COUNTERING 

OVERSEAS 

THREATS

Gaps in State 

Department 

Management of 

Security Training May 

Increase Risk to U.S. 

Personnel

Report to Congressional Addressees

March 2014

GAO-14-360

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-14-360, a report to 

congressional addressees

March 2014

COUNTERING OVERSEAS THREATS 

Gaps in State Department Management of Security 

Training May Increase Risk to U.S. Personnel 

Why GAO Did This Study

U.S personnel engaged in efforts 

overseas have faced numerous 

threats to their security. To mitigate 

these threats and prepare U.S. 

personnel for work in high-threat 

environments, State established a 

mandatory requirement that specified 

U.S. executive branch personnel 

under chief-of-mission authority and 

on assignments or short-term TDY 

complete FACT security training

before arrival in a high-threat

environment. This report examines (1) 

State and USAID personnel’s 

compliance with the FACT training 

requirement and (2) State’s and 

USAID’s oversight of their personnel’s 

compliance. GAO reviewed agencies’ 

policy guidance; analyzed State and 

USAID personnel data from March 

2013 and training data for 2008 

through 2013; reviewed agency 

documents; and interviewed agency 

officials in Washington, D.C., and at 

various overseas locations. This public 

version of a February 2014 sensitive 

report excludes information that State 

has deemed sensitive.

What GAO Recommends

GAO is making several recommendations to improve oversight of 

compliance with the FACT training 

requirement. These include identifying 

a mechanism to readily determine the 

universe of U.S. personnel subject to 

the requirement, updating State’s

policy manual to reflect changes made 

to the requirement in June 2013, 

consistently verifying that all U.S. 

civilian personnel have completed 

FACT training before arriving in 

designated high-threat countries, and 

monitoring compliance with the 

requirement. State concurred with the 

recommendations and stated that it will 

take steps to address them. USAID did 

not specifically agree or disagree but 

noted it plans to take additional steps. 

What GAO Found

Using data from multiple sources, GAO determined that 675 of 708 Department

of State (State) personnel and all 143 U.S. Agency for International Development 

(USAID) personnel on assignments longer than 6 months (assigned personnel) 

in the designated high-threat countries on March 31, 2013, were in compliance 

with the Foreign Affairs Counter Threat (FACT) training requirement. GAO found 

that the remaining 33 State assigned personnel on such assignments had not 

complied with the mandatory requirement. For State and USAID personnel on 

temporary duty of 6 months or less (short-term TDY personnel), GAO was unable 

to assess compliance because of gaps in State’s data. State does not 

systematically maintain data on the universe of U.S. personnel on short-term 

TDY status to designated high-threat countries who were required to complete 

FACT training. This is because State lacks a mechanism for identifying those 

who are subject to the training requirement. These data gaps prevent State or an 

independent reviewer from assessing compliance with the FACT training 

requirement among short-term TDY personnel. According to Standards for 

Internal Control in the Federal Government, program managers need operating 

information to determine whether they are meeting compliance requirements. 

State’s guidance and management oversight of personnel’s compliance with the

FACT training requirement have weaknesses that limit State’s ability to ensure 

that personnel are prepared for service in designated high-threat countries. 

These weaknesses include the following:

• State’s policy and guidance related to FACT training—including its Foreign 

Affairs Manual, eCountry Clearance instructions for short-term TDY 

personnel, and guidance on the required frequency of FACT training—are 

outdated, inconsistent, or unclear. For example, although State informed 

other agencies of June 2013 policy changes to the FACT training 

requirement, State had not yet updated its Foreign Affairs Manual to reflect 

those changes as of January 2014. The changes included an increase in the 

number of high-threat countries requiring FACT training from 9 to 18.

• State and USAID do not consistently verify that U.S. personnel complete 

FACT training before arriving in designated high-threat countries. For 

example, State does not verify compliance for 4 of the 9 countries for which it 

required FACT training before June 2013.

• State does not monitor or evaluate overall levels of compliance with the 

FACT training requirement. 

State’s Foreign Affairs Manual notes that it is the responsibility of employees to 

ensure their own compliance with the FACT training requirement. However, the 

manual and Standards for Internal Control in the Federal Government also note 

that management is responsible for putting in place adequate controls to help 

ensure that agency directives are carried out. The gaps in State oversight may 

increase the risk that personnel assigned to high-threat countries do not 

complete FACT training, potentially placing their own and others’ safety in 

jeopardy.

View GAO-14-360. For more information, 

contact Charles Michael Johnson, Jr. at (202) 

512-7331 or johnsoncm@gao.gov.
Page i GAO-14-360 Mandatory Security Training 

Letter 1

Background 4

Most State and USAID Assigned Personnel Completed FACT 

Training, but Gaps in State Department Data Prevent 

Compliance Assessment for Short-Term TDY Personnel 8

State Department’s Guidance and Management Oversight of 

Compliance with FACT Training Requirement Has Weaknesses 13

Conclusions 22

Recommendations for Executive Action 23

Agency Comments and Our Evaluation 24

Appendix I Objectives, Scope, and Methodology 27

Objective 1: Compliance with the FACT Training Requirement 

among State and USAID Personnel 28

Objective 2: State’s and USAID’s Oversight of Their Personnel’s 

Compliance with the FACT Training Requirement 31

Appendix II Examples of Anti-U.S. Attacks Overseas

September 2012 to September 2013 32

Appendix III FACT Training Compliance among State and 

USAID Assigned Personnel Identified as Required to 

Complete FACT Training 39

Appendix IV Comments from the Department of State 43

GAO Comments 46

Appendix V Comments from the U.S. Agency for International Development 47

Appendix VI GAO Contact and Staff Acknowledgments 50

Contents
Page ii GAO-14-360 Mandatory Security Training 

Tables

Table 1: FACT Training Compliance among Department of State 

Assigned Personnel Identified as Required to Complete 

Training and in Designated High-Threat Countries on 

March 31, 2013, by Country 39

Table 2: Noncompliance with FACT Training Requirement among 

Department of State Assigned Personnel Identified as 

Required to Complete Training and in Designated HighThreat Countries on March 31, 2013 40

Table 3: FACT Training Compliance among USAID Assigned 

Personnel Identified as Required to Complete Training 

and in Designated High-Threat Countries on March 31, 

2013, by Country 42

Figures

Figure 1: Examples of Topics Addressed by the Foreign Affairs 

Counter Threat Training Course 5

Figure 2: Overview of Electronic Country Clearance Request and 

Approval Process 15

Figure 3: Instructions in eCC System Provided to Short-term TDY 

Personnel and Relevant Agency Officials for Designated 

High-Threat Countries 16

Figure 4: Department of State (State) and U.S. Agency for 

International Development (USAID) Verification of FACT 

Training Compliance for Assigned Personnel 19
Page iii GAO-14-360 Mandatory Security Training 

Abbreviations

eCC eCountry Clearance 

FACT Foreign Affairs Counter Threat 

FAM Foreign Affairs Manual

GEMS Global Employment Management System

OIP Orientation and In-Processing Center 

State Department of State

STMS Student Training Management System

TDY temporary duty 

USAID U.S. Agency for International Development

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-14-360 Mandatory Security Training 

441 G St. N.W.

Washington, DC 20548

March 10, 2014

Congressional Addressees

Civilian U.S. personnel engaged in U.S. efforts overseas, including 

assistance to foreign partners, have been the target of attacks by Al 

Qaeda, its affiliates, and other violent extremists. In September 2012, 

attacks on U.S. diplomatic facilities and personnel in Benghazi, Libya

killed four Americans, including the U.S. Ambassador. In the same month, 

a car bomb hit U.S. government vehicles in Pakistan, injuring two 

Americans, and protesters in Egypt and Yemen overran the U.S. 

embassies’ security defenses and broke into the embassy compounds.1

The President has instructed U.S. chiefs of mission that they are 

responsible for providing for the security of all U.S. government personnel 

on official duty abroad and their accompanying dependents, unless an 

interagency agreement provides otherwise.2

 1

According to State officials, although protesters breached embassy perimeters and got 

onto compounds, the physical defensive features of the buildings performed fully as 

designed by successfully preventing intrusion, despite repeated attempts by protesters to 

break through them. 

To help safeguard and 

prepare personnel serving in high-threat countries, the Department of 

State (State) established a mandatory requirement that specified U.S. 

personnel under chief-of-mission authority in designated high-threat 

countries receive Foreign Affairs Counter Threat (FACT) training before 

deploying. FACT training, conducted by State’s Bureau of Diplomatic 

Security, provides instruction in personal security skills necessary for 

recognizing, avoiding, and responding to potential terrorist and other 

threat situations.

2

Chiefs of mission are the principal officers in charge of U.S. diplomatic missions and 

certain U.S. offices abroad that the Secretary of State designates as diplomatic in nature. 

Usually, the U.S. ambassador to a foreign country is the chief of mission in that country. 

According to the law, the chief of mission’s authority encompasses all employees of U.S. 

executive branch agencies, excluding personnel under the command of a U.S. area 

military commander and Voice of America correspondents on official assignment (22 

U.S.C. § 3927). According to the President’s letter of instruction to chiefs of mission, 

members of the staff of an international organization are also excluded from chief-ofmission authority. The President’s letter of instruction further states that the chief of 

mission’s security responsibility extends to all government personnel on official duty 

abroad other than those under the protection of a U.S. area military commander or on the 

staff of an international organization.
Page 2 GAO-14-360 Mandatory Security Training 

This report examines (1) compliance with the FACT training requirement 

among civilian personnel employed by State and the U.S. Agency for 

International Development (USAID) and (2) State’s and USAID’s 

oversight of personnel’s compliance with the requirement. We focused 

our review on State and USAID because they are the primary foreign 

affairs agencies with civilian personnel in countries for which State 

requires FACT training. Because of broad congressional interest in 

threats against U.S. personnel overseas, we prepared this report under 

the authority of the U.S. Comptroller General to conduct evaluations on 

his own initiative. This report is a public version of a sensitive report that 

we issued in February 2014. State deemed some of the information in our 

prior report as sensitive but unclassified information, which must be 

protected from public disclosure. Therefore, this report omits sensitive 

information about the countries to which the FACT training requirement 

pertains. Although the information provided in this report is more limited in 

scope, this report addresses the same questions as the sensitive report 

and uses the same methodology.

To examine compliance with the FACT training requirement, we collected 

available data on State and USAID personnel who were in eight of the 

nine high-threat countries3 for which State required FACT training and 

were subject to the requirement on March 31, 2013.4

 3 For one of the eight countries, State requires that its personnel assigned to selected 

posts complete FACT training prior to deployment. Personnel assigned to other posts in 

that country are not required to take the training.

We collected data 

from State and USAID on two categories of personnel: those on 

assignments or temporary-duty (TDY) of more than 6 months (assigned 

personnel) and those on TDY of 1 to 6 months (short-term TDY 

4 We did not examine compliance with the FACT training requirement among personnel in 

Afghanistan, because we have previously reported on the extent of compliance with the 

FACT training requirement among U.S. personnel in that country. See GAO, Afghanistan: 

Improvements Needed to Strengthen Management of U.S. Civilian Presence, 

GAO-12-285 (Washington, D.C.: Feb. 27, 2012). In June 2013, State increased the 

number of countries for which it required FACT training from 9 to 18.
Page 3 GAO-14-360 Mandatory Security Training 

personnel).5 We identified State and USAID personnel assigned to the 

eight countries as of March 31, 2013. We compared these data with 

State’s and USAID’s records of personnel’s completion of FACT or FACTequivalent training, and we categorized as noncompliant any assigned 

personnel with no such records or with no records within 5 years of the 

start of their assignments. To assess the data’s reliability, we interviewed 

agency officials responsible for compiling the data or maintaining the 

systems that generated the data, and we performed checks of the data’s 

consistency and completeness. We found the data to be reliable for 

determining the extent of compliance with the FACT training requirement 

among State and USAID assigned personnel. We also attempted to 

conduct the same analysis for personnel on short-term TDY of 6 months 

or less, but we found the data to be insufficiently reliable for determining 

the extent of compliance among these personnel. (We discuss this issue 

later in the report.) We did not examine compliance for Diplomatic 

Security special agents and security protective specialists because 

State’s Foreign Affairs Manual exempts these personnel from FACT 

training.6

We conducted this performance audit from March 2013 to March 2014 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

To examine State’s and USAID’s oversight of compliance with 

the FACT training requirement, we reviewed State and USAID policies 

and procedures and interviewed relevant agency officials at State and 

USAID headquarters in Washington, D.C., and at various overseas posts. 

See appendix I for a detailed description of our objectives, scope, and 

methodology.

 5 For the purposes of our review, we defined “assigned personnel” as personnel on tours 

of duty exceeding 6 months, including employed eligible family members. This definition is 

consistent with the definition in State’s Foreign Affairs Handbook (FAH), which states that 

an assignment is a tour of duty to a Foreign Service position that exceeds 6 months (3 

FAH-1 H-2421). Our definition of “assigned personnel” also includes those who are in 

long-term TDY status in two of eight countries for more than 180 days, because the 

Foreign Affairs Manual (FAM) explicitly requires these personnel to take the FACT training 

(13 FAM 322). We defined “short-term TDY personnel” as personnel who are on a 

temporary tour of duty at post for 6 months or less; however, because of limitations in 

State’s data systems, we assessed the extent of compliance for short-term TDY personnel 

who were at post for between 30 and 180 days. 

6

13 FAM 322(b).
Page 4 GAO-14-360 Mandatory Security Training 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

State’s Foreign Affairs Manual requires that U.S. government Foreign 

Service and Civil Service employees under chief-of-mission authority with 

assignments or short-term TDY to designated high-threat countries 

complete FACT training before deploying.7 USAID’s Automated Directives 

System additionally requires FACT training for USAID’s U.S. personal 

services contractors deploying to these posts.8

 7

13 FAM 322. 

The 1-week course, held 

at a U.S. location, provides practical, hands-on instruction in topics such 

as detection of surveillance, familiarization with firearms, awareness of 

improvised explosive devices, and provision of emergency medical care 

(see fig. 1 for other examples of topics addressed in FACT training).

8 USAID,”Training and Career/Professional Development,” Automated Directives System

458.3.4.2 (June 4, 2013).

Background
Page 5 GAO-14-360 Mandatory Security Training 

Figure 1: Examples of Topics Addressed by the Foreign Affairs Counter Threat Training Course
Page 6 GAO-14-360 Mandatory Security Training 

To ensure that personnel are prepared to confront current risks in highthreat environments,9

State initially established the FACT training requirement for personnel in 

one country in 2003 and extended it to eight more countries over the next 

9 years.

State requires that personnel complete the course 

every 5 years and updates the FACT training curriculum periodically to 

reflect changing threats abroad. For example, in 2009, the ambassador to 

one high-threat country noted that personnel needed to be familiar with 

the sound of sirens announcing a rocket attack and with the physical 

features of protective bunkers, in part because personnel were injuring 

themselves when entering the bunkers. In response, State’s Diplomatic 

Security Training Center added two bunkers at its training facility and 

began conducting duck-and-cover exercises with recorded sirens. State 

also revised the FACT training curriculum in 2013 to include instruction on 

helicopter operations, vehicle rollover training, and evacuation from a 

smoke-filled environment.

10 In June 2013, State doubled the number of countries for which 

it required FACT training. Prior to that date, the requirement applied to 

assigned personnel and those on short-term TDY in a designated highthreat country for 30 or more cumulative days in a 365-day period (with 

the exception of personnel on short-term TDY to one country, where 

State required FACT training for personnel with 60 cumulative days or 

more of TDY status).11

• In December 2012, the Accountability Review Board, which State 

convened to investigate the attacks on the mission in Benghazi, Libya, 

recommended that FACT training be required for personnel assigned 

to all high-threat, high-risk countries.12

 9

See appendix II for examples of attacks against U.S. personnel and facilities overseas 

from September 2012 through September 2013.

An independent panel 

established as a result of the Accountability Review Board also 

identified training as critical to State’s ability to ensure a safe and 

secure environment for employees.

10The FACT training course replaced a diplomatic security anti-terrorism course for one of 

the high-threat countries, which was administered from 2003 to 2006 to prepare personnel 

for service in that country. 

11 From 2008 to 2010, State issued memoranda specifying that eligible family members of 

personnel under chief-of-mission authority in four countries must complete FACT training 

before arriving in those countries.

12Accountability Review Board report on Benghazi Embassy Attack (December 2012).
Page 7 GAO-14-360 Mandatory Security Training 

• In response to the Accountability Review Board’s recommendation, in 

June 2013, State issued a memorandum notifying U.S. agencies that 

it was increasing the number of countries for which it requires FACT 

training from 9 to 18.13 State also required that employed eligible 

family members of personnel in all designated high-threat countries 

complete FACT training14 and changed the requirement for short-term 

TDY personnel. Under the new requirement, short-term TDY 

personnel must take FACT training if they spend more than 45 

cumulative days in a calendar year in one or more of the designated 

countries.15

State’s Foreign Affairs Manual exempts a selected group of U.S. 

personnel under chief-of-mission authority from the FACT training 

requirement.16

 13The June 2013 State memorandum identifying the nine additional countries noted that 

personnel deploying to three additional countries will also be required to complete FACT 

training but are exempt from the requirement until further notice. State Diplomatic Security 

officials informed us that these countries were granted temporary exceptions based on the 

estimated student training capacity at the facility where FACT training is currently 

conducted. The officials indicated that State is re-evaluating the facility’s capacity, to 

ascertain whether these posts can be included in the FACT training requirement. See 

GAO, Diplomatic Security: Expanded Missions and Inadequate Facilities Post Critical 

Challenges to Training Efforts, 

For example, certain categories of personnel—specifically, 

State Bureau of Diplomatic Security special agents and security 

protective specialists—are exempt from the requirement. Instead of 

completing FACT training, these Diplomatic Security special agents and 

security protective specialists complete a security training course called 

“High-Threat Tactical,” which the Bureau of Diplomatic Security has 

determined exceeds the FACT training requirement. In addition, some 

personnel who were deployed to high-threat countries as of March 31, 

2013, could have met the requirement by completing a 3-week course, 

Security for Non-traditional Operating Environments, which the Bureau of 

Diplomatic Security determined was equivalent to, or exceeded, FACT 

GAO-11-460 (Washington, D.C.: June 1, 2011). 

14See 14 FAM 511.3 for State’s definition of eligible family members.

15Short-term TDY personnel who do not meet this threshold are required to take an online 

course called “High Threat Security Overseas Seminar,” which provides training in 

security topics such as surveillance detection, crime, and defensive driving, among other 

topics.

1613 FAM 322(b).
Page 8 GAO-14-360 Mandatory Security Training 

training.17 In extraordinary circumstances, State may grant a waiver of the 

FACT training requirement to individuals on a case-by-case basis.18

Using data from multiple sources related to State and USAID assigned 

personnel, we determined that 675 of 708 State personnel and all of the 

143 USAID personnel on assignments to the designated high-threat 

countries on March 31, 2013, were in compliance with the FACT training 

requirement.19 We found 33 State assigned personnel who were not in 

compliance with the mandatory training requirement. We were unable to

assess compliance among short-term TDY personnel because of gaps in 

State’s data. First, State has not established a mechanism to identify the 

universe of short-term TDY personnel who are required to take FACT 

training. Second, State’s eCountry Clearance (eCC) system—the most 

comprehensive data source for identifying short-term TDY personnel 

granted country clearance to high-threat posts—has limitations. 

According to GAO’s Standards for Internal Control in the Federal 

Government, program managers need operating information to determine 

whether they are meeting compliance requirements.20

 17The Security for Non-traditional Operating Environments course was discontinued in 

February 2012. 

18According to State officials, State had issued no waivers of the FACT training 

requirement to State or USAID assigned or short-term TDY personnel who were at the 

designated posts on March 31, 2013.

19We did not examine compliance with the FACT training requirement among personnel in 

Afghanistan, because we have previously reported on the extent of compliance with the 

FACT training requirement among U.S. personnel in that country. See GAO-12-285.

20GAO, Standards for Internal Control in the Federal Government, AIMD-00-21.3.1

(Washington, D.C.: November 1999), 19.

Most State and 

USAID Assigned 

Personnel Completed 

FACT Training, but 

Gaps in State 

Department Data 

Prevent Compliance 

Assessment for 

Short-Term TDY 

Personnel
Page 9 GAO-14-360 Mandatory Security Training 

Based on our review of available data, we found that 675 of 708 State 

personnel and all of the 143 USAID personnel in the designated highthreat countries on March 31, 2013, complied with the FACT training 

requirement. We identified 33 noncompliant State personnel.21

Because State does not maintain a single source of data on assigned 

U.S. personnel who are required to complete FACT training, State or an 

independent reviewer has to obtain and reconcile information from three 

State databases—State’s Global Employment Management System 

(GEMS), Student Training Management System, and Post Personnel—as 

well as other sources to assess the extent of compliance among all U.S. 

agencies with the FACT training requirement. In addition, limitations in 

these various State data systems containing information needed to 

assess compliance make it difficult to readily identify personnel subject to 

the FACT training requirement. As a result, the data are not readily 

available for decision making and require resource- and labor-intensive 

efforts to determine compliance. According to internal control standards, 

program managers need operating information to determine whether they 

are meeting compliance requirements.

According 

to State officials, of the 22 noncompliant individuals in one country, 18 

were State personnel’s employed eligible family members who were 

required to take the training; State officials explained that these 

individuals were not aware of the requirement at the time. The officials 

noted that enrollment of family members in the course is given lower 

priority than enrollment of direct-hire U.S. government employees but that 

space is typically available. In addition, a senior official at the embassy in 

another country as of March 31, 2013, did not complete FACT training 

before or during his tenure. According to State officials, this resulted from 

a pressing situation in the country; however, this individual did not receive 

a waiver from the FACT training requirement. State provided a variety of 

reasons why the remaining 10 personnel were not in compliance with the 

requirement (see app. III for more information).

22

The following is a list of the current data systems and the limitations 

associated with each.

 21State did not grant waivers to any of these personnel. 

22AIMD-00-21.3.1, 19.

Most State and USAID 

Assigned Personnel 

Complied with FACT 

Training Requirement, but 

Limitations in State’s Data 

Systems Make It Difficult 

to Readily Determine 

Compliance
Page 10 GAO-14-360 Mandatory Security Training 

Global Employment Management System. GEMS—the centralized 

personnel database for State’s U.S. direct-hire personnel and employed 

eligible family members—identifies direct-hire personnel on assignments, 

including assignments to the designated high-threat countries. However, 

GEMS does not consistently identify State personnel who are required to 

complete FACT training. In some cases, the GEMS data that we reviewed 

included dates for employees’ arrival at post; in other cases, it included 

employees’ hire dates. As a result, to determine whether these personnel 

had completed FACT training within 5 years of arrival at the posts, 

additional employee profile information must be obtained from State’s 

Bureau of Human Resources.23

Student Training Management System. State’s Student Training 

Management System is the official system of record for State, USAID, 

and other agency personnel’s FACT training completion dates. Although 

the Student Training Management System shows personnel who enrolled 

in FACT training, it does not consistently include training completion 

dates. For example, the data that we reviewed lacked FACT training 

completion dates for 9 of 143 assigned USAID personnel. State officials 

could not provide a definitive explanation for the absence of these 

completion dates in the training management system. For these nine 

records, State and USAID officials had to provide alternate forms of 

evidence, such as Foreign Service Institute training transcripts or FACT 

training rosters, to show that personnel had completed the training.

Moreover, GEMS data do not contain a 

field identifying whether certain personnel are subject to the FACT 

training requirement based on their employment type or position. For 

example, the GEMS data do not readily identify eligible family members, 

some of whom were required to complete FACT training. As a result of 

this limitation, additional evidence is required to verify whether they were 

subject to the FACT training requirement. 

Post Personnel. State’s Post Personnel system—a database managed 

by the overseas posts—contains information on all U.S. executive branch 

personnel assigned under chief-of-mission authority. Therefore, we 

 23Examples of these employees include those on limited noncareer appointments or hired 

under 3161 authority specifically for service in high-threat countries. Under 3161 authority, 

federal law allows the head of a temporary organization to appoint persons to positions of 

employment in such numbers and with such skills as are necessary to perform the 

functions required. The period of appointment for these positions may not exceed 3 years, 

unless extended by regulations prescribed by the Office of Personnel Management. 5 

U.S.C. § 3161. 
Page 11 GAO-14-360 Mandatory Security Training 

reviewed data from Post Personnel to identify some USAID personnel 

who were required to complete FACT training, because USAID officials 

told us that data maintained in USAID’s internal staffing report for March 

31, 2013, might not include all personal services contractors at the 

designated high-threat countries. We attempted to compare Post 

Personnel records for USAID personnel with FACT training completion 

records in State’s Student Training Management System to examine 

compliance among USAID personnel. However, we found that the Post 

Personnel data excluded 18 USAID assigned personnel who, according 

to a USAID staffing report, were assigned to countries for which State 

required FACT training on March 31, 2013.

According to State officials, Post Personnel is not an official or reliable 

system of record for information. State is in the process of developing a 

new, centralized system to replace Post Personnel—the Overseas 

Personnel System—that will track the location of all U.S. employees 

stationed at overseas posts and is expected to become operational in 

February 2014, according to State Bureau of Human Resources officials. 

However, according to agency officials, the new system will not integrate 

data from State’s Student Training Management System or other 

personnel data systems.
Page 12 GAO-14-360 Mandatory Security Training 

Gaps in State’s data on U.S. short-term TDY personnel at high-threat 

countries make it impossible for State or an independent reviewer to 

readily assess compliance with the FACT training requirement among 

State and USAID short-term TDY personnel who are required to complete 

FACT training. First, State does not systematically maintain data on the 

universe of U.S. personnel on short-term TDY status in designated highthreat countries who are required to complete the training. Second, 

neither the eCC system—the primary mechanism that State and USAID 

short-term TDY personnel generally use to request country clearance24—

nor any other State system is set up to permit those responsible for 

granting country clearance to determine whether the personnel 

requesting clearance have reached the cumulative 45 days threshold in 

one designated country or across multiple high-threat countries.25

We attempted to use data from the eCC system and State’s Student 

Training Management System to identify the universe and determine 

compliance with the FACT training requirement for short-term TDY 

personnel. However, we were unable to do so because we could not 

obtain a reliable or comprehensive universe of short term TDY personnel 

in designated high-threat countries. Although we attempted to overcome 

these data limitations by examining other State records, we ultimately 

concluded that the available data and records on State and USAID shortterm TDY personnel were not sufficiently reliable to determine the extent 

of compliance for these personnel. This lack of reliable data is 

inconsistent with internal control standards, which state that agencies 

need operating information to determine whether they are meeting their 

compliance requirements.

Determining whether U.S. personnel have reached, or will reach, the 

cumulative-days threshold is a key factor in identifying short-term TDY 

personnel who should have completed FACT training before receiving 

country clearance.

26

 24Chiefs of mission may delegate their approval authority for country clearance to other 

post officials who may be heads of a post’s various sections, including both State and 

USAID staff.

Without such data, agencies cannot 

25Prior to June 2013, personnel at an overseas country for 30 or more cumulative days in 

a 365-day period were required to complete FACT training (with the exception of 

personnel on short-term TDY to one country, where State required FACT training for 

personnel with 60 cumulative days or more of TDY status). As of June 2013, personnel 

traveling to one designated overseas country or across multiple countries for 45 or more 

cumulative days in a 365-day period are required to complete the training.

26AIMD-00-21.3.1, 19.

Gaps in State’s Data 

Prevent Compliance 

Assessment for ShortTerm TDY Personnel
Page 13 GAO-14-360 Mandatory Security Training 

determine the extent to which personnel comply with the mandatory 

training requirement. 

Several weaknesses in State oversight of personnel’s compliance with 

the FACT training requirement limit State’s ability to help ensure that all 

personnel subject to the requirement are prepared for service in highthreat countries. First, State’s policy manual is outdated, and certain 

guidance related to FACT training is inconsistent and unclear. Second, 

State and USAID management personnel responsible for assigning 

civilian personnel and granting them country clearance do not 

consistently verify FACT training completion before the personnel deploy 

to high-threat countries. Third, State management does not monitor or 

evaluate overall levels of compliance with the training requirement. 

Effective management of an organization’s workforce is essential to 

achieving results and an important part of internal control. Only when the 

right personnel for the job are on board and are provided the right 

support, including training, is operational success possible.27

State has not updated the Foreign Affairs Manual to reflect changes 

made to the FACT training requirement in June 2013.28 In addition, 

State’s eCC system provides inconsistent and unclear instructions to 

employees regarding the FACT training-related information they must 

include on eCC request forms. Moreover, we found that State’s guidance 

regarding the required frequency of FACT training is unclear. According 

to Standards for Internal Control in the Federal Government, information 

should be recorded and communicated to management and others in the 

agency in a form and within a time frame that enables them to carry out 

their responsibilities.29

As of January 2014, State had not updated its Foreign Affairs Manual to 

reflect its policy change, announced in June 2013, that (1) increased the 

number of designated high-threat countries requiring FACT training from 

Without up-to-date, consistent, and clear guidance, 

agencies and personnel may not have the information needed to ensure 

compliance with the FACT training requirement. 

 27AIMD-00-21.3.1, 13.

28The relevant sections of State’s Foreign Affairs Manual were last updated in September 

2012. See 13 FAM 321-323.

29AIMD-00-21.3.1, 18.

State Department’s 

Guidance and 

Management 

Oversight of 

Compliance with 

FACT Training 

Requirement Has 

Weaknesses 

State’s Policy and 

Guidance on FACT 

Training Requirement Are 

Outdated, Inconsistent, or 

Unclear

State’s Foreign Affairs Manual 

Has Not Been Updated
Page 14 GAO-14-360 Mandatory Security Training 

9 to 18, (2) changed the cumulative-days threshold for the FACT training 

requirement from 30 or more cumulative days in one high-threat country 

to more than 45 cumulative days in one or more of the countries, and (3) 

described the conditions that indicate whether eligible family members 

must complete the course.

Although State informed other federal agencies and personnel under 

chief-of-mission authority about the changes to the FACT training 

requirement in a June 2013 memorandum and a July 2013 cable, 

respectively, we found that USAID was not implementing changes to the 

requirement as of January 2014. USAID officials told us that they had not 

implemented the revised requirement in part because they were made 

aware that the State’s Bureau of Diplomatic Security did not have the 

capacity to train staff assigned to the newly designated high-threat 

countries; therefore, they believed the changes had not taken effect. 

Updating the Foreign Affairs Manual is important given that USAID 

revised its Automated Directives System guidance in June 2013 to 

provide a specific cross-reference to the FACT training requirement in the 

Foreign Affairs Manual.

30 USAID did this to help ensure that its staff are 

aware of the designated high-threat locations for which FACT training is 

required, in response to a GAO letter sent to USAID in April 2013 

highlighting gaps in its Automated Directives System guidance.

 30See USAID Automated Directives System 458.3.4.2(e) and 13 FAM 322.
Page 15 GAO-14-360 Mandatory Security Training 

Instructions in the eCC system—as previously noted, the primary 

mechanism generally used to request and grant country clearance to 

short-term TDY personnel—included the FACT training requirement for 

eight of the nine designated high-threat countries that we reviewed (see 

fig. 2).31

Figure 2: Overview of Electronic Country Clearance Request and Approval Process

a

In some cases, short-term TDY personnel designate others to complete and submit their eCC 

requests.

However, instructions contained in the eCC system provide inconsistent 

or unclear guidance to U.S. personnel. This occurs because State 

headquarters has not provided instructions to posts in designated highthreat countries regarding the FACT training documentation that 

personnel should include in the clearance requests that they submit 

through the eCC system. Rather, State has granted each overseas post 

responsibility for developing its country requirements information in the 

 31The eCC system is not currently used to provide country clearance for one country 

because the United States has no diplomatic post in that country. Instead, personnel 

submit a travel request for the approval of State’s Under Secretary for Management.

Instructions in eCC System 

Provide Inconsistent and 

Unclear Guidance
Page 16 GAO-14-360 Mandatory Security Training 

system. According to State officials, each post is responsible for 

maintaining and updating its own requirements. Thus, some 

inconsistencies have occurred. Figure 3 illustrates the inconsistency in 

eCC system instructions for designated high-threat countries.

Figure 3: Instructions in eCC System Provided to Short-term TDY Personnel and Relevant Agency Officials for Designated 

High-Threat Countries

Note: As of November 2013.

a

The eCC system is not used to provide country clearance for one country because the United States 

has no diplomatic post in that country. Instead, personnel request country clearance by submitting a 

travel request to the Under Secretary for Management.

Examples of inconsistency and lack of clarity in eCC country instructions 

that we reviewed include the following: 

• The eCC instructions for four countries required employees to record 

their FACT training completion dates on the eCC request or provide 

evidence of FACT training before they arrive at post. The eCC 

instructions for the other four relevant high-threat countries did not 

require employees to provide any documentation of FACT training 

before they arrive at post (see fig. 3). The instructions for three 

countries required employees to specify the dates of training; 
Page 17 GAO-14-360 Mandatory Security Training 

instructions for the fourth country required employees to provide 

evidence of training completion but do not specify what evidence 

should be provided—such as a completion date or training completion 

certificate—or how or to whom the evidence should be provided.

• The eCC instructions for only two countries required officials from the 

sponsoring agency or office to ensure that employees completed 

FACT training before arriving at post. The eCC instructions for one of 

these countries required the employee’s sponsoring agency to provide 

written verification that the employee has completed FACT training; 

the instructions for the other country required the employee’s 

sponsoring agency to ensure employees have FACT training before 

traveling to post.

We also found other State guidance regarding the FACT training 

requirement to be inconsistent and unclear. Specifically, State officials 

have provided inconsistent guidance regarding the frequency with which 

personnel must repeat FACT training. According to State’s Bureau of 

Diplomatic Security, as of November 2013, FACT training must be current 

through the end of an assignment to a designated high-threat country; 

that is, the FACT training certificate must remain valid for the duration of 

the personnel’s entire tour of duty. In contrast, according to State 

Orientation and In-Processing Center (OIP) officials and instructions, all 

required training must be completed within 5 years of arrival at the post, 

and the period since the last training may exceed 5 years during the 

assignment.32 In October 2013, State officials said that they were in the 

process of clearing a “Frequently Asked Questions” cable intended to 

resolve the inconsistency in the guidance, but the officials did not provide 

a date when the cable would be issued.

 32State’s OIP center—a State unit based in Washington, D.C., and staffed mainly by 

contractors—assists assigned personnel with submitting travel requests through the eCC 

system for five of the designated high-threat countries and also assists short-term TDY 

personnel with travel requests for two of the high-threat countries.

Other Guidance Related to 

FACT Training Is Also 

Inconsistent and Unclear
Page 18 GAO-14-360 Mandatory Security Training 

Although State and USAID have processes in place to notify assigned 

and short-term TDY personnel of the FACT training requirement and to 

enroll them in training,33 neither agency consistently verifies completion of 

the training before its respective personnel deploy to high-threat 

countries.34 While State’s Foreign Affairs Manual notes that it is each 

employee’s responsibility to ensure his or her compliance with the FACT 

training requirement, the manual also states that agency management is 

responsible for ensuring adequate controls over all department 

operations.35

State OIP verifies that all State and USAID assigned personnel departing 

for five of the designated high-threat countries have complied with the 

FACT training requirement, and USAID verifies compliance with the 

requirement for assigned USAID personnel departing for two additional 

countries. State does not verify compliance for personnel assigned to the 

other designated high-threat countries (see fig. 4).

Without such controls for ensuring FACT training 

compliance, State increases the risk that personnel may deploy to the 

designated high-threat countries without completing the mandatory 

training.

 33State and USAID human resource officers or OIP officials generally notify assigned 

personnel of the FACT training requirement and enroll them into training. State short-term 

TDY employees typically enroll themselves in FACT training using the Foreign Service 

Institute’s online training system with the approval of their bureau’s supervisors and 

training officers. USAID executive officers at overseas posts typically enroll USAID shortterm TDY personnel.

34Verifying training refers to checking the accuracy of training completion dates against 

evidence of completion, such as a training completion certificate or course roster.

3513 FAM 323(a); 2 FAM 021.1(a); 2 FAM 022.12(a).

State and USAID Do Not 

Consistently Verify FACT 

Training Completion 

before Personnel Deploy 

to High-Threat Countries

Gaps in Verification of FACT 

Training Compliance for 

Assigned Personnel
Page 19 GAO-14-360 Mandatory Security Training 

Figure 4: Department of State (State) and U.S. Agency for International 

Development (USAID) Verification of FACT Training Compliance for Assigned

Personnel

a

As of March 31, 2013, no USAID personnel were assigned to designated high-threat posts in 

Country D or to Country F.

b

Although State officials in Country F request an expected FACT training completion date from all 

assigned personnel who have not previously completed the training, they do not obtain proof of FACT 

training completion, such as an employee’s training transcript or FACT training certificate.

Verification of FACT training compliance varies across countries. U.S. 

personnel with assignments to five countries submit eCC travel requests 

that are routed through OIP to the posts. According to OIP officials, OIP 

forwards the eCC request form to the posts only after verifying, using 

State’s Student Training Management System, that personnel have 

completed FACT training within 5 years of the assignment start date. 

USAID generally verifies whether personnel on assignments to two 

additional countries have completed FACT training before arrival by 

requesting their FACT training completion certificate.

State and USAID generally do not verify short-term TDY personnel’s 

completion of FACT training before deployment. We found two 

instances—USAID in two countries—where agency officials told us that 

they verified FACT training compliance before short-term TDY personnel 

Gaps in Verification of FACT 

Training Compliance for ShortTerm TDY Personnel
Page 20 GAO-14-360 Mandatory Security Training 

arrived at post.36

Although State OIP helps to ensure that eCC requests submitted by 

short-term TDY personnel traveling to two countries include FACT 

training completion dates,

In contrast, State officials told us that they do not verify 

FACT training completion for either of these countries. Furthermore, State 

and USAID officials told us that they do not obtain evidence of FACT 

training completion for short-term TDY personnel for six additional 

countries. For the remaining country, although the eCC instructions call 

for personnel to provide evidence of FACT training, post officials told us 

that they do not review the evidence provided. Moreover, according to a 

State official responsible for managing the eCC system, the department 

has issued no documented protocol or standard operating procedure to 

posts regarding reviewing and approving eCC requests to ensure 

compliance with the FACT training requirement.

37 the office does not verify that the dates are 

accurate. In addition, OIP does not review eCC requests or verify FACT 

training compliance for short-term TDY personnel traveling to the three 

other high-risk countries for which OIP supports short-term TDY travel. 

According to OIP officials, OIP tested the accuracy of a random sample of 

34 employee eCC records over a 2-week period and concluded that it is 

unnecessary to verify eCC data on FACT training completion, based on 

the test’s results.38

 36Since February 2013, USAID officials in one country have been using a form to remind 

post officials to follow up with short-term TDY personnel prior to travel and ask them if 

they have completed the training. State officials in this country recently developed a 

similar form for this purpose.

We believe that OIP’s methodology for conducting this 

test is not sufficient or reliable for determining that no further verification is 

necessary. While OIP’s sample provided anecdotal insights about 

employees’ recorded training dates, the sample results were not 

generalizable to the entire population. Thus, conclusions about the 

population’s accuracy based on OIP’s sample are not appropriate.

37According to State officials, OIP began reviewing eCC requests of short-term TDY 

personnel traveling to one country as of July 1, 2013 as a result of our review on this topic. 

38According to OIP officials, OIP conducted a 2-week validation study of 34 FACT training 

records in State’s Student Training Management System to determine whether the FACT 

training completion dates recorded on the eCC requests of short-term TDY employees 

traveling to one country were correct. OIP determined that 3 of the 34 employees had 

recorded their FACT training dates inaccurately on the eCC form but that all 34 employees 

had valid FACT training dates and thus were in compliance with the requirement. 

Therefore, OIP determined that verifying the accuracy of FACT training dates recorded on 

employees’ eCC requests was not necessary.
Page 21 GAO-14-360 Mandatory Security Training 

To verify short-term TDY personnel’s compliance with the FACT training 

requirement, agencies would need to determine how many days within a 

calendar year personnel have traveled to designated high-threat 

countries. In June 2013, the department changed the cumulative-days 

requirement to 45 cumulative days or more in a calendar year in any of 

those countries. However, State’s data systems do not enable personnel 

to view an employee’s history of travel to more than one of the designated 

countries. For short-term TDY personnel traveling to two specific 

countries, State officials noted that OIP officials use the eCC system to 

determine cumulative numbers of days traveled within each country; 

however, they cannot determine personnel’s cumulative numbers of days 

traveled across countries. Furthermore, in-country officials who approve 

country clearance requests can generally view employees’ travel histories 

only for that particular country and generally do not have eCC system 

authority to look at employee travel histories for other countries. 

According to State officials, the department has no plans to ensure shortterm TDY personnel’s compliance with the 45 cumulative-day 

requirement. The officials said that (1) the process to view personnel’s 

travel records is labor intensive and (2) they would not want to burden 

post officials by asking them to track personnel’s cumulative travel days. 

We realize that this would be a difficult task, but one of the first steps to 

ensuring compliance with the requirement is to collect the necessary 

data.

State, which is primarily responsible for the safety and security of U.S. 

government personnel on official duty abroad, has not monitored or 

evaluated the overall extent of compliance with the FACT training 

requirement among assigned and short-term TDY personnel. According 

to State officials, an agency working group began exploring options in 

November 2013 for a process to validate and track FACT training, which 

is intended to ensure an additional measure of compliance with the 

requirement.39

 39State’s Office of Inspector General has not conducted evaluations of the extent of 

compliance with the FACT training requirement.

While State’s Foreign Affairs Manual notes that it is each 

employee’s responsibility to fulfill the FACT training requirement, the 

manual also notes that agency management is responsible for ensuring 

adequate controls over agency operations and that all managers are 

responsible for maintaining and monitoring systems of management 

State Management Does 

Not Monitor Overall Extent 

of Compliance with FACT 

Training Requirement
Page 22 GAO-14-360 Mandatory Security Training 

control.40 In addition, according to Standards for Internal Control in the 

Federal Government, agency management should assess the quality of 

performance over time and, based on these reviews, should ensure that 

any findings from audits and other reviews are promptly resolved.41 The 

lack of monitoring prevents State officials from identifying systematic 

deficiencies in their efforts to ensure FACT training compliance.

The presence of U.S. personnel at overseas posts is critical to promoting 

U.S. interests and assisting foreign partners. This includes the 

deployment of personnel to high-threat countries where they may be 

targeted by Al Qaeda, its affiliates, and other violent extremist 

organizations. State has identified the need, and established the 

requirement, for employees to complete a mandatory security course 

(FACT) to better prepare employees for work in high-threat environments. 

The lack of security awareness training by one individual could put not 

only his or her own safety in jeopardy but could also place at risk the 

safety of others serving in an overseas high-threat country.

While State’s Foreign Affairs Manual notes that it is the employee’s 

responsibility to ensure compliance with the FACT training requirement, it 

also notes that agency management is responsible for ensuring adequate 

controls over all agency operations. Accordingly, it is essential that State 

provide U.S. personnel with access to the most up-to-date information on 

the requirements for training, establish mechanisms to identify the 

individuals who are required to complete FACT training, and ensure that 

they are in compliance with the requirements. State has not yet updated 

the Foreign Affairs Manual to reflect changes related to the FACT training 

requirement from June 2013, provided consistent and clear policy 

guidance, or monitored compliance with the requirement. Undertaking 

these steps is essential to ensuring that all U.S. personnel deploying to 

designated high-threat countries are adequately prepared for challenges 

associated with working in a high-threat security environment.

 4013 FAM 323(a), 2 FAM 021.1(a), 2 FAM 022.12(a).

41AIMD-00-21.3.1, 20. 

Conclusions
Page 23 GAO-14-360 Mandatory Security Training 

We are making 10 recommendations to the Secretary of State and one

recommendation to the USAID Administrator. To ensure that State’s 

policy guidance reflects the June 2013 mandatory FACT training 

requirements and provides clear information to U.S. agencies on which 

personnel are required to take FACT training, we recommend that the 

Secretary of State update the Foreign Affairs Manual to

• reflect the nine additional countries that were added in June 2013,

• reflect the requirement for all eligible family members assigned or on 

short-term TDY to the designated high-threat countries to complete 

FACT training before deployment,

• indicate that short-term TDY personnel who spend more than 45 

cumulative days in a calendar year at one or more of the designated 

posts are required to complete FACT training, and

• clarify whether FACT training completion must be valid during an 

employee’s entire assignment or short-term TDY visit.

To strengthen State’s ability to ensure that U.S. civilian personnel are in 

compliance with the FACT training requirement, we recommend that the 

Secretary of State

• identify a mechanism to readily determine the universe of assigned 

U.S. civilian personnel under chief-of-mission authority who are 

required to complete FACT training;

• identify a mechanism to readily determine the universe of short-term 

TDY U.S. civilian personnel who are required to complete FACT 

training—specifically, required personnel who have spent 45 days or 

more in the designated high-threat countries in a calendar year;

• ensure that eCC instructions regarding the documentation of the 

FACT training requirement for short-term TDY personnel are 

consistent for all designated high-threat countries;

• take steps to ensure that management personnel responsible for 

assigning personnel to designated high-threat countries consistently 

verify that all assigned U.S. civilian personnel under chief-of-mission 

authority who are required to complete FACT training have completed 

it before arrival in the designated high-threat countries;

Recommendations for 

Executive Action
Page 24 GAO-14-360 Mandatory Security Training 

• take steps to ensure that management personnel responsible for 

granting country clearance consistently verify that all short-term TDY 

U.S. civilian personnel under chief-of-mission authority who are 

required to complete FACT training have completed it before arrival in 

the designated high-threat countries; and

• monitor or evaluate overall levels of compliance with the FACT 

training requirement among U.S. civilian personnel under chief-ofmission authority who are subject to the requirement.

We recommend that the USAID Administrator take steps to ensure that all 

USAID short-term TDY personnel who are required to take FACT training 

complete the training before arrival in the designated high-threat 

countries, as USAID has done for its assigned personnel.

We provided a draft of this report to State and USAID for their review and 

comment. State and USAID provided written comments, which we have 

reprinted in appendices IV and V, respectively. State also provided 

technical comments, which we incorporated as appropriate.

State fundamentally concurred with our recommendations. State noted 

that it has efforts underway to address these recommendations. In 

addition, State noted that it established a working group chaired by the 

Executive Assistant for the Under Secretary for Management in 

November 2013 to identify areas where improvements can be made, 

such as in the areas of notification, enrollment, and tracking of FACT 

training. State indicated that it plans to distribute internal and external 

guidance on this issue and document all existing and new measures 

accordingly.

USAID did not specifically agree or disagree with our recommendation

that it take steps to ensure that all USAID short-term TDY personnel who 

are required to take FACT training complete the training before arrival in 

the designated high-threat countries. USAID noted challenges in verifying 

whether its short-term TDY personnel are in compliance with the FACT 

training requirement and indicated that the onus is on the employee to 

fulfill the requirement. However, USAID indicated that it plans to take 

some steps to assist employees in tracking their compliance with the 

requirement. Specifically, USAID stated that every country clearance will 

include (1) a reminder to employees about the FACT training requirement 

and (2) a statement that employees must keep track of their cumulative 

days of travel to FACT training posts, so that they do not exceed 45 days 

Agency Comments 

and Our Evaluation
Page 25 GAO-14-360 Mandatory Security Training 

at FACT training posts without getting the required training. USAID also 

noted that its efforts will include a warning that if an employee fails to 

meet this responsibility, he or she could be subject to discipline.

We are sending copies of this report to the appropriate congressional 

committees, the Secretary of State, and the USAID Administrator. In 

addition, the report is available at no charge on GAO’s Web site at 

http://www.gao.gov.

If you or your staff have any questions about this report, please contact 

me at (202) 512-7331 or johnsoncm@gao.gov. Contact points for our 

Offices of Congressional Relations and Public Affairs may be found on 

the last page of this report. GAO staff who made key contributions to this 

report are listed in appendix VI.

Charles Michael Johnson, Jr.

Director, International Affairs and Trade
Page 26 GAO-14-360 Mandatory Security Training 

List of Addressees

The Honorable Bob Corker

Ranking Member

Committee on Foreign Relations

United States Senate

The Honorable Tom Coburn

Ranking Member

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Ed Royce

Chairman

The Honorable Eliot L. Engel

Ranking Member

Committee on Foreign Affairs

House of Representatives
Appendix I: Objectives, Scope, and 

Methodology

Page 27 GAO-14-360 Mandatory Security Training 

This report reviews issues related to compliance with the Department of 

State’s (State) Foreign Affairs Counter Threat (FACT) training, including 

internal controls to ensure compliance. Specifically, we examined (1) 

compliance with the FACT training requirement among civilian personnel 

employed by State and the U.S. Agency for International Development 

(USAID) and (2) State’s and USAID’s oversight of their personnel’s 

compliance with the requirement.

Our work focused on personnel at State and USAID, the two primary 

foreign affairs agencies with civilian personnel in the countries for which 

State requires FACT training. We met with officials from relevant 

components of these agencies. For State, we met with officials from the 

Bureau of Diplomatic Security; Bureau of Human Resources; Office of 

Management Policy, Rightsizing and Innovation; Orientation and InProcessing Center; relevant headquarters-based regional bureaus; and 

the Foreign Service Institute. We interviewed State officials in seven of 

the nine countries for which State required FACT training as of March 

2013. For USAID, we met with officials from the agency’s Office of 

Human Resources, the Office of Security, and regional offices for 

designated high-threat countries. We also interviewed USAID officials in 

five of the nine countries that were designated as high threat as March 

13, 2013. Although we include Afghanistan in our discussion of State and 

USAID processes to ensure compliance, we did not assess compliance 

among State and USAID personnel in Afghanistan because we have 

previously reported on the extent of compliance with the FACT training 

requirement among U.S. personnel assigned to that country.

1

 1

GAO, Afghanistan: Improvements Needed to Strengthen Management of U.S. Civilian 

Presence, GAO-12-285 (Washington, D.C.: Feb. 27, 2012). 

Appendix I: Objectives, Scope, and 

Methodology
Appendix I: Objectives, Scope, and 

Methodology

Page 28 GAO-14-360 Mandatory Security Training 

We evaluated the extent of compliance among State and USAID 

assigned and short-term temporary duty (TDY) 2

We assessed compliance with the requirement among State and USAID 

direct-hire personnel and U.S. personal services contractors, who are 

required to complete FACT training per State’s Foreign Affairs Manual

and USAID’s Automated Directives System. We also assessed the extent 

of compliance among employed eligible family members of personnel 

assigned to relevant designated posts in three countries, the only 

locations in our compliance assessment for which State specified that 

employed eligible family members were required to complete FACT 

training, as of March 31, 2013. We excluded Diplomatic Security special 

agents and security protective specialists from our analysis, because 

State’s guidance specifically exempts these personnel from the FACT 

training requirement. We excluded regional security officers, deputy 

regional security officers, and assistant regional security officers from our 

analysis, because, according to State, these personnel are categorized 

as Diplomatic Security special agents and as such are exempt from the 

FACT training requirement. In addition, we excluded personnel who were 

at the designated country or post on March 31, 2013, but who arrived 

before the FACT training requirement took effect for that country.

personnel in the 

countries for which State or USAID required FACT training as of March 

31, 2013, against the relevant provisions in State’s Foreign Affairs Manual

(13 FAM 321-323) and USAID’s Automated Directives System (ADS 

458). To do so, we collected available personnel and training data for 

State and USAID assigned and short-term TDY personnel who were in 

the designated countries on March 31, 2013. We chose this date because 

it was a recent date during our initial planning of the review.

Because FACT training is valid for a 5-year period, we obtained FACT 

training completion data for 2008 through 2013 from State’s Global 

 2

For the purposes of our review, we defined “assigned personnel” as personnel on tours 

of duty exceeding 6 months, including employed eligible family members. This definition is 

consistent with the definition in State’s Foreign Affairs Handbook (FAH), which states that 

an assignment is a tour of duty to a Foreign Service position that exceeds 6 months (3 

FAH-1 H-2421). Our definition of “assigned personnel” also includes those who are in 

long-term TDY status in two specific countries for more than 180 days. The Foreign Affairs 

Manual (FAM) explicitly requires long-term TDY personnel traveling to these two countries 

to take the FACT training (13 FAM 322). We defined “short-term temporary TDY 

personnel” as personnel who are on a temporary tour of duty at post for between 30 and 

180 days.

Objective 1: 

Compliance with the 

FACT Training 

Requirement among 

State and USAID 

Personnel
Appendix I: Objectives, Scope, and 

Methodology

Page 29 GAO-14-360 Mandatory Security Training 

Employment Management System (GEMS) and Student Training 

Management System (STMS). For State and USAID assigned personnel 

who did not complete FACT training, we asked State and USAID officials 

to provide one of the following: (1) evidence that these individuals 

completed equivalent training—for example, an employee profile or 

training roster indicating completion of either of two courses, Security for 

Non-traditional Operating Environments or the diplomatic security 

antiterrorism course designed for one country; (2) evidence that these 

individuals were otherwise exempt from the requirement—for example, an 

employee profile illustrating that an employee was a Diplomatic Security 

special agent; or (3) an explanation for the noncompliance of personnel 

who were not exempt but failed to comply with the requirement.

We used data from GEMS and State’s Bureau of African Affairs to 

compile information for State assigned personnel who were in the 

designated countries on March 31, 2013. All State records obtained from 

GEMS contained FACT training completion dates for assigned personnel 

who had completed the training; we used these completion dates in our 

compliance review. For USAID assigned personnel, we used data from 

State’s Post Personnel system and a USAID staffing report for March 31, 

2013. The USAID personnel data obtained from State’s Post Personnel 

system did not contain FACT training completion dates. For our 

compliance review, we assessed the USAID personnel records against 

FACT training completion records in STMS. To determine whether a 

USAID assigned personnel record could be categorized as a match with 

an STMS record containing a FACT training completion date, we 

compared data for the employees’ first and last names and available data 

for partial social security numbers and partial dates of birth.

To assess the reliability of the data that we used for assessing State and 

USAID assigned personnel’s compliance with the FACT training 

requirement, we interviewed agency officials responsible for compiling 

these data or maintaining the systems that generated the data, and we 

performed basic reasonableness checks of the data for obvious 

inconsistencies and gaps. When we found discrepancies or missing data 

fields, we brought them to the attention of relevant agency officials and 

worked with the officials to correct the discrepancies and missing fields. 

To assess the comprehensiveness of USAID Post Personnel data, we 

compared data for USAID assigned personnel with data from USAID’s 

staffing report for March 31, 2013. We found data on State and USAID 

assigned personnel to be sufficiently reliable for the purpose of our report.
Appendix I: Objectives, Scope, and 

Methodology

Page 30 GAO-14-360 Mandatory Security Training 

We were unable to conduct an assessment of the extent of compliance 

with the FACT training requirement among short-term TDY personnel

because we determined that the data were not sufficiently reliable for the 

purposes of our report. We worked for 7 months with various entities 

within State and at USAID to obtain data identifying the universe of shortterm TDY personnel in the designated countries as of March 31, 2013, 

who were required to take FACT training. We collected data from the 

eCountry Clearance (eCC) system as well as data provided by posts for 

where short-term TDY personnel were present on March 31, 2013. 

Through multiple data analysis steps, we identified problems with the 

reliability of agency and employment type data contained in the eCC 

system. For example, one eCC record listed an individual’s employer 

incorrectly; according to a State official, the individual identified as a State 

employee in the eCC system was actually a commercial contractor 

working for USAID. We ultimately concluded that these data were not 

sufficient or reliable for the purpose of our report.

To assess the reliability of the FACT training completion data from STMS, 

we asked State and USAID to provide additional documentation of FACT 

training completion. We obtained training records, such as rosters, for 

those personnel who State and USAID officials told us had completed 

FACT training but who did not have FACT training completion dates in 

STMS. We asked State’s Bureau of Diplomatic Security to explain 

discrepancies between these records and the STMS data; however, the 

bureau did not provide clear explanations. To test the reliability of the 

dates in STMS, we tested a nonrepresentative sample of 27 personnel 

from a list of State and USAID assigned and short-term TDY personnel 

who had FACT training completion dates within the last 5 years in STMS. 

We compared these dates with dates in training rosters that we obtained 

from State’s Bureau of Diplomatic Security for each of the personnel, and 

we confirmed that all 27 personnel could be accounted for in the training 

rosters. We determined that the FACT training completion data from 

STMS were sufficiently reliable for the purposes of our report.
Appendix I: Objectives, Scope, and 

Methodology

Page 31 GAO-14-360 Mandatory Security Training 

To assess State and USAID’s management oversight of assigned and 

short-term TDY personnel’s compliance with the FACT training 

requirement, we reviewed relevant documents from State and USAID, 

including State’s Foreign Affairs Manual, USAID’s Automated Directives 

System, and other standard operating procedures. We also interviewed 

knowledgeable State and USAID officials, as well as State Orientation 

and In-Processing Center contractors, to determine the steps that these 

agencies take to ensure compliance with the FACT training requirement. 

We compared these steps with State and USAID management and 

internal controls guidance. We also assessed the agencies’ processes for 

ensuring compliance against selected standards for enhancing internal 

controls in Standards for Internal Control in the Federal Government.

3

We conducted this performance audit from March 2013 to March 2014 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

 3

GAO, Standards for Internal Control in the Federal Government, AIMD-00-21.3.1 

(Washington, D.C.: November 1999).

Objective 2: State’s 

and USAID’s 

Oversight of Their 

Personnel’s 

Compliance with the 

FACT Training 

Requirement
Appendix II: Examples of Anti-U.S. Attacks 

Overseas: September 2012 to September 2013

Page 32 GAO-14-360 Mandatory Security Training 

This appendix provides examples of attacks against U.S. personnel and 

facilities overseas from September 2012 through September 2013. We 

derived this information from a chronology developed by the Department 

of State’s Bureau of Diplomatic Security, Office of Intelligence and Threat 

Analysis.

September 3, 2012 – Peshawar, Pakistan: A U.S. consulate threevehicle motorcade was attacked by a suicide vehicle-borne improvised 

explosive device in the vicinity of the U.S. Consulate General’s University 

Town housing complex. Two U.S. consulate general officers were 

wounded, as were two locally employed drivers, a local police bodyguard 

assigned to the Consulate General, and several other policemen 

providing security for the motorcade.

September 8, 2012 – Zabul Province, Afghanistan: The Zabul 

Provincial Reconstruction Team was hit with two improvised explosive 

devices. No chief-of-mission personnel were injured.

September 10, 2012 – Baghdad, Iraq: A U.S. embassy aircraft reported 

seeing 7 to 10 tracer rounds of unknown caliber fired behind the aircraft. 

There were no injuries to chief-of-mission personnel or Office of Security 

Cooperation in Iraq personnel, and no property damage.

September 11, 2012 – Jerusalem, Israel: An Israeli “flash-bang”

distraction device was thrown at the front door of an official U.S. 

consulate general residence. The detonation caused damage to an 

exterior door and hallway, but no one was hurt in the attack.

September 11 to 12, 2012 – Benghazi, Libya: A series of attacks 

involving arson, small-arms and machine-gun fire, rocket-propelled 

grenades, and mortars were directed at the U.S. Mission in Benghazi and 

a Mission annex, as well as against U.S. personnel en route between 

both facilities. Four U.S. government personnel, including the U.S. 

Ambassador to Libya, were killed. In addition, the attacks severely 

wounded two U.S. personnel and three Libyan contract guards and 

resulted in the destruction and abandonment of both facilities.

September 11 to 15, 2012 – Cairo, Egypt: Protesters overran the U.S. 

embassy perimeter defenses and entered the embassy compound. 

Though the embassy was cleared of intruders by that evening, battles 

continued between police and the crowd until the morning of September 

Appendix II: Examples of Anti-U.S. Attacks 

Overseas: September 2012 to September 

2013

Attacks in 2012
Appendix II: Examples of Anti-U.S. Attacks 

Overseas: September 2012 to September 2013

Page 33 GAO-14-360 Mandatory Security Training 

15, when Central Security Forces cleared the area of protesters. No 

Americans were injured in the violent demonstrations.

September 12, 2012 – Tunis, Tunisia: Approximately 200 

demonstrators gathered at the U.S. embassy to protest inflammatory 

material posted on the Internet. At one point, demonstrators tried to get to 

the embassy perimeter wall and threw stones at the fence. The police 

responded immediately and secured the area. No U.S. citizens were 

injured.

September 13, 2012 – Sana’a, Yemen: Approximately 500 protesters 

pushed past security forces and stormed the U.S. embassy compound, 

where they caused extensive damage by looting and setting several fires.

According to State officials, the physical defensive features of the 

buildings performed fully as designed by successfully preventing 

intrusion, despite repeated attempts by protesters to break through them. 

No U.S. citizens were injured in the attack. Throughout the day, groups of 

protesters continued to harass a number of chief-of-mission personnel.

September 14, 2012 – Chennai, India: Several hundred protesters threw 

rocks and other material near the U.S. Consulate General, to protest 

inflammatory material posted on the Internet. At one point, a Molotov 

cocktail was thrown over the consulate wall, causing damage but no 

injuries.

September 14, 2012 – Khartoum, Sudan: A mob of 4,000 protesters 

ransacked the German and British embassies and stormed the U.S. 

embassy. During the several-hour siege, the U.S. embassy compound 

sustained extensive damage. According to State officials, the physical 

defensive features of the buildings performed fully as designed by 

successfully preventing intrusion, despite repeated attempts by protesters 

to break through them. The rioters captured a police truck and set it on 

fire, then used the vehicle as a make-shift battering ram in an 

unsuccessful attempt to breach one of the compound’s rear entrance 

doors. Police equipment, including tear gas, was seized from the truck for 

use against the embassy’s defenders and intruders cut the embassy’s 

local power supply. More than 20 windows were damaged by rocks, and 

several surveillance cameras were destroyed

September 14, 2012 – Khartoum, Sudan: Police apprehended a man 

attempting to throw a Molotov cocktail at the U.S. embassy. The embassy 

building was not damaged and no one was injured.
Appendix II: Examples of Anti-U.S. Attacks 

Overseas: September 2012 to September 2013

Page 34 GAO-14-360 Mandatory Security Training 

September 14, 2012 – Tunis, Tunisia: Thousands of protesters 

breached the U.S. embassy wall and caused significant damage to the 

motor pool, outlying buildings, and the chancery. Separately, unknown 

assailants destroyed the interior of the American Cooperative School in 

Tunis. No U.S. citizens were injured in either attack.

September 15, 2012 – Sydney, Australia: Violent protesters conducted 

large demonstrations near the U.S. consulate general.

September 16, 2012 – Karachi, Pakistan: Two hundred protesters 

affiliated with a Shi’a religious group named Majilis-e-wahdat-ulMuslimeen broke through police lines and threw rocks into the U.S. 

consulate perimeter, causing damage to the compound access control 

windows. No chief-of-mission personnel were injured, but two protesters 

were killed, and several more were injured as security forces responded.

September 17, 2012 – Sydney, Australia: A U.S. citizen who was 

employed by the U.S. Air Force was assaulted while waiting for a bus in 

the central business district. This incident took place on the heels of the 

violent protests near the U.S. Consulate General in Sydney on 

September 15.

September 17, 2012 – Jakarta, Indonesia: Demonstrators threw 

Molotov cocktails and other material at the U.S. embassy to protest 

inflammatory material posted on the Internet. Eleven police officers were 

hurt. No U.S. citizens were injured, and damage to the embassy was 

minor.

September 18, 2012 – Beijing, China: Anti-Japanese protesters walked 

to the U.S. embassy from the Japanese embassy and surrounded the 

U.S. Ambassador’s vehicle. No injuries were reported, and there was only 

minor cosmetic damage to the vehicle.

September 18, 2012 – Peshawar, Pakistan: The student wing of 

Jamaat-e-Islami staged a demonstration at the U.S. consulate. The crowd 

became violent, throwing rocks and Molotov cocktails and pulling down a 

billboard showing an American flag.

September 27, 2012 – Kolkata, India: Fifteen thousand to 20,000 

protesters marched toward the American Center and then rushed the 

gates, throwing sticks and stones at the facility. There was minor damage 

to a window.
Appendix II: Examples of Anti-U.S. Attacks 

Overseas: September 2012 to September 2013

Page 35 GAO-14-360 Mandatory Security Training 

October 1 and 4, 2012 – Kandahar Province, Afghanistan: The 

Kandahar Provincial Reconstruction Team received small-arms fire. No 

personnel were injured.

October 13, 2012 – Maruf District, Kandahar Province, Afghanistan:

As a delegation of U.S. and Afghan officials arrived for a meeting in Maruf 

District, a suicide bomber detonated a suicide vest. The explosion killed 

two U.S. citizens and five Afghan officials. One of the U.S. citizens killed 

was under chief-of-mission authority.

October 29, 2012 – Tunis, Tunisia: A U.S. military officer assigned to 

the U.S. embassy was verbally harassed by two men in a car while he 

was stopped at a traffic light. One of the men threw a can at the officer’s 

car. He was not hurt in the incident.

November 4, 2012 – Farah, Afghanistan: A grenade exploded at U.S. 

Provincial Reconstruction Team Farah. No chief-of-mission personnel 

were injured in the attack.

November 18, 2012 – Peshawar, Pakistan: Two mortars impacted in 

the vicinity of the U.S. consulate housing cluster in University Town, with 

one round hitting the offices of the International Medical Committee, a 

nongovernmental organization. The Consul General’s residence 

sustained shrapnel damage and one local guard was slightly injured.

November 21, 2012 – Jakarta, Indonesia: A group of 150 

demonstrators, protesting inflammatory material posted on the Internet, 

staged a demonstration in which they threw objects at the U.S. embassy.

November 23, 2012 – Medan, Indonesia: Approximately 100 to 120 

protesters from the Islamic Defender’s Front arrived at the American 

Presence Post to protest events in Gaza. The protesters became 

aggressive and damaged a vehicle gate in an attempt to gain access to 

the ground floor of the building.

November 23, 2012 – Peshawar, Pakistan: A single round of indirect 

fire1

 1

In this appendix, the terms “indirect fire” and “indirect fire attacks” generally refer to 

rocket attacks or mortar attacks, or both. 

impacted a non-U.S. government private residence adjacent to a 
Appendix II: Examples of Anti-U.S. Attacks 

Overseas: September 2012 to September 2013

Page 36 GAO-14-360 Mandatory Security Training 

U.S. consulate residence in the University Town housing cluster. The 

device did not detonate, no chief-of-mission personnel were injured, and 

no facilities were damaged.

December 4, 2012 – Dhaka, Bangladesh: A U. S. embassy vehicle 

carrying an embassy driver and police assigned to the embassy was 

surrounded by protesters on Airport Road. The demonstrators threw 

rocks and bricks at the vehicle, shattering several windows, injuring the 

driver, and forcing him off the road; the crowd then attempted to set the 

vehicle on fire.

December 22, 2012 – Tunis, Tunisia: While U.S. government 

investigators were visiting the Tunisian Ministry of Justice, protesters 

forced their way into the building to confront the team. No one was hurt. 

Photos of the team, taken while they were inside the Ministry of Justice, 

were later posted on multiple social media and other Internet sites.

January 25, 2013 – Cairo, Egypt: Ten men climbed the gate of the U.S. 

embassy motor pool, destroyed the facility, and stole U.S. government 

property.

January 25, 2013 – Manila, Philippines: A crowd at the U.S. embassy 

protested against the Visiting Forces Agreement. They threw paint on the 

U.S. embassy facade.

January 28, 2013 – Manila, Philippines: Protesters gathered at the U.S. 

embassy’s consular entrance to demonstrate against the grounding of the 

USS Guardian. They threw paint on the facade and defaced the embassy 

seal.

February 1, 2013 – Ankara, Turkey: A suicide bomber detonated inside 

the pedestrian entrance to the U.S. embassy, killing himself and a local 

guard. The building’s facade sustained substantial damage. The Turkish 

leftwing group Revolutionary People’s Liberation Party/Front claimed 

responsibility for the attack.

February 27, 2013 – Helmand Province, Afghanistan: Six rounds of 

indirect fire impacted northeast of Camp Bastion/Leatherneck. At the time 

of the attack, a U.S. embassy aircraft was on the ground. No one was 

hurt in the attack.

Attacks in 2013
Appendix II: Examples of Anti-U.S. Attacks 

Overseas: September 2012 to September 2013

Page 37 GAO-14-360 Mandatory Security Training 

March 21, 2013 – Baghdad, Iraq: Three rockets were directed at the 

U.S. diplomatic support center in Baghdad. There were no injuries and 

minimal damage.

April 6, 2013 – Baghdad, Iraq: Two rockets were fired at the U.S. 

diplomatic support center in Baghdad. There were no injuries or damage 

to the center.

April 6, 2013 – Qalat City, Zabul Province, Afghanistan: A suicide 

vehicle-borne improvised explosive device and a separate improvised 

explosive device targeted a provincial reconstruction team movement. 

The explosion killed a U.S. embassy officer, a U.S. Defense Departmentcontracted interpreter and three U.S. military personnel. Two other 

Department of State personnel, along with eight members of the U.S. 

military, and four Afghan civilians were wounded in the blast. The group 

was en route to a boys’ school to hand out books to Afghan students.

April 10, 2013 – Baghdad, Iraq: Two rockets were fired at Baghdad 

International Airport, impacting near the U.S. diplomatic support center 

compound. There were no injuries or damage to the compound.

June 23, 2013 – Baghdad, Iraq: Two rounds of indirect fire were tracked 

in the vicinity of the international zone, with one confirmed round 

impacting near the embassy’s Military Attaché and Security Assistance 

Annex.

June 29, 2013 – Baghdad, Iraq: Three rounds of indirect fire were 

tracked to the international zone, with two rounds impacting 

approximately 200 meters north of the U.S. embassy heliport and the 

third round reportedly impacting100 meters north of the Embassy Annex 

Prosperity.

August 10, 2013 – Baghdad, Iraq: Two rounds of indirect fire originating 

north of the international zone were reported to have landed within the 

international zone approximately 1 kilometer away from the U.S. 

embassy.

August 13, 2013 – Baghdad, Iraq: Three rounds of indirect fire 

originating north of the international zone reportedly landed within the 

international zone, with one round reportedly landing as close as 0.6 

kilometers north of the U.S. embassy.
Appendix II: Examples of Anti-U.S. Attacks 

Overseas: September 2012 to September 2013

Page 38 GAO-14-360 Mandatory Security Training 

September 13, 2013 – Herat, Afghanistan: Taliban-affiliated insurgents 

conducted a complex attack against U.S. Consulate Herat using truckand vehicle-borne improvised explosive devices and seven insurgents 

equipped with small arms, rocket-propelled grenades, and suicide vests. 

The insurgents detonated a truck-borne improvised explosive device 

outside the consulate’s entry control point followed by a second vehicleborne improvised explosive device, after which the seven insurgents 

engaged U.S. and Afghan security personnel in a sustained firefight. 

According to State officials, the consulate’s internal defense team 

neutralized all attackers at the outer perimeter. No U.S. personnel were 

killed or injured in the attack. The attack lasted approximately 90 minutes 

and resulted in the death of eight Afghan guard force members and injury 

to two additional third-country National Guard force members.
Appendix III: FACT Training Compliance 

among State and USAID Assigned Personnel 

Identified as Required to Complete FACT 

Training

Page 39 GAO-14-360 Mandatory Security Training 

This appendix provides information on the extent to which State and 

USAID assigned personnel were in compliance with the FACT training 

requirement as of March 31, 2013, and the reasons for noncompliance. 

Table 1 shows the number of State assigned personnel we identified as 

required to complete FACT training by country, and the number of those 

personnel who complied with the requirement.

Table 1: FACT Training Compliance among Department of State Assigned 

Personnel Identified as Required to Complete Training and in Designated HighThreat Countries on March 31, 2013, by Country

Country

Personnel identified as 

required to complete FACT 

training a Personnel who complied with 

requirement 

B 210 209

C 14 10

D (selected posts) 204 182

E 194 193

F 2 2

G 13 13

H 30 28

I 41 38

Total 708 675

Source: GAO analysis of State data.

Notes: The analysis included data from State’s Global Employment Management System, Student 

Training Management System, and a regional bureau.

a

We excluded Afghanistan because we have previously reported on compliance with the requirement 

among U.S. personnel assigned to Afghanistan. See GAO, Afghanistan: Improvements Needed to 

Strengthen Management of U.S. Civilian Presence, GAO-12-285 (Washington, D.C.: Feb. 27, 2012).

Table 2 shows the countries where State assigned personnel whom we 

identified as required to complete FACT training that were not in 

compliance with the FACT training requirement, the numbers of 

noncompliant personnel, and State’s explanations of the noncompliance.

Appendix III: FACT Training Compliance among 

State and USAID Assigned Personnel Identified as 

Required to Complete FACT Training
Appendix III: FACT Training Compliance 

among State and USAID Assigned Personnel 

Identified as Required to Complete FACT 

Training

Page 40 GAO-14-360 Mandatory Security Training 

Table 2: Noncompliance with FACT Training Requirement among Department of 

State Assigned Personnel Identified as Required to Complete Training and in 

Designated High-Threat Countries on March 31, 2013 

Country of 

assignment

Number of 

noncompliant 

personnel 

identified a Department of State (State) explanations of 

personnel’s noncompliance

B 1 A medical situation prevented the employee from 

completing scheduled FACT training before arrival at 

the post. The employee’s travel request was not 

submitted for approval; however, post leadership 

approved the employee’s travel, mistakenly assuming 

that the training could be completed at post. As of 

November 2013, the employee was assigned to 

Country B but had not completed the medical portion 

of the FACT training despite instructions to do so from 

embassy management.b

C

The employee completed the 

medical portion of the training on January 26, 2014.

4 Two personnel assigned to Country C missed a few 

hours of scheduled FACT training and did not 

complete it because of visa issues. They completed 

FACT training more than 5 years previously.

A medical situation prevented one employee from 

completing scheduled FACT training.

Another employee did not complete FACT training 

within 5 years of arrival.

D

(selected 

posts)

22 State officials explained that the 18 employed eligible 

family members were not aware of the requirement at 

the time. The officials noted that enrollment of family 

members in the course is given lower priority than 

enrollment of direct-hire U.S. government employees.

One employee had not been notified of the 

requirement, and thus did not complete the training

One employee had completed another State course 

that met the requirement. However, the employee 

completed it more than 5 years before arrival at post.

According to State, the remaining 2 employees were 

unaware of the requirement at the time.

E 1 One employee was an employed eligible family 

member of a State employee, but did not complete 

FACT training before arrival.

H 2 Two personnel did not complete FACT training within 

5 years of arrival. 
Appendix III: FACT Training Compliance 

among State and USAID Assigned Personnel 

Identified as Required to Complete FACT 

Training

Page 41 GAO-14-360 Mandatory Security Training 

Country of 

assignment

Number of 

noncompliant 

personnel 

identified a Department of State (State) explanations of 

personnel’s noncompliance

I 3 A senior official did not complete FACT training 

because of a pressing situation in Country I.

A medical situation prevented one employee from 

completing the last day of scheduled FACT training 

before deploying.

One employee had completed a diplomatic antiterrorism course designed for a particular country. 

However, the employee completed it more than 5 

years before arrival at the post.

Total 33

Source: GAO analysis of data and information from State.

Notes: The analysis included data from State’s Global Employment Management System and 

information from State documents and officials.

a

Compliance among personnel in Afghanistan is not shown, because we have previously reported on 

compliance with the requirement among U.S. personnel assigned to that country (see GAO-12-285).

b

Assigned personnel submit travel requests for five countries to State’s Orientation and In-Processing 

Center, through the eCountry Clearance system. 
Appendix III: FACT Training Compliance 

among State and USAID Assigned Personnel 

Identified as Required to Complete FACT 

Training

Page 42 GAO-14-360 Mandatory Security Training 

As table 3 shows, we found no instances of noncompliance with the 

FACT training requirement among USAID personnel on assignments at 

five designated posts on March 31, 2013. At that time, no USAID 

personnel were on assignments to relevant posts in the three other 

designated high-threat countries.

Table 3: FACT Training Compliance among USAID Assigned Personnel Identified as 

Required to Complete Training and in Designated High-Threat Countries on March 

31, 2013, by Country

Country

Personnel identified as 

required to complete 

FACT training a Personnel who complied 

with requirement 

B 35 35

C 0 N/A

D (selected posts) 0 N/A

E 62 62

F 0 N/A

G 31 31

H 8 8

I 7 7

Total 143 143

Source: GAO analysis of data and information from the Department of State (State) and the U.S. Agency for International Development 

(USAID).,

Notes: “N/A” indicates that no USAID personnel required to take FACT training were at post on March 

31, 2013. The analysis included USAID staffing data and data from State’s Student Training 

Management System and Post Personnel system.

a

We excluded Afghanistan because we have previously reported on compliance with the requirement 

among U.S. personnel assigned to Afghanistan. See GAO, Afghanistan: Improvements Needed to 

Strengthen Management of U.S. Civilian Presence, GAO-12-285 (Washington, D.C.: Feb. 27, 2012).
Appendix IV: Comments from the Department 

of State

Page 43 GAO-14-360 Mandatory Security Training 

Appendix IV: Comments from the 

Department of State
Appendix IV: Comments from the Department 

of State

Page 44 GAO-14-360 Mandatory Security Training 

See comment 1.
Appendix IV: Comments from the Department 

of State

Page 45 GAO-14-360 Mandatory Security Training 
Appendix IV: Comments from the Department 

of State

Page 46 GAO-14-360 Mandatory Security Training 

The following are GAO’s comments on the U.S. Departments of State’s 

letter dated February 18, 2014.

1. The numbers in our report reflect a compliance rate of about 95 

percent for State Department assigned personnel.

GAO Comments
Appendix V: Comments from the U.S. Agency 

for International Development

Page 47 GAO-14-360 Mandatory Security Training 

Appendix V: Comments from the U.S. 

Agency for International Development 

Note: GAO received 

USAID’s letter on 

February 20, 2014
Appendix V: Comments from the U.S. Agency 

for International Development

Page 48 GAO-14-360 Mandatory Security Training 
Appendix V: Comments from the U.S. Agency 

for International Development

Page 49 GAO-14-360 Mandatory Security Training 
Appendix VI: GAO Contact and Staff 

Acknowledgments

Page 50 GAO-14-360 Mandatory Security Training 

Charles Michael Johnson, Jr. (202) 512-7331 or johnsoncm@gao.gov

In addition to the contact named above, Judith A. McCloskey (Assistant 

Director), Jaime Allentuck, Emily Gupta, Jeffrey Isaacs, Farhanaz 

Kermalli, Lina Khan, and Mona Sehgal made key contributions to this 

report. Ashley Alley, Emily Christoff, Etana Finkler, Justin Fisher, Reid 

Lowe, Ruben Montes de Oca, and Steven Putansu provided additional 

support.

Appendix VI: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(321013)
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website,

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.