive 

performance-based regulatory approaches 

to maintain safety; (5) to use risk information 

to improve the effectiveness and efficiency 

of our activities and decisions; (6) to make 

agency decisions based on technically 

sound and realistic information; and (7) to 

use risk information and performance-based 

approaches to reduce unnecessary 

regulatory burden.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XIV

Observations on the Nuclear Regulatory 

Commission’s Efforts to Address Its Major 

Management Challenges

Page 113 GAO-03-225 Status of Addressing Major Management Challenges

Inherent difficulties in applying a riskinformed approach to nuclear material 

licensees: The sheer number of 

licensees—almost 21,000—and the 

diversity of the activities they conduct—

converting uranium; transporting radioactive 

materials; and using radioactive material for 

industrial, medical, or academic purposes—

increase the complexity of developing a riskinformed approach for nuclear material 

licensees. In addition, NRC will be 

challenged to define its role, including the 

size and skill mix of staff both in 

headquarters and regional offices, as an 

increasing number of states assume 

responsibility for regulating nuclear material 

users within their borders. The decisions 

that NRC ultimately makes could have 

budgetary and other implications for the 

agency.

 

NRC’s fiscal year 2001 performance report 

stated that NRC made significant progress 

towards identifying regulatory applications 

that would be amenable to, and would 

benefit from, an increased use of risk 

insights and information. NRC’s report also 

stated that it:

• published draft screening criteria and 

completed eight case studies to (1) 

evaluate the effectiveness of the screening 

criteria for identifying regulatory 

applications amenable to being riskinformed, (2) identify potential near-term 

process improvements, and (3) evaluate 

existing tools, methods, and data;

• issued a revision to 10 CFR‘s report Part 

70 that increased the use of risk 

information for fuel cycle facilities; 

• substantially completed development of 

the Standard Review Plan to implement 

the new requirements; and

• completed the medical pilot inspection 

program in fiscal year 2001.

NRC’s fiscal year 2003 performance plan 

contains three performance goals, one 

performance measure, and three 

implementing strategies that relate to this 

challenge. The performance measure is to 

complete those specific materials 

milestones in the Risk-Informed Regulation 

Implementation Plan and the implementing 

strategy is to continue to improve the 

regulatory framework to increase the focus 

on safety and safeguards, including 

incremental use of risk-informed and, where 

appropriate, less prescriptive performancebased regulatory approaches to maintain 

safety. 

In addition, NRC’s plan states that during 

fiscal year 2002–2003, NRC will develop 

probabilistic risk assessment (PRA) tools 

and guidance to risk-inform the regulatory 

framework for materials licenses, develop or 

adapt PRA methods for use in materials risk 

analyses, perform material risk studies, and 

support the development of guidance for 

materials risk regulatory activities. The 

intended outcome of this research will be 

improved effectiveness and realism of 

agency regulation in the Nuclear Materials 

Safety arena by better focusing staff and 

licensee resources on the most risksignificant issues.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XIV

Observations on the Nuclear Regulatory 

Commission’s Efforts to Address Its Major 

Management Challenges

Page 114 GAO-03-225 Status of Addressing Major Management Challenges

Improving financial management 

systems: NRC needs to develop and 

implement a cost accounting system. 

NRC’s Office of the Inspector General 

identified the lack of a cost accounting 

process as a material weakness constituting 

an instance of substantial noncompliance 

with the Federal Financial Management 

Improvement Act.

As in the prior 2 years, NRC did not 

implement a cost accounting system to 

provide its managers with reliable and 

routine information for decision-making 

purposes in fiscal year 2001. As a result, 

NRC was found to still be in substantial 

noncompliance with the Federal Financial 

Management Improvement Act of 1996 

(FFMIA) by its independent auditors and its 

OIG. This noncompliance issue was first 

identified in its fiscal year 1998 audit. NRC 

has under development a new cost 

accounting system to address this issue and 

states that it expects to implement it in fiscal 

year 2002.

NRC’s independent auditors and its OIG 

also identified a new instance of substantial 

noncompliance by NRC with FFMIA in the 

area of accounting for internal use software. 

NRC did not have an adequate system to 

track the labor incurred for internal use 

software development activities. In its 

response to the audit report, NRC told the 

OIG that in fiscal year 2002 it planned to 

implement a new system to integrate human 

resources, payroll, and time and labor, and 

to be a single system for time, attendance, 

and labor reporting. NRC expects this 

system to correct all of the system 

weaknesses identified in the 

Payroll/Personnel System. 

NRC does discuss both of these material 

internal control weaknesses and its 

noncompliance with FFMIA in an overview 

section (management’s discussion and 

analysis) of the fiscal year 2001 

performance report where it states that 

some progress had been made in 2001 and 

mentions that it expects to implement 

systems to correct these weaknesses during 

fiscal year 2002. However, NRC OIG’s 

assessment does not mention NRC’s 

substantial noncompliance with either of 

these FFMIA standards in the section of the 

report that discusses its actions to address 

NRC’s fiscal year 2003 performance plan 

does not contain any performance goals, 

performance measures, or implementing 

strategies that directly relate to this 

challenge. The plan does contain one 

implementing corporate management 

strategy that indirectly addresses this 

challenge and one program output measure 

that directly addresses this challenge. The 

implementing corporate management 

strategy discusses strengthening NRC’s 

financial systems and processes to ensure 

that financial assets are adequately 

protected consistent with risk and that its 

financial information is better integrated with 

decision-making. The management 

program output measure states that NRC’s 

fiscal year 2002 financial statement audit will 

find no material weaknesses. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XIV

Observations on the Nuclear Regulatory 

Commission’s Efforts to Address Its Major 

Management Challenges

Page 115 GAO-03-225 Status of Addressing Major Management Challenges

its management challenges. NRC does 

state in this section that it had a number of 

significant achievements in financial 

management in fiscal year 2001. These 

achievements include the CFO’s evaluation 

of the status of the implementation of new 

systems that support cost accounting and 

revision of the accounting remediation plan 

for implementing a new cost accounting 

system in January 2002; the CFO’s review 

of the potential of creating more meaningful 

cost reports to better meet the needs of 

managers on an interim basis (prior to 

implementing a new cost accounting 

system); and the development of a 

statement of work for a new Consolidated 

Information Support Services (CISSCO) II 

program that addresses the financial 

management weaknesses of the original 

CISSCO I program that ended in August 

2001. 

Information technology issues: NRC 

experienced problems with implementing a 

new document capture and retrieval 

system—Agencywide Documents Access 

and Management System (ADAMS).

NRC’s fiscal year 2001 performance report 

does not address the issues associated with 

the implementation of its ADAMS system in 

its management challenge actions. Instead, 

NRC identifies a number of process 

improvements and initiatives aimed at 

expanding productivity and enhancing 

customer service under the President’s 

direction toward electronic government as a 

management priority. As a key component 

of its electronic government activities, NRC 

states that it launched the Electronic 

Information Exchange (EIE) production 

system. NRC states that it is also 

developing an Electronic Licensing rule that 

will allow NRC licensees and others to 

electronically submit almost all documents 

and data via EIE, as well as CD-ROM, email, and fax. 

NRC’s fiscal year 2003 performance plan 

contains no performance goals, 

performance measures, or implementing 

strategies for addressing this challenge. 

However, NRC did develop four new 

corporate management strategies to help 

accomplish its strategic and performance 

goals in its 2003 performance plan. One of 

these new corporate strategies is to provide 

proactive information management and 

information technology services. Several of 

the implementing strategies for this 

corporate strategy indirectly relate to this 

challenge and one management program 

output measure states that NRC installed an 

updated version of ADAMS in fiscal year 

2001 and plans to evaluate results of 

alternative approaches and feed-in to work 

in ADAMS during fiscal year 2003.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 116 GAO-03-225 Status of Addressing Major Management Challenges

Appendix XV

Observations on the National Science 

Foundation’s Efforts to Address Its Major 

Management Challenges ApendxiXV

The following table identifies the major management challenges 

confronting the National Science Foundation (NSF) in the governmentwide 

high-risk areas of strategic human capital management and information 

security. The first column lists the challenges identified by our office. The 

second column discusses what progress, as discussed in its fiscal year 2001 

performance report, NSF made in resolving its challenges. The third 

column discusses the extent to which NSF’s fiscal year 2003 performance 

plan includes performance goals and measures to address the challenges 

that we identified. We found that NSF’s performance report discussed the 

agency’s progress in resolving its challenges.

NSF’s performance plan had goals and measures directly related to both 

major management challenges.
Appendix XV

Observations on the National Science 

Foundation’s Efforts to Address Its Major 

Management Challenges

Page 117 GAO-03-225 Status of Addressing Major Management Challenges

Table 16: Major Management Challenges for NSF

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management:

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose 

size, skills, and deployment meet agency 

needs; and creating results-oriented 

organizational cultures.

NSF’s 2001 performance report addresses 

one of the four human capital management 

issues: acquiring and developing a staff 

whose size, skills, and deployment meet 

agency needs. NSF met its management 

goal to improve staff diversity by increasing 

the total number of science and engineering 

hires at NSF from underrepresented groups. 

NSF also met its management goal that 95 

percent of grant proposals will be reviewed 

electronically through FastLane. According 

to NSF’s performance report, this 

investment provides incentives for the 

recruitment and retention of high-quality 

employees.

The 2003 performance plan addresses the 

management of human capital in four 

performance goals for management: a 

strategic business analysis, an increase in 

hiring for science and engineering positions 

from underrepresented groups, preparation 

of a diversity plan, and development of a 

NSF training academy. Additionally, a short 

“resources required” section has been 

developed for a number of management 

goals. Further, NSF has addressed aspects 

of creating a results-oriented organizational 

culture as a part of the Government 

Performance and Results Act (GPRA) 

process.

In addition, according to NSF’s 

Administration and Management Strategic 

Plan, NSF conducted an agencywide 

workforce planning exercise that identified 

the need for additional staff to meet 

increasing workload requirements. 
Appendix XV

Observations on the National Science 

Foundation’s Efforts to Address Its Major 

Management Challenges

Page 118 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show that federal computer 

systems are riddled with weaknesses that 

make them highly vulnerable to computerbased attacks and place a broad range of 

critical operations and assets at risk of 

fraud, misuse, and disruption. Further, the 

events of September 11, 2001, underscored 

the need to protect America’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both.

NSF reported in its 2001 performance report 

that it had taken steps to strengthen its 

information systems security. Specifically, 

NSF reported that it had implemented an 

agencywide program that encompasses all 

aspects of information security, including (1) 

policy and procedures, (2) risk assessments 

and security plans, (3) managed intrusion 

detection services, (4) vulnerability 

assessments, and (5) technical and 

management security controls. For 

example, NSF appointed an Automated 

Data Processing Security Officer to 

coordinate Information Technology Security 

(ITS) Program plans and required computer 

security awareness training for all 

employees and contractors. 

NSF’s fiscal year 2003 performance plan 

noted that the agency had established a 

performance goal to maintain and enhance 

the agencywide security program to ensure 

adequate protection of its information 

technology infrastructure and critical assets. 

This goal was established in accordance 

with the Government Information Security 

Reform Act (GISRA), OMB Circular A-130, 

and the Computer Security Act of 1987. The 

performance goal provides that 100 percent 

of mission-critical systems will have 

documented risk assessments and 

approved security plans.

However, NSF’s indicators and strategies for 

success need to be specifically tied to the 

security assessment framework, developed 

by the National Institute for Standards and 

Technology (NIST), and related tools for 

determining the status of its information 

security programs. In addition, OMB’s 

GISRA reporting guidance requires specific 

performance measures, as well as 

corrective action plans with quarterly status 

updates.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 119 GAO-03-225 Status of Addressing Major Management Challenges

Appendix XVI

Observations on the Office of Personnel 

Management’s Efforts to Address Its Major 

Management Challenges ApendxiXVI

The following table identifies the major management challenges 

confronting the Office of Personnel Management (OPM), which include the 

governmentwide high-risk areas of strategic human capital management 

and information security. The first column lists the challenges identified by 

our office. The second column discusses what progress, as discussed in its 

fiscal year 2001 performance report, OPM made in resolving its challenges. 

The third column discusses the extent to which OPM’s fiscal year 2003 

performance plan includes performance goals and measures to address the 

challenges that we identified. We found that OPM’s performance report 

discussed the agency’s progress in resolving both of its major management 

challenges—strategic human capital management and information security. 

In addition, we found that OPM’s performance plan had goals and measures 

to address both of the governmentwide management challenges. 
Appendix XVI

Observations on the Office of Personnel 

Management’s Efforts to Address Its Major 

Management Challenges

Page 120 GAO-03-225 Status of Addressing Major Management Challenges

Table 17: Major Management Challenges for OPM

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management:

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures. OPM also faces shortcomings in 

many of these areas. 

As the President’s agent and advisor for 

human resource matters, OPM is charged 

with leading the governmentwide human 

capital initiative. This initiative is part of the 

President’s Management Agenda, released 

to agencies governmentwide in August 

2001. 

The report states that OPM met its 

corporate management strategy of 

recruiting, developing, and maintaining a 

highly skilled and diverse workforce 

necessary to accomplish current and future 

strategic goals with efficiency and 

innovation. Specifically, the report states 

that OPM has

• created a comprehensive human capital 

action plan to address all elements of the 

human capital initiative on the President’s 

Management Agenda,

• established a cross-organizational task 

force to develop a leadership succession 

plan,

• implemented new automated staffing 

software to streamline staffing processes,

• established a Delegated Examining Unit 

within OPM to facilitate a more efficient 

and cost-effective method of filling 

positions, 

• secured training slots for “Introduction to 

Supervision” so that all new supervisors 

and select aspiring supervisors can attend 

the training, 

• laid the groundwork for a new OPM Virtual 

University, which allows employees access 

to thousands of online training courses,

• improved its work environment by 

expanding the use of certain family friendly 

flexibilities, which resulted in almost 30 

percent of OPM employees participating in 

telecommuting on a scheduled or ad-hoc 

basis, and 

• promoted other family friendly options, 

such as nursing mothers’ lactation 

facilities, family-medical leave entitlements, 

alternative work schedules, and health and 

wellness programs. 

The plan has six goals directly applicable to 

this challenge. These goals are the 

following. 

• OPM manages its workforce strategically 

and aligns its human resources in a 

manner that best supports 

accomplishment of the agency’s strategic 

goals and furthers the President’s 

Management Agenda. 

• Recruitment and staffing strategies are 

based on workforce planning information 

and facilitate the hiring of a diverse, 

capable, and flexible workforce. 

• Innovative employee education and 

training programs and practices cultivate a 

workforce that is flexible, optimally trained, 

and capable of adapting to changing 

technology. 

• OPM’s work environment attracts, retains, 

and satisfies employees and managers. 

• OPM’s Office of Human Resources and 

Equal Employment Opportunity 

(OHREEO) uses the best available 

technology for personnel data processing 

and recordkeeping to provide fast, 

accurate, and efficient human resources 

services. 

• OPM’s work environment promotes and 

values diversity and is free from unlawful 

discrimination.

To meet these goals, among other activities, 

OPM states that it will do the following. 

• Develop consultative skills and technical 

competencies of OHREEO staff to 

enhance their ability to be strategic 

advisors to OPM managers. 
Appendix XVI

Observations on the Office of Personnel 

Management’s Efforts to Address Its Major 

Management Challenges

Page 121 GAO-03-225 Status of Addressing Major Management Challenges

• Educate OPM managers and supervisors 

about existing strategic human capital 

flexibilities that support recruitment and 

retention efforts. 

• Provide general needs training to close 

common skill gaps that exist across 

organizational lines.

• Improve managers’ access to employee 

relations policy and guidance and help 

them deal effectively with 

performance/conduct issues. 

• Implement new technological efficiencies 

in human resources transaction 

processing. 

• Continue to assess organizations that are 

at high risk for workplace disputes that 

result in grievances and complaints of 

discrimination and provide quarterly 

analysis to OPM senior managers. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVI

Observations on the Office of Personnel 

Management’s Efforts to Address Its Major 

Management Challenges

Page 122 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show federal computer systems 

are riddled with weaknesses that make them 

highly vulnerable to computer-based attacks 

and place a broad range of critical 

operations and assets at risk of fraud, 

misuse, and disruption. Further, the events 

of September 11, 2001, underscored the 

need to protect America ’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both.

OPM reports that during fiscal year 2001, it 

developed a new computer security policy 

that enhanced its information technology 

security program, and that extensive reviews 

of its information technology security by an 

outside auditor and the Office of Inspector 

General (OIG) uncovered no material 

weaknesses. In addition, OPM reports 

progress in implementing a systems 

development life-cycle process for its 

information technology projects. However, it 

also reports that a review of its financial 

management systems by an outside auditor 

found that, on an agencywide level, OPM did 

not provide adequate system security in that 

it does not have coordinated security 

procedures, lacks effective incidence 

response and monitoring capabilities, does 

not conduct periodic risk assessments, and 

has not developed adequate securityrelated processes to protect its assets from 

unauthorized access or improper use. OPM 

also reports the need to strengthen four 

specific areas of electronic data processing 

(EDP) general controls: 

(1) entitywide security, (2) access control, 

(3) control over application changes and 

systems development, and (4) service 

continuity planning.

In the audit of OPM’s fiscal year 2001 

consolidated financial statements, an 

outside auditor identified OPM’s EDP 

general control environment as a reportable 

condition noting that this environment had 

substantially not changed from the prior 

year. The auditor notes that while OPM has 

recently improved security controls, certain 

controls still need improvement to prevent 

and detect unauthorized changes to 

financial information, control access to 

sensitive information, and protect its 

information resources. These weaknesses 

are consistent with those identified by OPM 

in its performance report, but also include 

weaknesses related to system software 

controls (controls that limit and monitor 

access to the program and sensitive files 

that control the computer hardware and 

As part of its overall information technology 

management strategy, OPM’s goal is to 

protect its mission-critical systems, 

infrastructure, and information with a robust 

information technology security program. 

OPM does not identify any specific 

performance measures associated with this 

goal, but does indicate that it plans to 

resolve all remaining security issues during 

fiscal year 2002. OPM told us that all major 

milestones and plans scheduled to be 

accomplished in fiscal year 2002 were 

accomplished during that year.

In addition to Government Performance and 

Results Act reporting, the Office of 

Management and Budget’s guidance for 

fiscal year 2002 reporting under the 

Government Information Security Reform 

Act (GISRA) requires specific information 

security performance measures, as well as 

corrective action plans with quarterly status 

updates. OPM told us that all reports under 

this requirement have been filed.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVI

Observations on the Office of Personnel 

Management’s Efforts to Address Its Major 

Management Challenges

Page 123 GAO-03-225 Status of Addressing Major Management Challenges

secure applications supported by the 

system) and segregation of duties controls 

for application programmers. 

In its evaluation of OPM’s security program 

and practices required by GISRA, the OIG 

identified security requirements not met by 

OPM’s program, including that it had not 

developed a formal risk assessment 

methodology, implemented an agencywide 

security program, implemented a security 

training program to ensure that employees 

with critical information technology 

responsibilities are sufficiently trained, or 

formally established a computer incident 

response capability.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 124 GAO-03-225 Status of Addressing Major Management Challenges

Appendix XVII

Observations on the Small Business 

Administration’s Efforts to Address Its Major 

Management Challenges ApendxiXVI

The following table identifies the major management challenges 

confronting the Small Business Administration (SBA), which include the 

governmentwide high-risk areas of strategic human capital management 

and information security. The first column lists the challenges identified by 

our office. The second column discusses what progress, as discussed in its 

fiscal year 2001 performance report, SBA made in resolving its challenges. 

The third column discusses the extent to which SBA’s fiscal year 2003 

performance plan includes performance goals and measures to address the 

challenges that we identified. We found that SBA’s performance report 

discussed the agency’s progress in resolving all of its challenges.

Of the agency’s six major management challenges, its performance plan 

had

1. goals and measures that were directly related to the challenge of 

streamlining and automating disaster loan processing and improving 

timeliness,

2. goals and measures that were indirectly applicable to the challenges of 

focusing the 8(a) program on helping firms obtain contracts to 

increasing procurement opportunities, and

3. no goals and measures related to four of the challenges, but discussed 

strategies to address the challenges, which were

• strategic human capital management,

• information security,

• strengthen human capital, information technology, budget, and financial 

management practices to help modernize SBA, and

• continue to improve oversight of SBA’s lending partners to correct 

oversight weaknesses.
Appendix XVII

Observations on the Small Business 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 125 GAO-03-225 Status of Addressing Major Management Challenges

Table 18: Major Management Challenges for SBA

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management:

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures.

 

SBA reported that human capital planning is 

more important than ever because 

technology, an increasing demand for small 

business information and training, and 

changes in loan processing functions will 

require significant changes in SBA 

personnel needs. SBA will have fewer 

employees involved in loan processing, and 

more employees focused on outreach and 

lender oversight. Additionally, SBA will 

increasingly require personnel proficient in 

using and applying new technologies. 

SBA refers to transforming the workforce as 

one of its corporate management strategies 

and as an agency management challenge 

identified by the SBA Office of Inspector 

General (OIG). The SBA OIG notes that 

SBA has made some progress in areas 

such as analyzing the tasks that need to be 

performed by SBA today, developing 

competency models, and providing 

adequate training. However, SBA had not 

made substantial progress in over half the 

action areas outlined by the SBA OIG. 

As GAO testified on July 16, 2002,a

 SBA’s 

current structure contributes to the 

challenges SBA faces in delivering services 

to the small business community. In 

particular, ineffective lines of 

communication; confusion over the mission 

of district offices; complicated, overlapping 

organizational relationships; and a field 

structure not consistently matched with 

mission requirements combine to impede 

the efforts of SBA staff to deliver services 

effectively. To guide organizational changes 

and to respond to challenges raised by 

GAO, OMB, and the SBA OIG, SBA drafted 

a plan for a 5-year workforce transformation. 

The draft plan recognizes SBA’s need to 

restructure its workforce, privatize noncore 

functions, adjust incentives and goals, and 

streamline its headquarters’ operation. 

This issue is listed under a section in the 

performance plan on SBA’s corporate 

management strategies. There are no 

directly applicable measures included for 

this strategy. According to SBA, it treats 

this strategy as an internal management 

function and therefore does not publish 

directly available measures for the strategy. 

The plan provides a list of major activities 

planned for fiscal year 2003 that includes, 

among other things, beginning the 

implementation of the 5-year Workforce 

Restructuring Plan; reducing the number of 

organizational layers in headquarters; and 

implementing the results of fiscal 2002 pilot 

projects for alternate district office operating 

models. 
Appendix XVII

Observations on the Small Business 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 126 GAO-03-225 Status of Addressing Major Management Challenges

In commenting on this appendix, SBA noted 

that it has made much progress on its 

Human Capital initiative and was recognized 

by the Office of Personnel Management in 

the last two quarters of fiscal year 2002 with 

a green light on progress in implementing 

this area of the President’s Management 

Agenda.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVII

Observations on the Small Business 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 127 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show federal computer systems 

are riddled with weaknesses that make them 

highly vulnerable to computer-based attacks 

and place a broad range of critical 

operations and assets at risk of fraud, 

misuse, and disruption. Further, the events 

of September 11, 2001, underscored the 

need to protect America ’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both.

SBA reports that systems security was 

found to be a reportable condition in the 

audit of its fiscal year 2001 financial 

statements. In response, SBA’s corporate 

management strategy to modernize its 

information systems includes efforts to 

improve systems security by 

institutionalizing its security program 

management procedures, developing an 

organizational framework for identifying and 

assessing risks and deciding what mix of 

policies and controls are needed, regularly 

evaluating the effectiveness of information 

technology security policies and controls, 

and acting to address any identified 

weaknesses. Further, while not discussed in 

detail in its fiscal year 2001 performance 

and accountability report, SBA’s fiscal year 

2003 budget request and performance plan 

identifies specific actions taken to improve 

information security, including

• committing over $1.2 million in personnel 

and contract support to enhance its 

computer security program,

• issuing an updated computer security 

policy document that incorporated security 

policies covering the latest agency 

technology, including client servers, e-mail, 

and the Internet,

• documenting the computer security 

program and producing guidance 

documents and templates for the 

performance of computer security 

functions within the agency,

• completing certification and accreditation 

reviews for 38 of the most sensitive 

systems,

• developing a security training program, 

and

• continuing work on developing critical 

infrastructure protection and security 

plans.

In its 2001 performance and accountability 

report, SBA included its independent 

auditor’s report on its internal controls. The 

independent auditor noted improvements in 

SBA’s internal control over its information 

In its 2003 plan, SBA addressed information 

security as part of its corporate 

management strategy for modernizing 

information systems. However, there were 

no directly applicable goals or measures for 

this strategy in the plan. According to SBA, 

it treats this strategy as an internal 

management function and therefore does 

not publish directly applicable measures for 

the strategy. SBA plans to continue to 

address specific OIG information security 

audit recommendations. In discussing the 

status of these recommendations in its fiscal 

year 2001 performance and accountability 

report, SBA also noted that because of the 

long-term nature of implementing a security 

program, completion of final action on some 

recommendations is not scheduled until the 

fiscal year 2002 to 2004 time frame. 

The National Institute of Standards and 

Technology developed a security 

assessment framework and related tools 

that agencies can use in determining the 

status of their information security programs. 

Also, OMB guidance for fiscal year 2002 

reporting under the Government Information 

Security Reform Act (GISRA) requires 

agencies to use tools developed by NIST to 

evaluate the security of unclassified systems 

or groups of systems. 

In addition, OMB’s GISRA reporting 

guidance requires specific performance 

measures, as well as corrective action plans 

with quarterly status updates. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVII

Observations on the Small Business 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 128 GAO-03-225 Status of Addressing Major Management Challenges

system environment, but also identified the 

need for improvements in each of the six 

categories of controls reviewed: entitywide 

security program, access controls, 

application software development and 

program change, system software, 

segregation-of-duties, and service 

continuity. 

The OIG also evaluated SBA’s security 

program as required by GISRA and reported 

that SBA generally maintains a satisfactory 

information security program for its highpriority financial management and general 

support systems and has developed and 

issued policies and procedures to address 

security protections agencywide. However, 

the OIG also reported that information 

security vulnerabilities continue to exist that 

will require continued management 

emphasis with appropriate underlying 

resources. These vulnerabilities are 

computer security system testing and 

program monitoring, system access 

controls, and disaster recovery and 

contingency planning. 

GAO-designated major management 

challenge

Streamline and automate disaster loan 

processing to improve timeliness: In our 

2001 Performance and Accountability Series

SBA report, we said that SBA needs to be 

able to quickly expand its loan processing 

capabilities, including hiring and training 

damage inspectors, loan officers, and other 

staff to provide consistent, timely 

assistance.

SBA reported that it is continuing to seek 

ways to improve response times and reduce 

costs through a modernization effort. The 

Office of Disaster Assistance is focusing on 

internal streamlining efforts such as 

providing applicants with the ability to apply 

online or by telephone and the use of 

electronic files for processing and managing 

the program. 

The plan, as updated in August 2002, 

includes a disaster lending goal and five 

measures that directly relate to disaster loan 

processing, (1) SBA field presence 

established within 3 days, 

(2) applications processed within 21 days, 

(3) customer satisfaction, (4) making initial 

disbursement of loan proceeds within 5 days 

of closing a loan, and (5) conducting quality 

assurance reviews of each disaster office to 

ensure compliance with program 

underwriting procedures. SBA also lists the 

continued of development and 

implementation of the Disaster Assistance 

Credit Management Modernization Initiative 

as a major activity for fiscal year 2003.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVII

Observations on the Small Business 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 129 GAO-03-225 Status of Addressing Major Management Challenges

Strengthen human capital, information 

technology, budget, and financial 

management practices to help modernize 

SBA.

Human capital: This issue was discussed 

under the governmentwide, high-risk areas 

identified by GAO.

Information technology: SBA addressed 

modernizing its information systems under 

the corporate management strategies 

section of its performance report. SBA said 

that it has undertaken a multiyear 

information technology management 

improvement and systems modernization 

effort that upgrades its infrastructure, offers 

electronic access, and ensures timely and 

accurate information. SBA listed its major 

accomplishments in fiscal year 2001 as 

• implemented a pilot of electronic loan 

applications, 

• implemented a new lender information 

system, 

• continued implementation of the ClingerCohen Act with implementation of new 

procedures such as the Information 

Technology Investment Manual and 

development of other draft procedures, 

and 

• completed SBA’s Government Paperwork 

Elimination Act implementation plan. 

However, SBA’s OIG said that although SBA 

has made some progress, it needs to 

formulate and implement sound procedures 

for system development and software 

acquisition for all its systems under 

development. In commenting on this 

appendix, SAB said that it published a 

System Development Methodology in 

November 2001 that it uses as the official 

guide for systems development in the 

agency.

Budget: SBA addressed developing an 

activity-based budgeting process to link 

resources to strategic goals within a strategy 

on managing for results in the corporate 

management strategies section of its 

performance report. SBA also reported the 

implementation of a Web-based cost 

allocation survey and system to tie 

SBA included a section on corporate 

management strategies that includes 

managing human capital more strategically 

(this issue was discussed under the 

governmentwide, high-risk areas), improving 

information technology management, 

integrating performance with the budget, 

and improving financial management 

information. However, no goals or measures 

were provided for these strategies. 

According to SBA, it treats these strategies 

as internal management functions and 

therefore does not publish directly applicable 

measures for the strategies. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVII

Observations on the Small Business 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 130 GAO-03-225 Status of Addressing Major Management Challenges

a

U.S. General Accounting Office, Small Business Administration: Workforce Transformation Plan is 

Evolving, GAO-02-931T (Washington, D.C.: July 16, 2002).

resources to activities and results and 

beginning integration of cost accounting with 

the budget planning and execution process 

as a major accomplishment in fiscal year 

2001.

Financial Management: SBA addressed 

improving financial management under the 

corporate management strategies section of 

its performance report. SBA said that it had 

received its sixth unqualified audit opinion 

on its fiscal year 2001 financial statements 

and had improved its internal control 

framework. 

Continue to improve oversight of SBA’s 

lending partners to correct oversight 

weaknesses.

SBA reported that it is strengthening the 

oversight of its lending partners through 

continued efforts to put in place automated 

systems that will provide more 

comprehensive data on the loans that it 

guarantees and greater access to that data. 

Although SBA’s plan states that loan risk 

management issues have assumed a higher 

priority, much of SBA’s planned effort in this 

regard has not been completed. For 

example, SBA does not perform routine 

analyses of its portfolio to assess financial 

risk, and current SBA preferred lending 

partner reviews are not designed to evaluate 

financial risk. 

There were no directly applicable goals or 

measures. However, one of the strategies 

included under corporate management 

strategies was improving credit program 

management. SBA also listed key 

objectives for this area. Among other things, 

they included 

• expanding existing portfolio analysis to 

provide more detailed and timely 

information and related analysis of 

performance trends,

• conducting loan and investment analyses 

to understand performance and to identify 

areas of program risk, and 

• analyzing, revising, and as appropriate, 

expanding existing credit program 

performance measures so that they are 

reflective of risk. 

Focus the 8(a) program on helping firms 

obtain contracts to increase 

procurement opportunities.

SBA identified concentration of contracts as 

a material weakness in its fiscal year 2000 

Performance and Accountability Report. 

However, the SBA OIG reported that SBA 

had not acted or made substantial progress 

with respect to this challenge. SBA stated 

that to enhance the effectiveness of the 8(a) 

program, it would develop and implement a 

plan that would focus on providing business 

development assistance to ultimately result 

in a more equitable distribution of program 

benefits. 

The plan contains the goal of empowering 

entrepreneurs, but the measure does not 

directly relate to helping 8(a) firms obtain 

contracts. In September 2001, SBA 

committed to the SBA OIG to improve its 

performance measures for the 8(a) program. 

As of September 30, 2002, the 

recommendations had not been acted on, 

according to the SBA OIG. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 131 GAO-03-225 Status of Addressing Major Management Challenges

Appendix XVIII

Observations on the Social Security 

Administration’s Efforts to Address Its Major 

Management Challenges ApendxiXVI

The following table identifies the major management challenges 

confronting the Social Security Administration’s (SSA) in the 

governmentwide high-risk areas of strategic human capital management 

and information security. The first column lists the challenges identified by 

our office. The second column discusses what progress, as discussed in its 

fiscal year 2001 performance report, SSA made in resolving its challenges. 

The third column discusses the extent to which SSA’s fiscal year 2003 

performance plan includes performance goals and measures to address the 

challenges that we identified. We found that SSA’s performance report 

discussed the agency’s progress in resolving all of its challenges.

Of the agency’s six major management challenges, its performance plan 

had

1. goals and measures that were directly related to five of the challenges 

and

2. no goals and measures related to one of the challenges, but discussed 

strategies to address the challenge, which was

• information security.
Appendix XVIII

Observations on the Social Security 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 132 GAO-03-225 Status of Addressing Major Management Challenges

Table 19: Major Management Challenges for SSA

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic Human Capital Management: 

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures.

SSA faces human capital management 

challenges due to an increasing demand for 

services, the imminent retirement of a large 

portion of its workforce, changing customer 

expectations, and mixed success in past 

technology investments. These conditions 

challenge SSA’s ability to meet service 

delivery demands, such as faster and more 

accurate benefit claims determinations and 

an increased emphasis on returning the 

disabled to work. The aging of the “baby 

boom” generation has heightened this 

challenge. In prior work we have 

recommended that SSA develop a more 

detailed service delivery plan that would 

provide a blueprint for assessing a proper 

staff and skill mix for operating in the future. 

SSA’s progress in this area is presented 

under its strategic goal to be an employer 

that values and invests in each employee. 

SSA reported that the focus of this goal is to 

ensure that SSA continues to have a highly 

skilled, high performing, and motivated 

workforce. SSA’s human capital strategic 

goal contained four strategic objectives, 

which addressed (1) providing workforce 

tools and training, such as access to 

interactive video training and management 

development programs, (2) providing a 

physical environment that promotes the 

health and well being of every employee, 

(3) promoting an agency culture that 

successfully incorporates SSA’s values, and 

(4) creating a skilled workforce to serve 

SSA’s diverse customers in the 21st century. 

To measure its progress towards its 2001 

strategic goal for human capital 

management, SSA had 15 performance 

goals, of which it reported 11 were met, 3 

were not, and data were not available for 1.

For example, SSA reported meeting its 

goals to

• implement formal management 

development programs; 

• complete various tests and surveys of the 

quality and security of its office facilities; 

and 

• implement and update its Future 

Workforce Transition Plan, which was 

published in June 2000. 

SSA’s human capital goals and strategies 

are presented under its strategic goal to be 

an employer that values and invests in each 

employee. This goal contains three 

strategic objectives, which address (1) 

providing workforce tools and training, such 

as access to interactive video training and 

management development programs; (2) 

providing a physical environment that 

promotes the health and well being of every 

employee; and (3) recruiting and developing 

a qualified and satisfied workforce to 

perform effectively in a changing future 

environment. Overall, these strategies and 

goals are similar to SSA’s 2002 plan. 

SSA’s plan contains revisions to several of 

its human capital strategic objectives and 

performance goals. For example, SSA’s 

plan deleted, without explanation, the 

strategic objective to promote an agency 

culture that successfully incorporates its 

values and to attain a 50 percent 

improvement in the gap between current 

and desired workplace practices and values 

by 2005. The deletion of this objective could 

limit SSA’s ability to implement and monitor 

not only its human capital-related initiatives, 

but also those in other parts of the agency, 

such as customer service. 

SSA’s 2003 plan maintains a strategic 

objective to address the need to recruit, 

develop, and retain a well-qualified and 

satisfied workforce to perform effectively in a 

changing future environment. This objective 

contains a performance goal to continue to 

implement SSA’s Future Workforce 

Transition Plan. Previously the percentage 

of employees satisfied with SSA as a place 

to work also served as a performance goal 

for this strategic objective. However, in its 

2003 plan, SSA deleted this performance 

goal, potentially diminishing its ability to 

develop strategies for retaining employees. 
Appendix XVIII

Observations on the Social Security 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 133 GAO-03-225 Status of Addressing Major Management Challenges

Regarding SSA’s Future Workforce 

Transition Plan, SSA has not yet reported 

that it met its fiscal year 2000 performance 

goal to complete an employee survey as an 

interim step to developing the transition 

plan. Fully meeting this goal requires that 

SSA complete the employee survey. We are 

particularly concerned that SSA did not 

complete this survey, which could have 

provided critical information for developing 

the transition plan. SSA reported it did not 

meet its goals to 

• create and implement an agency change 

strategy (SSA planned to drop this goal in 

2002 because it is undergoing too many 

organization changes); 

• attain 33-1/3 percent participation by 

managerial staff in leadership training (28 

percent participated), and

• provide 67 percent of its offices with direct 

access to interactive video training (access 

to 57.7 percent achieved).

SSA added a performance goal to this 

strategic objective to increase the retention 

rate of new hires through the use of 

competency-based tools. While adding a 

performance goal to measure the retention 

of new hires is a beneficial human capital 

management practice, SSA’s goal does not 

aim to increase the retention rate by a set 

explicit percentage. Rather, the plan stated 

only that SSA wanted to increase retention 

due to the use of competency-based tools, 

exclusive of environmental factors beyond 

SSA’s control. The development and use of 

a more clearly defined goal could further aid 

SSA’s ability to monitor and improve year-toyear performance in this area. 

SSA also revised a component of its 

strategic objective to provide the necessary 

tools, training, and continuous learning 

opportunities to maintain a highly skilled and 

high performing workforce by the year 2005. 

Specifically, it lowered its goal of providing 

its employees necessary competency-based 

training and tools from “all” to “70 percent” of 

employees. SSA did not explain why it 

lowered this goal. Finally, SSA’s plan 

contains information on program evaluations 

and key initiatives in support of their 

strategic goal to value and invest in each 

employee. For example, SSA anticipates 

completing studies on attrition patterns and 

recruiting processes in 2003. 

The plan also contains an appendix, which 

lists key initiatives related to human capital 

management, such as the implementation of 

competency-based selection tools and a 

training administration system. However, 

the appendix does not contain 

implementation schedules, which were 

included in its fiscal year 2002 plan, making 

it difficult to monitor SSA’s progress in these 

areas. In addition, the fiscal year 2003 plan 

does not contain the key initiatives for 

implementing SSA’s workforce transition 

plan and leadership training, which were key 

initiatives in fiscal year 2002.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVIII

Observations on the Social Security 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 134 GAO-03-225 Status of Addressing Major Management Challenges

Information security: 

Our January 2001 high-risk update noted 

that agencies’ and governmentwide efforts 

to strengthen information security have 

gained momentum and expanded. 

Nevertheless, recent audits continue to 

show federal computer systems are riddled 

with weaknesses that make them highly 

vulnerable to computer-based attacks and 

place a broad range of critical operations 

and assets at risk for fraud, misuse, and 

disruption. Further, the events of 

September 11, 2001, underscored the need 

to protect America’s cyberspace against 

potentially disastrous cyber attacks—attacks 

that could also be coordinated to coincide 

with physical terrorist attacks to maximize 

the impact of both.

 

SSA’s 2001 report did not contain any 

specific performance indicators and goals 

related to information security. SSA’s fiscal 

year 2001 performance report is 

incorporated in its Accountability Report for 

that year. In the latter, SSA highlighted 

management improvement actions it took to 

improve the security of its information.

SSA has continued to make progress in 

addressing the information protection issues 

raised in prior years. Specifically, in fiscal 

year 2001 SSA has:

• conducted a risk assessment to identify 

critical assets and vulnerabilities as part of 

its Critical Infrastructure Protection Project;

• issued a final security policy for the State 

Disability Determination Service sites in 

accordance with the information security 

requirements included in the National 

Institute of Standards and Technology 

Special Publication 800-18;

• established and published technical 

security configuration standards for NT, 

Unix, AS 400, and firewall servers;

• completed updates for accreditation and 

certification of key systems; and 

• strengthened physical access controls 

over the National Computer Center.

While SSA has made progress in 

addressing information protection issues we 

raised in prior years, weaknesses in its 

security infrastructure persist. Until 

corrected, a weakened or incomplete 

information protection control structure will 

continue to impair SSA’s ability to mitigate 

the risk of unauthorized access, 

modification, or disclosure of sensitive SSA 

information. For example, through a 

contractor SSA found that it needed to 

further strengthen controls to protect its 

information and that weaknesses in controls 

expose key elements of SSA’s systems and 

networks to unauthorized access. These 

included SSA’s efforts to implement, 

enforce, and monitor security standards, 

network firewalls, and access controls at 

SSA’s 2003 performance plan does not 

include specific measurable goals and 

indicators related to its information security 

and information system weaknesses. 

However, the “management challenges” 

section of SSA’s fiscal year 2003 plan states 

that it intends to continue to strengthen its 

information systems controls. 

The 2003 plan discusses several ongoing 

initiatives to improve security awareness, 

such as security training for all new hires 

and certification training for security 

professionals. In addition, the plan contains 

an appendix, which lists key information 

security initiatives, such as one to “combat 

fraud.” However, this appendix does not 

contain the descriptions and implementation 

schedules contained in its fiscal year 2002 

plan, which makes it difficult to measure 

SSA’s progress.

To help SSA manage progress in this area, 

SSA should develop formal performance 

plan goals and measures to build upon 

commitments it presented in its fiscal year 

2003 plan. These included annually: (1) 

reviewing and re-certifying 100 percent of its 

sensitive system plans; (2) testing its 

Contingency Plan; and (3) testing its 

Incident Response Procedures. 

Improvements in this area are key to 

ensuring that automated agency data are 

both reliable and credible. 

In addition to reporting under GPRA, the 

Office of Management and Budget’s (OMB) 

guidance for fiscal year 2002 reporting 

under the Government Information Security 

Reform Act (GISRA) requires specific 

performance measures, as well as 

corrective action plans with quarterly status 

updates. SSA’s 2003 plan stated that it 

estimates issuing its GISRA report to OMB 

in 2003. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVIII

Observations on the Social Security 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 135 GAO-03-225 Status of Addressing Major Management Challenges

nonheadquarters locations. The contractor 

recommended that SSA (1) take actions to 

fully implement its information security 

framework such as assigning specific 

resources, with priority given to the 

implementation, enforcement, and 

monitoring of technical security standards; 

(2) fully implement technical security 

configuration standards; and (3) establish 

and enforce procedures for monitoring 

security violations. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVIII

Observations on the Social Security 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 136 GAO-03-225 Status of Addressing Major Management Challenges

GAO-designated major management 

challenge

Play an Active Research, Evaluation, and 

Policy Development Role: 

As the nation’s expert on social security 

issues, SSA is uniquely positioned to assess 

how economic and demographic trends 

affect its programs and to identify policy 

changes necessary to ensure efficient and 

cost-effective solutions for meeting 

recipients’ needs. However, we have 

testified and reported that SSA has not 

always been sufficiently active in using its 

research, evaluation, and policy 

components to identify areas where 

legislative or other changes are needed and 

to assist policymakers in developing options 

for change. Thus, SSA has missed 

opportunities to provide information to the 

Congress and other policymakers. 

SSA presents its progress related to this 

challenge under its strategic goal, to 

promote valued, strong, and responsive 

social security programs and conduct 

effective policy development, research, and 

program evaluation. This goal contains 

strategic objectives such as providing 

information for decisionmakers and others 

on Social Security and Supplemental 

Security Income (SSI) through objective and 

responsive research, evaluation, and policy 

development. 

SSA reported that it met nearly all of its 

fiscal year 2001 goals related to the 

strategic objectives for policy development, 

research, and program evaluation. Of SSA’s 

eight performance goals, it reported that 

seven were met and one was not. 

Performance goals in this area generally 

were output-oriented, such as the 

preparation of studies and analyses to 

support key SSA program challenges. 

For example, SSA reported meeting its 

goals to

• prepare analyses of proposals to 

strengthen the solvency of Old Age, 

Survivors, and Disability Insurance 

(OASDI) programs,

• analyze complex SSI policies,

• establish a baseline of customer 

satisfaction with the quality of its research 

products, and 

• measure the percent of statistical products 

that are issued on time. 

SSA reported it did not meet its goal to 

complete a report on welfare reform in 

conjunction with its SSI Childhood Disability 

Survey. 

We were unable to assess if SSA met its 

performance goal to issue a periodically 

updated research and policy agenda. SSA 

deleted this performance goal from its fiscal 

year 2001 report.

SSA’s plans to address this challenge are 

presented under the strategic goal to 

promote valued, strong, and responsive 

social security programs and conduct 

effective policy development, research, and 

program evaluation. Generally, these 

strategies and goals are similar to SSA’s 

2002 plan. 

SSA’s plan discusses its responsibility to 

address critical short- and long-term Social 

Security and Supplemental Security Income 

issues and contains strategic goals, 

objectives, and performance indicators that 

should help the agency play a more active 

research, evaluation, and policy 

development role. 

SSA’s plan maintains a performance goal to 

measure the percent of major statistical 

products produced on time. Also, SSA’s 

plan contains a customer-oriented goal to 

gauge user satisfaction with the quality and 

timeliness of its research products, an area 

in which we previously recommended that 

SSA take action. In this area, SSA reported 

that it plans to make improvements to its 

user satisfaction measures and to award a 

contract for a follow-up survey in 2003. 

For several of SSA’s planned activities, the 

agency did not sufficiently define its 

performance goals to be able to sufficiently 

track its progress. For example, in the areas 

of research to support its disability program, 

SSA stated that it will report on its status to 

develop a method to validate medical 

listings. However, the plan does not contain 

target dates or intermediate milestones to 

track progress in this area. SSA’s 2003 plan 

also lists goals for developing and using 

additional “barometer” measures to assess 

the effectiveness of the OASDI and SSI 

programs. These measures also did not 

specify milestones to help SSA track its 

progress. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVIII

Observations on the Social Security 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 137 GAO-03-225 Status of Addressing Major Management Challenges

Improve SSA’s disability determination 

process and return people to work: 

SSA’s disability determination process is 

time-consuming, expensive, fragmented, 

and complex. Ongoing weakness in making 

timely and accurate determinations result in 

beneficiaries often waiting more than 1 year 

for final disability decisions. Also, very few 

beneficiaries leave the rolls to return to 

work. The costs of administering the 

Disability Insurance (DI) and SSI programs 

reflect the demanding nature of these 

processes. In fiscal year 2001, SSA spent 

almost $4.1 billion or 57 percent of its 

administrative budget on these programs.

SSA’s progress related to this challenge is 

presented under its customer service, 

research and policy development, and 

program integrity strategic goals. 

SSA reported that it met about half of its 

performance goals related to making 

disability determinations more timely and 

accurate. SSA had 11 performance goals, 

of which it reported that 5 were met, 4 were 

not, and data were not available for 2. 

For example, SSA reported meeting its 

goals for

• the number initial disability claims 

processed,

• timeliness of processing initial disability 

claims, 

• the percent of its multiyear Continuing 

Disability Review (CDR) Plan completed, 

and

• periodic Continuing Disability 

Reviews(CDR) processed.

SSA reported it did not meet its goals to 

process

• 526,000 hearings (465,228 were 

processed),

• hearings on average in 271 days (average 

was 308 days),

• 103 hearings cases per work year (87 

were processed), and 

• 93.5 percent of its disability denial 

determinations accurately (rate was 92 

percent). 

In addition, SSA’s report showed that data 

were unavailable for two performance 

goals–the net accuracy of Disability 

Determination Service and State Office of 

Hearings and Appeals decisions. These 

data were also not available in SSA’s fiscal 

year 2000 report, which makes measuring 

SSA’s year-to-year progress in this area 

difficult. 

In fiscal year 2001, SSA’s performance in 

the return-to-work area dropped somewhat 

over the previous year. SSA reported that it 

SSA’s plans to address this challenge are 

included under its customer service, 

research and policy development, and 

program integrity strategic goals. Overall, 

these strategies and goals are similar to 

SSA’s 2002 plan. 

For fiscal year 2003, SSA maintained its 

strategic objective to increase the number of 

disability customers who receive timely 

services and payments. This objective 

should help SSA measure the percent of 

initial disability claims decisions issued 

within 120 days and the implementation of 

electronic processing of claims by 2005. 

Also, SSA added two key output indicators 

to its 2003 plan for pending disability claims 

and pending hearings, which we criticized 

SSA for deleting from its 2002 plan. These 

key disability process indicators should help 

SSA track its progress in these areas. 

The extent of SSA’s progress will depend on 

its ability to successfully implement 

supporting technology, which has been

challenging for SSA in the past. SSA’s plan 

has an indicator to have the software and 

infrastructure in place for electronic 

processing of disability claims and hearings 

cases, which builds upon its fiscal year 2002 

goal in this area. Despite these 

improvements, SSA’s plan still lacks an 

overall measure of timeliness of the entire 

disability determination process. 

Regarding the return-to-work area, the plan 

contains two performance goals to help 

measure SSA’s long-term success in 

returning people to work: (1) the percent 

increase in the number of DI beneficiaries 

whose benefits are suspended/terminated 

due to substantial gainful activity and (2) the 

percent increase in the number of SSI 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVIII

Observations on the Social Security 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 138 GAO-03-225 Status of Addressing Major Management Challenges

met four of its seven goals in this area in 

2001, whereas it reported that it met nearly 

all of them in fiscal year 2000. For example, 

SSA reported meeting its goals for

• identifying and defining “barometer” 

measures to assess the effectiveness of 

OASDI programs,

• preparing analyses of the effects of OASDI 

programs on different populations, and 

• preparing analyses of alternative return to 

work strategies.

SSA reported it did not meet its goals to

• increase the number of SSI disabled 

beneficiaries aged 18 to 64 who are 

working but still receiving benefits by 

27,061 individuals (increase was 24,816) 

and 

• prepare analyses of its National Study on 

Health Activity to improve its disability 

determination process. 

For the goal to increase the number of DI 

adult worker beneficiaries who begin a trial 

work period, SSA did not have data for its 

fiscal year 2001 report (SSA reported in its 

2000 report that it did not meet this goal). 

 

disabled beneficiaries who no longer receive 

benefits due to work. SSA’s plan showed 

that it postponed implementation of the 

indicators from 2005 to 2007. Moreover, 

SSA’s plan did not specify performance 

targets for these measures, establishing 

instead interim indicators to measure the 

start of work activity. In addition, for the 

return-to-work area, SSA’s plan contains 

performance goals to monitor its efforts to 

(1) validate medical listings and (2) prepare 

its National Study on Health Activity report. 

However, the goals for these activities are to 

provide “status reports,” and do not contain 

time frames for meeting milestones or final 

completion dates. 

SSA also has not developed a 

comprehensive strategy, as we 

recommended, to develop earlier 

intervention and work capacity identification 

strategies or sufficiently integrate its returnto-work and disability redesign efforts. The 

absence of such a strategy and 

accompanying performance goals will likely 

hinder SSA’s future efforts to make 

significant strides in the return-to-work area. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVIII

Observations on the Social Security 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 139 GAO-03-225 Status of Addressing Major Management Challenges

Sustain management and oversight of 

long-standing, high-risk Supplemental 

Security Income (SSI) issues: 

We designated the SSI program high-risk in 

1997 due to continued waste, fraud, and 

mismanagement. 

SSA’s progress related to this challenge is 

addressed under its strategic goal to ensure 

the integrity of social security programs with 

zero tolerance for fraud and abuse. 

SSA reported it met its target goals for 

nearly all of its performance goals in this 

area in fiscal year 2001. Of SSA’s 10 

performance goals, it reported that 7 were 

met and data were not available for 3. 

SSA increased and met its targets for 6 of 7 

goals, and attributed this to additional OIG 

resources and higher than anticipated return 

on investigative and debt collection 

activities. For example, SSA reported 

meeting its goals for the

• amount of SSI debt collected,

• number of investigations closed, 

• SSI dollar amounts reported from 

investigative activities, and

• SSI nondisability redeterminations.

However, we were unable to assess SSA’s 

performance in the accuracy of SSI 

payments, as SSA did not report this data in 

its fiscal year 2001 report. Data for this 

performance goal was also not reported in 

SSA’s fiscal year 2000 report. SSA’s plan 

and report acknowledges that this data was 

not available at the time of publication. In 

prior work however, we have recommended 

that SSA ensure that all key data necessary 

to measure SSA’s progress be included in 

its reports.

SSA’s plans in this area are included under 

its strategic goal to ensure the integrity of 

social security programs, with zero tolerance 

for fraud and abuse. These strategies and 

goals are similar to SSA’s 2002 plan. 

SSA’s plan reaffirms its commitment to 

improve SSI program integrity and highlights 

its key goals related to improving SSI 

management. For example, SSA increased 

all of its performance goals for its strategic 

objective to deter, identify, and resolve fraud, 

namely the

• dollar amounts reported from SSI 

investigations,

• number of judicial actions reported, and

• number of investigations closed.

SSA revised its goal to track outstanding 

SSI debt, which we criticized last year, to 

measure outstanding SSI debt not in a 

collection arrangement, excluding due 

process. SSA’s previous goal measured 

outstanding SSI debt in a repayment 

agreement, under appeal, or newly 

detected. However, we are concerned that 

the new measure still does not track actual 

debt collected by SSA in a given fiscal year. 

SSA’s new measure generally contains the 

same components of the prior measure, 

which we previously criticized—e.g., the 

level of outstanding debt that is in a 

repayment agreement, under appeal, or 

newly detected, and debt not being 

collected. 

 

SSA also revised its measure of the 

“number of criminal convictions conducted” 

to instead track the “number of judicial 

actions reported.” SSA reported that it 

made this revision because actions it 

counted in the universe of “criminal 

convictions,” such as arrests and trial 

appearances, were actually broader than 

the legal definition of a criminal conviction. 

While this revision helps clarify SSA’s 

actions we believe that a separate measure 

on the total number of convictions—which is 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVIII

Observations on the Social Security 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 140 GAO-03-225 Status of Addressing Major Management Challenges

the ultimate barometer of SSA’s anti-fraud 

efforts—should be included in its plans. 

Finally, SSA has not yet implemented 

improvements in its performance plan that 

we cited last year, such as more clearly 

linking its goals and measures for CDRs, 

investigations, and convictions to the SSI 

program. Nor has SSA developed additional 

indicators of anti-fraud efforts, such as 

tracking the number of civil and monetary 

penalties levied. These actions would 

further facilitate SSA’s efforts to improve SSI 

program integrity. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVIII

Observations on the Social Security 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 141 GAO-03-225 Status of Addressing Major Management Challenges

Better position SSA for future service 

delivery challenges: 

SSA faces significant challenges that could 

hamper its ability to provide high-level 

service delivery over the next decade and 

beyond. SSA expects to experience a 

significant increase in the demand for 

services as the baby boom generation ages. 

In addition, the imminent retirement of a 

large portion of SSA’s own workforce over 

the next decade and changing customer 

expectations for the types of services 

delivered will further strain agency 

operations.

While SSA reported that it is working to 

develop detailed plans and strategies to 

serve as a roadmap for meeting its future 

resource and workload challenges—

specified in its long-term Service Vision 

plan—these plans and strategies were not 

clearly linked to it’s 2001 performance 

report. SSA’s progress related to this 

challenge is contained under its strategic 

goals to deliver customer-responsive worldclass service, improve program integrity, and 

to strengthen public understanding of social 

security programs, where it discussed 

progress in meeting its current customer 

service performance goals. 

SSA places a high priority on customer 

service and reported that it met over half of 

its fiscal year 2001 goals related to this area. 

Of SSA’s 25 performance goals, it reported 

that 15 were met, 4 were not, and data were 

not available for 6. 

For example, SSA reported meeting its 

goals for

• the percentage of earnings posted 

correctly,

• the percentage of OASI and SSI Aged 

claims processed within 14 days of filing,

• the percentage of the public without an 

appointment waiting 30 minutes or less, 

• the number of Social Security number 

requests processed, 

• the percentage of employee reports (W-2s) 

filed electronically, and

• the percentage of its customer-initiated 

services available via the Internet or by 

telephone.

SSA reported it did not—but came close 

to—meeting its goals to

• have 82 percent of core business 

customers rate overall service as 

“excellent,” “very good,” or “good” (81 

percent gave SSA this rating), 

SSA addresses this challenge under its 

strategic goals to deliver citizen-centered 

world-class service, improve program 

integrity, and to strengthen public 

understanding of social security programs. 

However, as in its 2002 plan, SSA mainly 

discusses meeting its existing customer 

service performance goals. While SSA’s 

plan discusses human capital and 

information technology issues related to 

attaining its customer service strategic 

goals, they are not clearly linked to the 

attainment of its long-term Service Vision. 

As such, scarce budget resources may be 

spent on initiatives that do not adequately 

support SSA’s customers and may 

ultimately result in a degradation of services 

to the public. 

SSA changed and deleted several 

performance goals in its fiscal year 2003 

plan, potentially detracting from its customer 

service functions. For example, SSA 

deleted its goal to measure the percent of 

the public without an appointment who 

waited 30 minutes or less. SSA reported 

that it eliminated this goal because it is now 

emphasizing services it provides to the 

public via an appointment. However, SSA’s 

plan did not indicate that it analyzed 

customer needs, workloads, or service 

preferences, to warrant this deletion. This 

deletion may negatively affect SSA’s ability 

to monitor its services to people who do 

business with SSA without an appointment. 

SSA also deleted two other goals without 

explanation measure: (1) telephone services 

of its field offices, which was contained in its 

fiscal year 2002 plan, (2) the aged OASI and 

SSI claims introduced in its fiscal year 2002 

plan. The deletions may hinder SSA’s ability 

to track progress in these areas. 

In addition, the 2003 plan maintains a goal, 

which we criticized last year—the dollar 

accuracy of OASI payment outlays and the 

dollar accuracy of DI payment outlays. 

Aggregating and reporting on these 

separate and distinct programs in a single 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVIII

Observations on the Social Security 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 142 GAO-03-225 Status of Addressing Major Management Challenges

• have 30 percent of core business 

customers rate overall service as 

“excellent” (28 percent gave SSA this 

rating), 

• have 85 percent of the public with an 

appointment wait 10 minutes or less 

(performance was 84.4 percent),

• process 3,125,000 Retirement and 

Survivors Insurance (RSI) claims (actual 

was 3,092,743), and

• handle 60 million 800-number calls (actual 

was 59.3 million). 

SSA revised several of its goals in the 

customer service area. For example, SSA 

did not meet its lowered goals for: (1) the 

percentage of core business customers 

rating overall service as “excellent,” “very 

good,” or “good” and (2) the percentage of 

core business customers rating overall 

service as “excellent.” 

For six performance goals SSA did not 

report data for us to assess performance 

(SSA also did not report on these indicators 

in its fiscal year 2000 report):

• service accuracy of its 800-number,

• payment service accuracy of its 800-

number,

• the percentage of OASDI payments 

without overpayments, 

• the percentage of OASDI payments 

without underpayments,

• the percentage of employers rating its 

overall services as “excellent,” “very good,” 

or “good,” and

• the percentage of employers rating its 

overall services as “excellent.” 

With the exception of its employer-related 

customer satisfaction goals, SSA noted 

these data would be reported in its fiscal 

year 2002 report. 

indicator may affect SSA’s ability to 

sufficiently monitor and manage payment 

accuracy and obscure SSA’s actual 

performance in either program. Also, in our 

prior work we have recommended that SSA 

develop a performance plan goal to assess 

customer satisfaction with the clarity of its 

notices.a

 However, SSA deleted a measure 

of the clarity of its notices in fiscal year 

2000, and its 2003 plan still does not include 

a goal to track SSA’s work in this area.

SSA’s 2003 plan contains an appendix that 

lists initiatives related to customer service, 

such as improving its 800 number service, 

improving field office reception and waiting 

times, and electronic payment services. 

However, the appendix does not contain the 

descriptions and implementation schedules 

for these initiatives, contained in its 2002 

plan, which makes it difficult to track SSA’s 

progress in the area. 

SSA has begun taking concrete steps to 

address its service delivery challenges. 

However, without a long-term service 

delivery plan, it cannot ensure that 

investment in its workforce and technologies 

are consistent with and fully support its 

future approaches to service delivery. The 

fiscal year 2003 plan does not include 

specific objectives and goals for developing 

such a plan.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XVIII

Observations on the Social Security 

Administration’s Efforts to Address Its Major 

Management Challenges

Page 143 GAO-03-225 Status of Addressing Major Management Challenges

a

U.S. General Accounting Office, Social Security Administration: Longstanding Problems in SSA’s 

Letters to the Public Need to Be Fixed, GAO/HEHS-00-179 (Washington, D.C.: Sept. 26, 2000).

Further strengthen controls to protect 

SSA information.

See discussion under information security 

governmentwide high-risk area, above.

See discussion under information security 

governmentwide high-risk area.

See discussion under information security 

governmentwide high-risk area.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 144 GAO-03-225 Status of Addressing Major Management Challenges

Appendix XIX

Observations on the Department of State’s 

Efforts to Address Its Major Management 

Challenges ApendxiXIX

The following table identifies the major management challenges 

confronting the Department of State (State), including the governmentwide 

high-risk areas of strategic human capital management and information 

security. The first column lists the challenges identified by our office. The 

second column discusses what progress, as discussed in its fiscal year 2001 

performance report, State made in resolving its challenges. The third 

column discusses the extent to which State’s fiscal year 2003 performance 

plan includes performance goals and measures to address the challenges 

that we identified. 

We found that State’s 2001 performance report discussed its progress in 

meeting all of its challenges; however, it provided little information on what 

is being done to realign the U.S. workforce overseas with the U.S. 

government’s mission (also referred to as rightsizing, the process for 

determining the appropriate size and locations of the U.S. overseas 

presence).

Of the agency’s seven major management challenges, its performance plan 

had

1. goals and measures that were directly related to six of the challenges, 

and

2. goals and measures that were indirectly applicable to one of the 

challenges, which was

• realigning the U.S. workforce overseas.7

7

 State had an indirectly related goal, but no measures or strategies to address this 

challenges.
Appendix XIX

Observations on the Department of State’s 

Efforts to Address Its Major Management 

Challenges

Page 145 GAO-03-225 Status of Addressing Major Management Challenges

Table 20: Major Management Challenges for State

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management:

GAO has identified shortcomings at 

multiple agencies involving key elements of 

modern strategic human capital 

management, including strategic human 

capital planning and organizational 

alignment; leadership continuity and 

succession planning; acquiring and 

developing a staff whose size, skills, and 

deployment meet agency needs; and 

creating results-oriented organizational 

cultures.a

In its performance report, the department 

stated that in fiscal 2001 it began to lay the 

foundations for its 3-year diplomatic 

readiness initiative scheduled to begin in 

fiscal year 2002. It added that this initiative 

will rectify a severe imbalance between its 

workforce and its workload. According to 

the report, State met its fiscal 2001 targets 

for Foreign Service hiring and began 

preparations for hiring an additional 1,158 

foreign and civil service employees over 3 

years. These additional personnel will allow 

it to fill vacancies, create a “training float” 

(this will allow people to be trained without 

leaving a position vacant), provide backup 

personnel to respond to crises, and 

minimize staffing gaps. 

State had four Diplomatic Readiness 

performance goals that addressed human 

capital. The first is that the department will 

hire and retain an adequate number of 

employees. The three performance 

indicators deal with number of registrants for 

the Foreign Service Written Exam and 

alternate recruitment programs, hiring to 

attrition (approximately 800), and 

resignation rates. State exceeded the 

targets for all three indicators. 

The second performance goal is that State 

will develop and implement training and 

professional development programs and 

make them available to all full-time 

employees throughout their careers. This 

goal had three indicators—a 5 percent 

increase in the number of civil service 

employees in career development programs, 

1,623 foreign service nationals trained in 

crisis management, and maintaining or 

improving the current rate of 66 percent of 

language students who are assigned for at 

least the recommended amount of time and 

State’s fiscal year 2003 performance plan 

includes three performance goals with 

measurable indicators. For its first goal—to 

hire and retain an adequate number of 

employees—State established three key 

performance indicators and set five 

accompanying projected targets (three for 

the first indicator). The five targets are (1) 

20,000 individuals will take the Foreign 

Service Written Exam, (2) 7,000 of these test 

takers will be minorities, (3) 3,300 applicants 

will participate in the alternate exam program 

for specialists, (4) 1,530 people will apply to 

the student and specialist programs, and (5) 

State will hire 400 employees above normal 

intake to meet its priorities and provide a 

training float (it did not explain what normal 

intake is). The State Department stated that 

in addition to the 2003 performance plan, it 

has other indicators that track human capital 

goals. State’s performance plan indicates 

that the department will take appropriate 

steps to ensure that Americans are 

satisfactorily represented in multilateral 

organizations. However, the plan does not 

provide indicators to measure this effort. 

According to State, the Bureau of 

International Organization Affairs tracks 

progress toward achieving it through 

appropriate performance indicators.

The second goal—to develop and implement 

training and professional development 

programs for all full-time employees 

throughout their careers—sets two 

performance indicators: (1) progress toward 

a 3-year goal to provide appropriate 

leadership and management training to junior 

and midlevel officers and (2) a percentage of 

employees assigned to language-designated 

positions who meet the requirement of the 

position. For 2003, State projects that 25 

percent of targeted employees will receive 
Appendix XIX

Observations on the Department of State’s 

Efforts to Address Its Major Management 

Challenges

Page 146 GAO-03-225 Status of Addressing Major Management Challenges

who meet their training goals. The 

department did not meet the target for the 

first two indicators but met the target for the 

last indicator.

The third performance goal is that the 

Foreign Service Institute will be configured 

and equipped to provide and support the full 

range of its distance-learning offerings and 

that the National Foreign Affairs Training 

Center will be adequate to support staff and 

student needs. The two indicators involved 

converting the first analog multimedia 

laboratory to digital and initiating a formal 

capacity review of the training center. It 

exceeded the first target but only partially 

met the second target (it undertook a review 

of junior officer orientation space, with a full 

study pending). 

The fourth performance goal is to maintain 

current work-life programs and introduce 

new programs to improve the quality of the 

workplace for all employees, and to improve 

the quality of the lives of Foreign Service 

employees and their dependents serving 

abroad. The one performance indicator, 

with three quantifiable targets, measures 

Foreign Service specialist and generalist 

and civil service resignation rates. State 

exceeded all three targets. Indicators did 

not address whether work-life programs 

were being maintained or if new ones were 

being introduced, or how quality of life 

overseas was improved. 

appropriate leadership and management 

training, and that the department will 

maintain or improve the current percentage 

of employees in language-designated 

positions that meet the requirement, which 

State reported at 83 percent in 2001. 

The third goal—work-life programs—has two 

new performance indicators: (1) the results 

of an employee satisfaction survey and (2) 

the percentage of eligible family members 

employed in local economies overseas 

through the Spouse Networking Assistance 

Program. For 2003, State plans to use the 

results of the employee survey to evaluate 

and develop appropriate work-life programs 

and double the number of spouses employed 

on the local economy. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Appendix XIX

Observations on the Department of State’s 

Efforts to Address Its Major Management 

Challenges

Page 147 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained 

momentum and expanded. Nevertheless, 

recent audits continue to show that federal 

computer systems are riddled with 

weaknesses that make them highly 

vulnerable to computer-based attacks and 

place a broad range of critical operations 

and assets at risk of fraud, misuse, and 

disruption. Further, the events of 

September 11, 2001, underscored the 

need to protect America’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both. 

A comprehensive information protection 

program includes many elements, according 

to State’s report, including personnel 

investigations for security clearances, 

counterintelligence investigations and 

briefings, and computer security. The report 

added that the department has made 

substantial progress on information 

technology security by implementing 

incident handling and response teams, 

incident handling units, network monitoring 

and threat analysis centers, and effective 

working relationships with other federal 

incident response centers. 

However, State’s fiscal year 2001 

independent auditor’s report, completed in 

early 2002, stated that information systems 

security was a material weakness that could 

be exploited, possibly compromising the 

information State uses to prepare its 

financial statements. The auditor’s report 

identified significant information system 

security weaknesses that made the 

department’s systems networks for domestic 

operations vulnerable to unauthorized 

access. It added that although State had 

closed the recommendations we made in 

1998 in fiscal year 2000, this did not 

demonstrate that the material weakness in 

this area had necessarily been corrected. 

State’s fiscal year 2001 performance report 

stated that the department had one 

performance goal, that all classified and 

sensitive information overseas and in 

domestic facilities be safeguarded from 

physical and technical compromise. This 

goal has four performance indicators. State’s 

fiscal 2001 actual performance exceeded its 

targets percentage of cleared department 

employees that have received an annual 

security briefing and percentage of network 

intrusion detection systems for its primary 

unclassified computer system in place 

domestically. It met the target for 

percentage of periodic reinvestigations 

being done to meet the 5-year requirement. 

It did not meet its target for percentage of 

network intrusion detection systems on its 

unclassified system abroad. 

The 2003 plan does not have a separate 

performance goal addressing information 

security. However, one of the performance 

indicators under the performance goal of 

having safe, secure, and functional facilities 

addresses information security—the number 

of periodic reinvestigations of security 

clearances undertaken per month. The 

target for this indicator is 300 per month. 

State commented that it is drafting a 

performance goal for its fiscal year 2005 plan 

that addresses both employee security and 

information security. 

In discussing progress on the President’s 

Management Agenda, the plan stated that 

under the initiative to expand electronic 

government, the department will develop 

security corrective action plans for any 

programs and systems with security 

weaknesses.

The National Institute of Standards and 

Technology developed a security assessment 

framework and related tools that agencies 

can use in determining the status of their 

information security programs. In addition, 

Office of Management and Budget (OMB) 

guidance for fiscal year 2002 under the 

Government Information Security Reform Act 

(GISRA) requires agencies to use tools 

developed by the Institute to evaluate the 

security of unclassified systems or groups of 

systems. This guidance also requires specific 

performance measures, as well as corrective 

action plans with quarterly status updates. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Appendix XIX

Observations on the Department of State’s 

Efforts to Address Its Major Management 

Challenges

Page 148 GAO-03-225 Status of Addressing Major Management Challenges

GAO-designated major management 

challenge

Improve the security and maintenance 

of U.S. facilities overseas and enhance 

the management of overseas security 

programs: State faces many challenges 

and risks in its program to replace its most 

vulnerable facilities, improve security at all 

posts, and improve facility maintenance. 

Attacks on U.S. embassies and consulates 

in recent years and the events of 

September 11 underscore the importance 

of addressing this management challenge. 

Since 1998, the department stated that it 

has made significant strides in improving 

security overseas. State added that it has 

completed 90 percent of the security 

upgrade projects begun under the 

Emergency Security Amendment of 1998, 

has hired additional security personnel, and 

has expanded its capital building program. 

State’s report included two strategic goals 

that support overseas security and capital 

construction, and rehabilitation. The first 

had a performance goal that security for 

formerly lower-threat posts is heightened to 

meet standards used at higher-threat posts. 

This goal had four performance indicators, 

three of which State reported that it met. 

They were percentage of 38 security 

upgrade projects that have been completed, 

percentage of posts with technical security 

equipment upgrades, and number of 

Accountability Review Boards convened that 

found that a serious injury, loss of life, or 

significant destruction at a U.S. mission was 

due to inadequate security management or 

countermeasures. State did not meet the 

fourth goal, number of foreign service 

nationals trained in crisis management. 

State also has three performance goals 

under a second strategic goal dealing with 

overseas facilities. These performance 

goals are to continue the worldwide security 

upgrade program started in fiscal 1999; 

expeditiously relocate U.S. government staff 

into safe, secure, and functional facilities; 

and extend, through strategic and timely 

rehabilitation, the useful lives of facilities and 

enhance their functionality. State had seven 

performance indicators supporting these 

goals, addressing the status of (1) the 

physical security upgrade program, (2) new 

construction projects, and (3) major 

rehabilitation projects. The report said 

The department has embarked on a major 

capital construction program aimed at 

replacing many overseas facilities; security of 

U.S. installations is also being improved. 

One of State’s four infrastructure and 

operations performance goals—to have safe, 

secure, and functional facilities—addresses 

this challenge. 

State’s plan has seven performance 

indicators for this goal: (1) number of periodic 

reinvestigations undertaken, (2) the 

percentage of 38 projects funded through the 

Emergency Security Appropriation that have 

been completed, (3) the number of foreign 

service nationals trained in crisis 

management, (4) the percentage of access 

control system and newly designed building 

passes in place at State Department 

headquarters, (5) the percentage of projects 

completed under the Physical Security 

Upgrade Program, (6) the number of capital 

projects awarded as part of the Long Range 

Overseas Building Plan, and (7) the number 

of major renovation projects started in 

construction. While these indicators reflect 

an effort to quantify progress made towards 

completing various projects, they do not 

demonstrate the impact that these activities 

can be expected to have in terms of 

protecting employees and facilities. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Appendix XIX

Observations on the Department of State’s 

Efforts to Address Its Major Management 

Challenges

Page 149 GAO-03-225 Status of Addressing Major Management Challenges

State’s performance goals were partially 

achieved. It met the targets for two of the 

indicators, while falling below the targets on 

five indicators. 

The report contains no performance goals or 

indicators that specifically address facility 

maintenance, although both GAO and 

State’s Office of Inspector General (OIG) 

have identified it as a major long-standing 

management challenge. 

Improve the visa processing system and 

enhance border security: Since 

September 11, 2001, the administration 

has taken steps to strengthen the visa 

process, but will need to take additional 

actions, including reassessing staffing 

requirements, revamping and expanding 

consular training, and using the latest 

technology.

State reported two performance goals under 

the strategic goal to facilitate travel and 

immigration to the United States of 

legitimate visa applicants, and the denial of 

visas to ineligible applicants. The two 

performance goals are to meet anticipated 

increases in demand for nonimmigrant and 

immigrant visas and reduce the risk of 

illegitimate entry of aliens hostile to our 

interest by using all-source information from 

throughout the U.S. government to identify 

foreign terrorists and criminals. The report 

lists two performance indicators linked to 

both performance goals. They are the 

numbers of immigrant and nonimmigrant 

visa cases processed. The number for 

immigrant visas processed fell below the 

target, while the number for nonimmigrant 

visa cases was above the target. However, 

using number of cases as a performance 

indicator does not explain how State will 

meet anticipated increases in demand. 

Also, neither of the indicators offers an 

explanation on how this will help State 

reduce the risk of illegitimate entry.

The fiscal year 2003 performance plan 

includes a strategic goal, travel and 

migration. State’s single performance goal 

under this strategic goal is timely and 

effective visa issuance and a reduction of 

visa fraud. Four performance indicators and 

targets were established: (1) develop a 

biometrics collection program for U.S. visas, 

with development work on worldwide 

biometrics collection expected to begin in 

2003, (2) provide six other U.S. agencies 

access to the Consular Consolidated 

Database, (3) process 715,000 immigrant 

visa cases, and (4) process 7.6 million 

nonimmigrant visa cases. The department 

added that it has taken numerous actions to 

“improve the visa processing system and 

enhance border security.” For example, it 

said that it is now providing real-time transfer 

of visa issuance information to the 

Immigration and Naturalization Service and 

has entered nearly 8 million law enforcement 

records from a Federal Bureau of 

Investigation database into the consular 

name check system.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Appendix XIX

Observations on the Department of State’s 

Efforts to Address Its Major Management 

Challenges

Page 150 GAO-03-225 Status of Addressing Major Management Challenges

Realign the U.S. workforce overseas 

with the U.S. government’s mission: The 

U.S. presence overseas needs to be 

adjusted to reflect the emerging economic, 

political, security, and technological 

requirements of the 21st century.

In its report, State said that its overall 

workforce planning process begins with the 

setting of priorities through the strategic 

planning and budgeting process, which 

ensures that its staffing is the right size for 

its mission. It further stated that OMB has 

incorporated interagency rightsizing 

overseas as one of the initiatives in the 

President’s Management Agenda.

The administration’s rightsizing initiatives 

aim to reconfigure U.S. overseas staff to the 

minimum number necessary to meet U.S. 

foreign policy goals. Continued high-level 

cooperation and commitment from all 

participating agencies will be needed to 

make any rightsizing effort work given 

State’s limited authority and influence over 

the staffing decisions of other agencies 

operating overseas. 

State did not include any performance goals 

or measures for rightsizing in its 2001 

performance report.

OMB has directed all agencies operating 

abroad to rightsize their presence overseas 

and, in coordination with State and other U.S. 

agencies, is working to develop a process for 

agencies to follow in this effort. We have 

developed a general framework for 

rightsizingb

 that addresses security, agency 

mission, and cost considerations, and we 

have recommended that this framework be 

used in formulating the government’s 

approach to rightsizing the overseas 

presence.

The 2003 plan does not include goals or 

measures that specifically address this 

challenge. However, the agency’s strategic 

goal for human resources states that its 

workforce be at an optimum number, 

distribution, and configuration to respond to 

the foreign policy priorities identified in the 

strategic plan. 

State commented that it believes it is too 

early to have indicators and targets for this 

OMB-led rightsizing process. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Appendix XIX

Observations on the Department of State’s 

Efforts to Address Its Major Management 

Challenges

Page 151 GAO-03-225 Status of Addressing Major Management Challenges

Enhance overseas communication, 

information technology, and knowledge 

management capabilities: U.S. agencies 

located overseas have great difficulty 

communicating electronically with each 

other and sharing available information.

State continues to organize its efforts in this 

area around five strategies: (1) develop, 

deploy, and sustain a secure, commercialstyle global information technology (IT) 

network and infrastructure, (2) provide 

systems and tools to ensure ready access to 

international affairs applications and 

information, (3) develop a modern, 

integrated messaging approach and 

capability, (4) leverage IT to streamline 

administrative and IT operations and 

facilities, and (5) sustain a trained productive 

workforce. 

State’s report includes four performance 

indicators to address the five strategies; 

however, the indicators are not directly 

related to any specific strategy. The 

department responded that the performance 

indicators are related to and support the 

department’s information resources 

performance goal, to provide secure, 

advantageous, commercial-quality IT 

support for the full range of international 

affairs activities of the United States. 

The first indicator is percentage of 

commercial networking facilities available for 

unclassified and classified processing 

completed. However, the target was to 

conduct studies to move toward commercialstyle networking, which does not address 

the indicator. State said it has continued 

interest in moving toward commercial-style 

networking and has made some progress 

toward that goal, but it did not address either 

the performance indicator or the fiscal 2001 

target. The second indicator is the 

percentage of classified and unclassified 

desktop computers older than 4 years. The 

target was to develop a plan to refresh 

equipment, but does not discuss equipment 

age. State reported that it plans to replace 

both classified and unclassified hardware. 

State did not meet the target for the third 

indicator, which was that the average post 

would have 16 servers. The last indicator is 

progress toward elimination of the current 

cable system and processes, but the target 

State’s performance goal for information 

resources is to provide modern, secure, and 

advantageous IT to support the mission of 

the department. 

State has four performance indicators 

relating to information resources. By 2003, 

State’s projected performance includes (1) 

extending its primary unclassified but 

sensitive network to 100 percent of existing 

sites worldwide and improving network 

availability, projected to increase to 98 

percent in 2001, (2) replacing classified and 

unclassified computers older than 4 years at 

all overseas posts and for employees 

needing them, (3) reducing the average 

number of servers per post and initiating the 

use of regional/central servers, and (4) 

implementing the pilot and beginning 

deployment of a system to replace the 

current outmoded cable system. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Appendix XIX

Observations on the Department of State’s 

Efforts to Address Its Major Management 

Challenges

Page 152 GAO-03-225 Status of Addressing Major Management Challenges

is for no improvement. However, the 

department reported that it did make 

significant progress during fiscal 2001 in 

preparing the groundwork for the elimination 

of the current cable system. 

Improve financial management 

capabilities: GAO has reported that one of 

State’s long-standing shortcomings has 

been the absence of an effective financial 

management system. 

Although the department’s principal financial 

statements for fiscal years 2000 and 2001 

received an unqualified opinion, the 

independent auditor identified several 

significant outstanding issues in State’s 

Accountability Report for fiscal year 2001.c

These include (1) the security of the 

department’s information systems networks 

for domestic operations that include the 

financial management systems (based on 

GAO findings), (2) access vulnerabilities and 

other weaknesses with the Paris Financial 

Service Center’s Accounting and Disbursing 

System, (3) internal control weaknesses 

related to the management of unliquidated 

obligations, (4) weaknesses related to 

managerial cost accounting and State’s 

financial and accounting systems, and (5) 

the inadequacy of the department’s financial 

management systems. The independent 

auditor’s report also stated that the 

department’s financial management 

systems do not comply with six federal laws 

and regulations, including the Chief 

Financial Officer’s Act of 1990. These are 

basically the same findings the independent 

auditor reported last year. 

The department responded in the 

accountability report that it has taken steps 

to address these weaknesses. State is 

holding periodic meetings with staff 

members of the independent audit firm to 

identify and coordinate actions needed to 

resolve the weaknesses and monitor 

progress. Specifically, the department 

stated it has made significant progress in 

resolving problems with the Paris Financial 

Service Center’s Accounting and Disbursing 

system by closing 19 of the 25 

recommendations (they are working to close 

the remaining six).

State’s plan has one performance goal that 

calls for adequate funding for the department 

that is based on results-oriented budgeting, 

effective financial management systems, and 

demonstrated financial accountability. State 

has several performance indicators under 

this goal: (1) complete pilot testing of the 

Central Financial Planning System and begin 

phased deployment, (2) issue the fiscal year 

2002 financial statements on time with an 

unqualified opinion, (3) submit the 2002 

Combined Performance and Accountability 

Report on time and receive the Certificate of 

Excellence in Accountability Reporting for the 

report, (4) relocate the domestic processing 

for American payroll and foreign service 

pension to Charleston, and switch posts 

formerly serviced by the Paris Financial 

Services Center to Charleston and Bangkok, 

(5) direct input of the department’s and other 

agencies’ budget requests into the 

International Affairs database, and (6) 

automate the mission performance plan 

process completed and develop pilot for 

automation of bureau plans.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Appendix XIX

Observations on the Department of State’s 

Efforts to Address Its Major Management 

Challenges

Page 153 GAO-03-225 Status of Addressing Major Management Challenges

a

U.S. General Accounting Office, Staffing Shortfalls and Ineffective Assignment System Compromise 

Diplomatic Readiness at Hardship Posts, GAO-02-626 (Washington, D.C.: June 18, 2002).

b

U.S. General Accounting Office, Overseas Presence: Framework for Assessing Embassy Staff Levels 

Can Support Rightsizing Initiatives, GAO-02-780 (Washington, D.C.: July 26, 2002).

c

U.S. Department of State, Accountability Report, Fiscal Year 2001 (Washington, D.C.: February 

2002).

State reported one performance goal 

dealing with improving financial 

management capabilities, to improve 

financial management with demonstrated 

financial accountability, which had 12 

performance indicators. For 11 of the 12 

indicators, the actual figures for fiscal 2001 

equaled or exceeded the targets. For the 

12th indicator, which was qualitative, State 

reported that the goal was achieved without 

including what was done to meet this goal or 

why it believed the goal was achieved. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s fiscal 

year 2003 performance plan
Page 154 GAO-03-225 Status of Addressing Major Management Challenges

Appendix XX

Observations on the Department of 

Transportation’s Efforts to Address Its Major 

Management Challenges ApendxiXX

The following table identifies the major management challenges 

confronting the Department of Transportation’s (DOT) in the 

governmentwide high-risk areas of strategic human capital management 

and information security. The first column lists the challenges identified by 

our office. The second column discusses what progress, as discussed in its 

fiscal year 2001 performance report, DOT made in resolving its challenges. 

The third column discusses the extent to which DOT’s fiscal year 2003 

performance plan includes performance goals and measures to address the 

challenges that we identified. We found that DOT’s performance report 

discussed, in varying levels of detail, the agency’s progress in resolving all 

of its challenges.

Of the agency’s eight major management challenges, its performance plan 

had

1. goals and measures that were directly related to three of the 

challenges,

2. no goals and measures related to four of the challenges, but discussed 

strategies to address the challenges, which were

• strategic human capital management,

• acquisitions and disposals,

• financial accountability, and

• enhance competition and consumer protection in aviation and freight 

rail industries to ensure reasonable fares, rates, and service

3. no goals, measures or strategies to address one of the challenges, 

which was

• strengthen the financial condition of Amtrak.
Appendix XX

Observations on the Department of 

Transportation’s Efforts to Address Its Major 

Management Challenges

Page 155 GAO-03-225 Status of Addressing Major Management Challenges

Table 21: Major Management Challenges for DOT

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management:

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures.

The specific concern with DOT that we 

identified in our January 2001 report

is the “stovepiped” culture at the Federal 

Aviation Administration (FAA), which has 

been one of several underlying

causes of acquisition problems in the 

agency’s multibillion dollar

modernization program. The program has 

experienced cost overruns, schedule

delays, and significant performance 

shortfalls.

DOT’s report describes actions to staff the 

new Transportation Security Administration 

(TSA) and a workforce reinvention effort in 

the Coast Guard to take advantage of new 

information technology and the commercial 

supply chain marketplace. The report also 

describes FAA’s efforts to redirect 37,300 

employees into a results-oriented Air Traffic 

Organization, freeing most of FAA to 

manage better and modernize faster and 

more efficiently. 

DOT’s plan provides no performance goals 

or measures for this management 

challenge. The plan recognizes that by the 

fall of 2006, large numbers of DOT 

employees will become eligible for 

retirement and describes a number of 

actions planned to address this issue, 

including

• competitive sourcing and restructuring,

• revising the human resources strategic 

action plan to align with the President’s 

Management Agenda and DOT’s strategic 

plan and budget process,

• employing the individual performance 

assessment system to ensure executive 

performance accountability, and 

• expanding telecommuting.
Appendix XX

Observations on the Department of 

Transportation’s Efforts to Address Its Major 

Management Challenges

Page 156 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show federal computer systems 

are riddled with weaknesses that make them 

highly vulnerable to computer-based attacks 

and place a broad range of critical 

operations and assets at risk of fraud, 

misuse, and disruption. Further, the events 

of September 11, 2001, underscored the 

need to protect America’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both.

DOT’s report describes a number of steps 

that DOT took to address information 

technology (IT) security, including

• implementing a DOT-wide IT security 

program and establishing an IT security 

committee to provide a forum for 

departmentwide discussions of IT security 

issues, 

• completing a comprehensive annual 

agency IT security program review of DOT, 

in accordance with the Government 

Information Security Reform Act (GISRA), 

and

• preparing a plan and template for updating 

the inventory of critical infrastructure 

systems with specific plans for 

assessment, remediation, certification, and 

authorization.

DOT’s plan describes a number of actions 

that DOT plans to take in 2003, including 

• achieving at least a one grade 

improvement in federal classifications for 

the IT security program;

• fully integrating IT security into egovernment, capital planning, and 

enterprise architecture processes;

• establishing standards for authentication 

and digital signatures (reviewing 

technologies such as Public Key 

Infrastructure (PKI) and biometrics) for the 

department that contribute to operational 

and economic efficiencies;

• establishing and operating a 

departmentwide monitoring and reporting 

capability;

• completing an update of the department IT 

security governance structure;

• completing an inventory of critical 

infrastructure systems and developing a 

plan for completing and 

certifying/accrediting those systems; and 

• developing a PKI prototype, including 

digital signature capabilities, for use within 

the department.

In addition to Government Performance and 

Results Act reporting, the Office of 

Management and Budget’s guidance for 

fiscal year 2002 reporting under GISRA 

requires specific performance measures, as 

well as corrective action plans with quarterly 

status updates.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XX

Observations on the Department of 

Transportation’s Efforts to Address Its Major 

Management Challenges

Page 157 GAO-03-225 Status of Addressing Major Management Challenges

GAO-designated major management 

challenge

Improve the safety and security of air, 

highway, and pipeline transportation, 

including

(1)the implementation of certain aviation 

safety programs,

(2)the screening of passengers at airports 

for dangerous objects,

(3)the security of air traffic control computer 

systems and the facilities that house them,

(4)truck safety initiatives, and

(5)the evaluation of pipeline safety 

measures and the involvement of states in 

the safety programs.

(1) DOT’s report indicated that for fiscal year 

2001, FAA 

• met its performance targets for reducing 

the rate of fatal aviation accidentsa

 and the 

number of general aviation fatalities, and 

• did not meet its supplementary 

performance targets for operational errors 

per 1 million activities or the number of 

runway incursions.

According to the report, FAA has (1) in 

coordination with the aviation industry, 

formed a Joint Steering Committee to focus 

on a number of causal factors common to 

commercial aviation and (2) is using Special 

Operations Specifications that permit 

carriers to use advanced landing approach 

procedures to reduce the risk of certain 

accidents.

(2) The terrorist attacks of September 11, 

2001, changed the landscape for this 

management challenge, which was 

established prior to that date. DOT’s 2001 

report states that, in light of those events, 

DOT did not meet its performance target on 

the detection rate for explosives and 

weapons that may be brought aboard 

aircraft. 

(3) The report does not provide specific 

performance measures for securing air 

traffic control systems. The report 

addresses FAA’ s air traffic control system 

security within the broader context of critical 

transportation infrastructure protection. 

Concerning protection of FAA’s facilities, the 

report describes FAA’s concept of 

operations, approach, and major milestones 

focusing on protecting its operational 

capability. The report also discusses 

ongoing protection efforts, including

• authorizing and certifying computer 

security systems,

(1) According to DOT’s plan, DOT’s goals 

are to (1) by 2007, reduce the commercial 

aviation fatal accident rate per 100,000 

departures by 80 percent, from a 3-year 

average baseline (for 1994 through 1996) of 

0.051 fatal accidents per 100,000 

departures; and (2) reduce the number of 

general aviation fatal accidents.

The plan includes the following 2003 

performance targets:

• the number of fatal commercial aviation 

accidents, and 

• the number of fatal general aviation 

accidents.

The report also includes the following 

supplementary performance measures:

• the number of operational errors per 1 

million activities, and 

• the number of runway incursions per 

100,000 operations.

The plan discusses a number of strategies 

to improve performance, including

• developing a System Approach for Safety 

Oversight to integrate safety information 

systems and, in turn, enhance FAA’s ability 

to forecast, identify, and target critical 

safety issues;

• enhancing the Online Aviation Safety 

Inspection System to provide more 

accurate data, leading to improved safetyrelated decision-making;

• reducing controlled flight into terrain 

accidents in general aviation through 

improved pilot education, revised test 

standards and training materials, and 

conducting a national media campaign to 

promote pilot awareness of this type of 

accident and conducting risk-mitigation 

training; and

• enhancing air traffic controller training, 

deploying modern displays, and improving 

communication systems to reduce 

operational errors. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XX

Observations on the Department of 

Transportation’s Efforts to Address Its Major 

Management Challenges

Page 158 GAO-03-225 Status of Addressing Major Management Challenges

• training FAA personnel in security 

awareness and vulnerability assessments, 

and 

• improving intrusion detection capability.

To protect other critical transportation 

infrastructure, DOT 

• conducted 36,000 visits to identify 

potential weaknesses in carrier security 

programs and report potentially serious 

security issues to appropriate authorities; 

and

• developed 280 findings of suspicious 

activities resulting from security visits and 

made 126 referrals to the Federal Bureau 

of Investigation.

(4) The report states that based on 

preliminary information, DOT did not meet 

its performance target for truck-related 

fatalities and injuries. According to the 

report, DOT has continued its efforts aimed 

at motor carrier safety enforcement, safety 

research, and improving crash data and 

commercial driver licensing. In addition, the 

report states that DOT is working on 

rulemakings on drivers’ hours of service 

regulations, among other things and staffs a 

24-hour safety telephone hotline. The report 

does not discuss DOT’s efforts to staff key 

positions in the Federal Motor Carrier Safety 

Administration, which was a specific 

concern we mentioned under this 

management challenge. 

(5) DOT met its supplementary performance 

target for the number of failures of natural 

gas transmission pipelines. According to 

the report, DOT is establishing a new 

performance measure for the number of 

times pipelines have been damaged during 

excavations. The report also states that 

DOT has finalized a rule that requires 

hazardous liquid pipeline operators to 

provide better information on causes of 

failures, and has proposed rules to require 

these operators to file annual reports, which 

are needed to improve trend analysis. 

(2) According to the plan, DOT’s goals are to 

(1) ensure that no terrorist or other individual 

is successful in causing harm or significant 

disruption to the aviation system and (2) 

reduce passenger waiting time at screening 

checkpoints to no more than 10 minutes, 95 

percent of the time. 

The plan states that the Transportation 

Security Administration is developing longterm performance measures for aviation 

security and screening efficiency. In 

addition the plan states that DOT will 

establish a performance target for 

passenger and cargo screening 

effectiveness and efficiency in the fall of 

2002. The plan also lays out targets for 

having federal employees conduct 

passenger and baggage security screening 

and having explosive detection technology 

in place at 429 airports.

The plan states that Transportation Security 

Administration (TSA) is adding intelligence 

personnel to better assess the terrorist 

threat; improving technology for detecting 

explosive devices and weapons; and 

purchasing and deploying advanced security 

equipment for airports and smaller, less 

expensive explosive detection systems for 

less-busy airports and air carrier stations.

(3) The plan provides no performance goals 

or measures for this management 

challenge. DOT’s key 2003 milestones for 

information security, which encompass FAA 

computer systems, are discussed above 

under the governmentwide management 

challenge concerning information security.

(4) According to the performance plan, 

DOT’s goal is to reduce large truck-related 

fatalities by 50 percent from 5,374 to 2,687 

in 2009.

The plan contains performance measures 

for the number of fatalities in crashes 

involving large trucks and a supplementary 

performance measure on the number and 

rate (per 100 million commercial vehicle 

miles traveled) of injured persons in crashes 

involving large trucks. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XX

Observations on the Department of 

Transportation’s Efforts to Address Its Major 

Management Challenges

Page 159 GAO-03-225 Status of Addressing Major Management Challenges

The plan states that DOT’s strategies to 

improve large truck safety involve working 

through its administrations to, among other 

things, study the causes of crashes, improve 

crash data, monitor carrier safety 

performance, and conduct public safety 

awareness campaigns. 

(5) The plan provides a performance goal to, 

by 2003, reduce excavation damages to all 

types of pipelines by 10 percent from 2000 

levels.

The plan includes a performance measure 

for the number of times natural gas and 

hazardous liquid pipelines are damaged 

during excavations and a supplementary 

performance measure for failures of natural 

gas transmission pipelines.

According to the plan, DOT, through its 

Research and Special Programs 

Administration, will improve state 

partnerships by improving data integration to 

permit targeting of safety efforts to high-risk 

areas and working with states on their safety 

oversight efforts. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XX

Observations on the Department of 

Transportation’s Efforts to Address Its Major 

Management Challenges

Page 160 GAO-03-225 Status of Addressing Major Management Challenges

Acquisitions and disposals: Enhance 

major acquisitions and disposals concerning

(1) FAA’s air traffic control modernization 

program,

(2) the Coast Guard’s Deepwater Project, 

and

(3) the Maritime Administration’s surplus 

ship disposal program.

(1) DOT’s report provides supplementary 

performance measures for aviation delays 

per 100,000 activities, which FAA did not 

meet, and for a cumulative increase in 

throughput during peak periods at certain 

major airports and for a cumulative increase 

in direct routings for the en route flight 

phase, which FAA did meet. The report 

discusses several broad air traffic control 

modernization efforts to accommodate air 

traffic growth, but does not directly address 

a number of concerns that we raised under 

this management challenge, namely (1) 

establishing a minimum level of software 

process maturity before providing funding; 

(2) establishing a cost accounting system; 

(3) ensuring the ability of the Chief 

Information Officer to implement and 

enforce a number of information systems 

architecture, acquisition, and security 

initiatives; (4) issuing guidance for validating 

investment analysis; (5) instituting a process 

for evaluating projects to identify lessons 

learned; and (6) developing free flight 

software, integrating free flight technologies 

with other modernization projects, and 

addressing human factor issues affecting 

controllers and pilots.

(2) The report provided performance goals 

for achieving cost and schedule milestones 

and planned benefits, which DOT states 

apply to any major acquisition, including the 

Deepwater Project. However, the report 

provided no performance target directly 

related to the concerns we raised for the 

Deepwater Project, which include the 

development of a carefully thought out and 

well-documented acquisition plan, and 

documentation and detailed analysis of the 

risks associated with various contracting 

alternatives. The only target indirectly 

related to the management challenges 

provided in the performance report was a 

supplementary target for the number of 

combat-ready units, which DOT did not 

meet. 

(1) DOT’s plan states that beginning in 2002, 

FAA will use percentage of on-time flights as 

a measure of aviation delay. To reduce 

delays, FAA plans to 

• work with airlines and airports in planning 

airlines’ operations at congested hubs,

• modernize the airspace system and 

shorten the time for approving plans and 

for building new runways,

• insert specific technologies to improve 

airspace throughput capacity, and 

• improve the information and decisionmaking process.

While these plans address air system 

capacity improvements, they to not directly 

address the concerns that we raised under 

this management challenge, as stated in the 

column to the left.

(2) The plan provides no performance goals 

or measures for this management 

challenge.

The plan states that the Coast Guard will 

• use a performance-based acquisition 

focused on required mission capabilities 

and 

• contract with a single System Integrator to 

acquire an integrated system of surface, 

air, command and control, intelligence, and 

logistics systems.

According to the plan, the focus on mission 

capabilities will allow and encourage the 

System Integrator to use innovative, 

available technologies and processes that 

will maximize operational effectiveness 

while minimizing total ownership cost. 

(3) The plan indicates that in 2003, MARAD 

will dispose of three to five high-risk vessels 

through domestic scrapping. Additionally, 

the plan states that MARAD faces a fiscal 

year 2006 deadline to dispose of obsolete 

ships in the National Defense Reserve 

Fleet. According to the plan, MARAD plans 

to also use other means of disposal, 

including artificial reefing and sales to 

recycling companies. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XX

Observations on the Department of 

Transportation’s Efforts to Address Its Major 

Management Challenges

Page 161 GAO-03-225 Status of Addressing Major Management Challenges

(3) According to the report, 133 ships await 

disposal as of March 2002. Legislation 

enacted in 2001 allowed the Maritime 

Administration (MARAD) for the first time to 

purchase scrapping services, and since the 

start of fiscal year 2001, nine vessels have 

been disposed of through payment of 

scrapping services, prior year vessel sales, 

and artificial reefing, according to the report.

Financial Accountability: DOT’s lack of 

accountability for its financial activities 

impairs its ability to manage programs and 

exposes the department to potential waste, 

fraud, mismanagement, and abuse.

DOT’s report indicates that DOT’s fiscal year 

2001 Consolidated Financial Statement 

received an “unqualified” opinion from the 

Inspector General.

DOT’s plan provides no goals or measures 

to address this management challenge. The 

plan states that DOT (1) is continuing to 

implement the Delphi core accounting 

system, (2) is making good progress in 

reporting quarterly financial results by 2003 

and will be better able to manage unit costs 

of service delivery, and (3) is continuing to 

address asset management problems 

through detailed corrective action plans 

extending over multiple years and involving 

numerous offices. The plan also states that 

FAA planned to complete an integrated 

financial and asset management system in 

fiscal year 2002.

Strengthen the financial condition of 

Amtrak.

According to DOT’s report, DOT did not 

meet the 2001 performance target of 

increasing intercity ridership on Amtrak. 

Additionally, the report indicates that Amtrak 

has made no substantial progress in 

achieving operational self-sufficiency by 

fiscal year 2003, a goal it was legislatively 

obligated to meet or face the threat of 

liquidation.

DOT’s plan provides no performance goals 

or measures for this management challenge 

or strategies to meet this challenge.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XX

Observations on the Department of 

Transportation’s Efforts to Address Its Major 

Management Challenges

Page 162 GAO-03-225 Status of Addressing Major Management Challenges

a

Based on preliminary data.

Improve the oversight of highway and 

transit projects to provide maximum 

transportation services for the federal 

dollars.

DOT’s report provides no 2001 performance 

measures pertaining to this management 

challenge. According to the report, DOT is 

taking three types of actions:

(1) establishing project oversight by 

• designating competent oversight 

managers who are personally accountable 

for proper federal oversight,

• establishing Integrated Product Teams, 

• funding professional certifications for 

federal oversight managers, and

• requiring grant recipients’ project 

management staff to have professional 

certifications.

(2) establishing a formal management and 

reporting framework by

• creating a DOT Executive Council to 

review project oversight, 

• fostering collaboration between federal 

oversight and grant management officials,

• designating as “at risk” projects with 

significant deviations from cost and 

schedule baselines, and

• establishing financial incentives for 

comprehensive management systems.

(3) ensuring accountability by 

• incorporating mega project oversight into 

DOT’s performance plans,

• inviting external audits, and

• providing performance incentives for DOT 

employees conducting oversight.

DOT’s plan indicates the following 

performance goals, starting in 2002:

• achieve 95 percent of schedule milestones 

for major federally funded transportation 

infrastructure projects or miss those 

milestones by less than 10 percent and

• achieve 95 percent of cost estimates for 

major federally funded transportation 

infrastructure projects or miss them by less 

than 10 percent.

The plan indicates that DOT will measure 

the percentage of federally funded 

infrastructure projects that meet these 

performance goals. 

According to the plan, DOT plans to 

strengthen controls against fraud, waste, 

and abuse; heighten fraud awareness; and 

maintain good accountability through 

outreach efforts to grant recipients and by 

working with states.

Enhance competition and consumer 

protection in aviation and freight rail 

industries to ensure reasonable fares, 

rates, and service.

DOT’s states that in response to new-entrant 

airlines’ complaints against certain airlines’ 

unfair competitive practices, DOT informally 

investigated major airline actions. 

Additionally, the report states that DOT has 

a significant backlog of allegations of unfair 

competition, hoarding airport capacity, 

oppressive computer reservation system 

practices, and civil rights violations. The 

report does not address concerns that we 

cited regarding whether the Surface 

Transportation Board is adequately 

protecting rail shippers against 

unreasonable rates and poor service quality. 

The report states that the Surface 

Transportation Board is decisionally 

independent by law and is not part of DOT’s 

report.

DOT’s plan contains no performance goals 

or measures for this management 

challenge. The plan describes continuing 

strategies for addressing this challenge for 

aviation competition, stating that DOT 

conducts its own analysis of merger 

transactions and provides its views to the 

Department of Justice. The Department of 

Justice is responsible for determining 

whether mergers should be challenged on 

competitive grounds, according to the plan. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 163 GAO-03-225 Status of Addressing Major Management Challenges

Appendix XXI

Observations on the Department of the 

Treasury’s Efforts to Address Its Major 

Management Challenges ApendxiXI

The following table identifies the major management challenges 

confronting the Department of the Treasury (Treasury), which include the 

governmentwide high-risk areas of strategic human capital management 

and information security. The first column lists the challenges identified by 

our office. The second column discusses what progress, as discussed in its 

fiscal year 2001 performance report, Treasury made in resolving its 

challenges. The third column discusses the extent to which Treasury’s

fiscal year 2003 performance plan includes performance goals and 

measures to address the challenges that we identified. We found that the 

Treasury’s performance report discussed the agency’s progress in resolving 

all of its challenges.

Of the agency’s seven major management challenges, its performance plan 

had

1. goals and measures that were directly related to three of the challenges,

2. goals and measures that were indirectly applicable to two of the 

challenges, including

• Internal Revenue Service (IRS) modernization and

• need to improve Customs Service’s regulation of commercial trade 

while protecting against entry of illegal goods at U.S. borders 

3. no goals, measures or strategies to address two of the challenges, 

including

• need to improve the Bureau of Alcohol, Tobacco, and Firearm’s 

performance measures to better determine the progress in denying 

criminals access to firearms, and

• need to improve the management of Treasury’s asset forfeiture program.

However, Treasury has made significant progress in addressing these two 

challenges. 
Appendix XXI

Observations on the Department of the 

Treasury’s Efforts to Address Its Major 

Management Challenges

Page 164 GAO-03-225 Status of Addressing Major Management Challenges

Table 22: Major Management Challenges for Treasury

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management: 

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures.

According to Treasury’s fiscal year 2001 

performance report, in fiscal year 2001, 

Treasury’s Office of the Deputy Assistant 

Secretary for Human Resources collected 

and consolidated workforce information from 

each Treasury bureau to determine the 

extent of Treasury’s human capital planning. 

A comprehensive workforce analysis report 

was submitted to OMB along with an 

analysis of restructuring plans submitted 

from each bureau. Feedback from OMB 

directed Treasury to strengthen its strategic 

human resource goals and to focus on 

future planning, including the use of 

personnel flexibilities, technology, and 

succession planning.

Treasury reported that in fiscal year 2002, it 

would develop a Treasury human resource 

strategic plan that will serve as a framework 

for fiscal year 2002 and beyond, and will 

assist management to create an 

environment where the entire workforce is 

valued and can excel. The strategic plan will 

address skill imbalances in mission-critical 

occupations, and ensure that bureaus fully 

use human resource flexibilities and 

enterprisewide technological solutions, data 

support human resource service delivery, 

effective performance management is 

emphasized, and bureaus have leadership 

development and succession plans in place.

In its fiscal year 2003 performance plan, 

Treasury discontinued two performance 

measures described in the fiscal year 2002 

performance plan: a performance measure 

on the rollout of its new human resources 

system (Treasury intends to track this 

internally) and a measure on the increase in 

the percentage of major Treasury 

occupations for which workforce-planning 

processes have been completed. Workforce 

strategies developed as needed has also 

been discontinued. As mentioned in the 

fiscal year 2001 performance report, 

Treasury reports it has developed a 

comprehensive human resources strategic 

plan to measure program success in 

workforce planning strategies.

Treasury’s fiscal year 2003 performance 

plan includes a performance measure, 

which started in fiscal year 2002, that 

measures the percentage of Treasury 

bureaus that have developed and 

implemented adequate strategies to 

determine skill gaps anticipated during the 

next 5 years in mission-critical occupations. 

The strategies must include an adequate 

succession strategy to anticipate and fill 

vacancies in key leadership positions during 

the next 5 years. The Treasury bureaus will 

be required to provide copies of their 

strategies for anticipating and resolving any 

skill gaps anticipated in mission-critical 

occupations during the next 5 years and 

copies of their strategies for anticipating and 

planning for succession for vacancies in key 

leadership positions during the next five 

years. These plans will be evaluated for 

adequacy against OMB/Office of Personnel 

Management and internal criteria. 
Appendix XXI

Observations on the Department of the 

Treasury’s Efforts to Address Its Major 

Management Challenges

Page 165 GAO-03-225 Status of Addressing Major Management Challenges

Treasury’s 2003 performance plan reports 

that the Equal Employment Opportunity 

measures were combined and revised into a 

more meaningful measure for the out years, 

measuring the percentage of allegations of 

discrimination for which Alternative Dispute 

Resolution processes are used.

At the bureau level the performance plan 

measures employee satisfaction at Internal 

Revenue Service (IRS), Treasury Inspector 

General for Tax Administration, and the 

Federal Law Enforcement Training Center, 

the same three bureaus as in last year’s 

performance plan. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXI

Observations on the Department of the 

Treasury’s Efforts to Address Its Major 

Management Challenges

Page 166 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show federal computer systems 

are riddled with weaknesses that make them 

highly vulnerable to computer-based attacks 

and place a broad range of critical 

operations and assets at risk of fraud, 

misuse, and disruption. Further, the events 

of September 11, 2001, underscored the 

need to protect America ’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both.

Our January 2001 high-risk update also 

noted significant and long-standing 

weaknesses in controls over the IRS’s 

information systems, which contributed to 

GAO designating IRS financial management 

as a high-risk area. Although IRS has made 

significant progress in improving computer 

security weaknesses, much remains to be 

done to resolve the serious weaknesses 

within IRS’s computing environment that 

place its automated systems and taxpayer 

data at serious risk to both internal and 

external threats.

Treasury reported it is implementing 

Presidential Decision Directive 63, which 

requires federal departments and agencies 

to establish and implement a program to 

protect their critical infrastructure. In fiscal 

year 2001, Treasury bureaus identified all 

critical cyber and noncyber assets. The final 

report from the National Critical 

Infrastructure Assurance Office to Treasury 

revealed a total of 32 assets of Critical 

Infrastructure Protection (CIP) concern. 

Treasury reports that all of these 32 assets 

have either been scheduled for or have had 

a vulnerability assessment completed. The 

next step, which is to identify the 

interdependencies of each asset, is 

scheduled to begin in fiscal year 2002.

All bureaus have a computer security 

incident response capability (CSIRC), and 

all bureaus receive Federal Critical 

Infrastructure Reporting Center and 

National Infrastructure Protection Center 

alerts and advisories, and apply patches 

and other fixes as applicable. A statement of 

work has been drafted for an enterprisewide 

CSIRC in fiscal year 2002. The September 

11 attacks increased concern about 

systems security. In fiscal year 2002, cyber 

CIP guidelines and methodologies will be 

issued to Treasury bureaus and special 

bureau on-site assistance visits are planned. 

A new security awareness-training program 

will also begin in fiscal year 2002. 

Treasury reported that the Financial 

Management Service (FMS) has developed 

an aggressive corrective action plan to fully 

address computer security deficiencies 

identified by GAO and is on target for full 

implementation of its Entity-wide IT Security 

Program by December of 2002. This plan 

includes performance measures using NIST 

and Federal Chief Information Officers 

Council’s “Self Assessment Framework.”

Treasury has established a performance 

goal to improve computer security across 

the department by ensuring that all Treasury 

information technology systems are certified 

and accredited to operate. For fiscal year 

2003, Treasury has established a 

performance measure that in fiscal year 

2002 70 percent compared to 65 percent of 

all information technology systems will be 

currently certified and accredited to operate. 

However, Treasury also noted that computer 

security has been seriously under-funded 

throughout Treasury for many years, and 

continues to be under-funded. Treasury is 

identifying internal resources that may be 

reallocated to support computer security 

programs.

Treasury also established a goal to ensure 

that training provided to key Treasury 

information systems security personnel is 

effective, and a related performance 

measure that addresses the percentage of 

key Treasury information systems security 

personnel who assess security training as 

“effective.” However, Treasury did not specify 

a target percentage for fiscal year 2003. 

However, these measures do not fully 

measure the effectiveness of information 

security and the department’s progress in 

implementing corrective actions. NIST 

developed a security assessment framework 

and related tools that agencies can use to 

determine the status of their information 

security programs. Also, OMB guidance for 

fiscal year 2002 reporting under the 

Government Information Security Reform 

Act (GISRA) requires agencies to use tools 

developed by NIST to evaluate the security 

of unclassified systems or groups of 

systems. 

In addition, OMB’s GISRA reporting 

guidance requires specific performance 

measures, as well as corrective action plans 

with quarterly status updates. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXI

Observations on the Department of the 

Treasury’s Efforts to Address Its Major 

Management Challenges

Page 167 GAO-03-225 Status of Addressing Major Management Challenges

According to Treasury, although IRS’s 

computer security has improved, control 

weaknesses continue to place automated 

systems and taxpayer data at serious risk to 

internal and external threats. In response, 

IRS implemented programs to manage 

security risks and the costs related to 

mitigating them, identifying weaknesses and 

creating corrective action plans. An aroundthe-clock incident response capability was 

established with situation management 

centers to centralize responses. A strong 

program of awareness about unauthorized 

access to taxpayer information, and a 

security assessment framework for 

achieving security objectives, was adopted. 

In the weeks following the September 11 

terrorist attacks, IRS determined what 

immediate steps needed to be taken, such 

as screening and guard services and 

consistent security standards for key areas. 

The performance plan discusses FMS’s 

actions planned or underway to address its 

computer security issues. However, FMS 

has not established specific performance 

measures in its plan for addressing 

computer security issues.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXI

Observations on the Department of the 

Treasury’s Efforts to Address Its Major 

Management Challenges

Page 168 GAO-03-225 Status of Addressing Major Management Challenges

GAO-designated major management 

challenge

Internal Revenue Service Modernization:

Revamping Business Practices to Meet 

Taxpayer Needs. Within the new

operating divisions, IRS must take a fresh

look at how to enforce the tax laws and

meet taxpayer needs in new and better

ways. This will be a challenge in

overcoming cultural barriers and in

coordinating the requisite human capital,

data, and information system support

across IRS.

Implementing a Balanced Approach to 

IRS’s Performance Management System 

to Better Assess Progress. IRS is faced 

with the challenge of aligning its individual 

performance evaluation systems with its 

balanced measurement system to clearly 

link the work of individual managers and 

employees to the mission and goals of the 

agency.

In its fiscal year 2001 performance report, 

Treasury reported that following 

Restructuring and Reform Act of 1998 

directions, IRS designed and made 

substantial progress in implementing a new 

modernized IRS, organized around 

customers with similar needs. The new 

organization focuses on providing service in 

three key program areas: pre-filing, filing, 

and post-filing compliance. The modernized 

IRS organization was officially inaugurated 

on October 1, 2000. The final stages of 

implementation, including the redistribution 

of workload, will continue through fiscal year 

2002.

Treasury reported that during fiscal year 

2001, IRS initiated several actions designed 

to improve the quality of performance 

measures data and increase its ability to 

measure progress through effective 

processes. Treasury reports significant 

progress was made to automate the process 

of data reporting at the servicewide level 

and within the new IRS Operating Divisions. 

Servicewide, IRS moved to a Web-based 

Business Performance Management 

System that will incrementally provide for 

100-percent automation of data along with 

tailored reports, templates, and integration 

of performance information for phases of its 

strategic planning and budgeting cycle. The 

operating divisions are also engaged in 

automated data reporting activities through 

development of a data mart designed to 

serve both the Wage and Investment and 

Small Business/Self Employed divisions. At 

the same time, IRS enhanced its measures 

data dictionary input document to provide 

additional detail around the purpose, 

Treasury’s fiscal year 2003 performance 

plan did not cite specific goals with related 

measures for meeting this management 

challenge. 

GAO found that improving service to 

taxpayers remains a challenge for IRS. 

IRS’s progress in modernizing has laid a 

foundation for improvement but has not yet 

provided the quality of service that taxpayers 

need.a

 A theme in recent GAO reports on 

taxpayer service is the need for improved 

management of IRS’s service functions, 

such as telephone assistance. Specifically, 

we have recommended explicit goal setting, 

improved performance measures, and more 

program evaluation.b

In Treasury’s fiscal year 2003 performance 

plan, we did not find specific goals or 

measures relating to voluntary compliance, 

burden, overall productivity, or overall 

customer satisfaction, although IRS does 

report various measures of customer 

satisfaction for specific functional areas. 

Early in fiscal year 2002, IRS rolled out its 

new employee evaluation system for frontline employees. This system was designed 

to structurally align performance 

expectations for employees with IRS’s three 

strategic goals. GAO recommended that 

IRS act to improve the linkage between 

employee’s critical job responsibilities, 

supporting behaviors, and organizational 

unit performance measures.c

 IRS has also 

made progress in developing a way to 

measure the voluntary compliance of 

individual taxpayers without placing undue 

burden on them. IRS plans to collect data to 

measure voluntary compliance. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXI

Observations on the Department of the 

Treasury’s Efforts to Address Its Major 

Management Challenges

Page 169 GAO-03-225 Status of Addressing Major Management Challenges

limitations, critical path, and management 

controls for each of its strategic and critical 

measures. In fiscal year 2001, IRS also 

began to capture baseline data and detailed 

definitions for its strategic-level measures 

and plans to begin reporting on these 

measures in fiscal year 2002.

Addressing Financial Management 

Weakness to Develop Reliable CostBased Performance Information. IRS 

does not have reliable cost accounting data 

to enable it to (1) develop cost-based 

performance information, (2) determine 

cost/benefits of its tax collection and 

enforcement programs, and (3) judge 

whether it is appropriately allocating its 

resources among competing management 

priorities.

According to Treasury’s performance report, 

a major initiative for fiscal year 2001 was 

beginning the development of the Integrated 

Financial System (IFS). This system is 

designed to address material weaknesses in 

financial reporting and bring the IRS into 

compliance with FFMIA. The IFS will be 

deployed in two releases: Release 1 will 

contain the core financial elements (i.e., 

General Ledger, Accounts Receivable, 

Accounts Payable, Cost Accounting, payroll, 

and funds control), and Release 2 will 

provide for noncore systems (i.e., fixed 

assets, travel, procurement). The 

requirements phase of IFS was completed 

in October 2001, with the procurement of 

the software targeted for April 2002. 

Deployment of Release 1 is anticipated to 

be completed by October 2003 and Release 

2 should be completed by April 2005.

The fiscal year 2003 performance plan does 

not contain any goals with related measures 

that address this management challenge. 

However, IRS does have extensive plans to 

address its financial management 

weaknesses. In the short-term, IRS is 

working to improve existing processes, such 

as those related to recognition of expenses 

and property and equipment. IRS is also 

continuing to refine the workaround 

procedures it has developed to compensate 

for some of the material weaknesses in 

internal controls. In the long-term, IRS is 

engaged in a systems modernization project 

intended to address its financial 

management problems. This project 

involves the replacement of IRS’s current 

outdated financial management systems 

such as (1) general ledgers, (2) property 

and equipment systems, and (3) the master 

file, which contains the detailed records of 

taxpayer accounts. The project also includes 

implementation of a cost-accounting system 

to provide IRS current and reliable 

information on the costs of its programs to 

support decision-making. IRS expects the 

systems modernization project to be 

completed in stages over a period of 10 

years or more, beginning with its first rollout 

in 2003. Once fully implemented, IRS 

expects its financial management systems 

will be in compliance with the requirements 

of FFMIA.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXI

Observations on the Department of the 

Treasury’s Efforts to Address Its Major 

Management Challenges

Page 170 GAO-03-225 Status of Addressing Major Management Challenges

Institutionalizing Effective Systems 

Modernization Management Controls.

Since 1995, IRS has made progress in 

dealing with management and technical 

weaknesses in its information technology 

systems. However, weaknesses in 

investment management, system life-cycle 

management, enterprise architecture 

management, and software acquisition 

management remain challenges.

IRS Faces Challenges in Collecting 

Unpaid Taxes. Weaknesses in IRS’s 

information systems and inadequate 

financial and operational information 

continue to hamper IRS’s ability to collect 

billions of dollars in unpaid taxes.

Treasury reported in its fiscal year 2001 

performance report that IRS made the 

following improvements to its systems 

modernization management controls and 

capabilities. IRS completed and approved 

its Enterprise Architecture 1.0, which helps 

to ensure that modernized projects are 

coordinated across the entire IRS 

enterprise, completed high-level strategies 

for tax administration (Tax Administration 

Vision and Strategy—TAVS) and internal 

management (Internal Management Vision 

and Strategy—IMVS), and improved overall 

management of its modernization efforts by 

further refining the configuration 

management and release management 

processes and by establishing financial 

controls and portfolio management 

processes to better align funding and 

resources with its business priorities.

Treasury reported that traditional 

examination and collection activity have 

declined over the past several years. To 

offset this decline, IRS focused on riskbased compliance intervention techniques 

coupled with more focused and rapid 

intervention to improve the quality and 

speed of collection casework. IRS reported 

that in fiscal year 2001 it realized gains 

through

• establishment of a strategic, coordinated 

approach to compliance issues, programs, 

and systems to ensure that cross-cutting 

and national compliance issues were 

resolved with multiple compliance 

solutions,

• implementation of a nationwide database 

for proper matching of dependency 

information and more timely resolution of 

erroneous account balances,

• hiring and training additional phone 

assistors to increase the number of 

delinquent and unreported accounts 

resolved and increase the number of 

delinquent returns secured,

• providing employees with access and 

IRS’s fiscal year 2003 performance plan 

does not identify specific goals or 

performance measures related to this 

management challenge. However, the plan 

does identify several actions planned or 

underway that IRS believes will enhance the 

agency’s ability to modernize its information 

technology systems. These actions include 

ensuring ongoing projects are aligned with 

the Enterprise Architecture, fully 

implementing a risk management program, 

fully defining and institutionalizing standard 

configuration management procedures, and 

conducting an independent software 

acquisition capability evaluation. 

The fiscal year 2003 Performance plan 

contains numerous performance measures 

to determine output in terms of volume of 

collection cases closed and timeliness of 

certain types of collection action. However, 

performance measures that would assess 

IRS’s overall progress in improving its 

collection of delinquent taxes have not been 

developed. 

GAO found that available but limited data 

suggest that voluntary compliance may have 

deteriorated.d

 To reverse the compliance 

and collection program declines, IRS is 

relying on a strategy of reengineering 

business processes and using new 

technologies. By improving the efficiency of 

the compliance programs, IRS hopes to 

significantly increase compliance activity 

levels. IRS also hopes to develop new 

techniques that will enable it to expand its 

compliance coverage and develop 

analytically-based techniques to determine 

appropriate compliance action. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXI

Observations on the Department of the 

Treasury’s Efforts to Address Its Major 

Management Challenges

Page 171 GAO-03-225 Status of Addressing Major Management Challenges

capability to update account data through 

a single terminal, and allowing Automated 

Collection System and Service Center 

Collection Branch employees to process 

cases,

• initiating a compliance strategy by 

capturing data from 16.8 million K-1 forms 

(reports shareholder’s or partner’s passthrough income) for matching reported 

(IRS stopped against information sending 

notices under this effort in August 2002 

and is seeking to improve its identification 

of those who may have misreported K-1 

income), and

• reducing the burden on field employees 

and establishing control on escalating 

inventories.

The first phase of a multiyear Collection Reengineering program was implemented to 

ensure that business tax cases are promptly 

assigned to revenue officers. In addition, 

enhancements made to the Electronic Fraud 

Detection system include selected Business 

Master File data, permitting research, 

analysis, and evaluation of fraud detection 

scenarios for business returns.

GAO found large and pervasive declines in 

five of the six IRS compliance programs and 

in both IRS collection programs from fiscal 

year 1996 through 2001 and recommended 

that the Commissioner of Internal Revenue 

reexamine the extent to which some 

quantitative information on the impact of 

proposed program changes should be 

included in strategic assessments.e

 IRS 

revised its strategic planning, budgeting, 

and performance management process in 

fiscal year 2000 to make decisions for fiscal 

year 2002. This process provides IRS 

management with a means to reconcile 

competing priorities with the realities of 

available resources. Through the use of this 

process in developing its budget request for 

fiscal year 2003, IRS identified numerous 

improvements and enhancements that 

enabled it to redirect resources to higherpriority areas. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXI

Observations on the Department of the 

Treasury’s Efforts to Address Its Major 

Management Challenges

Page 172 GAO-03-225 Status of Addressing Major Management Challenges

Noncompliance with Earned Income Tax 

Credit (EITC). Noncompliance with EITC 

exposes the federal government to billions 

of dollars of risk. However, IRS does not yet 

have sufficient data to demonstrate that it 

has effective controls over EITC compliance.

According to Treasury’s performance report 

in fiscal year 2001, mitigation of risk 

associated with tax filing fraud in the EITC 

area was accomplished by implementation 

of a three-part strategy: education and 

outreach visits to companies with a high 

volume of EITC return preparers, visits by 

agents to review tax preparers’ compliance 

with due diligence requirements, and 

“partnering” with the Criminal Investigation 

to ensure investigation of known fraudulent 

EITC claims and schemes. IRS also began 

a check of secondary social security 

numbers associated with a qualifying child 

to reduce the number and amount of 

ineligible claims made under EITC. In fiscal 

year 2002, IRS will continue to emphasize 

improved compliance with the EITC 

provisions of the tax code. One key to IRS’s 

efforts is the use of the dependent database 

(DDB). Using data provided by the 

Department of Health and Human Services 

and Social Security Administration, DDB is 

designed to identify potential noncompliant 

returns during returns processing.

Treasury’s fiscal year 2003 performance 

plan does not contain any performance 

measures that cover any aspect of IRS’s 

administration of EITC. 

The Commissioner of Internal Revenue and 

Secretary of the Treasury convened a joint 

task force to develop recommendations to 

better administer the credit and make it 

easier for taxpayers to comply with the rules. 

The task force was formed shortly after IRS 

released its latest study of EITC compliance, 

which found that in 1999 about half of EITC 

claims were in error and about one-third of 

credits should not have been paid out. This 

level of noncompliance has remained 

relatively stable even after a multiyear effort 

to reduce it.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXI

Observations on the Department of the 

Treasury’s Efforts to Address Its Major 

Management Challenges

Page 173 GAO-03-225 Status of Addressing Major Management Challenges

Need to Improve Customs Service’s 

Regulation of Commercial Trade while 

Protecting Against Entry of Illegal Goods 

at U.S. borders: Although Customs has 

made progress in implementing initiatives to 

improve security at U.S. borders, the 

following challenges remain: (1) completing 

an assessment of new trade compliance 

initiatives, (2) balancing travelers’ rights with 

Customs’ responsibility to interdict 

contraband, (3) using reliable data to 

determine staffing needs, and (4) acquiring 

a new import processing system.

In its fiscal year 2001 performance report, 

Treasury did not report specific progress but 

reported that Customs plans to implement 

an account view of the trade community so 

that companies can be evaluated in terms of 

their compliance risk. This will allow 

Customs to focus its resources on 

individuals, companies, and industries with 

poor records. The time frame for this 

modernization is 2003. Additionally, the 

Automated Commercial Environment 

system will integrate and modernize the risk 

management system in the commercial 

environment, improve targeting and 

selectivity results, and provide an extensive 

analytical capability. This modernization is 

scheduled in 2004.

Treasury reported Customs’ 2003 

performance plan was under review, so 

goals applicable to this major management 

challenge remain to be determined. The 

events of September 11 changed Customs’ 

primary security and enforcement focus. 

Shortly after the September 11 events, the 

Commissioner of Customs said that 

terrorism has replaced drug smuggling as 

the agency’s top priority. Customs 

completed a Trade Compliance Strategy 

Study in 2001. The study concluded that the 

trade compliance strategy has evolved in a 

logical manner, but has some limitations. 

The study also provided several 

recommendations to address these findings. 

The study recommended replacing specific 

compliance goals with a continuous 

improvement model that will identify 

significant deficiencies. Customs’ ongoing 

effort to acquire a new trade processing 

system is key to modernizing how Customs 

tracks, controls, and processes all 

commercial goods imported into and 

exported out of the United States. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXI

Observations on the Department of the 

Treasury’s Efforts to Address Its Major 

Management Challenges

Page 174 GAO-03-225 Status of Addressing Major Management Challenges

Financial Management:

Challenges Affecting Certain Bureau 

Operations. For fiscal year 2000, Treasury 

reported that seven of its bureaus’ financial 

management systems were not in 

substantial compliance with the 

requirements of FFMIA. (For fiscal year 

2001, Treasury reported that five Treasury 

bureaus were not in substantial 

compliance.) Also, Customs faces 

weaknesses in its internal control over data 

in its automated systems and problems 

developing and implementing new 

automated systems; IRS also continues to 

experience ongoing deficiencies in its 

financial management and operational 

systems and processes.

Treasury reported that it continues to work 

closely with its bureaus to address and close 

the open audit findings and will work in fiscal 

year 2002 to ensure that actions are taken 

to mitigate the risk factors involved in 

carrying out its programs. Treasury reports 

on the percentage of bureaus in compliance 

with the requirements of the Federal 

Financial Management Improvement Act of 

1996 (FFMIA) as part of its set of financial 

management performance measures. In 

fiscal year 2001, 67 percent of its bureaus 

were in compliance, exceeding Treasury’s 

target of 62 percent.

Treasury reported that FMS took an 

aggressive, proactive approach to resolve 

the deficiencies in its systems and 

processes that had resulted in a qualified 

audit opinion on FMS’s fiscal year 1999 

statements. Additionally, FMS developed an 

aggressive corrective action plan to fully 

address computer security deficiencies 

identified by GAO.

According to Treasury’s report, Customs’ 

modernization effort will provide an essential 

element of an integrated financial system 

through the development of an accounts 

receivable subsidiary ledger. Customs has 

selected a primary contractor for building the 

Automated Commercial Environment, of 

which the subsidiary ledger is one part. The 

target date for completing the subsidiary 

ledger has not yet been established within 

the overall project schedule currently being 

developed by the contractor. In addition, 

Customs is working to make its financial 

systems compliant by replacing a variety of 

financial and administrative systems through 

the use of off-the-shelf software provided by 

SAP Public Services, Inc. Release 1 of this 

project is funded and is due to be completed 

by April 2002. Releases 2 and 3 are 

scheduled to be completed by October 

2004, if funding is made available. Customs 

is attempting to establish a disaster recovery 

capability through the option of a 

commercial recovery facility.

Treasury’s fiscal year 2003 Performance 

plan contains performance measures 

gauging the percentage of Treasury bureaus 

in compliance with FFMIA financial systems 

requirements, accounting standards, and 

Standard General Ledger requirements. 

Treasury has a goal of 80 percent for fiscal 

year 2003.

IRS has made progress in addressing its 

financial management weaknesses, 

including addressing deficiencies in its 

accountability over property and equipment 

and controls over budgetary activity. (IRS’s 

financial management weaknesses are 

discussed above under IRS modernization 

challenges.) 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXI

Observations on the Department of the 

Treasury’s Efforts to Address Its Major 

Management Challenges

Page 175 GAO-03-225 Status of Addressing Major Management Challenges

Preparing Financial Statements for the 

Government Continues to be a Challenge 

for FMS. As the preparer of the Financial 

Report of the U. S. Government (FR), FMS 

continues to face challenges in working with 

federal agencies, including the inability to 

(1) properly account for billions of dollars of 

basic transactions, especially those 

between government entities, (2) ensure 

that information in the FR is consistent with 

agencies’ financial statements, and (3) 

effectively reconcile the results of operations 

reported in the U.S. government’s financial 

statements with budget results.

Challenges Remain in Implementing the 

Debt Collection Improvement Act of 

1996. Challenges remain for FMS to fully 

implement its Treasury Offset Program to 

include all payment types. Challenges also 

remain for full implementation of Treasury’s 

cross-servicing program. For example, 

action is needed to ensure fair debt 

distribution and to promote competition 

among private collection agencies.

Treasury reported that FMS received an 

unqualified audit opinion on its statement of 

the government’s cash position for fiscal 

year 2000. This is the fourth consecutive 

year FMS has received a clean opinion. In 

addition, FMS received an unqualified 

opinion on its financial statements for fiscal 

year 2000, with no reportable internal 

control weaknesses. This represents a 

significant improvement compared to FMS’s 

previous audit. 

At the Treasury level, a task force brought 

together OMB and GAO to help analyze the 

current process for preparing the FR. It 

issued recommendations designed to 

resolve the current audit findings on the FR 

compilation process.

According to Treasury, in fiscal year 2001, 

FMS implemented two more payment types 

for offset: Social Security Benefit and federal 

salary. It also expanded the Continuous 

Levy (Offset) Program to include federal 

salaries. In addition, FMS developed 

improved procedures to monitor agencies’ 

plans for referral of delinquent debt for 

cross-servicing, requested that OMB 

develop audit guidelines for eligible debts, 

and worked with private collection agencies 

to address their concerns with how 

delinquent debt is distributed to them for 

collection.

FMS determined that its measure used in 

prior years was no longer relevant and 

replaced this measure with new broader 

measures that FMS stated would better 

reflect overall performance. However, the 

performance measures that have been 

developed relate to other governmentwide 

accounting reports published by FMS that 

are not used to compile the FR, nor do they 

bear any relationship to the issues 

discussed in the challenges that FMS 

continues to face in preparing these 

financial statements.

Treasury’s performance plan covering FMS’s 

performance contains two performance 

measures to assess how much delinquent 

debt FMS is collecting. The measures 

pertain to (1) the percentage of debt referred 

to Treasury for collection by Federal 

Program Agencies; and (2) the total amount 

collected through debt collection tools 

operated by FMS. 

In our prior report, we suggested changes to 

FMS’s performance measures that would 

provide a more accurate indication of FMS 

performance.f

Need to Improve the Bureau of Alcohol, 

Tobacco, and Firearms (ATF) 

Performance Measures to Better 

Determine the Progress in Denying 

Criminals Access to Firearms: Despite 

significant technological advances that have 

given ATF more investigative information to 

carry out its mission, limitations in its 

performance measures make it difficult to 

determine its progress.

Treasury reports that ATF is addressing this 

concern by developing a new cross-cutting 

measure, using data provided by the 

Department of Justice via Uniform Crime 

Reports from state and local law 

enforcement agencies. This measure will 

compare the violent crime rates of cities in 

which ATF has a substantial presence to 

those cities that do not. This will more fully 

reflect the impact of the ATF Integrated 

Violence Reduction Strategy and its 

component projects.

While the 2001 performance report indicates 

that ATF is working to develop a new 

performance measure to address this 

management challenge, the new measure is 

not described in the 2003 performance plan. 

Treasury has made significant progress on 

this challenge.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXI

Observations on the Department of the 

Treasury’s Efforts to Address Its Major 

Management Challenges

Page 176 GAO-03-225 Status of Addressing Major Management Challenges

a

U.S. General Accounting Office Tax Administration: Continued Progress Modernizing IRS Depends on 

Managing Risks. GAO-02-715T (Washington, D.C.: May 14, 2002).

b

U.S. General Accounting Office IRS Telephone Assistance: Opportunities to Improve Human Capital 

Management. GAO-01-144 (Washington, D.C.: Jan. 30, 2001); and U.S. General Accounting Office 

IRS Telephone Assistance: Limited Progress and Missed Opportunities to Analyze Performance in the 

2001 Filing Season. GAO-02-212 (Washington, D.C.: Dec. 7, 2001).

c

U.S. General Accounting Office Performance Management Systems: IRS’s Systems for Frontline 

Employees and Managers Align with Strategic Goals but Improvements Can be Made. GAO-02-804

(Washington, D.C.: July 12, 2002).

d

U.S. General Accounting Office Tax Administration: Impact of Compliance and Collection Program 

Declines on Taxpayers. GAO-02-674 (Washington, D.C.: May 22, 2002).

e

U.S. General Accounting Office Tax Administration: Impact of Compliance and Collection Program 

Declines on Taxpayers. GAO-02-674 (Washington, D.C.: May 22, 2002).

f

U.S. General Accounting Office Department of the Treasury: Status of Achieving Key Outcomes and 

Addressing Major Management Challenges. GAO-01-712 (Washington, D.C.: June 15, 2001).

Need to Improve the Management of 

Treasury’s Asset Forfeiture Program:

Treasury’s Asset Forfeiture Program faces 

inadequate information systems and 

financial management weaknesses, 

including problems with accountability over 

seized assets.

According to the fiscal year 2001 

performance report, for the first time since 

the inception of the Treasury Forfeiture Fund 

in 1992, the auditors of the Fund’s fiscal 

year 2001 financial statements asserted that 

the Fund is free of any material 

weaknesses. Additionally, for the second 

consecutive year, Fund managers asserted 

compliance with the Federal Managers 

Financial Integrity Act (FMFIA) and FFMIA 

in the annual Assurance Statements. As a 

result of the progress the Fund has made in 

resolving all material weaknesses, as well 

as completing the majority of the corrective 

actions established in response to audit 

recommendations, the Office for the Under

Secretary (Enforcement) of the Department 

of the Treasury has formally requested 

removal of the Treasury Forfeiture Fund 

from GAO’s major challenges list.

The 2003 performance plan does not list any 

applicable performance goals or measures 

related to this major management challenge. 

Treasury has made significant progress on 

this challenge.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 177 GAO-03-225 Status of Addressing Major Management Challenges

Appendix XXII

Observations on the U.S. Agency for 

International Development’s Efforts to 

Address Its Major Management Challenges ApendxiXXI

The following table identifies the major management challenges 

confronting the U.S. Agency for International Development (USAID), 

which includes the governmentwide high-risk areas of strategic human 

capital management and information security. The first column lists the 

challenges identified by our office. The second column discusses what 

progress, as discussed in its fiscal year 2001 performance report, USAID 

made in resolving its challenges. The third column discusses the extent to 

which USAID’s fiscal year 2003 performance plan includes performance 

goals and measures to address the challenges that we identified. 

We found that USAID’s performance report discussed the agency’s progress 

in resolving many of its challenges, but it did not discuss the agency’s 

progress in resolving the following challenge 

• information security

Of the agency’s five major management challenges, its performance plan 

had

1. goals and measures that were directly related to one of the challenges,

2. goals and measures that were indirectly applicable to two of the 

challenges, including

• strategic human capital management and 

• financial management information unreliable/financial statements 

inaccurate and do not measure program results

3. no goals and measures related to one of the challenges, but discussed 

strategies to address the challenge, which was

• challenges with developing reliable performance measures and 

accurately reporting results of programs

4. no goals, measures or strategies to address one of the challenges

• information security.
Appendix XXII

Observations on the U.S. Agency for 

International Development’s Efforts to 

Address Its Major Management Challenges

Page 178 GAO-03-225 Status of Addressing Major Management Challenges

Table 23: Major Management Challenges for USAID

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal year 

2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated government wide 

high risk

Strategic human capital 

management: GAO has identified

shortcomings at multiple agencies 

involving key elements of modern 

strategic human capital management, 

including strategic human capital 

planning and organizational alignment; 

leadership continuity and succession 

planning; acquiring and developing a 

staff whose size, skills, and deployment 

meet agency needs; and creating 

results-oriented organizational cultures.

Since the early 1990s, we have reported 

that USAID has made limited progress 

in addressing its human capital 

management issues. A major concern 

is USAID’s inability to establish and 

integrate a comprehensive workforce 

plan with its strategic goals and 

objectives. Developing such a plan is 

critical due to a reduction in its workforce 

during the 1990s and expected high 

continuing attrition. 

USAID stated that it took a number of steps to build 

a stronger and more capable human resource 

base. The agency continued recruiting entry-level 

staff through its New Entry Professional program 

and increased the level of midcareer professionals, 

specifically contract and legal officers. In addition, 

USAID reported that it increased the number of 

senior managers trained through external sources 

and developed in-house training to enhance the 

results-oriented management, financial 

management, acquisitions and assistance, and 

supervisory skills of program managers and their 

staffs.

USAID reported specific performance results in 

2001 that included

• hiring 77 new entry professionals, 18 presidential 

management interns, and 46 career civil service 

employees and

• providing training to

- 385 individuals in supervisory classes and 

seminars,

- 348 employees on managing for results, and

- 480 employees on acquisition and assistance 

rules and procedures.

USAID also reported that it is developing a 

workforce strategy that systematically and 

comprehensively assesses its headquarter’s 

staffing needs.

USAID reported that it intends to 

strengthen its human capital 

management capabilities by continuing 

its recruitment efforts and providing inhouse training. 

USAID plans to deploy staff rapidly in all 

labor categories through intensified 

recruitment efforts. To do so, the agency 

intends to meet all its foreign service and 

civil service staffing requirements and to 

complete a civil service recruitment plan. 

In addition, the agency intends to make 

“Web-enhanced human resource 

management tools” available to human 

resource management personnel.

USAID intends to continue providing inhouse training in leadership, operations, 

financial management, and overall 

managing for results. The agency plans 

to train 2,500 employees in fiscal 2003.
Appendix XXII

Observations on the U.S. Agency for 

International Development’s Efforts to 

Address Its Major Management Challenges

Page 179 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 

2001 high-risk update noted that 

agencies’ and governmentwide efforts to 

strengthen information security have 

gained momentum and expanded. 

Nevertheless, recent audits continue to 

show that federal computer systems are 

riddled with weaknesses that make them 

highly vulnerable to computer-based 

attacks and place a broad range of 

critical operations and assets at risk of 

fraud, misuse, and disruption. Further, 

the events of September 11, 2001, 

underscored the need to protect 

America’s cyberspace against 

potentially disastrous cyber attacks—

attacks that could also be coordinated to 

coincide with physical terrorist attacks to 

maximize the impact of both.

USAID reported that it has improved its computer 

security. For example, the agency’s computer 

security framework includes updated security 

policies and a risk assessment process. USAID 

has also improved its security training. However, 

the report does not provide any information on the 

content of the security training or the numbers and 

types of personnel who received the training. 

USAID plans to initiate actions to improve 

its computer security to reduce the 

possibility of unauthorized access. 

However, the plan does not provide 

information on specific actions or time 

frames for completion.

The National Institute of Standards and 

Technology (NIST) developed a security 

assessment framework and related tools 

that agencies can use in determining the 

status of their information security 

programs. Also, Office of Management 

and Budget (OMB) guidance for fiscal 

year 2002 reporting under the 

Government Information Security Reform 

Act (GISRA) requires agencies to use 

tools developed by NIST to evaluate the 

security of unclassified systems or 

groups of systems.

In addition, OMB’s GISRA reporting 

guidance requires specific performance 

measures as well as corrective action 

plans with quarterly status updates.

GAO-designated major management 

challenge

Challenges with developing reliable 

performance measures and 

accurately reporting results of 

programs: USAID continues to have 

problems developing performance 

measurement systems that meet 

external and internal reporting 

requirements, including the 

requirements of the Government 

Performance and Results Act of 1993.

USAID reported that it has taken a number of steps 

to address this challenge. USAID’s corrective 

actions included (1) developing and disseminating 

lists of indicators that can be used by missions 

seeking appropriate tools to measure performance, 

(2) sending annual reporting guidance cables to 

operating units on the types of data needed and the 

documentation required, (3) expanding the 

publication of supplementary guidance to missions 

on managing data for maximum quality and utility, 

and (4) holding training seminars for its overseas 

officers on managing for results. 

In 2001, USAID started to train its staff through a 

series of workshops held at missions around the 

world. During fiscal 2001, USAID reported that it 

trained 750 officers on its programming policies and 

nearly 500 officers on performance management. 

According to USAID’s 2003 plan, the 

agency is streamlining, simplifying, and 

improving its annual performance 

reporting process. In addition, the plan 

includes an annex that describes 

performance measurement indicators 

and how they are calculated. The annex 

also assesses the quality of the data. 

However, the 2003 plan does not include 

specific goals related to improving the 

reliability of performance indicators and 

reporting of results.

USAID plans to continue providing 

training on performance management 

and reporting. However, its 2003 plan 

does not include specific training targets.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal year 

2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXII

Observations on the U.S. Agency for 

International Development’s Efforts to 

Address Its Major Management Challenges

Page 180 GAO-03-225 Status of Addressing Major Management Challenges

Implementing an integrated financial 

management system

USAID acknowledged the cornerstone of its 

financial management improvement program is the 

implementation of a core financial system that is 

fully compliant with federal requirements and 

standards. While USAID has made progress in 

improving some areas of financial management, it 

still needs to make additional improvements to 

produce timely and accurate financial information 

for use by USAID managers in carrying out the 

agency’s goal of providing economic, development, 

and humanitarian assistance around the world in 

support of United States foreign policy. 

The Inspector General has continued to report that 

USAID’s financial management systems do not 

meet federal financial system requirements. In 

Fiscal 2001, USAID used a variety of nonintegrated 

systems that required data reentry, supplementary 

accounting records, and lengthy and burdensome 

reconciliation processes. Currently USAID uses a 

variety of nonintegrated systems that require data 

reentry, supplementary accounting records, and 

lengthy and burdensome reconciliation processes. 

In an attempt to mitigate this long-standing 

problem, USAID recently deployed an off-the-shelf 

accounting system as a component of its financial 

management system. However, USAID still lacks a 

fully integrated financial management system and 

places a greater reliance on manual processes 

such as reconciliations, because data for the same 

transactions are entered into multiple systems.

USAID’s performance goal for a core 

financial management system certified 

compliant with federal requirements has 

two indicators:

• A fully operational, secure, and 

compliant core financial system 

installed with interfaces to major feeder 

systems.

• A system installed in Washington and 

the field to allocate administrative cost 

to agency strategic goals.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal year 

2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXII

Observations on the U.S. Agency for 

International Development’s Efforts to 

Address Its Major Management Challenges

Page 181 GAO-03-225 Status of Addressing Major Management Challenges

Financial management information 

unreliable/financial statements 

inaccurate and do not measure 

program results

USAID’s report identified financial management as 

a management challenge and recognized the need 

to improve the quality and availability of financial 

and performance data. However, the report does 

not directly address agency progress in obtaining 

an unqualified opinion on its financial statements. 

Fiscal year 2001 marked the first time that the 

USAID Inspector General was able to express an 

opinion on three of USAID’s financial statements—

the Balance Sheet, Statement of Changes in Net 

Position, and Statement of Budgetary Resources. 

However, the opinions were qualified and achieved 

only through extensive efforts to overcome material 

internal control weaknesses. Thus, the progress 

made is not necessarily sustainable. Further, the 

Inspector General was still unable to express an 

opinion on USAID’s Statement of Net Cost and 

Statement of Financing because USAID’s financial 

management systems could not produce accurate, 

complete, reliable, timely, and consistent financial 

statement and performance information. USAID’s 

inadequate accounting systems make it difficult for 

the agency to accurately account for activity costs 

and measure its program results. 

The plan has no goals or measures that 

addresses this challenge. However, it 

provides a fiscal year 2003 time frame for 

establishing an integrated financial 

management system that is certified 

compliant with federal requirements. 

Also, USAID indicated that in fiscal 2003 

it has a target to install a system capable 

of allocating costs to strategic objectives 

throughout the agency. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal year 

2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 182 GAO-03-225 Status of Addressing Major Management Challenges

Appendix XXIII

Observations on the Department of Veterans 

Affairs’ Efforts to Address Its Major 

Management Challenges ApendxiXI

The following table identifies the major management challenges 

confronting the Department of Veterans Affairs (VA), which include the 

governmentwide high-risk areas of strategic human capital management 

and information security. The first column lists the challenges identified by 

our office. The second column discusses what progress, as discussed in its 

fiscal year 2001 performance report, VA has made in resolving its 

challenges. The third column discusses the extent to which VA’s fiscal year 

2003 performance plan includes performance goals and measures to 

address the challenges that we identified. We found that VA’s performance 

report discussed the agency’s progress in resolving all of its major 

challenges that GAO identified or some aspect of those challenges. For 

example, while VA discusses its plan to report to the Congress in 2004 the 

outcomes of its 3-year pilot study of assisted living, it does not provide 

information on the full continuum of services needed to provide long-term 

care.

Similarly, not all aspects of each of the agency’s six major management 

challenges were fully addressed. For example, the plan notes that it has 

undertaken several initiatives to address third-party collections 

weaknesses, but it does not have a performance measure for third-party 

collections.
Appendix XXIII

Observations on the Department of Veterans 

Affairs’ Efforts to Address Its Major 

Management Challenges

Page 183 GAO-03-225 Status of Addressing Major Management Challenges

Table 24: Major Management Challenges for VA

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan

GAO-designated governmentwide high 

risk

Strategic human capital management:

GAO has identified shortcomings at multiple 

agencies involving key elements of modern 

strategic human capital management, 

including strategic human capital planning 

and organizational alignment; leadership 

continuity and succession planning; 

acquiring and developing a staff whose size, 

skills, and deployment meet agency needs; 

and creating results-oriented organizational 

cultures.

We found that VA faces a potential shortage 

of skilled nurses, which could have a 

significant effect on VA’s quality of care 

initiatives. VA also needs to be vigilant in its 

human capital strategies to ensure that it 

maintains the necessary expertise to 

process claims as newly hired employees 

replace many experienced claims 

processors over the next 5 years.

In response to the President’s Management 

Agenda, VA reported that it has developed a 

human capital workforce and succession 

plan, which articulates specific strategies to 

address recruitment, retention, and 

development issues. For example, to help 

retain a skilled and competent workforce, VA 

developed a childcare tuition assistance 

program for lower-income employees.

In addition, VA reported that it is engaged in 

multiple efforts to assess its current nursing 

workforce and plan for the future. For 

example, a workgroup reported on the effect 

of the nursing shortage and barriers to 

recruitment and retention of nurses. The 

report contains a reference guide for the 

optimal use of hiring and pay authorities and 

recommends legislative and nonlegislative 

initiatives to address the nursing shortage.

Finally, VA reported that it launched a 

centralized training initiative—the standard 

for training future hires—for veterans service 

representatives, who request and obtain 

information on and evaluate veterans claims 

and assign a disability rating.

VA reported that the overall goal of its 

workforce planning initiative is to create an 

ongoing process—integrated with VA’s 

strategic and budget planning cycles—to 

predict future workforce trends and avert 

potential workforce crises. VA has 

developed an “interim” objective—and 

related performance measures and 

targets—to recruit, develop, and retain a 

competent, committed, and diverse 

workforce that provides high-quality service 

to veterans and their families.

VA reported that the national nursing 

shortage continues to be a priority for the 

health care industry, although there is no 

indication that the quality of care in VA 

medical centers has been adversely 

affected by this shortage. VA plans to 

maintain an active recruitment process, and 

legislation authorizing higher salaries for VA 

nurses should help these efforts. However, 

VA does not describe other strategies for 

addressing this shortage.

VA also reported that it plans to test national 

performance standards for claims 

processors.
Appendix XXIII

Observations on the Department of Veterans 

Affairs’ Efforts to Address Its Major 

Management Challenges

Page 184 GAO-03-225 Status of Addressing Major Management Challenges

Information security: Our January 2001 

high-risk update noted that agencies’ and 

governmentwide efforts to strengthen 

information security have gained momentum 

and expanded. Nevertheless, recent audits 

continue to show federal computer systems 

are riddled with weaknesses that make them 

highly vulnerable to computer-based attacks 

and place a broad range of critical 

operations and assets at risk of fraud, 

misuse, and disruption. Further, the events 

of September 11, 2001, underscored the 

need to protect America’s cyberspace 

against potentially disastrous cyber 

attacks—attacks that could also be 

coordinated to coincide with physical 

terrorist attacks to maximize the impact of 

both.

VA continues to report information security 

controls as a material weakness on its 

Federal Managers Financial Integrity Act 

(FMFIA) report for 2001. Similarly, the VA 

Office of Inspector General (OIG) reported 

widespread weaknesses in computer 

security.

To improve the department’s information 

security program, VA reported that it met its 

fiscal year 2001 target to have 20 percent of 

the departmentwide information security 

program implemented. VA reported that the 

Office of Cyber Security undertook 

numerous efforts, including

• developing and issuing a revised VA 

Information Security Management Plan, 

which identified security enhancement 

actions,

• establishing a central security fund to 

consistently pursue departmentwide 

security efforts,

• implementing an enterprisewide integrated 

antivirus solution that will facilitate the 

rapid distribution of antivirus updates to 

more than 150,000 VA desktops and 

servers at over 800 locations,

• initiating a contract to develop a 

certification and accreditation program to 

bring discipline, formality, and technical 

excellence to the security planning 

activities of VA offices during the design of 

systems and applications,

• providing VA facilities access to a single 

security incident response service to which 

they can report security incidents and 

receive advice related to scope, effect, and 

suggested remedies,

• establishing a national program in security 

training and education of computer 

professional staff,

• beginning to revamp security policies into 

usable frameworks, and

• developing and submitting to OMB the 

Government Information Security Reform 

Act (GISRA) report and corrective action 

plans.

For fiscal year 2003, VA’s information 

security measure and target is to have 100 

percent of GISRA reviews and reporting 

completed. Further, VA reported that its 

efforts to revamp security policies into a 

usable framework is still ongoing.

However, this measure may not specifically 

gauge the effectiveness of information 

security and the agency’s progress in 

implementing corrective actions. The 

National Institute of Standards and 

Technology (NIST) developed a security 

assessment framework and related tools 

that agencies can use in determining the 

status of their information security programs. 

Also, the Office of Management and Budget 

(OMB) guidance for fiscal year 2002 

reporting under GISRA requires agencies to 

use tools developed by NIST for evaluating 

the security of unclassified systems or 

groups of systems. In addition, OMB’s 

GISRA reporting guidance requires specific 

performance measures, as well as 

corrective action plans with quarterly status 

updates. 

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXIII

Observations on the Department of Veterans 

Affairs’ Efforts to Address Its Major 

Management Challenges

Page 185 GAO-03-225 Status of Addressing Major Management Challenges

GAO-designated major management 

challenge

Ensure timely and equitable access to 

quality VA health care: VA cannot ensure 

that veterans receive timely care at VA 

medical facilities. Nor can it ensure that it 

has maintained the capacity to provide 

veterans who have spinal cord injuries, 

serious mental illnesses, or other special 

needs the care that they require, as 

mandated by the Congress. VA must also 

assess its capacity to provide long-term care 

for its aging veteran population and respond 

to emerging health care needs, such as 

treating veterans for hepatitis C.

In fiscal year 2001, VA reported that it 

established baselines for two of its waiting 

time performance goals: scheduling patients 

for nonurgent primary care and specialty 

care visits within 30 days. VA’s third waiting 

time goal—to have 73 percent of patients 

seen within 20 minutes of their scheduled 

appointment—was not met overall, but half 

of VA’s 22 networks exceeded the goal. 

(Early in 2002, VA combined two networks 

and now has 21.)

VA reported that it exceeded its goal to 

maintain at 95 percent the proportion of 

discharges from spinal cord injury centers to 

noninstitutional settings. VA also reported 

that it met its goal to have

63 percent of homeless veterans with 

mental illness receive follow-up mental 

health outpatient care or admission to a 

work, transitional, or rehabilitation program. 

VA did not establish a target for its one 

hepatitis C measure, but it said that it did not 

achieve its hepatitis C goal. Regarding longterm care, VA is conducting a 3-year pilot 

study of assisted living and plans to report 

the outcomes to the Congress in 2004.

VA set the performance goal to increase the 

percent of primary care and specialty care 

appointments scheduled within 

30 days of desired date to 89 percent and 87 

percent (from 87 and 84 percent), 

respectively. For its third waiting time goal, 

VA established a fiscal year 2003 target of 

72 percent. Efforts described focus on 

improving the quality of the data used to 

measure performance.

VA’s fiscal year 2003 performance target 

related to care for veterans with spinal cord 

injuries remains at 95 percent. Its 

performance target for caring for homeless 

veterans with mental illness also remains at 

the fiscal year 2001 target of 

63 percent; however, its strategic target for 

this goal is 68 percent. VA established three 

new measures for caring for veterans with 

hepatitis C as well as targets for two of these 

measures: the fiscal year 2003 performance 

target for percentage of all patients 

screened and percentage of all patients 

tested for hepatitis C is

61 percent and 65 percent, respectively, with 

strategic targets set at 80 percent and 82 

percent. The fiscal year 2003 performance 

target and strategic target for the third 

measure—percentage of patients with 

hepatitis C who have annual assessment of 

liver function—are to be determined. While 

VA acknowledges GAO’s concern regarding 

long-term care, its strategy for ensuring 

adequate capacity is not addressed in its 

fiscal year 2003 performance plan.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXIII

Observations on the Department of Veterans 

Affairs’ Efforts to Address Its Major 

Management Challenges

Page 186 GAO-03-225 Status of Addressing Major Management Challenges

Maximize VA’s ability to provide health 

care within available resources: VA must 

continue to aggressively pursue 

opportunities to use its health care 

resources. VA could achieve more 

efficiencies by further modifying its 

infrastructure to support its increased 

reliance on outpatient health care services, 

expanding its use of alternative methods for 

acquiring support services, and pursuing 

additional opportunities with the Department 

of Defense (DOD) to determine costeffective ways to serve both veterans and 

military personnel. In addition, VA must 

ensure that it collects the money it is due 

from third-party payers.

VA’s report addresses two of these 

concerns—capital asset management and 

procurement reform—under its “enabling 

goal,” which aims to create an environment 

that fosters the delivery of “world-class” VA 

services. The enabling goal has no key 

performance measures.

VA reported that its Capital Asset 

Realignment for Enhanced Services 

(CARES) program is ongoing.

VA reported that its Procurement Reform 

Task Force, formed in July 2001, established 

five major goals: leverage purchasing power, 

standardize commodities, obtain 

comprehensive VA procurement 

information, improve VA procurement 

organizational effectiveness, and ensure 

sufficient and talented acquisition workforce.

VA also reported that in May 2001, the 

President’s Task Force to Improve Health 

Care Delivery for Our Nation’s Veterans was 

established. The task force’s mission is to 

identify ways to improve benefits and 

services for DOD military retirees who are 

also VA beneficiaries, review barriers and 

challenges that impede VA and DOD 

coordination, and identify opportunities for 

improved resource utilization through 

partnerships.

In addition, VA reported that its Revenue 

Enhancement Work Group and Steering 

Committee identified 24 major 

recommendations that require action in 

order to bring VA’s revenue operation to the 

next level of success in improving third-party 

collections.

In its fiscal year 2003 plan, VA established a 

performance goal of attaining a

30 percent cumulative reduction in excess 

capacity as a result of the implementation of 

CARES. The national CARES plan will 

identify total excess capacity. VA reports 

that this first phase of CARES, implementing 

the program in the Network 12, will take 5 

years or more. 

VA established the performance goal of 

increasing the number and dollar volume of 

sharing agreements with DOD by

10 percent over the previous year. This 

sharing includes joint procurement activities 

as well as sharing resources. The fiscal year 

2003 plan reiterates the creation of the 

President’s task force but does not provide 

an update on the task force’s progress.

While VA’s fiscal year 2003 plan notes that it 

has undertaken several initiatives to address 

third-party collections weaknesses, it does 

not have a performance measure for thirdparty collections. Moreover, it does not 

report on the status of the Revenue 

Enhancement Work Group and Steering 

Committee’s 24 recommendations.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXIII

Observations on the Department of Veterans 

Affairs’ Efforts to Address Its Major 

Management Challenges

Page 187 GAO-03-225 Status of Addressing Major Management Challenges

Process veterans’ disability claims 

promptly and accurately: VA has had longstanding difficulties in ensuring timely and 

accurate decisions on veterans’ claims for 

disability compensation. Veterans have also 

raised concerns that claims decisions are 

inconsistent across VA’s regional offices. VA 

needs better analyses of its processes in 

order to target error-prone types of cases 

and identify processing bottlenecks—as well 

as determine if its performance goals are 

realistic.

VA reported that it exceeded its fiscal year 

2001 timeliness goal to complete ratingrelated actions on compensation and 

pension claims on average within 202 days; 

however, this performance was worse than 

the previous year’s—a trend VA 

characterized as “unacceptable.” VA also 

reported exceeding its goal of a national 

accuracy rate of 72 percent. The fiscal year 

2001 rate of 78 percent was significantly 

better than the fiscal year 2000 rate of 59 

percent.

VA set its fiscal year 2003 timeliness target 

at 165 days, and its strategic target at 74 

days. (The Secretary set a goal of an 

average of 100 days processing time for the 

last quarter of fiscal year 2003.) However, 

for fiscal year 2002, VA projected that it 

would take an average of 208 days to 

process rating-related actions—27 days 

more than in fiscal year 2001. Conversely, 

the accuracy rate for VA’s claims processing 

was expected to continue to improve. For 

fiscal year 2002, VA projected that the rate 

would be 85 percent. VA’s fiscal year 2003 

target is 88 percent, and its strategic target 

is 96 percent.

VA has numerous initiatives planned for 

fiscal year 2003 aimed at improving claims 

processing. These initiatives focus on 

automation, training, performance 

assessment, and program evaluation.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Appendix XXIII

Observations on the Department of Veterans 

Affairs’ Efforts to Address Its Major 

Management Challenges

Page 188 GAO-03-225 Status of Addressing Major Management Challenges

Develop sound agencywide management 

strategies to build a high-performing 

organization: VA must revise its budgetary 

structure—to link funding to performance 

goals, rather than program operations—and 

develop long-term, agencywide strategies 

for ensuring an appropriate IT infrastructure 

and sound financial management.

VA reported that it and OMB jointly 

developed a proposal to restructure and 

simplify VA’s budget accounts and to base 

its budgeting on performance. VA plans to 

implement the proposal with the fiscal year 

2004 budget.

In fiscal year 2001, VA also reported that it 

made numerous advances regarding its 

enterprise architecture, including creating 

the Office of the Chief Architect, developing 

and issuing the “One VA” enterprise 

architecture strategy and implementation 

plan, and organizing and developing the 

Information Technology Board.

In addition, VA reported that it received an 

unqualified opinion on the consolidated 

financial statements for fiscal year 2000 and 

fiscal year 1999. VA also made progress in 

correcting material weaknesses in 

numerous areas and committed to 

addressing the remaining weaknesses. 

Discussions of the details of the new 

structure for the budget accounts are 

ongoing with OMB and congressional 

appropriations committees. The fiscal year 

2003 plan states that VA intends to 

implement the new account structure with 

the 2004 budget. However, VA continues to 

work with OMB and has yet to delineate 

specific measures for this goal.

VA’s fiscal year 2003 plan identifies 

milestones for its IT approach and 

implementation—part of VA’s enabling goal. 

VA also set one IT measure and target: 100 

percent of Chief Information Officerdesignated major IT systems conform to the 

“One VA” enterprise architecture.

VA’s plan acknowledges the significant 

material weaknesses identified by its OIG 

and by GAO, such as noncompliance with 

FFMIA requirements, but does not have 

goals, measures, or strategies for 

addressing these weaknesses. Corrective 

actions needed to address noncompliance 

are expected to take several years to 

complete. In addition, the risk of materially 

misstating financial information remains high 

because of the need to perform extensive 

manual compilations and extraneous 

processes.

(Continued From Previous Page)

Major management challenge

Progress in resolving major management 

challenge as discussed in agency’s fiscal 

year 2001 performance report

Applicable goals, measures, and 

strategies as discussed in agency’s 

fiscal year 2003 performance plan
Page 189 GAO-03-225 Status of Addressing Major Management Challenges

Appendix XXIV

GAO Contact and Staff Acknowledgments ApendxiXXIV

GAO Contact Elizabeth H. Curda, (202) 512-4040

Acknowledgments In addition to the individual named above, the following individuals made 

significant contributions to this report: Charles M. Adams, Michael 

Alexander, Cornelia M. Ashby, Sheila K. Avruch, James Beard, Ronald W. 

Beers, Steven J. Berke, Daniel Bertoni, Amy Bevan, J. Michael Bollinger, 

Elaine M. Boudreau, Barbara D. Bovbjerg, Lisa M. Brown, John Brummet, 

Jeannie M. Bryant, Susan H. Campbell, Richard Cheston, Amy M. Choi, 

Steven L. Cohen, Robert F. Dacey, Kirk Daubenspeck, Peter J. Del Toro, 

William J. Dowdal, Patrick Dugan, E. Jeanette Espinola, Fred Felder, 

Charles R. Fox, Mark Gaffigan, Jonathan M. Gill, Dianne D. Guensberg, 

Richard Harada, Margaret K. Harris, Richard J. Herley, Anne M. Hilleary, 

Samuel L. Hinojosa, Tim D. Hopkins, Albert H. Huntington, III, David W. 

Irvin, Ronald Y. Ito, Shirley B. Johnson, John V. Kelly, Karen L. Kemper, 

Edward D. Kennedy, Jeffrey Knott, Edward A. Kratzer, Carol Langelier, 

Kathy Larin, Lynn Lavalle, Evelyn Logue, Jeffery D. Malcolm, Charles W. 

Malphurs, Patty Manthe, Weldon McPhail, Carolyn K. McGowan, Valerie 

Melvin, Edmond E. Menoche, Mary A. Mohiyuddin, Robin M. Nazzaro, Tim 

Outlaw, Robert Owens, Susan Ragland, Paula M. Rascona, Patricia Rennie, 

William B. Ritt, William H. Roach, Jr., Mark Shaw, Andrew Sherrill, Nancy 

A. Simmons, Karen Sloan, George H. Stalcup, Gerald Stankosky, Keith 

Steck, Tamara Stenzel, Edward H. Stephenson, John B. Stephenson, 

Carolyn M. Taylor, Anjali Tekchandani, William Thompson, Charles Vrabel, 

William F. Wadsworth, Elwood D. White, Gregory C. Wilshusen, Ellen T. 

Wolfe, Ronnie E. Wood, and Anthony J. Wysocki.

(450153)
GAO’s Mission The General Accounting Office, the investigative arm of Congress, exists to 

support Congress in meeting its constitutional responsibilities and to help improve 

the performance and accountability of the federal government for the American 

people. GAO examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of accountability, 

integrity, and reliability.

Obtaining Copies of 

GAO Reports and 

Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and fulltext files of current reports and testimony and an expanding archive of older 

products. The Web site features a search engine to help you locate documents 

using key words and phrases. You can print these documents in their entirety, 

including charts and other graphics.

Each day, GAO issues a list of newly released reports, testimony, and 

correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site 

daily. The list contains links to the full-text document files. To have GAO e-mail this 

list to you every afternoon, go to www.gao.gov and select “Subscribe to GAO 

Mailing Lists” under “Order GAO Products” heading.

Order by Mail or Phone The first copy of each printed report is free. Additional copies are $2 each. A check 

or money order should be made out to the Superintendent of Documents. GAO 

also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single 

address are discounted 25 percent. Orders should be sent to:

U.S. General Accounting Office

441 G Street NW, Room LM

Washington, D.C. 20548

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Public Affairs Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202) 512-4800

U.S. General Accounting Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548
United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Service Requested

Presorted Standard

Postage & Fees Paid

GAO

Permit No. GI00