United States Government Accountability Office

GAO Testimony 

Before the Subcommittee on Capitol 

Security, Committee on House 

Administration, House of Representatives

U.S. CAPITOL POLICE

Status of Efforts to Address 

Prior GAO Recommendations 

on Administrative and 

Management Operations 

Statement of: 

Richard M. Stana, Director 

Homeland Security and Justice 

Kay L. Daly, Director 

Financial Management and Assurance 

Bernice Steinhardt, Director 

Strategic Issues 

Valerie C. Melvin, Director 

Information Technology 

For Release on Delivery

Expected at 11:30 a.m. EDT 

May 1, 2008

GAO-08-540T 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

May 1, 2008

U.S. CAPITOL POLICE

Status of Efforts to Address Prior GAO 

Recommendations on Administrative and 

Highlights of GAO-08-540T, testimony Management Operations

before the Subcommittee on Capitol 

Security, Committee on House 

Administration, House of Representatives 

The United States Capitol Police 

(USCP) is responsible for securing

the 276-acre Capitol Complex, 

including protecting Members of

Congress, visitors, and 

congressional facilities. In response 

to heightened security concerns, 

various requests, and legislative

mandates over the years, GAO has 

reported on management control 

problems in five key areas:

(1) establishing an accountability 

framework for monitoring

recommendations, (2) establishing 

a risk management framework, 

(3) ensuring financial management, 

(4) ensuring strategic and human 

capital planning, and (5) managing

information technology (IT). From 

January 2004 through March 2007, 

GAO made 46 recommendations 

aimed at improving USCP 

administrative and management 

operations and achieving strategic 

goals. This testimony reports on 

the status of USCP’s efforts to 

address GAO’s recommendations. 

To conduct its work, GAO analyzed 

USCP documentation, such as risk 

matrices, budget documents, and 

strategic plans. GAO also

conducted interviews with USCP 

officials and contractors on their 

efforts related to its 

recommendations. GAO performed

this work from October 2007 

through April 2008. 

USCP generally agreed with GAO’s 

46 prior recommendations and 

GAO’s assessment of the status of

USCP’s efforts to implement those 

recommendations. Along these 

lines, USCP needs to complete

those actions in progress and 

address those where there has 

been no progress. 

USCP has made significant progress in addressing the 46 recommendations 

GAO made since 2004. As shown in the table below, USCP has completed 

actions on 15 recommendations, is making progress toward addressing 28 

recommendations, and has not made progress on 3 recommendations. With 

respect to the five areas, the status of USCP’s efforts to address GAO’s 

recommendations is as follows: 

• Accountability Framework for Monitoring Recommendations. 

USCP has completed actions on creating a framework to monitor progress 

on addressing GAO’s recommendations and on reporting this progress to 

appropriate congressional committees and the USCP Police Board. 

• Linking Resources to Risks, Threats, and Vulnerabilities. USCP has 

taken steps to complete risk assessments for 18 of the 19 congressional 

facilities. However, additional actions will be required to adequately test 

and review its overall risk management approach. 

• Financial Management. USCP has completed actions on 8 GAO 

recommendations, including preparing its first full set of financial 

statements. USCP is making progress in addressing another 13 

recommendations related to training, policies, procedures, and internal 

controls, but did not make progress toward addressing ongoing staff 

shortages and work imbalances. 

• Human Capital Management. USCP has implemented one 

recommendation by adopting a hiring policy and is making progress on 

seven other recommendations related to workforce planning and training. 

USCP has not yet addressed a ninth recommendation to monitor and 

evaluate the results of its strategic workforce plan because this plan is still 

being developed. 

• Information Technology. USCP has implemented four 

recommendations related to IT management capabilities and is making 

progress toward implementing the remaining five recommendations 

related to enterprise architecture, IT investment management, information 

security, and continuity of operations planning. 

Status of USCP Progress in Addressing GAO’s Recommendations

Status of recommendations

Issue area GAO recommendations

since 2004 Completed In progress No progress

Accountability framework for

monitoring recommendations 2 2 0 0

Linking resources to risks, 

threats, and vulnerabilities 3 0 3 0

Financial management 23 8 13 2

Human capital management 9 1 7 1

Information technology 9 4 5 0

Total 46 15 28 3

Source: GAO analysis of USCP data. To view the full product, including the scope 

and methodology, click on GAO-08-540T. 

For more information, contact Richard M. 

Stana at (202) 512-8777 or stanar@gao.gov. 
Chairman Capuano, Mr. Lungren, and Members of the Subcommittee: 

We appreciate the opportunity to be here today to discuss the United 

States Capitol Police’s (USCP) progress in implementing our prior 

recommendations on administrative and management operations. The 

USCP is responsible for securing the 276-acre Capitol Complex; protecting 

members of Congress, their staff, visitors, 19 buildings, national treasures; 

and regulating traffic within the Capitol grounds. Having efficient and 

effective administrative and management operations is important in the 

USCP’s overall mission to protect the United States Capitol Complex and 

the on-site public. 

Over the years, in response to various requests and legislative mandates, 

we have reported on USCP’s efforts to address a range of (1) operational, 

(2) financial management, (3) human capital management, and 

(4) information technology (IT) management issues. Our reviews have 

disclosed management control problems in these areas. As a result of 

these reviews, we have made a number of recommendations that we 

believe the USCP should implement to achieve its strategic goals and 

operate in an efficient and effective manner. 

In our March 2007 report, we noted that USCP’s progress in implementing 

many of our past recommendations in the four aforementioned areas had

been slow for reasons that included an absence of goals, time frames, and 

accountability; a lack of continuity in leadership and staff; and a tendency 

to focus on near-term operational demands to the exclusion of longer-term 

challenges. To ensure greater accountability and transparency, we 

recommended that the Chief of Police set goals and timetables to track 

prior recommendations and to report semiannually to the Capitol Police 

Board and congressional stakeholders on progress towards addressing 

open recommendations (that is, recommendations not yet fully 

implemented). 

My remarks today are based on our recent review of USCP’s progress 

toward addressing recommendations we have made from January 2004 

through March 2007 in the following areas: (1) creating an accountability 

framework for monitoring recommendations; (2) effectively linking 

USCP’s resource requirements and allocations to risks, threats, and 

vulnerabilities; (3) ensuring adequate accountability for its assets and 

resources and meeting its long-term goal of becoming a sound, fully 

functional financial management operation; (4) ensuring strategic

management of its workforce; and (5) effectively leveraging information 

technology to meet its strategic mission, goals, and outcomes. 

Page 1 GAO-08-540T 
To evaluate USCP’s efforts in these areas, we reviewed documentation, 

such as risk matrices, budget documents, financial reports, and strategic 

plans in support of the current status of USCP actions to improve 

management controls and close outstanding recommendations; analyzed 

USCP operational, strategic and human capital planning, and IT 

management information; reviewed USCP management and administrative 

processes and written policies, procedures, plans, and directives; and 

interviewed members of the USCP leadership team, contractors, and other 

key USCP staff. In determining the status of financial management 

recommendations we also supplemented our assessment with the agency 

auditor’s report findings. Prior experience with the auditors and our 

review of their reports provided the basis for determining the sufficiency 

and relevance of evidence provided in these documents. We conducted 

our performance audit from October 2007 through April 2008 in 

accordance with generally accepted government auditing standards. Those 

standards require that we plan and perform the audit to obtain sufficient, 

appropriate evidence to provide a reasonable basis for our findings and 

conclusions based on our audit objectives. We believe that the evidence 

obtained provides a reasonable basis for our findings and conclusions 

based on our audit objectives. 

Since our March 2007 report, USCP has made significant progress toward 

addressing 46 recommendations we made since 2004. As shown in table 1, 

of the 46 recommendations we made, USCP has completed actions on 15 

recommendations, is making progress toward addressing 28 

recommendations, and has not made progress on 3 recommendations. 

Summary 

Page 2 GAO-08-540T 
Table 1: USCP’s Progress toward Addressing GAO’s Recommendations

Issue area GAO Status of recommendations

recommendations

since 2004 Completed In progress No progress

Accountability 

framework for 

monitoring 

recommendations 2 2 0 0

Linking resources to 

risks, threats, and 

vulnerabilities 3 0 3 0

Financial management 23 8 13 2

Human capital

management 9 1 7 1

Information technology 

(IT) 9 4 5 0

Total 46 15 28 3

Source: GAO analysis of USCP data. 

The following describes the actions taken and the work remaining to 

address the recommendations in the five areas shown in table 1: 

Accountability Framework for Monitoring Recommendations. USCP 

has completed actions on both of our recommendations relating to 

creating a framework for monitoring recommendations and holding 

management accountable. USCP set goals and timetables for 

implementing each of our 46 recommendations, assigned responsibility to 

an appropriate USCP official for ensuring that actions are taken to 

implement the recommendations, and created a tracking system to 

monitor progress. In addition, USCP now reports semiannually to the 

USCP Board, Senate and House Appropriations Committees, the Senate

Committee on Rules and Administration, and the Committee on House 

Administration on progress made in implementing our prior 

recommendations. 

Linking Resources to Risks, Threats, and Vulnerabilities. USCP is 

making progress toward implementing our three recommendations 

relating to more effectively linking USCP’s staffing and other resource 

needs to the risks, threats, and vulnerabilities that the Capitol Complex 

faces. USCP has taken steps to complete and apply a risk matrix that 

assesses the security environment at 18 of the 19 Capitol Complex 

facilities, and plans to apply it to six Library of Congress buildings when 

USCP assumes responsibility for their security at the end of the fiscal year.

Page 3 GAO-08-540T 
Moreover, initial steps have been taken to conduct both external peer 

reviews and periodic testing of USCP’s overall risk management approach.

While USCP has plans to periodically test and evaluate the risk matrix, the 

process has yet to be formalized as a Standard Operating Procedure 

(SOP). 

Financial Management. Of our 23 recommendations relating to financial 

management, USCP has completed actions on 8 recommendations, in 

areas such as assessing its staffing needs and procurement process and 

issuing its first full set of financial statements in accordance with generally 

accepted accounting principles in December 2007. USCP is also making 

progress towards addressing 13 recommendations related to training, 

policies, procedures, and internal controls. However, USCP has not made 

progress on 2 recommendations to fill vacancies that are critical in helping

its Office of Financial Management stabilize its workforce. 

Human Capital Management. Of our nine recommendations relating to

human capital management, USCP has implemented one recommendation 

by adopting a hiring policy and is making progress on seven other 

recommendations related to workforce planning and training. USCP has 

not yet addressed a ninth recommendation to monitor and evaluate the 

results of its strategic workforce plan because this plan is still being 

developed and it is still too soon for USCP Office of Human Resources 

(OHR) officials to monitor and evaluate any progress on achieving the 

human capital goals of the plan. 

Information Technology (IT). Of our nine recommendations relating to

IT, USCP has implemented four recommendations and is making progress 

toward implementing the remaining five. Specifically, USCP has made 

progress towards establishing important IT management capabilities, such 

as the use of disciplined system acquisition management practices. 

However, more work remains to be done in the areas of enterprise 

architecture, IT investment management, information security, and 

continuity of operations planning. 

I will briefly discuss each of the major areas where we have made 

recommendations and USCP’s progress to date in implementing those 

recommendations. More detailed information on our recommendations 

and USCP’s efforts to implement them is included as an appendix to this 

statement. 

Page 4 GAO-08-540T 
Creating an 

Accountability 

Framework for 

Monitoring 

Recommendations: 

USCP Has 

Established a 

Framework 

USCP’s progress in implementing many of our past recommendations had 

been slow for reasons that included an absence of goals, time frames, and 

accountability; a lack of continuity in leadership and staff; and a tendency 

to focus on near-term operational demands to the exclusion of longer-term 

challenges. To help ensure that actions were taken to implement our 

recommendations, in March 2007, we recommended that the USCP Chief 

of Police (1) set goals and timetables, and establish accountability for 

implementing the recommendations, and (2) report semiannually to the 

USCP Board, Senate and House Appropriations Committees, the Senate

Committee on Rules and Administration, and the House Committee on 

House Administration on progress made in implementing our 

recommendations. 

To address our first recommendation, USCP appointed an Audit Liaison to

coordinate the tracking, reporting, and resolution of recommendations 

made by us and the USCP Office of the Inspector General (OIG). In this 

regard, USCP created a formal recommendation resolution process with 

several components. Each recommendation is assigned to a designated 

official who is responsible for establishing an action plan to outline the 

actions needed to implement the recommendation, identify staff 

responsible for taking the needed actions, establish a target completion 

date, and track the status of related actions until completion. In a larger 

sense, during the last year, USCP has taken additional steps to strengthen 

management accountability and address both our and OIG 

recommendations. For example, USCP has created a formal process 

known as the Force Development Planning Process aimed at ensuring that 

all organizationwide decision-making, planning, and resource allocation 

processes incorporate elements of threat-based planning. According to 

USCP, the process links seven previously separate activities related to 

planning, investments, budget formulation, execution, and performance 

evaluation into a single process that integrates risk and operational and

administrative assessments. By linking these activities, USCP endeavors to 

establish timetables and better accountability for planning and resource 

requirements while ensuring that the overall department employs a more 

strategic and results-oriented approach. 

With respect to the second recommendation, USCP submitted two 

semiannual reports during 2007 to stakeholders to provide an update on 

progress made to implement both our and the OIG prior 

recommendations. In these reports, the Chief of Police also linked USCP’s 

progress toward implementing the recommendations and improving 

overall USCP management and operations to the steps necessary to realize 

the goals in the USCP strategic plan and Concept of Operations (ConOps). 

Page 5 GAO-08-540T 
Linking Resources to 

Risks, Threats, and 

Vulnerabilities: 

Progress Made in 

Implementing a Risk 

Management 

Approach 

Over the years, we have supported the use of a risk management approach 

to help implement and assess responses to various national security and 

terrorism concerns. We have concluded that without an approach that 

provides insights about the present threat and vulnerabilities as well as the 

organizational and technical requirements necessary to achieve a 

program’s goals, there is little assurance that programs are properly 

prioritized and focused.

In the past, we have reported that to improve operations and better 

support resource requirements, USCP would have to more effectively link 

threats and vulnerabilities to its staffing and other resource needs. In our 

2005 report, we noted that according to USCP, continued increases in its 

operational requirements were not being met with necessary increases in 

its number of uniformed officers. We also noted that USCP’s ability to 

assess risk levels—relative to the vulnerabilities of and threats to USCP 

security posts—would provide USCP with information needed to more 

effectively allocate limited resources to the areas of greatest need. In that 

regard, we worked with USCP to develop a risk analytical management 

matrix that could be used to assess risk relative to the threats and 

vulnerabilities of the Capitol Complex. Moreover, we issued three 

recommendations to help USCP develop a risk management framework 

that links threats and vulnerabilities to allocation of resources. 

In our March 2007 report, we noted that while USCP had taken several 

steps to develop a risk management framework to address our 

recommendations, its progress was slow. Since we issued that report, 

USCP has made significant progress in addressing our recommendations 

regarding the implementation of a risk management approach, although 

further actions are needed. 

Progress Has Been Made 

in Applying the Risk 

Matrix, but It Is Not Fully 

Implemented 

USCP has made significant progress in applying the risk management 

framework. Using the risk matrix and other tools, USCP has completed 

risk assessments for 18 of 19 congressional facilities and is scheduled to 

complete all assessments this fiscal year. According to USCP officials, they

will be required to complete a total of 25 assessments after the department 

assumes responsibility for six additional facilities from the Library of 

Congress at the end of the fiscal year. USCP will need to complete the risk 

assessments of all the facilities under its responsibility to fully address our 

recommendations. Moreover, to ensure that USCP’s resource 

requirements are better linked to threats and vulnerabilities, USCP 

contracted with Enlightened Leadership Solutions (ELS) to assess the 

department’s manpower configuration, law enforcement operations, and 

Page 6 GAO-08-540T 
overall staffing resources. According to USCP officials, the findings from 

the ELS Manpower Study are currently being evaluated and integrated into

its Force Development Planning Process. Agency officials told us that 

upon integration, the USCP will be able to more effectively link resource 

requirements to threats and vulnerabilities. 

Initial Steps Taken to 

Review and Test the 

Effectiveness of the 

Matrix; However, 

Additional Actions Are 

Necessary 

While USCP has taken initial steps to review and test the effectiveness of 

its risk management framework, further action is necessary to fully 

implement our recommendation. For example, ELS examined the risk 

management frameworks employed by comparable federal law 

enforcement agencies to identify best practices and potential benchmarks. 

To do this work, ELS conducted best practices research and interviewed 

high-level officials in the Central Intelligence Agency (CIA), the Federal

Bureau of Investigation (FBI), the U.S. Department of State’s Bureau of 

Diplomatic Security, and the Department of Defense. Moreover, USCP 

sought the assistance of three additional agencies—the General Services 

Administration (GSA), the Transportation Security Administration (TSA), 

and the U.S. Secret Service (USSS)—to conduct peer reviews by reviewing 

USCP’s risk management framework. According to USCP, the agencies 

listed above share protective missions similar to the USCP as well as 

conduct large physical security surveys. According to USCP, regarding the 

risk management framework, these agencies all concur with USCP’s 

methodologies, processes, and reporting structures. Although we did not 

validate the initial findings of the external peer reviews, we believe that 

USCP is taking steps in the right direction to review the effectiveness of its 

risk management framework. 

To test the effectiveness of the risk matrix, according to USCP officials, 

the department’s Safety and Security Bureau (SSB) plans to conduct an 

annual internal review and assessment of the risk matrix after all risk 

assessments have been completed for all congressional facilities. As a part 

of the review, SSB proposed to evaluate the thoroughness and accuracy of 

each risk assessment; review whether or not all existing vulnerabilities 

and mitigation options were correctly identified; and suggest changes or 

updates to the risk matrix as a result of the review. Agency officials told us 

that this plan is to be formalized into their SOPs when all physical 

assessments of the congressional facilities have been completed. 

When fully integrated, the combination of these efforts should fulfill our 

remaining recommendations regarding the linkage between risk 

management and the necessary resource requirements to address those 

risks in the most efficient and effective manner.

Page 7 GAO-08-540T 
Financial 

Management: 

Progress Noted in 

Certain Areas, but 

Major Financial 

Management 

Challenges Remain 

In our March 2007 report, we found that USCP continued to face major 

challenges and had not made significant progress toward improving its 

financial management operations. Major challenges reported included a 

high level of staff turnover and open vacancies, which have continued into 

fiscal year 2008 and prevented USCP’s Office of Financial Management 

(OFM) from stabilizing its financial management operations. As you know, 

a stable and skilled workforce is needed to build a strong foundation for 

financial management, internal control, and accountability. Our March 

2007 report also highlighted continuing challenges related to financial 

reporting and the performance of related physical inventories of assets, 

the implementation of a new financial management system, and the need

to follow through with plans to develop and implement an internal control 

program. Further, we reported that 23 previously issued financial 

management recommendations covering general financial management 

and reporting, internal control policies and training development, 

procurement, and staffing identified during our reviews since 2004 had not 

been addressed. 

During the past year, OFM has made important progress toward 

addressing long-standing financial management issues in each of these 

areas, including the issuance of its first full set of financial statements in 

accordance with generally accepted accounting principles in December 

2007. In addition to achieving this important milestone, USCP completed 

actions in areas such as assessing its staffing needs and procurement 

process that effectively addressed 8 of our 23 recommendations. However, 

despite these efforts, USCP did not make progress toward addressing 

ongoing staff shortages and work imbalances, which significantly limit its 

ability to sustain improvement efforts and meet long-term financial 

management goals and prevented us from noting progress in 2 

recommendations. In addition, although USCP has made important 

progress toward addressing the remaining 13 recommendations related to

training, policies and procedures, internal controls, and other financial

management activities, continued efforts are needed to ensure that USCP’s

financial management operations meet their objectives and stakeholder 

needs. 

Addressing Staffing 

Shortages Is Critical for 

Sustained Improvements 

USCP effectively addressed two of our prior recommendations related to 

evaluating its financial management staffing needs by conducting internal 

assessments of current and future needs that included assessing the need 

for additional staff or contractors to meet ongoing needs and high-priority 

demands. However, USCP has not made progress in addressing two 

recommendations to fill vacancies that are critical in helping OFM stabilize 

Page 8 GAO-08-540T 
its workforce, reduce risk associated with workload and staffing 

imbalances, improve its financial operations and meet its long-term goals. 

For example, eight OFM positions, including the Chief Financial Officer 

(CFO), Deputy CFO, Budget Officer, and Procurement Officer, remained

vacant as of April 4, 2008, due to recurring turnovers and other factors. As 

a result of these shortages, USCP financial statement auditors reported 

significant weaknesses related to OFM’s ability to effectively monitor its 

financial management operations. 

Collectively, USCP efforts effectively addressed three of our prior 

recommendations related to procurement activities and credit card 

programs; however, additional efforts are needed to address nine other 

recommendations in these areas. For example, efforts to realign 

procurement staff and implement workload efficiencies have enabled OFM 

to eliminate previously reported backlogs and provided an effective 

framework for meeting future activity. In addition, USCP monitored 

purchase card activity to identify potential fraudulent activity, improper 

usage, or abuses of these cards and initiated efforts to monitor fleet and 

travel card activities. USCP has also made progress toward providing 

training and guidance for staff involved in procurement activities and 

credit card programs. However, continued efforts are needed to further 

assess credit card program risks and enhance existing guidance, training, 

and monitoring activities to ensure consistent application of policies and 

procedures. 

Additional Efforts Needed 

to Build on Progress Made 

in Procurement Activities 

and Credit Card Programs 

Financial Reporting and 

Internal Control Have 

Improved, but Challenges 

Remain 

USCP effectively addressed three of our seven recommendations related 

to financial reporting and general internal control by issuing its first full 

set of financial statements, formalizing procedures related to

reprogramming transactions, and establishing electronic approval paths in

its new financial management system. By the end of fiscal year 2007, USCP 

had also issued or revised about 30 policies and procedures covering a 

wide range of financial activities including payroll, capitalized assets, and

access to its financial management reporting system. Although USCP has 

made substantial progress in formalizing its policies and procedures, 

additional efforts are needed to address issues identified in the four 

remaining recommendations. For example, the USCP financial statement 

auditor noted in its 2007 audit report instances where the lack of staff and 

improper implementation of USCP’s policies and procedures created 

Page 9 GAO-08-540T 
deficiencies that ultimately contributed to two material weaknesses1

 and 

the auditor’s inability to issue an opinion on the financial statements. 

Recognizing that annual financial statements audits provide a valuable 

assessment of USCP’s financial management operations and that auditors

reported significant deficiencies in December 2007, we encourage USCP to 

continue to work with its auditors to address (1) the deficiencies that 

prevented its auditors from expressing an unqualified opinion on its 

financial statements, (2) significant internal control deficiencies reported 

by the auditors including those considered to represent material 

weaknesses related to payroll processing and financial management, and 

(3) any instances of noncompliance with laws and regulations reported by 

the auditors. Correcting these deficiencies will not only permit USCP to 

obtain an unqualified opinion in the future, but will also help in achieving 

its long-term goal of becoming a fully functional financial management 

operation with a solid foundation of internal control and accountability. 

Since our prior review in March 2007, USCP has successfully implemented 

our August 2004 recommendation to adopt a civilian hiring policy. USCP 

has addressed this recommendation by issuing a policy that describes the 

department’s process for hiring both sworn and civilian staff and outlines 

the responsibilities of managers and selecting officials in this process. 

Additionally, USCP has made some initial steps to develop a strategic 

workforce plan and a master training plan. Our past work has identified 

the need for USCP to develop these plans to address several long-standing 

human capital challenges, such as updating human resource management 

policies and procedures, improving workforce planning, and addressing 

employees’ training needs. In January 2004, we issued six 

recommendations proposing that USCP develop and implement a strategic 

workforce planning process containing specific human capital strategies 

addressing such areas as recruitment and training. We made two 

additional recommendations regarding the implementation of this process 

in our reports issued in 2005. Of these eight recommendations, USCP has 

Human Capital 

Management: USCP 

Has Adopted Hiring 

Policy and Initiated 

Efforts to Address 

Long-standing 

Workforce Planning 

and Training Issues 

 1

A material weakness is a significant deficiency, or a combination of significant 

deficiencies, that result in more than a remote likelihood that a material misstatement of 

the financial statements will not be prevented or detected. A significant deficiency is a 

control deficiency, or combination of control deficiencies, that adversely affects the 

entity’s ability to initiate, authorize, record, process, or report financial data reliably in 

accordance with generally accepted accounting principles such that there is more than a 

remote likelihood that a misstatement of the entity’s financial statements that is more than

inconsequential will not be prevented or detected. 

Page 10 GAO-08-540T 
made progress on all but one recommendation—to monitor and evaluate 

the results of its strategic workforce plan. Because USCP has not yet fully 

developed its strategic workforce plan, it is still too soon for officials from 

USCP’s Office of Human Resources (OHR) to monitor and evaluate the 

results of this plan. 

In our August 2004 report, we determined that USCP needed to adopt 

clear, up-to-date policies and procedures for hiring individuals into civilian 

positions. Specifically, both USCP’s SOP that discusses the roles and 

responsibilities managers have in the civilian hiring process and the 

supplemental memorandum on the process for making job offers were 

out-of-date and not consistently implemented by USCP officials. In 

October 2007, USCP successfully implemented this recommendation by

issuing its Employment and Promotion Policy Plan that provides a 

standardized hiring process for both sworn and civilian positions within 

USCP. In addition to including a description of the department’s hiring 

process, this plan also outlines the responsibilities that managers and 

selecting officials have in the hiring process, such as determining whether 

vacant positions still need to be filled and consulting with OHR officials on

any changes in the position’s duties, responsibilities, or organizational 

placement. This plan was approved by USCP’s Chief of Police and applies 

to all personnel actions related to filling USCP positions. 

USCP Has Adopted a 

Civilian Hiring Policy 

USCP Has Taken Initial 

Steps to Develop a 

Strategic Workforce Plan 

Our prior work examining the practices of leading organizations has 

highlighted the importance of developing human capital strategies—the 

programs, policies, and processes that organizations use to hire and train 

staff; develop succession plans; administer a performance management 

system; and use human capital flexibilities.2

 These strategies can assist an 

agency in addressing skill gaps within its current workforce as well as 

acquiring skills needed in the future to achieve an agency’s mission and 

goals. 

To address our eight recommendations relating to the development and 

implementation of a strategic workforce planning process, USCP’s Office 

of Human Resources has completed an initial draft of a strategic 

 2

GAO, Human Capital: Agencies Need Leadership and the Supporting Infrastructure to 

Take Advantage of New Flexibilities, GAO-05-616T (Washington, D.C.: Apr. 21, 2005); and 

GAO, Human Capital: Effective Use of Flexibilities Can Assist Agencies in Managing 

Their Workforces, GAO-03-2 (Washington, D.C.: Dec. 6, 2002). 

Page 11 GAO-08-540T 
workforce plan, which discusses the importance of workforce planning, 

demographic information on USCP’s workforce, as well as a listing of 

action items needed to develop a set of human capital strategies. Although

creating this initial draft plan is an important first step, OHR officials 

acknowledge that the plan will need further refinement. Specifically, as 

the draft plan is further developed, the action items should be more fully 

developed and include such details as specific tasks to complete, defined 

roles and responsibilities, milestones, and resource requirements. Finally, 

because USCP has not yet fully developed its strategic workforce plan, it is 

too soon for OHR officials to monitor and evaluate their progress on 

achieving the human capital goals of their plan―one of the eight 

recommendations we made related to strategic planning. 

Further Collaboration 

Needed to Complete 

Master Training Plan 

In our March 2007 report, we discussed USCP’s efforts to establish a welldesigned training program that addresses the needs of both sworn and 

civilian staff. Effective training and development programs are an integral

part of an agency’s ability to ensure that its employees have the 

information, skills, and competencies to work effectively. These training 

programs can also enhance an agency’s ability to attract and retain 

employees with needed skills and competencies. 

To address three of the recommendations related to developing USCP’s 

strategic workforce plan, USCP’s Training Services Bureau (TSB) officials 

have been working on a four-phase process to develop a master training 

plan, which is to define and prioritize staff training needs and 

requirements. TSB has completed the process’ first phase by issuing a 

training catalog containing all training courses available to USCP staff 

through TSB as well as external training providers and facilities. Currently, 

TSB is in the second phase of this process—validating the competencies of 

USCP’s position descriptions—which will require further collaboration 

with OHR. According to OHR officials, they have finished identifying the

competencies for USCP’s civilian positions and are currently reviewing 

and revising competencies for the sworn positions. Upon completion of 

this phase, TSB officials, working with OHR and other stakeholders, plan 

to then identify appropriate professional development and training 

curriculum for all USCP staff based on the set of validated competencies. 

To complete the development of the master training plan, TSB officials 

plan to develop specific training strategies and procedures, such as 

formulating future training needs. 

Page 12 GAO-08-540T 
Information 

Technology: USCP 

Has Made Progress 

toward Establishing 

IT Management 

Capabilities, but 

Further Actions Are 

Needed to Address 

Remaining 

Weaknesses 

USCP relies on information technology (IT) to support the achievement of

its mission. For example, USCP depends on IT systems to schedule and 

dispatch police officers, manage the maintenance of vehicles and 

equipment, and perform numerous administrative functions, such as 

preparing financial reports and paying employees. To effectively leverage

IT in achieving strategic mission goals and outcomes, an organization such 

as USCP needs to institutionalize certain management disciplines and 

capabilities. Accordingly, we have advised the agency on the importance 

of (1) following disciplined system acquisition management practices, 

(2) developing and implementing an enterprise architecture, 

(3) establishing and implementing investment management structures and 

processes, and (4) developing and implementing an effective information 

security program and continuity of operations plan. Our research of 

leading private and public sector organizations shows that success in 

managing and leveraging IT can be linked to these strategic IT 

management disciplines and capabilities. 

USCP has made progress in addressing our recommendations related to 

each of these IT management disciplines and capabilities, including the 

use of disciplined system acquisition management practices. Nevertheless, 

weaknesses remain in the areas of enterprise architecture, investment 

management, information security, and continuity of operations planning. 

Of nine recommendations we made in January and August 2004 to improve 

USCP’s IT management capabilities, the department has completed 

actions on four of the recommendations and has made progress toward 

completing the remaining five recommendations. 

System Acquisition Polices 

and Procedures Have Been 

Developed and 

Implemented 

USCP has completed the development and implementation of system 

acquisition policies and procedures that are essential to reducing the risk

of acquiring systems that do not perform as intended, are delivered late, 

and cost more than planned. Specifically, the agency’s policies and 

procedures provide for, among other things, developing acquisition plans 

and maintaining them throughout the acquisition life-cycle. Additionally, 

USCP has taken steps to ensure that system acquisitions are conducted in 

accordance with the policies and procedures. For example, as part of its 

acquisition of a new case management system, USCP developed a project 

management plan, defined requirements, and monitored project 

development costs. According to USCP officials, the agency’s policies and

procedures are followed for ongoing and planned system acquisitions. As a 

result of improving its system acquisition management, USCP has reduced 

the risk of systems not performing as intended, not being delivered on 

time, and not meeting cost and schedule expectations. 

Page 13 GAO-08-540T 
USCP has a long-standing enterprise architecture program and, according

to agency officials, all but one of the agency’s existing applications are in 

compliance with the current architecture version. However, progress 

within the last year toward effectively managing the program in 

accordance with relevant guidance, such as our enterprise architecture 

management maturity framework, has been limited. Further, the agency’s 

architecture products do not include the full breadth of necessary content,

particularly regarding descriptions of how security will be achieved. 

Additionally, USCP officials have identified the need to update their 

transition plan and for the revised plan to include a current schedule for 

legacy systems replacement and the resource needs for accomplishing this 

replacement. According to the officials, the agency has not had sufficient 

staff resources to support its architecture program, and thus, has 

requested funding for two full-time architecture staff in its fiscal year 2009 

budget request. Until USCP addresses these weaknesses in its enterprise 

architecture program, the agency will be challenged in its ability to 

implement systems that optimally support mission operations. 

Further Actions Needed to 

Develop and Implement 

Enterprise Archietecture 

IT Investment 

Management Process Has 

Been Developed, but 

Implementation Has 

Limitations 

USCP has developed, but not yet fully implemented, a comprehensive IT 

investment management process. The agency’s IT Capital Planning and 

Investment Control Guide defines a comprehensive process that includes 

selection, control, and evaluation of proposed and ongoing investments. 

While the agency has made progress toward implementing a process 

consistent with its guide, the existing process is largely limited to the 

selection of proposed investments, with little emphasis on controlling and 

evaluating ongoing investments. For example, the process does not yet 

require documentation of key decisions or include assignment of 

responsibility for executing decisions during the control and evaluation 

stages of the investment life cycle. In speaking to these activities, USCP 

officials said they chose to focus their initial investment management 

efforts on increasing discipline in the selection of all (i.e., IT and non-IT) 

investments across the agency; however they recognized the need to 

extend such discipline to the control and evaluation of the agency’s 

investments. Until USCP implements an investment management process 

that includes control and evaluation of investments, in addition to the 

already established selection process, the agency will not be effectively 

positioned to provide the management oversight and informed decision 

making that is necessary to ensure that investments are performing as 

planned and delivering promised value. 

Page 14 GAO-08-540T 
USCP has implemented an information security program and performed 

continuity of operations planning. The agency reported that it has 

implemented 70 of 108 information security program activities that it had 

identified as necessary. For example, it has completed the execution of 

vulnerability assessments and network scans. Additionally, according to 

agency officials, certification and accreditation of major applications has

been completed and information security plans have been developed for 

major applications. Regarding continuity of operations planning, USCP has 

revised its continuity of operations plan and begun activities to implement 

the plan throughout the agency. Specifically, in January 2008, the Chief of

Police adopted the revised plan and directed follow-on activities to be 

completed that include a timeline for ensuring the integration of the plan

with agency operations. Nevertheless, USCP officials assert that the 

agency needs additional staff resources to fully implement its remaining 

security program activities and maintain an effective security program. To 

this end, the agency has requested funding for two full-time IT security 

staff in its fiscal year 2009 budget request. Until USCP completes its 

security program activities, it will not be positioned to protect its systems 

and critical information. 

Over the years, we have recommended that USCP take actions to correct 

deficiencies we identified in the areas of operations, financial 

management, strategic and human capital planning, and IT management. 

Since the issuance of our last report and as noted in this statement, USCP 

has made significant progress in addressing our prior recommendations. 

Notwithstanding the progress that has been made, there is still substantial 

work that remains to be done. For example, in the areas of linking 

resources to threats and vulnerabilities, USCP has yet to fully integrate its

risk management framework. Until this process is completed, USCP will 

not be in the best position to effectively link resource needs to threats and 

vulnerabilities. In the areas of financial management, USCP has yet to fully 

address the challenges of ongoing staff shortages and work imbalances. 

Until these recommendations are implemented, USCP’s ability to sustain 

improvement efforts and meet long-term financial management goals will 

be limited. In the area of human capital management, work still remains to 

complete its strategic workforce plan and master training plan, which 

should include long-term strategies for acquiring, developing, and 

retaining a workforce with the critical skills and competencies needed to 

accomplish the department’s mission. In the area of information 

technology, despite the progress made in addressing management 

concerns, weaknesses remain in enterprise architecture, investment 

management, and information security. Until these management and 

Further Actions Needed to 

Fully Implement 

Information Security 

Program and Continuity of 

Operations Plan 

Concluding Remarks 

Page 15 GAO-08-540T 
operational issues are fully addressed and implemented, USCP will not be 

in the best position to achieve its strategic goals and mission in the most 

efficient and effective manner. This underscores Congress’s need to stay 

closely attuned to USCP’s progress toward addressing the administrative 

and management challenges we identified. 

Mr. Chairman, this concludes our prepared statement. We would be happy 

to respond to questions you or other members of the subcommittee may 

have at this time. 

For questions regarding this testimony, please contact Richard M. Stana at

(202) 512-8777 or stanar@gao.gov. Contact points for our offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this statement. 

Page 16 GAO-08-540T 
Page 17 GAO-08-540T 

This appendix provides a status summary of the progress made and 

remaining actions by USCP in addressing prior GAO recommendations. 

GAO recommendation and 

date of recommendation Status Progress and remaining action

Framework for Recommendation Accountability

1. Set goals, timetables, and establish 

accountability for implementing 

outstanding GAO recommendations. 

March 2007 

Completed Progress 

USCP has fulfilled this recommendation, through the creation of the Force

Development Process—which is an organizational effort to incorporate 

risk management into its planning, operations, investment decisions and 

resource requests and the establishment of an audit liaison to handle the 

coordination, tracking, and reporting of all open recommendations (that is, 

recommendations not yet fully implemented) from both GAO and USCP’s 

Office of the Inspector General (OIG). 

In July 2007, USCP issued Directive 2032.001 that established a 

framework tool to track the progress made on outstanding GAO and OIG

recommendations. The primary objectives of the directive are to: 

(1) specify the roles of USCP officials involved with follow-up and 

resolution of outstanding recommendations, (2) strengthen the 

procedures utilized by the department, (3) assure that corrective actions 

committed by the department are actually taken in a timely manner, and 

(4) improve overall internal controls over audit follow-up and ensure 

continuous organizational evaluation and improvement. 

Moreover, USCP developed a planning process and tracking system that 

utilizes action plans to document the assignment of recommendations to 

specific owners, establish timetables, and track the resolution of 

recommendations. 

Remaining action 

None required.

2. Report semiannually to the USCP 

Board, Senate and House 

Appropriations Committees, the Senate 

Committee on Rules and Administration, 

and the House Committee on House 

Administration on progress made in

implementing our prior 

recommendations. 

March 2007 

Completed Progress 

USCP has completed this recommendation by reporting semiannually to 

the designated stakeholders. Specifically, USCP has issued two 

semiannual reports to the designated stakeholders to provide a progress 

update regarding prior GAO recommendations. This is a part of the 

department’s framework to increase organizational accountability and its 

response to stakeholder concerns. 

Remaining action 

None required.

Appendix I: Status of United States 

Capitol Police (USCP) Recommendations 
GAO recommendation and 

date of recommendation Status Progress and remaining action

Linking Resources to Risks, Threats, and Vulnerabilities

1. Apply the risk matrix to all 19 

congressional buildings. 

November 2005

In progress Progress 

Since our March 2007 report, USCP has made good progress in 

completing risk assessments for almost all congressional facilities. Over 

the past year, the department has applied the risk matrix— which is 

based on threat level and criticality—to 18 of 19 facilities and plans to 

apply it to six Library of Congress buildings when USCP assumes 

responsibility for their security. USCP is scheduled to complete 

assessments on any remaining facilities in fiscal year 2008. 

A critical aspect of this work includes linking threats and vulnerabilities to 

staffing resources. In October 2006, USCP contracted with Enlightened 

Leadership Solutions (ELS) to conduct an assessment of how well USCP 

responds to the threats and risks unique to the Capitol Complex and to 

determine the most effective way to allocate staffing resources throughout

the department. According to agency officials, ELS completed the 

Manpower study in October of 2007. However, the study’s 

recommendations are under review and have yet to be applied to USCP’s 

risk management approach and overall operations and strategic planning. 

Agency officials told us that once the recommendations from the study 

are applied to the risk management framework and its operations, the 

department will be in a better position to determine how best to 

strategically place its officers throughout the Capitol Complex to mitigate 

threats and vulnerabilities. 

Remaining action 

Although ELS delivered its recommendations on how USCP should 

allocate its staffing resources throughout the Capitol Complex in October 

2007, USCP has yet to fully implement them into its risk management 

approach. While progress has been made in linking threats and 

vulnerabilities to staffing and resource allocation, according to agency 

officials, integrating the findings from the ELS report into USCP’s overall 

operations and strategic planning processes is an ongoing task that 

requires oversight and feedback. Moreover, USCP senior management 

indicated that achieving buy-in from the department’s uniformed officers 

and staff will also take additional time. 

Page 18 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

2. Conduct an external peer review of the 

risk matrix and make revisions as 

appropriate. 

November 2005

In progress Progress 

USCP has taken steps to address this recommendation by conducting 

best practices research from comparable federal law enforcement 

agencies. USCP contracted with ELS to determine how best to link 

staffing resources with threats and vulnerabilities. During the course of 

the review, ELS contacted several federal law enforcement agencies that 

shared similar missions with USCP. ELS interviewed security officials 

from the Uniformed and Protective Division of the Federal Bureau of 

Investigation (FBI), the Central Intelligence Agency (CIA), the Department

of Defense, and the Department of State (Bureau of Diplomatic Security).

ELS concluded that the factors considered in their risk management 

approach aligned with the current practices of their peer federal law 

enforcement agencies. 

In January 2008, USCP sought the assistance of three additional 

agencies to review its risk matrix. These agencies included the United

States Secret Service (USSS), the Transportation Security Administration 

(TSA), and the General Services Administration (GSA). According to 

USCP officials, these federal agencies were chosen because they share 

protective missions similar to USCP and therefore conduct similar 

physical security assessments. According to USCP, regarding the risk 

management framework, these agencies all concur with USCP’s 

methodologies, processes, and reporting structures. Although GAO did 

not validate the findings of the external peer review, we believe that 

USCP is taking steps in the right direction. 

Remaining action 

USCP needs to complete risk assessments of the remaining 

congressional facilities as well as the six facilities it will assume 

responsibility for from the Library of Congress and incorporate the 

findings from the ELS manpower study into the risk matrix. 

3. Conduct periodic testing and evaluation 

of the risk matrix to help ensure its 

continued effectiveness as a risk 

assessment/resource allocation tool. 

November 2005

In progress Progress 

The Security Services Bureau (SSB) has developed a plan to conduct 

periodic assessments of the risk matrix. The proposed plan includes an

annual review of all the assessments conducted for congressional assets, 

quarterly reviews of technology concerns related to the risk matrix, and a 

formal process to report recommendations and modifications to the risk 

matrix to the Chief Operating Officer (COO). 

Remaining action 

While the USCP has plans to periodically test and evaluate the risk 

matrix, the process has yet to be formalized as a Standard Operating 

Procedure (SOP). 

Page 19 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

Financial Management 

Financial Reporting and General Internal Controls 

1. Consult with congressional 

stakeholders to determine the format 

of audited financial statements that 

would be useful to those stakeholders 

and explore interim steps, such as 

preparing a statement of budgetary 

resources, to be completed prior to 

developing a full set of financial 

statements in accordance with 

generally accepted accounting

principles (GAAP) for federal entities, 

so that congressional and other 

stakeholders are provided with audited 

information that meets their needs. 

January 2004 

Completed Progress 

USCP has fulfilled this recommendation by issuing its first Statement of 

Budgetary Resources in fiscal year 2004 and its first full set of financial 

statements in accordance with GAAP in fiscal year 2007. 

Although USCP’s efforts satisfied the intent of this recommendation, 

financial statement auditors disclaimed their opinion on the USCP 

financial statements because they were unable to obtain sufficient, 

competent evidential matter to determine if the financial statements were

fairly presented in accordance with generally accepted accounting 

principles. These deficiencies prevented the auditors from validating 

amounts at which property, plant, and equipment were recorded, as well 

as other items such as the amount of write-offs, depreciation expense, 

and operating expenses. 

The USCP financial auditor also identified two material weaknesses in the 

areas of payroll processing and financial management which included 

several deficiencies that USCP needs to address. 

2. Provide training and other guidance to 

Office of Financial Management (OFM) 

staff to ensure consistent application of 

the applicable policies and procedures 

relating to financial management 

operations. 

January 2004 

In progress Progress 

USCP has made significant progress in providing guidance to OFM staff 

through financial management training sessions and through the 

development and implementation of numerous financial management 

policies and procedures since this recommendation was reported. 

• During fiscal years 2006 and 2007, USCP issued or revised over 30 

SOPs related to its budget activities, payroll processing, 

reconciliations, year-end procedures, capitalized asset processing, and 

other financial management activities. Financial statement auditors 

also reported progress in their December 2007 report, noting that 

USCP implemented many recommended policies and procedures for 

managing its financial operations. 

• During fiscal year 2007, OFM held numerous training sessions relating 

to its financial management system including budget, financial 

reporting, financial systems, internal controls, and other areas. These 

included sessions developed for Directors, Financial Liaison Officers, 

and administrative staff with financial management functions. 

• To further improve its guidance and documentation on internal control 

processes, USCP hired a contractor to perform an overall review of 

USCP’s internal control program, including an evaluation of policies 

and procedures over financial reporting. The contractor is to assist 

USCP in identifying required policies and procedures necessary to 

ensure compliance with OMB Circular No. A-123a

 and support financial 

statement development. 

Page 20 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

However, despite ongoing efforts by USCP to provide training and other 

guidance such as policies and procedures to its staff, financial statement 

auditors reported in USCP’s 2007 audit report that policies and 

procedures were not consistently applied due to the lack of manpower 

resulting in continuing financial management deficiencies. Auditors also 

reported the need for additional policies in several areas to address 

internal control deficiencies identified during the audit. For example, 

auditors reported that USCP has inadequate quality assurance 

procedures for year-end closing and financial statement preparation 

activities. They also reported that lack of policies and procedures to 

ensure coordination between OFM and the Office of General Counsel and

among OFM divisions contributed to inadequate communication required 

for timely and accurate financial reporting.

Remaining actions

• Continue efforts to develop and implement additional policies and 

procedures to address deficiencies noted by financial statement 

auditors as well as those identified through other internal and external

reviews. 

• Ensure staff continue to receive training in key financial management 

areas and in new and existing policies. 

• Assess the cause of deficiencies noted by financial auditors to 

determine if weaknesses relate to deficiencies in the SOPs, 

implementation of procedures, or lack of monitoring. 

• Monitor the implementation of policies and procedures to ensure 

consistent application of the policies and eliminate deficiencies related 

to this area.

3. Assess whether adequate segregation of 

duties exists over financial management 

activities to ensure that proper control 

procedures are in place over USCP 

resources to reduce the risk of

erroneous or fraudulent transactions. 

August 2004 

In progress Progress 

• In our February 2005 report, we noted that OFM had taken actions to 

correct the segregation of duties issues identified and developed an 

OFM-wide policy on internal controls to ensure proper segregation of 

duties. 

• In 2006, USCP hired a contractor to perform an overall review and 

assessment of its internal control program, including assessing 

segregation of duties. In September 2007, the contractor provided an 

assessment of USCP’s internal control environment related to financial 

reporting policies and procedures, which included numerous 

recommendations for improvement. In addition, as of February 2008, 

this contractor had reviewed six of USCP’s financial assessable units 

and, according to an OFM official, completion of the remaining financial 

reviews is expected by June 2008. 

• In May 2007, USCP developed and established an SOP that provided 

guidance on requirements for granting access to its Momentum and 

Maximo financial systems. This SOP also included provisions for 

periodic reviews to ensure adequate segregation of duties. Before this 

SOP was finalized, a review of Momentum access was completed in 

December 2006, and USCP reported that as of January 2008 it had 

initiated efforts to conduct its 2008 review. 

Page 21 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

However, despite these efforts, the fiscal year 2007 financial statement 

audit report issued in December 2007 disclosed significant internal control 

deficiencies related to financial management and other areas, which may 

be caused in part by improper segregation of duties. For example, the 

auditor cited several instances where transactions were not properly 

supervised and monitored creating misstatements, transaction errors, 

incomplete transactions, and inaccurate documentation. Until USCP 

addresses these deficiencies and underlying causes, it cannot adequately

ensure that the risks of erroneous or fraudulent transactions are mitigated 

by appropriate internal controls. 

Remaining action 

USCP needs to continue implementing actions to address deficiencies 

and issues identified through its internal and external internal control 

review efforts.

4. Continue to develop and implement all 

necessary policies and procedures 

covering financial management 

operations, and adequately train all staff 

involved in financial management 

activities to ensure consistent application 

of the applicable policies and 

procedures, and to reduce risk in 

financial management operations. 

February 2005

In progress Progress 

USCP has made significant progress in providing guidance to OFM staff 

through financial management training sessions and through the 

development and implementation of numerous financial management 

policies and procedures since this recommendation was made. 

For additional information on progress made and remaining actions, refer 

to those described in Recommendation 2. 

5. Increase efforts to develop and 

implement all necessary policies and 

procedures covering financial

management operations, and 

adequately train staff involved in 

financial management activities to help 

ensure consistent application of the 

applicable policies and procedures, and 

to reduce risk in financial management 

operations. 

November 2005

In progress Progress 

USCP has made significant progress in providing guidance to OFM staff 

through financial management training sessions and through the 

development and implementation of numerous financial management 

policies and procedures since this recommendation was made. 

For additional information on progress made and remaining actions, refer 

to those described in Recommendation 2. 

6. Establish, document, and formalize 

specific policies and procedures for 

year-end reprogramming transactions. 

November 2005

Completed Progress 

In August 2006, USCP issued a Budget Modifications and 

Reprogramming Standard Operating Procedure (SOP) which fulfilled the 

intent of this recommendation. The USCP SOP outlined procedures for 

processing year-end reprogramming and other transactions, which 

included provisions for 

• establishment of deadlines for bureau and office staff to approve 

requisitions, and travel and training authorizations in USCP’s financial 

system; 

• Budget Office authority to withdraw remaining annual funds to fund 

other priority needs;

Page 22 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

• provision to officially request any reprogramming or notification actions 

from oversight committees, if necessary; and

• Budget Office authority to initiate and process reprogramming 

documents for any bureau or office in order to effect year-end spending 

reallocations and priorities and committee-approved transactions in 

USCP’s financial system. 

Although USCP satisfied this recommendation with the issuance of its 

SOP, additional efforts are needed to address issues identified by 

financial statement auditors and our review related to monitoring 

contracts and expenditures, and processing-related reprogramming 

transactions. Refer to Recommendations 7 and 21 for additional 

information. 

7. Establish electronic approval paths that 

are properly designed and implemented 

in the new financial management system 

to help ensure that adequate 

segregation of duties is in place and that 

only approved reprogramming

transactions are processed in the 

system. 

November 2005

Completed Progress 

In connection with the implementation of its new financial system, 

electronic approval paths have been established, segregating the ability 

to create and approve reprogramming transactions and to help ensure 

that only approved transactions are processed in the system. 

Although USCP efforts to implement electronic approval paths in its new 

financial system satisfy the intent of this recommendation, the USCP 

financial statement auditors noted in its audit report that 2 of the 87 

reprogramming transactions were entered after the fiscal year ended. For 

example, one of these reprogramming issues resulted from travel 

expenditures by the Dignitary Protection Division (DPD) exceeding yearend budgeted amounts. According to an OFM official, DPD travel 

expenditures are difficult to estimate and track since DPD uses group 

travel authorizations as opposed to individual authorizations. To cover for 

the DPD-related travel vouchers, approximately $63,000 of additional 

funds had to be reprogrammed after year-end. According to an OFM

official, USCP encountered another reprogramming transaction after 

year-end related to a contractor’s late submission of outstanding invoices 

for 2007 expenditures resulting in a reprogramming transaction involving 

approximately $115,000 of fiscal year 2007 funds. 

Because of these type of situations, it is important that USCP monitors its 

transactions to identify and process all reprogramming transactions by 

fiscal year-end. 

Page 23 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

Staffing

8. Hire additional staff to fill vacant 

positions and maintain authorized 

staffing levels to meet USCP financial 

management goals. 

August 2004 

No progress Progress 

USCP has made no progress in filling vacant positions and maintaining 

authorized staffing levels to meet its financial management goals and 

avoid workload imbalances as evidenced by the following findings: 

• Eight vacancies continue to exist in its Office of Financial Management 

(OFM) as of April 4, 2008, indicating no overall progress toward 

reaching authorized staffing levels. 

• Seven key financial staff left OFM during 2007, including the Chief 

Financial Officer (CFO), Deputy CFO, Procurement Officer, and a 

Budget Officer. 

In addition, the USCP financial statement auditor cited in its fiscal 2007 

audit report that severe loss of human capital resources had a significant 

effect on USCP’s financial reporting capability for fiscal year 2006, and 

additional human capital loss during fiscal year 2007 exacerbated the 

existing finding. The auditor also stated that the combination of existing 

and new staff shortages, additional financial statements, and the 

accelerated deadline, along with the identified internal control 

weaknesses, taxed OFM beyond its capacity. 

According to USCP officials, only two positions have been filled in OFM

since the GAO March 2007 report, and selections have been made to fill 

three additional OFM positions, but no confirmations have been made. 

Although OFM has made attempts to address the large number of 

vacancies and staff imbalance issues, no actual progress has been made 

due to the high rate of turnover and other factors. 

Remaining action 

USCP must fill existing OFM vacancies and hire needed staff with 

sufficient skills to meet its financial management goals. 

Page 24 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

9. Continually evaluate its financial 

management staffing needs to 

determine whether staffing levels are 

sufficient to address current and future 

operational demands and meet longterm financial management goals. 

February 2005

Completed USCP has fulfilled this recommendation by continually evaluating its 

staffing needs to meet operational demands and long-term financial 

management goals. Since our March 2007 report, the USCP did the 

following: 

• Evaluated its staffing needs and, based in part on a staffing analysis 

performed by an independent contractor, continued to request funding 

for additional OFM positions in its annual budget request. This request 

includes a description of the purpose for the requested position and the 

effect on financial management operations if not funded. For example, 

USCP’s fiscal year 2009 budget request includes two new accountant 

positions, noting that if these positions are not filled, OFM will have 

difficulties in meeting financial management goals and will struggle to 

produce financial statements, conduct timely quarterly closings, 

implement cost accounting, and address internal control deficiencies. 

• Posted announcements for several vacant positions in OFM using 

recently updated job descriptions. 

• Updated job descriptions to reflect USCP’s assessment of the specific 

competencies required for the vacancies. 

• Evaluated the need to restructure OFM resources and utilize services 

of contractors to fill short-term and ongoing needs in areas such as 

financial reporting, analysis, and travel voucher processing.

10. Evaluate its financial management 

staffing needs to (1) determine the 

proper mix of contractor and staff 

support needed during the current period 

of high demand and in the future, (2) 

determine whether staffing levels are 

sufficient to address future workload 

demands, and (3) meet its long-term 

financial management goals. 

November 2005

Completed Progress 

USCP has fulfilled this recommendation by continually evaluating its 

staffing needs to meet operational demands and long term financial 

management goals. 

For additional information on progress made, refer to actions described in 

Recommendation 9. 

11. Immediately address high-priority 

staffing and contractor needs and fill 

vacancies to reduce risk associated with

any workload and staffing imbalance. 

November 2005

No progress Progress 

USCP has made no progress in filling key vacant positions and 

maintaining authorized staffing levels to meet its financial management 

goals and avoid workload imbalances. 

For additional information refer to Recommendation 8. 

Page 25 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

Procurement and Credit Card Programs 

12. Develop and implement detailed 

policies and procedures covering 

USCP’s procurement activities and 

provide training to the appropriate staff. 

January 2004 

In progress Progress 

USCP has made significant improvements in addressing its detailed 

policies and procedures covering its procurement activities and has 

provided training to applicable staff. 

• In our February 2005 and November 2005 reports, we noted ongoing 

progress related to developing, finalizing, and implementing policies, 

procedures, and controls related to procurement, including the 

development of numerous policies and procedures and other guidance 

related to its purchase card, travel card, and fleet card programs. 

• During 2006 and 2007, USCP issued or revised numerous

procurement-related policies, including USCP’s procurement policy; 

travel card administration and monitoring policy; and policies related to 

contracting officer responsibilities, procurement thresholds, payment 

approvals, purchase order processing, file documentation, and 

acquisitions of office supplies.

• In August 2007, USCP issued interim guidance related to its travel and 

fleet card policies. 

• According to an OFM official, credit card holders are required to 

receive training regarding the proper use of USCP credit cards to 

ensure purchases of goods and services are made in accordance with 

existing policies. 

• Purchase card holders are required to sign that they have taken 

training before they are issued a purchase card. 

However, although OFM efforts to draft a purchase card policy were 

noted in an earlier report, this important procurement-related policy has 

not yet been finalized. In addition, USCP’s financial statement auditors 

reported in December 2007 that USCP does not have procedures in 

place to implement its new policy for monitoring fuel purchase 

transactions related to its fleet card program. 

Remaining actions

• Continue efforts to provide training and other guidance to address 

issues identified in the audit report and through internal reviews to 

monitor consistent application of policies and procedures. 

• Complete comprehensive purchase card policy. 

• Complete detailed procedures for performing reviews of fleet card 

transactions. 

• Implement procedures that conform with stated policies. 

Page 26 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

13. Provide training and other 

guidance to USCP operations staff who 

procure goods and services or oversee 

contracts to help ensure consistent 

application of the applicable policies and 

procedures relating to financial 

management operations. 

August 2004 

In progress Progress 

USCP has made significant improvements in developing its detailed 

policies and procedures covering its procurement activities and has 

provided training to applicable staff. 

• Refer to Recommendation 12 describing progress made by USCP in 

providing training and other guidance to staff who procure goods and 

services. 

• In addition to procurement guidance, USCP implemented the following 

steps to help ensure consistent application of contract management: 

• created contract and interagency agreement listings that, according 

to OFM officials, list all active contracts and interagency 

agreements; 

• dedicated teams to provide support to internal customers on

procurement issues (see details and progress described in 

Recommendation 15); and 

• implemented policy related to monitoring contractor performance 

and the role of Contracting Officer Representatives (COR). 

However, despite these efforts, USCP continues to be hampered by the 

lack of sufficient training and guidance and inconsistent application of 

policies and procedures related to procuring goods. For example 

• USCP experienced problems in monitoring contracts involving 

procurement-related activities to ensure contractor invoice

submissions; 

• certain purchase card guidance and desk procedures have not been 

finalized; and 

• the financial statement auditor and subsequently USCP found 

problems with travel reimbursement processing, which resulted in 

several duplicate travel reimbursements. 

Remaining action 

Refer to remaining actions described in Recommendation 12. 

14. Finalize detailed policies, 

procedures, and internal controls 

covering USCP’s procurement and 

purchasing activities and provide training 

to the appropriate staff. 

August 2004 

In progress Refer to progress and remaining action described in Recommendation 

12. 

15. Assess the procurement workload 

to identify the current backlog of 

procurement transactions and identify 

any additional staffing needed to 

address the backlog and projected future 

procurement activity. 

August 2004 

Completed Progress 

USCP efforts have collectively addressed the procurement backlog and 

provided a framework for meeting future activity. These efforts include 

• adoption of a team approach involving assignment of procurement staff 

to work with specific bureaus in March 2006 to improve operations and 

better manage the overall procurement workload, 

Page 27 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

 • restructuring of procurement staff among bureaus in March 2007 to 

more evenly balance procurement staff workload, and 

• routine use of procurement-related status and activity reports to 

monitor workload such as outstanding requisitions and requisitions 

received each month. 

As of December 2007 and January 2008, USCP had 58 and 110 

outstanding requisitions, respectively. This increase, according to an

OFM procurement official, was expected due to increased procurement 

activity related to USCP’s receipt of USCP’s fiscal year 2008 annual 

appropriations. Also, according to reports used to monitor procurement 

workload, at least 97 percent of outstanding requisitions as of January 2, 

2008, were initiated since October 1, 2007, indicating USCP’s ability to 

process procurement activity on a timely basis. 

16. Systematically monitor the 

purchase card program to identify 

potential fraudulent, improper, and 

abusive uses of the purchase cards, as 

well as any patterns of improper 

cardholder transactions. 

August 2004 

Completed Progress 

USCP has implemented actions to monitor the use of purchase cards that

fulfills this recommendation: 

• In our February 2005 report, GAO noted that OFM established 

monitoring activities to reduce the risk of fraudulent purchase card 

transactions including training sessions, reviews of buying logs, 

surprise reviews of files supporting transactions, and the use of a 

consultant to review credit card history of each purchase card holder. 

• During our current review, we confirmed that USCP continued to 

monitor purchase card activity in 2007 through the use of buying logs 

and surprise reviews. 

• USCP requires purchase card holders to take applicable training to 

help ensure compliance with policies and procedures. 

In addition, an external contractor hired to review key financial internal 

control activities reported no findings based on its review of process flows 

and tests of key controls related to purchase cards. 

17. Continue to assess the risks 

associated with the management of all 

credit card programs, including fleet and 

travel, and take appropriate action where 

necessary to strengthen controls and to 

minimize the risks of fraudulent, 

improper, and abusive credit card 

transactions. 

August 2004 

In progress Progress 

As noted in Recommendations 12 and 16, USCP has continued to 

provide training and additional guidance associated with the management 

of its credit card programs. 

USCP has also implemented various actions to strengthen controls 

related to the use of travel cards. For example 

• OFM staff review quarterly reports noting unusual or questionable 

activity based on numerous predefined parameters, 

Page 28 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

• bureau Commanders or office Directors are notified of questionable 

travel card transactions and corrective action is taken, as necessary, 

and 

• according to OFM officials, staff responsible for monitoring travel card 

activities coordinates with staff that process travel vouchers to 

minimize specifically identified risks associated with individual travel

card holders. 

Additional controls implemented by USCP related to fleet cards include 

the following: 

• OFM staff scans monthly reports of detailed fleet card transactions for 

unusual or questionable activity. Activity is organized on these reports 

by card holder enabling OFM staff to more easily identify unusually 

high usage. 

• Fleet card holders must input specific personal identification numbers 

and odometer readings to obtain authorization for each fleet card 

transaction. 

Although several activities have been established to strengthen controls 

over the use of purchase cards, detailed policies and procedures for 

performing these reviews have not been formalized. In addition, USCP 

continues to have deficiencies related to the use of credit cards. For 

example, USCP policy requires the monthly reconciliation of travel cards 

maintained in the Accounting Section safe. However, we noted that as of 

February 2008, only one reconciliation had been completed and certified 

since June 2007. OFM officials also stated that questionable activity was 

noted during the last quarter of 2007 requiring additional follow-up. 

Remaining actions

• Complete detailed procedures for performing reviews of fleet card 

transactions. 

• Complete comprehensive purchase card policy. 

• Continue efforts to provide training and other guidance to address 

issues identified in the audit report and through internal reviews to 

monitor consistent application of policies and procedures (see 

recommendation 12). 

• Consider the results of the external contractor’s assessment of internal 

controls related to all credit card programs reviewed and implement 

additional controls as appropriate (see recommendation 3). 

18. Continue efforts to finalize detailed 

policies, procedures, and internal 

controls covering USCP’s procurement 

and purchasing activities, and 

adequately train staff to reduce risk in 

the procurement area. 

February 2005

In progress Progress 

Refer to Recommendation 12 describing progress and actions related to 

developing, finalizing, and implementing policies and procedures and 

training. See also Recommendations 14 and 17 for progress and 

remaining actions related to implementing internal controls related to 

procurement and purchasing activities associated with USCP’s credit card 

programs. 

Page 29 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

19. Evaluate the process for 

procurements that require multiple 

actions, approvals from higher levels, 

and additional follow-up, to determine 

what additional resources are needed to 

efficiently complete the procurement 

request and to reduce the procurement 

workload. 

February 2005

Completed Progress 

USCP efforts have collectively addressed the procurement backlog and 

provided a framework for meeting future activity. USCP has fulfilled this 

recommendation. 

For additional information on progress made refer to Recommendation 

15. 

20. Continue to implement proper

internal control, such as monitoring, over 

all credit card programs to minimize the 

risks of fraudulent, improper, and 

abusive credit card transactions. 

February 2005

In progress Progress 

USCP has continued to provide training and additional guidance 

associated with the management of its credit card programs. 

For additional information on progress made and remaining actions, refer 

to those described in Recommendation 17. 

21. Monitor the effectiveness of 

recently implemented reporting 

requirements and procedures 

established to improve accountability 

over large-dollar contracts. 

February 2005

In progress Progress 

USCP has implemented the following steps to improve accountability over 

large dollar contracts: 

• the creation of contract and interagency agreement listings which, 

according to OFM officials, include all active contracts and interagency 

agreements; 

• the implementation of dedicated teams to provide support to internal 

customers on procurement issues; and 

• the implementation of policy related to monitoring contractor

performance and the role of Contracting Officer Representatives 

(COR). 

Despite these efforts, USCP continues to experience challenges with

monitoring large-dollar contracts, especially related to monitoring 

contractor invoice submissions. For example, according to an OFM

official, a contractor did not submit invoices for several months and USCP

underestimated the amount of outstanding invoices at year-end, which 

resulted in a 15 percent overrun of expenditures on this contract and the 

need to reprogram unobligated fiscal year 2007 funds to satisfy $115,000 

in expenditures. 

Remaining action 

Clarify responsibilities for monitoring activities related to contract invoice 

submissions and expenditures and implement appropriate measures to 

ensure accountability and timely and thorough performance of required 

monitoring activities. 

22. Finalize detailed policies, 

procedures, and internal controls 

covering USCP’s procurement and 

purchase activities, and adequately train 

staff to reduce risk in the procurement 

area. 

November 2005

In progress Progress 

USCP has made significant improvements in addressing its detailed 

policies and procedures covering its procurement activities and has 

provided training to applicable staff. 

For additional information on progress made and remaining actions, refer 

to those described in Recommendation 12. 

Page 30 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

23. Evaluate alternatives for contract 

administration over large-dollar contracts 

to determine which would be cost 

beneficial and effective to help ensure 

that contract requirements are met and 

deliverables are received. 

November 2005

In progress Progress 

USCP has implemented steps to improve accountability and contract 

administration over large-dollar contracts. However, additional procedures

are needed. 

For additional information on progress made and remaining actions, refer 

to those described in Recommendation 21. 

Human Capital Management 

1. Chief of Police should direct the Chief 

Administrative Officer (CAO) and the 

Director of Human Resources to 

implement a workforce planning 

process that clearly establishes and 

assigns roles and responsibilities to 

link planning of resource requirements 

to the USCP strategic plan and

achieve operating efficiencies.

February 2005

In progress Progress 

USCP has made progress by gathering input from USCP’s leaders and 

managers on the human capital goals and challenges facing the 

organization. Leading organizations developing workforce planning 

strategies have involved their employees and other stakeholders in 

identifying ways to streamline processes and improve human capital

strategies. USCP has taken initial steps by surveying through e-mail all 

sworn employees from the rank of Lieutenant and higher, and higher-level 

civilian employees, seeking their opinions regarding USCP’s most 

significant human capital challenges and goals. USCP officials view this 

survey as the first of several steps to gather information from its 

workforce to refine the strategic direction of its workforce planning. 

Remaining actions

USCP needs to continue with its process of gathering input from not only 

its leadership and managers, but from its other employees and employee 

union. By involving the entire workforce, USCP will help ensure that the 

entire organization understands the need for and benefits of changes 

described in the strategic workforce plan, allowing USCP to develop clear 

and transparent policies and procedures to implement the plan’s human 

capital strategies. In addition, USCP will need to take steps to involve its 

stakeholders in this process of gathering input and seeking an

understanding of the plan’s human capital strategies. 

2. Chief of Police direct the Director of 

Human Resources to develop and 

implement a USCP strategic workforce 

planning process that includes: Building 

capabilities to address administrative, 

education, and other requirements 

important to support workforce

strategies. 

January 2004 

In progress Progress 

USCP is making progress through drafting appropriate human capital

policies, a strategic workforce plan, and a master training plan. We

reported in our January 2004 report that USCP needs to make updating 

its leave policy a high priority because previous guidance on the use of 

leave was fragmented among a number of documents and needed to be

integrated to provide greater consistency. In addition, we recommended 

USCP develop and implement a strategic workforce planning process that 

included strategies for hiring and training staff to address workforce gaps

and sustain the needed critical skills and competencies. As part of this 

plan, USCP should identify currently available human capital flexibilities—

polices and practices that an agency has the authority to implement in 

managing its workforce. These flexibilities can include policies and 

practices such as alternative work schedules, monetary recruitment and 

retention incentives, and special hiring authorities. Since our 2004 report, 

USCP’s Office of Human Resources (OHR) has revised its leave policy,

Page 31 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

which is currently under internal review. In addition, OHR has made 

progress by creating an initial draft of its strategic workforce plan. USCP’s 

Training Services Bureau (TSB) has initiated a four-phased process for 

developing a master training plan. TSB has completed its first phase by 

producing a training catalog containing all training courses available to 

USCP staff through TSB as well as through 15 other training providers 

and facilities, such as the Federal Law Enforcement Training Center 

operated by the Department of Homeland Security in Glynco, Georgia. 

TSB officials are currently in the second phase of this process in which 

they are collaborating with the OHR to validate the competencies of 

USCP’s sworn and civilian positions to ensure that the training provided 

addresses the competencies required for staff to perform their duties. 

Remaining actions

USCP officials need to continue with developing, finalizing, and 

implementing appropriate human capital policies, their strategic workforce 

plan, and master training plan. USCP officials should use the 

development of the strategic workforce plan as an opportunity to identify 

available and new human capital flexibilities for managing its workforce 

and accomplishing its mission and goals. Furthermore, USCP will need to 

ensure that using any human capital flexibilities is part of an overall 

human capital strategy as well as ensure that stakeholder input is 

considered as part of the process for developing any flexibilities-related 

policies and procedures. 

3. Chief of Police direct the Director of 

Human Resources to develop and 

implement a USCP strategic workforce 

planning process that includes: Defines 

organizational roles for establishing a 

more integrated approach to civilian 

training. 

January 2004 

In progress Progress 

USCP has been making progress by completing its review and revision of 

all USCP’s civilian position descriptions. Through this process, USCP’s 

OHR has identified the appropriate competencies associated with each 

civilian position description, which will enable OHR and USCP’s TSB to 

identify the appropriate training curriculum addressing the competencies 

of these positions. In addition, USCP has established a departmentwide

14-member training working group to discuss and begin addressing 

training issues throughout the department. 

Remaining actions

USCP’s revision of its civilian position descriptions is an important first 

step in adopting a more strategic approach to training its civilian 

employees. In addition, civilian training issues should be addressed as 

part of TSB’s master training plan. Without a more strategic approach, 

USCP cannot ensure optimum use of its training funds. 

4. Chief of Police direct the Director of 

Human Resources to develop and 

implement a USCP strategic workforce 

planning process that includes: 

Determining critical skills and 

competencies that are needed to 

achieve future programmatic results. 

January 2004 

In progress Progress 

USCP has been making progress on this recommendation through its 

review and revision of all USCP’s civilian position descriptions. To

complete this process, USCP’s OHR held focus groups with supervisors 

of USCP’s civilian staff to identify the appropriate competencies and 

critical skills associated with each position description. OHR revised these 

position descriptions based on this input. Furthermore, OHR has entered 

these civilian position descriptions into an automated human resource 

management system (supported by AVUE Technologies Corporation), 

which can be a useful tool for identifying skill gaps within the department 

as well as for identifying the training needs of employees.

Page 32 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

 Remaining actions

Having completed a revision of all the civilian position descriptions, USCP 

will need to complete a similar process for its sworn staff, which OHR 

officials have reportedly begun. As USCP continues this process, OHR 

officials should ensure that the critical skills and competencies of the 

sworn position descriptions are aligned with USCP’s strategic goals, as 

they have done with the civilian position descriptions. 

5. Chief of Police direct the Director of 

Human Resources to develop and 

implement a USCP strategic workforce 

planning process that includes: Devising 

strategies (e.g., hiring, outsourcing, or 

training) to address gaps in the number, 

deployment, and alignment of human 

capital resources to enable and sustain 

the contributions of critical skills and 

competencies.

January 2004 

In progress Progress 

USCP is making progress through its development of a draft strategic 

workforce plan and the establishment of a process for developing a 

master training plan. Our March 2002 strategic human capital model 

stressed the importance of agencies developing human capital 

strategies—the programs, policies, and processes that agencies use to 

hire and train staff; develop succession plans; administer a performance 

management system; and use human capital flexibilities. In addition, we 

found that agencies need to consider how these strategies can eliminate 

skill gaps within their current workforces and to plan for acquiring skills 

needed in the future to achieve the agencies’ mission and goals. USCP’s 

draft strategic workforce plan is a significant first step in addressing this 

recommendation by listing specific actions needed to develop these 

human capital strategies. Additionally, USCP officials reported that they 

plan to include within the master training plan an examination of the 

possible professional development courses for various positions as well 

as an organizationwide succession plan to ensure the continuity of 

USCP’s leadership. 

A recent development in establishing a human capital strategy is the 

OHR’s implementation of an “Officer Voluntary Reassignment Program.” 

Through accessing OHR’s automated resource management system 

(supported by AVUE Technologies Corporation), sworn personnel can 

request reassignments from their current unit to another USCP unit, 

within the constraints of the organization’s needs and staff seniority.

Page 33 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

 Remaining actions

USCP officials need to continue developing their strategic workforce plan 

and master training plan. In particular, the strategic workforce plan will 

need to be further refined. Although it contains an appendix listing action 

items for implementing human capital strategies, these action items lack 

sufficient details on specific steps needed to establish potential human 

capital strategies. TSB will need to continue its four-phase process to 

develop the master training. Currently, TSB is in the second phase of this 

process—validating the competencies of USCP’s position descriptions— 

a process that will require further collaboration with USCP’s OHR. Upon 

completion of this phase, TSB officials, working with OHR and other 

stakeholders, plan to then identify appropriate professional development 

and training curriculum for all USCP staff based on the set of validated 

competencies. Finally, to complete the master training plan, TSB officials 

plan to develop specific training strategies and procedures, such as 

identifying future training needs. 

Once these plans have been developed, USCP leadership will be in a 

position to better communicate—to all its employees—the specific 

strategies being implemented. To further implement this recommendation, 

USCP leaders should consider developing a communication strategy 

when issuing these plans to create a shared set for expectations among 

staff and promote transparency during the implementation of these 

human capital strategies. 

6. Chief of Police direct the Director of 

Human Resources to develop and 

implement a USCP strategic workforce 

planning process that includes: Involving 

top management and employees in 

developing, communicating, and 

implementing a strategic workforce plan. 

January 2004 

In progress Progress 

USCP has taken the initial steps to address this recommendation by 

surveying via e-mail all high-ranking sworn officers and all higher-level

civilian employees seeking their opinions on USCP’s most significant 

human capital challenges and goals. An official from USCP’s Office of 

Human Resources (OHR) explained that this survey is the first of several 

steps to gather information from its workforce in order to refine the 

direction of its workforce planning. OHR has also taken the initiative to 

discuss the need for a strategic workforce planning process with USCP’s 

senior management team, which consists of middle-level managers from 

management offices as well as captains within the operational bureaus. 

Recently established by USCP, the senior management team meets on a 

monthly basis to discuss various management and operational issues. 

Remaining actions

USCP officials will need to continue seeking ways to involve top 

management and employees in the development, communication, and 

implementation of the strategic workforce plan. Our work reviewing the 

experience of leading organizations has shown that top management that 

is personally involved in the strategic workforce planning process can 

provide an organizational vision that is important in times of change; can 

help provide stability as the workforce plan is being developed and 

implemented; and help ensure that human capital strategies are 

thoroughly implemented and sustained over time. 

Page 34 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

7. Chief of Police direct the Director of 

Human Resources to develop and 

implement a USCP strategic workforce 

planning process that includes: 

Monitoring and evaluating progress 

toward the organization’s human capital 

goals and the contribution that human 

capital results have made toward 

achieving programmatic goals. 

January 2004 

No progress Remaining actions

Because the strategic workforce plan is still being developed, USCP 

officials acknowledged that it is still too early to evaluate the progress of 

its planned human capital strategies. In the future, it will be important for 

USCP to measure both the outcomes of its human capital strategies and 

how these outcomes have helped USCP accomplish its mission and 

strategic goals. Periodic measurement of an agency’s progress towards 

its human capital goals and the extent that human capital strategies 

contribute to achieving agency goals provides information for effective 

oversight by identifying performance shortfalls and appropriate corrective 

actions. 

8. Chief of Police make completing the 

strategic workforce plan a priority for 

USCP and be involved in developing, 

communicating, and implementing the 

workforce plan. In this regard, the 

workforce analyses assigned to the OHR 

workforce planner should be evaluated 

to help ensure that progress on the 

strategic workforce plan can also go

forward. As we recommended in our 

February 2005 report, the Chief should 

direct the CAO and the Director of OHR 

to implement a workforce planning 

process that clearly establishes and 

assigns roles and responsibilities to link 

planning of resource requirements to the 

USCP strategic plan. 

November 2005

In progress Progress 

USCP has addressed a portion of this recommendation by ensuring that 

the Office of Human Resources’ (OHR) strategic workforce planner is 

assigned primarily to the development of the strategic workforce plan 

rather than performing other workforce analyses. By focusing his effort on

the workforce plan, OHR’s strategic workforce planner has made 

significant progress by creating an initial draft of the strategic workforce 

plan. 

Remaining actions

While USCP has made some progress on this recommendation, a 

substantial amount of work is still required to develop and implement the 

strategic workforce plan. Although the plan contains useful background 

material and demographics of USCP workforce, it lacks sufficient details 

on how USCP will establish its potential human capital strategies. 

Page 35 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

9. Human Capital, Civilian Hiring. In 

addition, to provide increased assurance 

that USCP is consistently implementing 

clear, up-to-date policies and procedures 

for civilian hiring and a strategic 

approach for training civilian employees, 

we recommend that the Chief of Police 

monitor the development and

implementation of USCP’s civilian 

handbook and its analysis of the 

competencies that employees will need 

to meet its performance goals. 

August 2004 

Completed Progress 

In October 2007, USCP implemented this recommendation by issuing its 

Employment and Promotion Policy Plan. In our August 2004 report, we 

determined that both USCP’s SOP that discusses the roles and 

responsibilities of managers in the civilian hiring process and the 

supplemental memorandum outlining information to be reviewed before 

making a job offer to applicants were out-of-date and not consistently 

implemented by USCP officials. We concluded that USCP needed to 

adopt clear, up-to-date policies and procedures for its civilian hiring 

process. To address this recommendation, USCP’s OHR developed and 

issued a plan that provides a standardized hiring process for both sworn 

and civilian positions within USCP. In addition to including a description of 

the department’s hiring process, the plan outlines the responsibilities that 

managers and selecting officials have in the hiring process, such as 

determining whether vacant positions still need to be filled and consulting 

with OHR officials on any changes in the position’s duties, 

responsibilities, or organizational placement. This plan was approved by 

USCP’s Chief of Police and applies to all personnel actions related to 

filling USCP positions. Furthermore, OHR officials have reviewed and 

revised all the department’s civilian position descriptions, which include 

the applicable competencies for these positions. By using these position 

descriptions as part of the hiring process, USCP will be able to identify, 

recruit, and hire individuals based on whether the applicant has the 

requisite competencies for the position. 

Information Technology

1. Manage development, maintenance, 

and implementation of USCP’s

enterprise architecture (EA) in

accordance with relevant guidance. 

January 2004 

In progress Progress 

USCP has made limited progress in managing, developing, maintaining, 

and implementing its enterprise architecture since March 2007. According 

to agency officials, USCP has completed additional content to enhance its 

existing architecture products. 

Remaining action 

USCP has not yet instituted several important architecture management 

practices. For example, it has yet to establish a committee to guide, 

direct, and approve the architecture. In addition, USCP has not yet fully 

developed and implemented architecture products or implemented an

independent verification and validation function. It also has not measured 

and reported architecture product quality. Furthermore, the agency still 

needs to ensure the sufficiency of the staff resources it applies to 

developing, maintaining, and implementing its architecture.

Page 36 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

2. Ensure that EA products are sufficiently 

complete to include (1) the business 

operation description to address the 

business strategy and business rules 

governing how agency strategic goals 

and objectives will be achieved, 

including a description of key business 

processes and how they are to support 

the agency’s mission, and identify 

opportunities to re-engineer, unify, and 

simplify systems and processes across 

the agency; 

(2) the technology architecture

description identifying the physical 

components of the IT infrastructure and 

the policies, procedures, and processes 

for, among other things, system

development, acquisition, and 

integration activities, and (3) all 

descriptions addressing how security will 

be achieved. 

January 2004 

In progress Progress 

USCP developed architecture products, including a business operation 

description and a technology architecture description. However, these 

descriptions do not address how security will be achieved. Further, the 

agency has taken steps to ensure that it has sufficient staff resources to 

maintain and support its architecture program. Thus, USCP has identified 

the need for two full-time architecture staff and has requested funding for 

these positions in its fiscal year 2009 budget request. 

Remaining action 

USCP needs to include information on how security will be achieved in its 

architecture descriptions. Additionally, the agency needs to ensure the 

sufficiency of the staff resources it applies to maintaining and 

implementing its architecture. 

3. Ensure that the modernization program 

management plan (or transition plan) 

includes a governance and control 

structure for aligning the organization’s 

business transformation with systems 

modernization, including a schedule that 

shows legacy system replacement and 

resource needs for accomplishing this 

replacement. 

January 2004 

In progress Progress 

In September 2006, USCP updated its transition plan as part of the most 

recent version of the agency’s enterprise architecture. Although the 

transition plan includes references to the architecture governance and 

control policies and included a legacy systems replacement schedule, 

agency officials stated that this schedule needs to be updated. 

Remaining action 

USCP needs to revise its enterprise architecture transition plan to include

a current schedule for legacy systems replacement and the resource 

needs for accomplishing this replacement. 

4. Manage IT investments in accordance 

with relevant guidance, to include 

defining and implementing (1) policies 

and procedures for measuring IT project 

progress, (2) a process for Investment 

Review Board (IRB) oversight of 

implemented IT projects, and (3) a 

process for collecting and maintaining 

information in its catalog of IT systems 

and using that information to make 

investment decisions. 

January 2004 

In progress Progress 

The agency has developed an IT Capital Planning and Investment 

Control Guide that includes policies and processes for measuring IT

project progress, IRB oversight of ongoing projects, and maintaining 

information on IT systems for use in making investment decisions. In 

addition, USCP’s investment management approach includes top 

management involvement in the review, approval, and monitoring of IT

investments. 

Remaining action 

USCP’s investment management approach largely focuses on the 

selection of investments, but does not address the control and evaluation 

of investments. According to agency officials, USCP plans to enhance the 

current process with respect to the control and evaluation of investments. 

Page 37 GAO-08-540T 
GAO recommendation and 

date of recommendation Status Progress and remaining action

5. Limit future IT investments to small, lowrisk projects until the appropriate 

controls have been implemented. 

January 2004 

Completed Progress 

Following our recommendation, USCP limited its IT investments to small, 

low-risk projects until it had established its IT Capital Planning and 

Investment Control Guide.

6. Ensure that the members of USCP’s IRB 

are adequately trained on how to carry 

out the IRB’s IT investment 

responsibilities. 

January 2004 

Completed Progress 

USCP has conducted training for its IRB members on how to carry out its 

investment management responsibilities. 

7. Develop and implement an appropriate 

set of system acquisition policies and 

procedures, based on relevant Software 

Engineering Institute (SEI) guidance, 

that at a minimum 

(1) addresses relevant key processes 

and practices identified in SEI guidance, 

including acquisition planning, 

solicitation, and transition to support; (2) 

ensures that reliable project cost 

estimates are prepared; and (3) 

addresses how to handle questions from 

potential bidders. 

January 2004 

Completed Progress 

USCP has developed and implemented system acquisition policies and 

procedures that address best practice guidance, require cost estimate 

development, and address how to handle questions from potential 

bidders. Further, the agency has taken steps to ensure that system 

acquisitions are conducted in accordance with these policies and 

procedures. For example, USCP developed a project management plan, 

developed requirements, and monitored project costs for its Case 

Management System acquisition as prescribed by the agency’s policies 

and procedures. 

8. Ensure that adequate resources to 

implement planned and ongoing 

information security activities and 

continuity of operations planning efforts 

are provided. 

August 2004 

In progress Progress 

USCP has continued to implement planned and ongoing activities related

to information security and continuity of operations. For example, the 

agency has implemented information security program activities such as 

the certification and accreditation of major IT systems. In addition, its 

2008 continuity of operations plan was reviewed and adopted by the 

Chief of Police. Further, USCP officials have asserted that the agency 

lacks adequate staff resources to address all the information security 

activities it has identified and to effectively maintain the agency’s 

information security program. Accordingly, the agency has identified the 

need for two full-time information security staff in its fiscal year 2009 

budget request.

Remaining action 

The agency needs to ensure the sufficiency of the staff resources it 

applies to implementing planned and ongoing IT security activities such

as ensuring data integrity and maintaining continuity of operations. 

9. Assess USCP’s near-term exposure to 

the risk posed by not having a continuity 

of operations plan for all essential 

administrative functions, and take 

appropriate steps to mitigate this risk. 

August 2004 

Completed Progress 

USCP assessed the risks posed by not having a continuity of operations 

plan in 2005. The agency has since developed such a plan and, in doing 

so, has mitigated the risks posed by not having one. 

a

OMB Circular No. A-123, Management’s Responsibilities for Internal Control (revised Dec.

2004).

Page 38 GAO-08-540T 
Page 39 GAO-08-540T 

Appendix II: GAO Contact and Staff 

Acknowledgments 

Richard M. Stana, (202) 512-8777 or stanar@gao.gov 

Individuals making key contributions to this statement were Bernice 

Steinhardt, Director; Valerie Melvin, Director; Kay Daly, Acting Director; 

Bill Crocker, Assistant Director; Elizabeth Martinez, Assistant Director; 

Mark Bird, Assistant Director; Steven Lozano, Assistant Director; John 

Mortin, Assistant Director; Josh A. Diosomito; Heather Dunahoo; James 

Kernen; Teresa M. Neven; Kenrick Isaac; Lerone Reid; Katherine Davis; 

Geoffrey Hamilton; Jacquelyn Hamilton; Franklin Jackson; and Mike 

Volpe. 

GAO Contact 

Acknowledgments 

(440682) 
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 

Page 40 GAO-08-540T 
GAO’s Mission The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “E-mail Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, DC 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, DC 20548 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Mail or Phone 

To Report Fraud,

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER