HIGH-RISK SERIES

Progress on Many 

High-Risk Areas, 

While Substantial 

Efforts Needed on 

Others

Report to Congressional Committees

February 2017

GAO-17-317

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-17-317, a report to 

congressional committees

February 2017

HIGH-RISK SERIES

Progress on Many High-Risk Areas, While Substantial 

Efforts Needed on Others

What GAO Found

Since GAO’s last high-risk update, many of the 32 high-risk areas on the 2015 

list have shown solid progress. Twenty-three high-risk areas, or two-thirds of all 

the areas, have met or partially met all five criteria for removal from the HighRisk List; 15 of these areas fully met at least one criterion. Progress has been 

possible through the concerted efforts of Congress and leadership and staff in 

agencies. For example, Congress enacted over a dozen laws since GAO’s last 

report in February 2015 to help address high-risk issues.

GAO removed 1 high-risk area on managing terrorism-related information, 

because significant progress had been made to strengthen how intelligence on 

terrorism, homeland security, and law enforcement is shared among federal, 

state, local, tribal, international, and private sector partners. Sufficient progress 

was made to remove segments of 2 areas related to supply chain management 

at the Department of Defense (DOD) and gaps in geostationary weather satellite 

data. 

Two high-risk areas expanded—DOD’s polar-orbiting weather satellites and the 

Department of the Interior’s restructuring of offshore oil and gas oversight. 

Several other areas need substantive attention including VA health care, DOD 

financial management, ensuring the security of federal information systems and 

cyber critical infrastructure, resolving the federal role in housing finance, and 

improving the management of IT acquisitions and operations.

GAO is adding 3 areas to the High-Risk List, bringing the total to 34:

• Management of Federal Programs That Serve Tribes and Their 

Members. GAO has reported that federal agencies, including the 

Department of the Interior’s Bureaus of Indian Education and Indian Affairs 

and the Department of Health and Human Services’ Indian Health Service, 

have ineffectively administered Indian education and health care programs 

and inefficiently developed Indian energy resources. Thirty-nine of 41 GAO 

recommendations on this issue remain unimplemented.

• U.S. Government's Environmental Liabilities. In fiscal year 2016 this 

liability was estimated at $447 billion (up from $212 billion in 1997). The 

Department of Energy is responsible for 83 percent of these liabilities and 

DOD for 14 percent. Agencies spend billions each year on environmental 

cleanup efforts but the estimated environmental liability continues to rise. 

Since 1994, GAO has made at least 28 recommendations related to this 

area; 13 are unimplemented.

• The 2020 Decennial Census. The cost of the census has been escalating 

over the last several decennials; the 2010 Census was the costliest U.S.

Census in history at about $12.3 billion, about 31 percent more than the 

2000 Census (in 2020 dollars). The U.S. Census Bureau (Bureau) plans to 

implement several innovations—including IT systems—for the 2020 

Census. Successfully implementing these innovations, along with other 

challenges, risk the Bureau’s ability to conduct a cost-effective census. 

Since 2014, GAO has made 30 recommendations related to this area; 

however, only 6 have been fully implemented. 

View GAO-17-317. For more information, 

contact J. Christopher Mihm at (202) 512-6806 

or mihmj@gao.gov.

Why GAO Did This Study

The federal government is one of the 

world’s largest and most complex 

entities: about $3.9 trillion in outlays in 

fiscal year 2016 funded a broad array 

of programs and operations. GAO’s 

high-risk program identifies 

government operations with greater 

vulnerabilities to fraud, waste, abuse, 

and mismanagement or the need for 

transformation to address economy, 

efficiency, or effectiveness challenges.

This biennial update describes the 

status of high-risk areas listed in 2015 

and actions that are still needed to 

assure further progress, and identifies 

new high-risk areas needing attention 

by Congress and the executive branch. 

Solutions to high-risk problems 

potentially save billions of dollars, 

improve service to the public, and 

strengthen government performance 

and accountability.

GAO uses five criteria to assess 

progress in addressing high-risk areas: 

(1) leadership commitment, (2) agency 

capacity, (3) an action plan, (4) 

monitoring efforts, and (5) 

demonstrated progress.

What GAO Recommends

This report contains GAO’s views on 

progress made and what remains to be 

done to bring about lasting solutions 

for each high-risk area. Perseverance 

by the executive branch in 

implementing GAO’s recommended 

solutions and continued oversight and 

action by Congress are essential to 

achieving greater progress.
GAO’s 2017 High-Risk List

Strengthening the Foundation for Efficiency and Effectiveness 

• Strategic Human Capital Managementa

• Managing Federal Real Property 

• Funding the Nation’s Surface Transportation Systema 

• Modernizing the U.S. Financial Regulatory System and the Federal Role in 

Housing Financea 

• Restructuring the U.S. Postal Service to Achieve Sustainable Financial 

Viabilitya 

• Management of Federal Oil and Gas Resources 

• Limiting the Federal Government’s Fiscal Exposure by Better Managing 

Climate Change Risks 

• Improving the Management of IT Acquisitions and Operations

• Improving Federal Programs that Serve Tribes and their Members (new)a

• 2020 Decennial Census (new)

• U.S. Government Environmental Liabilities (new) a

Transforming DOD Program Management 

• DOD Supply Chain Management 

• DOD Weapon Systems Acquisition

• DOD Financial Management 

• DOD Business Systems Modernization 

• DOD Support Infrastructure Managementa 

• DOD Approach to Business Transformation 

Ensuring Public Safety and Security 

• Ensuring the Security of Federal Information Systems and Cyber Critical 

Infrastructure and Protecting the Privacy of Personally Identifiable 

Informationa 

• Strengthening Department of Homeland Security Management Functions 

• Ensuring the Effective Protection of Technologies Critical to U.S. National 

Security Interestsa 

• Improving Federal Oversight of Food Safetya 

• Protecting Public Health through Enhanced Oversight of Medical Products 

• Transforming EPA’s Processes for Assessing and Controlling Toxic 

Chemicals

• Mitigating Gaps in Weather Satellite Data 

Managing Federal Contracting More Effectively 

• DOE’s Contract Management for the National Nuclear Security 

Administration and Office of Environmental Management 

• NASA Acquisition Management

• DOD Contract Managementa

Assessing the Efficiency and Effectiveness of Tax Law Administration 

• Enforcement of Tax Lawsa

Modernizing and Safeguarding Insurance and Benefit Programs 

• Medicare Programa 

• Medicaid Programa 

• Improving and Modernizing Federal Disability Programs

• Pension Benefit Guaranty Corporation Insurance Programsa 

• National Flood Insurance Programa 

• Managing Risks and Improving VA Health Carea

Source: GAO. | GAO-17-317

a

Legislation is likely to be necessary in order to effectively address this area.
Page i GAO-17-317 High-Risk Series

Letter 1

High-Risk Areas Making Progress 2

High-Risk Areas Highlighted for Significant Attention 19

New High-Risk Areas 31

Monitoring Previous High-Risk Areas 45

Appendix I Background 51

Appendix II Overview for Each High-Risk Area 60

Strategic Human Capital Management 61

Managing Federal Real Property 77

Funding the Nation’s Surface Transportation System 99

Modernizing the U.S. Financial Regulatory System and the 

Federal Role in Housing Finance 107

Restructuring the U.S. Postal Service to Achieve Sustainable 

Financial Viability 130

Management of Federal Oil and Gas Resources 136

Limiting the Federal Government’s Fiscal Exposure by Better 

Managing Climate Change Risks 150

Improving the Management of IT Acquisitions and Operations 180

Improving Federal Management of Programs that Serve Tribes 

and Their Members 200

2020 Decennial Census 220

U.S. Government’s Environmental Liability 232

DOD Supply Chain Management 248

DOD Weapon Systems Acquisition 269

DOD Financial Management 280

DOD Business Systems Modernization 297

DOD Support Infrastructure Management 311

DOD Approach to Business Transformation 327

Ensuring the Security of Federal Information Systems and Cyber 

Critical Infrastructure and Protecting the Privacy of Personally 

Identifiable Information 338

Strengthening Department of Homeland Security Management 

Functions 354

Ensuring the Effective Protection of Technologies Critical to U.S. 

National Security Interests 376

Improving Federal Oversight of Food Safety 389

Contents
Page ii GAO-17-317 High-Risk Series

Protecting Public Health through Enhanced Oversight of Medical 

Products 400

Transforming EPA’s Process for Assessing and Controlling Toxic 

Chemicals 417

Mitigating Gaps in Weather Satellite Data 430

DOE’s Contract Management for the National Nuclear Security 

Administration and Office of Environmental Management 445

NASA Acquisition Management 470

DOD Contract Management 483

Enforcement of Tax Laws 500

Medicare Program 520

Medicare Improper Payments 547

Medicaid Program 560

Medicaid Improper Payments 579

Improving and Modernizing Federal Disability Programs 589

Pension Benefit Guaranty Corporation Insurance Programs 609

National Flood Insurance Program 619

Managing Risks and Improving VA Health Care 627

Establishing Effective Mechanisms for Sharing and Managing 

Terrorism-Related Information to Protect the Homeland 653

Appendix III GAO’s 2017 High-Risk List 674

GAO Related Products 676

Tables

Table 1: 2015 High-Risk Areas Rated Against Five Criteria for 

Removal from GAO’s High-Risk List 2

Table 2: Status of Action Items Required to Remove TerrorismRelated Information Sharing from GAO’s High-Risk List 8

Table 3: Changes to the High-Risk List, 1990-2017 51

Table 4: Year That Areas on GAO’s 2017 High-Risk List Were 

Designated High Risk 58

Table 5: Examples of Legacy Investments and Systems 187

Table 6: Status of GAO Recommendations to OMB and Agencies 

to Address Shortcomings in IT Acquisitions and 

Operations (Fiscal Years 2010 through 2015), as of 

December 2016 193
Page iii GAO-17-317 High-Risk Series

Table 7: GAO Assessment of DHS Progress in Addressing Key 

Outcomes 366

Table 8: Financial Savings from Fiscal Years (FY) 2013-2016: 

$4,570 million 616

Table 9: Status of GAO Recommendations Related to Department 

of Veterans Affairs (VA) Health Care from Calendar Year 

2010 through Calendar Year 2016 631

Table 10: GAO Recommendations Related to Department of 

Veterans Affairs (VA) Health Care from Calendar Year 

(CY) 2010 through CY 2016, by Area of Concern 632

Table 11: Status of Action Items Required to Remove TerrorismRelated Information Sharing from GAO’s High-Risk List 657

Table 12: Implementation Plan Priority Objectives Aligned with 

National Strategy for Information Sharing and 

Safeguarding Goals 666

Table 13: Descriptions of Completed Implementation Plan Priority 

Objectives and Examples of Demonstrated Progress 670

Table 14: Descriptions of Remaining Implementation Plan Priority 

Objectives, Examples of Demonstrated Progress, and 

What Remains to be Done 671

Table 15: GAO’s 2017 High-Risk List 674

Figures

Figure 1: Elements of the Information Sharing Environment 5

Figure 2: Total Reported U.S. Environmental Liability, Fiscal Year 

2016 38

Figure 3: DOE’s Office of Environmental Management’s Annual 

Spending and Growing Environmental Liability 39

Figure 4: Criteria for Removal from the High-Risk List and 

Examples of Actions Leading to Progress 54

Figure 5: High-Risk Progress Criteria Ratings 56

Figure 6: History of Areas Removed from the High-Risk List 57

Figure 7: Percentage of Career Permanent Employees, on Board 

as of September 30, 2015, Eligible to Retire by 2020 by 

Agency 74

Figure 8: Examples of Vacant Federal Buildings (the Cotton 

Annex, vacant General Services Administration 

warehouse, and a vacant building at St. Elizabeths) 79

Figure 9: Projected Cumulative Highway Trust Fund Balance, 

Fiscal Years 2021 through 2026 101
Page iv GAO-17-317 High-Risk Series

Figure 10: Comparison of Selected Investments’ April 2015 CIO 

Ratings to GAO’s Assessments 190

Figure 11: Comparison of Software Development Projects’ 

Percentage of Planned Delivery Every 6 Months 

Reported on the IT Dashboard and to GAO for Fiscal 

Year 2016 192

Figure 12: Summary of OMB’s and Agencies’ Progress in 

Addressing GAO’s Recommendations related to the 

Management of IT Acquisition and Operations, as of 

December 2016 194

Figure 13: Total Reported U.S. Environmental Liability, Fiscal 

Year 2016 236

Figure 14: Total Reported Department of Energy Environmental 

Liability, Fiscal Years 2000 to 2016 237

Figure 15: Department of Energy’s Office of Environmental 

Management’s Annual Spending and Growing 

Environmental Liability 238

Figure 16: Total Reported Department of Defense Environmental 

Liability, Fiscal Years 2000 to 2016 242

Figure 17: Change in Reported Environmental Liability for 

Selected Agencies, Fiscal Years 2000 to 2016 244

Figure 18: Comparison of the Cost Performance of DOD’s 2011-

2015 Portfolios 271

Figure 19: Growth Trends in Total Medicaid Spending by Eligibility 

Group 562

Figure 20: Medicaid Expenditures for Long-Term Services and 

Supports, Fiscal Years 1994-2014 574

Figure 21: PBGC’s Net Financial Position of the Single-Employer 

and Multiemployer Programs Combined – Net Position (in 

billions of dollars) 610

Figure 22: Elements of the Information Sharing Environment 654

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-17-317 High-Risk Series

441 G St. N.W. Comptroller General

Washington, DC 20548 of the United States

February 15, 2017

The Honorable Ron Johnson

Chairman

The Honorable Claire McCaskill

Ranking Member

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Jason Chaffetz

Chairman

The Honorable Elijah E. Cummings

Ranking Member

Committee on Oversight and Government Reform

House of Representatives

Since the early 1990s, our high-risk program has focused attention on 

government operations with greater vulnerabilities to fraud, waste, abuse, 

and mismanagement or that are in need of transformation to address 

economy, efficiency, or effectiveness challenges. This effort, supported 

by the Senate Committee on Homeland Security and Governmental 

Affairs and by the House of Representatives Committee on Oversight and 

Government Reform, has brought much-needed attention to problems 

impeding effective government and costing billions of dollars each year.

To help improve these high-risk operations, we have made hundreds of 

recommendations. Executive agencies either have addressed or are 

addressing many of them and, as a result, progress is being made in a 

number of areas. Congress also continues to take important actions. For 

example, Congress enacted over a dozen laws since our last report in 

February 2015 to help make progress on high-risk issues. Progress in 

high-risk areas over the past decade (fiscal year 2007 through fiscal year 

2016) resulted in financial benefits totaling approximately $240 billion or 

an average of about $24 billion per year.1

This report describes (1) progress made addressing high-risk areas and 

the reasons for that progress, and (2) actions that are still needed to 

 1

Financial benefits are based on actions taken in response to our work, such as reducing 

government expenditures, increasing revenues, or reallocating funds to other areas. 

Letter
Page 2 GAO-17-317 High-Risk Series

assure further progress. It also identifies three new high-risk areas, which 

include the management of federal programs that serve tribes and their 

members, the federal government’s environmental liabilities, and the 

2020 Census.

Since our last high-risk update, while progress has varied, many of the 32 

high-risk areas on our 2015 list have shown solid progress. One area 

related to sharing and managing terrorism-related information is now 

being removed from the list.

Agencies can show progress by addressing our five criteria for removal 

from the list: leadership commitment, capacity, action plan, monitoring, 

and demonstrated progress.2 As shown in table 1, 23 high-risk areas, or 

two-thirds of all the areas, have met or partially met all five criteria for 

removal from our High-Risk List; 15 of these areas fully met at least one 

criterion. Compared with our last assessment, 11 high-risk areas showed 

progress in one or more of the five criteria. Two areas declined since 

2015. These changes are indicated by the up and down arrows in table 1.

Table 1: 2015 High-Risk Areas Rated Against Five Criteria for Removal from GAO’s High-Risk List

( indicates one or more areas progressed;  indicates one or more areas declined since 2015.)

Number of criteria

High-risk area Change 

since 2015

Met Partially

met

Not met

Establishing Effective Mechanisms for Sharing and Managing Terrorism-Related 

Information to Protect the Homeland

 5 0 0

NASA Acquisition Management 3 2 0

Strengthening Department of Homeland Security Management Functions  3 2 0

Department of Defense (DOD) Supply Chain Management  3 2 0

Mitigating Gaps in Weather Satellite Data  3 2 0

Protecting Public Health through Enhanced Oversight of Medical Products  1 4 0

DOD Contract Management 1 4 0

DOD Weapon Systems Acquisition 1 4 0

Medicare Programa 1 4 0

Enforcement of Tax Laws  1 4 0

Managing Federal Real Property  1 4 0

 2

Additional detail on our high-risk criteria and ratings is in appendix I.

High-Risk Areas 

Making Progress
Page 3 GAO-17-317 High-Risk Series

Number of criteria

High-risk area Change 

since 2015

Met Partially

met

Not met

Transforming the Environmental Protection Agency’s (EPA) Processes for 

Assessing and Controlling Toxic Chemicals

 1 4 0

Improving the Management of IT Acquisitions and Operations 1 4 0

Ensuring the Security of Federal Information Systems and Cyber Critical 

Infrastructure and Protecting the Privacy of Personally Identifiable Information

1 4 0

DOD Approach to Business Transformation  1 4 0

Strategic Human Capital Management  1 3 1

DOE’s Contract Management for the National Nuclear Security Administration and 

Office of Environmental Management

 1 2 2

Management of Federal Oil and Gas Resources  0 5 0

DOD Support Infrastructure Management 0 5 0

Ensuring the Effective Protection of Technologies Critical to U.S. National Security 

Interests

0 5 0

Improving and Modernizing Federal Disability Programs 0 5 0

Modernizing the U.S. Financial Regulatory System and the Federal Role in Housing 

Finance

0 5 0

National Flood Insurance Program 0 5 0

Restructuring the U.S. Postal Service to Achieve Sustainable Financial Viability 0 5 0

Medicaid Programa 0 5 0

Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate 

Change Risks

 0 4 1

DOD Business Systems Modernization 0 4 1

DOD Financial Management 0 3 2

Improving Federal Oversight of Food Safety 0 3 2

Managing Risks and Improving VA Health Care 0 2 3

Funding the Nation’s Surface Transportation System N/A N/A N/A

Pension Benefit Guaranty Corporation Insurance Programs N/A N/A N/A

Legend: N/A = Not applicable.

Source: GAO. | GAO-17-317

Notes: Two high-risk areas received a “not applicable” rating because addressing them primarily 

involves congressional action (Funding the Nation’s Surface Transportation System and Pension 

Benefit Guaranty Corporation Insurance Programs).

a

Medicare and Medicaid programs only refer to the Improper Payments programs and we did not rate 

other elements of the Medicare and Medicaid programs.

Of the 11 high-risk areas showing progress between 2015 and 2017, 

sufficient progress was made in 1 area—Establishing Effective 

Mechanisms for Sharing and Managing Terrorism-Related Information to 

Protect the Homeland—to be removed from the list. In two other areas, 

High-Risk Areas Showing 

Progress
Page 4 GAO-17-317 High-Risk Series

enough progress was made that we removed a segment of the high-risk 

area—Mitigating Gaps in Weather Satellite Data and Department of 

Defense (DOD) Supply Chain Management. The other eight areas 

improved in at least one criterion rating by either moving from “not met” to 

“partially met” or from “partially met” to “met.”

We removed the area of Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information to Protect the Homeland 

from the High-Risk List because the Program Manager for the Information 

Sharing Environment (ISE) and key departments and agencies have 

made significant progress to strengthen how intelligence on terrorism, 

homeland security, and law enforcement, as well as other information 

(collectively referred to in this section as terrorism-related information), is 

shared among federal, state, local, tribal, international, and private-sector 

partners. As a result, the Program Manager and key stakeholders have 

met all five criteria for addressing our high-risk designation, and we are 

removing this issue from our High-Risk List. While this progress is 

commendable, it does not mean the government has eliminated all risk 

associated with sharing terrorism-related information. It remains 

imperative that the Program Manager and key departments and agencies 

continue their efforts to advance and sustain ISE. Continued oversight 

and attention is also warranted given the issue’s direct relevance to 

homeland security as well as the constant evolution of terrorist threats 

and changing technology.

The Program Manager, the individual responsible for planning, 

overseeing, and managing ISE, along with the key departments and 

agencies—the Departments of Homeland Security (DHS), Justice (DOJ), 

State (State), and Defense (DOD), and the Office of the Director of 

National Intelligence (ODNI)—are critical to implementing and sustaining 

ISE.3 Following the terrorist attacks of 2001, Congress and the executive 

branch took numerous actions aimed explicitly at establishing a range of 

new measures to strengthen the nation’s ability to identify, detect, and 

deter terrorism-related activities. For example, ISE was established in 

accordance with the Intelligence Reform and Terrorism Prevention Act of 

 3

The Office of the Program Manager for ISE is situated within and funded through 

amounts appropriated to ODNI. Additional departments and agencies also participate in 

ISE, including Air Force Intelligence, Surveillance, and Reconnaissance; Central 

Intelligence Agency; the Departments of Commerce, Energy, Health and Human Services, 

the Interior, Transportation, and the Treasury; National Counterterrorism Center; National 

Geospatial-Intelligence Agency; and National Reconnaissance Office.

One High-Risk Designation 

Removed
Page 5 GAO-17-317 High-Risk Series

2004 (Intelligence Reform Act) to facilitate the sharing of terrorism-related 

information.4 Figure 1 depicts the relationship between the various 

stakeholders and disciplines involved with the sharing and safeguarding 

of terrorism-related information through ISE.

Figure 1: Elements of the Information Sharing Environment 

The Program Manager and key departments and agencies met the 

leadership commitment and capacity criteria in 2015, and have 

subsequently sustained efforts in both these areas. For example, the 

Program Manager clearly articulated a vision for ISE that reflects the 

government’s terrorism-related information sharing priorities. Key 

departments and agencies also continued to allocate resources to 

operations that improve information sharing, including developing better 

technical capabilities.

The Program Manager and key departments and agencies also 

developed, generally agreed upon, and executed the 2013 Strategic 

Implementation Plan (Implementation Plan), which includes the overall 

strategy and more specific planning steps to achieve ISE. Further, they 

 4

See Pub. L. No. 108-458, § 1016, 118 Stat. 3638, 3664-70 (2004) at 6 U.S.C. § 485. See 

also 6 U.S.C. § 482 (requiring the establishment of procedures for the sharing of 

homeland security information).
Page 6 GAO-17-317 High-Risk Series

have demonstrated that various information-sharing initiatives are being 

used across multiple agencies as well as state, local, and private sector 

stakeholders. For example, the project manager has developed a 

comprehensive framework for managing enterprise architecture to help 

share and integrate terrorism-related information among multiple 

stakeholders in ISE.5 Specifically, the Project Interoperability initiative 

includes technical resources and other guidance that promote greater 

information system compatibility and performance.6 Furthermore, the key 

departments and agencies have applied the concepts of the Project 

Interoperability Initiative to improve mission operations by better linking 

different law enforcement databases, and facilitating better geospatial 

analysis, among other things.

In addition, the Program Manager and key departments and agencies 

have continued to devise and implement ways to measure the effect of 

ISE on information sharing to address terrorist and other threats to the 

homeland. They developed performance metrics for specific informationsharing initiatives (e.g., fusion centers) used by various stakeholders to 

receive and share information. The Program Manager and key 

departments and agencies have also documented mission-specific 

accomplishments (e.g., related to maritime domain awareness) where the 

Program Manager helped connect previously incompatible information 

systems. The Program Manager has also partnered with DHS to create 

an Information Sharing Measure Development Pilot that intends to better 

measure the effectiveness of information sharing across all levels of ISE.

Further, the Program Manager and key departments and agencies have 

used the Implementation Plan to track progress, address challenges, and 

substantially achieve the objectives in the National Strategy for 

 5

An enterprise architecture, or modernization blueprint, is intended to provide a clear and 

comprehensive picture of an entity, whether it is an organization (e.g., federal department 

or agency) or a functional or mission area that cuts across more than one organization 

(e.g., financial management). This picture consists of snapshots of the enterprise’s current 

and target operational and technological environments, and contains a road map for 

transitioning from the current to the target environment.

6

Project Interoperability refers to a collection of policies and guidance related to 

information interoperability. Information interoperability is the ability to share and use 

information in a consistent, efficient way across multiple organizations and IT systems to 

accomplish operational missions. From a technical perspective, interoperability is 

developed in part by using common technical standards and definitions to manage 

information.
Page 7 GAO-17-317 High-Risk Series

Information Sharing and Safeguarding.7 The Implementation Plan 

contains 16 priority objectives, and by the end of fiscal year 2016, 13 of 

the 16 priority objectives were completed. The Program Manager

transferred the remaining three objectives, which were all underway, to 

other entities with the appropriate technical expertise to continue 

implementation through fiscal year 2019.

In our 2013 high-risk update, we listed nine action items that were critical 

for moving ISE forward. In that report, we determined that two of those 

action items—demonstrating that the leadership structure has the needed 

authority to leverage participating departments, and updating the vision 

for ISE—had been completed. In our 2015 update, we determined that 

the Program Manager and key departments had achieved four of the 

seven remaining action items—demonstrating that departments are 

defining incremental costs and funding; continuing to identify 

technological capabilities and services that can be shared collaboratively; 

demonstrating that initiatives within individual departments are, or will be, 

leveraged to benefit all stakeholders; and demonstrating that 

stakeholders generally agree with the strategy, plans, time frames, 

responsibilities, and activities for substantially achieving ISE.

For the 2017 update, we determined that the remaining three action items 

have been completed: establishing an enterprise architecture 

management capability; demonstrating that the federal government can 

show, or is more fully developing a set of metrics to measure, the extent 

to which sharing has improved under ISE; and demonstrating that 

established milestones and time frames are being used as baselines to 

track and monitor progress. Achieving all nine action items has, in effect, 

addressed our high-risk criteria.

While this demonstrates significant and important progress, sharing 

terrorism-related information remains a constantly evolving work in 

progress that requires continued effort and attention from the Program 

 7

Office of the Program Manager for the Information Sharing Environment, Strategic 

Implementation Plan for the National Strategy for Information Sharing and Safeguarding

(Washington, D.C.: December 2013). In December 2012, the President signed the 

National Strategy for Information Sharing and Safeguarding, which provides guidance on 

implementing policies, standards, and technologies that promote secure and responsible 

national security information sharing. This document builds on the 2010 National Security 

Strategy and the 2007 National Strategy for Information Sharing. The December 2012 

national strategy identifies priority objectives, which have been incorporated into the 

Implementation Plan.
Page 8 GAO-17-317 High-Risk Series

Manager, departments, and agencies. Although no longer a high-risk 

issue, sharing terrorism-related information remains an area with some 

risk, and continues to be vitally important to homeland security, requiring 

ongoing oversight as well as continuous improvement to identify and 

respond to changing threats and technology. Table 2 summarizes the 

Program Manager’s and key departments’ and agencies’ progress in 

achieving the action items.

Table 2: Status of Action Items Required to Remove Terrorism-Related Information Sharing from GAO’s High-Risk List

Action items Action 

item 

status

High-risk category

Demonstrate that the Information Sharing and Access Interagency Policy Committee has 

needed authority, is leveraging participating departments, and is producing results.

Meta Leadership Commitment

Update the vision for ISE—the information sharing capabilities and procedures that need to 

be in place to help ensure terrorism-related information is accessible and identifiable to 

relevant federal, state, local, private, and foreign partners.

Meta Leadership Commitment

Demonstrate that departments are defining incremental costs and funding needed to 

complete the responsibilities and activities which substantially achieve ISE.

Metb Capacity to resolve risk

Continue to identify technological capabilities and services that can be shared collaboratively 

within and across ISE, consistent with a federated architecture approach.

Metb Capacity to resolve risk

Demonstrate that initiatives within individual departments are, or will be, leveraged to benefit 

all relevant federal, state, local, and private security stakeholders participating in ISE.

Metb Action plans that provide 

corrective measures

Establish an enterprise architecture management capability and demonstrate that it will be 

used to guide selection of projects for substantially achieving ISE.

Met Action plans that provide 

corrective measures

Demonstrate that stakeholders generally agree with the strategy, plans, time frames, their 

responsibilities, and their activities for substantially achieving ISE.

Metb Action plans that provide 

corrective measures

Demonstrate that the federal government can show the extent to which sharing has 

improved under ISE, or can show it has actions underway to more fully develop a set of 

metrics and processes to measure results achieved, both from individual projects and 

activities, as well as from the overall ISE.

Met Monitor and validate the 

effectiveness of corrective 

measures

Demonstrate that established milestones and time frames are being used as baselines to 

track and monitor progress on individual projects and in substantially achieving the overall 

ISE.

Met Demonstrated Progress

Source: GAO analysis of Office of the Program Manager for the Information Sharing Environment and key department documents, interviews, and prior GAO reports. | GAO-17-317

a

We determined that these action items were complete in our 2013 high-risk update.

b

We determined that these action items were complete in our 2015 high-risk update.

As we have with areas previously removed from the High-Risk List, we 

will continue to monitor this area, as appropriate, to ensure that the 

improvements we have noted are sustained. If significant problems again 

arise, we will consider reapplying the high-risk designation.
Page 9 GAO-17-317 High-Risk Series

Additional Information on Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information to Protect the Homeland is 

provided on page 653 of this report.

In the 2 years since our last high-risk update, sufficient progress has been 

made in two areas—DOD Supply Chain Management and Mitigating 

Gaps in Weather Satellite Data—that we are narrowing their scope.

DOD Supply Chain Management

DOD manages about 4.9 million secondary inventory items, such as 

spare parts, with a reported value of approximately $91 billion as of 

September 2015. Since 1990, DOD’s inventory management has been 

included on our High-Risk List due to the accumulation of excess 

inventory and weaknesses in demand forecasting for spare parts. In 

addition to DOD’s inventory management, the supply chain management 

high-risk area focuses on materiel distribution and asset visibility within 

DOD. Based on DOD’s leadership commitment and demonstrated 

progress to address weaknesses since 2010, we are removing the 

inventory management component from the supply chain management 

high-risk area. Specifically, DOD has taken the following actions:

• Implemented a congressionally-mandated inventory management 

corrective action plan and institutionalized a performance 

management framework, including regular performance reviews and 

standardized metrics. DOD has also developed and begun 

implementing a follow-on improvement plan.8

• Reduced the percentage and value of its “on-order excess inventory”

(i.e., items already purchased that may be excess due to subsequent 

changes in requirements) and “on-hand excess inventory” (i.e., items 

categorized for potential reuse or disposal). DOD’s data show that the 

proportion of on-order excess inventory to the total amount of onorder inventory decreased from 9.5 percent at the end of fiscal year 

2009 to 7 percent at the end of fiscal year 2015, the most recent fiscal 

year for which data are available. During these years, the value of on-

 8

The National Defense Authorization Act for Fiscal Year 2010 required the Secretary of 

Defense to submit to congressional defense committees a comprehensive plan for 

improving the inventory management systems of the military departments, and DLA with 

the objective of reducing the acquisition and storage of secondary inventory that is excess 

to requirements. Pub. L. No. 111-84 § 328 (2009). 

Two High-Risk Areas 

Narrowed
Page 10 GAO-17-317 High-Risk Series

order excess inventory also decreased from $1.3 billion to $701 

million. DOD’s data show that the proportion of on-hand excess 

inventory to the total amount of on-hand inventory dropped from 9.4 

percent at the end of fiscal year 2009 to 7.3 percent at the end of 

fiscal year 2015. The value of on-hand excess inventory also 

decreased during these years from $8.8 billion to $6.8 billion.

• Implemented numerous actions to improve demand forecasting and 

began tracking department-wide forecasting accuracy metrics in 2013, 

resulting in forecast accuracy improving from 46.7 percent in fiscal 

year 2013 to 57.4 percent in fiscal year 2015, the latest fiscal year for 

which complete data are available.

• Implemented 42 of our recommendations since 2006 and is taking 

actions to implement an additional 13 recommendations, which are 

focused generally on reassessing inventory goals, improving 

collaborative forecasting, and making changes to information 

technology (IT) systems used to manage inventory.

Additional information on DOD Supply Chain Management is provided on 

page 248 of this report.

Mitigating Gaps in Weather Satellite Data

The United States relies on two complementary types of satellite systems 

for weather observations and forecasts: (1) polar-orbiting satellites that 

provide a global perspective every morning and afternoon, and (2) 

geostationary satellites that maintain a fixed view of the United States. 

Both types of systems are critical to weather forecasters, climatologists, 

and the military, who map and monitor changes in weather, climate, the 

oceans, and the environment. Federal agencies are planning or executing 

major satellite acquisition programs to replace existing polar and 

geostationary satellite systems that are nearing or beyond the end of their 

expected life spans. The Department of Commerce’s National Oceanic 

and Atmospheric Administration (NOAA) is responsible for the polar 

satellite program that crosses the equator in the afternoon and for the

nation’s geostationary weather satellite program; DOD is responsible for 

the polar satellite program that crosses the equator in the early morning 

orbit.

Over the last several years, we have reported on the potential for a gap in 

satellite data between the time that the current satellites are expected to 

reach the end of their lifespans, and the time when the next satellites are 

expected to be in orbit and operational. We added this area to our HighRisk List in 2013. According to NOAA program officials, a satellite data 
Page 11 GAO-17-317 High-Risk Series

gap would result in less accurate and timely weather forecasts and 

warnings of extreme events—such as hurricanes, storm surges, and 

floods. Such degraded forecasts and warnings would endanger lives, 

property, and our nation’s critical infrastructures. Similarly, according to 

DOD officials, a gap in space-based weather monitoring capabilities could 

affect the planning, execution, and sustainment of U.S. military operations 

around the world. In our prior high-risk updates, we reported on NOAA’s 

efforts to mitigate the risk of a gap in its polar and geostationary satellite 

programs.

With strong congressional support and oversight, NOAA has made 

significant progress in its efforts to mitigate the potential for gaps in 

weather satellite data on its geostationary weather satellite program. 

Specifically, the agency demonstrated strong leadership commitment to 

mitigating potential gaps in geostationary satellite data by revising and 

improving its gap mitigation/contingency plans. Previously, in December 

2014, we reported on shortfalls in the satellite program’s gap 

mitigation/contingency plans and made recommendations to NOAA to 

address these shortfalls.9 For example, we noted that the plan did not 

sufficiently address

• strategies for preventing a launch delay,

• timelines and triggers to prevent a launch delay, and

• whether any of its mitigation strategies would meet minimum 

performance levels.

NOAA agreed with these recommendations and released a new version 

of its geostationary satellite contingency plan in February 2015 that 

addressed the recommendations, thereby meeting the criterion for having 

an action plan.

We rated capacity as partially met in our 2015 report due to concerns 

about NOAA’s ability to complete critical testing activities because it was

already conducting testing on a round-the-clock, accelerated schedule. 

Since then, NOAA adjusted its launch schedule to allow time to complete 

critical integration and testing activities. In doing so, the agency 

demonstrated that it met the capacity criterion.

 9

GAO, Geostationary Weather Satellites: Launch Date Nears, but Remaining Schedule 

Risks Need to be Addressed, GAO-15-60 (Washington, D.C.: Dec. 16, 2014).
Page 12 GAO-17-317 High-Risk Series

NOAA has also met the criterion for demonstrating progress by mitigating 

schedule risks and successfully launching the satellite. In September 

2013, we reported that the agency had weaknesses in its schedulemanagement practices on its core ground system and spacecraft. We 

made recommendations to address those weaknesses, which included 

sequencing all activities, ensuring there are adequate resources for the 

activities, and analyzing schedule risks. NOAA agreed with the 

recommendations and the Geostationary Operational Environmental 

Satellite-R series (GOES-R) program improved its schedule management 

practices. By early 2016, the program had improved the links between 

remaining activities on the spacecraft schedule, included needed 

schedule logic for a greater number of activities on the ground schedule, 

and included indications on the ground schedule that the results of a 

schedule risk analysis were used in calculating its durations. In addition, 

the program successfully launched the GOES-R satellite in November 

2016.

Oversight by Congress has been instrumental in reducing the risk of 

geostationary weather satellite gaps. For example, Subcommittees of the 

House Science, Space, and Technology committee held multiple hearings 

to provide oversight of the satellite acquisition and the risk of gaps in 

satellite coverage.

As a result, the agency now has a robust constellation of operational and 

backup satellites in orbit and has made significant progress in addressing 

the risk of a gap in geostationary data coverage. Accordingly, there is 

sufficient progress to remove this segment from the high-risk area.10

Additional information on Mitigating Gaps in Weather Satellite Data is 

provided on pages 19 and 430 of this report.

Below are selected examples of areas where progress has been made.

• Strengthening Department of Homeland Security Management 

Functions. The Department of Homeland Security (DHS) continues 

to strengthen and integrate its management functions and progressed 

from partially met to met for the monitoring criterion. Since our 2015 

high-risk update, DHS has strengthened its monitoring efforts for 

financial system modernization programs by entering into a contract 

 10While we removed this segment from the High-Risk List, we added another segment in 

this area—DOD’s Polar-Orbiting Weather Satellites. See page 19.

Progress in Other Areas
Page 13 GAO-17-317 High-Risk Series

for independent verification and validation services to help ensure that 

the modernization projects meet key requirements. These programs 

are key to effectively supporting the department’s financial 

management operations.

Additionally, DHS continued to meet the criteria for leadership 

commitment and a corrective action plan. DHS’s top leadership has 

demonstrated exemplary support and a continued focus on 

addressing the department’s management challenges by, among 

other things, issuing 10 updated versions of DHS’s initial January 

2011 Integrated Strategy for High Risk Management.

The National Defense Authorization Act for Fiscal Year 2017 

reinforces this focus with the inclusion of a mandate that the DHS 

Under Secretary for Management report to us every 6 months to 

demonstrate measurable, sustainable progress made in implementing 

DHS’s corrective action plans to address the high-risk area, until we 

submit written notification of the area’s removal from the High-Risk 

List to the appropriate congressional committees.11 Similar provisions 

were included in the DHS Headquarters Reform and Improvement Act 

of 2015,12 the DHS Accountability Act of 2016,13 and the DHS Reform 

and Improvement Act.14 Additional information on this high-risk area is 

provided on page 354 of this report.

• Strategic Human Capital Management. This area progressed from 

partially met to met on leadership commitment. The Office of 

Personnel Management (OPM), agencies, and Congress have taken 

actions to improve efforts to address mission critical skills gaps. 

Specifically, OPM has demonstrated leadership commitment by 

publishing revisions to its human capital regulations in December 

2016 that require agencies to, among other things, implement human 

capital policies and programs that address and monitor governmentwide and agency-specific skills gaps. This initiative has increased the 

likelihood that skills gaps with the greatest operational effect will be 

addressed in future efforts.

 11Pub. L. No. 114-328, § 1903(b) codified at 6 U.S.C. § 341(a)(11). 

12H.R.3572, 114th Cong. (as passed by House, Oct. 20, 2015).

13S. 2976, 114th Cong. § 101(b) (as reported by S. Comm. on Homeland Sec. and Gov’tal 

Affairs, June 28, 2016).

14H.R. 6381, 114th Cong. (2016).
Page 14 GAO-17-317 High-Risk Series

At the same time, Congress has provided agencies with authorities 

and flexibilities to manage the federal workforce and make the federal 

government a more accountable employer. For example, Congress 

included a provision in the National Defense Authorization Act for 

Fiscal Year 2016 to extend the probationary period for newly-hired 

civilian DOD employees from 1 to 2 years.15 This action is consistent 

with our 2015 reporting that better use of probationary periods gives 

agencies the ability to ensure an employee’s skills are a good fit for all 

critical areas of a particular job. Additional information on this high-risk 

area is provided on page 61 of this report.

• Transforming the Environmental Protection Agency’s Process 

for Assessing and Controlling Toxic Chemicals. Overall, this highrisk area progressed from not met to partially met on two criteria—

capacity and demonstrated progress—and continued to partially meet 

the criterion for monitoring due to progress in one program area. The 

Environmental Protection Agency’s (EPA) ability to effectively 

implement its mission of protecting public health and the environment 

is critically dependent on assessing the risks posed by chemicals in a 

credible and timely manner. EPA assesses these risks under a variety 

of actions, including the Integrated Risk Information System (IRIS) 

program and EPA’s Toxic Substances Control Act (TSCA) program. 

The IRIS program has made some progress on the capacity, 

monitoring, and demonstrated progress criteria. In terms of IRIS 

capacity, EPA has partially met this criterion by finalizing a Multi-Year 

Agenda to better assess how many people and resources should be 

dedicated to the IRIS program. In terms of IRIS monitoring, EPA has 

met this criterion in part by using a Chemical Assessment Advisory 

Committee to review IRIS assessments, among other actions. In 

terms of IRIS demonstrated progress, EPA has partially met this 

criterion as of January 2017 by issuing five assessments since fiscal 

year 2015.

The Frank R. Lautenberg Chemical Safety for the 21st Century Act 

amended TSCA and was enacted on June 22, 2016.16 Passing TSCA 

reform may facilitate EPA’s effort to improve its processes for 

assessing and controlling toxic chemicals in the years ahead. The 

new law provides EPA with greater authority and the ability to take 

actions that could help EPA implement its mission of protecting 

 15Pub. L. No. 114-92, div. A, title XI, § 1105, 129 Stat. 726, 1023-1024, codified at 10 

U.S.C. § 1599e.

16Pub. L. No. 114-182, 130 Stat. 448. 
Page 15 GAO-17-317 High-Risk Series

human health and the environment. EPA officials stated that the 

agency is better positioned to take action to require chemical 

companies to report chemical toxicity and exposure data. Officials 

also stated that the new law gives the agency additional authorities, 

including the authority to require companies to develop new 

information relating to a chemical as necessary for prioritization and 

risk evaluation.

Using both new and previously existing TSCA authorities should 

enhance the agency’s ability to gather new information as necessary 

to evaluate hazard and exposure risks. Continued leadership 

commitment from EPA officials and Congress will be needed to fully 

implement reforms. Additional work will also be needed to issue a 

workload analysis to demonstrate capacity, complete a corrective 

action plan, and demonstrate progress implementing the new 

legislation. Additional information on this high-risk area is provided on 

page 417 of this report.

• Managing Federal Real Property. The federal government continued 

to meet the criteria for leadership commitment, now partially meets 

the criterion for demonstrated progress, and made some progress in 

each of the other high-risk criteria. The Office of Management and 

Budget (OMB) issued the National Strategy for the Efficient Use of 

Real Property (National Strategy) on March 25, 2015, which directs 

Chief Financial Officer (CFO) Act agencies to take actions to reduce 

the size of the federal real property portfolio, as we recommended in 

2012. In addition, in December 2016, two real property reform bills 

were enacted that could address the long-standing problem of federal 

excess and underutilized property. The Federal Assets Sale and 

Transfer Act of 2016 may help address stakeholder influence by 

establishing an independent board to identify and recommend five 

high-value civilian federal buildings for disposal within 180 days after 

the board members are appointed, as well as develop 

recommendations to dispose and redevelop federal civilian real

properties.17

Additionally, the Federal Property Management Reform Act of 2016 

codified the Federal Real Property Council (FRPC) for the purpose of 

ensuring efficient and effective real property management while 

reducing costs to the federal government.18 FRPC is required to 

 17Pub. L. No. 114-287, 130 Stat. 1463. The act excludes properties on military instillations 

among other types of properties.

18Pub. L. No. 114-318, 130 Stat. 1608.
Page 16 GAO-17-317 High-Risk Series

establish a real property management plan template, which must 

include performance measures, and strategies and government-wide 

goals to reduce surplus property or to achieve better utilization of 

underutilized property. In addition, federal agencies are required to 

annually provide FRPC a report on all excess and underutilized 

property, and identify leased space that is not fully used or occupied.

In addressing our 2016 recommendation to improve the reliability of 

real property data, GSA conducted an in-depth survey that focused on 

key real property data elements maintained in the Federal Real 

Property Profile, formed a working group of CFO Act agencies to 

analyze the survey results and reach consensus on reforms, and 

issued a memorandum to CFO Act agencies designed to improve the 

consistency and quality of real property data. The Federal Protective 

Service, which protects about 9,500 federal facilities, implemented our 

recommendation aimed at improving physical security by issuing a 

plan that identifies goals and describes resources that support its risk 

management approach. In addition, the Interagency Security 

Committee, a DHS-chaired organization, issued new guidance 

intended to make the most effective use of physical security 

resources. Additional information on this high-risk area is provided on 

page 77 of this report.

• Enforcement of Tax Laws. The Internal Revenue Service’s (IRS) 

continued efforts to enforce tax laws and address identity theft refund 

fraud (IDT) have resulted in the agency meeting one criterion for 

removal from the High-Risk List (leadership commitment) and partially 

meeting the remaining four criteria (capacity, action plan, monitoring, 

and demonstrating progress). IDT is a persistent and evolving threat 

that burdens legitimate taxpayers who are victims of the crime. It cost 

the U.S. Treasury an estimated minimum of $2.2 billion during the 

2015 tax year.

Congress and IRS have taken steps to address this challenge. IRS 

has deployed new tools and increased resources dedicated to 

identifying and combating IDT refund fraud. In addition, the 

Consolidated Appropriations Act, 2016, amended the tax code to 

accelerate Wage and Tax Statement (W-2) filing deadlines to January 

31.19 We had previously reported that the wage information that 

employers report on Form W-2 was not available to IRS until after it 

issues most refunds. With earlier access to W-2 wage data, IRS could 

 19Pub. L. No. 114-113, div. Q, § 201, 129 Stat. 2242, 3076 (2015). This change went into 

effect for W-2s reporting payments made in 2016 and filed in 2017.
Page 17 GAO-17-317 High-Risk Series

match such information to taxpayers’ returns and identify 

discrepancies before issuing billions of dollars of fraudulent IDT 

refunds. Such matching could also provide potential benefits for other 

IRS enforcement programs, such as preventing improper payments 

via the Earned Income Tax Credit. Additional information on this highrisk area is provided on page 500 of this report.

In addition to being instrumental in supporting progress in individual highrisk areas, Congress also has taken actions to enact various statutes that, 

if implemented effectively, will help foster progress on high-risk issues 

government-wide. These include the:

• Program Management Improvement Accountability Act:20

Enacted in December 2016, the act seeks to improve program and 

project management in federal agencies. Among other things, the act 

requires the Deputy Director of the Office of Management and Budget 

(OMB) to adopt and oversee implementation of government-wide 

standards, policies, and guidelines for program and project 

management in executive agencies. The act also requires the Deputy 

Director to conduct portfolio reviews to address programs on our 

High-Risk List. It further creates a Program Management Policy 

Council to act as an interagency forum for improving practices related 

to program and project management. The Council is to review 

programs on the High-Risk List and make recommendations to the 

Deputy Director or designee. We are to review the effectiveness of 

key efforts under the act to improve federal program management.

• Fraud Reduction and Data Analytics Act of 2015 (FRDA):21 FRDA, 

enacted in June 2016, is intended to strengthen federal anti-fraud 

controls, while also addressing improper payments.22 FRDA requires 

OMB to use our Fraud Risk Framework to create guidelines for 

federal agencies to identify and assess fraud risks, and then design 

and implement control activities to prevent, detect, and respond to 

 20Pub. L. No. 114-264, 130 Stat. 1371 (2016).

21Pub. L. No. 114-186, 130 Stat. 546 (2016).

22It is important to note that while all fraud involving a federal payment is considered an 

improper payment, not all improper payments are fraud. However, minimizing fraud risks 

in federal agency programs can help reduce improper payments and enhance program 

integrity.

Congressional Action 

Aided Progress on 

Government-wide HighRisk Issues
Page 18 GAO-17-317 High-Risk Series

fraud.23 Agencies, as part of their annual financial reports beginning in 

fiscal year 2017, are further required to report on their fraud risks and 

their implementation of fraud reduction strategies, which should help 

Congress monitor agencies’ progress in addressing and reducing 

fraud risks. To aid federal agencies in better analyzing fraud risks, 

FRDA requires OMB to establish a working group tasked with 

developing a plan for the creation of an interagency library of data 

analytics and data sets to facilitate the detection of fraud and the 

recovery of improper payments. This working group and the library 

should help agencies to coordinate their fraud detection efforts and 

improve their ability to use data analytics to monitor databases for 

potential improper payments. The billions of dollars of improper 

payments are a central part of the Medicare Program, Medicaid 

Program, and Enforcement of Tax Laws (Earned Income Tax Credit) 

high-risk areas.

• IT Acquisition Reform, Legislation known as the Federal 

Information Technology Acquisition Reform Act (FITARA):24

FITARA, enacted in December 2014, was intended to improve how 

agencies acquire IT and enable Congress to monitor agencies’

progress and hold them accountable for reducing duplication and 

achieving cost savings. FITARA includes specific requirements 

related to seven areas: the federal data center consolidation initiative, 

enhanced transparency and improved risk management, agency 

Chief Information Officer authority enhancements, portfolio review, 

expansion of training and use of IT acquisition cadres, governmentwide software purchasing, and maximizing the benefit of the federal 

strategic sourcing initiative. Effective implementation of FITARA is 

central to making progress in the Improving the Management of IT 

Acquisitions and Operations government-wide area we added to the 

High-Risk List in 2015.

 23To help managers combat fraud and preserve integrity in government agencies and 

programs, we identified leading practices for managing fraud risks and organized them 

into a conceptual framework. GAO, A Framework for Managing Fraud Risks in Federal 

Programs, GAO-15-593SP (Washington, D.C.: July 28, 2015).

24FITARA was enacted into law a part of the Carl Levin and Howard P. “Buck” McKeon 

National Defense Authorization Act for Fiscal Year 2015, Pub. L. No. 113-291 (2014), div. 

A, title VIII, subtitle D, §§ 831-837, 128 Stat. 3292, 3438-3450.
Page 19 GAO-17-317 High-Risk Series

In the 2 years since the last high-risk update, two areas—Mitigating Gaps 

in Weather Satellite Data and Management of Federal Oil and Gas 

Resources—have expanded in scope because of emerging challenges 

related to these overall high-risk areas. In addition, while progress is 

needed across all high-risk areas, particular areas need significant 

attention.

While NOAA has made significant progress, as described earlier, in its 

geostationary weather satellite program, DOD has made limited progress 

in meeting its requirements for the polar satellite program. In 2010, when 

the Executive Office of the President decided to disband a tri-agency 

polar weather satellite program, DOD was given responsibility for 

providing polar-orbiting weather satellite capabilities in the early morning 

orbit. This information is used to provide updated information for weather 

observations and models. However, the department was slow to develop 

plans to replace the existing satellites that provide this coverage. 

Because DOD delayed establishing plans for its next generation of 

weather satellites, there is a risk of a satellite data gap in the early 

morning orbit.

The last satellite that the department launched in 2014 called Defense 

Meteorological Satellite Program (DMSP)-19, stopped providing recorded 

data used in weather models in February 2016. A prior satellite, called 

DMSP-17, is now the primary satellite operating in the early morning orbit. 

However, this satellite, which was launched in 2006, is operating with 

limitations due to the age of its instruments. DOD had developed another 

satellite, called DMSP-20, but plans to launch that satellite were canceled 

after the department did not certify that it would launch the satellite by the 

end of calendar year 2016.

The department conducted a requirements review and analysis of 

alternatives from February 2012 through September 2014 to determine 

the best way forward for providing needed polar-orbiting satellite 

environmental capabilities in the early morning orbit. In October 2016, 

DOD approved plans for its next generation of weather satellites, called 

the Weather System Follow-on—Microwave program, which will meet the 

High-Risk Areas 

Highlighted for 

Significant Attention

Expanding High-Risk 

Area: Mitigating Gaps in 

DOD Weather Satellite 

Data

DOD’s Polar-Orbiting Weather 

Satellites
Page 20 GAO-17-317 High-Risk Series

department’s needs for satellite information on oceanic wind speed and 

direction to protect ships on the ocean’s surface. The department plans to 

launch a demonstration satellite in 2017 and to launch its first operational 

satellite developed under this program in 2022. However, DOD’s plans for 

the early morning orbit are not comprehensive.

The department did not thoroughly assess options for providing its two 

highest-priority capabilities, cloud descriptions and area-specific weather 

imagery. These capabilities were not addressed due to an incorrect 

assumption about the capabilities that would be provided by international 

partners. The Weather System Follow-on—Microwave program does not 

address these two highest-priority capabilities and the department has not 

yet determined its long-term plans for providing these capabilities. As a 

result, the department will need to continue to rely on the older DMSP-17 

satellite until its new satellite becomes operational in 2022, and it 

establishes and implements plans to address the high-priority capabilities 

that the new satellite will not address. Given the age of the DMSP-17 

satellite and uncertainty on how much longer it will last, the department 

could face a gap in critical satellite data.

In August 2016, DOD reported to Congress its near-term plans to address 

potential satellite data gaps. These plans include a greater reliance on 

international partner capabilities, exploring options to move a 

geostationary satellite over an affected region, and plans to explore 

options for acquiring and fielding new equipment, such as satellites and 

satellite components to provide the capabilities. In addition, the 

department anticipates that the demonstration satellite to be developed 

as a precursor to the Weather System Follow-on—Microwave program 

could help mitigate a potential gap by providing some useable data. 

However, these proposed solutions may not be available in time or be 

comprehensive enough to avoid near-term coverage gaps. Such a gap 

could negatively affect military operations that depend on weather data, 

such as long-range strike capabilities and aerial refueling.

DOD needs to demonstrate progress on its new Weather Satellite Followon—Microwave program, and to establish and implement plans to 

address the high-priority capabilities that are not included in the program. 

Additional information on Mitigating Gaps in Weather Satellite Data is 

provided on page 430 of this report.
Page 21 GAO-17-317 High-Risk Series

On April 20, 2010, the Deepwater Horizon drilling rig exploded in the Gulf 

of Mexico, resulting in 11 deaths, serious injuries, and the largest marine 

oil spill in U.S. history. In response, in May 2010, the Department of the 

Interior (Interior) first reorganized its offshore oil and gas management 

activities into separate offices for revenue collection, under the Office of 

Natural Resources Revenue, and energy development and regulatory 

oversight, under the Bureau of Ocean Energy Management, Regulation 

and Enforcement. Later, in October 2011, Interior further reorganized its 

energy development and regulatory oversight activities when it 

established two new bureaus to oversee offshore resources and 

operational compliance with environmental and safety requirements. The 

new Bureau of Ocean Energy Management (BOEM) is responsible for 

leasing and approving offshore development plans while the new Bureau 

of Safety and Environmental Enforcement (BSEE) is responsible for lease 

operations, safety, and enforcement.

In 2011, we added Interior’s management of federal oil and gas resources 

to the High-Risk List based on three concerns: (1) Interior did not have 

reasonable assurance that it was collecting its share of billions of dollars 

of revenue from federal oil and gas resources; (2) Interior continued to 

experience problems hiring, training, and retaining sufficient staff to 

oversee and manage federal oil and gas resources; and (3) Interior was 

engaged in restructuring its oil and gas program, which is inherently 

challenging, and there were questions about whether Interior had the 

capacity to reorganize while carrying out its range of responsibilities, 

especially in a constrained resource environment.

Immediately after reorganizing, Interior developed memorandums and 

standard operating procedures to define roles and responsibilities, and 

facilitate and formalize coordination between BOEM and BSEE. Interior 

also revised polices intended to improve its oversight of offshore oil and 

gas activities, such as new requirements designed to mitigate the risk of a 

subsea well blowout or spill. In 2013, we determined that progress had 

been made, because Interior had fundamentally completed reorganizing 

its oversight of offshore oil and gas activities. As a result, in 2013, we 

removed the reorganization segment from this high-risk area.

Expanding High-Risk 

Area: Management of 

Federal Oil and Gas 

Resources

Restructuring of Offshore Oil 

and Gas Oversight
Page 22 GAO-17-317 High-Risk Series

However, in February 2016, we reported that BSEE had undertaken 

various reform efforts since its creation in 2011, but had not fully 

addressed deficiencies in its investigative, environmental compliance, and 

enforcement capabilities identified by investigations after the Deepwater 

Horizon incident.

BSEE’s ongoing restructuring has made limited progress enhancing the 

bureau’s investigative capabilities. BSEE continues to use pre–

Deepwater Horizon incident policies and procedures. Specifically, BSEE 

has not completed a policy outlining investigative responsibilities or 

updated procedures for investigating incidents—among the goals of 

BSEE’s restructuring, according to restructuring planning documents, and 

consistent with federal standards for internal control. The use of outdated 

investigative policies and procedures is a long-standing deficiency. Post–

Deepwater Horizon incident investigations found that Interior’s policies 

and procedures did not require it to plan investigations, gather and 

document evidence, and ensure quality control, and determined that 

continuing to use them posed a risk to the effectiveness of bureau 

investigations. Without completing and updating its investigative policies 

and procedures, BSEE continues to face this risk.

BSEE’s ongoing restructuring of its environmental compliance program 

reverses actions taken to address post–Deepwater Horizon incident 

concerns, and risks weakening the bureau’s environmental compliance 

oversight capabilities. In 2011, in response to two post–Deepwater 

Horizon incident investigations that found that BSEE’s predecessor’s 

focus on oil and gas development might have been at the expense of 

protecting the environment, BSEE created an environmental oversight 

division with region-based staff reporting directly to the headquartersbased division chief instead of regional management. This reporting 

structure was to help ensure that environmental issues received 

appropriate weight and consideration within the bureau.

Under the restructuring, since February 2015, field-based environmental 

compliance staff again report to their regional directors. BSEE’s rationale 

for this action is unclear, as it was not documented or analyzed as part of 

the bureau’s restructuring planning. Under federal standards for internal 

control, management is to assess the risks posed by external and internal 

sources and decide what actions to take to mitigate them. Without 

assessing the risk of reversing its reporting structure, Interior cannot be 

sure that BSEE will have reasonable assurance that environmental issues 

are receiving the appropriate weight and consideration, as called for by 

post–Deepwater Horizon incident investigations.
Page 23 GAO-17-317 High-Risk Series

When we reviewed BSEE’s environmental compliance program, we found 

that the interagency agreements between Interior and EPA designed to 

coordinate water quality monitoring under the National Pollutant 

Discharge Elimination System were decades old. According to BSEE 

annual environmental compliance activity reports, the agreements may 

not reflect the agency’s current resources and needs. For example, a 

1989 agreement stipulates that Interior shall inspect no more than 50 

facilities on behalf of EPA per year, and shall not conduct water sampling 

on behalf of EPA. Almost 30 years later, after numerous changes in 

drilling practices and technologies, it is unclear whether inspecting no 

more than 50 facilities per year is sufficient to monitor water quality.

Nevertheless, senior BSEE officials told us that the bureau has no plans 

to update its agreements with EPA, and some officials said that a 

previous headquarters-led effort to update the agreements was not 

completed because it did not sufficiently describe the bureau’s offshore oil 

and gas responsibilities. According to Standards for Internal Control in the 

Federal Government, as programs change and agencies strive to improve 

operational processes and adopt new technologies, management officials 

must continually assess and evaluate internal controls to ensure that 

control activities are effective and updated when necessary.

BSEE’s ongoing restructuring has made limited progress in enhancing its 

enforcement capabilities. In particular, BSEE has not developed 

procedures with criteria to guide how it uses enforcement tools—such as 

warnings and fines—which are among the goals of BSEE’s restructuring, 

according to planning documents, and consistent with federal standards 

for internal control. BSEE restructuring plans state that the current lack of 

criteria causes BSEE to act inconsistently, which makes oil and gas 

industry operators uncertain about BSEE’s oversight approach and 

expectations. The absence of enforcement climate criteria is a longstanding deficiency. For example, post–Deepwater Horizon incident 

investigations recommended BSEE assess its enforcement tools and how 

to employ them to deter safety and environmental violations. Without 

developing procedures with defined criteria for taking enforcement 

actions, BSEE continues to face risks to the effectiveness of its 

enforcement capabilities.

To enhance Interior’s oversight of oil and gas development, we 

recommended in February 2016 that the Secretary of the Interior direct 
Page 24 GAO-17-317 High-Risk Series

the Director of BSEE to take the following nine actions as it continues to 

restructure. 25

• To address risks to the effectiveness of BSEE’s investigations, 

environmental compliance, and enforcement capabilities, we 

recommended that BSEE complete policies outlining the 

responsibilities of investigations, environmental compliance, and 

enforcement programs, and update and develop procedures to guide 

them.

• To enhance its investigative capabilities, we recommended that 

BSEE:

• establish a capability to review investigation policy and collect and 

analyze incidents to identify trends in safety and environmental 

hazards;

• develop a plan with milestones for implementing the case 

management system for investigations;

• clearly communicate the purpose of BSEE’s investigations 

program to industry operators; and

• clarify policies and procedures for assigning panel investigation 

membership and referring cases of suspected criminal 

wrongdoing to the Inspector General.

• To enhance its environmental compliance capabilities, we recommend 

that BSEE:

• conduct and document a risk analysis of the regional-based 

reporting structure of its Environmental Compliance Division, 

including actions to mitigate any identified risks;

• coordinate with the Administrator of the Environmental Protection 

Agency to consider the relevance of existing interagency 

agreements for monitoring operator compliance with National 

Pollutant Discharge Elimination System permits on the Outer 

Continental Shelf and, if necessary, update agreements to reflect 

current oversight needs; and

• develop a plan to address documented environmental oversight 

staffing needs.

 25GAO, Oil and Gas Management: Interior’s Bureau of Safety and Environmental 

Enforcement Restructuring Has Not Addressed Long-Standing Oversight Deficiencies, 

GAO-16-245 (Washington, D.C.: Feb. 10, 2016).
Page 25 GAO-17-317 High-Risk Series

• To enhance its enforcement capabilities, we recommended that BSEE 

develop a mechanism to ensure that it reviews the maximum daily 

civil penalty and adjusts it to reflect changes in the Consumer Price 

Index within the time frames established by statute.

In its written comments, Interior agreed that additional reforms—such as 

documented policies and procedures—are needed to address offshore oil 

and gas oversight deficiencies, but Interior neither agreed nor disagreed 

with our specific recommendations. Additional information on 

Management of Federal Oil and Gas Resources is provided on page 136

of this report.

• Managing Risks and Improving VA Health Care. Since we added 

Department of Veterans Affairs (VA) health care to our High-Risk List 

in 2015, VA has acknowledged the significant scope of the work that 

lies ahead in each of the five areas of concern we identified: (1) 

ambiguous policies and inconsistent processes; (2) inadequate 

oversight and accountability; (3) information technology (IT) 

challenges; (4) inadequate training for VA staff; and (5) unclear 

resource needs and allocation priorities. It is imperative that VA 

maintain strong leadership support, and as the new administration 

sets its priorities, VA will need to integrate those priorities with its 

high-risk related actions.

VA developed an action plan for addressing its high-risk designation, 

but the plan describes many planned outcomes with overly ambitious 

deadlines for completion. We are concerned about the lack of root 

cause analyses for most areas of concern, and the lack of clear 

metrics and needed resources for achieving stated outcomes. In 

addition, with the increased use of community care programs, it is 

imperative that VA’s action plan discuss the role of community care in 

decisions related to policies, oversight, IT, training, and resource 

needs.

Finally, to help address its high-risk designation, VA should continue 

to implement our recommendations, as well as recommendations 

from others. While VA’s leadership has increased its focus on 

implementing our recommendations in the last 2 years, additional 

work is needed. We made 66 VA health care-related 

recommendations in products issued since the VA health care highrisk designation in February 2015, for a total of 244 recommendations 

from January 1, 2010, through December 31, 2016. VA has 

implemented 122 (about 50 percent) of the 244 recommendations, but 

over 100 recommendations remain open as of December 31, 2016 

Additional High-Risk Areas 

Needing Significant 

Attention
Page 26 GAO-17-317 High-Risk Series

(with about 25 percent being open for 3 or more years). It is critical 

that VA implement our recommendations in a timely manner.

Additional information on Managing Risks and Improving VA Health 

Care is provided on page 627 of this report.

• DOD Financial Management. The effects of DOD’s financial 

management problems extend beyond financial reporting and 

negatively affect DOD’s ability to manage the department and make 

sound decisions on mission and operations. In addition, DOD remains 

one of the few federal entities that cannot demonstrate its ability to 

accurately account for and reliably report its spending or assets. 

DOD’s financial management problems continue as one of three 

major impediments preventing us from expressing an opinion on the 

consolidated financial statements of the federal government.

Sustained leadership commitment will be critical to DOD’s success in 

achieving financial accountability, and in providing reliable information 

for day-to-day management decision making as well as financial audit 

readiness. DOD needs to assure the sustained involvement of 

leadership at all levels of the department in addressing financial 

management reform and business transformation. In addition, further 

action is needed in the areas of capacity and action planning. 

Specifically, DOD needs to

• continue building a workforce with the level of training and 

experience needed to support and sustain sound financial 

management;

• continue to develop and deploy enterprise resource planning 

systems as a critical component of DOD’s financial improvement 

and audit readiness strategy, as well as strengthen automated 

controls or design manual workarounds for the remaining legacy 

systems to satisfy audit requirements and improve data used for 

day-to-day decision making; and

• effectively implement its Financial Improvement and Audit 

Readiness Plan and related guidance to focus on strengthening 

processes, controls, and systems to improve the accuracy, 

reliability, and reporting for its priority areas, including budgetary 

information and mission-critical assets.

Further, DOD needs to monitor and assess the progress the 

department is making to remediate its internal control deficiencies. 

DOD should (1) require the military services to improve their policies 

and procedures for monitoring their corrective action plans for 

financial management-related findings and recommendations, and (2) 

improve its process for monitoring the military services’ audit 
Page 27 GAO-17-317 High-Risk Series

remediation efforts by preparing a consolidated management 

summary that provides a comprehensive picture of the status of 

corrective actions throughout the department. DOD is continuing to 

work toward undergoing a full financial statement audit by fiscal year 

2018; however, it expects to receive disclaimers of opinion on its 

financial statements for a number of years.

A lack of comprehensive information on the corrective action plans 

limits the ability of DOD and Congress to evaluate DOD’s progress 

toward achieving audit readiness, especially given the short amount of 

time remaining before DOD is required to undergo an audit of the 

department-wide financial statements for fiscal year 2018. Being able 

to demonstrate progress in remediating its financial management 

deficiencies will be useful as the department works toward 

implementing lasting financial management reform to ensure that it 

can generate reliable, useful, and timely information for financial 

reporting as well as for decision making and effective operations. 

Moreover, stronger financial management would show DOD’s 

accountability for funds and would help it operate more efficiently.

Additional information on DOD Financial Management is provided on 

page 280 of this report.

• Modernizing the U.S. Financial Regulatory System and the 

Federal Role in Housing Finance. Resolving the role of the federal 

government in housing finance will require leadership commitment 

and action by Congress and the administration. The federal 

government has directly or indirectly supported more than two-thirds 

of the value of new mortgage originations in the single-family housing 

market since the beginning of the 2007-2009 financial crisis.26

Mortgages with federal support include those backed by Fannie Mae 

and Freddie Mac, two large government-sponsored enterprises (the 

enterprises). Out of concern that their deteriorating financial condition 

threatened the stability of financial markets, the Federal Housing 

Finance Agency (FHFA) placed the enterprises into federal 

conservatorship in 2008, creating an explicit fiscal exposure for the 

federal government. As of September 2016, the Department of the 

Treasury (Treasury) had provided about $187.5 billion in funds as 

capital support to the enterprises, with an additional $258.1 billion 

available to the enterprises should they need further assistance. In 

accordance with the terms of agreements with Treasury, the 

 26This figure is based on data from Inside Mortgage Finance.
Page 28 GAO-17-317 High-Risk Series

enterprises had paid dividends to Treasury totaling about $250.5 

billion through September 2016.

More than 8 years after entering conservatorship, the enterprises’

futures remain uncertain and billions of federal dollars remain at risk. 

The enterprises have a reduced capacity to absorb future losses due 

to a capital reserve amount that falls to $0 by 2018. Without a capital 

reserve, any quarterly losses—including those due to market 

fluctuations and not necessarily to economic conditions—would 

require the enterprises to draw additional funds from Treasury. 

Additionally, prolonged conservatorships and a change in leadership 

at FHFA could shift priorities for the conservatorships, which in turn 

could send mixed messages and create uncertainties for market 

participants and hinder the development of the broader secondary 

mortgage market. For this reason, we said in November 2016 that 

Congress should consider legislation establishing objectives for the 

future federal role in housing finance, including the structure of the 

enterprises, and a transition plan to a reformed housing finance 

system that enables the enterprises to exit conservatorship.27

The federal government also supports mortgages through insurance 

or guarantee programs, the largest of which is administered by the 

Department of Housing and Urban Development’s Federal Housing 

Administration (FHA). During the financial crisis, FHA served its 

traditional role of helping to stabilize the housing market, but also 

experienced financial difficulties from which it only recently recovered. 

Maintaining FHA’s long-term financial health and defining its future 

role also will be critical to any effort to overhaul the housing finance 

system.

We previously recommended that Congress or FHA specify the 

economic conditions that FHA’s Mutual Mortgage Insurance Fund 

would be expected to withstand without requiring supplemental funds.

As evidenced by the $1.68 billion FHA received in 2013, the current 2 

percent capital requirement for FHA’s fund may not always be 

adequate to avoid the need for supplemental funds under severe 

stress scenarios. Implementing our recommendation would be an 

important step not only in addressing FHA’s long-term financial 

viability, but also in clarifying FHA’s role.

 27GAO, Federal Housing Finance Agency: Objectives Needed for the Future of Fannie 

Mae and Freddie Mac After Conservatorships, GAO-17-92 (Washington, D.C.: Nov. 17, 

2016).
Page 29 GAO-17-317 High-Risk Series

Additional information on Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing Finance is provided on page 

107 of this report.

• Pension Benefit Guaranty Corporation Insurance Programs. The 

Pension Benefit Guaranty Corporation (PBGC) is responsible for 

insuring the defined benefit pension plans of nearly 40 million 

American workers and retirees who participate in nearly 24,000 

private sector plans. PBGC faces an uncertain financial future due, in 

part, to a long-term decline in the number of traditional defined benefit 

plans and the collective financial risk of the many underfunded 

pension plans that PBGC insures. PBGC’s financial portfolio is one of 

the largest of all federal government corporations and, at the end of 

fiscal year 2016, PBGC’s net accumulated financial deficit was over 

$79 billion—having more than doubled since fiscal year 2013. PBGC 

has estimated that, without additional funding, its multiemployer 

insurance program will likely be exhausted by 2025 as a result of 

current and projected pension plan insolvencies. The agency’s singleemployer insurance program is also at risk due to the continuing 

decline of traditional defined benefit pension plans, increased financial 

risk and reduced premium payments.

While Congress and PBGC have taken significant and positive steps 

to strengthen the agency over recent years, challenges related to 

PBGC’s funding and governance structure remain. Addressing the 

significant financial risk and governance challenges that PBGC faces 

requires additional congressional action. To improve the long-term 

financial stability of PBGC’s insurance programs, Congress should 

consider: (1) authorizing a redesign of PBGC’s single employer 

program premium structure to better align rates with sponsor risk; (2) 

adopting additional changes to PBGC’s governance structure—in 

particular, expanding the composition of its board of directors; (3) 

strengthening funding requirements for plan sponsors as appropriate 

given national economic conditions; (4) working with PBGC to develop 

a strategy for funding PBGC claims over the long term, as the defined 

benefit pension system continues to decline; and (5) enacting 

additional structural reforms to reinforce and stabilize the 

multiemployer system that balance the needs and potential sacrifices 

of contributing employers, participants and the federal government. 

Absent additional steps to improve PBGC’s finances, the long-term 

financial stability of the agency remains uncertain and the retirement 

benefits of millions of American workers and retirees could be at risk 

of dramatic reductions.
Page 30 GAO-17-317 High-Risk Series

Additional information on Pension Benefit Guaranty Corporation 

Insurance Programs is provided on page 609 of this report.

• Ensuring the Security of Federal Information Systems and Cyber 

Critical Infrastructure and Protecting the Privacy of Personally 

Identifiable Information. Federal agencies and our nation’s critical 

infrastructures—such as energy, transportation systems, 

communications, and financial services—are dependent on 

computerized (cyber) information systems and electronic data to carry 

out operations and to process, maintain, and report essential 

information.28 The security of these systems and data is vital to public 

confidence and the nation’s safety, prosperity, and well-being. 

However, safeguarding computer systems and data supporting the 

federal government and the nation’s critical infrastructure is a 

concern. We first designated information security as a governmentwide high-risk area in 1997.

This high-risk area was expanded to include the protection of critical 

cyber infrastructure in 2003 and protecting the privacy of personally 

identifiable information (PII) in 2015. Ineffectively protecting cyber 

assets can facilitate security incidents and cyberattacks that disrupt 

critical operations; lead to inappropriate access to and disclosure, 

modification, or destruction of sensitive information; and threaten 

national security, economic well-being, and public health and safety. 

In addition, the increasing sophistication of hackers and others with 

malicious intent, and the extent to which both federal agencies and 

private companies collect sensitive information about individuals, have 

increased the risk of PII being exposed and compromised.

Over the past several years, we have made about 2,500 

recommendations to agencies aimed at improving the security of 

federal systems and information. These recommendations would help 

agencies strengthen technical security controls over their computer 

networks and systems, fully implement aspects of their information 

security programs, and protect the privacy of PII held on their 

systems. As of October 2016, about 1,000 of our information security–

 28Critical infrastructure includes systems and assets so vital to the United States that 

incapacitating or destroying them would have a debilitating effect on national security. 

These critical infrastructures are grouped by the following industries or “sectors”: 

chemical; commercial facilities; communications; critical manufacturing; dams; defense 

industrial base; emergency services; energy; financial services; food and agriculture; 

government facilities; health care and public health; information technology; nuclear 

reactors, materials, and waste; transportation systems; and water and wastewater 

systems.
Page 31 GAO-17-317 High-Risk Series

related recommendations had not been implemented. In addition, the 

federal government needs, among other things, to improve its abilities 

to detect, respond to, and mitigate cyber incidents; expand efforts to 

protect cyber critical infrastructure; and oversee the protection of PII, 

among other things.

Additional information on Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and Protecting the Privacy 

of Personally Identifiable Information is provided on page 338 of this 

report.

For 2017, we are adding three new areas to the High-Risk List.29

We, along with inspectors general, special commissions, and others, 

have reported that federal agencies have ineffectively administered Indian 

education and health care programs, and inefficiently fulfilled their 

responsibilities for managing the development of Indian energy 

resources. In particular, we have found numerous challenges facing 

Interior’s Bureau of Indian Education (BIE) and Bureau of Indian Affairs 

(BIA)30 and the Department of Health and Human Services’ (HHS) Indian 

Health Service (IHS) in administering education and health care services, 

which put the health and safety of American Indians served by these 

programs at risk. These challenges included poor conditions at BIE 

school facilities that endangered students, and inadequate oversight of 

health care that hindered IHS’s ability to ensure quality care to Indian 

communities. In addition, we have reported that BIA mismanages Indian 

energy resources held in trust and thereby limits opportunities for tribes 

and their members to use those resources to create economic benefits 

and improve the well-being of their communities.

Congress recently noted, “through treaties, statutes, and historical 

relations with Indian tribes, the United States has undertaken a unique 

trust responsibility to protect and support Indian tribes and Indians.”31 In 

light of this unique trust responsibility and concerns about the federal 

 29To determine which federal government programs and functions should be designated 

high risk, we use our guidance document, Determining Performance and Accountability 

Challenges and High Risks, GAO-01-159SP.

30Both of these bureaus are under the Office of the Assistant Secretary for Indian Affairs 

(Indian Affairs). 

31Indian Trust Asset Reform Act, Pub. L. No. 114-178, § 101(3) (2016).

New High-Risk Areas

Improving Federal 

Management of Programs 

That Serve Tribes and 

Their Members
Page 32 GAO-17-317 High-Risk Series

government ineffectively administering Indian education and health care 

programs and mismanaging Indian energy resources, we are adding 

these programs as a high-risk issue because they uniquely affect tribal 

nations and their members.

Federal agencies have performed poorly in the following broad areas: (1) 

oversight of federal activities; (2) collaboration and communication; (3) 

federal workforce planning; (4) equipment, technology, and infrastructure; 

and (5) federal agencies’ data. While federal agencies have taken some 

actions to address the 41 recommendations we made related to Indian 

programs, there are currently 39 that have yet to be fully resolved.

We plan to continue monitoring federal efforts in these areas. To this end, 

we have ongoing work focusing on accountability for safe schools and 

school construction, and tribal control of energy delivery, management, 

and resource development.

Education: We have identified weaknesses in how Indian Affairs

oversees school safety and construction and in how it monitors the way 

schools use Interior funds. We have also found limited workforce planning 

in several key areas related to BIE schools. Moreover, aging BIE school 

facilities and equipment contribute to degraded and unsafe conditions for 

students and staff. Finally, a lack of internal controls and other 

weaknesses hinder Indian Affairs’ ability to collect complete and accurate

information on the physical conditions of BIE schools.

In the past 3 years, we issued three reports on challenges with Indian 

Affairs’ management of BIE schools in which we made 13 

recommendations. Eleven recommendations below remain open.

• To help ensure that BIE schools provide safe and healthy facilities for 

students and staff, we made four recommendations which remain 

open, including that Indian Affairs ensure the inspection information it 

collects on BIE schools is complete and accurate; develop a plan to 

build schools’ capacity to promptly address safety and health 

deficiencies; and consistently monitor whether BIE schools have 

established required safety committees.

• To help ensure that BIE conducts more effective oversight of school 

spending, we made four recommendations which remain open, 

including that Indian Affairs develop a workforce plan to ensure that 

BIE has the staff to effectively oversee school spending; put in place 

written procedures and a risk-based approach to guide BIE in 

What Needs to Be Done
Page 33 GAO-17-317 High-Risk Series

overseeing school spending; and improve information sharing to 

support the oversight of BIE school spending.

• To help ensure that Indian Affairs improves how it manages Indian 

education, we made five recommendations. Three recommendations 

remain open, including that Indian Affairs develop a strategic plan for 

BIE that includes goals and performance measures for how its offices 

are fulfilling their responsibilities to provide BIE with support; revise 

Indian Affairs’ strategic workforce plan to ensure that BIA regional 

offices have an appropriate number of staff with the right skills to 

support BIE schools in their regions; and develop and implement 

decision-making procedures for BIE to improve accountability for BIE 

schools.

Health Care: IHS provides inadequate oversight of health care, both of its 

federally operated facilities and through the Purchase Referred Care 

program (PRC). Other issues include ineffective collaboration—

specifically, IHS does not require its area offices to inform IHS 

headquarters if they distribute funds to local PRC programs using 

different criteria than the PRC allocation formula suggested by 

headquarters. As a result, IHS may be unaware of additional funding 

variation across areas. We have also reported that IHS officials told us 

that an insufficient workforce was the biggest impediment to ensuring 

patients could access timely primary care.

In the past 6 years, we have made 12 recommendations related to Indian 

health care that remain open. Although IHS has taken several actions in 

response to our recommendations, such as improving the data collected 

for the PRC program and adopting Medicare-like rates for nonhospital 

services, much more needs to be done.

• To help ensure that Indian people receive quality health care, the 

Secretary of HHS should direct the Director of IHS to take the 

following two actions: (1) as part of implementing IHS’s quality 

framework, ensure that agency-wide standards for the quality of care 

provided in its federally operated facilities are developed, and 

systematically monitor facility performance in meeting these standards 

over time; and (2) develop contingency and succession plans for 

replacing key personnel, including area directors.

• To help ensure that timely primary care is available and accessible to 

Indians, IHS should: (1) develop and communicate specific agencywide standards for wait times in federally-operated facilities, and (2) 

monitor patient wait times in federally-operated facilities and ensure 

that corrective actions are taken when standards are not met.
Page 34 GAO-17-317 High-Risk Series

• To help ensure that IHS has meaningful information on the timeliness 

with which it issues purchase orders authorizing payment under the 

PRC program, and to improve the timeliness of payments to 

providers, we recommended that IHS: (1) modify IHS’s claims 

payment system to separately track IHS referrals and self-referrals, 

revise Government Performance and Results Act measures for the 

PRC program so that it distinguishes between these two types of 

referrals, and establish separate time frame targets for these referral

types; and (2) better align PRC staffing levels and workloads by 

revising its current practices, where available, used to pay for PRC 

program staff. In addition, as HHS and IHS monitor the effect that new 

coverage options available to IHS beneficiaries through PPACA have 

on PRC funds, we recommend that IHS concurrently develop potential 

options to streamline requirements for program eligibility.

• To help ensure successful outreach efforts regarding PPACA 

coverage expansions, we recommended that IHS realign current 

resources and personnel to increase capacity to deal with enrollment 

in Medicaid and the exchanges, and prepare for increased billing to 

these payers.

• If payments for physician and other nonhospital services are capped, 

we recommended that IHS monitor patient access to these services.

• To help ensure a more equitable allocation of funds per capita across 

areas, we recommended that Congress consider requiring IHS to 

develop and use a new method for allocating PRC funds.

• To develop more accurate data for estimating the funds needed for 

the PRC program and improve IHS oversight, we recommended that 

IHS develop a written policy documenting how it evaluates the need 

for the PRC program, and disseminate it to area offices so they 

understand how unfunded services data are used to estimate overall 

program needs. We also recommended that IHS develop written 

guidance for PRC programs outlining a process to use when funds 

are depleted but recipients continue to need services.

Energy: We have reported on issues with BIA oversight of federal 

activities, such as the length of time it takes to review energy-related 

documents. We also reported on challenges with collaboration—in 

particular, while working to form an Indian Energy Service Center, BIA did 

not coordinate with key regulatory agencies, including the Department of 

the Interior’s Fish and Wildlife Service, the U.S. Army Corps of Engineers, 

and the Environmental Protection Agency. In addition, we found 

workforce planning issues at BIA contribute to management shortcomings 

that have hindered Indian energy development. Lastly, we found issues 
Page 35 GAO-17-317 High-Risk Series

with outdated and deteriorating equipment, technology, and infrastructure, 

as well as incomplete and inaccurate data.

In the past 2 years, we issued three reports on developing Indian energy 

resources in which we made 14 recommendations to BIA. All 

recommendations remain open.

• To help ensure BIA can verify ownership in a timely manner and 

identify resources available for development, we made two 

recommendations, including that Interior take steps to improve its 

geographic information system mapping capabilities.

• To help ensure BIA’s review process is efficient and transparent, we 

made two recommendations, including that Interior take steps to 

develop a documented process to track review and response times for 

energy-related documents that must be approved before tribes can 

develop energy resources.

• To help improve clarity of tribal energy resource agreement 

regulations, we recommended BIA provide additional guidance to 

tribes on provisions that tribes have identified to Interior as unclear.

• To help ensure that BIA streamlines the review and approval process 

for revenue-sharing agreements, we made three recommendations, 

including that Interior establish time frames for the review and 

approval of Indian revenue-sharing agreements for oil and gas, and 

establish a system for tracking and monitoring the review and 

approval process to determine whether time frames are met.

• To help improve efficiencies in the federal regulatory process, we 

made four recommendations, including that BIA take steps to 

coordinate with other regulatory agencies so the Service Center can 

serve as a single point of contact or lead agency to navigate the 

regulatory process.

• To help ensure that BIA has a workforce with the right skills, 

appropriately aligned to meet the agency’s goals and tribal priorities, 

we made two recommendations, including that BIA establish a 

documented process for assessing BIA’s workforce composition at 

agency offices.

Congressional Actions Needed: It is critical that Congress maintain its 

focus on improving the effectiveness with which federal agencies meet 

their responsibilities to serve tribes and their members. Since 2013, we 

testified at six hearings to address significant weaknesses we found in the 

federal management of programs that serve tribes and their members.

Sustained congressional attention to these issues will highlight the 
Page 36 GAO-17-317 High-Risk Series

challenges discussed here and could facilitate federal actions to improve 

Indian education and health care programs, and the development of 

Indian energy resources.

See pages 200-219 for additional details on what we found.

The federal government’s environmental liability has been growing for the 

past 20 years and is likely to continue to increase. For fiscal year 2016, 

the federal government’s estimated environmental liability was $447 

billion—up from $212 billion for fiscal year 1997.32 However, this estimate 

does not reflect all of the future cleanup responsibilities facing federal 

agencies. Because of the lack of complete information and the often 

inconsistent approach to making cleanup decisions, federal agencies 

cannot always address their environmental liabilities in ways that 

maximize the reduction of health and safety risks to the public and the 

environment in a cost-effective manner.

The federal government is financially liable for cleaning up areas where 

federal activities have contaminated the environment. Various federal 

laws, agreements with states, and court decisions require the federal 

government to clean up environmental hazards at federal sites and 

facilities—such as nuclear weapons production facilities and military 

installations. Such sites are contaminated by many types of waste, much 

of which is highly hazardous.

Federal accounting standards require agencies responsible for cleaning 

up contamination to estimate future cleanup and waste disposal costs, 

and to report such costs in their annual financial statements as 

environmental liabilities. Per federal accounting standards, federal 

agencies’ environmental liability estimates are to include probable and 

reasonably estimable costs of cleanup work. Federal agencies’

environmental liability estimates do not include cost estimates for work for 

which reasonable estimates cannot currently be generated. 

Consequently, the ultimate cost of addressing the U.S. government’s 

environmental cleanup is likely greater than $447 billion. Federal 

agencies’ approaches to addressing their environmental liabilities and 

cleaning up the contamination from past activities are often influenced by 

 32We did not adjust environmental liability estimates for inflation because information 

about the amount of the liability applicable to each fiscal year was not available.

U.S. Government’s 

Environmental Liability
Page 37 GAO-17-317 High-Risk Series

numerous site-specific factors, stakeholder agreements, and legal 

provisions.

We have also found that some agencies do not take a holistic, riskinformed approach to environmental cleanup that aligns limited funds with 

the greatest risks to human health and the environment. Since 1994, we 

have made at least 28 recommendations related to addressing the federal 

government’s environmental liability. These include 22 recommendations 

to the Departments of Energy (DOE) or Defense (DOD), 1 

recommendation to OMB to consult with Congress on agencies’

environmental cleanup costs, and 4 recommendations to Congress to 

change the laws governing cleanup activities. Of these, 13 

recommendations remain unimplemented. If implemented, these steps 

would improve the completeness and reliability of the estimated costs of 

future cleanup responsibilities, and lead to more risk-based management 

of the cleanup work.

Of the federal government’s estimated $447 billion environmental liability, 

DOE is responsible for by far the largest share of the liability, and DOD is 

responsible for the second largest share. The rest of the federal 

government makes up the remaining 3 percent of the liability with 

agencies such as the National Aeronautics and Space Administration 

(NASA) and the Departments of Transportation, Veteran’s Affairs, 

Agriculture (USDA), and Interior holding large liabilities (see figure 2).

What Needs to Be Done
Page 38 GAO-17-317 High-Risk Series

Figure 2: Total Reported U.S. Environmental Liability, Fiscal Year 2016

Note: We did not adjust environmental liability estimates for inflation because information about the 

amount of the liability applicable to each fiscal year was not available.

Agencies spend billions each year on environmental cleanup efforts but 

the estimated environmental liability continues to rise. For example, 

despite billions spent on environmental cleanup, DOE’s environmental 

liability has roughly doubled from a low of $176 billion in fiscal year 1997 

to the fiscal year 2016 estimate of $372 billion. In the last 6 years alone, 

DOE’s Office of Environmental Management (EM) has spent $35 billion, 

primarily to treat and dispose of nuclear and hazardous waste, and 

construct capital asset projects to treat the waste; however, EM’s portion 

of the environmental liability has grown over this same time period by 

over $90 billion, from $163 billion to $257 billion (see figure 3).
Page 39 GAO-17-317 High-Risk Series

Figure 3: DOE’s Office of Environmental Management’s Annual Spending and 

Growing Environmental Liability

Note: EM is the organization within DOE responsible for managing environmental cleanup and is 

responsible for cleaning up 107 sites across the country. To date, EM has completed cleanup at 91 of 

these sites. EM spending includes money to treat and dispose of nuclear and hazardous waste, and 

to construct capital asset projects to treat the waste. We did not adjust environmental liability 

estimates for inflation because information about the amount of the liability applicable to each fiscal 

year was not available.

Progress in addressing the U.S. government’s environmental liabilities 

depends on how effectively federal departments and agencies set 

priorities, under increasingly restrictive budgets, that maximize the risk 

reduction and cost-effectiveness of cleanup approaches. As a first step, 

some departments and agencies may need to improve the completeness 

of information about long-term cleanup responsibilities and their 

associated costs so that decision makers, including Congress, can 

consider the full scope of the federal government’s cleanup obligations. 

As a next step, certain departments, such as DOE, may need to change 

how they establish cleanup priorities. For example, DOE’s current 

practice of negotiating agreements with individual sites without 
Page 40 GAO-17-317 High-Risk Series

considering other sites’ agreements or available resources may not 

ensure that limited resources will be allocated to reducing the greatest 

environmental risks, and costs will be minimized.

We have recommended actions to federal agencies that, if implemented, 

would improve the completeness and reliability of the estimated costs of 

future cleanup responsibilities, and lead to more risk-based management 

of the cleanup work. These recommendations include:

• In 1994, we recommended that Congress amend certain legislation to 

require agencies to report annually on progress in implementing plans 

for completing site inventories, estimates of the total costs to clean up 

their potential hazardous waste sites, and agencies’ progress toward 

completing their site inventories and on their latest estimates of total 

cleanup costs. We believe these recommendations are as relevant, if 

not more so, today.

• In 2015, we recommended that USDA develop plans and procedures 

for completing its inventories of potentially contaminated sites. USDA 

disagreed with this recommendation. However, we continue to believe 

that USDA’s inventory of contaminated and potentially contaminated 

sites—in particular, abandoned mines, primarily on Forest Service 

land—is insufficient for effectively managing USDA’s overall cleanup 

program. Interior is also faced with an incomplete inventory of 

abandoned mines that it is working to improve.

• In 2006, we recommended that DOD develop, document, and 

implement a program for financial management review, assessment, 

and monitoring of the processes for estimating and reporting 

environmental liabilities. This recommendation has not been 

implemented.

• We have found in the past that DOE’s cleanup strategy is not risk 

based and should be re-evaluated. DOE’s decisions are often driven 

by local stakeholders and certain requirements in federal facilities 

agreements and consent decrees. In 1995, we recommended that 

DOE set national priorities for cleaning up its contaminated sites using 

data gathered during ongoing risk evaluations. This recommendation 

has not been implemented.

• In 2003, we recommended that DOE ask Congress to clarify its 

authority for designating certain waste with relatively low levels of 

radioactivity as waste incidental to reprocessing, and therefore not 

managed as high-level waste. In 2004, DOE received this specific 

Completeness of 

Environmental Liability 

Estimates

Reliability of Environmental 

Liability Estimates

Risk-Based Decision Making
Page 41 GAO-17-317 High-Risk Series

authority from Congress for the Savannah River and Idaho Sites,33

thereby allowing DOE to save billions of dollars in waste treatment 

costs. The law, however, excluded the Hanford Site.

• More recently, in 2015, we found that DOE is not comprehensively 

integrating risks posed by National Nuclear Security Administration’s 

(NNSA) nonoperational contaminated facilities with EM’s portfolio of 

cleanup work.34 By not integrating nonoperational facilities from 

NNSA, EM is not providing Congress with complete information about 

EM’s current and future cleanup obligations as Congress deliberates 

annually about appropriating funds for cleanup activities. We 

recommended that DOE integrate its lists of facilities prioritized for 

disposition with all NNSA facilities that meet EM’s transfer 

requirements, and that EM should include this integrated list as part of 

the Congressional Budget Justification for DOE. DOE neither agreed 

nor disagreed with this recommendation.

See pages 232-247 for additional details on what we found.

One of the most important functions of the U.S. Census Bureau (Bureau) 

is conducting the decennial census of the U.S. population, which is 

mandated by the Constitution and provides vital data for the nation. This 

information is used to apportion the seats of the U.S. House of 

Representatives; realign the boundaries of the legislative districts of each 

state; allocate billions of dollars in federal financial assistance; and 

provide social, demographic, and economic profiles of the nation’s people 

to guide policy decisions at each level of government. A complete count 

of the nation’s population is an enormous challenge as the Bureau seeks 

to control the cost of the census while it implements several new 

innovations and manages the processes of acquiring and developing new 

and modified IT systems supporting them. Over the past 3 years, we have 

made 30 recommendations to help the Bureau design and implement a 

more cost-effective census for 2020; however, only 6 of them had been 

fully implemented as of January 2017.

 33Pub. L. No. 108-375, § 3116 (2004).

34NNSA has identified 83 contaminated facilities for potential transfer to EM for disposition 

over a 25-year period, 56 of which are currently nonoperational. NNSA is maintaining 

these facilities for future transfer to EM, but the condition of nonoperational facilities 

continues to degrade, resulting in increasing costs to NNSA to maintain them to prevent 

the spread of contamination.

2020 Decennial Census
Page 42 GAO-17-317 High-Risk Series

The cost of the census, in terms of cost for counting each housing unit, 

has been escalating over the last several decennials. The 2010 Census 

was the costliest U.S. Census in history at about $12.3 billion, and was 

about 31 percent more costly than the $9.4 billion cost of the 2000 

Census (in 2020 dollars).35 The average cost for counting a housing unit 

increased from about $16 in 1970 to around $92 in 2010 (in 2020 

constant dollars). Meanwhile, the return of census questionnaires by mail 

(the primary mode of data collection) declined over this period from 78 

percent in 1970 to 63 percent in 2010. Declining mail response rates—a 

key indicator of a cost-effective census—are significant and lead to higher 

costs. This is because the Bureau sends enumerators to each 

nonresponding household to obtain census data. As a result, 

nonresponse follow-up is the Bureau’s largest and most costly field 

operation. In many ways, the Bureau has had to invest substantially more 

resources each decade to match the results of prior enumerations.

The Bureau plans to implement several new innovations in its design of 

the 2020 Census. In response to our recommendations regarding past 

decennial efforts and other assessments, the Bureau has fundamentally 

reexamined its approach for conducting the 2020 Census. Its plan for 

2020 includes four broad innovation areas that it believes will save it over 

$5 billion (2020 constant dollars) when compared to what it estimates 

conducting the census with traditional methods would cost. The Bureau’s 

innovations include (1) using the Internet as a self-response option, which 

the Bureau has never done on a large scale before; (2) verifying most 

addresses using “in-office” procedures and on-screen imagery rather than 

street-by-street field canvassing; (3) re-engineering data collection 

methods such as by relying on an automated case management system; 

and (4) in certain instances, replacing enumerator collection of data with 

administrative records (information already provided to federal and state 

governments as they administer other programs). These innovations 

show promise for a more cost-effective head count. However, they also 

introduce new risks, in part, because they include new procedures and 

technology that have not been used extensively in earlier decennials, if at 

all.

 35The fiscal year 2020 constant dollar factors the Bureau used are derived from the 

Chained Price Index from “Gross Domestic Product and Deflators Used in the Historical 

Tables: 1940–2020” table from the Fiscal Year 2016 Budget of the United States 

Government. 
Page 43 GAO-17-317 High-Risk Series

The Bureau is also managing the acquisition and development of new 

and modified IT systems, which add complexity to the design of the 

census. To help control census costs, the Bureau plans to significantly 

change the methods and technology it uses to count the population, such 

as offering an option for households to respond to the survey via the 

Internet or phone, providing mobile devices for field enumerators to 

collect survey data from households, and automating the management of 

field operations. This redesign relies on acquiring and developing many 

new and modified IT systems, which could add complexity to the design.

These cost risks, new innovations, and acquisition and development of IT 

systems for the 2020 Census, along with other challenges we have 

identified in recent years, raise serious concerns about the Bureau’s 

ability to conduct a cost-effective enumeration. Based on these concerns, 

we have concluded that the 2020 Census is a high-risk area and have 

added it to the High-Risk List in 2017.

To help the Bureau mitigate the risks associated with its fundamentally 

new and complex innovations for the 2020 Census, the commitment of 

top leadership is needed to ensure the Bureau’s management, culture, 

and business practices align with a cost-effective enumeration. For 

example, the Bureau needs to continue strategic workforce planning 

efforts to ensure it has the skills and competencies needed to support 

planning and executing the census. It must also rigorously test individual 

census-taking activities to provide information on their feasibility and 

performance, their potential for achieving desired results, and the extent 

to which they are able to function together under full operational 

conditions.36

We have recommended that the Bureau also ensure that its scheduling 

adheres to leading practices and be able to support a quantitative 

schedule risk assessment, such as by having all activities associated with 

the levels of resources and effort needed to complete them. The Bureau 

has stated that it has begun maturing project schedules to ensure that the 

logical relationships are in place and plans to conduct a quantitative risk 

assessment. We will continue to monitor the Bureau’s efforts.

 362020 Census: Additional Actions Could Strengthen Data Collection Efforts, GAO-17-191 

(Washington, D.C.: Jan. 26, 2017).

What Needs to Be Done
Page 44 GAO-17-317 High-Risk Series

The Bureau must also improve its ability to manage, develop, and secure 

its IT systems. For example, the Bureau needs to prioritize its IT 

decisions and determine what information it needs in order to make those 

decisions. In addition, the Bureau needs to make key IT decisions for the 

2020 Census in order to ensure they have enough time to have the 

production systems in place to support the end-to-end system test. To 

this end, we recommended the Bureau ensure that the methodologies for 

answering the Internet response rate and IT infrastructure research 

questions are determined and documented in time to inform key design 

decisions.37 Further, given the numerous and critical dependencies 

between the Census Enterprise Data Collection and Processing and 2020 

Census programs, their parallel implementation tracks, and the 2020 

Census’s immovable deadline, we recommended that the Bureau 

establish a comprehensive and integrated list of all interdependent risks 

facing the two programs, and clearly identify roles and responsibilities for 

managing this list.38 The Bureau stated that it plans to take actions to 

address our recommendations.

It is also critical for the Bureau to have better oversight and control over 

its cost estimation process and we have recommended that the Bureau 

ensure its cost estimate is consistent with our leading practices.39 For 

example, the Bureau will need to, among other practices, document all 

cost-influencing assumptions; describe estimating methodologies used for 

each cost element; ensure that variances between planned and actual 

cost are documented, explained, and reviewed; and include a 

comprehensive sensitivity analysis, so that it can better estimate costs. 

We also recommended that the Bureau implement and institutionalize 

processes or methods for ensuring control over how risk and uncertainty 

are accounted for and communicated within its cost estimation process. 

The Bureau agreed with our recommendations, and we are currently 

conducting a follow-up audit of the Bureau’s most recent cost estimate 

and will determine whether the Bureau has implemented them.

Sustained congressional oversight will be essential as well. In 2015 and 

2016, congressional committees held five hearings focusing on the 

progress of the Bureau’s preparations for the decennial. Going forward, 

 37GAO-15-225.

38GAO-16-623.

39GAO-16-628.
Page 45 GAO-17-317 High-Risk Series

active oversight will be needed to ensure these efforts stay on track, the 

Bureau has needed resources, and Bureau officials are held accountable 

for implementing the enumeration as planned.

We will continue monitoring the Bureau’s efforts to conduct a costeffective enumeration. To this end, we have ongoing work focusing on 

such topics as the Bureau’s updated lifecycle cost estimate and the 

readiness of IT systems for the 2018 End-to-End Test.

See pages 219 – 231 for additional details on what we found.

After we remove areas from the High-Risk List we continue to monitor 

them, as appropriate, to determine if the improvements we have noted 

are sustained and whether new issues emerge. If significant problems 

again arise, we will consider reapplying the high-risk designation. DOD’s 

Personnel Security Clearance Program is one former high-risk area that 

we continue to closely monitor in light of government-wide reform efforts.

The Office of the Director of National Intelligence (ODNI) estimates that 

approximately 4.2 million federal government and contractor employees 

held or were eligible to hold a security clearance as of October 1, 2015.40

Personnel security clearances provide personnel with access to classified

information, the unauthorized disclosure of which could, in certain 

circumstances, cause exceptionally grave damage to national security.

High profile security incidents, such as the disclosure of classified 

programs and documents by a National Security Agency contractor and 

the OPM data breach of 21.5 million records, demonstrate the continued 

need for high-quality background investigations and adjudications, strong 

oversight, and a secure IT process, which have been areas of longstanding challenges for the federal government. 

 40The Director of National Intelligence (DNI) in accordance with Executive Order 13467, is 

responsible, as the Security Executive Agent, for the development of policies and 

procedures governing the conduct of investigations and adjudications for eligibility for 

access to classified information and eligibility to hold a sensitive position. See Exec. Order 

No. 13,467, § 2.3(c), 73 Fed. Reg. 38,103 (June 30, 2008). (renumbered as section 2.5(e) 

in January 2017)(renumbered as section 2.5(e) in January 2017).

.

Monitoring Previous 

High-Risk Areas

Personnel Security 

Clearances
Page 46 GAO-17-317 High-Risk Series

In 2005, we designated the DOD personnel security clearance program

as a high-risk area because of delays in completing background 

investigations and adjudications. We continued the high-risk designation 

in the 2007 and 2009 updates to our High-Risk List because of issues 

with the quality of investigation and adjudication documentation, and 

because delays in the timely processing of security clearances 

continued.41

In our 2011 high-risk report, we removed DOD’s personnel security 

clearance program from the High-Risk List because DOD took actions to 

develop guidance to improve its adjudication process, develop and 

implement tools and metrics to assess quality of investigations and 

adjudications, and improve timeliness for processing clearances.42 We 

also noted that DOD continues to be a prominent player in the overall 

security clearance reform effort, which includes entities within the OMB, 

OPM, and ODNI that comprise the Performance Accountability Council 

(PAC) which oversees security clearance reform. The executive branch 

has also taken steps to monitor its security clearance reform efforts. The 

GPRA Modernization Act of 2010 requires OMB to report through a 

website—performance.gov—on long-term cross-agency priority goals, 

which are outcome-oriented goals covering a limited number of 

crosscutting policy areas, as well as goals to improve management 

across the federal government.43 Among the cross-agency priority goals, 

the executive branch identified security clearance reform as one of the 

key areas it is monitoring.

Since removing DOD’s personnel security clearance program from the 

High-Risk List, the government’s overall reform efforts that began after 

passage of the Intelligence Reform and Terrorism Prevention Act of 2004 

have had mixed progress, and key reform efforts have not yet been 

implemented. In the aftermath of the June 2013 disclosure of classified 

documents by a former National Security Agency contractor and the 

September 2013 shooting at the Washington Navy Yard, OMB issued, in 

February 2014, the Suitability and Security Processes Review Report to 

 41GAO, High-Risk Series: An Update, GAO-07-310 (Washington, D.C.: January 2007); 

and High-Risk Series: An Update, GAO-09-271 (Washington, D.C.: January 2009). 

42GAO, High-Risk Series: An Update, GAO-11-278 (Washington, D.C.: January 2011). 

43See also GAO, Performance.gov: Long-Term Strategy Needed to Improve Website 

Usability, GAO-16-693 (Washington, D.C.: Aug. 30, 2016).
Page 47 GAO-17-317 High-Risk Series

the President, a 120-day review of the government’s processes for 

granting security clearances, among other things.

The 120-day review resulted in 37 recommendations, 65 percent of which 

have been implemented as of October 2016, including the issuance of 

executive branch-wide quality assessment standards for investigations in 

January 2015. Additionally, the recommendations led to expanding 

DOD’s ability to continuously evaluate the continued eligibility of cleared 

personnel. However, other recommendations from the 120-day review 

have not yet been implemented. For example, the reform effort is still 

trying to fully implement the revised background investigation standards 

issued in 2012 and improve data sharing between local, state, and federal 

entities.

In addition, the 120-day review further found that performance measures 

for investigative quality are neither standardized nor implemented 

consistently across the government, and that measuring and ensuring 

quality continues to be a challenge. The review contained three 

recommendations to address the development of quality metrics, but the 

PAC has only partially implemented those recommendations. We 

previously reported that the executive branch had developed some 

metrics to assess quality at different phases of the personnel security 

clearance process; however, those metrics had not been fully developed 

and implemented.44

The development of metrics to assess quality throughout the security 

clearance process has been a long-standing concern.45 Since the late 

1990s we have emphasized the need to build and monitor quality 

throughout the personnel security clearance process.46 In 2009, we again 

 44GAO, Personnel Security Clearances: Full Development and Implementation of Metrics 

Needed to Measure Quality of Process, GAO-14-157T (Washington, D.C.: Oct. 31, 2013).

45GAO, Personnel Security Clearances Funding Estimates and Government-wide Metrics 

Are Needed to Implement Long-Standing Reform Efforts, GAO-15-179SU (Washington, 

D.C.: Apr. 23, 2015). GAO, Personnel Security Clearances: Additional Guidance and 

Oversight Needed at DHS and DOD to Ensure Consistent Application of Revocation

Process, GAO-14-640 (Washington, D.C.: Sept. 8, 2014). GAO, DOD Personnel 

Clearances: Comprehensive Timeliness Reporting, Complete Clearance Documentation, 

and Quality Measures Are Needed to Further Improve the Clearance Process, 

GAO-09-400 (Washington, D.C.: May 19, 2009).

46GAO, DOD Personnel: Inadequate Personnel Security Investigations Pose National 

Security Risks, GAO/NSIAD-00-12 (Washington, D.C.: Oct. 27, 1999).
Page 48 GAO-17-317 High-Risk Series

noted that clearly defined quality metrics can improve the security 

clearance process by enhancing oversight of the time required to process 

security clearances and the quality of the investigation and adjudicative 

decisions. We recommended that OMB provide Congress with results of 

metrics on comprehensive timeliness and the quality of investigations and 

adjudications.47 According to ODNI, in October 2016, ODNI began 

implementation of a Quality Assessment and Reporting Tool to document 

customer issues with background investigations. The tool will be used to 

report on the quality of 5 percent of each executive branch agency’s 

background investigations.

ODNI officials stated that they plan to develop metrics in the future as 

data are gathered from the tool, but did not identify a completion date for 

these metrics. Separately, the NDAA for Fiscal Year 2017, among other 

things, requires DOD to institute a program to collect and maintain data

and metrics on the background investigation process, in the context of 

developing a system for performance of background investigations.48 The 

PAC’s effort to fully address the 120-day review and our 

recommendations on establishing metrics on the quality of investigations 

as well as DOD’s efforts to address the broader requirements in the 

NDAA for Fiscal Year 2017 remain open and will need to be a continued 

focus of the department moving forward in its effort to improve its 

management of the security clearance process.

Further, in response to the 2015 OPM data breach, the PAC completed a 

90-day review which led to an executive order establishing the National 

Background Investigations Bureau, within OPM, to replace the Federal 

Investigative Services and transferred responsibility to develop, maintain 

and secure new IT systems for clearances to DOD.49 Additionally, the 

Executive Order made DOD a full principal member of the PAC.50 The 

Executive Order also directed the PAC to review authorities, roles, and 

responsibilities, including submitting recommendations related to revising, 

 47GAO-09-400.

48See Pub. L. No. 114-328, § 951(b)(1)(G) (2016).

49See Exec. Order No. 13,741, 81 Fed. Reg. 68,289 (Sept. 29, 2016) (amending Exec. 

Order No. 13,467).

50See Exec. Order No. 13,741, § 1(e), 81 Fed. Reg. at 68,289–90. 
Page 49 GAO-17-317 High-Risk Series

as appropriate, executive orders pertaining to security clearances.51 This 

effort is ongoing.

In addition to addressing the quality of security clearances and other 

goals and recommendations outlined in the 120-day and 90-day reviews,

and the government’s cross-agency priority goals, the PAC has the added 

challenge of addressing recent changes that may result from the NDAA 

for Fiscal Year 2017. Specifically, section 951 of the Act requires the 

Secretary of Defense to develop an implementation plan for the Defense 

Security Service to conduct background investigations for certain DOD 

personnel—presently conducted by OPM—after October 1, 2017.52 The 

Secretary of Defense must submit the plan to the congressional defense 

committees by August 1, 2017. It also requires the Secretary of Defense 

and Director of OPM to develop a plan by October 1, 2017, to transfer 

investigative personnel and contracted resources to DOD in proportion to 

the workload if the plan for DOD to conduct the background investigations 

were implemented.53 It is unknown if these potential changes will impact 

recent clearance reform efforts. 

Given the history and inherent challenges of reforming the governmentwide security clearance process, coupled with recent amendments to a 

governing Executive Order and potential changes arising from the NDAA 

for Fiscal Year 2017, we will continue reviewing critical functions for 

personnel security clearance reform and monitor the government’s 

implementation of key reform efforts. We have ongoing work assessing 

progress being made on the overall security clearance reform effort and 

in implementing a continuous evaluation process54, a key reform effort 

considered important to improving the timeliness and quality of 

 51See Exec. Order No. 13,741, § 2, 81 Fed. Reg. at 68,291.

52Specifically, the implementation plan would cover background investigations for DOD 

personnel whose investigations are adjudicated by the DOD Consolidated Adjudication 

Facility. See Pub. L. No. 114-328, § 951(a). According to the Consolidated Adjudication 

Facility, its mission is to determine security clearance eligibility of non-intelligence agency 

DOD personnel, with a customer base including all military service members, military 

applicants, civilian employees, and consultants affiliated with DOD.

53See id.

54Continuous evaluation refers to a vetting process to review the background of an 

individual who has been determined to be eligible for access to classified information or to 

hold a sensitive position at any time during the period of eligibility. It leverages a set of 

automated record checks and business rules to assist in the on-going assessment of 

continued eligibility. Exec. Order No. 13,764, § 3(e) (Jan. 17, 2017).
Page 50 GAO-17-317 High-Risk Series

investigations. We anticipate issuing a report on the status of the 

government’s continuous evaluation process in the fall of 2017. 

Additionally, we have previously reported on the importance of securing 

federal IT systems55 and anticipate issuing a report in early 2017 that 

examines IT security at OPM and efforts to secure these types of critical 

systems. Continued progress in reforming personnel security clearances 

is essential in helping to ensure a federal workforce entrusted to protect 

U.S. government information and property, promote a safe and secure 

work environment, and enhance the U.S. government’s risk management 

approach.

The high-risk assessment continues to be a top priority and we will 

maintain our emphasis on identifying high-risk issues across government 

and on providing insights and sustained attention to help address them, 

by working collaboratively with Congress, agency leaders, and OMB. As 

part of this effort, with the new administration and Congress in 2017 we 

hope to continue to participate in regular meetings with the incoming 

OMB Deputy Director for Management and with top agency officials to 

discuss progress in addressing high-risk areas. Such efforts have been 

critical for the progress that has been made.

This high-risk update is intended to help inform the oversight agenda for 

the 115th Congress and to guide efforts of the administration and 

agencies to improve government performance and reduce waste and 

risks. We are providing this update to the President and Vice President, 

congressional leadership, other Members of Congress, OMB, and the 

heads of major departments and agencies.

Gene L. Dodaro

Comptroller General

of the United States

 55GAO, Information Security: Agencies Need to Improve Controls over Selected HighImpact Systems, GAO-16-501 (Washington, D.C.: May 18, 2016).
Appendix I: Background

Page 51 GAO-17-317 High-Risk Series

In 1990, we began a program to report on government operations that we 

identified as “high risk.” Since then, generally coinciding with the start of 

each new Congress, we have reported on the status of progress 

addressing high-risk areas and have updated the High-Risk List. Our 

most recent high-risk update was in February 2015.1 That update 

identified 32 high-risk areas.

Overall, this program has served to identify and help resolve serious 

weaknesses in areas that involve substantial resources and provide 

critical services to the public. Since our program began, the federal 

government has taken high-risk problems seriously and has made longneeded progress toward correcting them. In a number of cases, progress 

has been sufficient for us to remove the high-risk designation. A summary 

of changes to our High-Risk List over the past 27 years is shown in table 

3. This 2017 update identifies 34 high-risk areas.

Table 3: Changes to the High-Risk List, 1990-2017

Number of areas

Original High-Risk List in 1990 14

High-risk areas added since 1990 46

High-risk areas removed since 1990 24

High-risk areas consolidated since 1990 2

High-Risk List in 2017 34

Source: GAO. | GAO-17-317

To determine which federal government programs and functions should 

be designated high risk, we use our guidance document, Determining 

Performance and Accountability Challenges and High Risks.2 In making 

this determination, we consider whether the program or function is of 

national significance or is key to performance and accountability.

Further, we consider qualitative factors, such as whether the risk

• involves public health or safety, service delivery, national security, 

national defense, economic growth, or privacy or citizens’ rights, or

 1

GAO, High-Risk Series: An Update, GAO-15-290 (Washington, D.C.: Feb. 11, 2015). 

2

GAO, Determining Performance and Accountability Challenges and High Risks, 

GAO-01-159SP (Washington, D.C.: November 2000).

Appendix I: Background

What Is the History of the 

High-Risk Program?

What Are the Criteria for 

Being Added to the HighRisk List?
Appendix I: Background

Page 52 GAO-17-317 High-Risk Series

• could result in significantly impaired service, program failure, injury or 

loss of life, or significantly reduced economy, efficiency, or 

effectiveness.

We also consider the exposure to loss in monetary or other quantitative 

terms. At a minimum, $1 billion must be at risk, in areas such as the value 

of major assets being impaired; revenue sources not being realized; 

major agency assets being lost, stolen, damaged, wasted, or 

underutilized; potential for, or evidence of improper payments; and 

presence of contingencies or potential liabilities.

Before making a high-risk designation, we also consider corrective 

measures planned or under way to resolve a material control weakness 

and the status and effectiveness of these actions.

Our experience has shown that the key elements needed to make 

progress in high-risk areas are top-level attention by the administration 

and agency leaders grounded in the five criteria for removal from the 

High-Risk List, as well as any needed congressional action.3 The five 

criteria for removal that we issued in November 2000 are as follows:

• Leadership Commitment. Demonstrated strong commitment and top 

leadership support.

• Capacity. Agency has the capacity (i.e., people and resources) to 

resolve the risk(s).

• Action Plan. A corrective action plan exists that defines the root 

cause, solutions, and provides for substantially completing corrective 

measures, including steps necessary to implement solutions we 

recommended.

• Monitoring. A program has been instituted to monitor and 

independently validate the effectiveness and sustainability of 

corrective measures.

• Demonstrated Progress. Ability to demonstrate progress in 

implementing corrective measures and in resolving the high-risk area.

 3

GAO-01-159SP. 

What Are the Criteria for 

Removal from the HighRisk List?
Appendix I: Background

Page 53 GAO-17-317 High-Risk Series

The five criteria form a road map for efforts to improve and ultimately 

address high-risk issues. Addressing some of the criteria leads to 

progress, while satisfying all of the criteria is central to removal from the 

list. Our April 2016 report provided additional information drawn from our 

2015 high-risk update on how agencies had made progress addressing 

high-risk issues.4 We provided illustrative actions that agencies took that 

led to progress or removal from our High-Risk List. This information 

provides additional guidance to agencies whose programs are on the 

High-Risk List.

Figure 4 shows the five criteria and illustrative actions taken by agencies 

to address the criteria as cited in that report. Importantly, the actions

listed are not “stand alone” efforts taken in isolation from other actions to 

address high-risk issues. That is, actions taken under one criterion may 

be important to meeting other criteria as well. For example, top leadership 

can demonstrate its commitment by establishing a corrective action plan 

including long-term priorities and goals to address the high-risk issue and 

using data to gauge progress—actions which are also vital to monitoring 

criteria.

 4

GAO, High-Risk Series: Key Actions to Make Progress Addressing High-Risk Issues, 

GAO-16-480R (Washington, D.C.: Apr. 25, 2016).

How Can Agencies Use 

the Criteria to Make 

Progress on High-Risk 

Issues?
Appendix I: Background

Page 54 GAO-17-317 High-Risk Series

Figure 4: Criteria for Removal from the High-Risk List and Examples of Actions Leading to Progress
Appendix I: Background

Page 55 GAO-17-317 High-Risk Series

In each of our high-risk updates, for more than a decade, we have 

assessed progress to address the five criteria for removing a high-risk 

area from the list. In our 2015 update, we added clarity and specificity to 

our assessments by rating each high-risk area’s progress on the criteria 

and used the following definitions:

• Met. Actions have been taken that meet the criterion. There are no

significant actions that need to be taken to further address this 

criterion.

• Partially Met. Some, but not all, actions necessary to meet the 

criterion have been taken.

• Not Met. Few, if any, actions towards meeting the criterion have been 

taken.

Figure 5 shows a visual representation of varying degrees of progress in 

each of the five criteria for a high-risk area. Each point of the star 

represents one of the five criteria for removal from the High-Risk List and 

each ring represents one of the three designations: not met, partially met, 

or met. An unshaded point at the innermost ring means that the criterion 

has not been met, a partially shaded point at the middle ring means that 

the criterion has been partially met, and a fully shaded point at the 

outermost ring means that the criterion has been met.

Further, a plus symbol inside the star indicates the rating for that criteria 

progressed since our last high-risk update in 2015. Likewise, a minus 

symbol inside the star indicates the rating for that criteria declined since 

our last update. At the bottom of the star graphic are summary statements 

showing the number of criteria that have been met as well as the number 

that progressed, declined, or both since the 2015 high-risk update.

How Are High-Risk Areas 

Rated?
Appendix I: Background

Page 56 GAO-17-317 High-Risk Series

Figure 5: High-Risk Progress Criteria Ratings

Some high-risk areas are comprised of segments or subareas that make 

up the overall high-risk area. For example, the high-risk area 

Transforming EPA’s Process for Assessing Toxic Chemicals includes two 

segments—EPA’s Integrated Risk Information System and the Toxic 

Substances Control Act—to reflect two interrelated parts of the overall 

high-risk area. Multidimensional high-risk areas such as these have 

separate ratings for each segment as well as a summary rating of the 

overall high-risk area that reflects a composite of the ratings received 

under the segment for each of the five high-risk criteria.

A summary of areas removed from our High-Risk List over the past 27 

years is shown in figure 6.

What Is the History of

Programs Removed from 

the High-Risk List?
Appendix I: Background

Page 57 GAO-17-317 High-Risk Series

Figure 6: History of Areas Removed from the High-Risk List
Appendix I: Background

Page 58 GAO-17-317 High-Risk Series

The areas on our 2017 High-Risk List, and the year each was designated 

as high risk, are shown in table 4.

Table 4: Year That Areas on GAO’s 2017 High-Risk List Were Designated High Risk

Area Year designated 

high risk

1. Medicare Program 1990 

2. DOD Supply Chain Management 1990 

3. DOD Weapon Systems Acquisition 1990 

4. DOE’s Contract Management for the National Nuclear Security Administration and Office of 

Environmental Management 

1990 

5. NASA Acquisition Management 1990 

6. Enforcement of Tax Laws 1990 

7. DOD Contract Management 1992 

8. DOD Financial Management 1995 

9. DOD Business Systems Modernization 1995 

10. Ensuring the Security of Federal Information Systems and Cyber Critical Infrastructure and Protecting the 

Privacy of Personally Identifiable Information

1997 

11. DOD Support Infrastructure Management 1997 

12. Strategic Human Capital Management 2001 

13. Medicaid Program 2003 

14. Managing Federal Real Property 2003 

15. Improving and Modernizing Federal Disability Programs 2003 

16. Strengthening Department of Homeland Security Management Functions 2003 

17. Pension Benefit Guaranty Corporation Insurance Programs 2003 

18. DOD Approach to Business Transformation 2005 

19. National Flood Insurance Program 2006 

20. Funding the Nation’s Surface Transportation System 2007 

21. Ensuring the Effective Protection of Technologies Critical to U.S. National Security Interests 2007 

22. Improving Federal Oversight of Food Safety 2007 

23. Modernizing the U.S. Financial Regulatory System and Federal Role in Housing Finance 2009 

24. Protecting Public Health through Enhanced Oversight of Medical Products 2009 

25. Transforming EPA’s Processes for Assessing and Controlling Toxic Chemicals 2009 

26. Restructuring the U.S. Postal Service to Achieve Sustainable Financial Viability 2009 

27. Management of Federal Oil and Gas Resources 2011 

28. Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks 2013 

29. Mitigating Gaps in Weather Satellite Data 2013 

30. Managing Risks and Improving VA Health Care 2015 

31. Improving the Management of IT Acquisitions and Operations 2015 

When Were Areas Added 

to the High-Risk List?
Appendix I: Background

Page 59 GAO-17-317 High-Risk Series

Area Year designated 

high risk

32. Improving Federal Programs that Serve Tribes and Their Members 2017

33. U.S. Government’s Environmental Liabilities 2017

34. 2020 Decennial Census 2017

Source: GAO. | GAO-17-317
Appendix II: Overview for Each High-Risk Area

Page 60 GAO-17-317 High-Risk Series

The following pages provide overviews of the 34 high-risk areas on our 

updated list. Each overview discusses (1) why the area is high risk, (2) 

the actions that have been taken and that are under way to address the 

problem since our last update in 2015, and (3) what remains to be done. 

Each of these high-risk areas is also described on our High-Risk List 

website, http://www.gao.gov/highrisk/overview. We also provide additional 

details on the one area that was removed from the High-Risk List in 2017.

Appendix II: Overview for Each High-Risk 

Area
Strategic Human Capital Management

Page 61 GAO-17-317 High-Risk Series

Since we last reported on government-wide efforts to address skills gaps, 

the Office of Personnel Management (OPM), the Chief Human Capital 

Officers (CHCO) Council,1 and individual agencies have strengthened 

their leadership over this area; however, OPM and agencies have only 

partially met the criteria for removal from the High-Risk List. Missioncritical skills gaps within the federal workforce pose a high risk to the 

nation. Regardless of whether the shortfalls are in such government-wide 

occupations as cybersecurity and acquisitions, or in agency-specific 

occupations such as nurses at the Veterans Health Administration (VHA), 

skills gaps impede the federal government from cost-effectively serving 

the public and achieving results. Agencies can have skills gaps for 

different reasons: they may have an insufficient number of people or their 

people may not have the appropriate skills or abilities to accomplish 

mission-critical work. Moreover, current budget and long-term fiscal 

pressures, the changing nature of federal work, and a potential wave of 

employee retirements that could produce gaps in leadership and 

institutional knowledge, threaten to aggravate the problems created by 

existing skills gaps. Indeed, the government’s capacity to address 

complex challenges such as disaster response, national and homeland 

security, and rapidly-evolving technology and privacy security issues 

requires a skilled federal workforce able to work seamlessly with other 

agencies, with other levels of government, and across sectors.

We first added strategic human capital management to the High-Risk List 

in 2001.2 In our 2015 update, we noted that while OPM and agencies had 

made strides in developing an infrastructure for identifying and 

addressing skills gaps, they needed to do additional work to more fully 

use workforce analytics to identify their gaps, implement specific 

strategies to address these gaps, and evaluate the results of actions 

taken so as to demonstrate progress in closing the gaps.3 Mission critical 

skills gaps were also a factor in making other areas across government 

high risk. Of the 34 other high-risk areas covered in this report, 15 

 1

The CHCO Council is an interagency body composed of the Director of OPM, the Deputy 

Director for Management at the Office of Management and Budget (OMB), CHCOs from 

Executive departments, and other members designated by the Director. The CHCO 

Council, among other things, advises OPM, OMB, and agency leaders on human capital 

strategies and policies as well as assesses federal workforce characteristics and future 

needs.

2

GAO, High-Risk Series: An Update, GAO-01-263 (Washington, D.C.: Jan. 1, 2001).

3

GAO, High-Risk Series: An Update, GAO-15-290 (Washington, D.C.: Feb. 11, 2015).

Strategic Human Capital Management

Why Area Is High 

Risk
Strategic Human Capital Management

Page 62 GAO-17-317 High-Risk Series

areas—such as IT management, acquisitions, and management of oil and 

gas resources—had skills gaps playing a contributory role.4

Since we last reported on government-wide efforts to address skills gaps, 

OPM, the CHCO Council, and individual agencies have strengthened 

their leadership over this area, including establishing a new human capital 

framework to guide their efforts. In doing so, they have (1) taken 

important steps to institutionalize efforts to close skills gaps and (2) 

enhanced the analytical method used to identify skills gaps. However, 

OPM and agencies have only partially met the criteria for removal from 

the High-Risk List for developing the capacity to close skills gaps, 

designing and implementing action plan strategies for closing skills gaps, 

and monitoring efforts to close existing skills gaps as well as identify 

emerging ones. Additionally, OPM and agencies have not yet 

demonstrated sustainable progress in closing skills gaps.

To date, Congress has provided agencies with authorities and flexibilities 

to manage the federal workforce and make the federal government a 

more accountable employer. For example, Congress included a provision 

in the National Defense Authorization Act for Fiscal Year 2016 to extend 

the probationary period for newly hired civilian Department of Defense 

(DOD) employees from 1 year to 2 years.5 As we noted in our 2015 

report, better use of probationary periods gives agencies the ability to 

ensure an employee’s skills are a good fit for all critical areas of a 

particular job. Dismissing employees who cannot do the work becomes 

more difficult and time consuming after the probationary period because 

 4

The complete list of sections in this report that feature skills gap findings includes: 

Management of Federal Oil and Gas Resources; Managing Federal Real Property; 

Improving the Management of IT Acquisitions and Operations; Department of Defense 

(DOD) Business Systems Modernization; DOD Financial Management; Strengthening 

Department of Homeland Security (DHS) Management Functions; Ensuring the Security 

of Federal Information Systems and Cyber-Critical Information and Protecting the Privacy 

of Personally Identifiable Information; Protecting Public Health through Enhanced 

Oversight of Medical Products; Transforming the Environmental Protection Agency’s 

(EPA) Processes for Assessing and Controlling Toxic Chemicals; DOD Contract 

Management; Department of Energy (DOE)’s Contract Management for the National 

Nuclear Security Administration and Office of Environmental Management; National 

Aeronautics and Space Administration (NASA) Acquisition Management; Enforcement of 

Tax Laws; Managing Risks and Improving Department of Veterans Affairs (VA) Health 

Care; and Improving Federal Management of Indian Programs. 

5

Pub. L. No. 114-92, div. A, title XI, § 1105, 129 Stat. 726, 1023-1024, codified at 10 

U.S.C. § 1599e.

What GAO Found
Strategic Human Capital Management

Page 63 GAO-17-317 High-Risk Series

of the procedural requirements agencies must follow and the greater 

appeal rights afforded.6

Further, oversight hearings held by the House and Senate focusing on 

federal human capital management challenges have been important for 

ensuring that OPM and agencies continue to make progress in acquiring, 

developing, and retaining employees with the skills needed to carry out 

the government’s vital work.

OPM and agencies can continue taking actions to address skills gaps 

with respect to capacity, action plan, monitoring, and demonstrated 

progress. In particular, we have identified several priority 

recommendations to OPM, in its role as leader for human capital 

management in the federal government:

• OPM needs to strengthen the approach and methodology for 

addressing skills gaps by working with agencies to develop targets 

that are clear, measurable, and outcome-oriented.

• OPM needs to establish a schedule specifying when it will modify its 

EHRI database to collect staffing data, in concert with agency 

CHCOs, and needs to help bolster agencies’ ability to assess 

workforce competencies, either by sharing competency surveys, 

disseminating lessons learned, or by other means.

• OPM, in consultation with the CHCO Council, should develop a core 

set of human capital metrics that agencies can use to monitor 

progress in closing skills gaps through HRstat reviews, and OPM 

should ensure that these efforts are coordinated with other agency 

skills gap initiatives.

Individual agencies must also take steps to address skills gaps identified 

in our prior work. For example, we recommended that the Department of 

Veterans Affairs (VA) institute a system-wide evaluation of the initiatives 

to recruit and retain VHA nurses.7 Doing so could provide VHA with better 

data to identify resource needs across its medical centers and ensure that 

 6

GAO, Federal Workforce: Improved Supervision and Better Use of Probationary Periods 

Are Needed to Address Substandard Employee Performance, GAO-15-191 (Washington, 

D.C.: Feb. 6, 2015).

7

GAO, VA Health Care: Oversight Improvements Needed for Nurse Recruitment and 

Retention Initiatives, GAO-15-794 (Washington, D.C.: Sept. 30, 2015). 

What Remains to Be 

Done
Strategic Human Capital Management

Page 64 GAO-17-317 High-Risk Series

its nursing workforce is keeping pace with the health care needs of 

veterans. VA agreed with our recommendation and indicated in August 

2016 that it had formed a working group that is charged with reporting on 

observations from data on recruitment and retention effectiveness by 

October 2017.

Continued congressional attention to improving the government’s human 

capital policies and procedures will be essential going forward. For 

example, in our August 2016 report, to help improve the federal hiring 

process, we recommended that OPM assess the effectiveness of 

government hiring authorities to determine whether opportunities exist to 

refine, consolidate, eliminate, or expand them.8 In cases where legislation 

would be necessary to implement changes, we recommended that OPM 

should work with the CHCO Council to develop legislative proposals. 

OPM concurred with this recommendation and said it would work with the 

CHCO Council and others to develop proposals as appropriate.

OPM and agencies have fully met the leadership criterion for removal 

from the High-Risk List. In December 2016, OPM finalized revisions to its 

strategic human capital management regulation that include the new 

Human Capital Framework.9 This framework is to be used by agencies to 

plan, implement, evaluate, and improve human capital policies and 

programs. Additionally, the revised regulation provides that agency 

human capital policies and programs must monitor and address skills 

gaps within government-wide and agency-specific mission-critical 

occupations by using comprehensive data analytic methods and gap 

closure strategies. The revised regulation also requires that agency 

leadership participate in a quarterly, data-driven review process known as 

 8

GAO, Federal Hiring: OPM Needs to Improve Management and Oversight of Hiring 

Authorities, GAO-16-521 (Washington, D.C.: Aug. 2, 2016).

9

Personnel Management in Agencies, 81 Fed. Reg. 89,357 (Dec. 12, 2016) (to be codified 

at 5 C.F.R. pt. 250, subpt. B).

Additional Details on 

What GAO Found

Leadership Commitment
Strategic Human Capital Management

Page 65 GAO-17-317 High-Risk Series

HRstat,10 which, as we reported in 2015, could be an important tool in 

reviewing key performance metrics related to closing skills gaps.

OPM and the CHCO Council also improved the method that agencies use 

to identify mission-critical occupations with skills gaps, in response to our 

recommendation. We previously reviewed the CHCO Council’s 2011-

2012 efforts to identify skills gaps. We reported that those efforts lacked a 

quantitative grounding and the CHCO Council did not use workforce 

analytics, such as employee attrition rates, until after it had already 

selected an initial set of occupations based on qualitative methods.11 In 

2015, OPM and the CHCO Council worked with agencies to refine their 

inventory of government-wide and agency-specific skills gaps. They 

narrowed the scope for identifying skills gaps by using a quantitative 

multi-factor model—which included the 2-year retention rate, the quit rate, 

retirement rate, and average manager satisfaction with applicant quality. 

Using this model, OPM, the CHCO Council, and agencies identified six 

government-wide occupational areas with mission-critical skills gaps:

• Cybersecurity;

• Acquisition;

• Human Resources Specialist;

• Auditor;

• Economist; and

• The Science, Technology, Engineering, and Mathematics (STEM) 

functional area.

OPM and the CHCO Council asked individual agencies to use the same 

process to identify 2 to 3 occupations within their own agency, resulting in 

48 unique occupations with agency-specific skills gaps among the 24 

Chief Financial Officers Act agencies.

OPM also worked with the Office of Management and Budget (OMB) to 

issue guidance in November 2016 that outlined three broad objectives 

 10OPM established HRstat as a pilot in May 2012 whereby agency CHCOs would hold 

quarterly review sessions to assess progress against performance metrics that contribute 

to agency human resources goals. This pilot built on the quarterly data-driven reviews that 

were required for agency priority goals under the GPRA Modernization Act of 2010.

11GAO, Federal Workforce: OPM and Agencies Need to Strengthen Efforts to Identify and 

Close Mission-Critical Skills Gaps, GAO-15-223 (Washington, D.C.: Jan. 30, 2015).
Strategic Human Capital Management

Page 66 GAO-17-317 High-Risk Series

and seven practices agencies should use to achieve excellence in 

hiring.12 As part of OPM’s People and Culture Cross-Agency Priority goal, 

this memorandum encouraged agencies to, among other things, use data 

to inform workforce planning and strategic recruitment—as well as fully 

leverage relevant hiring authorities—consistent with our prior 

recommendations.

With these actions, OPM, the CHCO Council, and agencies have built a 

framework to address skills gaps. It will be important for OPM to sustain 

this leadership commitment through budgetary challenges and the 

transition to a new administration so that institutional gains are not lost.

OPM and agencies have partially met this criterion. After agencies 

identified sets of occupations with skills gaps, OPM and the CHCO 

Council worked with the agencies to establish working groups of 

occupational leaders and CHCO representatives—known as Federal 

Agency Skills Teams (FAST). According to OPM, the FASTs are to 

analyze root causes, develop strategies to address skills gaps through 

action plans, and monitor progress in closing skills gaps within each 

occupation. Beginning in January 2017, each FAST for both governmentwide and agency-specific skills gaps is to report quarterly to OPM on 

progress and ensure that action plan strategies and performance metrics 

are aligned with the root cause analyses performed by the FASTs. These 

institutional resources can help sustain efforts to address skills gaps 

going forward.

OPM has made less progress on other aspects of capacity building. For 

example, OPM has not finalized efforts to centralize collection of agency 

staffing data that could be used to detect emerging skills gaps. OPM 

officials have reported that modifying the Enterprise Human Resources 

Integration (EHRI) database to perform this function may not be feasible. 

Moreover, OPM officials reported that they were still working with 

stakeholders to develop a framework to assist agencies in assessing 

competencies. We reported, in 2015, that agencies vary in the extent to 

which they assess competencies, and thus some agencies have limited 

ability to respond to external workforce planning factors, despite the 

importance of conducting these assessments.13 Without more rigorous 

 12OPM and OMB, Institutionalizing Hiring Excellence to Achieve Mission Outcomes, OMB 

and OPM Memorandum M-17-03 (Nov. 1, 2016).

13GAO-15-223.

Capacity
Strategic Human Capital Management

Page 67 GAO-17-317 High-Risk Series

data collection across government on the number and skills of people 

filling mission-critical occupations, OPM and agencies may be unable to 

build the predictive capacity to identify and address emerging skills gaps.

OPM and agencies have partially met this criterion. Working with the 

CHCO Council, OPM designed an action plan template that agency 

FASTs are to use as a model. In reviewing past efforts to address skills 

gaps, we found that agencies’ planning documents did not always adhere 

to best practices for project planning. We found that some plans did not 

consistently identify the root causes of the skills gaps, assign roles and 

responsibilities for implementing actions, or develop and use outcomeoriented performance metrics.14 OPM and the CHCO Council included all 

of these practices in their most recent template, which asks each agency 

FAST to identify key actions, responsible parties for those actions, 

milestones, time frames, and performance metrics for monitoring 

progress and skills gap risk reduction and closure. Moreover, the 

template asks FASTs to explain how the actions discussed in the 

document relate to the root cause of that skills gap. Going forward, OPM 

and the CHCO Council will need to ensure that agencies and their FASTs 

use the template appropriately and incorporate the best practices into 

their action plans.

OPM has yet to show, however, whether agencies are consistently 

adopting these practices in their action plans. As of the end of 2016, nine 

agencies had not submitted action plans for closing skills gaps. OPM 

officials noted that they are still working with agencies on the submission 

of the outstanding plans.

OPM and agencies have partially met this criterion. Agencies can take a 

number of actions to meet the monitoring criterion for removal from the 

High-Risk List, such as (1) holding frequent review meetings to assess 

status and performance, (2) reporting to senior managers on program 

progress and potential risks, and (3) tracking progress against goals. As 

noted, OPM’s revisions to its strategic human capital management 

regulations will require agency leadership to participate in quarterly, datadriven HRstat review sessions, and beginning in 2017 each FAST is to 

report quarterly to OPM and show that action plan strategies are aligned 

with monitored performance metrics. Together, these two actions could 

 14GAO-15-223.

Action Plan

Monitoring
Strategic Human Capital Management

Page 68 GAO-17-317 High-Risk Series

help ensure that skills gaps receive the visibility and attention of senior 

managers—as well as the accountability that comes from presenting 

quarterly results—that have been applied to other human capital 

challenges such as improving employee engagement.

However, OPM could do more to assist agencies in developing consistent 

practices for HRstat and to improve the visibility of skills gaps to 

managers. In 2015, we recommended that OPM work with the CHCO 

Council to develop a core set of metrics that agencies should use in 

HRstat to track common skills gap challenges, while still allowing 

agencies discretion to include metrics that meet their specific needs.15 In 

response to our recommendation, OPM officials stated that they consider 

HRstat an agency-centric initiative and that, while OPM has no plans to 

prescribe a core set of skills gap metrics that all agencies must use for 

HRstat, OPM may recommend metrics for each type of skills gap 

challenge (e.g., training, recruitment, staffing, or competency 

assessments) that an agency may encounter. OPM has, however, used 

its November 2016 guidance to recommend specific metrics to be tracked 

in HRstat that are tailored to improving hiring practices.16 We maintain 

that this practice should be applied to skills gaps in general and that an 

appropriate core set of metrics would be beneficial because it would (1) 

help ensure agencies were monitoring skills gaps with a consistent set of 

robust metrics, (2) provide OPM and Congress greater visibility over 

government-wide progress in addressing skills gaps, and (3) help OPM 

and agencies target government-wide actions toward those areas where 

progress is lagging across agencies.

OPM officials have also said that they have no plans to require agencies 

to integrate the work of their FASTs with their HRstat reviews. OPM 

officials again cited deference to agencies on identifying the most 

appropriate metrics to use for their HRstat reviews. The quarterly 

reporting mechanism that OPM has instituted with each agency FAST 

could be an effective monitoring tool going forward; however, requiring 

agencies to routinely monitor skills gap metrics as part of the mandatory 

HRstat reviews could increase the visibility and urgency of skills gaps for 

top agency management.

 15GAO-15-223.

16OPM and OMB, Institutionalizing Hiring Excellence to Achieve Mission Outcomes, OMB 

and OPM Memorandum M-17-03 (Nov. 1, 2016).
Strategic Human Capital Management

Page 69 GAO-17-317 High-Risk Series

OPM and agencies have not met this criterion because at present there 

are no government-wide targets or goals for closing skills gaps, and 

agencies are not reporting progress. In our 2015 review we reported that 

government-wide goals to close skills gaps lacked clarity and 

measurability. OPM previously had a Cross Agency Priority (CAP) goal to 

close skills gaps by 50 percent in at least 3 of the government-wide 

mission-critical occupations by the end of fiscal year 2013. The CAP Goal 

on skills gaps provided important visibility across the government. 

Following the expiration of this CAP Goal, the Fiscal Year 2015 Budget 

included a 4-year CAP Goal on People and Culture that included 

workforce planning elements related to skills gaps but had no 

government-wide performance targets for closing skills gaps. Currently 

there are no government-wide goals regarding skills gaps that have the 

same visibility that the prior CAP Goal provided. As a result, it is unclear 

what would be the appropriate yardstick for closing skills gaps across the 

government.

OPM and agencies also have not reached the stage of reporting progress 

on strategies to close skills gaps. As part of the multi-year process OPM 

and the CHCO Council have developed with agency FASTs, OPM 

expects to see agencies reporting progress according to their 

performance metrics by September 2017. As noted above, not all 

agencies have even drafted action plans with performance metrics as of 

December 2016.

Strengthening agencies’ abilities to identify and close skills gaps is critical 

because they can affect mission accomplishment across the government. 

Since our 2015 high-risk report, we have published over two dozen 

additional reports with findings related to skills gaps. Additionally, as 

noted above, 15 other sections in this report feature discussions related 

to skills gaps. Included in the examples below are issues found elsewhere 

in the 2017 high-risk report.

• Information Technology (IT) Workforce. We have underscored IT 

skills gaps in prior high-risk reports, and elements of the IT workforce–

particularly cybersecurity– have been highlighted in OPM’s skills gap 

efforts since 2011. Challenges remain in this area. In November 2016, 

we reported that five selected agencies17 had not consistently applied 

key workforce planning steps and activities that help to ensure that 

 17These five agencies are the Departments of Commerce, Defense, Health and Human 

Services, Transportation, and the Treasury. 

Demonstrated Progress
Strategic Human Capital Management

Page 70 GAO-17-317 High-Risk Series

program staff members have the knowledge and skills critical to 

successfully acquire IT investments.18 Moreover, we reported in April 

2016 that the Federal Emergency Management Agency (FEMA) had 

not established time frames for completing its workforce planning 

activities and lacked an understanding of its regional IT workforce.19

In particular, FEMA’s 2014 competency assessment only covered part 

of its IT workforce, and multiple regional offices told us that they faced 

shortages in IT staff, such as computer and network engineers. 

Without a better understanding of its current IT workforce, FEMA will 

be unable to address its workforce planning needs and may not have 

the skills needed to respond to major disasters. The Department of 

Homeland Security (DHS) concurred in April 2016 with our 

recommendation to establish time frames for current and future 

workforce planning, and we will verify these efforts going forward. See 

Improving the Management of IT Acquisitions and Operations on page 

180 for more information.

• Acquisition Management. Agencies have continued to face 

challenges in hiring sufficient staff and in monitoring the competencies 

of its workforce in acquisitions, an area we have highlighted in prior 

high-risk reports. For instance, DHS’s 2016 staffing assessments did 

not take into account all acquisition-related positions, potentially 

limiting DHS’s insight into the size and nature of potential staffing 

shortfalls. DHS announced plans in December 2016 to pilot new 

staffing assessment guidance to be more inclusive of acquisition 

positions, but the timing of full implementation is not yet known. 

Additionally, in December 2015, we found that while DOD has 

assessed workforce competencies for nearly all of its 13 career 

acquisition fields, the agency has not established a timeline for 

reassessing competencies in 10 of those fields to gauge progress 

addressing previously identified gaps.20 Officials agreed with our 

recommendation to work with functional leaders in setting timeframes 

for completing future career field competency assessments and, 

according to an October 2016 workforce strategic plan, intend to 

conduct career field competency assessments at a minimum of every 

 18GAO, IT Workforce: Key Practices Help Ensure Strong Integrated Program Teams; 

Selected Departments Need to Assess Skill Gaps, GAO-17-8 (Washington, D.C.: Nov. 30, 

2016).

19GAO, Information Technology: FEMA Needs to Address Management Weaknesses to 

Improve Its Systems, GAO-16-306 (Washington, D.C.: Apr. 5, 2016).

20GAO, Defense Acquisition Workforce: Actions Needed to Guide Planning Efforts and 

Improve Workforce Capability, GAO-16-80 (Washington, D.C.: Dec. 14, 2015).
Strategic Human Capital Management

Page 71 GAO-17-317 High-Risk Series

5 years. Doing so will better allow the agency to track improvements 

in the capability of a workforce that oversaw $273.5 billion in contracts 

for goods and services in fiscal year 2015. See Strengthening 

Department of Homeland Security Management Functions on page 

354 and DOD Contract Management on page 483 for more 

information.

• Oil and Gas Management. In 2014, we recommended that The 

Department of the Interior (Interior) should collect data on hiring times 

and explore the expanded use of existing authorities to retain key oil 

and gas oversight positions, such as petroleum engineers, geologists, 

and geophysicists.21 In September 2016, we found that Interior 

continued to face challenges hiring and retaining staff for these 

positions and has taken steps to address low salaries and lengthy 

hiring times for certain occupations but has not evaluated the 

effectiveness of such measures.22 Moreover, Interior has not 

evaluated training needs or the effectiveness of existing training and 

has not promoted collaboration across its bureaus to discuss and 

address shared hiring and retention challenges. We recommended 

that Interior take steps to evaluate its training programs and promote 

cross-bureau hiring collaboration. In response to our 

recommendations, Interior officials indicated that their Office of Policy, 

Management, and Budget would monitor cross-bureau collaboration 

on a range of issues including hiring, retention, and training through 

ongoing quarterly performance reviews and that Interior’s bureaus 

would coordinate their training needs. See Management of Federal Oil 

and Gas Resources on page 136 for more information.

• Veterans Health Administration (VHA) Human Resources 

Personnel. In our December 2016 report on VHA’s human resources 

(HR) capacity, we recommended that VHA (1) develop its own 

comprehensive competency assessment tool for HR staff that 

evaluates knowledge of all three of VHA’s personnel systems and (2) 

ensure that all VHA HR staff complete it so that VHA may use the 

data to identify and address competency gaps among medical center 

 21GAO, Oil and Gas: Interior Has Begun to Address Hiring and Retention Challenges but 

Needs to Do More, GAO-14-205 (Washington, D.C.: Jan. 31, 2014). 

22GAO, Oil and Gas Oversight: Interior Has Taken Steps to Address Staff Hiring, 

Retention, and Training but Needs a More Evaluative and Collaborative Approach,

GAO-16-742 (Washington, D.C.: Sept. 29, 2016).
Strategic Human Capital Management

Page 72 GAO-17-317 High-Risk Series

HR staff.23 Without such a tool, VHA will have limited insights into the 

abilities of its HR staff and be ill-positioned to provide necessary 

support and training. The Department of Veterans Affairs (VA) agreed 

with both recommendations and indicated it has realigned its HR 

training office to ensure that a comprehensive competency 

assessment tool be developed and implemented. See Managing 

Risks and Improving VA Health Care on page 627 for more 

information.

• Oversight of Medical Products. As part of our December 2016 

report, we found that vacancies at foreign Food and Drug 

Administration (FDA) offices persist.24 As of July 2016, 46 percent of 

foreign offices’ authorized positions, including those covering staff 

conducting medical product investigations, were vacant, and we found 

that FDA still faces challenges in recruiting staff to these positions. 

While FDA has set a goal for reducing this vacancy rate, the 

performance measure selected to track progress on this goal includes 

both foreign and domestic staff in FDA’s Office of International 

Programs. FDA could thus fulfill its overall vacancy goal without 

lowering vacancies in foreign offices. The Department of Health and 

Human Services (HHS) agreed with our December 2016 

recommendation to establish staffing goals by position type at foreign 

offices, and FDA indicated that recruiting and hiring have long been 

challenges at these offices. We will monitor future developments in 

FDA’s foreign inspection staffing. See Protecting Public Health 

through Enhanced Oversight of Medical Products on page 400 for 

more information.

In addition, our work published since the 2015 high-risk report has 

identified additional skills gaps that will require agencies’ attention 

because of their operational impact. For example, we reported in October 

2015 that the Small Business Administration (SBA) did not have an up-todate agency-wide competency assessment.25 Officials said that when 

SBA centralized its loan processing functions—and thus removed these 

 23GAO, Veterans Health Administration: Management Attention Is Needed to Address 

Systemic, Long-standing Human Capital Challenges, GAO-17-30 (Washington, D.C.: Dec. 

23, 2016).

24GAO, Drug Safety: FDA Has Improved Its Foreign Drug Inspection Program, but Needs 

to Assess the Effectiveness and Staffing of Its Foreign Offices, GAO-17-143 (Washington, 

D.C.: Dec. 16, 2016). 

25GAO, Small Business Administration: Leadership Attention Needed to Overcome 

Management Challenges, GAO-15-347 (Washington, D.C.: Sept. 22, 2015).
Strategic Human Capital Management

Page 73 GAO-17-317 High-Risk Series

functions from the agency’s district offices—as part of a 2004 

reorganization, district offices had to take on new responsibilities, and 

certain staff no longer had skills that matched their day-to-day work. For 

example, employees with financial backgrounds—needed to process 

loans—were now asked to perform marketing and business development 

tasks. SBA also noted that the skills gap had been compounded by recent 

changes in job requirements and new initiatives that required new skill 

sets for its employees. SBA agreed with our recommendation to complete 

a workforce plan that includes a competency and skills gap assessment, 

and in October 2016 SBA indicated it had finalized such an assessment 

and would be incorporating it into its strategic workforce planning 

process.

Going forward, agencies will need to continue to monitor these and other 

existing and newly emerging skills gap challenges. Managing these 

challenges is especially important because, as we have reported 

previously, agencies are facing a wave of potential retirements, as figure 

7 shows. According to OPM data, government-wide over 34 percent of 

federal employees on board by the end of fiscal year 2015 will be eligible 

to retire by 2020. Some agencies, such as the Department of Housing 

and Urban Development, will have particularly high eligibility levels by 

2020.
Strategic Human Capital Management

Page 74 GAO-17-317 High-Risk Series

Figure 7: Percentage of Career Permanent Employees, on Board as of September 30, 2015, Eligible to Retire by 2020 by 

Agency

Notes: Our calculations include permanent employees in the competitive service, the excepted 

service, and the senior executive service with all work schedules (e.g. full time, part time, seasonal, 

and intermittent). Retirement eligibility is not affected by work schedule. Temporary and term 

employees are excluded.

“Eligible to retire” is defined as the year in which a person is first eligible for retirement with unreduced 

annuity. Data are from the OPM EHRI database.

EHRI covers federal civilian employees at most Executive Branch agencies and some Legislative 

Branch agencies. Among those agencies excluded from EHRI are the Central Intelligence Agency 

and other intelligence organizations; the U.S. Postal Service; Tennessee Valley Authority; and the 

White House Office.

The total number of employees included in our calculations on Jan. 17, 2017 is 1,712,547.

Various factors can affect when individuals actually retire, and some 

amount of retirement and other forms of attrition can be beneficial 

because it creates opportunities to bring fresh skills on board and it allows 

organizations to restructure themselves to better meet program goals and 

fiscal realities. But if turnover is not strategically monitored and managed, 
Strategic Human Capital Management

Page 75 GAO-17-317 High-Risk Series

gaps can develop in an organization’s institutional knowledge and 

leadership.

For additional information about this high-risk area, contact Robert 

Goldenkoff at 202-512-6806 or GoldenkoffR@gao.gov or Yvonne Jones 

at 202-512-6806 or JonesY@gao.gov.

Veterans Health Administration: Management Attention Is Needed to 

Address Systemic, Long-standing Human Capital Challenges. 

GAO-17-30. Washington, D.C.: December 23, 2016.

Drug Safety: FDA Has Improved Its Foreign Drug Inspection Program, but 

Needs to Assess the Effectiveness and Staffing of Its Foreign Offices. 

GAO-17-143. Washington, D.C.: December 16, 2016.

IT Workforce: Key Practices Help Ensure Strong Integrated Program 

Teams; Selected Departments Need to Assess Skill Gaps. GAO-17-8. 

Washington, D.C.: November 30, 2016.

Oil and Gas Oversight: Interior Has Taken Steps to Address Staff Hiring, 

Retention, and Training but Needs a More Evaluative and Collaborative 

Approach. GAO-16-742. Washington, D.C.: September 29, 2016.

Aviation Security: TSA Should Ensure Testing Data Are Complete and 

Fully Used to Improve Screener Training and Operations. GAO-16-704. 

Washington, D.C.: September 7, 2016.

Federal Hiring: OPM Needs to Improve Management and Oversight of 

Hiring Authorities. GAO-16-521. Washington, D.C.: August 2, 2016.

Information Technology: FEMA Needs to Address Management 

Weaknesses to Improve Its Systems. GAO-16-306. Washington, D.C.: 

April 5, 2016.

Defense Acquisition Workforce: Actions Needed to Guide Planning Efforts 

and Improve Workforce Capability. GAO-16-80. Washington, D.C.: 

December 14, 2015.

VA Health Care: Oversight Improvements Needed for Nurse Recruitment 

and Retention Initiatives. GAO-15-794. Washington, D.C.: October 30, 

2015.

GAO Contact

Related GAO 

Products
Strategic Human Capital Management

Page 76 GAO-17-317 High-Risk Series

Small Business Administration: Leadership Attention Needed to 

Overcome Management Challenges. GAO-15-347. Washington, D.C.: 

September 22, 2015.

Federal Workforce: Improved Supervision and Better Use of Probationary 

Periods Are Needed to Address Substandard Employee Performance. 

GAO-15-191. Washington, D.C.: February 6, 2015.

Federal Workforce: OPM and Agencies Need to Strengthen Efforts to 

Identify and Close Mission-Critical Skills Gaps. GAO-15-223. Washington, 

D.C.: January 30, 2015.
Managing Federal Real Property

Page 77 GAO-17-317 High-Risk Series

The federal government’s real estate portfolio is vast and diverse—

including approximately 273,000 buildings that are leased or owned in the 

United States and that cost billions of dollars annually to operate and 

maintain by civilian and defense agencies.1 Since federal real property 

management was placed on the High-Risk List in 2003, the federal 

government has given high-level attention to this issue, such as issuing 

the National Strategy for the Efficient Use of Real Property (National 

Strategy) in 2015, which provides a foundation to further assist agencies 

in strategically managing their real property inventories. However, federal 

agencies continue to face long-standing challenges in several areas of 

real property management, including: (1) disposing of excess and 

underutilized property effectively, (2) relying too heavily on leasing, (3) 

collecting reliable real property data to support decision making, and (4) 

protecting federal facilities. Issues with the reliability of the Federal Real 

Property Profile (FRPP) data—particularly the utilization variable—make it 

difficult to quantify the overall number of vacant and underutilized federal 

buildings.

In September 2016, we reported on some vacant properties in the 

Washington, D.C., area that illustrate the challenges associated with 

disposing of or repurposing vacant property.2 Figure 8 illustrates the 

following examples:

• The Cotton Annex: This building, held by the General Services 

Administration (GSA), which serves as the federal government’s 

primary disposal agent, is located just a couple blocks off the National 

Mall in Washington, D.C., is approximately 118,000 gross square feet 

and has been vacant since 2007. In 2016, we found that GSA’s recent 

attempt to exchange the property for construction services failed when 

GSA was unable to obtain sufficient value from the exchange, making 

the fate of this unneeded building unclear.

• GSA Warehouses: In 2014, we found that some GSA warehouses 

listed in FRPP as used had been vacant for as long as 10 years. GSA 

only lists warehouses as unused if they are in the process of being 

 1

This number reflects the most recent data—as of September 30, 2015—on leased and 

federally owned properties reported by Chief Financial Officer (CFO) Act agencies that 

report into the Federal Real Property Profile (FRPP). Some agencies, such as the United 

States Postal Service, are not required to submit real property data to the FRPP and are 

therefore not included in this summary. 

2

GAO, Federal Real Property: Efforts Made, but Challenges Remain in Reducing 

Unneeded Facilities, GAO-16-869T (Washington, D.C.: Sept. 23, 2016). 

Managing Federal Real Property

Why Area Is High 

Risk
Managing Federal Real Property

Page 78 GAO-17-317 High-Risk Series

disposed. Interpreting use this way in FRPP caused GSA to list as 

used some warehouses that had been vacant for years. We made a 

priority recommendation to GSA, to improve the way GSA manages 

its warehouses. According to GSA officials, they are in the process of 

developing a Guide for Strategic Warehouse Planning.

• St. Elizabeths: The west campus of St. Elizabeths, a National 

Historic landmark in Washington, D.C., is made up of 61 buildings on 

about 182 acres. Many buildings have been vacant for extended 

periods of time and are in badly deteriorated condition. As we 

reported in 2014, GSA developed a plan to establish a consolidated 

headquarters for the Department of Homeland Security (DHS) on the 

site in 2009.3 Since then, GSA has completed construction of a new 

headquarters building for the Coast Guard on the campus, but most of 

the project has been delayed. The estimated timeline for completing 

the project has been extended multiple times, from an initial estimated 

completion date of 2016, to an estimated completion date of 2021 

based on a scaled back plan as of 2015.

In addition, the federal government continues to face challenges in 

protecting federal facilities from potential attacks. For example, DHS’s 

Federal Protective Service (FPS), responsible for the physical protection 

of 9,500 federal facilities, continues to work to apply a risk-based 

approach for assessing facilities and ensuring that guards are adequately 

trained. In January 2017, we also reported that GSA is leasing from 

foreign owners about 3.3 million square feet in 20 buildings that require 

higher levels of security that could present security risks, such as 

espionage and unauthorized cyber and physical access.4

 3

GAO, Federal Real Property: DHS and GSA Need to Strengthen the Management of 

DHS Headquarters Consolidation, GAO-14-648 (Washington, D.C.: Sept. 19, 2014). 

4

GAO, Federal Real Property: GSA Should Inform Tenant Agencies When Leasing HighSecurity Space from Foreign Owners, GAO-17-195 (Washington, D.C.: Jan. 3, 2017).
Managing Federal Real Property

Page 79 GAO-17-317 High-Risk Series

Figure 8: Examples of Vacant Federal Buildings (the Cotton Annex, vacant General 

Services Administration warehouse, and a vacant building at St. Elizabeths)

The federal government continues to meet the high-risk criterion for 

demonstrating leadership commitment to improving the management of 

real property by executing a number of reform efforts since the last highrisk update in 2015. For example, the Office of Management and Budget 

(OMB) has issued several key guidance documents since 2015. Most 

notably, OMB introduced the National Strategy in March 2015, and more 

recently issued a memo on Improving Federal Real Property Data Quality 

in January 2016. In response to OMB’s memo, GSA issued its Federal 

Real Property Data Validation and Verification (V&V) Guidance in May 

2016. These actions represent key examples of the federal government’s 

continued commitment to improve its management of real property. The 

federal government has also continued to make progress toward 

increasing its capacity, developing an action plan, and monitoring its 

progress toward improving real property management and has made 

improvements in the demonstrating progress criterion to move it from a 

not met to a partially met rating. For example, in June 2016, OMB and 

GSA continued efforts to implement our March 2016 recommendation to 

improve FRPP data quality by conducting an in-depth survey of agencies 

and soliciting information on several data elements that have been known 

to be unreliable. GSA issued a memo in December 2016 to Chief 

Financial Officer (CFO) Act agencies that revised the definitions to 

improve the consistency and quality of several FRPP data elements. GSA 

also launched the Asset Consolidation Tool, a software application that 

allows federal agency users to generate geospatial information about 

assets in close proximity to identify potential candidates for colocation 

and consolidation. In addition, GSA implemented two priority 

recommendations since 2015 related to improving data reliability and is 

taking steps toward developing a 5-year capital plan.

Although progress is evident, these reforms have not fully addressed the 

underlying challenges to manage real property efficiently. For example, 

What GAO Found
Managing Federal Real Property

Page 80 GAO-17-317 High-Risk Series

we found that federal agencies have not demonstrated that they have the 

capacity to reduce their reliance on costly leases, particularly high-value 

leases where owning properties would be less costly in the long run. GSA 

has also made strides to improve data reliability, including but not limited 

to issuing new data validation and verification guidance that requires 

agencies to investigate anomalies and resolve them. However, GSA will 

not finish measuring and tracking the progress of its data reliability efforts 

until late in 2017; agencies submitted their first data under the new 

approach in December 2016 and address all data irregularities by 

October 2017.

Related to physical security, we found that the federal government could 

do more to improve capacity, monitoring, action plans, and demonstrate 

progress. For example, FPS, GSA, and other agencies could improve the 

action plan criterion by collaborating and by clearly defining roles and 

responsibilities to adequately protect federal facilities. Further, FPS has 

taken some action to demonstrate progress but has yet to fully implement 

our March 2015 and September 2013 recommendations to improve 

security screening at federal buildings and guard training, respectively.

In December 2016, Congress enacted two real property reform bills that 

could address the long-standing problem of federal excess and 

underutilized property. The Federal Assets Sale and Transfer Act of 2016 

may help address stakeholder influence by establishing an independent 

board to identify and recommend at least five high-value civilian federal 

buildings for disposal within 180 days after the board members are 

appointed, as well as develop recommendations to dispose and 

redevelop federal civilian real properties.5 Additionally, the Federal 

Property Management Reform Act of 2016 codified the Federal Real 

Property Council (FRPC) for the purpose of ensuring efficient and 

effective real property management while reducing costs to the federal 

government.6 The FRPC is required to establish a real property 

management plan template, which must include performance measures, 

and strategies and government-wide goals to reduce surplus property or 

to achieve better utilization of underutilized property. In addition, federal 

agencies are required to annually provide FRPC a report on all excess 

 5

Pub. L. No. 114-287, 130 Stat. 1463 (Dec. 16, 2016). The act excludes properties on 

military installations among other types of properties.

6

Pub. L. No. 114-318, 130 Stat. 1608 (Dec. 16, 2016).
Managing Federal Real Property

Page 81 GAO-17-317 High-Risk Series

and underutilized property and identify leased space that is not fully used 

or occupied.

While the federal government has made progress on different aspects of 

managing federal real property, additional work is needed. In order to 

further improve the management of real property, OMB and GSA should 

implement our open recommendations to build upon the National Strategy 

and improve data reliability. Improving data reliability was also included 

as a priority recommendation in our August 2016 letter to the GSA 

Administrator. While the National Strategy mentions some underlying 

causes of the challenges that federal agencies face in managing their 

portfolios, it does not expound on the extent to which these challenges 

impede agencies’ ability to dispose of, better utilize, or repair their real 

property and offers discussion on how agencies can overcome these 

challenges by addressing the underlying causes, such as legal and 

budgetary limitations and competing stakeholder interests.

OMB also could increase the usefulness of the National Strategy by 

discussing alternative funding mechanisms, such as retaining fees and 

enhanced-use leasing. Further, despite OMB’s efforts to focus agencies’

attention on measuring progress through the Reduce the Footprint policy, 

the government’s efforts to monitor progress remain limited without 

reliable real property data in the FRPP. In June 2016, OMB and GSA 

officials noted that they continue to implement our March 2016 

recommendation to analyze the differences in how agencies collected 

and reported data by conducting a survey of agencies that contribute 

FRPP data on several key indicators such as status, utilization, and 

replacement value. GSA plans to convene an inter-agency working group 

in early 2017 to discuss each of the data elements and devise an action 

plan to address the findings of the survey.

To further build capacity and develop action plans for reducing the federal 

government’s overreliance on costly leasing, GSA should implement our 

priority recommendation from 2013 to develop a strategy for the federal 

government to own rather than lease prioritized high-value properties 

such as agency headquarters buildings. While GSA has taken some 

steps to increase its capacity to make its existing leasing program less 

costly by increasing competition, further action is required to decrease 

leasing costs by reducing unneeded fees, which is one of our priority 

recommendations. 

What Remains to Be 

Done
Managing Federal Real Property

Page 82 GAO-17-317 High-Risk Series

Finally, FPS, GSA, and other agencies can take additional measures to 

increase capacity, develop action plans, and monitor as well as 

demonstrate progress in securing federal facilities and courthouses. For 

example, FPS can take additional action to address our March 2016 

recommendation to improve human capital planning by developing 

performance measures with targets that are aligned to FPS goals. FPS 

and the Department of Justice’s (DOJ) U.S. Marshals Service (USMS) 

can continue work they have under way to implement our March 2015 

recommendation to improve their security screening at federal buildings 

and courthouses. Further, FPS should implement our September 2013 

recommendation to ensure that all guards have received screening and 

active-shooter training. Finally, the Administrator of GSA and the 

Secretary of Homeland Security should work jointly to implement our 

other open priority recommendation to improve the management of the 

Department of Homeland Security headquarters consolidation project.

OMB continues to meet this criterion by demonstrating leadership 

commitment to reducing the amount of excess and underutilized federal 

Additional Details on 

What GAO Found

Excess and Underutilized 

Property

Leadership Commitment
Managing Federal Real Property

Page 83 GAO-17-317 High-Risk Series

real property. In March 2015, OMB implemented our recommendation by 

issuing government-wide guidance—the National Strategy—which 

identifies actions to reduce the size of the federal real property portfolio 

by prioritizing consolidation, colocation, and disposal actions. The 

strategy provides a foundation to further assist agencies strategically 

manage their real property. In conjunction with the National Strategy, 

OMB also issued the Reduce the Footprint policy, which requires all CFO 

Act agencies to implement a 5-year, rolling planning process that sets 

annual square-feet reduction targets to reduce their real property 

portfolios and to adopt space design standards to optimize domestic 

office space use.

OMB and federal real property-holding agencies continue to partially meet 

the criterion for having the capacity to address the risks associated with 

managing excess and underutilized property. For example, GSA 

introduced the Asset Consolidation Tool in June 2016. It allows users to 

identify potential candidates for colocation and consolidation by 

generating geospatial information about assets in close proximity. In 

addition, GSA also introduced the Real Property Management Tool that 

uses multiple sources to help agencies identify opportunities for property 

consolidations, collocations, and disposals. While progress is evident, we 

have previously identified additional ways the federal government can 

strengthen its capacity to reduce excess and underutilized property. In 

2016, we reported that the National Strategy mentions some of the 

causes underlying the challenges federal agencies face in managing their 

portfolios—such as limited funding—but it neither addresses the extent to 

which challenges impede agencies’ abilities to dispose of, better use, or 

repair their real property, nor does it offer guidance on how agencies can 

overcome these challenges by addressing the underlying causes.7

Furthermore, the strategy does not discuss alternative-funding 

mechanisms that we have previously identified to help manage budgetary 

constraints, such as retaining fees in real property and exploring 

enhanced use lease authority.8 OMB staff told us that their efforts are 

focused on identifying policy options within the current statutory 

 7

GAO, Federal Real Property: Improving Data Transparency and Expanding the National 

Strategy Could Help Address Long-standing Challenges, GAO-16-275 (Washington, D.C.: 

Mar. 31, 2016).

8

Some of these alternative mechanisms allow selected agencies to meet their real 

property needs by leveraging other authorized resources, such as retained fees or land 

swaps with a private sector partner.

Capacity
Managing Federal Real Property

Page 84 GAO-17-317 High-Risk Series

framework to reduce excess and underutilized property while seeking 

legislative options to address the underlying challenges. We 

recommended that OMB expand the National Strategy to more clearly 

articulate planned actions and identify alternative approaches to address 

underlying causes of real property problems. In June 2016, OMB staff told 

us that they plan to expand the National Strategy since it is not a one-time 

policy but a living document that they plan to use to address longstanding challenges. As of December 2016, OMB had not made any 

changes to the National Strategy.

OMB showed improvement and met the criterion of establishing an action 

plan for reducing excess and underutilized property. Under the Reduce 

the Footprint policy, OMB has, for the first time, established a 

government-wide action plan to use property as efficiently as possible 

and to reduce agency portfolios through annual reduction targets. For 

example, the Reduce the Footprint policy requires agencies to develop 

and submit annual Real Property Efficiency Plans, which describe the 

agency’s overall strategic and tactical approach in managing its real 

property, including measures to dispose of unneeded properties, improve 

efficiency, and save money. The policy also requires agencies to adopt 

space design standards to optimize how they use domestic office space 

and to set annual square foot reduction targets for their portfolio of office 

and warehouse space.

OMB and federal real property-holding agencies continue to partially meet 

the criterion for monitoring progress toward reducing excess and 

underutilized real property. To implement the National Strategy, the 

Reduce the Footprint policy requires agencies to set annual reduction 

targets to measure agency performance. When agencies combine these 

reduction targets with the fiscal year 2014 benchmarking metrics 

developed under the President’s Management Agenda, the government 

has a 3-year set of performance measures to drive portfolio-wide 

efficiency improvements and property disposals. Despite multiple efforts 

outlined above, the government’s efforts remain limited without reliable 

real property data in the FRPP, which is necessary to effectively measure 

reductions in excess and underutilized property. For example, in our 

March 2016 report, we found that agencies tailored how they collect and 

report data to meet their mission needs and portfolio requirements, thus 

limiting OMB’s and GSA’s insight into the quality of the FRPP data and 

the extent to which agencies are following sound and comparable 

collection and reporting practices.

Action Plan

Monitoring
Managing Federal Real Property

Page 85 GAO-17-317 High-Risk Series

For example, our review found that some of the agencies estimated, 

rather than determined, actual operating costs for each building, as these 

agencies do not maintain data on costs for specific buildings. As a result, 

standardizing data has been challenging since agencies have applied 

different approaches to collecting data that align closely with their mission 

but that in some cases are inconsistent with existing GSA guidance. In 

December 2016, GSA issued a memo to senior real property officers of 

the FRPC that revised the definitions to improve the consistency and 

quality of several FRPP data elements including replacement value, 

annual maintenance costs, and annual operating costs. Although a step 

in the right direction, agencies are not required to implement these 

revised definitions until the December 2018 FRPP reporting cycle. 

Since the last high-risk update, OMB and GSA have demonstrated some 

progress and partially met this criterion by taking a number of steps to 

reduce excess and underutilized properties. GSA implemented a new 

asset management tool, the Federal Real Property Profile Management 

System (FRPP MS), which helps agencies identify opportunities to 

consider new space and improves transparency by enabling agencies to 

access each other’s data. GSA officials said that the new platform will 

include capabilities to help identify underutilized properties and potential 

candidates for colocations and consolidations and address long-standing 

management challenges, while OMB staff noted that the new platform 

has the potential to improve real property data management. Further, 

OMB reported, in September 2016, that in fiscal years 2014 and 2015 the 

federal government disposed of over 12,000 buildings with 71.8 million 

square feet of space, saving $64 million in annual operation and 

maintenance costs. While progress is apparent, we testified in September 

2016 that a lack of reliable data makes it difficult to accurately measure 

the amount of excess property and has undermined efforts to effectively 

reform real property management and judge progress. In two 

assessments of the federal government’s reported results of real property 

reforms, we identified problems with data reliability. While OMB and GSA 

have taken steps to address some of these data reliability issues such as 

revising FRPP definitions to improve data quality and consistency, more 

time is needed to determine the effectiveness of these measures and to 

demonstrate that the federal government’s real property data are reliable.

Demonstrated Progress
Managing Federal Real Property

Page 86 GAO-17-317 High-Risk Series

OMB and GSA continue to meet this criterion and demonstrate leadership 

commitment in addressing its overreliance on leasing privately owned 

space in situations where owning buildings would be more cost efficient in 

the long run. As previously stated, OMB implemented our 

recommendation in March 2015 to issue a National Strategy, which 

requires agencies to identify opportunities to consolidate within their 

leased assets and to improve space utilization, steps that would reduce 

leasing. In addition, GSA could also save money by reducing the costs of 

the leases that remain. For example, GSA has implemented a number of 

measures, including leasing reform, and, at a June 2015 hearing, a top 

GSA manager stated that the agency’s ongoing lease reform efforts 

include plans to reduce costs by increasing competition for its leases.9

GSA still does not meet this criterion as it has not demonstrated that it 

has the capacity to reduce its reliance on costly leases, particularly highvalue leases that represent a disproportionately large amount of the rent 

GSA pays. Although GSA has taken some actions to reduce the size of 

 9

Statement by Commissioner of Public Buildings Service, U.S. General Services 

Administration at U.S. Senate Homeland Security and Governmental Affairs Committee 

Hearing, Federal Real Property Reform: How Cutting Red Tape and Better Management 

Could Achieve Billions in Savings (Washington, D.C.: June 16, 2015). 

Costly Leasing

Leadership Commitment

Capacity
Managing Federal Real Property

Page 87 GAO-17-317 High-Risk Series

its leases, it has not addressed its overall reliance on high-value leases 

(defined as $2.85 million and over per year in rent) in situations where 

ownership would be less expensive in the long run. In particular, GSA has 

not implemented our 2013 recommendation to develop a strategy to 

increase ownership investments for a prioritized list of high-value leases 

where it would be less expensive in the long run to own.10 GSA has taken 

some steps to increase its capacity to reduce the cost of its existing 

leasing program by increasing competition for GSA leases but has not 

implemented our other recommendation to decrease leasing costs by 

reducing interest fees. For example, we found that GSA could potentially 

help tenant agencies save millions of dollars for some leases by loaning 

them the funds needed to improve newly leased spaces—that is, to make 

tenant improvements—instead of having the tenants finance these costs 

with private-sector owners at private-sector interest rates as high as 9 

percent over the term of the lease. 

GSA showed improvement and partially met the action plan criterion by 

taking some steps to rank and prioritize long-term ownership solutions for 

current high-value leases. For example, GSA developed and provided us 

a list of criteria to rank and prioritize the space needs that are currently 

being met in high-value leases to determine which of those leases would 

benefit most from converting to a federally owned solution. GSA has also 

implemented a new software program for its 5-year capital-planning 

process that considers avoiding lease costs, among many other criteria, 

in prioritizing projects for approval. According to GSA officials, several of 

the projects approved in the capital plan covering fiscal years 2015-2019 

would reduce lease costs by moving tenants out of leases into federally 

owned property. These efforts are producing incremental progress, but 

GSA has not implemented our recommendation to create a long-term, 

cross-agency strategy for considering targeted investments in ownership.

In addition, we reported, in January 2016, that while GSA has taken steps 

to reform leasing and reduce leasing costs, certain factors—such as a 

tenant agency’s need for space in restricted geographic areas and 

specialized building requirements—may drive down competition and 

result in agencies obtaining leasing rates that are higher than local market 

 10GAO. Federal Real Property: Greater Transparency and Strategic Focus Needed for 

High-Value GSA Leases, GAO-13-744 (Washington, D.C.: Sept. 19, 2013).

Action Plan
Managing Federal Real Property

Page 88 GAO-17-317 High-Risk Series

rates.11 Developing additional plans to reduce barriers to competition, 

where possible, and identifying sources of capital to allow tenants to fund 

tenant improvements could decrease leasing costs and lead to millions in 

cost savings for some leases. 

OMB and GSA have shown improvement and partially met the criterion 

for monitoring progress toward reducing its overreliance on leasing 

privately owned space. By issuing the National Strategy, OMB instituted 

key property management reform by requiring agencies to measure the 

costs and utilization of individual real property assets to support more 

efficient use of federal space, which would include reducing the amount of 

space leased. However, GSA has not implemented our recommendation 

to set a long-term, cross-agency strategy for investing in ownership, 

which would improve the ability to monitor and track progress by defining 

success. As previously mentioned, adopting criteria to rank and prioritize 

potential long-term ownership alternatives to current high-value leases 

could help develop goals and a strategy to consider targeted investments 

in ownership specifically related to these costly leases. With regard to the 

costs of leasing, GSA is making progress by monitoring the extent to 

which its leases are competitive and signed at rates below the private 

sector. However, GSA should also implement our 2016 recommendations 

to reduce the costs to tenants by exploring strategies to enhance 

competition for GSA leases and reducing unneeded fees.

OMB and GSA have demonstrated some progress since 2015 and 

partially met this criterion. OMB required agencies to reduce their overall 

footprint through the Reduce the Footprint policy and the National 

Strategy. Even though the National Strategy does not directly address the 

issue of leasing, it requires agencies to adopt space design standards to 

optimize how they use federal domestic office space, a step that would 

likely include reducing leased space by using space more efficiently and 

consolidating leases onto federally owned property. According to GSA 

data, the amount of space that GSA leases has fallen for 3 straight years, 

but only by 4 percent since 2013. GSA’s recent progress in reducing its 

reliance on leasing has been modest. GSA has outlined a number of 

actions that it has taken to implement our January 2016 recommendation 

to reduce leasing costs for federal agencies by increasing competition for 

GSA leases. Specifically, it has established a framework for broadening 

 11GAO, Federal Real Property GSA Could Decrease Leasing Costs by Encouraging 

Competition and Reducing Unneeded Fees, GAO-16-188 (Washington, D.C.: Jan. 13, 

2016). 

Monitoring

Demonstrated Progress
Managing Federal Real Property

Page 89 GAO-17-317 High-Risk Series

the delineated geographic areas agencies request—a key driver for 

competition. GSA officials said in 2016 that the agency has also 

implemented a performance measure to encourage competition. As a 

result, GSA said that 81 percent of its leases are competitive. However, 

these steps to reduce the costs of leases are still too recent to clearly 

demonstrate progress. Further, fully implementing our recommendation 

for GSA to develop and use criteria to rank and prioritize potential longterm ownership solutions to create a cross-agency strategy for making 

those investments is a needed first step in addressing its overreliance on 

leasing that could then lead to demonstrating progress in saving money in 

the long term.

The federal government continued to demonstrate leadership 

commitment and met this criterion by taking a number of steps to improve 

data reliability within the FRPP. In addition to the National Strategy, which 

called for additional data quality improvements that support data-driven 

decision making, in January 2016, OMB issued a government-wide memo 

requiring all CFO Act agencies to implement standard data validation and 

verification checks when submitting their annual FRPP data to GSA 

beginning in fiscal year 2017. Subsequently, in May 2016, GSA issued its 

Federal Real Property Data Validation and Verification (V&V) Guidance, 

Data Reliability

Leadership Commitment
Managing Federal Real Property

Page 90 GAO-17-317 High-Risk Series

which establishes a new mandatory data validation and verification 

process and requires agencies to investigate data anomalies.

OMB and GSA improved the government’s capacity to ensure that 

reliable data are available to inform real property decision making through 

a series of reforms to FRPP and now meet this criterion. For example, 

GSA upgraded FRPP from its legacy system to a new platform with 

several enhancements and tools. The new FRPP MS is an asset 

management tool that now supports the new Asset Consolidation Tool, 

which helps agencies identify opportunities to consider new space and 

improves transparency by enabling agencies to access each other’s data. 

GSA has also improved agencies’ capacity to submit accurate data by 

improving the clarity of variables and helping with data verification.

GSA continues to partially meet this criterion by putting plans in place to 

continue implementing our recommendations aimed at addressing the 

reliability of federal real property data. In June 2016, OMB and GSA 

noted that they continue to implement our recommendation to improve 

FRPP data quality by conducting an in-depth survey focusing on several 

data elements including replacement value, status, owned and otherwise 

managed operating costs, repair needs, utilization, and lease costs. GSA 

officials told us that they implemented the survey to better understand the 

methods CFO Act agencies are employing to collect and prepare real 

property data submitted into the FRPP. Each survey question began with 

the FRPP definition for a specific data element, followed by a series of 

questions designed to elicit information about how each agency applies 

the FRPP reporting requirements. GSA completed its analysis of the 

survey results, and in December 2016, GSA issued a memorandum to 

senior real property officers of FRPC based on the survey results 

designed to improve the consistency and quality of real property data. In 

addition, GSA plans to convene an inter-agency working group—made up 

of GSA, OMB, and executive branch agencies that contribute data to the 

FRPP—in early 2017 to discuss each of the data elements and devise an 

action plan to address the findings of the survey. The working group will 

review the survey results in more detail and reach consensus on: (1) 

changes to the definitions and requirements for these data elements in 

the FRPP data dictionary; (2) limitations on the use of the data for crossagency analysis, and (3) best practices and methodologies for reporting 

these data elements. 

The federal government continues to partially meet the criterion for 

monitoring progress toward improving FRPP data reliability. With OMB 

issuing its January 2016 memo on improving federal real property data 

Capacity

Action Plan

Monitoring
Managing Federal Real Property

Page 91 GAO-17-317 High-Risk Series

quality and GSA issuing its recent V&V guidance, agencies will be 

required to adhere to a revised process for resolving data anomalies 

when they submit data into the FRPP. Specifically, the V&V guidance 

now includes a new mandate—referred to as anomaly resolution—that 

requires agencies to investigate whether the underlying data flagged by 

the anomalies are accurate or inaccurate. GSA’s updated information 

technology platform, FRPP MS, allows GSA and agencies to analyze the 

numbers and percentages of anomalies resolved versus total number of 

assets in a given anomaly category. The system will maintain records of 

data anomalies for each year that V&V is performed. Moreover, agencies 

will have year-to-year records of all data tagged as anomalous, as well as 

the reason for the tag. This has the potential to improve data quality, 

promote consistency among agencies, and enable OMB and other 

policymakers to measure how data quality improves over time. Although a 

step in the right direction, measuring and tracking the progress of these 

V&V checks will have to wait several years, as agencies submitted data 

under the new approach in December 2016, and will be required to 

address all data irregularities by October 2017.

GSA showed improvement since 2015 and partially met the 

demonstrating progress criterion by improving the reliability of federal real 

property data, but challenges still remain. In March 2016, we reported that 

OMB and GSA took important steps to revise and modify several FRPP 

data definitions based upon user feedback and internal data 

evaluations.12 As previously mentioned, GSA issued its federal real 

property data validation and verification guidance, requiring agencies to 

confirm whether data flagged as anomalous are accurate or inaccurate, 

and has plans in place to address our recommendations through the 

recent survey it administered. However, until GSA acts on these survey 

findings and takes concrete steps to address differences in data collection 

and identify any limitations, the usefulness of FRPP data for decision 

making will remain unclear. For example, in our March 2016 report, we 

found that some of the agencies in our review estimated, rather than 

determined, actual operating costs into FRPP for each building, as these 

agencies do not maintain data on costs for each specific building. 

Estimating practices also varied by agency. As a result, it may be difficult 

for OMB or agencies to accurately determine aggregate cost savings from 

successfully reducing excess or underutilized property. Finally, it is 

unlikely that all of the data for 2 dozen variables submitted by agencies 

 12GAO-16-275.

Demonstrated Progress
Managing Federal Real Property

Page 92 GAO-17-317 High-Risk Series

each year on over half a million buildings and structures will ever be 

completely correct and consistent. As a result, GSA should fully 

implement our 2016 recommendation to assess, analyze, and identify any 

limitations in how agencies collect and report data to FRPP.

The federal government continued to meet the criterion for demonstrating 

leadership commitment to improving the physical security of federal 

facilities. In August 2013, the Interagency Security Committee (ISC), a 

DHS-chaired organization, showed leadership commitment by issuing a 

consolidated set of standards for physical security at federal facilities, 

called The Risk Management Process for Federal Facilities: An 

Interagency Security Committee Standard. In January 2016, it continued 

to show leadership commitment by updating the Risk Management 

Process elements related to current threats, countermeasures to mitigate 

the threats, and the protection level for federal child care centers. In 2015, 

FPS, which protects about 9,500 federal facilities in conjunction with 

GSA, implemented our recommendation by issuing a revised government 

facilities sector plan that identifies goals and describes resources that 

support the risk management approach.

FPS and GSA continued to partially meet the criterion for having the 

capacity to address the risks associated with ensuring the safety of our 

Physical Security

Leadership Commitment

Capacity
Managing Federal Real Property

Page 93 GAO-17-317 High-Risk Series

federal facilities. For example, FPS developed a Strategic Human Capital 

Plan that included strategies tailored to address identified gaps and 

needs in its workforce and identified actions that build organizational 

capability to support those strategies. FPS also designed and plans to 

implement a staffing model—which identifies the federal workforce 

necessary to meet its mission—consistent with most key practices we 

identified. However, FPS has not fully developed performance measures 

to evaluate progress toward goals, which is also a key strategic workforce 

planning principle. For example, FPS has not identified performance 

measures for all of the Plan’s strategies, nor has it included performance 

targets. Additionally, FPS has made consistent progress in its efforts to 

conduct facility security assessments that are consistent with ISC 

standards. Specifically, in March 2012, FPS developed the Modified 

Infrastructure Survey Tool (MIST) to assess the vulnerabilities of federal 

facilities. In October 2016, FPS officials stated that FPS inspectors are 

currently using MIST augmented with external threat and consequence 

data to provide a more complete assessment for federal facilities than can 

be achieved by using MIST alone. As of October 2016, FPS had also 

developed a Mission Needs Assessment that outlines how FPS will 

enhance its ability to assess risks to federal facilities by incorporating 

threat, vulnerability, and consequence information in a single, integrated, 

and automated tool. FPS officials said that this new tool could improve 

FPS’s ability to better protect federal facilities and help minimize 

agencies’ duplicative risk assessment activities.

FPS has shown improvement since our last high-risk update and partially 

met this criterion by developing action plans that should improve the 

physical security of federal facilities. We recommended, in December 

2015, that FPS and GSA—two agencies that share responsibility for 

protecting federal facilities—take actions to improve their collaboration 

and finalize the two agencies’ memorandum of agreement (MOA) 

accordingly.13 As of August 2016, FPS reported that it has taken steps 

with GSA to resolve differences in agency opinions on security-related 

authorities for protecting federal real property. FPS also stated that once 

an agreement or an updated MOA has been established, both agencies 

would be better positioned to devise a plan with time frames for finalizing 

a joint strategy. However, progress toward an agreement is slow; the 

MOA has not been updated since 2006. Further, in September 2011, we 

 13GAO, Homeland Security: FPS and GSA Should Strengthen Collaboration to Enhance 

Facility Security, GAO-16-135 (Washington, D.C.: Dec. 16, 2015). 

Action Plan
Managing Federal Real Property

Page 94 GAO-17-317 High-Risk Series

recommended that FPS and DOJ work with other agencies to improve 

collaboration to address a number of courthouse security challenges.14

USMS and FPS formed a working group in 2015 to assess the costs and 

benefits of a pilot program that would enhance security. However, as of 

January 2017, FPS, USMS, the Administrative Office of the U.S. Courts, 

and GSA were still working to finalize the draft MOA on courthouse 

security. 

The federal government has shown improvement since our last high-risk 

update and partially met the criterion for monitoring progress in securing 

our nation’s federal facilities. For example, we reported, in March 2015, 

that action is needed to better assess cost-effectiveness of security 

enhancements at federal facilities.15 In December 2015, ISC implemented 

our recommendation that they help federal agencies implement the costeffectiveness and performance measurements by amending the federal 

government’s risk management standard and published new guidance 

intended to help federal entities make the most effective use of resources 

available for physical security across their facilities. As a result, federal 

entities will be able to better determine the benefits of security 

investments and assess whether they have reduced federal facilities’

vulnerability to threats, including acts of terrorism or other forms of 

violence. With regard to FPS guard training, further action is required to 

monitor progress. FPS relies on 13,500 privately contracted guards to 

provide security to federal facilities under the custody and control of GSA. 

We recommended in September 2013 that FPS immediately determine 

which guards have not had screener (x-ray and magnetometer 

equipment) or active-shooter scenario training and ensure the training 

has been provided to them.16 FPS has taken some steps to build a 

monitoring and tracking system to identify guards who completed training 

but has not yet completed and implemented the tracking system. In 

addition, we reported in January 2017 that GSA is leasing from foreign 

owners about 3.3 million square feet in 20 buildings that require higher 

 14GAO, Federal Courthouses: Improved Collaboration Needed to Meet Demands of a 

Complex Security Environment, GAO-11-857 (Washington, D.C.: Sept. 28, 2011).

15GAO, Homeland Security: Action Needed to Better Assess Cost-Effectiveness of 

Security Enhancements at Federal Facilities, GAO-15-444 (Washington, D.C.: Mar. 24, 

2015).

16GAO, Federal Protective Service: Challenges with Oversight of Contract Guard Program 

Still Exist, and Additional Management Controls are Needed, GAO-13-694 (Washington, 

D.C.: Sept. 17, 2013).

Monitoring
Managing Federal Real Property

Page 95 GAO-17-317 High-Risk Series

levels of security.17 Most of the tenant agencies we contacted were 

unaware that the space they occupy is in a foreign-owned building. 

Federal officials who assess foreign investments and some tenant 

agencies said that leasing space in foreign-owned buildings could present 

security risks, such as espionage and unauthorized cyber and physical 

access. We recommended that GSA identify foreign owners of high 

security space and inform the tenant agencies for any needed security 

mitigation. GSA agreed with the recommendations.

Although FPS and other agencies have improved some areas of physical 

security, they have not yet met the criterion for demonstrated progress. 

To do so, FPS and USMS should continue work they have under way to 

implement our March 2015 recommendation related to security screening 

at federal buildings and courthouses. More specifically, we recommended 

that (1) FPS develop and implement a strategy for using covert-testing 

data and data on prohibited items to improve FPS’s security-screening 

efforts and (2) USMS develop and implement a strategy for using 

intrusion-testing data and data on prohibited items to improve security 

screening at federal courthouses held by GSA.18 Further, FPS must fully 

implement our September 2013 recommendations to ensure that its 

guards have met training and certification requirements and that contract 

guard companies’ instructors be certified to teach basic and refresher 

training courses to guards.19 As previously described, developing a 

tracking system that monitors guards’ training would also improve the way 

FPS oversees its contract guard program, which is central to effectively 

protecting employees and visitors in federal facilities.

• In July 2011, we recommended that FPS establish a process for 

verifying the accuracy of federal facility and guard training and 

certification data before entering them into the guard database. FPS 

developed and implemented procedures in 2014 to verify the 

accuracy of that data before entering it into its interim contract guard 

database. This step will help FPS in its continued efforts to verify the 

accuracy of federal facility and contract guard data. 

 17GAO-17-195.

18GAO, Homeland Security: Actions Needed to Better Manage Security Screenings at 

Federal Buildings and Courthouses, GAO-15-445 (Washington, D.C.: Mar. 31, 2015).

19GAO-13-694.

Demonstrated Progress

Benefits Achieved by 

Implementing Our 

Recommendations
Managing Federal Real Property

Page 96 GAO-17-317 High-Risk Series

• In June 2012, we recommended that OMB, in collaboration with 

Federal Real Property Council member agencies, develop and publish 

a national strategy for managing federal excess and underutilized real 

property. In the spring of 2015, OMB issued the National Strategy. By 

issuing the National Strategy, the federal government has taken a 

major step forward to increase the efficiency of federal real property 

management and address long-standing real property challenges.

• In March 2015, we recommended that the Secretary of Homeland 

Security direct ISC to develop guidance for helping federal entities 

meet the cost-effectiveness and performance measurement aspects 

of lSC’s risk management standard. In December 2015, ISC 

published new guidance that provides entities with an introduction and 

understanding of the most efficient processes and procedures to 

effectively allocate physical security resources across an entities’

portfolio of facilities, including discussions on how to determine costeffectiveness and implement performance measures. As a result, 

federal entities will be able to better determine the benefits of security 

investments and whether they have reduced federal facilities’

vulnerability to acts of terrorism or other forms of violence.

• In August 2012, we recommended that DHS direct FPS to coordinate 

with GSA and other federal tenant agencies to reduce any 

unnecessary duplication in security assessments of facilities under the 

custody and control of GSA. In 2016, we determined that FPS had 

taken steps to coordinate with these agencies. For example, in 2014, 

FPS surveyed GSA and other federal agencies to determine why they 

were conducting their own risk assessments, among other things. As 

a result of both coordinating with and surveying GSA as well as other 

federal agencies, FPS has reduced or prevented the duplication of 

effort associated with its risk assessments.

For additional information about this high-risk area, contact the following 

people. On real property management, contact Dave Wise at (202)512-

2834 or wised@gao.gov. On issues related to physical security of federal 

facilities, contact Lori Rectanus at (202) 512-2834 or rectanusl@gao.gov.

Federal Real Property: GSA Should Inform Tenant Agencies When 

Leasing High-Security Space from Foreign Owners. GAO-17-195. 

Washington, D.C.: January 3, 2017.

GAO Contact

Related GAO 

Products
Managing Federal Real Property

Page 97 GAO-17-317 High-Risk Series

Federal Real Property: Efforts Made, but Challenges Remain in Reducing 

Unneeded Facilities. GAO-16-869T. Washington, D.C.: September 23, 

2016.

Federal Real Property: Actions Needed to Enhance Information on and 

Coordination among Federal Entities with Leasing Authority. 

GAO-16-648. Washington, D.C.: July 6, 2016.

Federal Real Property: Observations on GSA’s Canceled Swap 

Exchange Involving Buildings in the Federal Triangle South Area, 

GAO-16-571R. Washington, D.C.: June 16, 2016.

Federal Real Property: Improving Data Transparency and Expanding the 

National Strategy Could Help Address Long-standing Challenges. 

GAO-16-275. Washington, D.C.: March 31, 2016.

Federal Protective Service: Enhancements to Performance Measures and 

Data Quality Processes Could Improve Human Capital Planning. 

GAO-16-384. Washington, D.C.: March 24, 2016.

Federal Real Property: GSA Could Decrease Leasing Costs by 

Encouraging Competition and Reducing Unneeded Fees. GAO-16-188. 

Washington, D.C.: January 13, 2016.

Homeland Security: FPS and GSA Should Strengthen Collaboration to 

Enhance Facility Security. GAO-16-135. Washington, D.C.: December 16, 

2015.

Homeland Security: Actions Needed to Better Manage Security Screening 

at Federal Buildings and Courthouses. GAO-15-445. Washington, D.C.: 

March 31, 2015.

Homeland Security: Action Needed to Better Assess Cost-Effectiveness 

of Security Enhancements at Federal Facilities. GAO-15-444. 

Washington, D.C.: March 24, 2015.

Federal Real Property: Strategic Focus Needed to Help Manage Vast and 

Diverse Warehouse Portfolio. GAO-15-41. Washington, D.C.: November 

12, 2014.

Capital Financing: Alternative Approaches to Budgeting for Federal Real 

Property. GAO-14-239. Washington, D.C.: March 12, 2014.
Managing Federal Real Property

Page 98 GAO-17-317 High-Risk Series

Federal Facility Security: Additional Actions Needed to Help Agencies 

Comply with Risk Assessment Methodology Standards. GAO-14-86. 

Washington, D.C.: March 5, 2014.

Federal Real Property: Greater Transparency and Strategic Focus 

Needed for High-Value GSA Leases. GAO-13-744. Washington, D.C.: 

September 19, 2013.

Federal Protective Service: Challenges with Oversight of Contract Guard 

Program Still Exist, and Additional Management Controls Are Needed. 

GAO-13-694. Washington, D.C.: September 17, 2013.

Critical Infrastructure: DHS Needs to Refocus Its Efforts to Lead the 

Government Facilities Sector. GAO-12-852. Washington, D.C.: August 

13, 2012.

Federal Protective Service: Actions Needed to Assess Risk and Better 

Manage Contract Guards at Federal Facilities. GAO-12-739. Washington, 

D.C.: August 10, 2012.

Federal Buildings Fund: Improved Transparency and Long-term Plan 

Needed to Clarify Capital Funding Priorities. GAO-12-646. Washington, 

D.C.: July 12, 2012.

Federal Real Property: National Strategy and Better Data Needed to 

Improve Management of Excess and Underutilized Property. 

GAO-12-645. Washington, D.C.: June 20, 2012.

Federal Courthouses: Improved Collaboration Needed to Meet Demands 

of a Complex Security Environment. GAO-11-857. Washington, D.C.: 

September 28, 2011.
Funding the Nation’s Surface Transportation 

System

Page 99 GAO-17-317 High-Risk Series

The nation’s surface transportation system—including highways, transit, 

maritime ports, and rail systems that move both people and freight—is 

critical to the economy and affects the daily lives of most Americans. 

However, the system is under growing strain, and the cost to repair and 

upgrade the system to meet current and future demands is estimated in 

the hundreds of billions of dollars. The oldest portions of the Interstate 

Highway System are approaching 60 years of age, and 10 percent of the 

nation’s bridges were rated as structurally deficient in 2015. While this 

percentage of bridges rated as structurally deficient improved from 13 

percent in 2006, bridge conditions may become more challenging to 

address as a growing proportion approach the end of their 50-year design 

life.

Challenges to the nation’s surface transportation system are amplified by 

shifting demographics, the need to transport the goods and services to 

support a growing economy, rapid development of new technologies, and 

other factors. The U.S. population is expected to increase by 70 million 

over the next 30 years. As the Department of Transportation (DOT) has 

reported, this projected increase includes a growing percentage of 

Americans over the age of 65 with limited ability to drive or use transit to 

access critical services, and millennials, many of whom drive less than 

previous generations and choose to live in urban areas where they can 

walk, bike, or use public transportation. Though employment options in 

suburban areas are increasing, poverty is also increasing in such areas. 

Collectively, these changes will complicate future infrastructure planning 

decisions.

These trends are altering transportation investment decision making. The 

amount of freight moving through the country is expected to grow, a factor 

that will place strain on existing freight bottlenecks. Rapidly evolving 

vehicle technologies present new opportunities, but also pose challenges 

to creating a statutory and regulatory framework that will allow people to 

use these technologies while addressing privacy and other concerns they 

raise. Climate change also poses risks to existing transportation assets 

and presents opportunities and challenges to enhance resilience and 

reduce potential future losses, rather than simply pursuing a reactive 

approach of funding after a disaster occurs.

These challenges to the nation’s surface transportation system come at a 

time when traditional funding sources are eroding, and the federal 

government lacks a long-term sustainable strategy for funding surface 

transportation, as discussed below. Funding the nation’s surface 

transportation system is further complicated by the federal government’s 

Funding the Nation’s Surface Transportation 

System

Why Area Is High 

Risk
Funding the Nation’s Surface Transportation 

System

Page 100 GAO-17-317 High-Risk Series

financial condition and fiscal outlook. Funding the nation’s surface 

transportation system has been on GAO’s High-Risk List since 2007.

There is no rating for this high-risk area because addressing it primarily 

involves congressional action and the high-risk criteria and subsequent 

ratings were developed to reflect the status of agencies’ actions and the 

additional steps they need to take.

Motor fuel taxes and additional truck-related taxes that support the 

Highway Trust Fund—the major source of federal surface transportation 

funding—are eroding. Federal motor fuel tax rates have not increased 

since 1993, and drivers of passenger vehicles with average fuel efficiency 

currently pay about $96 per year in federal gasoline taxes. Because of 

inflation, the 18.4 cent-per-gallon tax on gasoline enacted in 1993 is worth 

about 11 cents today. The tax base will likely continue to erode as 

demand for gasoline decreases with the introduction and adoption of 

more fuel-efficient and alternative fuel vehicles. To maintain spending 

levels of about $45-50 billion a year for highway and transit programs and 

to cover revenue shortfalls, Congress transferred a total of about $141 

billion in general revenues to the Highway Trust Fund on eight occasions 

from 2008 through 2015.1 This funding approach has effectively ended 

the long-standing principle of “users pay” in highway finance, breaking the 

link between the taxes paid and the benefits received by highway users.

The most recent surface transportation reauthorization measure, enacted 

in December 2015 and which authorized funding through 2020, was the 

Fixing America’s Surface Transportation (FAST) Act. In addition to funds 

authorized from the Highway Trust Fund, the FAST Act provided around 

$70 billion of the $141 billion in transfers from general revenues. The 

general revenues provided in the FAST Act represented a one-time 

transfer of funding, not a sustainable long-term source of revenues. After 

2020, the gap between projected revenues and spending will recur. In 

March 2016, the Congressional Budget Office estimated that $107 billion 

in additional funding would be required to maintain current spending 

levels plus inflation from 2021 through 2026, as shown in figure 9.

 1

The transfers from the General Fund of the U.S. Treasury were subject to sequestration, 

which resulted in somewhat lower dollar amounts transferred into the Highway Trust Fund.

What GAO Found
Funding the Nation’s Surface Transportation 

System

Page 101 GAO-17-317 High-Risk Series

Figure 9: Projected Cumulative Highway Trust Fund Balance, Fiscal Years 2021 

through 2026

Note: This projection assumes no further augmentation of highway-related taxes to the Highway Trust 

Fund after 2021 from general revenues or other sources. By law, the Highway Trust Fund cannot 

incur negative balances.

Congress and the administration need to agree on a long-term plan for 

funding surface transportation. Continuing to augment the Highway Trust 

Fund with general revenues may not be sustainable, given competing 

demands and the federal government’s fiscal challenges. A sustainable 

solution would balance revenues to and spending from the Highway Trust 

Fund. New revenues from users can come only from taxes and fees; 

ultimately, major changes in transportation spending or in revenues, or in 

both, will be needed to bring the two into balance.

A long-term sustainable plan for funding surface transportation requires 

congressional action and remains the pivotal action that will determine 

whether the funding of surface transportation remains on, or is removed 

from, our High-Risk List. DOT will also need to continue implementing the 

performance-based approach to surface transportation mandated in the 

Moving Ahead for Progress in the 21st Century Act (MAP-21) and 

discussed below. It will become increasingly important to improve the 

effectiveness of surface transportation programs by establishing links to 

performance, measuring progress toward clear national goals, and 

What Remains to Be 

Done
Funding the Nation’s Surface Transportation 

System

Page 102 GAO-17-317 High-Risk Series

enhancing the management of discretionary grant programs. These 

actions are essential to maximizing the use of available resources.

The challenge of funding the nation’s surface transportation system is 

magnified by the fact that spending for surface transportation programs 

has not commensurately improved system performance. Many programs 

have not effectively addressed key challenges—such as deteriorating 

infrastructure conditions and increasing congestion and freight demand—

because federal goals and roles have been unclear, programs have 

lacked links to performance, and programs have not used the best tools 

and approaches to ensure effective investment decisions. Beginning in 

2008, we recommended that Congress consider a fundamental 

reexamination of these programs to clarify federal goals and roles, 

establish performance links, and improve investment decision making. 

More recently, we found that it can be difficult to determine the extent to 

which federal funding has improved system performance. Specifically, in 

2016, we found that while the Federal Highway Administration (FHWA) 

collects and maintains data on both federal funding for bridge projects 

and bridge conditions, it lacks a means of demonstrating the link between 

such funding and changes in bridge conditions. We recommended that 

the FHWA Administrator develop an efficiency measure to demonstrate 

the link between funding and bridge infrastructure outcomes, and report 

that information to Congress. DOT concurred with our recommendation 

and we are awaiting information on what steps DOT plans to take to 

implement it.

Congress passed provisions in MAP-21 in 2012 to help address the key 

challenges we identified in 2008. Among other things, the act included 

provisions to move toward a more performance-based highway and 

transit program. Specifically, MAP-21 established national performance 

goals in areas such as infrastructure condition, safety, and system 

performance; MAP-21 also outlined a three-stage process in which (1) 

DOT establishes performance measures for these national goals, (2) 

states and other grantees set targets based on these performance 

measures and report annually on their progress, and (3) DOT evaluates 

whether grantees have met their targets and reports to Congress.

DOT is in the process of implementing MAP-21’s performance 

management approach through rulemaking. In January 2017, DOT 

finalized the last of seven interrelated rules that will, among other things, 

establish the performance measures that states will be required to set 

targets for and report progress on in the areas of safety, pavement and 

Additional Details on 

What GAO Found
Funding the Nation’s Surface Transportation 

System

Page 103 GAO-17-317 High-Risk Series

bridge conditions, and system performance. For example, the System 

Performance Measure rule includes measures for freight movement, 

traffic congestion, and air quality and received over 8,800 public 

comments. MAP-21 also required states to report on their progress in 

implementing the transportation performance management requirements 

to DOT by October 2016 and required DOT to report to Congress on 

progress made by October 2017. Because several of the final rules were 

recently issued, it is too early for states to report on progress, and thus 

DOT provided guidance to states, requesting that they instead report on 

their general performance management activities. We plan to report on 

DOT and state progress and anticipated challenges implementing the 

new national transportation performance management framework in the 

summer of 2017.

Congress and DOT have also taken steps to more strategically address 

freight congestion, though many of DOT’s actions are in the early stages. 

For example, MAP-21 established national goals and directed the 

Secretary of Transportation to establish a national freight network, 

develop a strategic freight plan, and provide the tools necessary to 

support a performance-based approach for evaluating and selecting new 

freight projects. The 2015 FAST Act made some changes to, and built 

upon, some of MAP-21’s freight provisions. Specifically, it extended the 

deadline for DOT to finalize the National Freight Strategic plan from 

October 2015 to December 2017. The public comment period for the draft 

plan closed on April 2016 and, according to DOT, it is on track to finalize 

the plan by the new deadline. The FAST Act also directed DOT to 

establish for the first time a National Multimodal Freight Network and also 

a National Highway Freight Network.

The National Highway Freight Network is to be used to strategically direct 

federal resources and policies toward improved performance of highway 

portions of the U.S. freight transportation system. Finally, the FAST Act

established a competitive grant program to fund freight and highway 

projects of regional or national importance. In 2016, DOT awarded 

approximately $760 million for the Fostering Advancements in Shipping 

and Transportation for the Long-term Achievement of National 

Efficiencies (FASTLANE) grant program to 18 freight projects.

We have reported that the historic approach to funding surface 

transportation, in particular highways, poses challenges to incorporating 

performance and accountability for results into transportation funding 

decisions. This situation exists because funding has been principally 

provided through formulas designed to yield a largely predetermined 
Funding the Nation’s Surface Transportation 

System

Page 104 GAO-17-317 High-Risk Series

outcome—that of returning revenues to their attributed state of origin. For 

three highway programs designed to meet national and regional 

transportation priorities, we recommended that Congress consider a 

competitive, criteria-based process for distributing federal funds. The 

FAST Act authorized about a dozen new discretionary grant programs, 

some of which DOT is already implementing, including the FASTLANE 

program. While over 90 percent of funds will continue to be distributed by 

formula, the FAST Act represents a promising development to address 

national and regional transportation priorities.

Nevertheless, we have found challenges with DOT’s implementation of 

discretionary grant programs, including problems documenting key 

evaluation and project selection decisions. For example, in May 2014, we 

found that DOT did not document key decisions—such as accepting and 

reviewing project applications received after the published deadline, or 

changes to projects’ technical ratings— and deviated from established 

procedures and recognized internal control practices in awarding 

Transportation Investment Generating Economic Recovery (TIGER) 

discretionary grants. We recommended that the Secretary of 

Transportation establish additional accountability measures by, among 

other things, issuing a decision memorandum or similar mechanism to 

document and approve major decisions in the application evaluation and 

project-selection process. DOT generally agreed with, but has not fully 

implemented, this recommendation.

In addition, in December 2016, we found that the Federal Transit 

Administration (FTA) did not document key decisions in awarding $3.6 

billion in discretionary, competitive grants for projects to increase the 

resilience of transit systems to withstand future disasters in areas affected 

by Hurricane Sandy. For example, FTA did not document how it 

addressed reviewers’ concerns that some of the proposed—and 

ultimately funded—projects were outside the scope of the grant program. 

We also found that because FTA did not incorporate information collected 

from applicants and reviewers into its selection process, it may have 

funded projects that may no longer be needed if other resilience projects 

in the same region are implemented. We recommended that FTA 

examine its funded projects for potential duplication with other resilience 

efforts and determine if realigning or rescinding those funds is 

appropriate. DOT concurred with our recommendation and we are 

awaiting information on what steps DOT plans to take to implement it.

Given the continuing challenges we found with DOT discretionary grant 

programs, and the number of new programs authorized by the FAST Act, 
Funding the Nation’s Surface Transportation 

System

Page 105 GAO-17-317 High-Risk Series

we recommended in December 2016 that the Secretary of Transportation 

issue a directive governing department-wide and modal administration 

discretionary grant programs. Such a directive should include 

requirements to, among other things, (1) develop an up-front plan for 

evaluating project proposals to ensure DOT reviews applications 

consistently; and (2) document key decisions, including the reason for 

any rating changes, as well as how high-level concerns raised during the 

process were addressed. Developing such a directive would help to 

ensure the integrity of future DOT discretionary grant programs. DOT 

concurred with our recommendation and we are awaiting information on 

what steps DOT plans to take to implement it.

For additional information about this high-risk area, contact Susan 

Fleming at (202) 512-2834 or FlemingS@gao.gov.

DOT Discretionary Grants: Problems with Hurricane Sandy Transit Grant 

Selection Process Highlight the Need for Additional Accountability. 

GAO-17-20. Washington, D.C.: December 14, 2016.

West Coast Ports: Better Supply Chain Information Could Improve DOT’s 

Freight Efforts. GAO-17-23. Washington, D.C.: October 31, 2016.

Highway Bridges: Linking Funding to Conditions May Help Demonstrate 

Impact of Federal Investment. GAO-16-779. Washington, D.C.: 

September 14, 2016.

U.S. Border Communities: Ongoing DOT Efforts Could Help Address 

Impacts of International Freight Rail. GAO-16-274. Washington, D.C.: 

January 28, 2016.

Surface Transportation: DOT Is Progressing Toward a PerformanceBased Approach, but States and Grantees Report Potential 

Implementation Challenges. GAO-15-217. Washington, D.C.: January 16, 

2015.

Surface Transportation: Department of Transportation Should Measure 

the Overall Performance and Outcomes of the TIGER Discretionary Grant 

Program. GAO-14-766. Washington, D.C.: September 23, 2014.

GAO Contact

Related GAO 

Products
Funding the Nation’s Surface Transportation 

System

Page 106 GAO-17-317 High-Risk Series

Freight Transportation: Developing National Strategy Would Benefit from 

Added Focus on Community Congestion Impacts. GAO-14-740. 

Washington, D.C.: September 19, 2014.

Surface Transportation: Actions Needed to Improve Documentation of 

Key Decisions in the TIGER Discretionary Grant Program. GAO-14-628R. 

Washington, D.C.: May 28, 2014.

Highway Trust Fund: Pilot Program Could Help Determine the Viability of 

Mileage Fees for Certain Vehicles. GAO-13-77. Washington, D.C.: 

December 13, 2012.

Highway Trust Fund: All States Received More Funding Than They 

Contributed in Highway Taxes from 2005 to 2009. GAO-11-918. 

Washington, D.C.: September 8, 2011.

Surface Transportation: Clear Federal Role and Criteria-Based Selection 

Process Could Improve Three National and Regional Infrastructure 

Programs. GAO-09-219. Washington, D.C.: February 6, 2009.

Surface Transportation: Restructured Federal Approach Needed for More 

Focused, Performance-Based, and Sustainable Programs. GAO-08-400. 

Washington, D.C.: March 6, 2008.
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 107 GAO-17-317 High-Risk Series

Congress and financial regulators have made progress in meeting criteria 

for removing the issue area of reforming the U.S. financial regulatory 

system from our High-Risk List. However, definitive steps have yet to be 

taken to address the federal government’s role in housing finance. As the 

worst financial crisis in more than 75 years unfolded, unprecedented 

federal support was provided to many firms, including Fannie Mae and 

Freddie Mac, two large, housing-related government-sponsored 

enterprises (the enterprises). Many households suffered as a result of 

falling asset prices, tightening credit, and increasing unemployment. 

These events clearly demonstrated that the U.S. financial regulatory 

system had failed to respond effectively to developments in the markets 

and to the increase in systemic risks that contributed to the crisis.1 Given 

the challenges that regulators would face in identifying and implementing 

changes to reduce the potential for such events to occur again, we 

designated reform of the financial regulatory system as a high-risk area in 

2009.2

According to data from Inside Mortgage Finance, the federal government 

has directly or indirectly supported more than two-thirds of the value of 

new mortgage originations in the single-family housing market in the 

years since the crisis began. Mortgages with federal support include 

those backed by the enterprises, which the Federal Housing Finance 

Agency (FHFA) placed under government conservatorship in 2008, and 

whose future role in the housing finance system has yet to be determined. 

The federal government also supports mortgages through insurance or 

guarantee programs, the largest of which is administered by the 

Department of Housing and Urban Development’s (HUD) Federal 

Housing Administration (FHA).3 During the financial crisis, FHA served its 

traditional role of helping to stabilize the housing market, but also 

experienced financial difficulties from which it only recently recovered. 

Until decisions are made about what role the federal government will play 

in housing finance, housing and mortgage markets continue to pose 

increased risks to taxpayers and the U.S. financial system. In light of 

 1

GAO, Financial Regulation: A Framework for Crafting and Assessing Proposals to 

Modernize the Outdated U.S. Financial Regulatory System, GAO-09-216 (Washington, 

D.C.: Jan. 8, 2009). 

2

GAO, High-Risk Series: An Update, GAO-09-271 (Washington, D.C.: January 2009). 

3

The Department of Veterans Affairs and the Department of Agriculture’s Rural Housing 

Service also administer mortgage guarantee programs.

Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Why Area Is High 

Risk 
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 108 GAO-17-317 High-Risk Series

developments at the enterprises and FHA, we added this issue to the 

scope of this high-risk area in 2013.4

Congress and financial regulators have made progress in meeting criteria 

for removing the issue area of reforming the U.S. financial regulatory 

system from our High-Risk List, but additional steps are needed to 

improve the structure of the financial regulatory system and the 

implementation of some reforms. Demonstrating leadership commitment 

and capacity, Congress enacted sweeping reforms in 2010 through the 

Dodd-Frank Wall Street Reform and Consumer Protection Act (DoddFrank Act) and regulators have worked to implement the act’s numerous 

reforms. Continued leadership commitment from financial regulators and 

Congress will be needed to fully implement the reforms and additional 

work will be needed to exhibit capacity to complete oversight and 

monitoring plans, monitor progress, and demonstrate the effectiveness of 

the new oversight bodies and regulations.

Policymakers have made proposals to overhaul the federal role in the 

housing finance system, but additional leadership commitment will be 

needed to reach consensus and enact changes to the system. The 

ongoing federal conservatorship of the enterprises and FHA’s need for 

supplemental funds in 2013 underscore the need to reconsider the 

federal role. Federal agencies have taken some steps to develop plans, 

build capacity, and provide monitoring mechanisms that could help build a 

more robust housing finance system. However, progress toward resolving 

the federal role within that system will be difficult to achieve without an 

overall blueprint for change.

In the decades leading up to the recent crisis, the U.S. financial regulatory 

system failed to adapt to significant changes. First, although the U.S. 

financial system increasingly had become dominated by large, 

interconnected financial conglomerates, no single regulator was tasked 

with monitoring and assessing the risks that these firms’ activities posed 

across the entire financial system. Second, entities—such as nonbank 

mortgage lenders, hedge funds, and credit rating agencies—that had 

come to play critical roles in the financial markets were not subject to 

sufficiently comprehensive regulation and oversight. Third, the regulatory 

system was not effectively providing key information and protections for 

 4

GAO, High-Risk Series: An Update, GAO-13-283 (Washington, D.C.: February 2013). 

What GAO Found
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 109 GAO-17-317 High-Risk Series

new and more complex financial products for consumers and investors. 

Taking steps to better position regulators to oversee firms and products 

that pose risks to the financial system and consumers, and to adapt to 

new products and participants as they arise, could reduce the likelihood 

that the financial markets will experience another financial crisis similar to 

the one in 2007–2009.

Losses from risky mortgage products also resulted in the enterprises 

being placed into federal conservatorship in 2008, creating an explicit 

fiscal exposure for the federal government. The enterprises received 

more than $187 billion in financial assistance from the Department of the 

Treasury (Treasury) through purchases of senior preferred stock, but 

have paid more than $250 billion in dividends to Treasury under the stock 

purchase agreements. Distressed housing and mortgage markets also 

expanded FHA’s role in the mortgage market, while leading to 

deterioration in the agency’s financial condition from which it has taken 

years to recover. In 2015, mortgages directly or indirectly supported by 

the federal government accounted for more than 70 percent of the dollar 

value of new single-family mortgage originations, according to data from 

Inside Mortgage Finance.

Although more needs to be done to address this high-risk issue, there 

have been several benefits achieved by implementing our 

recommendations.

• In a March 2016, we reported that Treasury had not instituted a 

system to review the extent to which it would use the available 

program balance for the Making Home Affordable (MHA) program. 

Consistent with our recommendations, Treasury updated estimates of 

future MHA program expenditures, deobligated $2 billion from the 

MHA program, and announced a $2 billion increase in funding for the 

Hardest Hit Fund.

• In June 2013, we made recommendations intended to increase FHA’s 

returns on sales of foreclosed properties with FHA-insured mortgages. 

FHA’s actions in response to our recommendations improved its 

returns and led to financial benefits totaling more than $3.4 billion in 

fiscal years 2013–2016.

• In June 2012, we recommended that Treasury and FHA update their 

estimates of program participation and use the updated estimates to 

reassess the terms the $8 billion letter of credit facility for FHA’s 

Refinance for Borrowers in Negative Equity Positions program. As a 

result, Treasury amended the purchase agreement and deobligated 
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 110 GAO-17-317 High-Risk Series

approximately $7.1 billion dollars, which was returned to the general 

fund in fiscal year 2013.

• In November 2005, we recommended that FHA take a number of 

steps to mitigate the risks associated with mortgages with down 

payment assistance from nonprofit organizations funded by property 

sellers. Citing our work, Congress prohibited seller-funded downpayment assistance, effective October 1, 2008. In fiscal year 2013, 

the financial benefit to the federal government of not insuring such 

loans was approximately $2.5 billion.

Continued leadership commitment is needed to ensure that financial 

regulations foster stable, competitive and well-functioning markets. Our 

review of selected major rules—that is, those likely to result in an annual 

impact on the economy of $100 million or more, among other things—

found that regulators generally quantified some of the costs but not 

always the benefits of each rule, noting data and other limitations. 

Although the federal financial regulators—as independent agencies—are 

not subject to executive orders requiring detailed cost-benefit analysis in 

accordance with Office of Management and Budget (OMB) guidance, we 

have recommended that the regulators more fully incorporate OMB’s 

regulatory guidance into their written rulemaking policies. However, not all 

regulators have implemented this recommendation. The Administration 

and members of Congress have expressed intentions to reduce financial 

regulatory burdens. Such actions would be most effective if they largely 

preserve the benefits sought by the regulations while allowing institutions 

to comply with the requirements in less costly ways. 

The full impact of the Dodd-Frank Act remains uncertain because some of 

its rules have not been finalized and insufficient time has passed to 

evaluate others. For example, the Dodd-Frank Act prohibits insured 

depository institutions and any company affiliated with an insured 

depository institution from engaging in proprietary trading and from 

acquiring or retaining ownership interests in, sponsoring, or having certain 

relationships with a hedge fund or private equity fund. Banks were initially 

expected to have implemented these restrictions by July 2014, but the 

Federal Reserve twice extended the conformance date, with affected 

entities now required to conform by July 2017. Similarly, the higher capital 

What Remains to Be 

Done

Actions Needed to 

Complete and Ensure the 

Effective Functioning of 

Reforms to the U.S. 

Financial Regulatory 

System
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 111 GAO-17-317 High-Risk Series

requirements that regulators adopted for banks in October 2013 have 

some provisions that will not be fully effective until January 2019.

Additional leadership from Congress is also needed to improve the 

inefficiencies that hamper the current financial regulatory system. 

Although the Dodd-Frank Act implemented a number of key reforms 

intended to address significant weaknesses and gaps in the regulatory 

system, the U.S. financial regulatory structure remains complex, with 

responsibilities fragmented among a number of regulators that have 

overlapping authorities. We have noted that this fragmentation, overlap, 

and duplication introduce significant challenges for efficient and effective 

oversight of financial institutions and activities.

The framework we developed in 2009 for evaluating regulatory reform 

proposals noted that an effective regulatory system would address certain 

structural shortcomings created by fragmentation and overlap. To help 

achieve this, we have suggested that Congress consider whether 

additional changes to the financial regulatory structure are needed to 

reduce or better manage fragmentation and overlap in the oversight of 

financial institutions and activities to improve the efficiency and 

effectiveness of oversight. For example, Congress could consider 

consolidating the number of federal agencies involved in overseeing the 

safety and soundness of depository institutions, combining the entities 

involved in overseeing the securities and derivatives markets, transferring 

the remaining prudential regulators’ consumer protection authorities over 

large depository institutions to the Consumer Financial Protection Bureau 

(CFPB), and determining the optimal federal role in insurance regulation.

Congressional leadership also could improve the ability of the U.S. 

regulatory system to address systemic risks. Although the Financial 

Stability Oversight Council (FSOC) represents advancement in 

addressing systemic risk threats to the U.S. financial system, its legal 

authorities may not be broad enough to ensure that it can address all 

threats effectively. Under the Dodd-Frank Act, FSOC can respond to 

certain potential systemic risks primarily through its authority to designate 

certain entities or activities that pose a threat to financial stability for 

enhanced supervision by a specific federal regulator. We reported in 

February 2016 that FSOC’s designation authorities, by statute, cannot be 

used to address certain types of risks, such as specific industry-wide 

activities involving nonbank financial institutions, and the full scope of 

FSOC’s designation authority remains untested and unclear to date.
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 112 GAO-17-317 High-Risk Series

FSOC has other nondesignation authorities that allow it to recommend 

that individual regulators address specific risks, but these 

recommendations are nonbinding. As a result, we suggested that 

Congress consider whether legislative changes would be necessary to 

align FSOC’s authorities with its mission to respond to systemic risks. 

Such actions could include changes to FSOC’s mission, its authorities, or 

both, or to the missions and authorities of one or more of the FSOC 

member agencies to support a stronger link between its responsibility and 

capacity to respond to systemic risks.

Additional leadership, planning, capacity, and monitoring activities by U.S. 

financial regulators also could improve systemic risk oversight. While the 

newly created systemic risk and financial research bodies have been 

established, we have continued to identify additional steps they need to 

take to fully meet their envisioned missions. The Dodd-Frank Act 

maintained the independence of the system’s multiple regulators but 

created FSOC to identify and respond to systemic risks. We noted in 

February 2016 that this approach to systemic risk oversight requires 

consistent and highly effective interagency collaboration and the use of 

good quantitative and qualitative information. However, we reported then 

that FSOC’s Systemic Risk Committee is not fully and consistently 

informed by the Office of Financial Research (OFR) and the Federal 

Reserve’s monitoring tools or other outputs, and we recommended this 

be done.

In addition, we found that both OFR and the Federal Reserve conduct 

broad-based systemic risk monitoring activities that aim to identify threats 

across the financial system and recommended that the two agencies 

jointly articulate individual and common goals for their systemic risk 

monitoring activities, including a plan to monitor progress toward 

articulated goals, and formalize regular strategic and technical 

discussions around their activities and outputs to support those goals. 

Such efforts could help ensure that FSOC more accurately measures the 

effect of significant Dodd-Frank Act regulations but also more efficiently 

coordinates with its members to leverage retrospective reviews.

In our priority recommendations letter to Treasury, we identified some 

actions that could be taken to improve regulators’ ability to oversee 

systemic risks. First, we noted that FSOC and OFR need to clarify 

responsibility for implementing requirements to monitor threats to financial 

stability across FSOC and OFR, including FSOC members and member 
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 113 GAO-17-317 High-Risk Series

agencies, to better ensure that the monitoring and analysis of the financial 

system are comprehensive and not unnecessarily duplicative.5 In 

addition, to improve the data that council members need to conduct their 

responsibilities, FSOC should direct OFR to work with its members to 

identify and collect the data necessary to assess the effect of the DoddFrank Act regulations on, among other things, the stability, efficiency, and 

competitiveness of the U.S. financial markets.6

Financial regulators need to demonstrate further progress by taking 

additional actions. Although FSOC’s ability to identify firms whose 

financial difficulties could pose threats to the overall financial system is an 

important oversight tool, we reported in November 2014 that the 

transparency of its process for designating systemically important 

nonbank entities could be improved.7 Designating these entities in a way 

that supports public and market confidence could help mitigate the 

potential for such entities to endanger the stability of the U.S. financial 

system. Thus, we recommended that FSOC take various steps to 

improve the tracking of its process and disclose the rationales for its 

designations in greater detail. Since then, FSOC has issued supplemental 

procedures for nonbank financial company designations that stated its 

commitment to continuing to provide the public with an understanding of 

the council’s analysis and a subsequent designation document included 

additional information compared to prior ones. However, that document 

did not fully explain how FSOC concluded that a company’s 

characteristics were sufficiently large or significant enough, or had other 

attributes, to meet a determination standard.

Demonstrated progress is needed to ensure the effectiveness of reforms 

addressing the resolution of troubled firms. Although regulators have 

made progress conducting their reviews of the resolution plans of large 

financial institutions, the time they took to complete these reviews and 

provide feedback did not provide some companies with sufficient time to 

fully incorporate changes into subsequent plans. As a result, we 

recommended that the Federal Reserve and Federal Deposit Insurance 

 5

GAO, Financial Stability: New Council and Research Office Should Strengthen the 

Accountability and Transparency of Their Decisions, GAO-12-886 (Washington, D.C: 

Sept. 11, 2012). 

6

GAO, Dodd-Frank Act Regulations: Implementation Could Benefit from Additional 

Analyses and Coordination, GAO-12-151 (Washington, D.C: Nov. 10, 2011). 

7

GAO-09-216. 
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 114 GAO-17-317 High-Risk Series

Corporation address these weaknesses. In addition, we recommended in 

2016 numerous steps the Federal Reserve could take to improve the 

stress tests that assess how large financial institutions would be affected 

by changes in economic or other conditions.

Additional progress is needed to address other risks. Although the 

Federal Reserve has worked with the two clearing banks for the 

repurchase (repo) market to reduce their problematic credit exposures, 

the FSOC 2015 annual report notes that the risk of fire sales of collateral 

by creditors of a defaulted broker-dealer remains an important financial 

stability concern. For instance, many of the creditors may themselves be 

vulnerable to runs in a stress event. As a result, the council expressed the 

need for market participants to continue to improve the settlement 

processes for these transactions.

Resolving the role of the federal government in housing finance will 

require continued leadership commitment by Congress and the 

administration. Prolonged conservatorships and a change in leadership at 

FHFA could shift priorities for the conservatorships, which in turn could 

send mixed messages and create uncertainties for market participants 

and hinder the development of the broader secondary mortgage market. 

For this reason, we said in November 2016 that Congress should 

consider legislation establishing objectives for the future federal role in 

housing finance, including the structure of the enterprises, and a 

transition plan to a reformed housing finance system that enables the 

enterprises to exit conservatorship.8

Maintaining FHA’s long-term financial health and defining its future role 

also will be critical to any effort to overhaul the housing finance system. 

We previously recommended that Congress or FHA specify the economic 

conditions that FHA’s Mutual Mortgage Insurance (MMI) Fund would be 

expected to withstand without requiring supplemental funds.9 As 

evidenced by the $1.68 billion FHA received in 2013, the 2 percent capital 

requirement for FHA’s MMI Fund may not always be adequate to avoid 

the need for supplemental funds under severe stress scenarios. 

 8

GAO, Federal Housing Finance Agency: Objectives Needed for the Future of Fannie Mae 

and Freddie Mac After Conservatorships, GAO-17-92 (Washington, D.C.: Nov. 17, 2016).

9

GAO, Mortgage Financing: FHA’s Fund Has Grown, but Options for Drawing on the Fund 

Have Uncertain Outcomes, GAO-01-460 (Washington, D.C.: Feb. 28, 2001).

Actions Needed to 

Resolve the Federal Role 

in Housing Finance
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 115 GAO-17-317 High-Risk Series

Implementing our recommendation would be an important step not only in 

addressing FHA’s long-term financial viability, but also in clarifying FHA’s 

role. FHA also will need to sustain the progress it made in strengthening 

the health of the MMI Fund and implementing sound risk-management 

practices. Furthermore, it will be important for FHA and other agencies 

with housing finance-related responsibilities to fully implement our 

recommendations on evaluating the effectiveness of foreclosure 

mitigation actions, opportunities for consolidating similar housing 

programs, and the effect of recent mortgage market regulations.10

Due to the interconnected nature of the housing finance system and the 

central role homeownership plays in the U.S. economy, changes will need 

to be carefully designed and implemented. In October 2014, we issued a 

framework consisting of nine elements that Congress and others can use 

as they consider changes to the housing finance system.11 The 

framework has the following elements:

• clearly defined and prioritized goals for the housing finance system;

• policies and mechanisms that are aligned with goals and other 

economic policies;

• adherence to an appropriate financial regulatory framework;

• government entities with the capacity to manage risks;

• protections for mortgage borrowers and actions to address barriers to 

mortgage market access;

• protection for mortgage securities investors;

• consideration of the cyclical nature of housing finance and the effect 

of housing finance on financial stability;

• recognition and control of fiscal exposure and mitigation of moral 

hazard; and

• emphasis on implications of the transition.

 10See GAO, Mortgage Reforms: Actions Needed to Help Assess Effects of New 

Regulations, GAO-15-185 (Washington, D.C.: June 25, 2015); Housing Assistance: 

Opportunities Exist to Increase Collaboration and Consider Consolidation, GAO-12-554 

(Washington, D.C.: Aug. 16, 2012); and Foreclosure Mitigation: Agencies Could Improve 

Effectiveness of Federal Efforts with Additional Data Collection and Analysis, GAO-12-296 

(Washington, D.C.: June 28, 2012).

11GAO, Housing Finance System: A Framework for Assessing Potential Changes, 

GAO-15-131 (Washington, D.C.: Oct. 7, 2014). 
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 116 GAO-17-317 High-Risk Series

Each element in the framework is critically important in establishing the 

most effective and efficient housing finance system. Applying the 

elements of this framework would help policymakers identify the relative 

strengths and weaknesses of any proposals they consider. Similarly, the 

framework can be used to craft proposals or to identify changes to 

existing proposals to make them more effective and appropriate for 

addressing any limitations of the current system. However, any viable 

proposal for change must recognize that sometimes tradeoffs will exist 

among and within the nine elements. If Congress enacts changes to the 

housing finance system, relevant federal agencies will need to develop 

the capacity and action plans necessary to effectively implement the 

changes and monitor progress.

FHA needs to complete or build on steps it has taken in response to two 

priority recommendations that were not fully implemented as of October 

2016. First, FHA has partially addressed recommendations from our June 

2012 report on reducing losses from troubled mortgages, but needs to 

finish analyzing and reevaluating its loss mitigation approaches in order to 

optimize these efforts.12 Second, FHA and other agencies that are part of 

a single-family housing task force need to evaluate and report on the 

opportunities for consolidating similar housing programs, as we 

recommended in an August 2012 report.13

Additional congressional leadership is needed to address this high-risk 

area. Specifically, Congress should consider whether additional changes 

to the financial regulatory structure are needed to reduce or better 

manage fragmentation and overlap in the oversight of financial institutions 

and activities to improve (1) the efficiency and effectiveness of oversight; 

(2) the consistency of consumer and investor protections; and (3) the 

consistency of financial oversight for similar institutions, products, risks, 

and services. In addition, Congress could consider whether legislative 

changes would be necessary to align FSOC’s authorities with its mission 

to respond to systemic risks. Such actions could include changes to 

FSOC’s mission, its authorities, or both, or to the missions and authorities 

of one or more of the FSOC member agencies to support a stronger link 

between its responsibility and capacity to respond to systemic risks. Also, 

Congress should consider legislation establishing objectives for the future 

 12GAO-12-296. 

13GAO-12-554. 

Congressional Actions 

Needed
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 117 GAO-17-317 High-Risk Series

federal role in housing finance, including the structure of the enterprises, 

and a transition plan to a reformed housing finance system that enables 

the enterprises to exit conservatorship.

Policymakers and regulators have partially met the leadership criterion for 

removal from the High-Risk List. Since the crisis, policymakers and 

regulators showed leadership commitment by enacting and implementing 

the Dodd-Frank Act, which included reforms intended to better position 

the financial regulatory system to address many of the risks we identified. 

For example, the act created FSOC, which includes various financial 

regulators. FSOC’s responsibilities include monitoring the stability of the 

Additional Details on 

What GAO Found

Implementation and 

Effective Functioning of 

Regulations and New 

Financial Regulatory 

Bodies

Leadership Commitment
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 118 GAO-17-317 High-Risk Series

U.S. financial system and acting to mitigate risks that might destabilize 

the system. In addition, the act consolidated responsibility for consumer 

financial protection laws into a new agency, CFPB. However, some 

reforms, including several rules addressing over-the-counter derivatives 

reforms, have yet to be fully implemented.

Additional leadership is needed from Congress to address the limitations 

that hamper the current financial regulatory structure. Although the DoddFrank Act made changes that were consistent with some of the 

characteristics we have identified for an effective financial regulatory 

framework, the existing regulatory structure does not always ensure (1) 

efficient and effective oversight, (2) consistent consumer protections, and 

(3) consistent financial oversight. As a result, negative effects of 

fragmented and overlapping authorities persist throughout the system. 

Without congressional action it is unlikely that remaining fragmentation 

and overlap in the U.S. financial regulatory system can be reduced or that 

policymakers and regulators can more effectively and efficiently oversee 

financial institutions. Members of Congress have also expressed 

concerns about the burdens that the new regulations may have created 

for financial institutions and have indicated plans to reduce these 

burdens.

Regulators have partially met the capacity criterion for removal from the 

High-Risk List. Regulators have made considerable progress in finalizing 

the rulemakings necessary to implement the Dodd-Frank Act regulatory 

reforms. As of January 2017, regulators had issued final rules for 186 (79 

percent) of the 236 provisions of the act that we identified as requiring 

rulemaking. For example, since we last reported on this high-risk issue, 

the Commodity Futures Trading Commission and the Securities and 

Exchange Commission largely finalized various rules required by the act 

that relate to trading swaps and other derivatives. CFPB also finalized 

amendments to a key rule—which became effective in October 2015—

that provides consumers with an integrated disclosure of the key features, 

costs, and risks of their home mortgages at the time they apply. 

Previously we reported in January 2013 that delays in completing rules 

sometimes arose because the large volume of required rules strained 

regulators’ capacities or because of the need to coordinate complicated 

rulemakings across multiple regulators or with international counterparts, 

but staff from the Securities and Exchange Commission and the 

Commodity Futures Trading Commission, which had reported 

experiencing difficulties due to resource constraints, told us that while 

Capacity
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 119 GAO-17-317 High-Risk Series

they continue to face such constraints they are taking steps to address 

their obligations to finalize the remaining rules.14

Regulators have made some progress in developing action plans for 

completing reforms and have partially met this criterion for removal from 

the High-Risk List. Since 2010, regulators have taken steps to prioritize 

rulemakings, including FSOC issuing an integrated implementation road 

map for required rules and publishing a consultation framework for 

guiding rulemaking coordination activities among agencies. FSOC’s 

annual reports serve as the council’s key accountability document, as 

each report discusses the progress regulators have made in 

implementing reforms, identifies newly emerging threats, and includes 

recommendations to address them. We also reported in February 2016 

that the work of FSOC’s Systemic Risk Committee has become better 

integrated into the council’s annual reports.15

Regulators have made some progress in monitoring implementation 

progress and have partially met this criterion for removal from the HighRisk List. OFR conducts broad-based systemic risk monitoring efforts, 

including developing a quantitative systemic risk monitoring tool called the 

Financial Stability Monitor. We also reported in 2015 that federal banking 

regulators have taken steps to incorporate the lessons learned from the 

2007-2009 financial crisis to improve their ability to identify and respond 

to emerging risks, including incorporating forward-looking elements, such 

as stress testing, into the examiners’ considerations of risk in individual 

institutions.16 In addition, the financial regulators have other monitoring 

tasks that are ongoing. Under various statutes, the financial regulators 

are to conduct analyses of the effect of their rules. We reported in 

December 2015 that the regulators are engaged in these retrospective 

analyses.17 Moreover, we developed indicators which, when monitored 

 14GAO, Financial Regulatory Reform: Regulators Have Faced Challenges Finalizing Key 

Reforms and Unaddressed Areas Pose Potential Risks, GAO-13-195 (Washington, D.C.: 

Jan. 23, 2013).

15GAO, Financial Regulation: Complex and Fragmented Structure Could Be Streamlined 

to Improve Effectiveness, GAO-16-175 (Washington, D.C.: Feb. 25, 2016).

16GAO, Bank Regulation: Lessons Learned and a Framework for Monitoring Emerging 

Risks and Regulatory Response, GAO-15-365 (Washington, D.C.: June 25, 2015).

17GAO, Dodd-Frank Regulations: Impacts on Community Banks, Credit Unions and 

Systemically Important Institutions, GAO-16-169 (Washington, D.C.: Dec. 30, 2015).

Action Plan

Monitoring
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 120 GAO-17-317 High-Risk Series

over time, may be useful to these regulators in monitoring the effect of 

regulations on banks and credit unions.

Regulators have partially met the demonstrated progress criterion for 

removal from the High-Risk List. The new regulatory bodies have been 

taking actions to carry out their missions. For example, FSOC meets 

regularly to discuss issues related to risks to the U.S. financial system 

and issues an annual report that addresses market and regulatory 

developments across the financial system.

As a result of FSOC determining that the activities or characteristics of 

some entities are systemically important, various financial market utilities 

(which perform key functions in the financial system) were designated to 

be subject to prescribed risk management standards and four nonbank 

financial companies were designated to be subjected to enhanced 

prudential standards and supervision by the Board of Governors of the 

Federal Reserve (Federal Reserve), although the United States District 

Court for the District of Columbia rescinded the designation applicable to 

one company and FSOC rescinded the designation of another after the 

company changed its operations to reduce its systemic importance.18

As part of making progress in demonstrating the effectiveness of 

implemented reforms, FSOC also issued a mandated report in March 

2016 that addressed the effect regulatory changes are having on firm 

sizes, diversification, and other issues. CFPB has implemented rules and 

taken enforcement actions that resulted in billions of dollars of relief to 

consumers. With the recent crisis demonstrating the importance of 

efficiently resolving systemically important financial institutions that fail, 

the Federal Reserve and the Federal Deposit Insurance Corporation 

completed several annual reviews of resolution plans that the Dodd-Frank 

Act mandates large systemically important financial institutions prepare. 

And in response to one of our recommendations, the agencies made 

additional information public about the criteria they use to evaluate the 

plans.

 18FSOC designated a fourth firm, General Electric Capital Corporation, Inc., as 

systemically important, but has subsequently rescinded the designation after the company 

changed its business such that if it experienced material financial distress it would no 

longer pose a threat to U.S. financial stability. The United States Court of Appeals for the 

District of Columbia Circuit has heard oral argument regarding the status of the MetLlife, 

Inc. designation. The court has not issued a ruling on the designation as of December 

2016.

Demonstrated Progress
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 121 GAO-17-317 High-Risk Series

Regulators also made progress reducing the potential systemic 

implications of certain concentrations of credit risks the Dodd-Frank Act 

had not addressed. Regulators have been working to reduce the potential 

for serious problems arising from the failure of one of the two clearing 

banks that provide credit to facilitate transactions in the tri-party 

repurchase (repo) market that provides short-term funding to many 

financial institutions. FSOC’s 2015 annual report noted that market 

participants have reduced their reliance on intraday credit from the 

clearing banks, which reduces the risks posed by these activities.

Policymakers have shown some commitment to resolving the federal role 

in housing finance and have partially met this criterion for removal from 

the High-Risk List. For example, in 2015 and 2016, several legislative 

proposals were introduced that addressed the future of the housing 

finance system. Some proposals focused on the secondary mortgage 

market, including the finances and ultimate disposition of the enterprises 

and developing a common mortgage securitization platform. The 

proposals varied in their views of an appropriate federal role in a new 

Resolution of the Role of 

the Federal Government in 

Housing Finance

Leadership Commitment
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 122 GAO-17-317 High-Risk Series

housing finance system. As of December 2016, none of the proposals 

had passed the Senate or the House of Representatives.19

Housing and regulatory agencies also have demonstrated commitment to 

strengthening the housing finance system. FHA has enhanced its riskmanagement practices in response to our recommendations, including 

creating credit and operational risk committees, and has taken actions to 

recapitalize its MMI Fund. FHFA has continued efforts to develop a single 

security for the enterprises—which may enhance market liquidity for 

mortgaged-backed securities—and put in place a common securitization 

platform for the enterprises.20 Additionally, as we reported in our 2015 

high-risk update, financial regulators have finalized rules defining qualified 

mortgages and qualified residential mortgages that are designed to 

prevent a recurrence of risky mortgage origination and securitization 

practices.

Agencies have partially met this criterion for removal from the High-Risk 

List. FHA has made progress in strengthening its financial capacity. In 

fiscal years 2009–2014, FHA’s MMI Fund was out of compliance with its 

statutory 2 percent minimum capital requirement. And at the end of fiscal 

year 2013, FHA drew on $1.68 billion in permanent and indefinite budget 

authority to ensure the MMI Fund had sufficient resources to pay for 

expected future losses on existing insurance obligations.21 However, as of 

September 30, 2016, the MMI Fund’s capital ratio was in compliance with 

the statutory requirement and stood at 2.32 percent.

The improvement is partly attributable to steps FHA took to restore its 

financial health. For example, FHA adjusted its insurance premiums, 

made the annual premium permanent for the life of the loan, and 

increased down-payment requirements for borrowers with lower credit 

 19A provision in one of the legislative proposals was enacted, in slightly modified form, as 

part of the Consolidated Appropriations Act, 2016, Pub. L. No. 114-113, Div. O, § 702, 129 

Stat. 2242, 3025 (2015). This provision in the act states that Treasury may not dispose of 

preferred stock in the enterprises, until at least January 1, 2018, unless Congress enacts 

legislation permitting it to do so. Another provision in the act states that Congress should 

enact legislation determining the future of Fannie Mae and Freddie Mac.

20Freddie Mac began using the new platform in late November 2016. Fannie Mae is 

expected to begin using the platform at a later date that has not yet been specified. The 

platform ultimately also may be used by other issuers of mortgage-backed securities.

21Permanent indefinite budget authority is available for obligation and expenditure without 

fiscal year limitation and is not limited to a specified amount or ceiling.

Capacity
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 123 GAO-17-317 High-Risk Series

scores. FHA took steps to mitigate losses by revising guidelines on home 

retention options for struggling borrowers and by implementing costeffective alternatives for disposing of nonperforming loans and foreclosed 

properties. FHA also acted on our recommendations for increasing 

returns on foreclosed properties, which could help strengthen its financial 

position.

Under FHFA’s conservatorship, the enterprises generally have operated 

profitably since 2012, and, through September 2016, paid more than 

$250 billion to Treasury in dividends. However, FHFA’s Inspector General 

warned in March 2015 that the continued profitability of the enterprises 

was not assured and that the enterprises faced many financial 

challenges. These challenges included lower earnings on their retained 

investment portfolios and a reduced capacity to absorb future losses due 

to a capital reserve amount that falls to $0 by 2018.22 Without a capital 

reserve, any quarterly losses—including those due to market fluctuations 

and not necessarily to economic conditions—would require the 

enterprises to draw additional funds from Treasury. Treasury has 

provided about $187.5 billion in funds as capital support to the 

enterprises, with an additional $258.1 billion available to the enterprises 

should they need further assistance.

FHFA has taken actions to assess the financial capacity of the 

enterprises and mitigate some of their risks. For example, FHFA has 

overseen annual stress tests of the enterprises, pursuant to requirements 

in the Dodd-Frank Act. It also has directed the enterprises to expand their 

use of risk-sharing transactions (to transfer some credit risk to private 

sector entities), develop a new framework for representations and 

warranties (lenders’ assurances that their loans comply with enterprise 

standards), and develop new financial and operational standards for 

private mortgage insurers. But in March 2016, we concluded that FHFA 

lacked statutory authority to examine nonbank mortgage servicers—

whose market role has increased substantially in recent years—to identify 

and address deficiencies that could affect the enterprises.23 We said 

 22Under the current terms of Senior Preferred Stock Purchase Agreements with Treasury 

as amended, the enterprises are required to reduce their retained portfolios. They also 

must pay to Treasury all their quarterly positive net worth (if any) over a specified capital 

reserve amount, but the agreements reduce this capital reserve amount to zero in January 

2018.

23GAO, Nonbank Mortgage Servicers: Existing Regulatory Oversight Could Be 

Strengthened, GAO-16-278 (Washington, D.C.: Mar. 10, 2016). 
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 124 GAO-17-317 High-Risk Series

Congress should consider granting FHFA the authority to examine third 

parties, including nonbank mortgage servicers doing business with the 

enterprises. As of December 2016, Congress had not yet acted on that 

recommendation.

Although fundamental changes to the housing finance system have yet to 

be enacted, federal agencies have taken some planning steps in relation 

to resolving the federal role in housing finance and have therefore 

partially met this criterion for removal from the High-Risk List. As we 

noted in our 2015 high-risk update, these steps included a 2011 

Treasury-HUD plan outlining a vision for the federal role, a 2014 FHFA 

plan identifying strategic goals for enterprise conservatorship, and a 2014 

Treasury initiative to obtain public comments on the role of the privatelabel securities market in the current and future housing finance system. 

As we found in November 2016, FHFA’s 2014 strategic plan shifted 

emphasis away from contracting the enterprises’ operations, which was a 

goal in the 2012 plan developed under FHFA’s previous director.24 Since 

launching its initiative in 2014, Treasury has provided a forum for 

stakeholders in the private-label market to identify the structural reforms 

needed to bring back capital into that market in a responsible way. 

Additionally, in July 2016, Treasury, FHFA, and HUD issued a report with 

guiding principles for future efforts to mitigate mortgage losses based on 

lessons from the financial crisis.

Federal agencies have taken initial steps to provide the types of 

monitoring needed to assess the effects of changes to the housing 

finance system and have therefore partially met this criterion for removal 

from the High-Risk List. For example, FHFA and CFPB have strategic 

plans that call for monitoring different aspects of the mortgage market, 

such as consumer access and emerging risks. FHFA and CFPB also 

have continued a joint initiative—the National Mortgage Database 

project—the components of which include the ongoing development of a 

representative database with fields that could be useful for examining the 

effect of mortgage market reforms. A second component is a quarterly 

national survey of a representative sample of recent borrowers about their 

experiences in obtaining a mortgage. FHFA and CFPB reported 

information from the first set of survey responses in May 2016. Treasury 

and HUD have continued to report monthly on housing market conditions 

 24GAO-17-92. FHFA said that its 2014 plan was intended to be neutral toward options for 

the future structure of the enterprises. 

Action Plan

Monitoring
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 125 GAO-17-317 High-Risk Series

through their housing market scorecard. Furthermore, FHFA and FHA 

have continued to monitor and report on the financial condition of the 

enterprises and FHA’s MMI Fund.

A number of agencies—such as CFPB and HUD—have begun planning 

required retrospective reviews of mortgage market reforms—specifically, 

the qualified mortgage and qualified residential mortgage rules noted 

previously. However, in June 2015, we found the agencies had not yet 

developed sufficient metrics, baselines, and analytical methods to 

effectively conduct the retrospective reviews.25 We recommended that 

they complete plans for the reviews and include the three elements we 

identified. As of December 2016, some of the agencies reported making 

progress to develop these improvements but had not yet completed them.

Policymakers and regulators have not met this criterion for removal from 

the High-Risk List. Overall progress on resolving the federal role in 

housing finance will be difficult to achieve until Congress provides further 

direction by enacting changes to the housing finance system. Federal 

agencies have begun taking some planning, capacity building, and 

monitoring steps. Among these are actions mentioned above to 

strengthen the financial condition of FHA and mitigate risks of the housing 

enterprises. FHFA and FHA have also taken steps to monitor progress in 

these areas by reporting on their financial condition and activities. 

Furthermore, Treasury and HUD have combined to report regularly on the 

condition of the housing market. Nonetheless, assessing progress against 

specific goals is not yet possible because Congress has not provided an 

overall blueprint for the future federal role in housing finance or 

determined the specific roles federal agencies will play.

• In a March 2016 report on the Troubled Asset Relief Program (TARP), 

we found Treasury had not instituted a system to review the extent to 

which it would use the available program balance for the TARPfunded Making Home Affordable (MHA) program. We recommended 

that Treasury estimate future expenditures, deobligate funds that 

likely would not be expended, and move up to $2 billion of such funds 

 25GAO-15-185. 

Demonstrated Progress

Benefits Achieved by 

Implementing Our 

Recommendations
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 126 GAO-17-317 High-Risk Series

to the TARP-funded Hardest Hit Fund, as authorized.26 Consistent 

with our recommendations, Treasury updated estimates of future 

MHA program expenditures, deobligated $2 billion from the MHA 

program, and announced a $2 billion increase in funding for the 

Hardest Hit Fund.

• In June 2013, we found that HUD’s performance in selling foreclosed 

properties with FHA-insured mortgages lagged the performance of 

Fannie Mae and Freddie Mac. We made recommendations intended 

to increase FHA’s returns on such property dispositions. FHA’s 

actions in response to our recommendations improved its returns and 

led to financial benefits totaling more than $3.4 billion in fiscal years 

2013–2016.

• In a June 2012 report on federal foreclosure mitigation efforts, we 

found that Treasury had not reassessed its need for the $8 billion 

letter of credit facility for FHA’s Refinance for Borrowers in Negative 

Equity Positions program. We recommended that Treasury and FHA 

update their estimates of program participation and use the updated 

estimates to reassess the terms of the letter of credit facility. The 

agencies implemented our recommendation. As a result, Treasury 

amended the purchase agreement and deobligated approximately 

$7.1 billion dollars, which was returned to the general fund in fiscal 

year 2013.

• In November 2005, we found that the proportion of FHA-insured 

mortgages with down payment assistance from nonprofit 

organizations funded by property sellers had grown substantially and 

that these loans performed worse than similar loans without such 

assistance. We recommended that FHA take a number of steps to 

mitigate the risks associated with these loans. Citing our work, 

Congress prohibited seller-funded down-payment assistance, 

effective October 1, 2008. In fiscal year 2013, the financial benefit to 

the federal government of not insuring such loans was approximately 

$2.5 billion.

• After we recommended ways CFPB could better secure the data it 

collects on consumer credit card accounts, mortgage loans, and other 

products, in 2015 CFPB finalized data intake and privacy procedures 

and issued a new policy for addressing weaknesses in its information 

security environment. In 2014 CFPB conducted additional privacy 

 26The Hardest Hit Fund supports innovative measures developed by state housing finance 

agencies and approved by Treasury to help borrowers in states hit hardest by the 

aftermath of the housing crisis.
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 127 GAO-17-317 High-Risk Series

training for its staff and obtained assurance from the Office of 

Management and Budget that its collection of credit card data 

complied with federal requirements. These steps should help ensure 

CFPB collects and protects consumer financial data in accordance 

with federal requirements.

• After the Dodd-Frank Act prohibited certain types of proprietary 

trading that had caused large losses for banks, regulators 

implemented our recommendation to improve their oversight by 

reviewing trading data before issuing final rules to implement the 

restriction in December 2013. These rules also identified trading data 

some firms will have to report to regulators. As a result, regulators 

should have better information to help them reduce the risk that banks

will incur large trading losses.

• FHA takes possession of thousands of homes as a result of 

foreclosures on FHA-insured mortgages. In June 2013, we found FHA 

generally did not take market conditions into account when reducing 

list prices for unsold foreclosed properties, but instead generally 

followed standardized schedules. We recommended that FHA adopt 

practices used by other federally related housing entities, which base 

price reduction decisions on property-level information and market 

conditions. FHA implemented our recommendations in June 2016, 

which could reduce holding times for and improve returns on 

foreclosed properties. 

• Additionally, in response to our November 2011 recommendation that 

FHA establish ongoing mechanisms for anticipating potential risks 

presented by changing conditions, FHA created credit and operational 

risk committees, which have specified tools they use to address 

emerging risks. Taking these steps should help FHA more effectively 

identify, plan for, and address risks facing the agency.

For additional information about this high-risk area, contact Lawrance 

Evans at (202) 512-8678 or evansl@gao.gov.

Resolution Plans: Regulators Have Refined Their Review Processes but 

Could Improve Transparency and Timeliness. GAO-16-341. Washington, 

D.C: April 12, 2016.

GAO Contact

Related GAO 

Products

U.S. Financial Regulatory 

System
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 128 GAO-17-317 High-Risk Series

Financial Regulation: Complex and Fragmented Structure Could Be 

Streamlined to Improve Effectiveness. GAO-16-175. Washington, D.C: 

February 25, 2016.

Dodd-Frank Regulations: Impacts on Community Banks, Credit Unions 

and Systemically Important Institutions. GAO-16-169. Washington, D.C: 

December 30, 2015.

Bank Regulation: Lessons Learned and a Framework for Monitoring 

Emerging Risks and Regulatory Response. GAO-15-365. Washington, 

D.C: June 25, 2015.

Financial Stability Oversight Council: Further Actions Could Improve the 

Nonbank Designation Process. GAO-15-51. Washington, D.C: November 

20, 2014.

Financial Stability: New Council and Research Office Should Strengthen 

the Accountability and Transparency of Their Decisions. GAO-12-886. 

Washington, D.C: September 11, 2012.

Dodd-Frank Act Regulations: Implementation Could Benefit from 

Additional Analyses and Coordination. GAO-12-151. Washington, D.C: 

November 10, 2011.

Financial Regulation: A Framework for Crafting and Assessing Proposals 

to Modernize the Outdated U.S. Financial Regulatory System. 

GAO-09-216. Washington, D.C.: January 8, 2009.

Federal Housing Finance Agency: Objectives Needed for the Future of 

Fannie Mae and Freddie Mac After Conservatorships. GAO-17-92. 

Washington, D.C.: November 17, 2016.

Nonbank Mortgage Servicers: Existing Regulatory Oversight Could Be 

Strengthened. GAO-16-278. Washington, D.C.: March 10, 2016.

Mortgage Reforms: Actions Needed to Help Assess Effects of New 

Regulations. GAO-15-185. Washington, D.C.: June 25, 2015.

Housing Finance System: A Framework for Assessing Potential Changes. 

GAO-15-131. Washington, D.C.: October 7, 2014.

Federal Role in Housing 

Finance
Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing 

Finance

Page 129 GAO-17-317 High-Risk Series

Mortgage Financing: FHA’s Fund Has Grown, but Options for Drawing on 

the Fund Have Uncertain Outcomes. GAO-01-460. Washington, D.C.: 

February 28, 2001.
Restructuring the U.S. Postal Service to 

Achieve Sustainable Financial Viability

Page 130 GAO-17-317 High-Risk Series

The U.S. Postal Service (USPS) faces a serious financial situation that is 

putting its mission of providing prompt, reliable, and efficient universal 

mail services at risk.1 It reported a net loss of $5.6 billion in fiscal year 

2016—its 10th consecutive year of net losses. Additionally, it continues to 

face unfunded liabilities that have grown from 99 percent of USPS 

revenues in fiscal year 2007 to 169 percent of revenues in fiscal year 

2016. These unfunded liabilities—totaling about $121 billion at the end of 

fiscal year 2016—consist mostly of retiree health and pension benefit 

obligations for which USPS has not set aside sufficient funds to cover. 

For example, since September 2010, USPS has not made almost $34 

billion in required prefunding retiree health payments, which has led to an 

unfunded liability of about $52 billion.2 USPS’s ability to make payments 

to cover its unfunded liabilities is challenged due to (1) continued 

expected declines in mail volumes; (2) growing expenses; (3) expiration 

of a temporary rate surcharge3 (which generated $4.6 billion in additional 

revenue from its January 2014 inception to its April 2016 discontinuation); 

and (4) no planned new major cost-savings initiatives. As a result, it is not 

likely that USPS will be able to make all of its required health and pension 

payments in fiscal year 2017.4

USPS’s inability to make these payments may ultimately place taxpayers 

and the health care and pension benefits of USPS employees, retirees, 

and their beneficiaries at risk. Funded benefits protect the future viability 

 1

39 U.S.C. § 101(a). 

2 Pub. L. 109-435, § 803, 120 Stat. 3198 (Dec. 20, 2006), codified at 5 U.S.C. § 8909a. 

The Postal Enhancement and Accountability Act of 2006 required USPS to begin 

prefunding health benefits for its current and future postal retirees, with predetermined 

annual payments of $5.4 billion to $5.8 billion for fiscal years 2007 through 2016, followed 

by actuarially determined payments beginning in 2017 and every year thereafter to 

address any unfunded liabilities. For more detail, see GAO-13-112. 

3

In December 2013, the Postal Regulatory Commission (PRC) approved USPS’s request 

for an “exigent surcharge” which allowed USPS to raise postal rates for most mail above 

the statutory price cap that is generally limited to the rate of inflation, except under 

extraordinary or exceptional circumstances that necessitate a larger rate increase. In July 

2015, PRC ruled that USPS could continue the surcharge until it collects $4.6 billion in 

incremental revenue, which represents USPS’s approximate loss due to the decline in 

mail experienced during the Great Recession.

4

In addition to making required payments for its retiree health benefits, in fiscal year 2017, 

USPS will be required to make payments to finance its postal pension benefits, specifically 

to address the unfunded liabilities under the Civil Service Retirement System, and to 

address any unfunded liabilities and normal costs of Federal Employees Retirement 

System benefits for current employees. 

Restructuring the U.S. Postal Service to 

Achieve Sustainable Financial Viability

Why Area Is High 

Risk
Restructuring the U.S. Postal Service to 

Achieve Sustainable Financial Viability

Page 131 GAO-17-317 High-Risk Series

of USPS by not saddling it with bills after employees have retired. USPS 

retirees participate in the same health and pension benefit programs as 

other federal retirees. Thus, if USPS ultimately does not adequately fund 

these benefits and if Congress wants these benefits to be maintained at 

current levels, funding from the U.S. Treasury and hence the taxpayer 

would be needed to continue the benefit at the same levels. Alternatively, 

unfunded benefits could pressure USPS to reduce benefits or pay for 

postal workers. In July 2009, we added USPS’s financial condition to the 

list of high-risk areas needing attention by Congress and the executive 

branch to achieve broad-based restructuring.

USPS has partially met all five of the criteria for removal from the HighRisk List. Although USPS has taken some steps to improve its financial 

situation, it has limited ability to resolve its financial difficulties, in part due 

to statutorily defined requirements, such as requirements to maintain 6-

day delivery and resistance from external groups. USPS has made efforts 

to reduce its physical footprint, grow its shipping and package services, 

raise revenue, and reduce the gap between expenses and revenue.

However, these initiatives are insufficient to restore USPS’s financial 

viability. USPS has no plans to initiate new major initiatives that would 

achieve necessary cost savings—USPS has previously faced resistance 

to such efforts from customers and Congress.

USPS’s Five Year Strategic Plan for fiscal years 2017 to 2021 identified 

specific legislative changes needed for USPS to return to long-term 

financial health. Furthermore, USPS continued to monitor its situation 

through public quarterly and annual financial reports that discuss its 

financial status and performance, but has also reported that it cannot 

secure its near- or long-term financial outlook without the passage of 

targeted postal reform legislation. The House Committee on Oversight 

and Government Reform approved a bill that addressed some of USPS’s 

solvency challenges; however, the bill was not enacted and there 

continues to be a lack of consensus about how to address the trade-offs 

that are inherent with resolving USPS’s financial difficulties.

USPS needs to continue taking action to reduce costs related to its 

operations, workforce, and facilities, and to increase revenues so that it 

can reduce its net losses, fully make its required payments to fund 

employee benefits, repay its debt, and generate capital for investments, 

such as replacing its aging vehicle fleet.

What GAO Found

What Remains to Be 

Done
Restructuring the U.S. Postal Service to 

Achieve Sustainable Financial Viability

Page 132 GAO-17-317 High-Risk Series

Congress and USPS need to agree on a comprehensive package of 

actions to improve USPS’s financial viability. These actions include (1) 

modifying USPS’s retiree health benefit payments in a fiscally responsible 

manner; (2) facilitating USPS’s ability to better align costs with revenues; 

and (3) requiring any binding arbitration in the negotiation process for 

USPS labor contracts to take USPS’s financial condition into account.

While USPS’s leadership has been committed to increasing revenue and 

reducing expenses in an effort to put USPS on a more stable financial 

path, USPS has no plans to initiate new major initiatives that would 

achieve necessary cost savings. Although USPS has previously faced 

resistance to such efforts from customers and Congress, committing to 

major cost-saving initiatives may serve to reiterate the need for broadbased restructuring. The efforts USPS has implemented thus far have 

been insufficient to eliminate net losses. For example, a temporary 4.3 

percent “exigent” surcharge was implemented to address losses from 

decreased mail volume during the Great Recession, which occurred 

between December 2007 and June 2009. The surcharge began in 

January 2014 and was discontinued in April 2016, generating $4.6 billion 

in additional revenue during this period—including $1.1 billion in fiscal 

year 2016, $2.1 billion in fiscal year 2015, and $1.4 billion in fiscal year

2014. Furthermore, starting in fiscal year 2011, USPS established 

Delivering Results, Innovation, Value, and Efficiency initiatives to reduce 

the large gap between revenue and costs, and to implement strategic 

initiatives with measurable outcomes.

USPS has made efforts to right-size its operations to better adapt to 

declining mail volumes that are adversely affecting its financial position, 

but these efforts have not been sufficient to fully address USPS’s excess 

capacity in its mail processing network. Right-sizing its operations can 

enable USPS to better match resources with mail volume and address its 

compensation and benefits costs—which account for close to 80 percent 

of total expenses. USPS reduced its physical footprint by consolidating 36 

mail processing facilities in fiscal year 2015, instituting operational 

changes to better utilize resources at processing facilities, and reducing 

the hours of over 13,000 post offices so that retail service better matches 

demand. Despite these efforts, however, USPS reported that work hours 

Additional Details on 

What GAO Found

Leadership Commitment

Capacity
Restructuring the U.S. Postal Service to 

Achieve Sustainable Financial Viability

Page 133 GAO-17-317 High-Risk Series

and its overall workforce increased in fiscal years 2015 and 2016 due, in 

part, to significant volume-growth in shipping and packages (14.1 percent 

in fiscal year 2015 and 13.8 percent in fiscal year 2016), which are more 

labor intensive to process.

USPS reported that although the 15.8 percent growth in shipping and 

packages revenue helped generate additional total revenue of $2.6 billion 

(a 3.7 percent increase), package growth also contributed to an increase 

of 18,000 employees in fiscal year 2016, and an increase in total 

expenses of about $3.1 billion (about 4.2 percent). In addition, although it 

experienced net losses, USPS’s compensation expenses increased by 2 

percent in fiscal year 2016 due to salary increases and additional work 

hours. Furthermore, as part of its efforts to reduce excess capacity, USPS 

revised its standards for on-time mail delivery in January 2015 by 

increasing the number of days for some mail to be delivered and still be 

considered on time. Even with the revised standards, on-time delivery 

performance declined significantly, particularly for the second quarter of 

fiscal year 2015, a decline USPS attributed to operational changes 

enacted in January 2015 and adverse winter weather. Performance has 

rebounded since then, but with the rebound came increases in workforce 

and mail transportation costs.

USPS’s Five-Year Strategic Plan for fiscal years 2017 to 2021 outlines its 

strategy for achieving financial viability. USPS’s plan summarizes 

changes that USPS has made or plans to make, and those that it would 

like Congress to address in postal reform legislation. We continue to 

believe that legislative action is needed to address USPS’s financial 

challenges, and in the interim, as previously noted, USPS has no current 

plans to undertake additional major initiatives to achieve significant cost 

savings in its operations—USPS has previously faced resistance to such 

efforts from customers and Congress.

USPS continued to monitor its situation through public quarterly and 

annual financial reports that discuss its financial status and performance, 

including trends USPS expects to become more pronounced and will 

significantly impact its current business model. USPS, however, has also 

reported that it cannot secure its near- or long-term financial outlook 

without the enactment of targeted postal reform legislation.

USPS’s actions have demonstrated some progress in achieving cost 

savings, as noted above. USPS has reported, however, that despite 

these efforts, statutory restrictions on its business model have left it 

unable to cover its total costs.

Action Plan

Monitoring

Demonstrated Progress
Restructuring the U.S. Postal Service to 

Achieve Sustainable Financial Viability

Page 134 GAO-17-317 High-Risk Series

We have issued a number of reports that included strategies and options 

for USPS to generate revenue, reduce costs, increase the efficiency of its 

delivery operations, and restructure the funding of pension and retiree 

health benefits.5 USPS has already acted on some of these strategies 

and options. Nonetheless, we have also reported that USPS’s actions 

alone under its existing authority will be insufficient to achieve sustainable 

financial viability and that comprehensive legislation is urgently needed to 

position USPS to be a sustainable entity.

• USPS improved the usefulness and transparency of its delivery 

performance information. USPS updated its website in June 2016 to 

include trend data for on-time delivery performance for all 67 postal 

districts beginning in the second quarter of fiscal year 2015 to the 

current quarter. While this accomplishment will not lead to financial 

benefits, the updated website will lead to more transparent and 

effective oversight of delivery performance to hold USPS accountable 

for meeting its statutory mission to provide service in all areas of the

nation. As a result, USPS performance information is easily 

accessible and Postal stakeholders can determine whether delivery 

performance is a problem in rural areas.

• Congress has taken limited action over the past year to address the 

need for postal reform including the following:

• A January 2016 hearing titled, “Laying out the Reality of the United 

States Postal Service,” held by the Senate Committee on Homeland 

Security and Governmental Affairs.

• A May 2016 hearing regarding USPS’s ongoing financial challenges 

held by the House Committee on Oversight and Government Reform.

• The House Committee on Oversight and Government Reform 

approved a bill that addressed some of USPS’s solvency challenges; 

however, this bill was not enacted.

For additional information about this high-risk area, contact Lori Rectanus 

at (202) 512-2834 or rectanusl@gao.gov.

 5

For example, our December 2012 report analyzed five different approaches for funding 

retiree health benefits and discussed the differing impacts that each alternative would 

have on USPS’s future annual payments and unfunded liabilities. GAO, U.S. Postal 

Service: Status, Financial Outlook, and Alternative Approaches to Fund Retiree Health 

Benefits, GAO-13-112 (Washington, D.C.: Dec. 4, 2012). 

Benefits Achieved by 

Implementing Our 

Recommendations 

GAO Contact
Restructuring the U.S. Postal Service to 

Achieve Sustainable Financial Viability

Page 135 GAO-17-317 High-Risk Series

U.S. Postal Service: Continuing Financial Challenges and the Need for 

Postal Reform. GAO-16-651T. Washington, D.C.: May 11, 2016. 

U.S. Postal Service: Post Office Changes Suggest Cost Savings, but 

Improved Guidance, Data, and Analysis Can Inform Future Savings 

Efforts. GAO-16-385. Washington, D.C.: April 29, 2016.

U.S. Postal Service: Financial Challenges Continue. GAO-16-268T. 

Washington, D.C.: January 21, 2016. 

U.S. Postal Service: Actions Needed to Make Delivery Performance 

Information More Complete, Useful, and Transparent. GAO-15-756. 

Washington, D.C.: September 30, 2015. 

U.S. Postal Service: Status, Financial Outlook, and Alternative 

Approaches to Fund Retiree Health Benefits. GAO-13-112. Washington, 

D.C.: December 4, 2012.

U.S. Postal Service: Strategies and Options to Facilitate Progress toward 

Financial Viability. GAO-10-455. Washington, D.C.: April 12, 2010.

Related GAO 

Products
Management of Federal Oil and Gas Resources

Page 136 GAO-17-317 High-Risk Series

The Department of the Interior (Interior) has taken some steps to

strengthen how it manages federal oil and gas resources, but has not met 

the criteria for removal from our High-Risk List. Interior has not 

implemented four of our recommendations to improve the verification of 

oil and gas produced from federal leases, and the reasonableness and 

completeness of royalty data. Management of federal oil and gas 

resources was added it to the High-Risk List in 2011. We identified 

challenges in Interior’s management of oil and gas on leased federal 

lands and waters. We found that Interior (1) lacked reasonable assurance 

that it was collecting its share of revenue from oil and gas produced on 

federal lands and waters; (2) continued to experience problems hiring, 

training, and retaining sufficient staff to oversee and manage oil and gas 

operations on federal lands and waters; and (3) was undertaking a major 

reorganization of its oversight of offshore oil and gas management and 

revenue collection functions. In 2013, after concluding that Interior had 

fundamentally completed its reorganization, we narrowed the high-risk 

area to Interior’s revenue collection and human capital challenges. For 

this update, we are reopening the third segment based on our February 

2016 report, in which we found that Interior’s restructuring of the Bureau 

of Safety and Environmental Enforcement (BSEE) has made limited 

progress addressing long-standing deficiencies in the bureau’s 

investigative, environmental compliance, and enforcement capabilities.

Federal oil and gas resources provide an important source of energy for 

the United States; create jobs in the oil and gas industry; and generate 

billions of dollars annually in revenues that are shared between federal, 

state, and tribal governments. Interior reported collecting over $49 billion 

from fiscal years 2011 through 2015 from royalties and other payments. 

This makes oil and gas resources one of the federal government’s largest 

sources of nontax revenue. Moreover, the April 2010 explosion onboard 

the Deepwater Horizon and subsequent oil spill in the Gulf of Mexico 

highlighted the importance of Interior’s management of permitting and 

inspection processes to ensure operational and environmental safety.

In 2010, we found that Interior faced various human capital challenges, 

including hiring and retaining staff and, as a result, had difficulty meeting 

its responsibilities overseeing oil and gas activities on offshore federal 

leases. We also found that Interior had not consistently and appropriately 

trained offshore inspection and engineering staff. Historically, Interior’s 

Bureau of Land Management (BLM) oversaw onshore federal oil and gas 

activities while the Minerals Management Service managed offshore 

activities and collected royalties for all leases. Interior completed 

restructuring its oil and gas program in 2011, transferring offshore 

Management of Federal Oil and Gas 

Resources

Why Area Is High 

Risk
Management of Federal Oil and Gas Resources

Page 137 GAO-17-317 High-Risk Series

oversight responsibilities to two new bureaus—the Bureau of Ocean 

Energy Management (BOEM) and BSEE—and assigning the revenue 

collection function to a new Office of Natural Resources Revenue 

(ONRR). BLM did not restructure its management of onshore federal oil 

and gas activities.

BSEE’s mission is to promote safety, protect the environment, and 

conserve offshore resources through regulatory oversight and 

enforcement. It oversees offshore operations, which includes the authority 

to investigate incidents that occur on the outer continental shelf, monitor 

operator compliance with environmental stipulations, and take 

enforcement actions against operators that violate safety or 

environmental standards. Yet more than 5 years after its creation, BSEE 

continues to use investigative policies and procedures that predate the 

Deepwater Horizon explosion. BSEE’s outdated policies and procedures 

do not require planning investigations, gathering and documenting 

evidence, and ensuring quality control, potentially undermining the 

effectiveness of investigations. Moreover, BSEE’s ongoing restructuring 

of its environmental compliance program reverses steps taken to address 

post–Deepwater Horizon incident concerns, risking the bureau’s abilities 

to oversee environmental compliance. Additionally, BSEE did not review 

its maximum daily civil penalty as required by the Outer Continental Shelf 

Lands Act.

While Interior has taken some steps to strengthen how it manages federal 

oil and gas resources, it has not met the criteria for removal from our 

High-Risk List. Interior has not implemented four of our prior 

recommendations to improve the verification of oil and gas produced from 

federal leases, and the reasonableness and completeness of royalty data. 

In April 2015, we made seven additional recommendations to the 

Secretary of the Interior to improve production verification efforts, two of 

which remain open. In January 2014, to ensure a consistent and 

comprehensive approach to addressing BLM’s, BOEM’s, and BSEE’s 

ongoing hiring and retention challenges, we made two recommendations 

to Interior to explore the expanded use of recruitment, relocation, and 

retention incentives, and systematically collect data on hiring times. We 

closed the first recommendation as implemented, but the second remains 

open. In September 2016, we made five recommendations to Interior to 

improve staff hiring, retention, and training; all five remain open. In 

February 2016, we made nine recommendations to Interior to address 

BSEE’s ongoing restructuring effort; eight of those recommendations 

remain open. Based on these factors and our ongoing work examining 

BSEE’s strategic initiatives to improve its offshore oversight and internal 

What GAO Found
Management of Federal Oil and Gas Resources

Page 138 GAO-17-317 High-Risk Series

management, we are expanding the Management of Federal Oil and Gas 

Resources high-risk area to again include a segment on Interior’s 

restructuring of offshore oil and gas oversight.

Interior has partially met the criteria to address the revenue collection and 

human capital challenges we identified, and has implemented some of 

the recommendations we made. However, Interior needs to do more to 

meet its responsibilities to manage federal oil and gas resources, and to 

maintain leadership commitment in addressing the remaining four criteria.

Leadership Commitment: To address its human capital challenges, 

Interior needs to evaluate the effectiveness of incentives such as special 

salary rates, analyze hiring time data, and evaluate the bureaus’ training 

programs. To enhance Interior’s oversight of oil and gas development, 

and fully implement the bureau’s restructuring and effectively oversee 

offshore oil and gas development, BSEE leadership needs to take several 

steps, such as completing draft policies outlining the responsibilities of its 

divisions, and updating and developing procedures to guide them. BSEE 

leadership also needs to conduct a risk analysis of its environmental 

compliance program.

Capacity: To address its revenue collection challenges, Interior will need 

to identify the staffing resources necessary to consistently meet its annual 

goals for inspecting and verifying oil and gas production. To address its 

human capital challenges, Interior needs to evaluate whether its efforts to 

increase compensation paid to key oil and gas staff were effective in 

hiring and retaining staff. Interior also needs to fully evaluate the bureaus’

training programs and look for potential opportunities to share training 

resources.

Action Plan: To address its revenue collection challenges, Interior needs 

to continue its efforts related to its study on automating data collection 

from production metering systems. To address its human capital 

challenges, Interior needs to track, monitor, and analyze the effectiveness 

of the incentives paid to key oil and gas staff. Interior also needs to 

analyze data from its new human resources software system in order to 

identify steps in the hiring process that may be causing delays. Regarding 

training, Interior needs to review training and identify opportunities to 

share training resources.

Monitoring: To address its revenue collection challenges, Interior needs 

to ensure that oil and gas produced from federal leases is accurately 

What Remains to Be 

Done
Management of Federal Oil and Gas Resources

Page 139 GAO-17-317 High-Risk Series

measured, and that the federal government is collecting an appropriate 

share of oil and gas revenues. To address its human capital challenges, 

Interior needs to track and monitor performance metrics for incentive 

payments and special salary rates, capture accurate data on hiring time 

from a new human resources software system, and evaluate training 

programs.

Demonstrated Progress: To address its revenue collection challenges, 

Interior needs to continue to effectively implement our related 

recommendations as outlined in the areas above. To address its human 

capital challenges, Interior must continue to show progress in hiring, 

retaining, and training its key oil and gas staff.

Overall, Interior has partially met the criteria for leadership commitment, 

capacity, action planning, monitoring, and demonstrated progress. All of 

the 2017 ratings are the same as the 2015 ratings except for leadership 

commitment, which dropped from met to partially met for the human 

capital challenges segment, discussed below.

Interior has demonstrated leadership commitment to address revenue 

collection weaknesses and partially met the remaining four criteria.

Interior’s leadership has demonstrated its commitment to addressing 

revenue collection weaknesses. For example, ONRR established a Data 

Additional Details on 

What GAO Found

Royalty Determination and 

Collection

Leadership Commitment
Management of Federal Oil and Gas Resources

Page 140 GAO-17-317 High-Risk Series

Mining Services Group to help identify potentially erroneous data 

submitted by companies paying royalties. ONRR is also studying whether 

it can use automated data collection from metering systems to more 

efficiently obtain oil and gas production data used to determine royalties 

from companies.

Interior’s capacity to address weaknesses in revenue collection is 

uneven. In recent years, Interior has hired offshore inspection staff to 

focus primarily on oil and gas measurement inspections. We found in 

April 2015 that BSEE came close to meeting its annual inspection goals 

for verifying oil and gas production in the Gulf of Mexico for fiscal years 

2009 through 2013. On the other hand, for the same time frame, we 

found that BLM did not meet its oil and gas production inspection goals, 

which officials attributed, in part, to insufficient inspection staff.

Interior has plans in place to continue implementing our 

recommendations aimed at correcting weaknesses in its revenue 

collection policies and practices. In November 2014, Interior provided a 

briefing document specifying goals and time frames for several areas 

related to these weaknesses. For example, in December 2013, we 

recommended that BLM issue revised regulations to provide it with 

greater flexibility in setting royalty rates and better ensure that the public 

receives a fair return from the oil and gas produced from federal leases. 

In November 2014, Interior stated that it planned to begin addressing this 

issue in fiscal year 2015 by issuing an advanced notice for proposed 

rulemaking. In November 2016, Interior amended its regulations to, 

among other things, allow for greater flexibility in setting royalty rates. 

Interior’s briefing document also specified other goals and time frames for 

completing a study on automating data collection from production 

metering systems, and for establishing procedures on when to 

periodically assess its fiscal system. Interior completed the latter of these 

two actions in August 2016.

Interior has undertaken several efforts to monitor its performance in 

addressing revenue collections weaknesses. For example, Interior’s 

November 2014 briefing document demonstrated that it is tracking the 

implementation of Interior Inspector General recommendations as well as 

our recommendations related to our high-risk findings. Interior’s briefing 

document indicates it has established milestones for a number of actions, 

including updating oil and gas measurement regulations. However, in our 

ongoing work, we found that BLM did not schedule nor complete a 

planned internal review to assess the overall effectiveness of other newly 

issued oil and gas guidance within 1 year of when BLM field office staff 

Capacity

Action Plan

Monitoring
Management of Federal Oil and Gas Resources

Page 141 GAO-17-317 High-Risk Series

implemented the guidance. The new guidance outlines criteria for 

approving “commingling” requests—requests to combine oil or gas from 

public, state, or private leases prior to royalty measurement—and 

identifies considerations for determining whether commingling is in the 

public interest. This includes ensuring that BLM has the ability to verify 

that production is accurately measured and properly reported. Because it 

has not scheduled and completed a review of the effectiveness of the 

new commingling guidance after its implementation, BLM does not have 

reasonable assurance that its staff are consistently applying the new 

guidance, and that staff are able to verify production.

Interior has demonstrated progress addressing weaknesses in its 

revenue collection policies and practices. As of January 2017, we found 

that Interior implemented 42 of 46 recommendations we had made since 

September 2008 addressing revenue collection weaknesses, including 

those related to oil and gas production verification and royalty data. 

However, as mentioned above, Interior has not completed reviewing the 

effectiveness of the new commingling guidance. Additionally, in March 

2010, we found that Interior’s production accountability program did not 

sufficiently address key factors that could affect gas measurement 

accuracy, and recommended that Interior establish goals for particular 

types of measurement inspections. Interior agreed with the 

recommendation, but as of October 2016, it has not fully implemented it. 

Without completing this action, Interior cannot be assured that oil and gas 

are being reasonably measured and associated royalty payments are 

correct.

Demonstrated Progress
Management of Federal Oil and Gas Resources

Page 142 GAO-17-317 High-Risk Series

Interior has partially met the five criteria below.

The rating for leadership commitment dropped from ‘met’ in 2015 to 

‘partially met’ in 2017. In January 2014, we recommended that Interior 

explore expanding its use of hiring incentives and systematically collect 

and analyze hiring data. Interior agreed with our recommendations and 

began to more systematically collect and analyze hiring data to identify 

causes for delays and expedite the hiring process. In November 2014, 

Interior senior officials briefed us on planned actions to address the 

department’s human capital challenges. As of September 2016, however, 

some of these planned actions had not yet been implemented or 

completed, as we reported. For example, Interior senior officials told us 

that they would implement a performance measure framework to evaluate 

the effectiveness of incentives on a quarterly basis beginning in April 

2015. However, as of July 2016, a senior official from the Office of Policy, 

Management and Budget said these quarterly reviews had not yet begun.

Regarding hiring time, BLM, BSEE, and BOEM adopted new human 

resources software in 2015 to provide better data to track their hiring 

process, but as of June 2016, officials had not completed analyzing data 

extracted from this new system, and their hiring process continued to 

exceed the Office of Personnel Management’s (OPM) goal of 80 days. 

Regarding training, we reported in September 2016 that Interior and the 

three bureaus had trained key oil and gas staff without fully evaluating the 

bureaus’ staff training needs or the training’s effectiveness, and Interior 

Human Capital Challenges

Leadership Commitment
Management of Federal Oil and Gas Resources

Page 143 GAO-17-317 High-Risk Series

had provided limited leadership to facilitate the bureaus sharing training 

resources. We also reported that BSEE has not implemented a 

certification program for its inspectors, although the Outer Continental 

Shelf Safety Oversight Board and Interior Inspector General 

recommended it in 2010.

Interior continues to partially meet this criterion. In 2010, we found that 

Interior’s bureaus experienced high turnover rates in key oil and gas 

inspection and engineering positions. In January 2014, we found that 

Interior’s hiring and retention challenges were largely due to lower 

salaries and a slow hiring process compared with similar positions in 

industry. The fiscal year 2012 attrition rate for petroleum engineers at 

BLM was more than 20 percent, or more than double the average federal 

attrition rate of 9.1 percent. The attrition rate for other key oil and gas staff 

was lower, but still a challenge because some field offices had only a few 

employees in any given position, and a single separation could 

significantly affect operations. According to Interior officials, these 

challenges made it more difficult for some field offices to conduct 

oversight activities, including inspecting production facilities.

Since fiscal year 2012, Interior has increased compensation for certain 

key oil and gas staff by using special salary rates, incentive payments, 

and student loan repayments. During fiscal years 2012 through 2016, 

Interior had special salary rates—authorized by Congress in annual 

appropriations acts—that allowed it to pay certain staff up to 25 percent 

more than their basic pay. In addition, some of the bureaus increased 

compensation through other tools, such as incentive payments and 

student loan repayments. For example, for fiscal years 2012 through 

2014, BLM and BSEE substantially increased the number of employees

receiving a retention incentive payment from 14 to 346 employees. During 

the same period, BSEE and BOEM increased the number of staff 

receiving a student loan repayment from 25 to 66 employees. Officials 

from the three bureaus said that anecdotally they know that efforts to 

increase the compensation paid to key oil and gas staff, along with an 

industry downturn that reduced private sector hiring, had likely helped 

them fill vacancies. Outside of these anecdotal observations, however, 

Interior and the bureaus have not evaluated whether their efforts, and the 

specific tools they used, were effective in hiring and retaining staff.

Regarding training, we reported in September 2016 that Interior and its 

bureaus had trained key oil and gas staff without fully evaluating training, 

and have missed opportunities to share training resources. Specifically, 

none of the bureaus reported conducting evaluations that would give 

Capacity
Management of Federal Oil and Gas Resources

Page 144 GAO-17-317 High-Risk Series

them information about the overall effectiveness of their training efforts by 

measuring the effect on staff’s job performance and comparing program 

benefits to training costs.

Interior continues to partially meet this criterion. Interior does not have a 

written action plan summarizing how it will address its human capital 

challenges; however, agency officials have described some actions it 

plans to take to address these challenges. To evaluate the effectiveness 

of the agency’s efforts to increase compensation paid to key oil and gas 

staff, such as the use of incentive payments and special salary rates, 

officials said in September 2016, that they had developed initial 

performance metrics and gathered data for the first three quarters of fiscal 

year 2016. Officials said they would continue to track and monitor the 

data on a quarterly basis.

To address the lengthy hiring process, officials from the three bureaus 

said in June 2016 that they had started analyzing data extracted from a 

new human resources software system in order to identify steps in the 

hiring process that may be causing delays. Regarding training, a senior 

Interior official we interviewed told us in January 2016, that their Interior 

Training Directors Council—composed of senior training officials across 

Interior—would begin reviewing training across the bureaus and seek to 

identify opportunities to share training resources. However, as of June 

2016, officials had not reported any progress made by the council, and it 

is unclear what, if any, steps the office has taken to review training and 

identify opportunities to share training resources. In addition, it is unclear 

what, if any, actions the agency will take in response to the 

recommendations we issued in September 2016 directing the agency to 

develop technical competencies for all key oil and gas staff, and annually 

evaluate the bureaus’ training programs and viability of a certification 

program for BSEE inspectors.

Interior continues to partially meet this criterion. Interior and the three 

bureaus have taken some steps to reduce hiring times, but did not have 

complete and accurate data to identify the causes of delays in the hiring 

process. Without reliable data, Interior’s bureaus cannot effectively 

implement changes to expedite the hiring process. We recommended in 

January 2014 that Interior systematically collect data on hiring times for 

key oil and gas positions, ensure the accuracy of the data, and analyze 

the data to identify the causes of delays and expedite the hiring process. 

In June 2016, officials from the three bureaus said that they had started 

analyzing data extracted from a new human resources software system in 

order to identify steps in the hiring process that may be causing delays. 

Action Plan

Monitoring
Management of Federal Oil and Gas Resources

Page 145 GAO-17-317 High-Risk Series

Once Interior has the systems in place to capture accurate data on hiring, 

the department will be able to monitor hiring times and the causes of 

delays in the hiring process.

In addition, Interior officials said in September 2016 that they had 

developed initial performance metrics to track and monitor on a quarterly 

basis the effectiveness of incentive payments and special salary rates 

that the agency has used to try to increase compensation paid to its key 

oil and gas staff. These officials also said they had gathered data for the 

first three quarters of fiscal year 2016, and would continue to track and 

monitor the data on a quarterly basis. However, the agency had not yet 

used these data to evaluate the effectiveness of incentives. We 

recommended that Interior regularly evaluate the effectiveness of 

available incentives, such as special salary rates, the student loan 

repayment program, and other incentives in hiring and retaining key oil 

and gas staff.

In regards to training, we reported in September 2016 that Interior had not 

evaluated training needs or effectiveness as required by law and 

regulations, according to officials, and we recommended the agency 

annually evaluate the bureaus’ training programs. We also reported that 

Interior’s bureaus have not evaluated training needs or effectiveness as 

directed by departmental policy. We recommended in September 2016 

that the agency develop technical competencies for all key oil and gas 

staff, and annually evaluate the bureaus’ training programs and the 

viability of a certification program for BSEE inspectors. It is unclear what, 

if any, actions the agency will take in response to these 

recommendations.

Interior continues to partially meet this criterion. In 2015, we reported that 

Interior and the three bureaus had taken some actions to address these 

hiring and retention challenges, but had not fully used their existing 

authorities to supplement salaries and provide other recruitment, 

relocation, and retention incentives.

In September 2016, we found that Interior has made progress in 

expanding the use of recruitment, relocation, and retention incentives to 

address hiring and retention challenges, but as yet cannot demonstrate 

the effectiveness of these measures. In 2014, the three bureaus 

increased the number of staff receiving these incentives and, in 2015, the 

bureaus developed guidance on their use. In addition, during fiscal years 

2012 through 2016, Interior had special salary rates—authorized by 

Congress in annual appropriations acts—that allowed it to pay certain 

Demonstrated Progress
Management of Federal Oil and Gas Resources

Page 146 GAO-17-317 High-Risk Series

staff up to 25 percent more than their basic pay. In September 2016, 

Interior described its plans to collect data on the three incentives and 

special salary rates in order to measure effectiveness.

Regarding their lengthy hiring process, in January 2014, we reported that 

Interior records showed that the average time to hire petroleum engineers 

and inspectors generally exceeded 120 calendar days—much longer than 

OPM’s target of 80 calendar days. We also found in September 2016 that 

each of the three bureaus has taken steps to begin to address their 

lengthy hiring process. In 2015, the three bureaus adopted new human 

resources software that officials said will provide them with better data to 

track their hiring process. In June 2016, officials from the three bureaus 

said that they had started analyzing data extracted from this new system 

to identify steps in the hiring process that may be causing delays.

Regarding training, we found in March 2010 that Interior had not 

consistently and appropriately trained offshore inspection and engineering 

staff. In July 2012, we reported that Interior was creating a new training 

program for its offshore inspection and engineering staff. However, in 

September 2015, BSEE inspectors at four local offices told us that the 

offshore training courses BSEE provided them, which were primarily led 

by contractors, did not adequately prepare them to perform inspections 

because the courses focused on how equipment operates, and did not 

teach them how to inspect the equipment. More broadly, we found in 

September 2016 that none of the three bureaus had evaluated training 

needs or effectiveness as directed by departmental policy. Without 

evaluating its bureaus’ training efforts, Interior may not be able to ensure 

that its key oil and gas staff are being adequately trained to conduct 

oversight, and may be ineffectively and inefficiently spending training 

funds.

In 2013, we removed the reorganization segment because the agency 

successfully restructured following Deepwater Horizon. However, we are 

expanding the Management of Federal Oil and Gas Resources high-risk 

area based on our recent work. In February 2016, we reported that 

BSEE’s leadership had undertaken several efforts to reform the bureau’s 

oversight capabilities. Yet, after more than 5 years since the bureau was 

created, BSEE has not finalized the underlying policies and procedures to 

facilitate implementing the bureau’s new divisions for Safety and Incident 

Investigation, Environmental Compliance, and Safety Enforcement. By 

not completing policies and procedures to establish the bureau’s new 

divisions, BSEE risks undermining the effectiveness of its oversight 

Restructuring of Offshore 

Oil and Gas Oversight
Management of Federal Oil and Gas Resources

Page 147 GAO-17-317 High-Risk Series

capabilities. Moreover, BSEE’s deficient oversight capabilities continue to 

undermine its ability to effectively oversee offshore oil and gas 

development.

• In response to recommendations we made in April, 2015, Interior 

issued updated onshore (1) gas measurement, (2) oil measurement, 

and (3) oil and gas site security regulations. These new regulations 

should help ensure that oil and gas produced from federal leases are 

accurately measured. Accurate measurement is critical for calculating 

the royalty payments operators pay the government.

• In response to a recommendation we made in July 2012, Interior 

reported that the two bureaus, BOEM and BSEE, jointly approved an 

information technology plan. This plan, according to Interior 

documents, is a roadmap that outlines a framework for deploying 

technology resources throughout the organizations in support of 

bureau missions, goals, and program priorities.

• In response to a recommendation we made in July 2012, BSEE in 

August 2013 and BOEM in September 2016 issued human capital 

plans.

• In response to a recommendation we made in January 2014, Interior 

took several actions to bridge the salary gap for key oil and gas 

oversight staff. Specifically, BLM, BSEE, and BOEM increased the 

number of staff receiving retention, recruitment, or relocation incentive 

payments in fiscal year 2014 and in fiscal year 2015 issued guidance 

describing which staff should receive these incentives. In addition, in 

September 2016, Interior outlined steps it will take to assess the 

effectiveness of these incentives by tracking measures such as 

turnover and acceptance rates.

Interior also implemented recommendations that we identified as priority 

recommendations to the Secretary of Interior.

• In response to a recommendation we made in December 2013, 

Interior took steps within its authority to revise BLM’s regulations to 

provide for flexibility to the bureau to make changes to onshore royalty 

rates, similar to that which is already available for offshore leases, to 

enhance Interior’s ability to make timely adjustments to the terms for 

federal onshore leases.

• In response to a recommendation we made in December 2013, the 

Secretary of the Interior established documented procedures for 

determining when to conduct periodic assessments of the overall 

Benefits Achieved by 

Implementing Our 

Recommendations
Management of Federal Oil and Gas Resources

Page 148 GAO-17-317 High-Risk Series

fiscal system. These procedures identified generally when such an 

assessment should be done or what changes in the market or industry 

would signal that such an assessment should be done.

• In response to a recommendation we made in December 2013, the 

Secretary of the Interior established documented procedures for 

determining whether and how to adjust lease terms for new offshore 

leases, including documenting the justification and analysis supporting 

any adjustments.

For additional information about this high-risk area, contact Frank Rusco 

at (202) 512-3841 or ruscof@gao.gov.

Oil and Gas Oversight: Interior Has Taken Steps to Address Staff Hiring, 

Retention, and Training but Needs a More Evaluative and Collaborative 

Approach. GAO-16-742. Washington, D.C.: September 29, 2016.

Oil and Gas Management: Interior’s Bureau of Safety and Environmental 

Enforcement has Not Addressed Long-Standing Oversight Deficiencies. 

GAO-16-245. Washington, D.C.: February 10, 2016.

Oil and Gas Resources: Interior’s Production Verification Efforts and 

Royalty Data Have Improved, but Further Actions Needed. GAO-15-39. 

Washington, D.C.: April 7, 2015.

Oil and Gas: Updated Guidance, Increased Coordination, and 

Comprehensive Data Could Improve BLM’s Management and Oversight. 

GAO-14-238. Washington, D.C.: May 5, 2014.

Oil and Gas Management: Continued Attention to Interior’s Human 

Capital Challenges Is Needed. GAO-14-394T. Washington, D.C.: 

February 27, 2014.

Oil and Gas: Interior Has Begun to Address Hiring and Retention 

Challenges but Needs to Do More. GAO-14-205. Washington, D.C.: 

January 31, 2014.

Oil and Gas Resources: Actions Needed for Interior to Better Ensure a 

Fair Return. GAO-14-50. Washington, D.C.: December 6, 2013.

GAO Contact

Related GAO 

Products
Management of Federal Oil and Gas Resources

Page 149 GAO-17-317 High-Risk Series

Oil and Gas Management: Interior’s Reorganization Complete, but 

Challenges Remain in Implementing New Requirements. GAO-12-423. 

Washington, D.C.: July 30, 2012.
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 150 GAO-17-317 High-Risk Series

Climate change is considered by many to be a complex, crosscutting 

issue that poses risks to many environmental and economic systems and 

presents a significant financial risk to the federal government. According 

to the National Research Council (NRC), although the exact details 

cannot be predicted with certainty, there is clear scientific understanding 

that climate change poses serious risks to human society and many of 

the physical and ecological systems upon which society depends.1

According to the United States Global Change Research Program 

(USGCRP), among other reported impacts, climate change could 

threaten coastal areas with rising sea levels, alter agricultural productivity, 

and increase the costs of severe weather events as these once “rare”

events potentially become more common and intense due to climate 

change.2

For example, the Department of Defense’s (DOD) 2010 and 2014 

Quadrennial Defense Reviews state that climate change poses risks to 

defense infrastructure, particularly on the coasts. DOD’s infrastructure 

consists of more than 555,000 defense facilities and 28 million acres of 

land, with a replacement value of close to $850 billion.3 In addition, 

extreme weather events have cost the nation tens of billions of dollars 

over the past decade. For example, in January 2013, about $60 billion in 

budget authority was provided for expenses related to the consequences 

of Superstorm Sandy. Further, based on a 2013 analysis of disaster relief 

 1

NRC is the principal operating agency of the National Academy of Sciences and the 

National Academy of Engineering. NRC, Committee on America’s Climate Choices, 

America’s Climate Choices (Washington, D.C.: 2011). See also NRC, Climate Change: 

Evidence, Impacts, and Choices. Answers to common questions about the science of 

climate change (Washington, D.C.: 2012). For more information about NRC’s recent 

reports on climate change, click here. 

2

Melillo, Jerry M., Terese (T.C.) Richmond, and Gary W. Yohe, eds., Climate Change 

Impacts in the United States: The Third National Climate Assessment, U.S. Global 

Change Research Program (Washington, D.C.: U.S. Government Printing Office, May 

2014). USGCRP coordinates and integrates the activities of 13 federal agencies that 

research changes in the global environment and their implications for society. USGCRP 

began as a presidential initiative in 1989 and was codified in the Global Change Research 

Act of 1990 (Pub. L. No. 101-606, § 103 (1990)). USGCRP-participating agencies are the 

Departments of Agriculture, Commerce, Defense, Energy, Interior, Health and Human 

Services, State, and Transportation; the U.S. Agency for International Development; the 

Environmental Protection Agency; the National Aeronautics and Space Administration; the 

National Science Foundation; and the Smithsonian Institution. 

3

GAO, Climate Change Adaptation: DOD Can Improve Infrastructure Planning and 

Processes to Better Account for Potential Impacts, GAO-14-446 (Washington, D.C.: May 

30, 2014).

Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate 

Change Risks

Why Area Is High 

Risk
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 151 GAO-17-317 High-Risk Series

appropriations by the Congressional Research Service, the amount of 

inflation-adjusted disaster relief per fiscal year increased from a median of 

$6.2 billion for the years 2000 to 2006, to a median of $9.1 billion for the

years 2007 to 2013 (46 percent).4

These impacts call attention to areas where government-wide action is 

needed to reduce fiscal exposure, because, among other roles, the 

federal government (1) leads a strategic plan that coordinates federal 

efforts and also informs state, local, and private-sector action; (2) owns or 

operates extensive infrastructure vulnerable to climate impacts, such as 

defense facilities and federal property; (3) insures property and crops 

vulnerable to climate effects; (4) provides data and technical assistance 

to federal, state, local, and private-sector decision makers responsible for 

managing the impacts of climate change on their activities; and (5) 

provides disaster relief aid. As a result, we added Limiting the Federal 

Government’s Fiscal Exposure by Better Managing Climate Change 

Risks to the High-Risk List in 2013.

One way to reduce the potential impacts of climate change is to enhance 

climate resilience.5 When discussing climate change, the term 

adaptation—defined as adjustments to natural or human systems in 

response to actual or expected climate change—is synonymous with 

enhancing climate resilience. Adaptation measures to protect 

infrastructure, for example, include raising river or coastal dikes to protect 

infrastructure from sea level rise, building higher bridges, and increasing 

the capacity of storm water systems. Enhancing climate resilience can 

cost additional money up front, but could also reduce potential future 

damage from climate-related events that—given expected budget 

pressures—would otherwise constrain federal programs. As stated in a 

2010 NRC report, increasing the nation’s ability to respond to a changing 

 4

GAO, Climate Change: Better Management of Exposure to Potential Future Losses Is 

Needed for Federal Flood and Crop Insurance, GAO-15-28 (Washington, D.C.: Oct. 29, 

2014). 

5

The National Academies define resilience as the ability to prepare and plan for, absorb, 

recover from, and more successfully adapt to adverse events. The National Academies, 

Committee on Increasing National Resilience to Hazards and Disasters; Committee on 

Science, Engineering, and Public Policy; Disaster Resilience: A National Imperative 

(Washington, D.C.: 2012). 
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 152 GAO-17-317 High-Risk Series

climate can be viewed as an insurance policy against climate change 

risks.6

Furthermore, according to NRC and USGCRP, the nation can reduce its 

vulnerability by limiting the magnitude of climate change through actions 

to limit greenhouse gas emissions.7 We recognize that (1) the federal 

government has a number of efforts underway to decrease domestic 

greenhouse gas emissions, and (2) the success of efforts to reduce 

greenhouse gas emissions depends in large part on cooperative 

international efforts. However, limiting the federal government’s fiscal 

exposure to climate change risks will be challenging no matter the

outcome of efforts to reduce emissions, in part because greenhouse 

gases already in the atmosphere will continue altering the climate system 

for many decades, according to NRC and USGCRP.8

 6

NRC, Panel on Adapting to the Impacts of Climate Change, America’s Climate Choices: 

Adapting to the Impacts of Climate Change (Washington, D.C.: 2010). 

7

In the atmosphere, greenhouse gases absorb and reemit radiation within the thermal 

infrared range of the electromagnetic spectrum. This is the fundamental cause of the 

greenhouse effect, or the warming of Earth’s atmosphere. In order of their prevalence by 

volume, the primary greenhouse gases are water vapor, carbon dioxide, methane, nitrous 

oxide, and ozone. 

8

The focus of this high-risk area may evolve over time to the extent that federal climate 

change programs and policies change. 
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 153 GAO-17-317 High-Risk Series

As of December 2016, the federal government has taken additional steps 

since our 2015 update and partially met four of the five criteria for removal 

from our High-Risk List—leadership commitment, capacity, action plan, 

and monitoring. Specifically, the federal government partially met the 

monitoring criterion, which had been rated not met in the 2015 report, and 

has taken further action in three criteria that remain partially met—

leadership commitment, capacity, and action plan.9 However, the 

demonstrated progress criterion remains not met because it is too early to 

determine whether the federal government has made progress.

Various executive orders (E.O.), task forces, and strategic planning 

documents identify climate change as a priority and demonstrate 

leadership commitment. This leadership commitment needs to be 

sustained and enhanced to address all aspects of the federal fiscal 

exposure to climate change in a cohesive manner. As we reported in 

2015, the federal government has some capacity to address the federal 

fiscal exposure to climate change. However, across its actions and 

strategies, the federal government has yet to clearly define the roles, 

responsibilities, and working relationships among federal, state, local, and 

private-sector entities, or how these efforts will be funded, staffed, and 

sustained over time. The federal government has taken further action by 

establishing a monitoring mechanism to review certain federal agencies’

efforts to reduce some aspects of their fiscal exposure to climate change, 

such as building efficiency. However, it is too early to determine the new 

mechanism’s effectiveness at demonstrating progress in implementing 

corrective measures, or whether the federal government will apply a 

similar mechanism across all areas of federal fiscal exposure to climate 

change.

The federal government needs a cohesive strategic approach with strong 

leadership and the authority to manage climate change risks that 

encompasses the entire range of related federal activities and addresses 

all key elements of strategic planning. Such an approach includes 

implementing our May 2011 recommendation to establish federal 

 9

For example, in response to a recommendation we made in May 2014, the Office of the 

Secretary of Defense and the services took a number of actions to develop a project plan 

and milestones for completing DOD’s screening-level climate change vulnerability 

assessment. GAO-14-446.

What GAO Found

What Remains to Be 

Done
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 154 GAO-17-317 High-Risk Series

strategic climate change priorities and develop roles, responsibilities, and 

working relationships among federal, state, and local entities.10

The federal government has had many climate-related strategic planning 

activities that demonstrated leadership commitment, such as the 

President’s June 2013 Climate Action Plan and the March 2015 

E.O.13693 Planning for Federal Sustainability in the Next Decade. 

However, it was unclear how the various planning efforts related to each 

other or whether they amounted to a government-wide approach for 

reducing federal fiscal exposures. Accordingly, leadership commitment 

needs to be enhanced, with increased focus on developing a cohesive 

strategy to reduce fiscal exposure across the full range of related federal 

activities. Further, the federal government will need to focus on 

implementing this strategy—by developing measurable goals; identifying 

the roles, responsibilities, and working relationships among federal, state, 

and local entities; identifying how such efforts will be funded and staffed 

over time; and establishing mechanisms to track and monitor progress.

In addition to addressing these broad strategic challenges, there are 

specific areas that require attention including the following:

• Federal property and resources: This involves federal agencies’

consistently implementing (1) the January 2015 E.O. 13690, 

Establishing a Federal Flood Risk Management Standard and a

Process for Further Soliciting and Considering Stakeholder Input, 

which requires all future federal investments in, and affecting, 

floodplains to meet a certain elevation level, as established by the 

standard;11 (2) the Council on Environmental Quality’s (CEQ) final 

guidance for considering climate change in agencies’ National 

Environmental Policy Act of 1969 (NEPA) implementation; (3) the 

Office of Management and Budget’s (OMB) Circular A-11—

government-wide guidance to agencies for developing their annual 

budgets—which directed agencies to include funds for resilience in 

construction and renovation of federal facilities in agency fiscal year 

 10GAO, Climate Change: Improvements Needed to Clarify National Priorities and Better 

Align Them with Federal Funding Decisions, GAO-11-317 (Washington, D.C.: May 20, 

2011). 

11GAO, Hurricane Sandy: An Investment Strategy Could Help the Federal Government 

Enhance National Resilience for Future Disasters, GAO-15-515 (Washington, D.C.: July 

30, 2015). The Consolidated Appropriation Act for fiscal year 2016 prohibited the use of 

appropriated funds to implement several aspects of E. O. 13690, but the prohibition does 

not apply during fiscal year 2017. 
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 155 GAO-17-317 High-Risk Series

2017 and 2018 budget requests; and (4) actions to achieve the 

government-wide goals for improving the climate resilience of federal 

facilities established by E.O. 13693.

• Federal flood and crop insurance programs: This entails building 

climate resilience into the requirements for federal crop and flood 

insurance programs. Although the Federal Emergency Management 

Agency (FEMA) has plans to provide updated hazard products and 

tools that incorporate climate science on an advisory basis, and the 

U.S. Department of Agriculture (USDA) provides information on 

voluntary resilience-building actions for producers—policyholders are 

not required to use the information to improve their resilience and 

reduce federal fiscal exposure. As such, the federal government 

needs to address our October 2014 recommendations to incorporate, 

as appropriate, forward-looking standards into required minimum flood 

elevation standards for insured properties and long-term agricultural 

resilience into the allowable agricultural practices required for crop 

insurance by the federal government.12

• Technical assistance to federal, state, local, and private-sector 

decision makers: This involves the Executive Office of the President 

(EOP) helping federal, state, local, and private sector decision makers 

access and use the best available climate information by designating 

a federal entity to (1) develop and periodically update a set of 

authoritative climate observations and projections for use in federal 

decision making, which state, local, and private sector decision 

makers could also access to obtain the best available climate 

information; and (2) create a national climate information system with 

defined roles for federal agencies and nonfederal entities, such as 

academic institutions, with existing statutory authority. Additionally, to 

assist standards-developing organizations incorporate forward-looking 

climate information into building codes and other standards, we 

recommended in November 2016 that the Secretary of Commerce 

should direct the National Institute of Standards and Technology 

(NIST) to convene federal agencies for an ongoing effort to provide 

the best available forward-looking climate information to these 

standards-developing organizations.13

 12GAO-15-28.

13GAO, Climate Change: Improved Federal Coordination Could Facilitate Use of ForwardLooking Climate Information in Design Standards, Building Codes, and Certification,

GAO-17-3 (Washington, D.C.: Nov. 30, 2016).
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 156 GAO-17-317 High-Risk Series

• Disaster aid: This involves implementing adequate budgeting and 

forecasting procedures to account for the costs of disasters. 

Additionally, the federal government has not yet defined the resources 

and government-wide structure to implement existing plans for 

reducing the federal fiscal exposure to disaster relief by improving 

resilience—with clear roles, responsibilities, and working relationships 

among federal, state, local, and private-sector entities.

Recognizing that each department and agency operates under its own 

authorities and responsibilities—and can therefore be expected to 

address climate change in different ways relevant to its own mission—

federal efforts have encouraged a decentralized approach, with federal 

agencies incorporating climate-related information into their planning, 

operations, policies, and programs. While individual agency actions are 

necessary, a centralized national strategy driven by a government-wide 

plan is also needed to reduce the federal fiscal exposure to climate 

change, maximize investments, achieve efficiencies, and better position 

the government for success. Even then, such approaches will not be 

sufficient unless also coordinated with state, local, and private-sector 

decisions that drive much of the federal government’s fiscal exposure. 

The challenge is to develop a cohesive approach at the federal level that 

also informs state, local, and private-sector action.

The interagency Council on Climate Preparedness and Resilience

(Resilience Council) established by E.O. 13653 recommended many of 

the same actions to future administrations in its October 2016 report 

Opportunities to Enhance the Nation’s Resilience to Climate Change. 

Among other actions, the Resilience Council called on the federal 

government to strengthen resilience coordination across federal agencies 

and increase the capacity for climate resilience efforts government-wide, 

expand incentives and requirements to increase resilience of 

infrastructure and buildings, improve awareness and dissemination of 

climate information, and enhance the usability of climate tools for decision 

making. Importantly, the Resilience Council recognized the need to 

coordinate resilience among multiple stakeholders—including all levels of 

government, academic institutions, and the private sector—through 

partnerships, shared knowledge and resources, and coordinated 

strategies, and to evaluate government-wide progress and performance 

of resilience investments. These are key elements of our criteria for 

removal from the High-Risk List.
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 157 GAO-17-317 High-Risk Series

For its climate strategic planning efforts, the federal government partially 

met four of the five criteria—leadership commitment, capacity, action 

plan, and monitoring—and received a not met rating for the 

demonstrating progress criterion. The federal government is not well 

organized to address the fiscal risks to which climate change exposes it, 

partly because of the inherently complicated, crosscutting nature of the 

issue. The federal government would be better positioned to respond to 

the risks posed by climate change if federal efforts were more 

coordinated and were directed toward common goals.

As we reported in our 2015 update, the federal government had partially 

met our leadership commitment, capacity, and action plan criteria through 

several climate-related strategic planning activities, such as the 

President’s June 2013 Climate Action Plan and agency adaptation plans, 

but it was unclear how the various planning efforts related to each other 

or what they amount to as a government-wide approach for reducing 

federal fiscal exposures. Additionally, existing planning activities partially 

met our capacity criterion because they did not clearly define the roles 

and responsibilities among federal, state, and local entities, or the 

resources needed to implement these plans. Furthermore, we reported 

that the federal government had not met our monitoring and 

demonstrated progress criteria because there were no programs to 

monitor the effectiveness of strategic planning efforts.

Since our 2015 update, the March 2015 E.O. 13693 Planning for Federal 

Sustainability in the Next Decade directs certain agencies to develop and 

annually update agency strategic sustainability performance plans, which, 

among other things, evaluate their past performance in achieving certain 

government-wide sustainability performance goals—including reducing 

greenhouse gas emissions and incorporating climate-resilient design 

elements into the operation and renovation of existing agency buildings 

and the design of new buildings.14 E.O. 13693 also directs specified 

federal agencies to convene regional interagency working groups to, 

 14More information on E.O. 13693 Planning for Federal Sustainability in the Next Decade 

can be found here. 

Additional Details on 

What GAO Found

Federal Government as 

Leader of National Climate 

Strategic Plan
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 158 GAO-17-317 High-Risk Series

among other things, address resilience planning in coordination with 

state, local, and tribal communities. Additionally, in April 2016, CEQ and 

OMB issued a joint memo that expands their annual review of agency 

adaptation plans, to include agency self-assessments and annual, inperson discussions with OMB and CEQ to evaluate certain agencies’

progress implementing their adaptation plans. Furthermore, the October 

2016 report Opportunities to Enhance the Nation’s Resilience to Climate 

Change from the interagency Resilience Council identified a set of key 

opportunities to guide sustained and coordinated action among federal 

agencies and invited stakeholders to work with these agencies on a 

shared climate resilience agenda.

For its strategic planning efforts, the federal government’s ratings are as 

follows.

The federal government has partially met this criterion and has taken 

additional steps since our last high-risk update. Specifically, E.O. 13693 

continues to demonstrate leadership commitment by establishing a 

government-wide approach and long-term goals for reducing some 

aspects of federal fiscal exposure to climate change. Further, the October 

2016 Resilience Council report identified key opportunities to guide 

sustained and coordinated action among federal agencies and invited 

stakeholders to advance a shared climate resilience agenda. However, 

the EOP has yet to implement our May 2011 recommendation to clearly 

establish federal strategic climate change priorities that take into 

consideration the full range of climate-related activities within the federal 

government.15 Additionally, because of the potential long-term effects of 

climate change, leadership needs to be sustained well into the future.

The federal government has partially met this criterion and has taken 

additional steps since our last high-risk update. For example, E.O. 13693 

directs the Office of Personnel Management (OPM), in coordination with 

other agencies, to consider creating a dedicated job classification for 

sustainability professionals and relevant positions that directly impact the 

achievement of Federal sustainability goals—which would define this 

occupation for work at federal agencies and establish official position 

titles—as well as initiating the inclusion of sustainability and climate 

preparedness and resilience into federal training—which could increase 

the federal government’s capacity. Additionally, E.O. 13693 directs 

 15GAO-11-317. 

Leadership Commitment

Capacity
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 159 GAO-17-317 High-Risk Series

specified federal agencies to convene regional interagency working 

groups to, among other things, address resilience planning in 

coordination with state, local, and tribal communities. Further, the October 

2016 Resilience Council report identifies opportunities to enhance 

capacity within the federal government and in local communities, among 

others. However, neither the October 2016 Resilience Council report nor 

the July 2015 E.O. 13693 implementing guidance specifically addresses 

the roles and responsibilities among federal, state, and local entities. 

Furthermore, neither the Resilience Council report nor the E.O. 13693 

implementing guidance indicates how these efforts will be funded, staffed, 

and sustained over time.

The federal government has partially met this criterion and has taken 

additional steps since our last high-risk update. In particular, the 

implementing guidance for E.O. 13693 directs agencies to annually 

measure and report their progress on, among other things, reducing 

greenhouse gas emissions and incorporating climate-resilient design into 

new agency buildings in their strategic sustainability performance plans, 

starting in June 2016. Additionally, the October 2016 Resilience Council 

report identified key opportunities that future administrations could take to 

improve climate resilience across three themes: (1) advancing and 

applying science-based information, technology, and tools to address 

climate risk; (2) integrating climate resilience into federal agency 

missions, operations, and culture; and (3) supporting community efforts to 

enhance climate resilience. However, it is too early to determine how 

effective agency strategic sustainability performance plans under E.O. 

13693 will be at reducing aspects of the federal fiscal exposure to climate 

change. Moreover, the October 2016 Resilience Council report provides a 

broad overview of key opportunities to improve climate resilience, but 

does not require implementation of specific actions to address these 

opportunities. As a result, it is unclear to what extent the Resilience 

Council report will help the government substantially complete actions to 

reduce federal fiscal exposure to climate change across the entire range 

of related federal activities.

The federal government now partially meets this criterion based on 

mechanisms established in E.O. 13693 to monitor certain agencies’

progress toward reducing aspects of the federal fiscal exposure to climate 

change, among other goals. E.O. 13693 directs OMB to prepare and 

publish scorecards evaluating certain agencies’ progress implementing 

their annual strategic sustainability performance plans. In addition, E.O. 

13693 directs CEQ, in coordination with OMB, to establish an interagency 

sustainability steering committee comprised of the agency senior officials 

Action Plan

Monitoring
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 160 GAO-17-317 High-Risk Series

responsible for implementing E.O. 13693 to advise OMB and CEQ on 

agencies’ performance of their E.O. responsibilities. Furthermore, the 

April 2016 joint CEQ and OMB memo established a monitoring 

mechanism to evaluate agencies’ progress on implementing their 

adaptation plans. However, it is too early to determine the effectiveness 

of the monitoring mechanisms. Additionally, the federal government has 

yet to establish a monitoring mechanism that addresses reducing federal 

fiscal exposure to climate change across the entire range of related 

federal activities.

The federal government has not met the criterion for demonstrating 

progress. Fiscal year 2016 is the first year agencies will include 

addressing aspects of fiscal exposure to climate change as part of the 

annual strategic sustainability performance plan process under E.O. 

13693. Therefore, it is too early to determine whether the federal 

government has demonstrated progress. Additionally, E.O. 13693 does 

not address reducing federal fiscal exposure to climate change across the 

entire range of related federal activities, such as federal disaster aid 

programs.

Demonstrated Progress
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 161 GAO-17-317 High-Risk Series

For its role as property owner, the federal government partially met four of 

the five criteria—leadership commitment, capacity, action plan, and 

monitoring—and received a not met rating for the demonstrating progress 

criterion. The federal government owns and operates hundreds of 

thousands of facilities and manages millions of acres of land that could be 

affected by climate change. For example, DOD oversees more than 

555,000 defense facilities and 28 million acres of land, with a replacement 

value DOD estimates at close to $850 billion.16 Federally funded and 

managed energy and water infrastructure, and federally managed land—

about 650 million acres—are also vulnerable to changes in the climate, 

including more frequent and severe droughts and wildfires. For example, 

in a November 2016 assessment of federal fiscal risks related to climate 

change, OMB and the Council of Economic Advisers (CEA) reported that 

18,000 facilities and structures with a replacement value of about $83 

billion were in the 100-year floodplain and susceptible to future changes 

in flood risk.17 Further, OMB and CEA reported that annual federal 

wildland fire suppression expenditures could increase by about $2.3 

billion by 2090.

As of our 2015 update, the federal government had partially met the 

criteria for leadership commitment, capacity, and action plan through 

various directives for agencies to develop climate change adaptation 

plans to integrate consideration of climate change into agency operations 

and missions, but leadership needed to be sustained over time and most 

agencies had yet to identify specific actions and the resources necessary 

to implement these plans. Additionally, we reported that the federal 

government had not met our monitoring and demonstrated progress 

criteria because there were no programs to monitor the effectiveness and 

sustainability of agency adaptation plans.18

Furthermore, CEQ had yet to implement our April 2013 recommendation 

to finalize guidance on how agencies can consider the effects of climate 

change when implementing NEPA, which applies to certain types of 

 16GAO-14-446.

17OMB and CEA’s analysis included those federal facilities with precise location data in 

the Federal Real Property Profile database, which excludes national security facilities—

with a replacement value of about $1 trillion. 

18GAO, High-Risk Series: An Update, GAO-15-290 (Washington, D.C.: February 2015). 

Federal Government as 

Property Owner
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 162 GAO-17-317 High-Risk Series

federal projects.19 Moreover, DOD had yet to implement our May 2014 

recommendations to develop a plan for completing climate change 

vulnerability assessments and clarifying how to account for climate 

change in planning as well as when comparing construction projects for 

funding.20

Since our 2015 update, the federal government has made progress on 

our April 2013 NEPA recommendation, the May 2014 DOD 

recommendations, and in other areas. Specifically, in August 2016, CEQ 

issued final guidance for agencies on how to consider the effects of 

climate change when implementing NEPA. Also, among other actions 

responsive to our May 2014 recommendations, DOD issued a January 

2016 directive on climate change adaptation and resilience that calls for 

DOD components to assess and manage climate change risks to build 

DOD’s resilience, when developing plans and implementing procedures.

In addition, the March 2015 E.O.13693 directed certain agencies to 

develop and annually update agency strategic sustainability performance 

plans, which, among other things, evaluate past performance toward 

achieving certain government wide sustainability performance goals—

including incorporating climate-resilient design and management 

elements into the operation, repair, and renovation of existing agency 

buildings and the design of new agency buildings. Finally, the April 2016 

joint CEQ and OMB memo expanded their annual review of agency 

adaptation plans to include agency self-assessments and annual, inperson discussions with OMB and CEQ to evaluate agencies’ progress 

implementing their adaptation plans.

Further, in July 2015, we reported that the January 2015 E.O. 13690, 

Establishing a Federal Flood Risk Management Standard and a Process 

for Further Soliciting and Considering Stakeholder Input requires all future 

federal investments in, and affecting, floodplains to meet a certain 

elevation level, as established by the standard.21 According to E.O. 

 19GAO, Climate Change: Future Federal Adaptation Efforts Could Better Support Local 

Infrastructure Decision Makers, GAO-13-242 (Washington, D.C.: Apr. 12, 2013). 

20GAO-14-446. 

21GAO, Hurricane Sandy: An Investment Strategy Could Help the Federal Government 

Enhance National Resilience for Future Disasters, GAO-15-515 (Washington, D.C.: July 

30, 2015). The Consolidated Appropriation Act for fiscal year 2016 prohibited the use of 

appropriated funds to implement several aspects of E. O. 13690, but the prohibition does 

not apply during fiscal year 2017. 
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 163 GAO-17-317 High-Risk Series

13690, implementing the standard will ensure that agencies address 

current and future flood risk and ensure that projects funded with taxpayer 

dollars last as long as intended. Furthermore, since June 2015, OMB 

Circular A-11—government-wide guidance to agencies for developing 

their annual budgets—has directed agencies to include funding for 

resilience in construction and renovation of federal facilities in their fiscal 

year 2017 and 2018 budget requests, although the 2018 budget requests 

have not been finalized.

For its role as property owner, the federal government’s ratings are as 

follows.

The rating for this criterion remains at partially met, but the federal 

government has taken additional steps since our 2015 update. E.O. 

13693 and E.O.13690 reflect continued leadership commitment by 

establishing a government-wide approach for reducing fiscal exposure to 

climate change for federal facilities and federally-funded infrastructure in 

and affecting floodplains. However, because of the potential long-term 

effects of climate change, leadership needs to be sustained well into the 

future.

The rating for this criterion remains at partially met, but the federal 

government has taken additional steps since our 2015 update. Under 

E.O. 13693 agencies must, where life-cycle cost effective, incorporate 

climate-resilient design and management elements into agency building 

operation, renovation, and design of new buildings. Furthermore, OMB’s 

revised Circular A-11 directs agencies to include funding for resilience in 

construction and renovation of federal facilities in their fiscal year 2017 

and 2018 budget requests—although the budget requests for fiscal year 

2018 have not been finalized. Moreover, the August 2016 CEQ final 

guidance for agencies on how to consider climate change when 

implementing NEPA may increase the consistency with which agencies 

address climate change in implementing the law. However, it is too early 

to determine whether these efforts will effectively build the capacity of the 

federal government to reduce its fiscal exposure as a property owner.

The rating for this criterion remains at partially met but the federal 

government has taken additional steps since our 2015 update. For 

example, the guidance for implementing E.O. 13693 directs agencies to 

identify specific strategies to accomplish sustainability goals and 

establishes targets and metrics for the goals. Additionally, E.O. 13690 

directs agencies to submit implementation plans with milestones and a 

timeline for their implementation of the Federal Flood Risk Management 

Leadership Commitment

Capacity

Action Plan
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 164 GAO-17-317 High-Risk Series

Standard. Moreover, DOD fully implemented one of our May 2014 

recommendations by developing a plan and milestones for completing 

climate change vulnerability assessments.22 DOD has also made 

progress implementing components of our other recommendations for 

considering climate change impacts when planning installations and 

comparing construction projects for funding.23 However, it is too early to 

determine whether these plans will effectively reduce federal facilities’

fiscal exposure to climate change.

The rating for this criterion was upgraded from not met in our 2015 update 

to partially met. E.O. 13693 establishes a mechanism for OMB and an 

interagency steering committee to monitor agency progress toward 

sustainability goals—which include incorporation of climate-resilient 

design and management elements into the operation, repair and 

renovation of existing agency buildings. Additionally, the April 2016 joint 

CEQ and OMB memo to federal agencies established a monitoring 

mechanism to evaluate agencies’ efforts to implement their adaptation 

plans as part of their annual reviews of the plans. However, it is too early 

to determine the effectiveness of these monitoring mechanisms.

The federal government has not met the criterion for demonstrating 

progress. Fiscal year 2016 is the first year agencies will include 

“incorporating climate resilient design and management elements” as a 

measurable goal within their annual strategic sustainability performance 

plan under E.O. 13693. In addition, fiscal year 2017 is the first year of 

agencies’ implementation plans for the Federal Flood Risk Management 

Standard. Therefore, it is too early to determine whether the federal 

government has demonstrated progress.

 22GAO-14-446.

23For example, DOD produced a report and database that provides regionalized sea level 

and extreme water level scenarios for three future time horizons (2035, 2065, and 2100) 

for 1,774 DOD sites worldwide, which DOD intends to be used by planners to account for 

sea-level rise, one effect of climate change. We have ongoing work examining DOD’s 

activities to adapt its infrastructure for climate change in overseas locations.

Monitoring

Demonstrated Progress
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 165 GAO-17-317 High-Risk Series

As the insurer of crops and property, the federal government partially met 

three of the five criteria—leadership commitment, capacity, and action 

plan—and received a not met rating for the monitoring and demonstrating 

progress criteria. Two important federal insurance efforts— the FEMA 

National Flood Insurance Program (NFIP) and USDA’s Federal Crop 

Insurance Corporation (FCIC)—face climate change and other challenges 

that increase federal fiscal exposure and send inaccurate price signals 

about risk to policyholders. For example, a November 2016 OMB and 

CEA report found that total annual premium subsidies for crop insurance 

could increase by about $4.2 billion in 2080 due to the effects of 

unmitigated climate change.24

In our 2015 update, we reported that the federal government had partially 

met our leadership commitment criterion by commissioning climate 

change studies and incorporating climate change adaptation into their 

planning, which recognized climate change risks to federal insurers, but 

needed to sustain top leadership support and enhance it over time. We 

also reported that the federal government had not met the other four 

criteria because federal insurers had yet to identify specific actions and 

the resources necessary to address challenges inherent to federal 

insurance programs—such as how to encourage policyholders to reduce 

their long-term exposure to climate change given the short-term nature of 

insurance contracts—that may impede the ability of these programs to 

minimize long-term federal fiscal exposure to climate change.

For example, to promote forward-looking construction and rebuilding 

efforts for flood insurance, we recommended in October 2014 that the 

Secretary of the Department of Homeland Security (DHS) direct FEMA to 

consider amending flood insurance standards to incorporate, as 

appropriate, forward-looking information.25 DHS agreed with our 

recommendation. For crop insurance, we recommended in October 2014 

that the Secretary of Agriculture direct the FCIC to consider working with 

agricultural experts to incorporate resilient agricultural practices into good 

farming practices—which farmers must follow to have their losses 

covered—so that these practices take into account long-term resilience to 

 24OMB and CEA did not estimate the projected changes in NFIP premiums or payouts 

under climate change. 

25GAO-15-28.

Federal Insurance 

Programs
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 166 GAO-17-317 High-Risk Series

climate change.26 USDA did not specify its agreement or disagreement 

with our recommendation.

Since our 2015 update, FEMA and USDA have taken additional actions to 

understand and respond to climate change risks. For flood insurance, in 

February 2016, FEMA publicly released the 2015 Future Conditions Risk 

Assessment and Modeling report by the Technical Mapping Advisory 

Council (TMAC)—an advisory body created to review the national flood 

mapping program and make recommendations to FEMA.27 The report, 

which was required by law, has several recommendations on how FEMA 

could incorporate the best-available climate science to assess flood risk 

and incorporate such information into its advisory hazard products, tools, 

and information for local decision makers.28 For crop insurance, in May 

2016, USDA publicly issued Building Blocks for Climate Smart Agriculture 

and Forestry: Implementation Plan and Progress Report for USDA’s 

framework for helping farmers, ranchers, and forestland owners respond 

to climate change, through voluntary and incentive-based actions.29

For its role as the insurer of crops and property, the federal government’s 

ratings are as follows.

The rating for this criterion remains at partially met but the federal 

government has taken additional steps since our 2015 update. For flood 

insurance, the TMAC report identified both short- and long-term 

recommended actions for FEMA to incorporate climate science into its 

hazard products and tools for decision makers, and a senior FEMA official 

has publicly stated that the agency will implement the 

recommendations.30 For crop insurance, the USDA’s 2016 Building 

 26GAO-15-28.

27Technical Mapping Advisory Council, Future Conditions Risk Assessment and Modeling 

(Published: December 2015, Publicly Issued: Feb. 8, 2016). 

28Pub. L. No. 112-141, div. F, tit. II, § 100215(d)(1) (2012) (codified at 42 U.S.C. § 

4101a(d)(1)).

29USDA, Building Blocks for Climate Smart Agriculture and Forestry: Implementation Plan 

and Progress Report (May 2016).

30Roy Wright, Deputy Associate Administrator, Federal Insurance And Mitigation 

Administration, Federal Emergency Management Agency, U.S. Department Of Homeland 

Security, The National Flood Insurance Program: Reviewing The Recommendations Of 

The Technical Mapping Advisory Council’s 2015 Annual Report, testimony before the 

Senate Committee On Banking, Housing, And Urban Affairs, 114th Cong., 2nd sess., 

September 13, 2016.

Leadership Commitment
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 167 GAO-17-317 High-Risk Series

Blocks for Climate Smart Agriculture and Forestry implementation plan 

continues leadership commitment by establishing long-term goals for 

reducing agricultural GHG emissions by improving producers’ soil health, 

nitrogen management, and land management practices, among others—

practices that may also reduce federal fiscal exposure for insured crops 

by improving agricultural resilience to climate change. However, because 

of the potential long-term effects of climate change, leadership needs to 

be sustained well into the future.

The rating for this criterion was upgraded from not met in our 2015 update 

to partially met. For flood insurance, a senior FEMA official has publicly 

stated that the agency will engage with stakeholders and partners to 

implement the recommendations of the TMAC report on incorporating 

climate science into its products and tools for decision makers.31

Additionally, the agency has begun conducting sea level rise pilot studies 

and work to identify related research gaps for additional pilot studies, 

according to the FEMA official. If FEMA implements the TMAC 

recommendations, it could improve climate change–related decision 

making capacity at federal, state, and local levels. For crop insurance, 

through its 2016 implementation plan, USDA has identified lead agencies 

and potential partnerships with public and private sector organizations to 

implement certain actions that could also improve agriculture’s resilience 

to climate change. Additionally, the USDA Regional Climate Hubs—which 

deliver science-based knowledge, practical information, and program 

support to farmers, ranchers, and forest landowners—may help improve 

producers’ capacity to understand and respond to climate change 

impacts. However, neither FEMA nor USDA has identified the resources 

necessary to implement the actions outlined in the TMAC report or 

USDA’s implementation plan. Additionally FEMA has not identified the 

roles, responsibilities, and working relationships among federal, state, 

and local entities for its effort to incorporate climate science into its 

products and tools.

The rating for this criterion was upgraded from not met in our 2015 update 

to partially met. In 2016, both FEMA and USDA have identified specific 

 31Roy Wright, Deputy Associate Administrator, Federal Insurance And Mitigation 

Administration, Federal Emergency Management Agency, U.S. Department Of Homeland 

Security, The National Flood Insurance Program: Reviewing The Recommendations Of 

The Technical Mapping Advisory Council’s 2015 Annual Report, testimony before the 

Senate Committee On Banking, Housing, And Urban Affairs, 114th Cong., 2nd sess., 

September 13, 2016.

Capacity

Action Plan
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 168 GAO-17-317 High-Risk Series

actions to address aspects of climate change in federal insurance 

programs and have made these actions publicly available. In particular, 

for flood insurance, the publicly available TMAC report identified shortand long-term actions to incorporate climate change science into its 

products and tools for decision makers. However, FEMA has yet to 

establish milestones and metrics for implementing the 

recommendations—although a senior FEMA official stated that the 

agency plans to do so. For crop insurance, in its 2016 publicly available 

report, USDA has developed clear milestones and metrics to assess its 

progress implementing certain actions that could also improve agricultural 

resilience to climate change. However, neither federal insurance program 

has taken action to implement our October 2014 recommendations to 

improve the long-term resiliency of insured structures and crops—through 

changes to flood insurance standards or allowable growing practices for 

crop insurance.

The rating for this criterion remains at not met, but the federal government 

has taken some steps since our 2015 update. For crop insurance, USDA 

established milestones for certain actions from 2016 to 2018 in its 2016 

implementation plan, and the plan indicates that USDA is developing a 

framework to estimate the adoption of conservation practices and 

technologies. However, it is unclear from the plan what mechanisms are 

in place for USDA to assess its overall progress toward the departmentwide goals, or the frequency of assessment. For flood insurance, FEMA 

has yet to establish metrics and milestones within an action plan to 

monitor its progress implementing the TMAC recommendations for 

addressing climate change in flood insurance.

The federal government has not met the criterion for demonstrating 

progress. Without clear monitoring mechanisms for FEMA and USDA to 

assess their overall progress addressing aspects of climate change in 

federal insurance programs, it is unclear how either agency will be able to 

demonstrate progress. Additionally, FEMA has indicated that—consistent 

with the TMAC recommendations—it should provide its updated hazard 

products and tools that incorporate climate science on an advisory—not 

regulatory—basis. USDA has also framed its resilience-building actions 

for producers as voluntary. As a result, it is unclear to what extent 

policyholders in either federal insurance program will use the information 

provided to improve their resilience and reduce federal fiscal exposure.

Monitoring

Demonstrated Progress
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 169 GAO-17-317 High-Risk Series

As the provider of technical assistance, the federal government partially 

met two of the five criteria—leadership commitment and action plan—and 

received a not met rating for the capacity, monitoring, and demonstrating 

progress criteria. Climate change has the potential to directly affect a 

wide range of federal services, operations, programs, and assets, as well 

as national security, increasing federal fiscal exposure in many ways. 

State, local, and private-sector decision makers can also drive federal 

climate-related fiscal exposures because they are responsible for 

planning, constructing, and maintaining certain types of vulnerable 

infrastructure paid for with federal funds, insured by federal programs, or 

eligible for federal disaster assistance. To reduce fiscal exposure, the 

federal government has a role to play in providing information to these 

decision makers so they can make more informed choices about how to 

manage the risks posed by climate change.32

As reported in our 2015 update, the federal government had partially met 

our leadership commitment and action plan criteria through various 

strategic plans and E.O.s that directed certain federal agencies to work 

together to provide authoritative and readily accessible climate-related 

information, but the roles, responsibilities, and working relationships 

among federal, state, local, and private-sector entities were still unclear. 

We also reported that the federal government had not met our criteria for 

capacity, monitoring, and demonstrated progress because the resources 

and government-wide structure necessary to implement plans were not 

yet defined, and that because no monitoring programs existed, the ability 

to demonstrate progress was limited.

Furthermore, we reported that despite existing efforts, the climate 

information needs of federal, state, local, and private section decision 

makers were not being fully met, in part because federal climate 

information was fragmented across individual agencies that used the 

information in different ways to meet their missions. We also reported that 

we had made multiple recommendations to the EOP to address these 

issues, such as developing an information exchange for ocean 

acidification information as required by law, and directing a federal entity 

 32For example, in its November 2016 assessment of federal fiscal risks related to climate 

change, OMB and CEA found that additional work is necessary to provide more specific 

and actionable information—such as specific risks and tradeoffs facing decision makers 

as they evaluate policy options and long-term investments and divestments. 

Technical Assistance to 

Federal, State, Local, and 

Private-Sector Decision 

Makers
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 170 GAO-17-317 High-Risk Series

to identify the best available climate-related information for state and local 

infrastructure planning.33

Since our 2015 update, we have completed work related to federal 

climate-related technical assistance across several areas—including 

federal supply chain climate risk; government-wide options to provide 

climate information to federal, state, local, and private sector decision 

makers; fisheries management; and private sector use of climate 

information in design standards and building codes—and found that 

although the federal government had taken some steps, additional efforts 

are needed to address the High-Risk List criteria. As a result, the federal 

government’s ratings for the High-Risk List criteria under technical 

assistance have not changed.

Specifically, we reported, in October 2015, that some climate information 

relevant to federal supply chain risks may not be available to federal 

agencies, and that these agencies may not have the capacity to assess 

their supply chain risks.34 In November 2015, we reported on federal 

efforts to provide climate information and found that they could be 

improved by incorporating key elements—such as a focused 

organization, authoritative data, and technical assistance to help decision 

makers use the climate information. We also reported that a key federal 

role in a national climate information system would be to provide 

authoritative data and quality assurance guidelines for how to use it, and 

a nonfederal entity would be better positioned to provide technical 

assistance and facilitate connections between decision makers and those 

with relevant expertise.35 In September 2016, we reported on climaterelated federal fisheries management and found that federal and regional 

management entities had general information on potential effects from 

climate change, but had limited information on the magnitude and timing 

 33GAO, Ocean Acidification: Federal Response Under Way, but Actions Needed to 

Understand and Address Potential Impacts, GAO-14-736 (Washington, D.C.: Sept. 12, 

2014); and GAO-13-242.

34GAO, Federal Supply Chains: Opportunities to Improve the Management of ClimateRelated Risks, GAO-16-32 (Washington, D.C.: Oct. 13, 2015).

35GAO, Climate Information: A National System Could Help Federal, State, Local, and 

Private Sector Decision Makers Use Climate Information, GAO-16-37 (Washington, D.C.: 

Nov. 23, 2015). 
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 171 GAO-17-317 High-Risk Series

of such effects for specific fish stocks.36 Lastly, in November 2016, we 

reported on the use of climate information in design standards and 

building codes and found that standards-developing organizations such 

as professional engineering societies generally use historical data to 

develop standards and face institutional and technical challenges to using 

forward-looking climate information, including difficulty identifying the best 

available climate information. We found that government-wide 

coordination to help address these challenges could present a benefit by 

reducing the federal fiscal exposure to the effects of climate change.37

For its efforts to provide technical assistance, the federal government’s 

ratings are as follows.

The rating for this criterion remains at partially met. Top leadership 

support for providing climate-related technical assistance has continued 

since 2009 through various E.O.s and planning documents, such as the 

President’s June 2013 Climate Action Plan, the U.S. Global Change 

Research Program’s 2012-2021 strategic plan for climate change 

science, and, more recently, the October 2016 Resilience Council report. 

However, because of the potential long-term effects of climate change, 

leadership needs to be sustained well into the future.

The rating for this criterion remains at not met. Specifically, the resources 

and government-wide structure to implement existing plans for providing 

technical assistance—with clear roles, responsibilities, and working 

relationships among federal, state, local, and private-sector entities—are 

not yet defined. Furthermore, climate information remains fragmented 

across individual agencies and efforts.38 We have made multiple 

recommendations to the EOP to address these issues; however, the EOP 

has yet to make progress implementing them. More recently, we 

recommended, in November 2015, that the EOP direct a federal entity to 

create a national climate information system with defined roles for federal 

 36GAO, Federal Fisheries Management: Additional Actions Could Advance Efforts to 

Incorporate Climate Information into Management Decisions, GAO-16-827 (Washington, 

D.C.: Sep. 28, 2016). 

37GAO-17-3.

38For example, we reported in November 2015 that entities within the EOP, such as CEQ 

and OSTP, had led multiple government-wide climate information efforts, such as the 

Climate Resilience Toolkit, the Climate Data Initiative, and USGCRP’s May 2014 Third 

National Climate Assessment, among other federal efforts. GAO-16-37. 

Leadership Commitment

Capacity
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 172 GAO-17-317 High-Risk Series

agencies and nonfederal entities with existing statutory authority. The 

EOP did not agree or disagree with this recommendation.

We also recently recommended that the EOP and other agencies provide 

guidance to help federal agencies and others use climate information. 

Specifically, in October 2015, we recommended that, within the EOP, the 

CEQ clarify the guidance to federal agencies on developing adaptation 

plans, to better assist agencies to include climate-related risks to their 

supply chains in their plans.39 CEQ agreed with this recommendation and 

implemented it in April 2016 by issuing a joint memo with OMB which, 

among other things, clarified the guidance to federal agencies for the 

November 2013 E.O. 13653 on Preparing the United States for the 

Impacts of Climate Change. Specifically, the joint memo directs agencies 

to include climate-related risks to supply chains in agency adaptation 

plans. In September 2016, we recommended that the Secretary of 

Commerce direct the National Marine Fisheries Service to develop 

guidance on how fisheries managers should incorporate climate 

information into different parts of the fisheries management process, such 

as fish stock assessments.40 Commerce agreed with this 

recommendation, but has yet to implement it. Lastly, in November 2016, 

we reported on using climate information in design standards and building 

codes. We found that standards-developing organizations, such as 

professional engineering societies, do not generally use forward-looking 

climate information and that they face institutional and technical 

challenges to doing so, including difficulty identifying the best available 

climate information. We also found that government-wide coordination to 

help address these challenges could present a benefit by reducing the 

federal fiscal exposure to the effects of climate change, and 

recommended that the Department of Commerce’s NIST convene federal 

agencies for an ongoing effort to provide the best available forwardlooking climate information to standards-developing organizations. The 

Department of Commerce neither agreed nor disagreed with our 

recommendation. Implementing these recommendations would improve 

the federal government’s capacity as a provider of technical assistance.

The rating for this criterion remains at partially met. As we reported in our 

2015 update, the federal government has taken some steps to develop an 

action plan related to technical assistance—through various strategic 

 39GAO-16-32.

40GAO-16-827.

Action Plan
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 173 GAO-17-317 High-Risk Series

plans and an E.O. that directed certain federal agencies to work together 

to develop and provide authoritative, easily accessible and useable 

information on climate preparedness and resilience.41 Additionally, the 

October 2016 Resilience Council report identified several opportunities to 

improve aspects of federal technical assistance government-wide, such 

as making climate tools easier for decision makers to use. However, 

existing plans and reports do not amount to a government-wide plan with 

clear milestones and metrics to address the challenges we’ve identified 

related to the federal government’s role in providing climate-related 

technical assistance, and government and private sector decision makers 

accessing and using such information.

The rating for this criterion remains at not met. The April 2016 joint memo 

by CEQ and OMB clarifies the process to monitor progress for certain 

agencies on several areas, including technical assistance. However, 

there are still no programs or mechanisms to monitor government-wide 

progress in addressing the challenges we’ve identified related to the 

federal government’s role in providing climate-related technical 

assistance. These challenges include clarifying the roles, responsibilities, 

and working relationships among federal, state, local, and private-sector 

entities; identifying the necessary resources and establishing the 

government-wide structure necessary to implement plans; and 

addressing the fragmentation of federal climate information across 

individual agencies that use the information in different ways to meet their 

missions.

The rating for this criterion remains at not met. Without a program or 

mechanism to monitor government-wide action addressing relevant 

challenges, it is unclear how the federal government can demonstrate 

progress.

 41The President’s June 2013 Climate Action Plan and the U.S. Global Change Research 

Program’s 2012 -2021 strategic plan recognize the importance of providing and translating 

climate information for decision makers. In addition, see section 4(a) of E. O. 13653 on 

Preparing the United States for the Impacts of Climate Change. 

Monitoring

Demonstrated Progress
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 174 GAO-17-317 High-Risk Series

As the provider of disaster aid, the federal government partially met two of 

the five criteria—leadership commitment, and capacity—and received a 

not met rating for the action plan, monitoring, and demonstrating progress 

criteria. Multiple factors, including increased disaster declarations, climate 

change effects, and changing development patterns increase federal 

fiscal exposure to severe weather events, which have cost the nation 

hundreds of billions of dollars over the past decade. For example, from 

fiscal years 2005 through 2014, the federal government obligated at least 

$277.6 billion across 17 federal department and agencies for disaster 

assistance programs and activities.42 Such federal disaster aid functions 

as the insurance of last resort in certain circumstances because whatever 

is not covered by insurance or built to be resilient to extreme weather 

increases the federal government’s implicit fiscal exposure through 

disaster relief programs. For example, a November 2016 OMB and CEA 

report found that total annual expected disaster relief for hurricane 

damage could increase by about $50 billion by 2075.

In our 2015 update, we reported that the federal government had partially 

met our leadership commitment criterion through the federal response to 

Superstorm Sandy, and other strategic planning documents that 

demonstrate top leadership support for increasing resilience and reducing 

fiscal exposures posed by climate change. Additionally, we reported that 

the federal government planned to take additional actions, such as 

issuing a federal flood risk reduction standard and updating guidance to 

direct states to incorporate climate change into their hazard mitigation 

plans, as a condition for receiving disaster relief. However, we also 

reported that the federal government had not met our criteria for capacity, 

action plan, monitoring, and demonstrated progress because there is no 

government-wide corrective action plan that defines clear roles and 

responsibilities to address federal fiscal exposure, and no programs to 

monitor the effectiveness of the measures identified in the existing 

strategies and plans. We also reported that federal disaster aid 

programs—such as FEMA’s Disaster Relief Fund—have been primarily 

funded through supplemental appropriations, and the federal government 

did not budget for these costs. Furthermore, without adequate budgeting 

and forecasting to account for these events, the federal government runs 

 42GAO, Federal Disaster Assistance: Federal Departments and Agencies Obligated at 

Least $277.6 Billion during Fiscal Years 2005 through 2014, GAO-16-797 (Washington, 

D.C.: Sept. 22, 2016).

Disaster Aid and 

Resilience
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 175 GAO-17-317 High-Risk Series

the risk of facing a large fiscal exposure at any time.43 Moreover, fiscal 

constraints would make it more difficult for the federal government to 

respond effectively in the future and such expenses could affect 

resources available for other key government programs.

Since our 2015 update, the federal government has made some progress 

addressing its federal fiscal exposure to disaster relief by improving 

resilience. Specifically, in our July 2015 report that examined disaster 

resilience efforts following Hurricane Sandy, we found that the President 

and Congress had taken multiple steps to enhance the federal 

government’s focus on disaster resilience through E.O.s, presidential 

policy directives, and enacted legislation.44 For example, we reported that 

E.O. 13690, Establishing a Federal Flood Risk Management Standard 

and a Process for Further Soliciting and Considering Stakeholder Input 

requires all future federal investments in, and affecting, floodplains to 

meet a certain elevation level, as established by the standard.45

Specifically, the standard provides 3 approaches that federal agencies 

can now use to establish the flood elevation and floodplain for 

consideration in their decision making: (1) climate-informed science 

approach, (2) adding 2-3 feet of elevation to the 100-year floodplain, and 

(3) using the 500-year floodplain.

According to E.O. 13690, implementing the standard will ensure that 

agencies address current and future flood risk and ensure that projects 

funded with taxpayer dollars last as long as intended. However, we also 

reported, in July 2015, that there was no comprehensive, strategic 

approach to identifying, prioritizing, and implementing investments for 

disaster resilience, which increases the risk of lower returns on 

investments or lost opportunities to strengthen critical infrastructure and 

 43GAO, Extreme Weather Events: Limiting Federal Fiscal Exposure and Increasing the 

Nation’s Resilience, GAO-14-364T (Washington, D.C.: Feb. 12, 2014). Fiscal Exposures: 

Improving Cost Recognition in the Federal Budget, GAO-14-28 (Washington, D.C.: Oct. 

29, 2013); and Budget Issues: Budgeting for Federal Insurance Programs, 

GAO/T-AIMD-98-147 (Washington, D.C.: Apr. 23, 1998). 

44For example, Congress passed and the President signed the Sandy Recovery 

Improvement Act of 2013, which authorized several changes to the way FEMA may 

deliver federal disaster assistance, including expedited procedures for its Hazard 

Mitigation Grant Program. Pub. L. No. 113-2, div. B, § 1104(a), 127 Stat. 39, 43 (2013). 

45GAO-15-515. The Consolidated Appropriation Act for fiscal year 2016 prohibited the use 

of appropriated funds to implement several aspects of E. O. 13690, but the prohibition 

does not apply during fiscal year 2017. 
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 176 GAO-17-317 High-Risk Series

lifelines—such as communications, energy, transportation, and water 

management systems.46 As a result, we recommended that the Mitigation 

Framework Leadership Group (MitFLG)—an intergovernmental body to 

help coordinate hazard mitigation efforts of relevant local, state, tribal, 

and federal organizations—establish an investment strategy to identify, 

prioritize, and implement federal investments in disaster resilience.47

As part of its response to this priority recommendation, FEMA developed 

a high-level work plan to guide MitFLG’s development of a disaster 

resilience investment strategy. Additionally, in May 2016, MitFLG solicited 

stakeholder input on its design of a new Federal Mitigation Investment 

Strategy. According to MitFLG, the strategy will identify, prioritize, and 

guide federal investments in disaster resilience and hazard mitigationrelated activities and include recommendations to the President and 

Congress on how the nation should prioritize future investments. 

Additionally, the October 2016 Resilience Council report identified several 

opportunities to further integrate climate resilience into federal agency 

missions and improve federal support for communities’ resilience-building 

efforts, such as expanding incentives and requirements to increase the 

resilience of infrastructure and building communities’ capacity for climate 

resilience efforts.

For its role as the provider of disaster aid, the federal government’s 

ratings are as follows.

The rating for this criterion remains at partially met. Top leadership has 

sustained support since 2009 through various E.O.s, such as E.O. 13690, 

and other documents, such as the October 2016 report on opportunities 

to enhance the nation’s resilience. However, because of the potential 

long-term effects of climate change, leadership needs to be sustained

well into the future.

The rating for this criterion was upgraded from our 2015 update to 

partially met. FEMA has taken steps to improve the capacity of the federal 

government and its nonfederal partners. For example, in response to our 

2012 priority recommendation that FEMA implement a methodology that 

can more comprehensively assess a jurisdiction’s capacity for disaster 

response and recovery without federal assistance, the agency has 

 46GAO-15-515. 

47GAO-15-515.

Leadership Commitment

Capacity
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 177 GAO-17-317 High-Risk Series

identified three potential options for determining how a state, territory, or 

tribal government qualifies for federal disaster assistance. Additionally, in 

January 2016, FEMA solicited comments on implementing individualized 

deductibles for states, territories, and Indian tribes to qualify for disaster 

assistance under its Public Assistance program. FEMA is considering 

requiring states, territories, and Indian tribes to demonstrate satisfaction 

of a predetermined level of financial or other commitment before FEMA 

would provide financial assistance to them through this program. As of 

October 2016, FEMA was considering comments received on its 

proposal. Further, in March 2015, FEMA updated its guidance for state 

hazard mitigation plans to include a summary of the likelihood of future 

hazard events and changing future conditions, such as climate change, 

as a condition for receiving certain types of non-emergency disaster 

assistance. However, the federal government has yet to implement 

adequate budgeting and forecasting procedures to account for the costs 

of disasters. Additionally, the federal government has not yet defined the 

resources and government-wide structure to implement existing plans for 

reducing the federal fiscal exposure by improving resilience—with clear 

roles, responsibilities, and working relationships among federal, state, 

local, and private-sector entities.

The rating for this criterion remains at not met. As we mentioned 

previously, the federal government has taken steps to develop an action 

plan for improving resilience through developing the Federal Mitigation 

Investment Strategy. However, because a draft of this strategy is not yet 

available, it is too soon to evaluate it as an action plan to address federal 

fiscal exposure through disaster aid. Additionally, although the October 

2016 Resilience Council report identifies several opportunities to improve 

federal and local climate resilience, it does not meet several action plan 

characteristics from our high-risk criterion, such as establishing goals and 

performance measures, developing a plan with clear milestones and 

metrics, and ensuring there are processes for reporting results, among 

others. As a result, it is unclear to what extent the October 2016 report 

will help the government substantially complete actions to reduce federal 

fiscal exposure to climate change as the provider of disaster aid.

The rating for this criterion remains at not met. The federal government 

has yet to implement programs or mechanisms to monitor the 

effectiveness of the measures identified across existing plans and 

standards.

The rating for this criterion remains at not met. Without monitoring 

mechanisms to assess the effectiveness of the measures in existing 

Action Plan

Monitoring

Demonstrated Progress
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 178 GAO-17-317 High-Risk Series

plans and standards, the federal government cannot demonstrate 

progress in implementing corrective measures.

• In response to a recommendation we made in May 2014, the Office of 

the Secretary of Defense (OSD) and the services took a number of 

actions from September 2014 to July 2015 to develop a project plan 

and milestones for completing DOD’s screening-level climate change 

vulnerability assessment. OSD also took action to direct the services 

to develop plans and milestones that describe how they intend to use 

the data collected through the assessment to support climate change 

adaptation planning. By implementing our recommendation, OSD and 

the services can now inform the department’s decision makers about 

the vulnerabilities of DOD facilities and missions to the potential 

impacts of climate change. (GAO-14-446)

• In response to a recommendation we made in October 2015, CEQ 

and OMB issued an April 2016 joint memo on climate adaptation 

planning that clarified the guidance for E.O. 13653 to include climaterelated risks to supply chains in agency adaptation plans, among 

other things. (GAO-16-32)

For additional information about this high-risk area, contact Alfredo 

Gómez Director, Natural Resources and Environment, (202)512-3841 or 

gomezj@gao.gov.

Climate Change: Improved Federal Coordination Could Facilitate Use of 

Forward-Looking Climate Information in Design Standards, Building 

Codes, and Certification. GAO-17-3. Washington, D.C.: November 30, 

2016.

Federal Fisheries Management: Additional Actions Could Advance Efforts 

to Incorporate Climate Information into Management Decisions. 

GAO-16-827. Washington, D.C.: September 28, 2016.

Federal Disaster Assistance: Federal Departments and Agencies 

Obligated at Least $277.6 Billion during Fiscal Years 2005 through 2014. 

GAO-16-797. Washington, D.C.: September 22, 2016.

Polar Weather Satellites: NOAA Is Working to Ensure Continuity but 

Needs to Quickly Address Information Security Weaknesses and Future 

Program Uncertainties. GAO-16-359. Washington, D.C.: May 17, 2016.

Benefits Achieved by 

Implementing Our 

Recommendations

GAO Contact

Related GAO 

Products
Limiting the Federal Government’s Fiscal 

Exposure by Better Managing Climate Change 

Risks

Page 179 GAO-17-317 High-Risk Series

Climate Information: A National System Could Help Federal, State, Local, 

and Private Sector Decision Makers Use Climate Information. 

GAO-16-37. Washington, D.C.: December 8, 2015.

Federal Supply Chains: Opportunities to Improve the Management of 

Climate-Related Risks. GAO-16-32. Washington, D.C.: October 27, 2015.

Hurricane Sandy: An Investment Strategy Could Help the Federal 

Government Enhance National Resilience for Future Disasters. 

GAO-15-515. Washington, D.C.: July 30, 2015.

Climate Change: Better Management of Exposure to Potential Future 

Losses Is Needed for Federal Flood and Crop Insurance. GAO-15-28. 

Washington, D.C.: November 20, 2014.

Climate Change Adaptation: DOD Can Improve Infrastructure Planning 

and Processes to Better Account for Potential Impacts, GAO-14-446. 

Washington, D.C.: May 30, 2014.
Improving the Management of IT Acquisitions 

and Operations

Page 180 GAO-17-317 High-Risk Series

Although the executive branch has undertaken numerous initiatives to 

better manage the more than $80 billion that is annually invested in 

information technology (IT), federal IT investments too frequently fail or 

incur cost overruns and schedule slippages while contributing little to 

mission-related outcomes. We have previously testified that the federal 

government has spent billions of dollars on failed IT investments.1 These 

investments often suffered from a lack of disciplined and effective 

management, such as project planning, requirements definition, and 

program oversight and governance. In many instances, agencies have 

not consistently applied best practices that are critical to successfully 

acquiring IT. In this regard, we have identified nine critical factors 

underlying successful major acquisitions, such as program officials 

actively engaging with stakeholders and staff having the necessary 

knowledge and skills.2

Nonetheless, agencies continue to have IT projects that perform poorly. 

Such projects have often used a “big bang” approach—that is, projects 

are broadly scoped and aim to deliver functionality several years after 

initiation. According to the Defense Science Board, this approach is often 

too long, ineffective, and unaccommodating of the rapid evolution of IT. 

Further, it is inconsistent with Office of Management and Budget (OMB) 

guidance directing that IT investments deliver functionality in 6-month 

increments.3 In August 2016, we reported that approximately half of the 

software projects across selected agencies were following this guidance.4

 1

GAO, Information Technology: OMB and Agencies Need to More Effectively Implement 

Major Initiatives to Save Billions of Dollars, GAO-13-796T (Washington, D.C.: July 25, 

2013). 

2

GAO, Information Technology: Critical Factors Underlying Successful Major Acquisitions, 

GAO-12-7 (Washington, D.C.: Oct. 21, 2011).

3

In May 2014, we recommended that OMB require projects to deliver functionality at least 

every 12 months (instead of every 6 months). This recommendation was based, in part, 

on OMB staff reporting to us that they did not expect that many investments would meet 

the 6-month requirement, thus raising questions as to whether a 6-month delivery 

requirement was an appropriate government-wide goal. While OMB disagreed with our 

recommendation, we continue to believe that delivering functionality every 6 months is not 

an appropriate requirement for all agencies and that requiring the delivery of functionality 

every 12 months is a more appropriate initial target. For more information, see GAO, 

Information Technology: Agencies Need to Establish and Implement Incremental

Development Policies, GAO-14-361 (Washington, D.C.: May 1, 2014).

4

GAO, Information Technology Reform: Agencies Need to Increase Their Use of 

Incremental Development Practices, GAO-16-469 (Washington, D.C.: Aug. 16, 2016).

Improving the Management of IT Acquisitions 

and Operations

Why Area Is High 

Risk
Improving the Management of IT Acquisitions 

and Operations

Page 181 GAO-17-317 High-Risk Series

Federal IT projects have also failed due to a lack of oversight and 

governance. Executive-level governance and oversight across the 

government has often been ineffective, specifically from chief information 

officers (CIO). However, we have reported that some CIOs’ authority is 

limited in that not all CIOs have the authority to review and approve the 

entire agency IT portfolio.5

Recognizing the severity of issues related to the government-wide 

management of IT, in December 2014, Congress enacted IT acquisition 

reform provisions (commonly referred to as the Federal Information 

Technology Acquisition Reform Act or FITARA) as part of the Carl Levin 

and Howard P. ‘Buck’ McKeon National Defense Authorization Act for 

Fiscal Year 2015.6 Among other things, the law requires action to: (1) 

consolidate federal data centers, (2) enhance transparency and improve 

risk management, (3) enhance agency CIO authority, (4) review IT 

investment portfolios, (5) expand training and use of IT acquisition 

cadres, (6) purchase software government-wide, and (7) maximize the 

benefit of federal strategic sourcing.

OMB and federal agencies’ efforts to improve the management of IT 

acquisitions and operations have resulted in meeting one of the five 

criteria for removal from our High-Risk List—leadership commitment—

and partially meeting the remaining four criteria—capacity, action plan, 

monitoring, and demonstrated progress. Specifically, OMB, in its 

leadership role in addressing this high-risk area, has demonstrated its 

commitment by issuing guidance for agencies implementing FITARA, 

optimizing federal data centers, and acquiring and managing software 

licenses.

However, while OMB and agencies have taken initial steps to improve 

their capacity, establish action plans, increase monitoring, and 

demonstrate progress in addressing our high-risk area by, for example, 

implementing 366 (or about 46 percent) of the 803 open 

recommendations from fiscal years 2010 through 2015 related to IT 

acquisitions and operations, additional actions are needed. Specifically, 

agencies need to improve their capacity to successfully manage IT 

 5

GAO, Federal Chief Information Officers: Opportunities Exist to Improve Role in 

Information Technology Management, GAO-11-634 (Washington, D.C.: Sept. 15, 2011). 

6

Federal Information Technology Acquisition Reform provisions of the Carl Levin and 

Howard P. ‘Buck’ McKeon National Defense Authorization Act for Fiscal Year 2015, Pub. 

L. No. 113-291, div. A, title VIII, subtitle D, 128 Stat. 3292, 3438-3450 (Dec. 19, 2014).

What GAO Found
Improving the Management of IT Acquisitions 

and Operations

Page 182 GAO-17-317 High-Risk Series

investments by fully implementing the CIO authorities described in 

FITARA and ensuring that program staff have the necessary knowledge 

and skills to acquire IT. Further work is also needed to establish action 

plans to modernize or replace obsolete IT investments. Regarding 

monitoring of IT investments, agencies need to improve how their CIOs 

assess investment risk and how they report incremental development 

status. Finally, additional demonstrated progress is needed by OMB and 

agencies to (1) address our open recommendations related to IT 

acquisitions and operations, (2) deliver functionality every 12 months on 

major acquisitions, and (3) achieve planned IT portfolio and data center 

consolidation savings.

To help address the management of IT investments, OMB and federal 

agencies should continue to expeditiously implement the requirements of 

FITARA. While OMB’s June 2015 FITARA implementation guidance7

provides a solid foundation for implementing the law and addresses the 

actions agencies are to take in regard to several initiatives that we have 

identified as high risk, OMB will need to provide consistent oversight to 

ensure that agency actions are completed and the desired results are 

achieved. Doing so should continue to improve the transparency and 

management of IT acquisitions and operations, as well as increase the 

authority of CIOs to provide needed direction and oversight.

Beyond implementing FITARA and OMB’s guidance to improve the 

capacity to address our high-risk area, selected agencies will also need to 

implement our recent recommendations related to improving their IT 

workforce planning practices.8 When fully implemented, these key 

practices should better position agencies to efficiently make decisions 

that cross lines of expertise and improve their ability to assess and 

address gaps in knowledge and skills that are critical to the success of 

major IT acquisitions.

 7

OMB, Management and Oversight of Federal Information Technology, Memorandum M15-14 (Washington, D.C.: June 10, 2015). 

8

GAO, IT Workforce: Key Practices Help Ensure Strong Integrated Program Teams; 

Selected Departments Need to Assess Skill Gaps, GAO-17-8 (Washington, D.C.: Nov. 30, 

2016).

What Remains to Be 

Done
Improving the Management of IT Acquisitions 

and Operations

Page 183 GAO-17-317 High-Risk Series

Further, agencies will need to establish action plans to modernize or 

replace obsolete IT investments.9 By establishing such plans, agencies 

can reduce the risk of continuing to maintain investments that have 

outlived their effectiveness and are consuming resources that outweigh 

their benefits.

To improve how they monitor the acquisition and operations of IT 

investments, federal agencies will need to implement our 

recommendations to address weaknesses in their reporting of investment 

risk and incremental development implementation on the IT Dashboard.10

Doing so will provide OMB and agencies with increased transparency and 

oversight of the government’s billions of dollars in IT investments.

Finally, initial progress has been made in addressing this high-risk area, 

including implementation of 46 percent of our prior recommendations. 

However, the remaining recommendations include 17 priority 

recommendations to agencies to, among other things, report all data 

center consolidation cost savings to OMB, address weaknesses in their 

management of software licenses, and improve their implementation of 

PortfolioStat.11 OMB and agencies need to take additional actions to (1) 

implement at least 80 percent of our recommendations related to the 

management of IT acquisitions and operations, (2) ensure that a 

minimum of 80 percent of the government’s major acquisitions deliver 

functionality every 12 months, and (3) achieve at least 80 percent of the 

over $6 billion in planned PortfolioStat savings and 80 percent of the 

more than $5 billion in savings planned for data center consolidation. It 

will be important for OMB and agencies to continue to make 

demonstrated progress against these metrics in order to more effectively 

and efficiently invest in IT, reduce the risk of major acquisitions, and 

achieve additional cost savings.

 9

GAO, Information Technology: Federal Agencies Need to Address Aging Legacy 

Systems, GAO-16-468 (Washington, D.C.: May 25, 2016). 

10GAO-16-469 and GAO, IT Dashboard: Agencies Need to Fully Consider Risks When 

Rating Their Major Investments, GAO-16-494 (Washington, D.C.: June 2, 2016). 

11Launched by OMB in 2012, PortfolioStat requires agencies to conduct an annual, 

agency-wide IT portfolio review to, among other things, reduce commodity IT spending 

and demonstrate how their IT investments align with the agency’s mission and business 

functions.
Improving the Management of IT Acquisitions 

and Operations

Page 184 GAO-17-317 High-Risk Series

OMB and the Federal CIO have demonstrated leadership commitment. 

Specifically, OMB’s June 2015 guidance for implementing FITARA 

addresses actions for agencies to take in several IT management areas 

we have identified as high risk, such as reviewing of poorly performing 

investments, reporting on investment risk, consolidating data centers, 

managing agencies’ IT portfolios, and purchasing government-wide 

software licenses. For example, OMB’s guidance reiterates the 

requirement for agencies to hold TechStat sessions—face-to-face 

meetings between OMB and agency leadership to terminate or turn 

around IT investments that are failing or are not producing results—and 

also requires agencies to report quarterly on the root causes of 

performance issues, to develop corrective action plans, and to establish a 

timeline for implementing the corrective actions.

OMB also released more specific guidance on acquiring and managing 

software licenses and operating federal data centers—two areas that we 

identified in our 2015 high-risk report as needing attention. Specifically, in 

June 2016, OMB issued guidance that requires agencies to maintain and 

analyze an agency-wide inventory of software licenses to ensure 

compliance with software licensing agreements, consolidate redundant 

applications, and identify other cost savings opportunities.12 Regarding 

federal data centers, in August 2016, OMB issued a memorandum that 

established the Data Center Optimization Initiative, noting that this new 

initiative would supersede the Federal Data Center Consolidation 

Initiative started in 2010.13 Among other things, OMB’s guidance requires 

agencies to develop and report on data center strategies to consolidate 

inefficient infrastructure, optimize existing facilities, improve security 

posture, save money, and transition to more efficient infrastructure. 

OMB’s memorandum also establishes metrics for data center optimization 

and targets to be achieved by the end of fiscal year 2018.

 12OMB, Category Management Policy 16-1: Improving the Acquisition and Management of 

Common Information Technology: Software Licensing, Memorandum M-16-12 

(Washington, D.C.: June 2, 2016). 

13OMB, Data Center Optimization Initiative (DCOI), Memorandum M-16-19 (Washington, 

D.C.: Aug. 1, 2016).

Additional Details on 

What GAO Found

Leadership Commitment
Improving the Management of IT Acquisitions 

and Operations

Page 185 GAO-17-317 High-Risk Series

In addition, the Federal CIO and OMB senior staff members have 

routinely met with us over the last 2 years to discuss their plans and 

progress in addressing this high-risk area. According to these officials, 

and as indicated through its actions, OMB is committed to demonstrating 

sustained progress in addressing this high-risk area. Going forward, it will 

be important for OMB to maintain its current level of top leadership 

support and commitment to ensure that agencies continue to successfully 

execute OMB’s guidance on implementing FITARA and related IT 

initiatives.

OMB and federal agencies partially met the criterion for having the 

capacity to improve the management of IT acquisitions and operations. 

Specifically, OMB’s June 2015 guidance addresses how agencies are to 

implement FITARA’s provisions related to enhancing the authority of 

federal CIOs. Among other things, OMB provided direction on

• enabling the CIOs’ role to integrate IT with the capabilities they 

support wherever IT may affect functions, missions, or operations;

• strengthening agency CIOs’ accountability for IT cost, schedule, 

performance, and security; and

• strengthening the relationship between agency CIOs and bureau 

CIOs.

Further, OMB’s guidance includes several actions that agencies are to 

take to establish a basic set of roles and responsibilities (referred to as 

the “common baseline”) for CIOs and other senior agency officials that 

are needed to implement the authorities described in the law. For 

example, agencies are to conduct a self-assessment to identify where 

they conform to the common baseline and where they deviate. OMB 

guidance also requires agencies to annually update their self-assessment 

and report their progress reaching FITARA implementation milestones. 

Agencies’ first updates were due by April 30, 2016, and additional 

updates are due on an annual basis thereafter. As of December 2016, 19 

of 24 major federal agencies had made their FITARA milestone status 

information publicly available, as required by OMB; however, all 19 

agencies had milestones that were still in progress or not yet started.

In addition, another area where agencies can improve their capacity to 

acquire IT investments is in assessing IT workforce skills gaps. 

Capacity
Improving the Management of IT Acquisitions 

and Operations

Page 186 GAO-17-317 High-Risk Series

Specifically, in November 2016, we reported that five selected agencies14

had not consistently applied key workforce planning steps and activities 

that help to ensure that program staff members have the knowledge and 

skills critical to successfully acquire IT investments.15 For example, four 

agencies had not demonstrated an established IT workforce planning 

process. The weaknesses identified were due, in part, to agencies lacking 

comprehensive policies that required such activities, or failing to apply the 

policies to IT workforce planning. We concluded that, until these 

weaknesses are addressed, the agencies risk not adequately assessing 

and addressing gaps in knowledge and skills that are critical to the 

success of major acquisitions. Accordingly, we recommended that the five 

selected agencies address the IT workforce planning practices that we 

identified as having weaknesses.

OMB and federal agencies have partially met the criterion for establishing 

an action plan to address this high-risk area. In addition to requiring 

agencies to conduct self-assessments, OMB’s June 2015 FITARA 

implementation guidance required agencies to submit a plan describing 

the changes they will make to ensure that common baseline 

responsibilities are implemented. These plans are to address the areas of 

IT management that we have identified as high risk, such as reviewing 

poorly performing investments, managing agencies’ IT portfolios, and 

implementing incremental development. For example, according to 

OMB’s June 2015 guidance, agencies’ plans are required to define IT 

processes and policies which ensure that the CIO certifies that IT 

investments are adequately implementing incremental development.

Agencies were to submit their plans to OMB’s Office of E-Government 

and Information Technology by August 15, 2015, and make portions of 

the plans publicly available on agency websites no later than 30 days 

after OMB approval. Approximately 9 months later, in May 2016, we 

testified that 2 of the 24 major agencies did not have approved FITARA 

implementation plans that were publicly available. 16 While these two 

agencies subsequently published their plans, agencies need to more 

 14These five agencies are the Departments of Commerce, Defense, Health and Human 

Services, Transportation, and the Treasury. 

15GAO-17-8. 

16GAO, Information Technology: OMB and Agencies Need to Focus Continued Attention

on Implementing Reform Law, GAO-16-672T (Washington, D.C.: May 18, 2016).

Action Plan
Improving the Management of IT Acquisitions 

and Operations

Page 187 GAO-17-317 High-Risk Series

consistently meet OMB’s FITARA implementation deadlines going 

forward. Further, effectively implementing these plans will be critical to 

ensuring that agencies are able to effectively manage their IT investments 

and that CIOs have the authorities required under FITARA. We have 

ongoing work reviewing agency self-assessments and FITARA 

implementation plans, including the extent to which agencies have 

defined the role of the CIO in accordance with federal law and guidance.

Significant work also remains for federal agencies to establish action 

plans to modernize or replace obsolete IT investments. Specifically, in 

May 2016, we reported that many agencies were using systems which 

had components that were, in some cases, at least 50 years old. 17 For 

example, we determined that the Department of Defense (DOD) was 

using 8-inch floppy disks in a legacy system that coordinates the 

operational functions of the nation’s nuclear forces. In addition, the 

Department of the Treasury was using assembly language code—a 

computer language initially used in the 1950s and typically tied to the 

hardware for which it was developed. Table 5 provides examples of 

legacy systems across the federal government that agencies report are 

30 years old or older and use obsolete software or hardware, and 

identifies those that do not have specific plans with time frames to 

modernize or replace these investments.

Table 5: Examples of Legacy Investments and Systems

Agency Investment 

or system

Description Agencyreported 

age

Specific, defined plans for 

modernization or 

replacement

Department of 

the Treasury

Individual 

Master File

The authoritative data source for individual 

taxpayers where accounts are updated, taxes are 

assessed, and refunds are generated. This 

investment is written in assembly language code—

a low-level computer code that is difficult to write 

and maintain—and operates on an IBM 

mainframe.

~56 No - The agency has general 

plans to replace this 

investment, but there is no firm 

date associated with the 

transition.

Department of 

the Treasury

Business 

Master File

Retains all tax data pertaining to individual 

business income taxpayers and reflects a 

continuously updated and current record of each 

taxpayer’s account. This investment is also written 

in assembly language code and operates on an 

IBM mainframe.

~56 No - The agency has general 

plans to update this system, but 

there is no time frame 

established for this transition.

 17GAO-16-468. 
Improving the Management of IT Acquisitions 

and Operations

Page 188 GAO-17-317 High-Risk Series

Agency Investment 

or system

Description Agencyreported 

age

Specific, defined plans for 

modernization or 

replacement

Department of 

Defense

Strategic 

Automated 

Command 

and Control 

System

Coordinates the operational functions of the 

United States’ nuclear forces, such as 

intercontinental ballistic missiles, nuclear bombers, 

and tanker support aircraft. This system runs on 

an IBM Series/1 Computer—a 1970s computing 

system—and uses 8-inch floppy disks.

53 Yes - The agency plans to 

update its data storage 

solutions, port expansion 

processors, portable terminals, 

and desktop terminals by the 

end of fiscal year 2017.

Department of 

Veterans Affairs

Personnel 

and 

Accounting 

Integrated 

Data

Automates time and attendance for employees, 

timekeepers, payroll, and supervisors. It is written 

in Common Business Oriented Language 

(COBOL)—a programming language developed in 

the 1950s and 1960s—and runs on an IBM 

mainframe.

53 Yes - The agency plans to 

replace it with a project called 

Human Resources Information 

System Shared Service Center 

in 2017.

Department of 

Veterans Affairs

Benefits 

Delivery 

Network

Tracks claims filed by veterans for benefits, 

eligibility, and dates of death. This system is a 

suite of COBOL mainframe applications.

51 No - The agency has general 

plans to roll capabilities into 

another system, but there is no 

firm time frame associated with 

this transition.

Department of 

Justice

Sentry Provides information regarding security and 

custody levels, inmate program and work 

assignments, and other pertinent information 

about the inmate population. The system uses 

COBOL and Java programming languages.

35 Yes - The agency planned to 

update the system through 

September 2016. 

Social Security 

Administration

Title II 

Systems

Determines retirement benefits eligibility and 

amounts. The investment is comprised of 162 

subsystems written in COBOL.

31 Yes - The agency has ongoing 

modernization efforts, including 

one that is experiencing cost 

and schedule challenges due to 

the complexities of the legacy 

software. 

Source: GAO analysis of IT Dashboard data, agency documentation, and interviews.

Note: Age was reported by agencies. Systems and investments may have individual components 

newer than the reported age.

To address this issue, we recommended that 12 agencies identify and 

plan to modernize or replace legacy systems, including establishing time 

frames, activities to be performed, and functions to be replaced or 

enhanced. 18 Most agencies agreed with our recommendations or had no 

comment.

 18These 12 agencies are the Departments of Agriculture, Commerce, Defense, Energy, 

Health and Human Services, Homeland Security, Justice, State, the Treasury, 

Transportation, and Veterans Affairs, and the Social Security Administration.
Improving the Management of IT Acquisitions 

and Operations

Page 189 GAO-17-317 High-Risk Series

OMB and federal agencies have partially met the criterion for monitoring 

efforts to address this high-risk area. Specifically, OMB took action to 

improve its use of TechStat sessions, which are intended to increase 

accountability and transparency and to improve investment performance. 

We previously reported that the number of TechStats that OMB and 

selected agencies had performed represented only a small percentage 

(33 percent) of the number of IT investments with a medium- or high-risk 

CIO rating. 19 OMB’s June 2015 FITARA implementation guidance 

strengthened the TechStat process by requiring agencies to hold a 

TechStat session on any investment that has a high-risk CIO rating for 3 

consecutive months, beginning on July 1, 2015. As a result, OMB and 

agencies will be able to more quickly intervene to turn around, halt, or 

terminate troubled IT projects.

OMB has also taken action to improve monitoring through its IT 

Dashboard—a public website that provides detailed information on major 

IT investments at 26 federal agencies, including ratings from CIOs that 

should reflect the level of risk facing each investment. Over the last 

several years, we have issued a series of reports that noted significant 

steps OMB has taken to enhance the oversight, transparency, and 

accountability of federal IT investments through the IT Dashboard.20 For 

example, OMB analyzed and reported on agencies’ Dashboard CIO 

ratings over time. Further, in an August 2016 memorandum,21 OMB 

expanded the data center consolidation and optimization progress 

information being reported on the IT Dashboard to include, among other 

things

• information on planned and achieved data center closures by agency,

 19GAO, Information Technology: Additional Executive Review Sessions Needed to 

Address Troubled Projects, GAO-13-524 (Washington, D.C.: June 13, 2013). 

20GAO, IT Dashboard: Agencies Are Managing Investment Risk, but Related Ratings 

Need to Be More Accurate and Available, GAO-14-64 (Washington, D.C.: Dec. 12, 2013); 

Information Technology Dashboard: Opportunities Exist to Improve Transparency and 

Oversight of Investment Risk at Select Agencies, GAO-13-98 (Washington, D.C.: Oct. 16, 

2012); IT Dashboard: Accuracy Has Improved, and Additional Efforts Are Under Way to 

Better Inform Decision Making, GAO-12-210 (Washington, D.C.: Nov. 7, 2011); 

Information Technology: OMB Has Made Improvements to Its Dashboard, but Further 

Work Is Needed by Agencies and OMB to Ensure Data Accuracy, GAO-11-262 

(Washington, D.C.: Mar. 15, 2011); and Information Technology: OMB’s Dashboard Has 

Increased Transparency and Oversight, but Improvements Needed, GAO-10-701 

(Washington, D.C.: July 16, 2010). 

21OMB, Memorandum M-16-19.

Monitoring
Improving the Management of IT Acquisitions 

and Operations

Page 190 GAO-17-317 High-Risk Series

• government-wide and agency-specific progress towards meeting 

applicable optimization targets, and

• cumulative cost savings and cost avoidance realized.

OMB’s efforts to expand the IT Dashboard should continue to increase 

transparency into government-wide and agency-specific progress on this 

important IT initiative.

However, significant work still remains for federal agencies to improve 

their monitoring of IT investments through their CIO risk assessments on 

the IT Dashboard. Specifically, in June 2016, we reported that our 

assessments of the risk ratings showed more risk than did the associated 

CIO ratings. 22 In particular, of the 95 investments reviewed, our 

assessments matched the CIO ratings 22 times, showed more risk 60 

times, and showed less risk 13 times. Figure 10 summarizes how our 

assessments compared to the select investments’ CIO ratings.

Figure 10: Comparison of Selected Investments’ April 2015 CIO Ratings to GAO’s Assessments

We reported that several issues contributed to these differences, such as 

ratings not being updated frequently and rating processes that did not 

focus on active risks. As a result, we concluded that the associated risk 

rating processes used by the agencies generally understated the level of 

an investment’s risk, raising the likelihood that critical federal investments 

 22GAO-16-494.
Improving the Management of IT Acquisitions 

and Operations

Page 191 GAO-17-317 High-Risk Series

in IT are not receiving the appropriate levels of oversight. Accordingly, we 

made 25 recommendations to 15 agencies to improve the quality and 

frequency of their CIO ratings. Most agencies agreed with our 

recommendations or had no comment.

Another area of concern regarding the monitoring of IT acquisitions is 

agencies’ reported use of incremental development. In August 2016, we 

reported on 7 selected agencies’ software development projects and 

determined that the percentage delivering functionality every 6 months 

was reported at 45 percent for fiscal year 2015 and planned for 54 

percent in fiscal year 2016. 23 However, significant differences existed 

between the delivery rates that the agencies reported to us and what they 

reported on the IT Dashboard. For example, the percentage of software 

projects delivering every 6 months that was reported to us by the 

Department of Commerce was about a 42 percentage point decrease 

from what was reported on the IT Dashboard. In contrast, DOD reported 

to us a 55 percentage point increase from what was reported on the IT 

Dashboard. Figure 11 compares what the 7 agencies reported on the IT 

Dashboard and what numbers they reported to us.

 23GAO-16-469. These seven agencies are the Departments of Commerce, Defense, 

Education, Health and Human Services, Homeland Security, Transportation, and the 

Treasury.
Improving the Management of IT Acquisitions 

and Operations

Page 192 GAO-17-317 High-Risk Series

Figure 11: Comparison of Software Development Projects’ Percentage of Planned Delivery Every 6 Months Reported on the IT 

Dashboard and to GAO for Fiscal Year 2016

a

The Department of Defense did not provide requested information in time to verify the information 

reported for a sample of projects.

We reported that the significant differences in delivery rates were due, in 

part, to agencies having different interpretations of OMB’s guidance on 

reporting software development projects and because the information 

reported to us was generally more current than the information reported 

on the IT Dashboard. We concluded that, until the inconsistences in the 

information reported to us versus the information provided on the IT 

Dashboard are addressed, the seven agencies we reviewed are at risk 

that OMB and key stakeholders may make decisions regarding agency 

investments without the most current and accurate information. 

Accordingly, we made 12 recommendations to 8 agencies to improve 

their reporting of incremental data on the IT Dashboard, among other 

things. Most agencies agreed with our recommendations or did not 

comment.
Improving the Management of IT Acquisitions 

and Operations

Page 193 GAO-17-317 High-Risk Series

OMB and federal agencies partially met the criterion for demonstrating 

progress in improving the management of IT acquisitions and operations. 

In our 2015 high-risk report, we noted that OMB and agencies would 

need to demonstrate government-wide progress in the following key 

areas:

• OMB and agencies should, within 4 years, implement at least 80 

percent of our recommendations related to managing IT acquisitions 

and operations.

• Agencies should ensure that a minimum of 80 percent of the 

government’s major acquisitions deliver functionality every 12 months.

• Agencies should achieve no less than 80 percent of the over $6 billion 

in planned IT portfolio savings and 80 percent of the more than $5 

billion in savings planned for data center consolidation.

Between fiscal years 2010 and 2015, we made 803 recommendations to 

OMB and federal agencies to address shortcomings in IT acquisitions and 

operations, including many to improve the implementation of the recent 

initiatives and other government-wide, cross-cutting efforts. As of 

December 2016, about 46 percent of these recommendations had been 

fully implemented. This is an additional 23 percent compared to the 

percentage we reported in our 2015 high-risk report. For example, in 

August 2016, the National Aeronautics and Space Administration (NASA) 

addressed our priority recommendation to report its data center 

consolidation cost savings and avoidances—totaling approximately $42 

million between fiscal years 2012 through 2016—to OMB. In fiscal year 

2016, we made 202 new recommendations, thus further reinforcing the 

need for OMB and agencies to address the shortcomings in IT 

acquisitions and operations. Table 6 summarizes OMB’s and agencies’

implementation of our recommendations. Following the table, figure 12

summarizes OMB’s and agencies’ implementation of our 

recommendations against the 80 percent target.

Table 6: Status of GAO Recommendations to OMB and Agencies to Address 

Shortcomings in IT Acquisitions and Operations (Fiscal Years 2010 through 2015), 

as of December 2016

Fiscal year Open Closed –

implemented

Closed – not 

implementeda Total

2010 4 66 6 76

2011 8 122 16 146

2012 22 94 27 143

Demonstrated Progress
Improving the Management of IT Acquisitions 

and Operations

Page 194 GAO-17-317 High-Risk Series

Fiscal year Open Closed –

implemented

Closed – not 

implementeda Total

2013 34 18 2 54

2014 243 50 1 294

2015 74 16 0 90

Total 385 (48%) 366 (46%) 52 (6%) 803

Source: GAO. | GAO-17-317

Note: We made 202 new recommendations in fiscal year 2016 to address shortcomings in IT 

acquisitions and operations; however, in order to give OMB and agencies time to address these 

recommendations, we did not include them in our status assessment.

a

We close recommendations without agencies having implemented them if (1) the recommendation is 

no longer valid because circumstances have changed, or (2) significant time has passed and 

implementation cannot reasonably be expected.

Figure 12: Summary of OMB’s and Agencies’ Progress in Addressing GAO’s 

Recommendations related to the Management of IT Acquisition and Operations, as 

of December 2016

However, additional OMB and agency progress is needed in several 

areas critical to their ability to effectively and efficiently invest in IT, such 

as the following:

• Consolidating federal data centers. In a series of reports, we 

pointed out that, while consolidating data centers could potentially 

save the federal government billions of dollars, weaknesses existed in 
Improving the Management of IT Acquisitions 

and Operations

Page 195 GAO-17-317 High-Risk Series

the execution and oversight of the initiative.24 In particular, planned 

savings may be understated because of difficulties agencies 

encountered when calculating savings and communicating their 

estimates to OMB. As a result, it was important for OMB to continue to 

provide leadership and guidance on this initiative. In total, we made 

168 recommendations to OMB and agencies to improve the federal 

data center consolidation effort. As of December 2016, 123 of our 

recommendations had been implemented.

• Developing comprehensive inventories of federal agencies’ 

software licenses. In May 2014, we reported on federal agencies’

management of software licenses and determined that better 

management was needed to achieve significant savings governmentwide. 25 In particular, 22 of the 24 major agencies did not have 

comprehensive license policies and only 2 had comprehensive license 

inventories. As a result, agencies’ oversight of software license 

spending was limited or lacking, thus, potentially leading to missed 

savings. The potential savings could be significant considering that, in 

fiscal year 2012, 1 major federal agency reported saving 

approximately $181 million by consolidating its enterprise license 

agreements, even though its oversight process was ad hoc. We 

recommended that OMB issue needed guidance to agencies and 

made 135 recommendations to the agencies to improve their policies 

and practices for managing licenses. As of December 2016, 13 of our 

recommendations had been implemented.

• Managing agencies’ IT portfolios. To better manage existing IT 

systems, OMB launched the PortfolioStat initiative, which requires 

agencies to conduct an annual, agency-wide IT portfolio review to, 

among other things, reduce commodity IT spending and demonstrate 

how their IT investments align with the agency’s mission and business 

 24GAO, Data Center Consolidation: Agencies Making Progress, but Planned Savings 

Goals Need to Be Established [Reissued on March 4, 2016], GAO-16-323 (Washington, 

D.C.: Mar. 3, 2016); Data Center Consolidation: Reporting Can Be Improved to Reflect 

Substantial Planned Savings, GAO-14-713 (Washington, D.C.: Sept. 25, 2014); Data 

Center Consolidation: Strengthened Oversight Needed to Achieve Cost Savings Goal, 

GAO-13-378 (Washington, D.C.: Apr. 23, 2013); Data Center Consolidation: Agencies 

Making Progress on Efforts, but Inventories and Plans Need to Be Completed, 

GAO-12-742 (Washington, D.C.: July 19, 2012); and Data Center Consolidation: Agencies 

Need to Complete Inventories and Plans to Achieve Expected Savings, GAO-11565 

(Washington, D.C.: July 19, 2011). 

25GAO, Federal Software Licenses: Better Management Needed to Achieve Significant 

Savings Government-Wide, GAO-14-413 (Washington, D.C.: May 22, 2014).
Improving the Management of IT Acquisitions 

and Operations

Page 196 GAO-17-317 High-Risk Series

functions.26 In November 2013, we reported that agencies continued 

to identify duplicative spending as part of PortfolioStat; however, 

weaknesses existed in agencies’ implementation of the initiative, such 

as limitations in the CIOs’ authority.27 In April 2015, we reported that, 

although agencies had achieved approximately $1.1 billion in 

PortfolioStat savings, inconsistencies in OMB’s and agencies’

reporting made it difficult to reliably measure progress in achieving 

savings.28 In total, our 2 reports made 69 recommendations to 

improve OMB and agencies’ implementation of PortfolioStat; and as 

of December 2016, 7 of our recommendations had been 

implemented.

In addition, while agencies have made progress on efforts to ensure that 

the government’s major acquisitions deliver functionality every 12 months, 

additional work is needed. Specifically, in August 2016, we determined29

that 7 selected agencies30 reported delivering functionality at least every 

12 months on 77 percent of their projects for fiscal year 2015. However, 

as previously stated, there were also inconsistencies with the selected 

agencies’ reporting of their incremental development status and we made 

recommendations to the agencies to address these issues. It will be 

critical for agencies to continue to improve their use of incremental 

development in order to reduce the risk that their projects will not meet 

cost, schedule, and performance goals and improve their reporting to 

better ensure that project decision making is based on current and 

accurate information.

Finally, agencies have also made progress in achieving planned savings 

across two OMB initiatives intended to improve the management of 

 26According to OMB, commodity IT includes services such as IT infrastructure (data 

centers, networks, desktop computers, and mobile devices); enterprise IT systems (email, collaboration tools, identity and access management, security, and web 

infrastructure); and business systems (finance, human resources, and other administrative 

functions). 

27GAO, Information Technology: Additional OMB and Agency Actions Are Needed to 

Achieve Portfolio Savings, GAO-14-65 (Washington, D.C.: Nov. 6, 2013).

28GAO, Information Technology: Additional OMB and Agency Actions Are Needed to 

Ensure Portfolio Savings Are Realized and Effectively Tracked, GAO-15-296 

(Washington, D.C.: Apr. 16, 2015). 

29GAO-16-469.

30These seven agencies are the Departments of Commerce, Defense, Education, Health 

and Human Services, Homeland Security, Transportation, and the Treasury.
Improving the Management of IT Acquisitions 

and Operations

Page 197 GAO-17-317 High-Risk Series

operational IT investments. Regarding the $6 billion in planned 

PortfolioStat savings identified in our 2015 high-risk report, agencies 

reported achieving approximately $1.4 billion in savings from fiscal years 

2012 through 2015, or approximately 24 percent of planned PortfolioStat 

savings. Further, in March 2016, we reported31 that agencies had 

achieved an estimated $2.8 billion in cost savings and avoidances related 

to their data center consolidation efforts from fiscal years 2011 to 2015. 

This is approximately 51 percent of the $5.3 billion planned savings 

identified in our 2015 high-risk report.

In July 2016, Congress enacted the MEGABYTE Act of 2016, which 

contained provisions to improve the management of software licenses.32

The act requires OMB to direct agency CIOs to, among other things, 

establish a comprehensive inventory of software license agreements and 

analyze software usage and other data to make cost-effective decisions.

Other examples of benefits achieved by implementing our 

recommendations include the following:

• $2.95 billion in total financial savings achieved from multiple agencies’

data center consolidation efforts (claimed in fiscal years 2014 through 

2016).

• $1.41 billion in total financial savings achieved from multiple agencies’

efforts to reduce duplicative and wasteful IT investments as part of 

OMB’s PortfolioStat initiative (claimed in fiscal years 2014 through 

2016).

• $520.46 million in financial savings achieved from the Census Bureau 

implementing IT investment management process that reduced 

investment in duplicative systems (claimed in fiscal year 2015).

• $24.27 million in total financial savings achieved from NASA’s and 

General Services Administration’s efforts to reduce their software 

license costs (claimed in fiscal years 2015 and 2016).

• OMB and agencies have taken steps to enhance the oversight, 

transparency, and accountability of federal IT investments through the 

IT Dashboard by, for example, improving the quality of investment 

 31GAO-16-323.

32Pub. L. No. 114-210, 130 Stat. 824 (2016).

Benefits Achieved by 

Implementing Our 

Recommendations
Improving the Management of IT Acquisitions 

and Operations

Page 198 GAO-17-317 High-Risk Series

performance data and analyzing and reporting on trends of agencies’

Dashboard CIO ratings over time. By analyzing trends, OMB is better 

positioned to ensure that investment risk is assessed accurately and 

that patterns warranting special management attention are observed, 

identified, and addressed. Further, improved agency performance 

data helps to ensure that OMB, other oversight bodies, and the 

general public are better positioned to hold the government agencies 

accountable for results and progress.

• Federal agencies have improved their data center consolidation 

efforts by increasing the quality of their data center inventories and 

considering consolidation challenges and lessons learned. As a result, 

agencies are better positioned to implement their consolidation 

activities, improve infrastructure utilization, and realize expected cost 

savings.

• Federal agencies have acted to ensure that their operations and 

maintenance investments are properly analyzed by periodically 

examining the investments’ performance against, among other things, 

established cost, schedule, and performance goals. By performing 

these analyses, agencies are better able to measure performance and 

have increased assurance that their investments are helping to meet 

mission goals

For additional information about this high-risk area, contact David A. 

Powner at (202) 512-9286 or pownerd@gao.gov or Carol Harris at (202) 

512-4456 or harrisc@gao.gov.

IT Workforce: Key Practices Help Ensure Strong Integrated Program 

Teams; Selected Departments Need to Assess Skill Gaps. GAO-17-8. 

Washington, D.C.: November 30, 2016.

Information Technology: Agencies Need to Improve Their Application 

Inventories to Achieve Additional Savings. GAO-16-511. Washington, 

D.C.: September 29, 2016.

Information Technology Reform: Agencies Need to Increase Their Use of 

Incremental Development Practices. GAO-16-469. Washington, D.C.: 

August 16, 2016.

Digital Service Programs: Assessing Results and Coordinating with Chief 

Information Officers Can Improve Delivery of Federal Projects. 

GAO-16-602. Washington, D.C.: August 15, 2016.

GAO Contact

Related GAO 

Products
Improving the Management of IT Acquisitions 

and Operations

Page 199 GAO-17-317 High-Risk Series

Information Technology: Better Management of Interdependencies

between Programs Supporting 2020 Census Is Needed. GAO-16-623. 

Washington, D.C.: August 9, 2016.

IT Dashboard: Agencies Need to Fully Consider Risks When Rating Their 

Major Investments. GAO-16-494. Washington, D.C.: June 2, 2016.

Information Technology: Federal Agencies Need to Address Aging 

Legacy Systems, GAO-16-468. Washington, D.C.: May 25, 2016.

DOD Major Automated Information Systems: Improvements Can Be 

Made in Reporting Critical Changes and Clarifying Leadership 

Responsibility. GAO-16-336. Washington, D.C.: March 30, 2016.

Data Center Consolidation: Agencies Making Progress, but Planned 

Savings Goals Need to Be Established [Reissued on March 4, 2016]. 

GAO-16-323. Washington, D.C.: March 3, 2016.

Information Technology Reform: Billions of Dollars in Savings Have Been 

Realized, but Agencies Need to Complete Reinvestment Plans. 

GAO-15-617. Washington, D.C.: September 15, 2015.
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 200 GAO-17-317 High-Risk Series

For nearly a decade, we, along with inspectors general, special 

commissions, and others, have reported that federal agencies have 

ineffectively administered Indian education and health care programs and 

inefficiently fulfilled their responsibilities for managing the development of 

Indian energy resources. In particular, we have found numerous 

challenges facing the Department of the Interior’s (Interior) Bureau of 

Indian Education (BIE) and Bureau of Indian Affairs (BIA)—both under the 

Office of the Assistant Secretary for Indian Affairs (Indian Affairs)—and 

the Department of Health and Human Services’ (HHS) Indian Health 

Service (IHS), in administering education and health care services, which 

put the health and safety of American Indians served by these programs 

at risk. These challenges included poor conditions at BIE school facilities 

that endangered students and inadequate oversight of health care that 

hindered IHS’s ability to ensure quality care to Indian communities. In 

addition, we have reported that BIA mismanages Indian energy resources 

held in trust and thereby limits opportunities for tribes and their members 

to use those resources to create economic benefits and improve the wellbeing of their communities.

Congress recently noted, “through treaties, statutes, and historical 

relations with Indian tribes, the United States has undertaken a unique 

trust responsibility to protect and support Indian tribes and Indians.”1 In 

light of this unique trust responsibility and concerns about the federal 

government ineffectively administering Indian education and health care 

programs and mismanaging Indian energy resources, we are adding 

these programs as a high-risk issue because they uniquely affect tribal 

nations and their members.

 1

Indian Trust Asset Reform Act, Pub. L. No. 114-178, § 101(3) (2016).

Improving Federal Management of Programs 

that Serve Tribes and Their Members

Why Area Is High 

Risk
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 201 GAO-17-317 High-Risk Series

Federal agencies have ineffectively administered and implemented Indian 

education and health care programs and mismanaged Indian energy 

resources in the following broad areas: (1) oversight of federal activities; 

(2) collaboration and communication; (3) federal workforce planning; (4) 

equipment, technology, and infrastructure; and (5) federal agencies’ data.

Although federal agencies have taken some actions to address the 41 

recommendations we made related to Indian programs, there are 

currently 39 that have yet to be fully resolved.

We plan to continue monitoring federal efforts to address the 39 

recommendations that have yet to be fully resolved. To this end, we have 

ongoing work focusing on accountability for safe schools and school 

construction and tribal control of energy delivery, management, and 

resource development.

In the past 3 years, we issued 3 reports on challenges with Indian Affairs’

management of BIE schools in which we made 13 recommendations. 

Eleven recommendations below remain open.

• To help ensure that BIE schools provide safe and healthy facilities for 

students and staff, we made 4 recommendations which remain open, 

including that Indian Affairs ensure the inspection information it 

collects on BIE schools is complete and accurate; develop a plan to 

build schools’ capacity to promptly address safety and health 

deficiencies; and consistently monitor whether BIE schools have 

established required safety committees.

• To help ensure that BIE conducts more effective oversight of school 

spending, we made 4 recommendations which remain open, including 

that Indian Affairs develop a workforce plan to ensure that BIE has the 

staff to effectively oversee school spending; put in place written 

procedures and a risk-based approach to guide BIE in overseeing 

school spending; and improve information sharing to support the 

oversight of BIE school spending.

What GAO Found

What Remains to Be 

Done

Education
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 202 GAO-17-317 High-Risk Series

• To help ensure that Indian Affairs improves how it manages Indian 

education, we made 5 recommendations. Three recommendations 

remain open, including that Indian Affairs develop a strategic plan for 

BIE that includes goals and performance measures for how its offices 

are fulfilling their responsibilities to provide BIE with support; revise 

Indian Affairs’ strategic workforce plan to ensure that BIA regional 

offices have an appropriate number of staff with the right skills to 

support BIE schools in their regions; and develop and implement 

decision-making procedures for BIE to improve accountability for BIE 

schools.

In the past 6 years, we have made 14 recommendations related to Indian 

health care that remain open. Although IHS has taken several actions in 

response to our recommendations, such as improving the data collected 

for the Purchased/Referred Care (PRC) program and adopting Medicarelike rates for non-hospital services, much needs to be done.

• To help ensure that Indian people receive quality health care, the 

Secretary of HHS should direct the Director of IHS to take the 

following two actions: (1) as part of implementing IHS’s quality 

framework, ensure that agency-wide standards for the quality of care 

provided in its federally operated facilities are developed and 

systematically monitor facility performance in meeting these standards 

over time; and (2) develop contingency and succession plans for 

replacing key personnel, including area directors.

• To help ensure that timely primary care is available and accessible to 

Indians, IHS should: (1) develop and communicate specific agencywide standards for wait times in federally-operated facilities, and (2) 

monitor patient wait times in federally-operated facilities and ensure 

that corrective actions are taken when standards are not met.

• To help ensure that IHS has meaningful information on the 

timeliness with which it issues purchase orders authorizing 

payment under the PRC program, and to improve the timeliness of 

payments to providers, we recommend that IHS: (1) modify IHS’s 

claims payment system to separately track IHS referrals and selfreferrals, revise the Government Performance and Results Act 

measures for the PRC program so that it distinguishes between 

these two types of referrals, and establish separate timeframe 

targets for these referral types; and (2) better align PRC staffing 

levels and workloads by revising its current practices, where 

available, used to pay for PRC program staff. In addition, as HHS 

and IHS monitor the effect that new coverage options available to 

Health Care
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 203 GAO-17-317 High-Risk Series

IHS beneficiaries through the Patient Protection and Affordable 

Care Act (PPACA) have on PRC funds, we recommend that IHS 

concurrently develop potential options to streamline requirements 

for program eligibility.

• To help ensure successful outreach efforts regarding PPACA 

coverage expansions, we recommend that IHS realign current 

resources and personnel to increase capacity to deal with enrollment 

in Medicaid and the exchanges and prepare for increased billing to 

these payers.

• If payments for physician and other nonhospital services are capped, 

we recommend that IHS monitor patient access to these services.

• To help ensure a more equitable allocation of funds per capita across 

areas, we recommended that Congress consider requiring IHS to 

develop and use a new method for allocating PRC funds. To make 

IHS’s allocation of PRC program funds more equitable, we 

recommended that IHS develop (1) written policies and procedures to 

require area offices to notify IHS when changes are made to the 

allocation of funds to PRC programs; (2) use actual counts of PRC 

users in any formula allocating PRC funds that relies on the number of 

active users; and (3) use variations in levels of available hospital 

services, rather than just the existence of a qualifying hospital, in any 

formula for allocating PRC funds that contain a hospital access 

component.

• To develop more accurate data for estimating the funds needed for 

the PRC program and improve IHS oversight, we recommended that 

IHS develop a written policy documenting how it evaluates need for 

the PRC program, and disseminate it to area offices so they 

understand how unfunded services data are used to estimate overall 

program needs. We also recommend that IHS develop written 

guidance for PRC programs outlining a process to use when funds 

are depleted but recipients continue to need services.

In the past 2 years, we issued 3 reports on developing Indian energy 

resources in which we made 14 recommendations to BIA. All 

recommendations remain open.

• To help ensure BIA can verify ownership in a timely manner and 

identify resources available for development, we made 2 

recommendations, including that Interior take steps to improve its 

geographic information system mapping capabilities.

Energy
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 204 GAO-17-317 High-Risk Series

• To help ensure BIA’s review process is efficient and transparent, we 

made 2 recommendations, including that Interior take steps to 

develop a documented process to track review and response times for 

energy-related documents that must be approved before tribes can 

develop energy resources.

• To help improve clarity of tribal energy resource agreement 

regulations, we recommended BIA provide additional guidance to 

tribes on provisions that tribes have identified to Interior as unclear.

• To help ensure that BIA’s effort to streamline the review and approval 

process for revenue-sharing agreements achieves its objectives, we 

made 3 recommendations, including that Interior establish time 

frames for the review and approval of Indian revenue-sharing 

agreements for oil and gas, and establish a system for tracking and 

monitoring the review and approval process to determine whether 

time frames are met.

• To help improve efficiencies in the federal regulatory process, we 

made 4 recommendations, including that BIA take steps to coordinate 

with other regulatory agencies so the Indian Energy Service Center 

can serve as a single point of contact or lead agency to navigate the 

regulatory process.

• To help ensure that it has a workforce with the right skills, 

appropriately aligned to meet the agency’s goals and tribal priorities, 

we made 2 recommendations, including that BIA establish a 

documented process for assessing BIA’s workforce composition at 

agency offices.

It is critical that Congress maintain its focus on improving the 

effectiveness with which federal agencies meet their responsibilities to 

serve tribes and their members. Since 2013, we testified at 6 hearings to 

address significant weaknesses we found in the federal management of 

programs that serve tribes and their members. Sustained congressional 

attention to these issues will highlight the challenges discussed here and 

could facilitate federal actions to improve Indian education and health 

care programs and the development of Indian energy resources.

Congressional Actions 

Needed
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 205 GAO-17-317 High-Risk Series

Indian Affairs, through BIE, is responsible for providing quality education 

opportunities to Indian students and oversees 185 elementary and 

secondary schools that serve approximately 41,000 students on or near 

Indian reservations in 23 states, often in rural areas and small towns. 

About two-thirds of these schools are operated by tribes, primarily 

through federal grants, and about one-third are operated directly by BIE. 

BIE’s Indian education programs originate from the federal government’s 

trust responsibility to Indian tribes, a responsibility established in federal 

statutes, treaties, court decisions, and executive actions. It is the policy of 

the United States to fulfill this trust responsibility for educating Indian 

children by working with tribes to ensure that education programs are of 

the highest quality and that children are provided a safe and healthy 

environment in which to learn.

Students attending BIE schools generally must be members of federally 

recognized Indian tribes, or descendants of members of such tribes, and 

reside on or near federal Indian reservations. All BIE schools—both 

tribally- and BIE-operated—receive almost all of their operational funding 

from federal sources, namely, Interior and the Department of Education, 

totaling about $1.2 billion in 2016. Indian Affairs considers many BIE 

schools to be in poor condition.

BIE is primarily responsible for its schools’ educational functions, while 

their administrative functions—such as safety, facilities, and property 

management—are divided mainly between two other Indian Affairs’

offices, BIA and the Office of the Deputy Assistant Secretary of 

Management. However, frequent turnover of leadership in these offices 

has hampered efforts to improve Indian education over the years. For 

example, in September 2013, we reported that from 2000 through 2013 

there were repeated changes in the tenure of acting and permanent 

assistant secretaries of Indian Affairs as well as acting and permanent 

directors of BIE. Since that time, leadership turnover has continued in 

these offices. For example, in March 2016, the previous BIE director was 

removed for violating federal hiring practices.

Inadequate oversight of federal activities. We have identified 

weaknesses in how Indian Affairs oversees school safety and 

construction and in how it monitors the way schools use Interior funds. In 

a March 2016 report, we found that Indian Affairs had not taken actions to 

Additional Details on 

What GAO Found

Indian Education
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 206 GAO-17-317 High-Risk Series

ensure that its regional offices annually inspect the safety and health of all 

BIE school campuses, as required, or that the information it collects 

through inspections is complete and accurate, and we recommended that 

it take such actions. Specifically, we found that Indian Affairs did not 

conduct annual inspections at about 1 in 3 BIE schools from fiscal years 

2012 through 2015. Further, 4 out of 10 regions did not conduct any 

inspections during this period. We also found that Indian Affairs did not 

systematically evaluate the thoroughness of the school safety inspections 

it conducted or monitor the extent to which inspection procedures varied 

within and across regions. Without Indian Affairs monitoring whether 

safety inspectors in each of its regions are consistently following 

appropriate procedures and guidance, inspections in different regions 

may continue to vary in completeness and miss important safety and 

health deficiencies at schools that could pose dangers to students and 

staff. In September 2016, Indian Affairs provided documentation that it 

had conducted fiscal year 2016 annual safety inspections at all BIE 

schools, but it did not include evidence that it had taken steps to ensure 

that its inspection information was complete and accurate. As of January 

2017, we had not received further updates from Indian Affairs. We will 

continue to monitor its efforts in this area.

In a February 2015 testimony, we reported that Indian Affairs did not 

consistently oversee some BIE school construction projects. For example, 

we found that at 1 BIE school Indian Affairs managed a $3.5 million 

project to replace roofs, but the new roofs had leaked continually since 

they were installed, causing mold and ceiling damage in classrooms, 

according to agency documents. At another school, Indian Affairs funded 

construction of a $1.5 million building for school bus maintenance and 

bus storage, but the size of the building did not allow a large school bus 

to fit on the lift when the exterior door was closed.

In a November 2014 report, we identified serious weaknesses in Indian 

Affairs’ oversight of school expenditures. For example, we reported that 

BIE does not have written oversight procedures and risk criteria for 

ensuring schools use Interior funds for their intended purpose of providing 

BIE students a quality education. As a result of Indian Affairs’ lack of 

oversight, we identified several instances of funds being misused, 

including $1.7 million for 1 school that were improperly transferred to an 

off-shore account.2 In September 2016, Indian Affairs provided 

 2

BIE reported that its personnel had already investigated the incident when we alerted 

them.
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 207 GAO-17-317 High-Risk Series

documentation demonstrating it has developed a system for overseeing 

Department of Education formula grants provided to BIE schools to 

provide services for children with special needs and to expand and 

improve educational programs for students from low-income families. 

However, Indian Affairs was unable to provide documentation showing 

that it has developed written procedures to oversee funds BIE schools 

receive from their largest funding source— Interior’s Indian School 

Equalization Program. Further, as of late September 2016, BIE still had 

not hired additional staff to oversee school spending, among other duties.

Indian Affairs also reported that it developed a risk-based approach to 

oversee BIE school expenditures, but we found it has not taken steps to 

fully implement this approach. Specifically, Interior reported that its riskbased approach was to post schools’ single audits on a website to enable 

officials responsible for fiscal monitoring to be able to target those at 

greatest risk of misusing federal funds.3 However, in reviewing the site, 

we found that audits for fewer than half of the schools had been posted 

on the site during each of the past 2 fiscal years. Access to all or at least 

the vast majority of these audits is critical for Indian Affairs to be able to 

conduct risk-based fiscal monitoring activities.

Limited federal workforce planning. We have found limited workforce 

planning in several key areas related to BIE schools. In a February 2015 

testimony, we noted that the capacity of Indian Affairs and BIE school 

staff to address school facility needs is limited due to gaps in expertise, 

steady declines in staffing levels, and limited institutional knowledge.

In a November 2014 report, we found that, in part, the lack of financial 

expertise and training hinders BIE administrators’ effectiveness in 

overseeing school expenditures. For example, although BIE line office 

administrators made key decisions about single audit report findings—

such as whether funds are being spent appropriately—they were not 

auditors or accountants. Additionally, the administrators responsible for 

the three BIE offices we visited said they did not have the financial 

expertise to understand the content of single audits. We recommended 

 3

The Single Audit Act of 1984, as implemented by the Office of Management and Budget, 

requires a financial audit of grantees who expend at least $500,000 in federal grants and 

other assistance in a fiscal year. These audits are commonly called “single audits.” The 

audits are carried out at the end of a school’s fiscal year and are conducted by 

independent auditors who are contracted by the grantee. They include both the entity’s 

financial statements and the records of spending of federal grant awards for each 

program. See 31 U.S.C. §§ 7501-7507.
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 208 GAO-17-317 High-Risk Series

that the agency develop a comprehensive workforce plan to ensure that 

BIE has an adequate number of staff with the requisite knowledge and 

skills to effectively oversee BIE school expenditures. Interior agreed to 

implement this recommendation, but as of January 2017, it had not 

provided documentation that it had done so.

In a September 2013 report, we found that Indian Affairs could not ensure 

that staffing levels at Indian Affairs’ regional offices were adjusted to meet 

the needs of BIE schools in regions with varying numbers of schools, 

ranging from 2 to 65, because it had not updated its strategic workforce 

plan. We recommended that Indian Affairs revise its strategic workforce 

plan to ensure that its employees providing administrative support to BIE 

are placed in the appropriate offices to ensure that regions with a large 

number of schools have sufficient support. Indian Affairs agreed to 

implement this recommendation. In September 2016, Interior provided us 

with a revised workforce plan for Indian Affairs. However, this plan did not 

include information about the workforce needs related to the Indian Affairs 

offices that provide administrative support to BIE and its schools and 

therefore did not address the recommendation. As of January 2017, we 

had not received further updates from Indian Affairs. We will continue to 

monitor its efforts in this area.

Outdated and deteriorating equipment, technology, and 

infrastructure. Aging BIE school facilities and equipment contribute to 

degraded and unsafe conditions for students and staff. In a March 2016 

report, we found at one school 7 boilers that failed inspection because of 

multiple high-risk safety deficiencies, including elevated levels of carbon 

monoxide and a natural gas leak. Four of the boilers were located in a 

student dormitory, and 3 were located in classroom buildings. All but one 

of the boilers were about 50 years old. While the poor condition of the 

boilers posed an imminent danger to the safety of students and staff, 

most of the boilers were not repaired until about 8 months after failing 

their inspection, prolonging safety risks to students and staff.

In a February 2015 testimony, we reported that BIE schools face a variety 

of challenges with their facilities, such as aging buildings and problems 

that result from years of deferred maintenance. For example, at one 

school built in 1959 we observed extensive cracks in concrete block walls 

and supports, which a BIA official said resulted from a shifting foundation.

Incomplete and inaccurate data. A lack of internal controls and other 

weaknesses hinder Indian Affairs’ ability to collect complete and accurate 

information on the physical conditions of BIE schools. In a March 2016 
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 209 GAO-17-317 High-Risk Series

report, we found that Indian Affairs lacks sound information on safety and 

health conditions of all BIE schools. Specifically, we found that its 

nationwide information on safety and health deficiencies at schools is not 

complete and accurate because of key weaknesses in its inspection 

program. Without inspection information that is complete and accurate, 

Indian Affairs cannot effectively determine the magnitude and severity of 

safety and health deficiencies at schools. As a result, it cannot ensure 

BIE school facilities are safe for students and staff and currently meet 

safety and health requirements. We recommended that Indian Affairs take 

steps to ensure that the inspection information it collects on BIE schools 

is complete and accurate, among other things. As of January 2017, the 

agency had not provided documentation that it had done so.

In a February 2015 testimony, we reported that issues with the quality of 

data on BIE school conditions—such as inconsistent data entry by 

schools and insufficient quality controls—makes it difficult to determine 

the actual number of schools in poor condition and undermines Indian 

Affairs’ ability to effectively track and address problems at school 

facilities.

The Indian Health Service (IHS), an agency within HHS, is charged with 

providing health care to approximately 2.2 million Indians. In fiscal year 

2016, IHS allocated about $1.9 billion for health services provided by 

federally and tribally operated hospitals, health centers, and health 

stations. Federally operated facilities provide mostly primary and 

emergency care, in addition to some ancillary or specialty services. The 

federally operated system consists of 26 hospitals, 56 health centers, and 

32 health stations. IHS hospitals range in size from 4 to 133 beds.

When services are not available at federally operated or tribally operated 

facilities, IHS may pay for services provided through external providers 

through its PRC program. IHS facilities and their associated PRC 

programs are located in 12 geographic areas, each overseen by an IHS 

office led by an area director. The PRC program is funded through annual 

appropriations and must operate within the limits of available appropriated 

funds. To be eligible for PRC services, recipients must meet several 

criteria, including being a member or descendant of a federally 

recognized tribe or having close social and economic ties with the tribe, 

and living within a Tribal Contract Health Services Area. Although funding 

available for the PRC program has recently increased, we have reported 

that the program is unable to pay for all eligible services, and that these 

gaps in services sometimes delay diagnoses and treatments, which can 

Indian Health Care
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 210 GAO-17-317 High-Risk Series

exacerbate the severity of a patient’s condition and necessitate more 

intensive treatment.

PPACA expanded or created new health care coverage options that may 

benefit Indians, including a state option to expand Medicaid eligibility to 

individuals with incomes at or below 138 percent of the federal poverty 

level (FPL), federal premium tax credits for individuals obtaining 

insurance through health insurance exchanges with incomes between 

100 and 400 percent of the FPL, and cost sharing exemptions for Indians 

who are members of federally recognized tribes with incomes at or below 

300 percent of the FPL who purchase insurance through the exchanges. 

In September 2013, we estimated that PPACA’s new coverage options 

may allow hundreds of thousands of Indians to obtain health care benefits 

for which they were not previously eligible, assuming all states expanded 

their Medicaid programs. We reported that, if Indians enroll in one of 

these options and choose to receive care through IHS, increased revenue 

from third party payers such as Medicaid could free up IHS resources and 

help alleviate pressure on the IHS budget.

Inadequate oversight of federal activities. IHS provides inadequate 

oversight of health care, both of its federally operated facilities and 

through the PRC program. In January 2017, we reported that IHS 

provided limited and inconsistent oversight of the quality of care provided 

in its federally operated facilities. As a result, the agency cannot ensure 

that patients receive quality care. IHS has recently finalized a quality 

framework designed to address these deficiencies and improve its 

oversight. We recommended that, as part of implementing the quality 

framework, IHS ensure that agency-wide standards for the quality of care 

provided in its federally operated facilities are developed, and that facility 

performance in meeting these standards is systematically monitored over 

time. HHS agreed with our recommendation and cited steps it already has 

underway to improve the quality of care in IHS’s federally-operated 

facilities. HHS described the development of the IHS Quality Framework 

and Implementation Plan released in November 2016. However, as of 

January 2017, IHS has not developed agency-wide standards for the 

quality of care provided in its federally operated facilities.

In March 2016, we reported that IHS had not set any agency-wide 

standards for patient wait times at IHS federally operated facilities, 

including how long it should take to schedule an appointment and 

complete an office visit. According to tribal representatives, patients 

reported difficulty scheduling primary care visits because of extended wait 

times. For example, one facility reported that new patients may wait 6 
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 211 GAO-17-317 High-Risk Series

weeks for an initial exam with a family medicine physician, and new 

patients in internal medicine may wait 3 to 4 months for an initial exam.

IHS has delegated this responsibility to its area offices and has not 

conducted any systematic, agency-wide oversight of the timeliness of 

primary care. Without these standards, IHS cannot know whether it is 

providing sufficient primary care to meet the needs of its patients. We 

recommended that IHS develop and communicate specific agency-wide 

standards for patient wait times in federally operated facilities, monitor 

patient wait times, and take corrective actions when standards are not 

met. HHS stated that it agreed with the need to improve patient wait times 

at IHS federally-operated facilities to ensure that primary care is available 

and accessible to Indians. HHS described its plan to establish an Office of 

Quality Health Care at IHS Headquarters to provide for national policy 

and oversight of critical quality improvement strategies and ensure their 

success and accountability. As of January 2017, IHS has not established 

the Office of Quality Health Care, and has not developed agency-wide 

standards for patient wait times in federally operated facilities.

In June 2012, we found that IHS had taken few steps to evaluate 

variations in the funds it allocates for the Contract Health Services (CHS) 

program (now called PRC), which varied from $299 to $801 per capita 

across the 12 IHS geographic areas in fiscal year 2010. IHS does not 

know the origin of the base funding formula, which, according to IHS 

officials, has existed since the 1930s and accounted for 82 percent of the 

funds allocated to the area offices that year. Annual adjustments for 

population growth and inflation are made as a percentage of base funding 

and are the same across all areas. Additional program increases are not 

large enough to alter funding variations because these additional 

increases have been a relatively small proportion of PRC funds that area 

offices receive. Because IHS continues to use this methodology, it cannot 

equitably allocate funds to meet the health care needs of Indians. In order 

to ensure IHS equitably allocates PRC funds, we recommended that the 

Congress consider requiring IHS to develop and use a new method to 

allocate funds to account for variations across areas. Legislation 

introduced in the House and reported out of committee in 2016 would 

have addressed this issue by requiring the agency to establish 

regulations to develop and implement a revised PRC distribution formula 

taking into account certain factors that may vary across areas. Also, a 

House Report partially addressed this issue by directing the agency to 

allocate an increased funding increment resulting from the 2017 

Department of Interior regular appropriation, H.R. 5538, pursuant to a 
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 212 GAO-17-317 High-Risk Series

specified allocation formula that may vary across areas. Neither bill 

became law.

Ineffective collaboration and limited communication. In a June 2012 

report, we found that IHS does not require its area offices to inform IHS 

headquarters if they distribute program increase funds to local PRC 

programs using different criteria than the PRC allocation formula 

suggested by headquarters. As a result, IHS may be unaware of 

additional funding variation across areas. We recommended that IHS 

develop written policies and procedures to require area offices to notify 

IHS when they diverge from the formula for allocating funds to PRC 

programs. HHS concurred with this recommendation and noted that 

guidance requiring area offices to report these changes to IHS 

headquarters would be added to the PRC manual, but did not specify a 

date for doing so. As of January 2017, IHS has not added this guidance 

to the manual.

Limited federal workforce planning. In a March 2016 report, we 

reported that IHS officials told us that an insufficient workforce was the 

biggest impediment to ensuring patients could access timely primary 

care. According to IHS’s 2016 budget justification, there were over 1,550 

vacancies for health care professionals throughout the IHS health care 

system including: physicians, dentists, nurses, pharmacists, physician 

assistants, and nurse practitioners. According to IHS officials, staffing 

vacancies have created obstacles for facilities working to provide primary 

care.

In September 2013, we found that IHS did not have an effective plan in 

place to ensure that sufficient staff would be in place to assist with 

increased enrollment and third party billing under expanded Medicaid or 

the exchanges beginning in 2014 under PPACA. Without a plan, IHS may 

not be able to ensure that a sufficient number of staff are available to 

assist with enrollment and to process increased third-party payments. We 

recommended that IHS realign current resources and personnel to 

increase capacity to assist with these efforts. HHS neither agreed nor 

disagreed with this recommendation. As of January 2017, IHS has not 

implemented this recommendation.

In December 2013, we reported that local PRC program officials said that 

insufficient staffing for the PRC program affected their ability to issue 

timely purchase orders for health care services approved by the program. 

IHS’s staffing standards model established a staffing ratio based on the 

annual number of purchase orders authorized for health services at a 
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 213 GAO-17-317 High-Risk Series

facility, and some PRC program officials noted that their number of staff 

was below these standards, contributing to delays in determining eligibility 

for the program and processing payments to providers. We 

recommended that IHS use available PRC funds to pay for PRC program 

staff. HHS disagreed with this recommendation, stating its intent to use 

PRC funds to pay only for services, not staff, since PRC funding was not 

sufficient to pay for all needed services. We acknowledged the difficult 

challenges and choices faced by PRC programs when program funds are 

not available to pay for all needed services, but maintained that without 

using funds to pay for staff, some PRC programs would continue to have 

staffing levels below IHS’s staffing standards model, which contributes to 

delays in administering the program. As of January 2017, IHS has not 

implemented this recommendation.

Outdated and deteriorating equipment, technology, and 

infrastructure. In March 2016, we reported that IHS officials told us that 

access to timely primary care at some health care facilities serving Indian 

communities is hindered by outdated medical and telecommunications 

equipment, such as analog mammography machines and telephones with 

an insufficient number of lines for scheduling patient appointments.

Incomplete and inaccurate data. In a June 2012 report, we found that 

IHS officials do not believe that its PRC program data are complete or 

that areas collect these data in the same manner. Without accurate data, 

IHS cannot know if the proportion of actual PRC users is consistent 

across areas. We made three recommendations to improve the accuracy 

of the PRC data for future allocations, including using actual counts of 

PRC users, using variation in levels of available hospital services in the 

funding formula, and, as mentioned above, requiring area offices to notify 

headquarters when they diverge from the formula for allocating funds to 

PRC programs. HHS did not concur with our recommendation to use 

actual counts of PRC users, rather than all IHS users, in any formula for 

allocating PRC funds that relies on the number of active users, stating 

that IHS’s combined count of all users is intended to reflect the health 

care needs of PRC users. HHS concurred with our recommendation that 

IHS use variations in levels of available hospital services to allocate PRC 

funds. As of January 2017, IHS has not implemented these 

recommendations.

In December 2013, we reported that one of the measures IHS uses to 

assess the time it takes to approve and process payments to providers in 

the PRC program did not provide a clear picture of timeliness because it 

combines data for two different types of PRC services. We recommended 
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 214 GAO-17-317 High-Risk Series

that IHS take steps to improve its ability to measure timeliness by 

modifying its claims data system to distinguish between two types of 

referrals and establish separate timeframe targets for each type. HHS 

concurred with this recommendation, but as of January 2017, IHS has not 

implemented it.

Developing energy resources is vital for the livelihood and long-term 

economic wellbeing of some Indian tribes and their members. More 

specifically, energy development provides opportunities to improve poor 

living conditions and decrease high levels of poverty. Tribes and their 

members determine how to use Indian energy resources to meet the 

needs of the community. However, if the resources are held in trust or 

restricted status, BIA—through its 12 regional offices, 85 agency offices, 

and other supporting offices—generally must review and approve leases, 

permits, and other documents required to develop the resources.4 In 

2014, in response to tribal requests for increased coordination and 

efficient management of their resources from the numerous federal 

regulatory agencies involved with Indian energy development, Interior 

took initial steps to form a new office, the Indian Energy Service Center 

(Service Center)—with BIA as the lead agency. According to Interior’s 

fiscal year 2016 budget justification, the Service Center is intended to, 

among other things, help expedite the leasing and permitting processes 

associated with Indian energy development.

Our work has shown that BIA did not incorporate leading practices or 

adhere to agency guidance in developing the Service Center and BIA has 

mismanaged Indian energy resources in the following ways:

Inadequate oversight of federal activities. In a June 2015 report, we 

found that BIA must review and approve activities throughout the 

development process, but BIA does not have a documented process or 

the data needed to track its review and response times—such as the date 

documents are received, the date the review process is considered 

complete by the agency, and the date documents are approved or 

denied. However, a few stakeholders we interviewed and some literature 

 4

Trust resources are held by the U.S. government for the beneficial interest of the tribe or 

a member, and restricted resources are owned by the tribe or a member but subject to 

restrictions on alienation. Trust and restricted resources generally cannot be leased 

without approval of the Secretary of the Interior, who has generally delegated this 

authority to BIA.

Indian Energy Resources
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 215 GAO-17-317 High-Risk Series

we reviewed identified that BIA’s review and approval process can be 

lengthy and increase development costs and project development times, 

resulting in missed development opportunities, lost revenue, and 

jeopardized viability of projects. For example, according to a tribal official, 

BIA took as long as 8 years to review some of its energy-related 

documents. In the meantime, the tribe estimates it lost $95 million in 

revenues it could have earned from tribal permitting fees, oil and gas 

severance taxes, and royalties. In another example, one lease for a 

proposed utility-scale wind project took BIA more than 3 years to review 

and approve. According to a tribal official, the long review time has 

contributed to uncertainty about the continued viability of the project 

because data used to support the economic feasibility and environmental 

impact of the project became too old to accurately reflect current 

conditions. We recommended that Interior direct BIA to develop a 

documented process to track its review and response times. In response, 

Interior stated it would try to implement a tracking and monitoring 

mechanism by the end of fiscal year 2017 for oil and gas leases. 

However, it did not indicate whether it intends to track and monitor its 

review of other energy-related documents that must be approved before 

tribes can develop resources. Without comprehensively tracking and 

monitoring its review process, BIA cannot ensure that documents are 

moving forward in a timely manner, and lengthy review times may 

continue to contribute to lost revenue and missed development 

opportunities for Indian tribes.

In a June 2016 report, we found that BIA took steps to improve its 

process for reviewing revenue-sharing agreements, but still had not 

established a systematic mechanism for monitoring or tracking. With 

respect to revenue sharing agreements, we recommended, among other 

things, that BIA develop a systematic mechanism for tracking these 

agreements through the review and approval process. Interior concurred 

with these recommendations and stated that BIA will develop such a 

mechanism and in the meantime use a centralized tracking spreadsheet.

Ineffective collaboration and limited communication. In a November 

2016 report, we found that BIA has taken steps to form an Indian Energy 

Service Center that is intended to, among other things, help expedite the 

permitting process associated with Indian energy development. However, 

BIA did not coordinate with key regulatory agencies, including Interior’s 

Fish and Wildlife Service, the U.S. Army Corps of Engineers, and the 

Environmental Protection Agency. As a result, the Service Center has not 

been established as the central point for collaborating with all federal 

regulatory partners generally involved in energy development, nor does it 
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 216 GAO-17-317 High-Risk Series

serve as a single point of contact for permitting requirements. Without 

serving in these capacities, the Service Center will be limited in its ability 

to improve efficiencies in the federal regulatory process. We also found 

that in forming the Service Center, BIA did not involve key stakeholders, 

such as the Department of Energy—an agency with significant energy 

expertise—and BIA employees from agency offices. By not involving key 

stakeholders, BIA has missed an opportunity to incorporate their 

expertise into its efforts. We recommended that BIA include other 

regulatory agencies in the Service Center so that it can act as a single 

point of contact or a lead agency to coordinate and navigate the 

regulatory process. We also recommended BIA establish formal 

agreements with key stakeholders, such as DOE, that identify the 

advisory or support role of the office, and establish a process for seeking 

and obtaining input from key stakeholders, such as BIA employees, on 

the Service Center activities. Interior agreed with our recommendations 

and described plans to address them.

In 2005, Congress provided an option for tribes to enter into an 

agreement with the Secretary of the Interior that allows the tribe, at its 

discretion, to enter into leases, business agreements, and rights-of-way 

agreements for energy resource development on tribal lands without 

review and approval by the Secretary. However, in a June 2015 report, 

we found that uncertainties about Interior’s regulations for implementing 

this option have contributed to deter a tribe from pursuing an agreement. 

We recommended that Interior provide clarifying guidance. In August 

2015, Interior stated the agency is considering further guidance. As of 

December 2016, Interior had not provided additional guidance.

Limited federal workforce planning. In November 2016, we found BIA 

had high vacancy rates at some agency offices and that the agency had 

not conducted key workforce planning activities, such as identifying the 

key workforce skills needed to achieve agency goals, and assessing any 

skill gaps. These workforce issues contribute to BIA’s management 

shortcomings that have hindered Indian energy development. Until BIA 

undertakes necessary workforce planning activities, it cannot ensure that 

it has a workforce with the right skills, appropriately aligned to meet the 

agency’s goals and tribal priorities. We recommended that BIA assess 

critical skills and competencies needed to fulfill its responsibilities related 

to energy development and identify potential gaps. We also 

recommended BIA establish a documented process for assessing BIA’s 

workforce composition at agency offices taking into account BIA’s 

mission, goals, and tribal priorities. Interior agreed with our 

recommendations and stated it is taking steps to implement them.
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 217 GAO-17-317 High-Risk Series

Outdated and deteriorating equipment, technology, and infrastructure. In 

June 2015, we found that BIA does not have the necessary geographic 

information system (GIS) mapping data for identifying who owns and uses 

resources, such as existing leases. Interior guidance states that efficient 

management of oil and gas resources relies, in part, on GIS mapping 

technology because it allows managers to easily identify resources 

available for lease and where leases are in effect. According to a BIA 

official, without GIS data, the process of identifying transactions, such as 

leases and access agreements for Indian land and resources, can take 

significant time and staff resources to search paper records stored in 

multiple locations. We recommended BIA should take steps to improve its 

GIS capabilities to ensure it can verify ownership in a timely manner. 

Interior stated it will enhance mapping capabilities by developing a 

national dataset composed of all Indian land tracts and boundaries in the 

next 4 years.

Incomplete and inaccurate data. In June 2015, we found that BIA did 

not have the data it needs to verify who owns some Indian oil and gas 

resources or identify where leases are in effect. In some cases, BIA 

cannot verify ownership because federal cadastral surveys—the means 

by which land is defined, divided, traced, and recorded—cannot be found 

or are outdated. The ability to account for Indian resources would assist 

BIA in fulfilling its federal trust responsibility, and determining ownership 

is a necessary step for BIA to approve leases and other energy-related 

documents. We recommended that Interior direct BIA to identify land 

survey needs. Interior stated it will develop a data collection tool to 

identify the extent of its survey needs in fiscal year 2016. As of December 

2016, Interior had not provided information on the status of its efforts to

develop a data collection tool.

For additional information about this high-risk area related to our Indian 

Education work, contact Melissa Emrey-Arras at (617) 788-0534 or 

EmreyArrasM@gao.gov. For additional information about this high-risk 

area related to our Indian Health work, contact Kathleen King at (202) 

512-7114 or KingK@gao.gov. For additional information about this highrisk area related to our Indian Energy work, contact Frank Rusco at (202) 

512-3841 or RuscoF@gao.gov.

GAO Contact
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 218 GAO-17-317 High-Risk Series

Indian Affairs: Key Actions Needed to Ensure Safety and Health at Indian 

School Facilities. GAO-16-313. Washington, D.C.: March 10, 2016.

Indian Affairs: Preliminary Results Show Continued Challenges to the 

Oversight and Support of Education Facilities. GAO-15-389T. 

Washington, D.C.: February 27, 2015.

Indian Affairs: Bureau of Indian Education Needs to Improve Oversight of 

School Spending. GAO-15-121. Washington, D.C.: November 13, 2014.

Indian Affairs: Better Management and Accountability Needed to Improve 

Indian Education. GAO-13-774. Washington, D.C.: September 24, 2013.

Indian Health Service: Actions Needed to Improve Oversight of Quality of 

Care. GAO-17-181. Washington, D.C.: January 9, 2017.

Indian Health Service: Actions Needed to Improve Oversight of Patient 

Wait Times. GAO-16-333. Washington, D.C.: March 29, 2016.

Indian Health Service: Opportunities May Exist to Improve the Contract 

Health Services Program. GAO-14-57. Washington, D.C.: December 11, 

2013.

Indian Health Service: Most American Indians and Alaska Natives 

Potentially Eligible for Expanded Health Coverage, but Action Needed to 

Increase Enrollment. GAO-13-553. Washington, D.C.: September 5, 

2013.

Indian Health Service: Capping Payment Rates for Nonhospital Services 

Could Save Millions of Dollars for Contract Health Services. GAO-13-272.

Washington, D.C.: April 11, 2013.

Indian Health Service: Action Needed to Ensure Equitable Allocation of 

Resources for the Contract Health Services Program. GAO-12-446.

Washington, D.C.: June 15, 2012.

Related GAO 

Products

Education

Health Care
Improving Federal Management of Programs 

that Serve Tribes and Their Members

Page 219 GAO-17-317 High-Risk Series

Indian Health Service: Increased Oversight Needed to Ensure Accuracy 

of Data for Estimating Contract Health Service Need. GAO-11-767.

Washington, D.C.: September 23, 2011.

Indian Energy Development: Additional Actions by Federal Agencies Are 

Needed to Overcome Factors Hindering Development. GAO-17-43. 

Washington, D.C.: November 10, 2016.

Indian Energy Development: Interior Could Do More to Improve Its 

Process for Approving Revenue-Sharing Agreements. GAO-16-553. 

Washington, D.C.: June 13, 2016.

Indian Energy Development: Poor Management by BIA Has Hindered 

Energy Development on Indian Lands. GAO-15-502. Washington, D.C.: 

June 8, 2015.

Energy
2020 Decennial Census

Page 220 GAO-17-317 High-Risk Series

One of the most important functions of the U.S. Census Bureau (Bureau) 

is conducting the decennial census of the U.S. population, which is 

mandated by the Constitution and provides vital data for the nation. This 

information is used to apportion the seats of the U.S. House of 

Representatives; realign the boundaries of the legislative districts of each 

state; allocate billions of dollars in federal financial assistance; and 

provide social, demographic, and economic profiles of the nation’s people 

to guide policy decisions at each level of government. A complete count 

of the nation’s population is an enormous challenge as the Bureau seeks 

to control the cost of the census while it implements several new 

innovations and manages the processes of acquiring and developing new 

and modified information technology (IT) systems supporting them. Over 

the past 3 years, we have made 30 recommendations to help the Bureau 

design and implement a more cost-effective census for 2020; however, 

only 6 of them had been fully implemented as of January 2017.

The cost of the census, in terms of cost for counting each housing unit, 

has been escalating over the last several decennials. The 2010 Census 

was the costliest U.S. Census in history at about $12.3 billion, and was 

about 31 percent more costly than the $9.4 billion 2000 Census (in 2020 

dollars).1 The average cost for counting a housing unit increased from 

about $16 in 1970 to around $92 in 2010 (in 2020 constant dollars). 

Meanwhile, the return of census questionnaires by mail (the primary 

mode of data collection) declined over this period from 78 percent in 1970 

to 63 percent in 2010. Declining mail response rates—a key indicator of a 

cost-effective census—are significant and lead to higher costs. This is 

because the Bureau sends enumerators to each non-responding 

household to obtain census data. As a result, non-response follow-up 

(NRFU) is the Bureau’s largest and most costly field operation. In many 

ways, the Bureau has had to invest substantially more resources each 

decade to match the results of prior enumerations.

 1

The fiscal year 2020 constant dollar factors the Bureau used are derived from the 

Chained Price Index from “Gross Domestic Product and Deflators Used in the Historical 

Tables: 1940–2020” table from the Fiscal Year 2016 Budget of the United States 

Government.

2020 Decennial Census

Why Area Is High 

Risk
2020 Decennial Census

Page 221 GAO-17-317 High-Risk Series

The Bureau plans to implement several new innovations in its design of 

the 2020 Census. In response to our recommendations regarding past 

decennial efforts and other assessments, the Bureau has fundamentally 

reexamined its approach for conducting the 2020 Census. Its plan for 

2020 includes four broad innovation areas that it believes will save it over 

$5 billion (2020 constant dollars) when compared to what it estimates 

conducting the census with traditional methods would cost. The Bureau’s 

innovations include (1) using the Internet as a self-response option, which 

the Bureau has never done on a large scale before; (2) verifying most 

addresses using “in-office” procedures and on-screen imagery rather than 

street-by-street field canvassing; (3) re-engineering data collection 

methods such as by relying on an automated case management system; 

and (4) in certain instances, replacing enumerator collection of data with 

administrative records (information already provided to federal and state 

governments as they administer other programs). These innovations 

show promise for a more cost-effective head count. However, they also 

introduce new risks, in part, because they include new procedures and 

technology that have not been used extensively in earlier decennials, if at 

all.

The Bureau is also managing the acquisition and development of new 

and modified IT systems, which add complexity to the design of the 

census. To help control census costs, the Bureau plans to significantly 

change the methods and technology it uses to count the population, such 

as offering an option for households to respond to the survey via the 

Internet or phone, providing mobile devices for field enumerators to 

collect survey data from households, and automating the management of 

field operations. This redesign relies on acquiring and developing many 

new and modified IT systems, which could add complexity to the design.

These cost risks, new innovations, and the acquisition and development 

of IT systems for the 2020 Census, along with other challenges we have 

identified in recent years, raise serious concerns about the Bureau’s 

ability to conduct a cost-effective enumeration. Based on these concerns, 

we have concluded that the 2020 Census is a high-risk area and have 

added it to the High-Risk List in 2017.

To help the Bureau mitigate the risks associated with its fundamentally 

new and complex innovations for the 2020 Census, the commitment of 

top leadership is needed to ensure the Bureau’s management, culture, 

and business practices align with a cost-effective enumeration. For 

example, the Bureau needs to continue strategic workforce planning 

efforts to ensure it has the skills and competencies needed to support 

What Remains to Be 

Done
2020 Decennial Census

Page 222 GAO-17-317 High-Risk Series

planning and executing the census. It must also rigorously test individual 

census-taking activities to provide information on their feasibility and 

performance, their potential for achieving desired results, and the extent 

to which they are able to function together under full operational 

conditions.2 We have recommended that the Bureau also ensure that its 

scheduling adheres to leading practices and be able to support a 

quantitative schedule risk assessment, such as by having all activities 

associated with the levels of resources and effort needed to complete 

them. The Bureau has stated that it has begun maturing project 

schedules to ensure that the logical relationships are in place and plans 

to conduct a quantitative risk assessment. We will continue to monitor the 

Bureau’s efforts.

The Bureau must also improve its ability to manage, develop, and secure 

its IT systems. For example, the Bureau needs to prioritize its IT 

decisions and determine what information it needs in order to make those 

decisions. In addition, the Bureau needs to make key IT decisions for the 

2020 Census in order to ensure they have enough time to have the 

production systems in place to support the end-to-end system test. To 

this end, we recommended the Bureau ensure that the methodologies for 

answering the Internet response rate and IT infrastructure research 

questions are determined and documented in time to inform key design 

decisions.3 Further, given the numerous and critical dependencies 

between the Census Enterprise Data Collection and Processing 

(CEDCaP) program—a large and complex modernization program within 

the IT Directorate—and 2020 Census programs, their parallel 

implementation tracks, and the 2020 Census’s immovable deadline, we 

recommended that the Bureau establish a comprehensive and integrated 

list of all interdependent risks facing the two programs, and clearly identify 

roles and responsibilities for managing this list.4 The Bureau stated that it 

plans to take actions to address our recommendations.

 2

GAO, 2020 Census: Additional Actions Could Strengthen Data Collection Efforts, 

GAO-17-191 (Washington, D.C.: Jan. 26, 2017).

3

GAO, 2020 Census: Key Challenges Need to Be Addressed to Successfully Enable 

Internet Response, GAO-15-225 (Washington, D.C.: Feb. 5, 2015).

4

GAO, Information Technology: Better Management of Interdependencies between 

Programs Supporting 2020 Census Is Needed, GAO-16-623 (Washington, D.C.: Aug. 9, 

2016).
2020 Decennial Census

Page 223 GAO-17-317 High-Risk Series

It is also critical for the Bureau to have better oversight and control over 

its cost estimation process and we have recommended that the Bureau 

ensure its cost estimate is consistent with our leading practices.5 For 

example, the Bureau will need to, among other practices, document all 

cost-influencing assumptions; describe estimating methodologies used for 

each cost element; ensure that variances between planned and actual 

cost are documented, explained, and reviewed; and include a 

comprehensive sensitivity analysis, so that it can better estimate costs. 

We also recommended that the Bureau implement and institutionalize 

processes or methods for ensuring control over how risk and uncertainty 

are accounted for and communicated within its cost estimation process. 

The Bureau agreed with our recommendations, and we are currently 

conducting a follow-up audit of the Bureau’s most recent cost estimate 

and will determine whether the Bureau has implemented them.

Sustained congressional oversight will be essential as well. In 2015 and 

2016, congressional committees held five hearings focusing on the 

progress of the Bureau’s preparations for the decennial. Going forward, 

active oversight will be needed to ensure these efforts stay on track, the 

Bureau has needed resources, and Bureau officials are held accountable 

for implementing the enumeration as planned.

We will continue monitoring the Bureau’s efforts to conduct a costeffective enumeration. To this end, we have ongoing work focusing on 

such topics as the Bureau’s updated life-cycle cost estimate and the 

readiness of IT systems for the 2018 End-to-End Test, which is 

essentially a dress rehearsal for the decennial.

The Bureau is planning many previously unused innovations for the 

2020 Census: The decennial census is an inherently challenging 

undertaking, requiring many moving parts to come together in a short 

time and be completed according to a prescribed schedule. To help 

 5

GAO, 2020 Census: Census Bureau Needs to Improve Its Life-Cycle Cost Estimating 

Process, GAO-16-628 (Washington, D.C.: June 30, 2016).

Additional Details on 

What GAO Found

Challenges Implementing 

Innovations
2020 Decennial Census

Page 224 GAO-17-317 High-Risk Series

control costs and maintain accuracy, the Bureau is introducing significant 

change to how it conducts the decennial census in 2020. Its planned 

innovations include (1) making greater use of local data, imagery, and 

other office procedures to build its address list; (2) improving selfresponse by encouraging respondents to use the Internet and telephone; 

(3) using administrative records to reduce field work; and (4) 

reengineering field operations using technology to reduce manual effort 

and improve productivity. While the census is under way, the tolerance for 

any breakdowns is quite small. As a result, given the new four innovation 

areas for the 2020 Census, it will be imperative that the Bureau have 

systems and operations in place for the 2018 End-to-End Test.

Using administrative records is promising but introduces 

challenges: Although administrative records—information already 

provided to the government as it administers other programs—have been 

discussed and used for the decennial census since the 1970s, the Bureau 

plans a more significant role for them to reduce the amount of data 

collection fieldwork, which has the potential to help significantly limit the 

cost increases of the 2020 Census. The Bureau has estimated that using 

these records could save up to $1.4 billion compared to traditional census 

methods. In 2015, we found that while the Bureau has already 

demonstrated the feasibility of using administrative records, it still faces 

challenges with using them for the 2020 Census.6 For example, although 

the Bureau has no control over the accuracy of data provided to it by 

other agencies, it is responsible for ensuring that data it uses for 2020 

Census are of sufficient quality for their planned uses.

Another challenge we identified is the extent to which the public will 

accept government agencies sharing personal data for the purposes of 

the census. Related concerns involve trust in the government and 

perceptions about burden on respondents as well the social benefits of 

agencies sharing data. Moreover, in addition to using administrative 

records to reduce fieldwork, the Bureau is considering several additional 

opportunities to leverage administrative records to help improve the cost 

and quality of the 2020 Census. It will be important for the Bureau to set 

deadlines for deciding which records it will use and for which purpose to 

help the Bureau monitor its progress and prioritize which activities—or 

 6

GAO, 2020 Census: Additional Actions Would Help the Bureau Realize Potential 

Administrative Records Cost Savings, GAO-16-48 (Washington, D.C.: Oct. 20, 2015).
2020 Decennial Census

Page 225 GAO-17-317 High-Risk Series

records—to continue pursuing, or to abandon, if time becomes a 

constraint.

The Bureau needs to identify and analyze root causes of noninterviews during testing: When households do not respond to the 

census and when the Bureau does not obtain information about the 

household while knocking on doors during its NRFU operation, the 

Bureau may have to impute attributes of the household based on the 

demographic characteristics of surrounding housing units as well as on 

administrative records. We reported in 2016 that during the Bureau’s 

2016 Census Site Test, the Bureau experienced about 20 and 30 percent 

of its test workload as non-interviews at its two test sites in Harris County, 

Texas, and Los Angeles County, California, respectively.7 According to 

the Bureau, non-interviews are cases where no data or insufficient data 

are collected, either because enumerators make six attempted visits 

without success (the maximum number the Bureau allows), or are not 

completed due to, for example, language barriers or dangerous 

situations.8 Identifying root causes of problems is something we look for 

when determining progress within a high-risk area. Accordingly, while the 

2016 Census Test non-interview rate is not necessarily a precursor to the 

2020 non-interview rate, because of its relationship to the cost and quality 

of the census, it will be important for the Bureau to better understand the 

factors contributing to it.

Bureau cancelled field tests for 2017: The Bureau plans to conduct 

additional research through 2018 in order to further refine the design of 

the 2020 Census, but recently had to alter its approach. On October 18, 

2016, the Bureau decided to stop two field test operations planned for 

fiscal year 2017 in order to mitigate risks from funding uncertainty. 

Specifically, the Bureau said it would stop all planned field activity, 

including local outreach and hiring, at its test sites in Puerto Rico, North 

and South Dakota, and Washington State. The Bureau will not carry out 

planned field tests of its mail-out strategy and follow up for non-response 

in Puerto Rico or its door-to-door enumeration. The Bureau also 

cancelled plans to update its address list in the Indian lands and 

surrounding areas in the three states.

 7

GAO, Decennial Census: Progress Report on Preparations for 2020, GAO-17-238T 

(Washington, D.C.: Nov. 16, 2016).

8

According to the Bureau, it needs to collect a number of predefined specific combinations 

of data elements during field interviews in order to consider the interview complete.
2020 Decennial Census

Page 226 GAO-17-317 High-Risk Series

However, the Bureau will continue with other planned testing in fiscal year 

2017, such as those focusing on systems readiness and Internet 

response. Further, the Bureau said it would consider incorporating the 

cancelled field activities elements within the 2018 End-to-End Test. The 

Bureau maintains that stopping the 2017 Field Test will help prioritize 

readiness for the 2018 End-to-End Test, and mitigate risk. Nevertheless, 

as we reported in November 2016, it also represents a lost opportunity to 

test, refine, and integrate operations and systems, and it puts more 

pressure on the 2018 Test to demonstrate that enumeration activities will 

function as needed for 2020.9

The Bureau needs to strengthen the management and oversight of 

all IT programs, systems, and contractors supporting the decennial:

The redesign of the 2020 Census relies on many new and modified IT 

systems. In addition to those systems that are being managed and 

developed within the 2020 Census Directorate, the 2020 program is also 

heavily dependent upon 11 systems that are being delivered by the 

CEDCaP program—a large and complex modernization program within 

the IT Directorate. Importantly, as a result of the Bureau’s challenges in 

key IT internal controls and its rapidly approaching deadline, we identified 

CEDCaP as an IT investment in need of attention in the February 2015 

high-risk report.

10 In addition, in August 2016, we reported that the 2020 

program and CEDCaP program lacked effective processes for managing 

their schedule, risk, and requirements interdependencies.11

For example, among tens of thousands of schedule activities, the two 

programs were expected to manually identify activities that are dependent 

on each other, and rather than establishing one integrated dependency 

schedule, the programs maintained two separate dependency schedules. 

We reported that this contributed to misaligning milestones between the 

programs. We stated that until the two programs establish schedules that 

are completely aligned, develop an integrated list of all interdependent 

 9

GAO-17-238T.

10As part of a new entry into the February 2015 update to our High-Risk Series focused on 

improving the management of IT acquisitions and operations, CEDCaP was identified as 

an IT investment—among others across the federal government—in need of the most 

attention. 

11GAO-16-623.

Critical IT Uncertainties
2020 Decennial Census

Page 227 GAO-17-317 High-Risk Series

risks, and finalize processes for managing requirements, both programs 

are at risk of not delivering their programs as expected.

The Bureau is also relying on contractor support in many key areas,

including technically integrating all of the key systems and infrastructure, 

and developing many of the key data collection systems. Specifically, in 

August 2016, the Bureau hired a contractor to technically integrate the 

2020 Census systems and infrastructure, to include evaluating the 

systems and infrastructure, developing the infrastructure (e.g., cloud or 

data center) to meet the Bureau’s scalability and performance needs, 

integrating all of the systems, and supporting testing activities.

In addition, the Bureau is relying on contractors to develop a number of 

key systems and infrastructure; these activities include (1) developing the 

IT platform that will be used to collect data from a majority of 

respondents—by using the Internet, telephone, and NRFU activities; (2) 

procuring the mobile devices and cellular service to be used for NRFU; 

and (3) developing the IT infrastructure in the field offices. A greater 

reliance on contractors for these key components of the 2020 Census 

requires the Bureau to focus on sound management and oversight of the 

key contracts, projects, and systems.12

Key IT decisions need to be prioritized and made in time for full endto-end testing in 2017: We have issued a series of reports and 

testimonies that have discussed the Bureau’s challenges in prioritizing 

and making IT decisions. In April 2014, we reported that the Bureau had 

not prioritized key IT research and testing needed for its 2020 Census 

design decisions.13 In February 2015, we reported that the Bureau had 

not determined how key IT research questions would be answered—such 

as the expected rate of respondents using its Internet response option or 

the IT infrastructure that would be needed to support this option.14

Further, we testified, in November 2015, that key IT decisions needed to 

be made soon because the Bureau was less than 2 years away from 

preparing for end-to-end testing of all systems and operations, and there 

 12GAO, Information Technology: Uncertainty Remains about the Bureau’s Readiness for a 

Key Decennial Census Test, GAO-17-221T (Washington, D.C.: Nov. 16, 2016).

13GAO, 2020 Census: Prioritized Information Technology Research and Testing Is 

Needed for Census Design Decisions, GAO-14-389 (Washington, D.C.: Apr. 3, 2014).

14GAO-15-225.
2020 Decennial Census

Page 228 GAO-17-317 High-Risk Series

was limited time to implement them.15 We emphasized that the Bureau 

had deferred key IT-related decisions, and that it was running out of time 

to develop, acquire, and implement the systems it will need to deliver the 

redesign.

In October 2016, Bureau officials stated that they had 16 IT-related and 

32 partially IT-related decisions left to make, including the uses of cloudbased solutions, the tools and test materials to be used during integration 

testing, and the expected scale of the system workload for those 

respondents who do not use the Bureau-provided Census ID. It will be 

important to make these decisions in enough time to develop solutions 

before the End-to-End Test begins in August 2017.

Information security risks and challenges need to be addressed to 

secure the Bureau’s systems and data: In August 2016, we described 

the significant challenges that the Bureau faces in securing systems and 

data, such as developing policies and procedures to minimize the threat 

of phishing aimed at stealing personal information16 and ensuring that 

individuals gain only limited and appropriate access to 2020 Census data. 

Because many of the systems to be used in the 2018 End-to-End Test 

are not yet fully developed, the Bureau has not finalized all of the controls 

to be implemented, completed an assessment of those controls, 

developed plans to remediate any control weaknesses, and determined 

whether there is time to fully remediate any weaknesses before the 

system test.

Estimation does not conform to best practices: We reviewed the 

Bureau’s October 2015 estimated comprehensive life-cycle cost for the 

2020 Census and reported in 2016 that it did not conform to best 

practices, and, as a result, the estimate was unreliable.17 Cost estimates 

that appropriately account for risks facing an agency can help an agency 

manage large, complex activities like the 2020 Census, as well as help 

 15GAO, 2020 Census: Key Information Technology Decisions Must Be Made Soon, 

GAO-16-205T (Washington, D.C.: Nov. 3, 2015).

16Phishing is a digital form of social engineering that uses authentic-looking, but fake, emails, websites, or instant messages to get users to download malware, open malicious 

attachments, or open links that direct them to a website that requests information or 

executes malicious code.

17GAO-16-628.

Unreliable 2020 Cost 

Estimate
2020 Decennial Census

Page 229 GAO-17-317 High-Risk Series

Congress make funding decisions and provide oversight. Cost estimates 

are also necessary to inform decisions to fund one program over another, 

to develop annual budget requests, to determine what resources are 

needed, and to develop baselines for measuring performance.

We found that although the Bureau had taken significant steps to improve 

its capacity to carry out an effective cost estimate, its estimate for the 

2020 Census partially met the characteristics of two best practices 

(comprehensive and accurate) and minimally met the other two (welldocumented and credible), where all four need to be substantially met in 

order for an estimate to be deemed high-quality.

According to best practices, to be comprehensive an estimate has to 

have enough detail to ensure that cost elements are neither omitted nor 

double-counted, and all cost-influencing assumptions are detailed in the 

estimate’s documentation, among other things.18 While Bureau officials 

were able to provide us with several documents that included projections 

and assumptions that were used in the cost estimate, we found the 

estimate to be partially comprehensive because it is unclear if all life-cycle 

costs are included in the estimate or if the cost estimate completely 

defines the program.

Credible cost estimates clearly identify limitations due to uncertainty or 

bias surrounding the data or assumptions, according to best practices. 

We found the estimate minimally met best practices for this characteristic 

in part because the Bureau carried out its risk and uncertainty analysis 

only for about $4.6 billion (37 percent) of the $12.5 billion total estimated 

life-cycle cost, excluding, for example, consideration of uncertainty over 

what the decennial census’s estimated part will be of the total cost of 

CEDCaP.

Accurate estimates are unbiased and contain few mathematical mistakes. 

We found the estimate partially met best practices for this characteristic, 

in part because we could not independently verify the calculations the 

Bureau used within its cost model, which the Bureau did not have 

documented or explained outside its limited access cost estimation 

software.

 18GAO Cost Estimating and Assessment Guide: Best Practices for Developing and 

Managing Capital Program Costs (Supersedes GAO-07-1134SP), GAO-09-3SP 

(Washington, D.C.: Mar. 2, 2009).
2020 Decennial Census

Page 230 GAO-17-317 High-Risk Series

Finally, the Bureau’s cost-estimate was not well-documented. Improving 

cost estimation practices will increase the reliability of the Bureau’s cost 

estimate, which will, among other things, help improve decision making, 

budget formulation, progress measurement, and accountability for results.

The Bureau’s cost estimate had other shortcomings as well. For example, 

in 2016 we found that the Bureau’s cost estimation team did not record 

how and why it changed assumptions that were provided to it, and the 

Bureau lacked written guidance and procedures for the cost estimation 

team to follow.19 Moreover, key risks were not accounted for in the cost 

estimate although this is an important best practice.

For additional information about this high-risk area, contact Robert 

Goldenkoff at (202) 512-2757 or GoldenkoffR@gao.gov; or David Powner 

at (202) 512-9286 or PownerD@gao.gov.

2020 Census: Additional Actions Could Strengthen Field Data Collection 

Efforts. GAO-17-191. Washington, D.C.: January 26, 2017.

Information Technology: Better Management of Interdependencies 

between Programs Supporting 2020 Census Is Needed. GAO-16-623. 

Washington, D.C.: August 9, 2016.

2020 Census: Census Bureau Needs to Improve Its Life-Cycle Cost 

Estimating Process. GAO-16-628. Washington, D.C.: June 30, 2016.

2020 Census: Additional Actions Would Help the Bureau Realize 

Potential Administrative Records Cost Savings. GAO-16-48. Washington, 

D.C.: October 20, 2015.

2020 Census: Key Challenges Need to Be Addressed to Successfully 

Enable Internet Response. GAO-15-225. Washington, D.C.: February 5, 

2015.

2020 Census: Census Bureau Can Improve Use of Leading Practices 

When Choosing Address and Mapping Sources. GAO-15-21. 

Washington, D.C.: October 2, 2014.

 19GAO-16-628.

GAO Contact

Related GAO 

Products
2020 Decennial Census

Page 231 GAO-17-317 High-Risk Series

2020 Census: Bureau Needs to Improve Scheduling Practices to 

Enhance Ability to Meet Address List Development Deadlines. 

GAO-14-59. Washington, D.C.: November 21, 2013.

2020 Census: Additional Steps Are Needed to Build on Early Planning. 

GAO-12-626. Washington, D.C.: May 17, 2012.

Decennial Census: Additional Actions Could Improve the Census 

Bureau’s Ability to Control Costs for the 2020 Census. GAO-12-80. 

Washington, D.C.: January 24, 2012.

2010 Census: Census Bureau Has Made Progress on Schedule and 

Operational Control Tools, but Needs to Prioritize Remaining System 

Requirements. GAO-10-59. Washington, D.C.: November 13, 2009.
U.S. Government’s Environmental Liability

Page 232 GAO-17-317 High-Risk Series

The federal government’s environmental liability has been growing for the 

past 20 years and is likely to continue to increase. For fiscal year 2016, 

the federal government’s estimated environmental liability was $447 

billion—up from $212 billion for fiscal year 1997.1 However, this estimate 

does not reflect all of the future cleanup responsibilities federal agencies 

may face. Because of the lack of complete information and the often 

inconsistent approach to making cleanup decisions, federal agencies 

cannot always address their environmental liabilities in ways that 

maximize the reduction of health and safety risks to the public and the 

environment in a cost effective manner.

The federal government is financially liable for cleaning up areas where 

federal activities have contaminated the environment. Various federal 

laws, agreements with states, and court decisions require the federal 

government to clean up environmental hazards at federal sites and 

facilities—such as nuclear weapons production facilities and military 

installations. Such sites are contaminated by many types of waste.

Federal accounting standards require agencies responsible for cleaning 

up contamination to estimate future cleanup and waste disposal costs 

and to report such costs in their annual financial statements as 

environmental liabilities. Per federal accounting standards, federal 

agencies’ environmental liability estimates are to include probable and 

reasonably estimable costs of cleanup work. Where the federal 

government is not legally responsible for environmental cleanup, but 

acknowledges that it will assume financial responsibility for the cleanup, a 

liability is recorded for unpaid amounts due, not necessarily the full cost of 

cleanup. Also, where the government is legally responsible for 

environmental cleanup but there is no known technology to clean up a 

particular site, then known costs for which the entity is responsible, such 

as a remedial investigation, feasibility studies, and costs to contain the 

contamination, are recorded as a liability. Further, federal agencies’

environmental liability estimates do not include cost estimates for work for 

which reasonable estimates cannot currently be generated. 

Consequently, the ultimate cost of addressing the U.S. government’s 

environmental cleanup is likely greater than $447 billion. Federal 

agencies’ approaches to addressing their environmental liabilities and 

cleaning up the contamination from past activities are often influenced by 

 1

As used herein, environmental liabilities includes environmental and disposal liabilities.

U.S. Government’s Environmental Liability

Why Area Is High 

Risk
U.S. Government’s Environmental Liability

Page 233 GAO-17-317 High-Risk Series

numerous site-specific factors, stakeholder agreements, and legal 

provisions.

We have also found that some agencies do not take a holistic, riskinformed approach to environmental cleanup that aligns limited funds with 

the greatest risks to human health and the environment. Since 1994, we 

have made at least 28 recommendations related to addressing the federal 

government’s environmental liability. These include 22 recommendations 

to the Department of Energy (DOE) or the Department of Defense (DOD), 

1 recommendation to the Office of Management and Budget to consult 

with Congress on agencies’ environmental cleanup costs, 1 

recommendation to the Department of Agriculture (USDA), and 4 

recommendations to Congress to change the law governing cleanup 

activities. Of these, 13 recommendations remain unimplemented. If 

implemented, these steps would improve the completeness and reliability 

of the estimated costs of future cleanup responsibilities and lead to more 

risk-based management of the cleanup work.

Future progress in addressing the U.S. government’s environmental 

liabilities depends, among other things, on how effectively federal 

departments and agencies set priorities, under increasingly restrictive 

budgets, that maximize the risk reduction and cost-effectiveness of 

cleanup approaches. As a first step, some departments and agencies 

may need to improve the completeness of information about long-term 

cleanup responsibilities and their associated costs so that decision 

makers, including Congress, can consider the full scope of the federal 

government’s cleanup obligations. As a next step, certain departments, 

such as DOE, may need to change how they establish cleanup priorities. 

For example, DOE’s current practice of negotiating agreements with 

individual sites without considering other sites’ agreements or available 

resources may not ensure that limited resources will be allocated to 

reducing the greatest environmental risks, and costs will be minimized.

We have recommended actions to federal agencies that, if implemented, 

would improve the completeness and reliability of the estimated costs of 

future cleanup responsibilities and lead to more risk-based management 

of the cleanup work.

What Remains to Be 

Done
U.S. Government’s Environmental Liability

Page 234 GAO-17-317 High-Risk Series

• In 1994, we recommended that Congress amend certain legislation to 

require agencies to report annually on progress in implementing plans 

for completing site inventories, estimates of the total costs to clean up 

their potential hazardous waste sites, and agencies’ progress toward 

completing their site inventories and on their latest estimates of total 

cleanup costs. We believe these recommendations are as relevant, if 

not more so, today.

• In 2015, we recommended that the USDA develop plans and 

procedures for completing their inventories of potentially contaminated 

sites. USDA disagreed with this recommendation. However, we 

continue to believe that USDA’s inventory of contaminated and 

potentially contaminated sites—in particular, abandoned mines, 

primarily on Forest Service land—is insufficient for effectively 

managing USDA’s overall cleanup program. Interior is also faced with 

an incomplete inventory of abandoned mines that they are working to 

improve.

• In 2006, we recommended that DOD develop, document, and 

implement a program for financial management review, assessment, 

and monitoring of the processes for estimating and reporting 

environmental liabilities. This recommendation has not been 

implemented.

• We have found in the past that DOE’s cleanup strategy is not riskbased and should be re-evaluated. DOE’s decisions are often driven 

by local stakeholders and certain requirements in federal facilities 

agreements and consent decrees. In 1995, we recommended that 

DOE set national priorities for cleaning up its contaminated sites using 

data gathered during ongoing risk evaluations. This recommendation 

has not been implemented.

• In 2003, we recommended that DOE ask Congress to clarify its 

authority for designating certain waste with relatively low levels of 

radioactivity as waste incidental to reprocessing, and therefore not 

managed as high-level waste. In 2004, DOE received this specific 

authority from Congress for the Savannah River and Idaho Sites,2

thereby allowing DOE to save billions of dollars in waste treatment 

costs. The law, however, excluded the Hanford Site.

 2

Pub. L. No. 108-375, § 3116 (2004).

Completeness of 

Environmental Liability 

Estimates

Reliability of 

Environmental Liability 

Estimates

Risk-Based DecisionMaking
U.S. Government’s Environmental Liability

Page 235 GAO-17-317 High-Risk Series

More recently, in 2015 we found that DOE is not comprehensively 

integrating risks posed by National Nuclear Security Administration’s 

(NNSA) nonoperational contaminated facilities with EM’s portfolio of 

cleanup work.3 By not integrating nonoperational facilities from NNSA, 

EM is not providing Congress with complete information about EM’s 

current and future cleanup obligations as Congress deliberates annually 

about appropriating funds for cleanup activities. We recommended that 

DOE integrate its lists of facilities prioritized for disposition with all NNSA 

facilities that meet EM’s transfer requirements, and that EM should 

include this integrated list as part of the Congressional Budget 

Justification for DOE. DOE neither agreed nor disagreed with this 

recommendation.

Of the federal government’s estimated $447 billion environmental 

liability—up from $212 billion for fiscal year 19974

—DOE is responsible 

for by far the largest share of the liability and DOD is responsible for the 

second largest share. The rest of the federal government makes up the 

remaining 3 percent of the liability with agencies such as the National 

Aeronautics and Space Administration (NASA) and the Departments of 

Transportation, Veterans Affairs, USDA, and Interior holding large 

liabilities (see figure 13).

 3

NNSA has identified 83 contaminated facilities for potential transfer to EM for disposition 

over a 25-year period, 56 of which are currently nonoperational. NNSA is maintaining 

these facilities for future transfer to EM, but the condition of nonoperational facilities 

continues to degrade, resulting in increasing costs to NNSA to maintain them to prevent 

the spread of contamination.

4

We did not adjust environmental liability estimates for inflation because information about 

the amount of the liability applicable to each fiscal year was not available.

Additional Details on 

What GAO Found
U.S. Government’s Environmental Liability

Page 236 GAO-17-317 High-Risk Series

Figure 13: Total Reported U.S. Environmental Liability, Fiscal Year 2016

Note: We did not adjust environmental liability estimates for inflation because information about the 

amount of the liability applicable to each fiscal year was not available.

DOE was responsible for over 80 percent ($372 billion) of the U.S. 

government’s fiscal year 2016 reported environmental liability, mostly 

related to nuclear waste cleanup.5 DOE’s total reported environmental 

liability has generally increased since fiscal year 2000 (see figure 14). 

According to audit documentation related to DOE’s fiscal year 2016 

financial statements, 50 percent of the DOE’s environmental liability 

resides at two cleanup sites: the Hanford Site in Washington State and 

the Savannah River Site in South Carolina.

 5

The majority of DOE’s annual environmental cleanup funding—over 80 percent in fiscal 

year 2016—comes from annual defense authorization spending.

Department of Energy
U.S. Government’s Environmental Liability

Page 237 GAO-17-317 High-Risk Series

Figure 14: Total Reported Department of Energy Environmental Liability, Fiscal Years 2000 to 2016

Note: We did not adjust environmental liability estimates for inflation because information about the 

amount of the liability applicable to each fiscal year was not available.

Since 1989, DOE’s Office of Environmental Management (EM) has spent 

over $164 billion to retrieve, treat, and dispose of nuclear and hazardous 

waste and to date has completed cleanup at 91 of 107 sites across the 

country. (The 91 sites were generally viewed by the department as the

smallest and least contaminated sites to address.) Despite billions spent 

on environmental cleanup, DOE’s environmental liability has roughly 

doubled from a low of $176 billion in fiscal year 1997 to the fiscal year 

2016 estimate of $372 billion. In the last 6 years alone, EM has spent $35 

billion, primarily to treat and dispose of nuclear and hazardous waste and 

construct capital asset projects to treat the waste, while EM’s portion of 

the environmental liability has grown over this same time period by over 

$90 billion, from $163 billion to $257 billion (see figure 15).
U.S. Government’s Environmental Liability

Page 238 GAO-17-317 High-Risk Series

Figure 15: Department of Energy’s Office of Environmental Management’s Annual 

Spending and Growing Environmental Liability

Note: EM is the organization within the Department of Energy responsible for managing 

environmental cleanup and is responsible for cleaning up 107 sites across the country. To date, EM 

has completed cleanup at 91 of these sites. EM spending includes money to treat and dispose of 

nuclear and hazardous waste and to construct capital asset projects to treat the waste. We did not 

adjust environmental liability estimates for inflation because information about the amount of the 

liability applicable to each fiscal year was not available.

In its fiscal year 2016 financial statement, DOE attributed recent 

environmental liability increases to (1) inflation adjustments for the current 

year; (2) improved and updated estimates for the same scope of work, 

including changes resulting from deferral or acceleration of work; (3) 

revisions in technical approach or scope for cleanup activities; and (4) 

regulatory and legal changes. Notably, in recent annual financial reports, 

DOE has cited other significant causes for increases in the liability. Other 

causes have included the lack of a disposal path for high-level radioactive 

waste—because of the termination of the Yucca Mountain repository 
U.S. Government’s Environmental Liability

Page 239 GAO-17-317 High-Risk Series

program —and delays and scope changes for major construction projects 

at the Hanford and Savannah River sites.6

We testified in February 2016 that DOE’s estimated liability does not 

include billions in expected costs. According to government accounting 

standards, environmental liability estimates include costs that are 

probable and reasonably estimable, meaning that costs that cannot yet 

be reasonably estimated are not included in total environmental liability.7

Examples of costs that DOE cannot yet estimate include the following:

• DOE has not yet developed a cleanup plan or cost estimate for the 

Nevada National Security Site and, as a result, the cost of future 

cleanup of this site was not included in DOE’s fiscal year 2015 

reported environmental liability. The nearly 1,400-square-mile site has 

been used for hundreds of nuclear weapons tests since 1951. These 

activities have resulted in more than 45 million cubic feet of 

radioactive waste at the site. According to DOE’s financial statement, 

since DOE is not yet required to establish a plan to clean up the site, 

the costs for this work are excluded from DOE’s annually reported 

environmental liability.

• DOE’s reported environmental liability includes an estimate for the 

cost of a permanent nuclear waste repository, but these estimates are 

highly uncertain and likely to increase. In response to the termination 

of the Yucca Mountain repository program, DOE proposed separate 

repositories for defense high-level and commercial waste in March 

2015. In January 2017, we reported that the cost estimate for DOE’s 

new approach excluded the costs and time frames for key activities. 

 6

In June 2008, DOE submitted a license application to the NRC seeking authorization to 

construct a high-level nuclear waste repository at Yucca Mountain. In the application, DOE 

stated that it planned to open the repository in 2017. DOE later delayed the date to 2020. 

In March 2009, however, the Secretary of Energy announced plans to terminate the Yucca 

Mountain repository program and instead study other nuclear waste options. The 

President’s fiscal year 2011 budget proposal, released in February 2010, proposed 

eliminating all funding for the Yucca Mountain repository program. For more information, 

see GAO, Commercial Nuclear Waste: Effects of a Termination of the Yucca Mountain 

Repository Program and Lessons Learned, GAO-11-229 (Washington D.C.: Apr. 8, 2011).

7

Federal Accounting Standards Advisory Board, FASAB Handbook of Federal Accounting 

Standards and Other Pronouncements, as Amended (Washington, D.C.: June 30, 2016).
U.S. Government’s Environmental Liability

Page 240 GAO-17-317 High-Risk Series

As a result, the full cost of these activities is likely more than what is 

reflected in DOE’s environmental liability.8

There are several possible causes for the large and growing amount of 

money that DOE will need to meet its cleanup responsibilities. First, as 

our and other organizations’ reports issued over the last 2 decades have 

found, DOE’s environmental cleanup decisions are not risk-based and its 

risk-based decision making is sometimes impeded by selection of 

cleanup remedies that are not appropriately tailored to the risks 

presented, and inconsistencies in the regulatory approaches followed at 

different sites. We and others have pointed out that DOE needs to take a 

nation-wide, risk-based approach to cleaning up these sites, which could 

reduce costs while also reducing environmental risks more quickly. 

Examples include the following:

• In 1995, we found that DOE’s cleanup strategy had been shaped by 

site-specific environmental agreements whose priorities and 

requirements had not always been consistent with technical or fiscal 

realities and that, under severe budgetary constraints, using many 

separately-negotiated agreements is not well suited to setting 

priorities among sites.9 We recommended that DOE set national 

priorities for cleaning up its contaminated sites. DOE responded at 

that time that because of limitations on the science of risk 

assessment, it had no intention of developing national, risk-based 

priorities for its cleanup work. In a later report, we found that DOE’s 

compliance agreements did not provide a means of prioritizing among 

sites and, therefore, DOE had not developed a comprehensive, 

relative ranking of the risks that it faces across its sites. DOE has 

been unsuccessful in its attempts to develop such a methodology in 

the past and, as a result, DOE has no systematic way to make

cleanup decisions among sites based on risk.

• In 2006, the National Academy of Sciences (the Academy) reported 

that the nation’s cleanup approach—primarily carried out by DOE 

among other agencies—was complex, inconsistent, and not 

systematically risk-based. For example, the Academy noted that the 

current regulatory structure for low activity waste is based primarily on 

 8

GAO, Nuclear Waste: Benefits and Costs Should Be Better Understood Before DOE 

Commits to a Separate Repository for Defense Waste, GAO-17-174 (Washington, D.C.: 

Jan. 31, 2017).

9

GAO, Department of Energy: National Priorities Needed for Meeting Environmental 

Agreements, GAO/RCED-95-1 (Washington, D.C.: Mar. 3, 1995).
U.S. Government’s Environmental Liability

Page 241 GAO-17-317 High-Risk Series

the waste’s origins rather than on its actual radiological risks. The 

Academy concluded that by working with regulators, public 

authorities, and local citizens to implement risk-informed practices, 

waste cleanup efforts can be done more cost-effectively. The report 

also suggested that statutory changes were likely needed. In 2011, 

the Academy also reported that DOE could realize significant benefits 

by providing more realistic safety- and risk-informed analyses.

• In 2015, a review organized by the Consortium for Risk Evaluation 

with Stakeholder Participation reported that DOE is not optimally 

using available resources to reduce risk.10 According to the report, 

factors such as inconsistent regulatory approaches and certain 

requirements in federal facility agreements cause disproportionate 

resources to be directed at lower priority risks. The report called for a 

more systematic effort to assess and rank risks within and among 

sites, including through headquarters guidance to sites, and to 

allocate federal taxpayer monies to remedy the highest priority risks 

through the most efficient means.

Second, DOE’s cleanup approach is based primarily on a series of 

compliance agreements and consent orders between DOE, the 

Environmental Protection Agency (EPA), and state regulators. According 

to one DOE official, 40 such agreements establish the requirements for 

DOE’s cleanup work. We have reported in the past that these agreements 

include thousands of associated milestones. Some of the 40 agreements 

were made decades ago and may be based on outdated information 

about the effectiveness of certain cleanup technologies.

Third, DOE may have insufficient controls in place to accurately account 

for its environmental liabilities. In January 2017, the DOE Inspector 

General reported a significant deficiency in internal control related to the 

reconciliation of environmental liabilities.

DOD was responsible for the second largest share of the federal 

government’s reported environmental liability—$63 billion in fiscal year 

2016. DOD’s total reported environmental liability has remained relatively 

constant since fiscal year 2000 (see figure 16). We have found in the past 

that DOD has spent billions on environmental cleanup and restoration at 

 10The Consortium for Risk Evaluation with Stakeholder Participation is a multi-university 

consortium organized in 1995 that provides several types of independent, multidisciplinary reviews of DOE documents, projects, and reports.

Department of Defense
U.S. Government’s Environmental Liability

Page 242 GAO-17-317 High-Risk Series

its sites. In July 2010, we reported that DOD spent almost $30 billion from 

1986 to 2008 across its environmental cleanup and restoration activities 

at its installations.11 More recently, in its July 2016 annual report to 

Congress on environmental cleanup, DOD reported spending an average 

of about $1.8 billion each year for its environmental cleanup activities 

from fiscal years 2011 to 2016.

Figure 16: Total Reported Department of Defense Environmental Liability, Fiscal Years 2000 to 2016

Note: We did not adjust environmental liability estimates for inflation because information about the 

amount of the liability applicable to each fiscal year was not available.

DOD’s $63 billion reported environmental liability includes cleanup 

responsibilities for base realignment and closure (BRAC), disposal of 

weapon systems, and environmental cleanup and restoration of DOD 

sites. Our recent work found that DOD’s environmental liability is likely to 

exceed its current estimate because a number of activities are not fully 

included in the estimate; the activities are not included because their 

scopes are not yet known. Notably, we reported in February 2014 that our 

audit of the government’s consolidated financial statements found that 

 11GAO, Superfund: Interagency Agreements and Improved Project Management Needed 

to Achieve Cleanup Progress at Key Defense Installations, GAO-10-348 (Washington, 

D.C.: July 15, 2010).
U.S. Government’s Environmental Liability

Page 243 GAO-17-317 High-Risk Series

DOD’s inability to estimate with assurance key components of its 

environmental liabilities was a material weakness. We reported in 

January 2017 that this weakness still exists. Examples of uncertainties in 

DOD reported environmental liabilities include the following:

• DOD’s current environmental liability estimate does not include 

additional costs that will likely be needed for DOD to complete the 

cleanup for BRAC activities. We reported in January 2017 that DOD 

estimates it will need about $3.4 billion in addition to the $11.5 billion it 

has already spent to manage and complete environmental cleanup of 

BRAC installations.12 We also found that DOD’s annual report on its 

environmental cleanup program does not include significant costs 

associated with cleanup of contaminants at its installations, including 

those closed under BRAC.

• DOD’s estimate does not include the total costs associated with 

cleaning up weapons sites. According to DOD’s fiscal year 2015 

Agency Financial Report (AFR), DOD is unable to estimate and report 

a liability for the environmental restoration that is needed to clean up 

buried chemical munitions and agents at certain sites, among other 

things, because the extent of the buried chemical munitions and 

agents is unknown.13

• DOD may also incur costs not currently included in its environmental 

liability estimate for restoration initiatives in conjunction with returning 

overseas DOD facilities to host nations. According to DOD’s fiscal 

year 2015 AFR, DOD is unable to provide a reasonable estimate 

because the extent of required restoration is unknown.

The remainder of the U.S. government’s estimated environmental liability 

(about $12 billion in fiscal year 2016) was managed by numerous 

departments and agencies and, similar to the DOE and DOD portions, is 

likely to increase. Federal agencies with large reported environmental 

liabilities in fiscal year 2016 included NASA, USDA, and the Departments 

of Transportation, Veterans Affairs, and Interior. Since 2000, the reported 

environmental liability for these agencies has also increased (see figure 

17).

 12GAO, Military Base Realignments and Closures: DOD Has Improved Environmental 

Cleanup Reporting but Should Obtain and Share More Information, GAO-17-151 

(Washington, D.C.: Jan. 19, 2017).

13DOD had not yet issued a fiscal year 2016 financial statement at the time of publication.

Other Federal Agencies
U.S. Government’s Environmental Liability

Page 244 GAO-17-317 High-Risk Series

Figure 17: Change in Reported Environmental Liability for Selected Agencies, 

Fiscal Years 2000 to 2016

Note: We did not adjust environmental liability estimates for inflation because information about the 

amount of the liability applicable to each fiscal year was not available.

a

In fiscal year 2000, the Department of Agriculture did not include any estimated environmental 

liability in its financial statement but did include a note indicating that the Forest Service estimates 

cleanup for sites on National Forest System lands could cost $2.5 billion.

b

The figures used for the Department of Transportation are reported environmental liabilities for fiscal 

years 2001 and 2016 since the department’s fiscal year 2000 reported environmental liability of $2.28 

billion was incorrect according to a department official.

We have done work recently at USDA and Interior. We found in January 

2015 that the environmental liabilities for USDA and Interior do not 

include many contaminated and potentially contaminated sites—primarily 

abandoned mines—and that the ultimate costs of future cleanup are 

therefore likely much higher than what is currently reported in the these 

departments’ environmental liability estimates.14 Further, the extent to 

 14GAO, Hazardous Waste: Agencies Should Take Steps to Improve Information on 

USDA’s and Interior’s Potentially Contaminated Sites, GAO-15-35 (Washington, D.C.: 

Jan. 16, 2015).
U.S. Government’s Environmental Liability

Page 245 GAO-17-317 High-Risk Series

which the federal government will pay cleanup costs may depend on 

whether or not financially viable responsible parties, including current and 

former mine owners and operators, can be identified. Additionally, neither 

department has a complete inventory of its cleanup responsibilities. For 

example,

• USDA: For fiscal year 2016, USDA reported an environmental liability 

of $196 million. As of April 2014, USDA had identified 1,491 

contaminated sites but this list is incomplete as many more potentially 

contaminated sites, including abandoned mines, have not yet been 

identified. In 2015, we found that USDA does not have a reliable, 

centralized site inventory or plans and procedures for completing one, 

in particular for abandoned mines. For example, in fiscal year 2013, 

USDA reported $3 million for the Forest Service’s environmental 

liability. In 2015, we found that this figure did not include any cleanup 

costs for abandoned mines. The Forest Service estimates that there 

could be from 27,000 to 39,000 abandoned mines on its lands—

approximately 20 percent of which may pose some level of risk to 

human health or the environment—and the federal government may 

have to pay for cleanup of some of these mines. USDA’s Forest 

Service has not developed a complete, consistent, or usable inventory 

of abandoned mines and had no plans and procedures for developing 

such an inventory. Without a reliable inventory, USDA cannot 

effectively estimate its ultimate cost to cleanup these sites.

• Interior: For fiscal year 2016, Interior reported an environmental 

liability of about $830 million. We found in 2015 that Interior had an 

inventory of 4,722 sites, including 85 abandoned mines, with 

confirmed or likely contamination. However, Interior may have future 

cleanup responsibilities and, as a result, ultimate cleanup costs may 

exceed the currently reported environmental liability. Specifically, 

Interior’s Bureau of Land Management (BLM) has identified over 

30,000 abandoned mines—some of which will the federal government 

may have to pay to clean up—that have not yet been assessed for 

contamination. Furthermore, this inventory is not complete as BLM 

estimated that there are at least 100,000 abandoned mines that have 

not yet been inventoried. While cost estimates for addressing these 

mines are not currently included in Interior’s liability, information for 

certain types of mines indicates that the ultimate cost of Interior’s 

future cleanup responsibilities are greater than what is reflected in the 

reported environmental liability. BLM is working to improve the 

completeness and accuracy of its inventory.
U.S. Government’s Environmental Liability

Page 246 GAO-17-317 High-Risk Series

For additional information about this high-risk area, contact David 

Trimble, Director, Natural Resources and Environment, 202-512-3841 or 

trimbled@gao.gov.

Military Base Realignments and Closures: DOD Has Improved 

Environmental Cleanup Reporting but Should Obtain and Share More 

Information. GAO-17-151. Washington, D.C.: January 19, 2017.

Department of Energy: Observations on Efforts by NNSA and the Office 

of Environmental Management to Manage and Oversee the Nuclear 

Security Enterprise. GAO-16-422T. Washington, D.C.: February 23, 2016.

DOE Facilities: Better Prioritization and Life Cycle Cost Analysis Would 

Improve Disposition Planning. GAO-15-272. Washington, D.C.: March 19, 

2015.

Hazardous Waste: Agencies Should Take Steps to Improve Information 

on USDA’s and Interior’s Potentially Contaminated Sites. GAO-15-35. 

Washington, D.C.: January 16, 2015.

DOD Financial Management: Effect of Continuing Weaknesses on 

Management and Operations and Status of Key Challenges. 

GAO-14-576T. Washington, D.C.: May 13, 2014.

Uranium Mining: Opportunities Exist to Improve Oversight of Financial 

Assurances. GAO-12-544. Washington, D.C.: May 17, 2012.

Superfund: Interagency Agreements and Improved Project Management 

Needed to Achieve Cleanup Progress at Key Defense Installations. 

GAO-10-348. Washington, D.C.: July 15, 2010.

Military Base Closures: Opportunities Exist to Improve Environmental

Cleanup Cost Reporting and to Expedite Transfer of Unneeded Property. 

GAO-07-166. Washington, D.C.: January 30, 2007.

Environmental Liabilities: Long-Term Fiscal Planning Hampered by 

Control Weaknesses and Uncertainties in the Federal Government’s 

Estimates. GAO-06-427. Washington, D.C.: March 31, 2006.

Nuclear Waste: Challenges to Achieving Potential Savings in DOE’s 

High-Level Waste Cleanup Program. GAO-03-593. Washington, D.C.: 

June 17, 2003.

GAO Contact

Related GAO 

Products
U.S. Government’s Environmental Liability

Page 247 GAO-17-317 High-Risk Series

Long-Term Commitments: Improving the Budgetary Focus on 

Environmental Liabilities. GAO-03-219. Washington, D.C.: January 24, 

2003.

Environmental Liabilities: Cleanup Costs From Certain DOD Operations 

Are Not Being Reported. GAO-02-117. Washington, D.C.: December 14, 

2001.

Environmental Liabilities: DOD Training Range Cleanup Cost Estimates 

Are Likely Understated. GAO-01-479. Washington, D.C.: April 11, 2001.

Department of Energy: National Priorities Needed for Meeting 

Environmental Agreements. GAO/RCED-95-1. Washington, D.C.: March 

3, 1995.

Federal Facilities: Agencies Slow to Define the Scope and Cost of 

Hazardous Waste Site Cleanups. GAO/RCED-94-73. Washington, D.C.: 

April 15, 1994.
DOD Supply Chain Management

Page 248 GAO-17-317 High-Risk Series

The Department of Defense (DOD) manages about 4.9 million secondary 

inventory items, such as spare parts, with a reported value of $91.7 billion 

as of September 2015. Effective and efficient supply chain management 

is critical for supporting the readiness and capabilities of the force and for 

helping to ensure that DOD avoids spending resources on unneeded 

inventory that could be better applied to other defense and national 

priorities. However, DOD has experienced weaknesses in the 

management of its supply chain, particularly in the following areas:

• Inventory management. DOD’s inventory management practices 

and procedures have been ineffective and inefficient. DOD has 

experienced high levels of inventory that were in excess of 

requirements and weaknesses in accurately forecasting the demand 

for inventory items.

• Materiel distribution. DOD has faced challenges in delivering 

supplies and equipment, including not meeting delivery standards and 

timelines for cargo shipments as well as not maintaining complete 

delivery data for surface shipments.

• Asset visibility. DOD has had weaknesses in maintaining visibility of 

supplies, such as problems with inadequate radio-frequency 

identification information to track all cargo movements.

We added supply chain management to the High-Risk List in 1990. In our 

February 2015 update, we reported that DOD had made moderate 

progress in addressing weaknesses in supply chain management, but 

had not resolved several long-standing problems. For example, DOD had 

not developed a corrective action plan to address materiel distribution 

weaknesses or performance metrics based on reliable data to assess 

performance across the entire distribution pipeline. With respect to asset 

visibility, DOD had not fully developed performance measures that will 

effectively ensure that the department’s initiatives improve asset visibility.

DOD Supply Chain Management

Why Area Is High 

Risk
DOD Supply Chain Management

Page 249 GAO-17-317 High-Risk Series

Since our February 2015 high-risk update, DOD has made progress in 

addressing all three dimensions of its supply chain management: 

inventory management, materiel distribution, and asset visibility. For 

inventory management, DOD has met all five high-risk criteria. For this 

reason, we are removing inventory management from the supply chain 

management high-risk area. For materiel distribution, DOD has continued 

to demonstrate leadership commitment and capacity and has developed 

a corrective action plan to guide and direct the department’s efforts to 

improve materiel distribution support to the warfighter. However, work 

remains to fully meet the monitoring and demonstrated progress high-risk 

criteria. For asset visibility, DOD has continued to meet the leadership 

commitment criteria and has met the capacity and corrective action plan 

criteria—the latter in fiscal year 2015 by updating and implementing the 

Strategy for Improving DOD Asset Visibility (Strategy). However, 

additional actions are needed to fully meet the remaining two criteria—

monitoring and demonstrated progress. In a December 2016 letter from 

the Under Secretary of Defense for Acquisition, Technology, and 

Logistics to the Chairman of the Committee on Oversight and 

Government Reform, U.S. House of Representatives, the department 

generally agreed with our assessment of progress made and outlined 

ongoing and planned actions to address the remaining issues.

In October 2014, we provided DOD with a letter that outlined six actions 

and outcomes that we believe it should address in order to mitigate or 

resolve long-standing weaknesses in materiel distribution and address 

the criteria for removal from the High-Risk List. Based on discussions with 

DOD officials and recent efforts across the department as of November 

2016, we believe that DOD has addressed three of the six actions and 

outcomes. Specifically, DOD has addressed the actions and outcomes 

associated with the action plan criterion by developing the Materiel 

Distribution Improvement Plan (Improvement Plan) that contains 

implementation goals and timelines that will guide its effort to identify 

gaps and root causes with respect to the performance of the entire

distribution pipeline. However, DOD still needs to address the three 

remaining actions and outcomes from the October 2014 letter that are 

related to monitoring and demonstrating progress. Additionally, based on 

our review of DOD’s efforts to improve materiel distribution, we are 

What GAO Found

What Remains to Be 

Done

Materiel Distribution
DOD Supply Chain Management

Page 250 GAO-17-317 High-Risk Series

adding an additional action focused on ensuring DOD refines and 

updates its actions in the Improvement Plan based on interim progress 

and results, which results in four remaining actions and outcomes that 

need to be addressed for removal of materiel distribution from the HighRisk List. Going forward, DOD needs to show measureable and sustained 

positive outcomes addressing the remaining four actions and outcomes.

DOD should

• make progress in developing its suite of distribution performance 

metrics, improving the quality of data underlying those metrics, and 

sharing metrics information among stakeholders;

• integrate distribution metrics data, including cost data, from the 

combatant commands and other DOD components, as appropriate, 

on the performance of all legs of the distribution system, including the 

tactical leg; and

• refine existing actions in the Improvement Plan or incorporate 

additional actions based on interim progress and results, and update 

the Improvement Plan accordingly.

DOD should

• demonstrate that the actions implemented under its Improvement 

Plan improve its capability to comprehensively measure distribution 

performance, identify distribution problems and root causes, and 

identify and implement solutions.

Our October 2014 letter to DOD outlined seven actions and outcomes 

that we believe it should address in order to mitigate or resolve longstanding weaknesses in asset visibility and address the criteria for 

removal from the High-Risk List. Based on discussions with DOD officials 

and recent efforts across the department as of January 2017, we believe 

that DOD has addressed five of the seven actions and outcomes. 

Specifically, DOD has addressed the actions and outcomes associated 

with the capacity and action plan criteria by the department providing 

additional direction to the components on formulating cost estimates and 

the components implementing that direction in developing its cost 

estimates for the asset visibility initiatives.

Additionally, DOD linked the goals and objectives of the Strategy with the 

specific initiatives intended to implement the Strategy, established a 

mechanism for periodically assessing the initiatives, and implemented 

Monitoring

Demonstrated Progress

Asset Visibility
DOD Supply Chain Management

Page 251 GAO-17-317 High-Risk Series

numerous initiatives. Based on our review of DOD’s efforts to improve 

asset visibility, we are adding an additional action aimed at improving the 

monitoring of the individual improvement initiatives, which results in three 

remaining actions and outcomes that need to be addressed for removal of 

asset visibility from the High-Risk List. Going forward, DOD needs to 

show measureable and sustained positive outcomes in addressing these 

remaining three actions and outcomes.

DOD should

• assess, and refine as appropriate, performance measures by, for 

example, incorporating the attributes (e.g., clear, quantifiable, 

objective, and reliable) of successful performance measures; and

• take steps to incorporate into after-action reports information relating 

to performance measures for the asset visibility initiatives.

DOD should demonstrate sustained progress in having implemented the 

initiatives that result in measurable outcomes and progress towards 

realizing the goals and objectives in the Strategy.

Monitoring

Demonstrated Progress

Additional Details on

What GAO Found

Inventory Management
DOD Supply Chain Management

Page 252 GAO-17-317 High-Risk Series

Senior officials, such as the Deputy Assistant Secretary of Defense for 

Supply Chain Integration (DASD(SCI)), have continued to demonstrate 

commitment and top leadership support for addressing the department’s 

inventory management challenges. These officials have taken actions, 

such as establishing a performance management framework to monitor 

and implement its corrective action plan since 2010 and revising inventory 

management policy and guidance, to institutionalize this commitment to 

help ensure the long-term success of the department’s efforts. In addition, 

senior DOD officials have met with us to discuss the department’s plans 

and progress in addressing inventory management challenges, and we 

have provided feedback on the department’s efforts.

DOD has continued to demonstrate that it has the capacity—personnel 

and resources—to strengthen inventory management. DOD has 

continued to use structured working groups, which include

representatives from each of the military services and the Defense 

Logistics Agency (DLA), to address inventory management weaknesses. 

Furthermore, DOD has dedicated financial resources to evaluating 

aspects of inventory management that need improvement, such as 

commissioning studies designed to improve forecasting for spare parts.

DOD has continued to implement its corrective action plan, established in 

fiscal year 2010, that had actions and goals scheduled through fiscal year 

2016, and has developed a follow-on improvement plan to guide efforts 

through 2020. As noted in our February 2015 update, DOD established 

overarching goals to reduce “on-order excess inventory” (i.e., items that 

have already been purchased but may be excess due to changes in 

requirements) and “on-hand excess inventory” (i.e., items that have been 

categorized for potential reuse or disposal). Additionally, DOD’s actions in 

its original and follow-up plans address key root causes of weaknesses in 

its inventory management, such as excess inventory and demand 

forecasting for spare parts. Since our February 2015 update, DOD has 

continued to implement actions associated with the plan across a number 

of areas of inventory management, such as demand forecasting, and has 

developed and begun implementing a follow-on improvement plan with 

actions and milestones intended to guide the department’s improvement 

efforts through 2020.

DOD has continued to use a performance management framework, 

including metrics and milestones, to track the implementation and 

effectiveness of the areas of inventory management included in the 

corrective action plan. The DASD(SCI) oversees implementing the 

corrective action plan and monitors performance on the associated 

Leadership Commitment

Capacity

Action Plan

Monitoring
DOD Supply Chain Management

Page 253 GAO-17-317 High-Risk Series

metrics through progress review meetings with representatives from the 

military services and DLA. The meetings are held about monthly.

Since fiscal year 2010, DOD has demonstrated sustained progress 

sufficient to remove the inventory management area from the supply 

chain management high-risk category. Specifically, DOD has 

demonstrated progress in the following four key areas of inventory 

management, and used our findings and implemented our 

recommendations to improve the department’s management of inventory:

• Reducing excess inventory: Since fiscal year 2009, DOD has 

reduced the percentage and value of its on-order excess inventory—

items already purchased that may be excess due to subsequent 

changes in requirements—and its on-hand excess inventory—items 

categorized for potential reuse or disposal. DOD’s data show that the 

proportion of on-order excess inventory to the total amount of onorder inventory decreased from 9.5 percent at the end of fiscal year 

2009 to 7.0 percent at the end of fiscal year 2015, the most recent 

fiscal year for which data is available. During these years, the value of 

on-order excess inventory also decreased from $1.3 billion to $701 

million. DOD’s data show that the proportion of on-hand excess 

inventory to the total amount of on-hand inventory dropped from 9.4 

percent at the end of fiscal year 2009 to 7.3 percent at the end of 

fiscal year 2015. The value of on-hand excess inventory also 

decreased during these years from $8.8 billion to $6.8 billion. DOD 

plans to continue to monitor the amount of excess inventory in its 

follow-on improvement plan.

• Revising policy and guidance: DOD has made key revisions to its 

inventory management policy and guidance. Based on analysis 

conducted as part of its corrective action plan, the department 

updated its main supply chain management policy in February 2014. 

The update strengthened its guidance for on-order excess inventory, 

the management of “retention stock” (i.e., inventory calculated to be 

more economical to keep than to dispose of and repurchase because 

it will likely be needed in the future or inventory retained to support 

specific contingencies), and demand forecasting. DOD subsequently 

continued to update aspects of the guidance, such as adding 

requirements associated with overseeing contractor-managed 

inventory in August 2015. DOD also developed and implemented, in 

March 2016, a guide that standardizes inventory management metrics 

across the services and DLA. Lastly, DOD developed and began 

implementing plans to update its policy and guidance as it continues 

Demonstrated Progress
DOD Supply Chain Management

Page 254 GAO-17-317 High-Risk Series

to oversee inventory management through its follow-on improvement 

plan.

• Addressing demand forecasting weaknesses: As we noted in our 

February 2015 update, DOD has taken actions to improve the 

accuracy of its demand forecasting for spare parts in an effort to 

address a key root cause of both excess inventory and parts 

shortages. First, in fiscal years 2010 through 2014, DOD reviewed its 

demand forecasting methods, which led to a number of changes in 

DOD’s guidance to the services and DLA aimed at improving the 

accuracy of demand forecasting.

Second, DOD established department-wide forecasting accuracy 

metrics in 2013. Its key metric helped department officials determine 

that their forecast accuracy has improved from 46.7 percent in fiscal 

year 2013 to 57.4 percent in fiscal year 2015, the latest fiscal year for 

which complete data are available. As of August 2016, since our 

February 2015 update, DOD has been working to establish 

procedures, including statistical techniques, for setting appropriate 

targets to continue to guide improvement in the accuracy of 

forecasting the demand for spare parts.

Third, DOD and DLA, in fiscal year 2013, modified approaches for 

setting inventory levels for over 495,000 consumable items with low or 

highly variable demand, and continue to monitor the effect of these 

changes through a suite of performance metrics. The Air Force also is 

in the process of implementing a similar method for setting levels for 

reparable items with low demand and is refining an approach for 

reparable items with variable demand and conducting additional 

analysis before deciding to implement it.

Fourth, DOD has made progress improving its collaborative 

forecasting (i.e., using customer input to forecast demand versus 

relying solely on statistical forecasting methods) for spare parts. 

Specifically, we found in June 2016 that DLA partnered with the 

services to improve collaborative forecasting efforts through an 

analytical, results-oriented approach, such as regularly monitoring key 

performance metrics. The approach is tailored for each service, and 

DOD identified in its follow-on improvement plan that it will analyze 

these different approaches and assess areas for improvement in an 

effort to further reduce excess inventory and shortages. DLA also 

designed an additional metric for its collaborative forecasting program 

to more accurately assess and manage the program and plans to fully 

implement the metric by July 2017. DOD also is in the process of 
DOD Supply Chain Management

Page 255 GAO-17-317 High-Risk Series

designing and adopting metrics to assess the accuracy of inventory 

planning factors, such as the accuracy of part lists that are used to 

determine the type and quantity of parts to buy for depot maintenance 

activities, and plans to implement these metrics by the end of fiscal 

year 2018.

• Enhancing the management and oversight of retention stock: 

DOD has continued to take actions to improve the management of 

retention stock across the department. For example, since fiscal year 

2009, DOD has monitored the amount of its retention stock relative to 

on-hand inventory, reviewed and updated its policy and guidance for 

retention stock, and taken steps to ensure retention stock is managed 

consistently across the department. Further, in response to our June 

2014 recommendation for the DLA Director to dispose of retention 

stock based on the results of an economic analysis, the Director 

changed DLA’s on-hand inventory reduction goal, which was leading 

DLA to dispose of items that the department’s guidance and DLA’s 

analysis showed were more economical to keep. With respect to 

“contingency retention stock” (i.e., items retained to support specific 

contingencies, such as disaster relief or civil emergencies), the 

department independently assessed its management in March 2011 

and implemented resulting recommendations, such as establishing 

categories and tracking the reasons for retaining contingency 

retention stock.

Lastly, DOD has used our findings and implemented our 

recommendations to improve how it manages inventory. Since May 2006, 

we have made 63 recommendations aimed at improving the efficiency 

and effectiveness of the department’s inventory management. As of

January 2017, DOD has implemented 42 of those recommendations and 

was in the process of taking actions to implement an additional 13 

recommendations, which are focused generally on re-assessing inventory 

goals, improving collaborative forecasting, and making changes to 

information technology systems used to manage inventory. The 

remaining eight recommendations were made in fiscal years 2007 and 

2009 and focused on improving the management of acquisition lead times 

for spare parts and oversight of Army and Navy inventory management, 

respectively. However, these recommendations are no longer relevant 

given the department’s efforts since 2010.
DOD Supply Chain Management

Page 256 GAO-17-317 High-Risk Series

Senior leaders have continued to demonstrate commitment and support 

for addressing the department’s materiel distribution challenges. In April 

2015, DOD established a distribution working group to draft a plan of 

actions and milestones for improving materiel distribution. The working 

group is co-chaired by the Office of the Deputy Assistant Secretary of 

Defense for Supply Chain Integration and the U.S. Transportation 

Command (USTRANSCOM). Other stakeholders include the Office of the 

Deputy Assistant Secretary of Defense for Transportation Policy, the 

military services, the Joint Staff, and DLA. As a result of the working 

group’s efforts, DOD completed its Materiel Distribution Improvement 

Plan (Improvement Plan), and the Acting Assistant Secretary of Defense 

for Logistics and Materiel Readiness signed it in September 2016.

According to the Improvement Plan, the Supply Chain Executive Steering 

Committee will receive regular updates on the progress of the 

Improvement Plan’s implementation. The steering committee is chaired 

by the Deputy Assistant Secretary for Supply Chain Integration and 

includes senior-level supply chain stakeholders from across DOD. Under 

its charter, the steering committee oversees implementation of initiatives 

designed to improve logistics.

DOD has continued to demonstrate that it has the capacity—personnel 

and resources—to improve materiel distribution. Key organizations in 

DOD’s global distribution system and its associated governance structure 

are USTRANSCOM, its military components, and DLA. Although the 

Materiel Distribution

Leadership Commitment

Capacity
DOD Supply Chain Management

Page 257 GAO-17-317 High-Risk Series

Improvement Plan does not quantify the level of resources required to 

accomplish corrective actions, it recognizes that some additional 

resources will likely be needed. With regard to developing a new 

distribution cost metric, for example, the Improvement Plan states that the 

metric would require a majority of its data inputs from two principal 

stakeholders—DLA and USTRANSCOM —and that many inputs can be 

pulled from existing data sources. However, there are likely other sources 

of information that must be identified or developed, some of which will 

require additional resources or processes to capture and validate relevant 

information that is not currently gathered.

According to the Improvement Plan, the distribution governance structure 

is expected to provide the resources and staff to complete each 

recommended action in the Improvement Plan and close any identified 

performance gaps within the time frame specified. The governance 

structure includes senior DOD officials. At the top of this structure is the 

Distribution Process Owner Executive Board, which is chaired by the 

Commander, USTRANSCOM, and whose members are at the 3-Star or 

Senior Executive Service (SES) equivalent level. The next most senior 

body, the Distribution Oversight Council, is chaired by the Deputy 

Commander, USTRANSCOM, and has members at the 1- and 2-Star and 

SES equivalent level. The Council is tasked with ensuring that highpriority initiatives and enterprise improvements are pursued, 

commensurate with authorized resources.

Since our February 2015 high-risk update, DOD has taken steps that 

meet our high-risk criteria for developing a corrective action plan to 

address the department’s materiel distribution challenges. The Acting 

Assistant Secretary of Defense for Logistics and Materiel Readiness 

signed the Improvement Plan in September 2016. According to the Acting 

Assistant Secretary, the Improvement Plan will guide and direct the 

department’s efforts to improve materiel distribution support to the 

warfighter by detailing specific goals and actions to better measure the 

end-to-end distribution process, ensure the accuracy of underlying data 

used to measure that process, and strengthen and integrate distribution 

policies and the governance structure.

The Improvement Plan lists 18 actions divided among 3 lines of effort: (1) 

metrics and performance, (2) data accuracy, and (3) policy and 

governance. The intent of these lines of effort and actions is to improve 

DOD’s capability for measuring the performance of its materiel distribution 

system, enabling continuous process improvement. According to the 

Improvement Plan, DOD “must be able to measure performance with 

Action Plan
DOD Supply Chain Management

Page 258 GAO-17-317 High-Risk Series

certainty across the enterprise before it can affect [sic] meaningful 

improvements in the distribution function.” In addition, the Acting 

Assistant Secretary of Defense for Logistics and Materiel Readiness 

states in the Improvement Plan that a robust policy and governance 

structure ensures that DOD can form, implement, and monitor corrective 

actions that address root causes and close distribution performance gaps 

once they are identified.

The Improvement Plan provides time frames for completing each of the 

18 actions. It calls for 11 of the actions to be completed within 1 year of 

the Improvement Plan’s approval, 4 additional actions to be completed 

within 2 years of the Improvement Plan’s approval, and the remaining 3 

actions to be completed within 3 years of the Improvement Plan’s 

approval. Going forward, DOD’s Distribution Steering Group will assume 

responsibility for executing the Improvement Plan. The Distribution 

Steering Group, part of the distribution governance structure, is cochaired by staff within USTRANSCOM and DLA.

DOD has partially met this criterion. Through its Improvement Plan, DOD 

aims to improve its capability to measure the performance of the 

distribution system by developing a suite of distribution performance 

metrics, improving the quality of data underlying those metrics, and 

sharing metrics information among stakeholders. While DOD has 

numerous distribution metrics in place, a team within the Distribution 

Working Group determined that five metrics should be included in its new 

suite of metrics. The selected metrics are aimed at addressing various 

attributes of the distribution system: responsiveness, reliability, 

information visibility, and efficiency/cost.

The Improvement Plan’s focus on these efforts has the potential, if 

implemented, to improve DOD’s ability to monitor various performance 

attributes of its distribution system. However, the Improvement Plan 

acknowledges that work remains to be done to investigate expanding the 

use of certain performance metrics, develop other metrics, improve data 

quality, and change policies to provide greater transparency of 

performance data and conduct routine reviews of performance metrics.

DOD’s Improvement Plan refers to measuring performance for all legs of 

the distribution system, including the tactical leg. Specifically, one of the 

goals in the Improvement Plan is for greater transparency of service, 

agency, and combatant command distribution performance data, 

including cost data. The Improvement Plan identifies where a policy 

change could be made to capture and provide such data. However, the 

Monitoring
DOD Supply Chain Management

Page 259 GAO-17-317 High-Risk Series

Improvement Plan does not specify the nature of data to be collected 

from the DOD components or how the data would be integrated with other 

metrics to measure the performance of all legs of the distribution system, 

including the tactical leg, and allow DOD to comprehensively monitor and 

oversee the materiel distribution system.

DOD began implementing its Improvement Plan in 2016. However, it is 

too early to assess whether implementing its Improvement Plan will result 

in the necessary demonstrated progress. However, the Improvement Plan 

is a key step toward meeting this criterion. Specifically, as discussed 

above, the Improvement Plan is aimed at improving the department’s 

capability to comprehensively measure distribution performance. With a 

performance measurement system in place, DOD will be better positioned 

to identify distribution problems, along with root causes and solutions.

DOD has identified next steps for implementing its Improvement Plan. 

According to the DASD(SCI), the Distribution Working Group (which 

developed the Improvement Plan) will formulate an approach to 

completing the Improvement Plan’s actions. The Distribution Steering 

Group will assume responsibility for executing and overseeing the 

Improvement Plan.

We have previously noted that DOD has made progress in addressing its 

materiel distribution challenges. For example, DOD was able to improve 

delivery times for some customers and use available assets more. These 

efforts, according to DOD officials, resulted in $1 billion in cost 

avoidances through April 2013. In its Improvement Plan, DOD highlighted 

initiatives it has taken to improve distribution and noted that efforts to 

improve asset visibility also benefit materiel distribution. However, 

challenges remain in addressing materiel distribution weaknesses. As we 

reported in 2015, current materiel distribution metrics used by the 

department do not provide decision makers with a complete 

representation of performance across the entire global distribution 

pipeline. Further, although joint doctrine has set efficient and effective 

distribution “from the factory to the foxhole” as a priority, these metrics do 

not always include performance for the final destination. In addition, DOD 

may not have sufficiently reliable data to accurately determine the extent 

to which it has met the standards it has established for distribution 

performance. DOD’s Improvement Plan is focused on these issues, but it 

will be important for the department to demonstrate progress in 

measuring the entire pipeline and ensuring the reliability of its data and 

measures as implementation of the Improvement Plan evolves.

Demonstrated Progress
DOD Supply Chain Management

Page 260 GAO-17-317 High-Risk Series

Senior leaders at the department have continued to demonstrate 

commitment to addressing the department’s asset visibility challenges as 

evidenced, in part, by DOD issuing, in January 2014 and October 2015, 

its Strategies for Improving DOD Asset Visibility. The Office of the Deputy 

Assistant Secretary of Defense for Supply Chain Integration oversees 

department-wide how the Strategy is developed, coordinated, approved, 

and implemented, and reviews the implementation of the initiatives. Also, 

senior leadership commitment is evident in its involvement in efforts to 

improve asset visibility through groups such as the Supply Chain 

Executive Steering Committee—senior-level officials responsible for 

overseeing asset visibility improvement efforts—and the Asset Visibility 

Working Group; which includes representatives from the components and 

other government agencies, as needed; identifies opportunities for 

improvement; and monitors the implementation of initiatives. Sustained 

leadership commitment will be critical moving forward as the department 

continues to implement its Strategies intended to improve asset visibility 

and associated asset visibility initiatives.

DOD now meets this criterion. As we previously reported in February 

2013 and continued to report in February 2015 resources and 

investments should be discussed in a comprehensive strategic plan, to 

include the costs to execute the plan and the sources and types of 

resources and investments—including skills, human capital, technology, 

information and other resources—required to meet established goals and 

objectives. DOD has demonstrated that it has the capacity—personnel 

Asset Visibility

Leadership Commitment

Capacity
DOD Supply Chain Management

Page 261 GAO-17-317 High-Risk Series

and resources—to improve asset visibility. For example, as we previously 

noted the department had established the Asset Visibility Working Group 

that is responsible for identifying opportunities for improvement; and 

monitoring the implementation of initiatives. The Working Group includes 

representatives from OSD and the components—Joint Staff, DLA, 

USTRANSCOM, and each of the military services. Furthermore, DOD’s 

2015 Strategy calls for the components to consider items such as 

manpower, materiel, and sustainment costs when documenting cost 

estimates for the initiatives in the Strategy, as we recommended in 

January 2015. However, in December 2015 we found that the 2015 

Strategy included three initiatives that did not include cost estimates. 

DOD has taken steps to address this weakness.

Specifically, in December 2016, a DOD official provided an abstract from 

the draft update to the 2015 Strategy that provides additional direction on 

how to explain and document cases where the funding for the initiatives is 

embedded within overall program funding. The draft update notes that 

there may be instances where asset visibility improvements are 

embedded within a larger program, making it impossible or cost 

prohibitive to isolate the cost associated with the specific asset visibility 

improvements. In these cases, the plan outlining the initiative will indicate 

that cost information is not available and why. However, if at some point 

during implementation some or all costs are identified, the information 

about the initiative will be updated to reflect as such. According to Office 

of the Secretary of Defense (OSD) officials, DOD plans to issue the 

update to the 2015 Strategy in 2017, but a release date has not been 

determined.

DOD now meets this criterion. The National Defense Authorization Act for 

Fiscal Year 2014 (NDAA) required DOD to submit to Congress a 

comprehensive strategy and implementation plans for improving asset 

tracking and in-transit visibility. The 2014 NDAA, among other things, 

called for DOD to include in its strategy and plans elements such as goals 

and objectives for implementing the strategy. The NDAA also included a 

provision that we assess the extent to which DOD’s strategy and 

accompanying implementation plans include the statutory elements. In 

January 2014, DOD issued its 2014 Strategy and accompanying 

implementation plans, which outline initiatives intended to improve asset 

visibility. DOD updated its 2014 Strategy and plans in October 2015.

We previously reported in February 2013 and continued to report in 

February 2015 that while the 2014 Strategy and implementation plans 

serve as a corrective-action plan, there was not a clear link between the 

Action Plan
DOD Supply Chain Management

Page 262 GAO-17-317 High-Risk Series

initiatives and the Strategy’s goals and objectives. We recommended that 

DOD clearly specify the linkage between the goals and objectives in the 

Strategy and the initiatives intended to implement the Strategy. DOD 

implemented our recommendation and updated its 2015 Strategy, which 

includes matrixes that link each of DOD’s ongoing initiatives intended to 

implement the Strategy to the Strategy’s overarching goals and 

objectives. DOD also added eight new initiatives to its 2015 Strategy and 

linked each of these efforts to the Strategy’s overarching goals and 

objectives.

DOD partially meets this criterion. As we previously reported in 2013 and 

continued to report in February 2015, DOD lacked a formal, central 

mechanism to monitor the status of improvements or fully track the 

resources allocated to them. We also reported that, while DOD’s draft 

strategy included overarching goals and objectives that address the 

overall results desired from implementing the strategy, it only partially 

addressed, among other factors, performance measures, which are 

necessary for DOD to monitor progress. Since February 2015, DOD has 

taken some steps to better monitor its improvement efforts. As noted in 

the 2015 Strategy, DOD described a process that tasks the Asset 

Visibility Working Group—a team that oversees the development and 

execution of DOD’s Strategy—to, among other things, review the 

performance of the component’s initiatives during implementation on a 

quarterly basis. According to OSD officials, they plan to issue an update 

to the 2015 Strategy, but the release date for this update has not been 

determined.

The Working Group uses status reports from the DOD components that 

include information on progress made toward implementation milestones, 

resources, and funding. DOD also identified performance measures for its 

asset visibility initiatives. However, the measures for the eight initiatives 

we reviewed were generally not clear, quantifiable, objective, and reliable. 

Measures with these attributes can help managers better monitor 

progress, including determining how well they are achieving their goals 

and identifying areas for improvement, if needed. Additionally, while the

Asset Visibility Working Group has closed initiatives, the Working Group 

generally did not have information related to performance measures to 

assess the progress of these initiatives.

As a result, DOD is unable to consistently monitor progress in achieving 

the Strategies’ goals and objectives. In December 2016, a DOD official 

provided an abstract from the draft update to the 2015 Strategy that noted 

that detailed metrics data will be collected and reviewed at the level 

Monitoring
DOD Supply Chain Management

Page 263 GAO-17-317 High-Risk Series

appropriate for the initiative. High-level summary metrics information will 

be provided to the Working Group in updates to the plan outlining the 

initiatives. The extent this planned change will affect the development of 

clear, quantifiable, objective, and reliable performance measures remains 

to be determined.

DOD partially meets this criterion. While DOD has made progress 

developing and implementing the 2014 and 2015 Strategies, the 

performance measures associated with the eight initiatives we reviewed 

cannot be used to demonstrate results. DOD reports it has closed or will 

no longer review the status of 20 of the 27 initiatives from the 2014 and 

2015 Strategies and continues to monitor the remaining seven initiatives. 

Additionally, in October 2016, DOD officials stated that they plan to add 

10 new initiatives in its update to the 2015 Strategy, which will be 

released in 2017, but OSD officials have not determined a date.

However, DOD has not taken steps to consistently incorporate 

information in after-action reports on initiatives’ performance measures to 

demonstrate the extent to which progress has been made toward 

achieving its goals for improving asset visibility. Without clear and 

quantifiable performance measures and information to support that 

progress has been made, DOD may not be able to demonstrate that 

implementing these initiatives resulted in measurable outcomes and 

progress towards achieving the goals and objectives in the Strategy. Also, 

DOD will be limited in its ability to demonstrate sustained progress in

implementing corrective actions and resolving the high-risk area.

• DOD Developed Metrics Guidance and Uses the Metrics to 

Monitor the Efficiency and Effectiveness of Its Inventory 

Management: In 2012, we found that DOD was developing metrics to 

assess the effectiveness and efficiency of its inventory management, 

but that it had not determined if it would incorporate these metrics into 

guidance. We noted that without guidance specifying standardized 

definitions, methodologies, and procedures for data collection 

procedures, DOD’s efforts to employ metrics to monitor and evaluate 

inventory management performance may be hampered.

Demonstrated Progress

Benefits Achieved by 

Implementing Our 

Recommendations

Inventory Management:
DOD Supply Chain Management

Page 264 GAO-17-317 High-Risk Series

To ensure sustained management attention consistent with resultsoriented management practices, we recommended that the Secretary 

of Defense direct the Assistant Secretary of Defense for Logistics and 

Materiel Readiness to (1) develop and implement guidance that 

establishes a comprehensive, standardized set of department-wide 

inventory management metrics, including standardized definitions and 

procedures for measuring and reporting the metrics, and (2) employ 

these metrics in periodically monitoring the effectiveness and 

efficiency of its inventory management practices. Based on our 

recommendations, the Assistant Secretary of Defense for Logistics 

and Materiel Readiness developed and issued the Supply Chain 

Metrics Guide in March 2016. This guide identifies a comprehensive, 

standardized set of inventory management metrics and identifies each 

metric’s application, definition, business value, data requirements, 

computational rules, goals and trends analysis, and connections to 

other related metrics.

DOD’s metric guidance provided the necessary information to ensure 

that metrics across the services and the DLA are standardized and 

can be used to manage the department’s inventory. Also, the 

DASD(SCI) uses these metrics to regularly monitor the department’s 

inventory management practices and outcomes. These actions will 

allow the department to monitor the effectiveness and efficiency of its 

inventory management practices across the services and the DLA.

• The Army Established On-Order Excess Inventory Goals to 

Guide Performance Improvement: In our April 2015 report on the 

military services’ inventory management, we found that the Army had 

not established goals for reducing on-order excess inventory. To 

improve management and minimize the amount of on-order excess 

inventory, we recommended that the Secretary of the Army direct the 

Commander, Army Materiel Command, to develop life-cycle 

management command-specific goals for the reduction of on-order 

excess inventory and monitor these goals. Based on our 

recommendation, in April 2015, the Army established on-order excess 

inventory goals for its life-cycle management commands and began 

monitoring its performance against those goals. These actions will 

provide the Army the ability to better oversee on-order excess 

inventory and maximize the amount of on-order excess inventory it 

reduces.

• The Navy Established Management Reviews to Improve 

Oversight of On-Order Excess Inventory: In our April 2015 report 

on the military services’ inventory management, we found that the 

Navy did not use management reviews of potential on-order excess 
DOD Supply Chain Management

Page 265 GAO-17-317 High-Risk Series

inventory based on dollar thresholds, as required by DOD guidance, 

resulting in a lack of oversight of on-order excess inventory. To help 

ensure the Navy adequately oversees on-order excess termination 

decisions, we recommended the Secretary of the Navy direct the 

Commander, Naval Supply Systems Command, to incorporate 

graduated management reviews based on dollar value thresholds into 

its current on-order excess inventory termination practices. Based on 

our recommendation, as of September 2015, the Navy began 

management reviews based on dollar value thresholds. This action 

will provide the Navy the ability to better oversee on-order excess 

inventory, thereby preventing unneeded inventory from being 

procured.

• DLA Revised Its Fiscal Year 2014 On-Hand Inventory Goal: In our 

June 2014 report on DLA inventory management, we found that DLA, 

in order to meet its on-hand inventory goal in fiscal year 2013, 

disposed of $855 million in inventory that its own economic analyses 

determined should be kept due to the risk DLA will need to buy the 

same items again in the future. To ensure that DLA does not dispose 

of inventory that is more economic to keep, in accordance with DOD 

guidance, we recommended that the Secretary of Defense direct the 

Director, DLA, to reassess and, if determined appropriate, revise 

DLA’s inventory reduction goals and schedule to achieve them in a 

way that minimizes risks and costs of having to buy items again in the 

long term. Based on our recommendation, in July 2014, DLA reexamined and documented its on-hand inventory reduction goal for 

fiscal year 2014. As a result of the review, DLA revised its on-hand 

inventory goal for fiscal year 2014 from $10 billion to about $10.9 

billion. Adjusting its goals will result in DLA needing to dispose of less 

inventory to meet the goals, which reduces the risk DLA may have to 

buy the same inventory in the future.

• DLA Incorporated On-Order Excess Inventory Metrics into Senior 

Management Performance Briefings: In our June 2014 report on 

DLA inventory management, we found that DLA senior management 

did not regularly review on-order excess inventory performance and 

that performance across DLA’s aviation, land, and maritime supply 

chains varied. To improve management and minimize the amount of 

on-order excess inventory, we recommended the Secretary of 

Defense direct the Director, DLA, to regularly monitor progress 

reducing on-order excess inventory through DLA’s senior 

management performance briefings. Based on our recommendation, 

in July 2014, DLA began including on-order excess inventory metrics 

in DLA’s Agency Performance Review, which is reviewed quarterly by 

the DLA Director and monthly by DLA headquarters senior logistics 
DOD Supply Chain Management

Page 266 GAO-17-317 High-Risk Series

operations managers. As a result of these actions, senior 

management will oversee on-order excess inventory performance and 

guide continued improvement managing its on-order inventory.

• DLA Established and Monitors Supply Chain-Specific On-Order 

Excess Inventory Goals: In our June 2014 report on DLA inventory 

management, we found that DLA had not established supply chainspecific goals for on-order excess inventory and that performance 

across DLA’s aviation, land, and maritime supply chains varied. To 

improve management and minimize the amount of on-order excess 

inventory, we recommended the Secretary of Defense direct the 

Director, DLA, to establish and regularly monitor supply chain-specific 

on-order excess goals that support DLA minimizing its investment in 

inventory that is not needed to meet requirements and achieving the 

DOD goal of 4 percent of the total value of on-order inventory by the 

end of fiscal year 2016.

Based on our recommendation, DLA established supply chain-specific 

goals of 6 percent in July 2014 that were aligned with DOD goals for 

fiscal year 2014. In July 2014, DLA also began monitoring supply 

chain-specific on-order excess inventory performance against DOD’s 

established department wide goals as part of its monthly Agency 

Performance Reviews. These actions will provide DLA the ability to 

guide continued improvement in reducing on-order excess inventory 

as well as monitor supply chain-specific performance against DOD’s 

goals.

• DLA Is Tracking and Reviewing On-Order Excess Inventory 

Performance Data: In our June 2014 report on DLA inventory 

management, we found that DLA had not consistently tracked and 

reported data to thoroughly measure its efforts to reduce on-order 

excess inventory. To improve management and minimize the amount 

of on-order excess inventory, we recommended the Secretary of 

Defense direct the Director, DLA, to track and regularly review 

performance data, such as the amount of on-order excess inventory 

reviewed, modified, or cancelled, and the reasons for not modifying or 

cancelling, in its inventory management processes. Based on our 

recommendation, as of June 2016, DLA implemented a monthly 

report process that reviews performance cancelling of on-order 

excess inventory as well as the reasons for decisions to retain or 

cancel on-order excess contracts. As part of this review process, DLA 

reports bi-annually on the status of its on-order excess inventory, 

specifically the reasons for retaining on-order excess contracts. These 

actions will provide DLA the ability to better oversee on-order excess 
DOD Supply Chain Management

Page 267 GAO-17-317 High-Risk Series

inventory, including tracking and monitoring the reasons for retaining 

on-order excess inventory.

• DOD Made Clear the Linkage between Its Goals and Objectives 

and Its Asset Visibility Initiatives: In our January 2015 report on 

DOD’s efforts to improve asset visibility, we found that DOD’s 2014 

Strategy included goals and objectives, but these goals and objectives 

were not linked with the initiatives. We recommended that DOD 

clearly specify the linkage between the goals and objectives in the 

Strategy and the initiatives intended to implement the Strategy. In 

October 2015, DOD issued its 2015 update to its Strategy, which 

included graphics showing a summary of the initiatives and their 

alignment to the Strategy’s goals and objectives. As a result of making 

apparent the alignment between its goals and objectives in the 2015 

Strategy and the initiatives intended to implement them, DOD should 

be better positioned to assess progress toward realizing its goals and 

objectives.

• DOD Included the Elements Considered in Its Cost Estimates for 

Asset Visibility Initiatives: In our January 2015 report on DOD’s 

efforts to improve asset visibility, we found that DOD’s Strategy did 

not specify the specific elements included in its cost estimates, such 

as human capital, information, and other resources required to meet 

the goals and objectives. That is, the components provided cost 

estimates in the plans outlining the initiatives, but generally at an 

aggregate level without details of the elements included.

We recommended DOD include this information in subsequent 

updates to its Strategy. As a result, in its 2015 update to its Strategy, 

DOD provided direction instructing the components to include cost 

estimates in their plans outlining the initiatives and to include at least 

the categories of manpower, materiel, and sustainment in these 

estimates of cost. As a result of updating its Strategy to require the 

components to include information on the specific elements included 

in cost estimates, DOD gains insights on the elements considered in 

developing the cost estimates and the level of detailed cost 

information it needs to make well-informed decisions about asset 

visibility.

For additional information about this high-risk area, contact Zina Merritt at 

(202) 512-5257 or merrittz@gao.gov or Cary Russell at (202) 512-5431 or 

russellc@gao.gov.

Asset Visibility:

GAO Contact
DOD Supply Chain Management

Page 268 GAO-17-317 High-Risk Series

Defense Inventory: Further Analysis and Enhanced Metrics Could 

Improve Service Supply and Depot Operations. GAO-16-450. 

Washington, D.C.: June 9, 2016.

Defense Logistics: DOD Has Addressed Most Reporting Requirements 

and Continues to Refine its Asset Visibility Strategy. GAO-16-88. 

Washington, D.C.: December 22, 2015.

Defense Inventory: Services Generally Have Reduced Excess Inventory, 

but Additional Actions Are Needed. GAO-15-350. Washington, D.C.: April 

20, 2015.

Defense Logistics: Improvements Needed to Accurately Assess the 

Performance of DOD’s Materiel Distribution Pipeline. GAO-15-226. 

Washington, D.C.: February 26, 2015.

Defense Logistics: DOD Has a Strategy and Has Taken Steps to Improve 

Its Asset Visibility, but Further Actions Are Needed. GAO-15-148. 

Washington, D.C.: January 27, 2015.

Defense Inventory: Actions Needed to Improve the Defense Logistics 

Agency’s Inventory Management. GAO-14-495. Washington, D.C.: June 

19, 2014.

Related GAO 

Products
DOD Weapon Systems Acquisition

Page 269 GAO-17-317 High-Risk Series

In March 2016, we reported that the Department of Defense (DOD) 

expects to invest $1.4 trillion (fiscal year 2016 dollars) to develop and 

procure its portfolio of 79 major defense acquisition programs. Congress 

and DOD have long sought to improve how major weapon systems are 

acquired, yet many DOD programs fall short of cost, schedule, and 

performance expectations, meaning DOD pays more than anticipated, 

can buy less than expected, and, in some cases, delivers less capability

to the warfighter. With the prospect of slowly-growing or flat defense 

budgets for years to come, DOD must get better returns on its weapon 

system investments and find ways to deliver capability to the warfighter 

on time and within budget.

Top leadership at DOD is committed to improving the way DOD acquires 

weapon systems. Since we added this area to our High-Risk List in 1990, 

DOD has made progress in addressing challenges, such as through the 

Better Buying Power initiatives outlined by the Office of the Under 

Secretary of Defense for Acquisition, Technology, and Logistics since 

2010. Although DOD lacks a comprehensive action plan for fully 

addressing this high-risk area and its root causes, the Better Buying 

Power initiatives are a step in the right direction, as DOD has prescribed 

a number of concrete changes. DOD has partially met the criteria for 

monitoring by issuing a series of annual performance reports on the 

portfolio of major defense acquisition programs. In 2016, DOD issued the 

fourth report in this series. Continuing and expanding this series of 

reports should help DOD measure its progress over time.

DOD has partially met the criteria for capacity by, for example, updating 

some policies to enable better outcomes and assessing the acquisition 

workforce. However, we remain concerned about whether DOD will fully 

implement its proposed reforms or continue to track progress in meeting 

workforce goals, as DOD has, in the past, failed to convert policy into 

practice. DOD has partially met the criteria for demonstrating progress as 

it relates to the cost and schedules of its weapon programs. Although we 

reported in March 2016 on the progress many DOD programs are making 

in reducing their cost, as demonstrated by improvements when measured 

against cost-growth targets, individual weapon programs are still not 

conforming to best practices for acquisition, or implementing key 

DOD Weapon Systems Acquisition

Why Area Is High 

Risk

What GAO Found
DOD Weapon Systems Acquisition

Page 270 GAO-17-317 High-Risk Series

acquisition reforms and initiatives that could prevent long-term cost and 

schedule growth.1

Our work reveals that, while there is still cost and schedule growth in 

major defense acquisition programs, DOD is making progress in 

decreasing the amount of cost growth realized in the portfolio as a whole. 

In March 2016, we reported that the total acquisition cost of DOD’s fiscal 

year 2015 portfolio of 79 programs decreased by $2.5 billion from the 

previous year.2 The decrease, however, was due primarily to reductions 

in a few programs. The majority of individual programs, 42 of the 79, 

increased in cost.

In terms of schedule, the time it took to deliver initial capabilities to the 

warfighter increased, on average, an additional 2.4 months. Our analysis 

also showed evidence that DOD made progress in improving efficiencies 

in its programs from 2014 to 2015. When we account for increased costs 

attributable to increased program quantity, 38 programs improved their 

buying power—that is, the amount of goods procured for dollars spent.

DOD’s major acquisition programs also showed some improvement when 

measured against the three cost-growth targets we have used to measure 

DOD’s progress in the weapon system acquisition high-risk area since 

2011. Most notably, 72 percent of programs meet the threshold for less 

than 10 percent growth over the past 5 years, and 76 percent meet the 

threshold for less than 2 percent growth in the past year, both an 

improvement over past assessments (see figure 18).3

 1

GAO, Defense Acquisitions: Assessments of Selected Weapon Programs, 

GAO-16-329SP (Washington, D.C.: Mar. 31, 2016).

2

GAO-16-329SP.

3

In December 2008 we, DOD, and the Office of Management and Budget discussed a set 

of cost growth metrics and goals to evaluate DOD’s progress on improving program 

performance for purposes of our high-risk report. These metrics were designed to capture 

total cost-growth performance over 1- and 5-year periods as well as from the original 

program estimate on a percentage basis, as opposed to dollar amount to control for the 

differences in the amount of funding among programs. DOD no longer supports the use of 

these metrics. We continue to believe that the current metrics have value. 
DOD Weapon Systems Acquisition

Page 271 GAO-17-317 High-Risk Series

Figure 18: Comparison of the Cost Performance of DOD’s 2011-2015 Portfolios

Note: For the 2014 portfolio we did not calculate a 5-year comparison as there were no December 

2008 Selected Acquisition Reports issued.

In addition, Congress has been working to reform the process for

acquiring weapon systems for several years. In the National Defense 

Authorization Acts (NDAA) for just the past 5 years, for example, 

Congress has enacted the following reforms, among others:

• In the 2013 NDAA, Congress introduced measures to control costs on 

acquisition programs by requiring DOD to limit the use of cost-type 

contracts for production, and to open programs to competition at the 

subcontract level.

• In the 2014 NDAA, Congress expanded requirements for cost 

reporting by requiring DOD to include additional cost and schedule 

estimates in its annual reports to Congress.

• In the 2016 NDAA, Congress made numerous reforms to the 

acquisition process including requiring more close involvement of the 

service chiefs; requiring DOD to report on efforts to streamline the 

requirements, acquisition, and budgeting processes; stipulating the 
DOD Weapon Systems Acquisition

Page 272 GAO-17-317 High-Risk Series

use and contents of an acquisition strategy; and reducing the number 

of certifications required for programs at milestone reviews.

• In the 2017 NDAA, Congress enacted reforms to require modular 

open system approaches in major programs, further ensure the 

achievement and reporting of program goals, modify requirements for 

independent cost estimates, and reorganize the acquisition authority 

within the Office of the Secretary of Defense.

At this point, DOD needs to build on existing reforms—not necessarily 

revisiting the process itself but augmenting it by tackling incentives. 

Based on our extensive body of work in weapon systems acquisition, 

DOD could

• examine best practices to integrate critical requirements, resources, 

and acquisition decision-making processes;

• attract, train, and retain acquisition staff and managers so that they 

are both empowered and accountable for program outcomes;

• use funding decisions at the start of new programs to reinforce 

desirable principles such as well-informed acquisition strategies;

• identify significant risks up front and resource them;

• explore ways to align budget decisions and program decisions more 

closely; and

• investigate tools, such as limits on system development time, to 

improve program outcomes.

Further, we have open priority recommendations related to four 

acquisition programs that would benefit from greater attention given the 

size of DOD’s investments in them and their cost, schedule, and 

performance challenges, including the following:

• In April 2015, we made one priority recommendation for the F-35 Joint 

Strike Fighter program, that DOD analyze the affordability of the 

program’s current procurement plan that reflects various assumptions 

about future technical progress and funding availability. DOD stated 

that it would analyze affordability as part of an internal deliberative 

process culminating in the services’ annual budget request.

• We made one priority recommendation for the Littoral Combat Ship 

program in July 2014. This recommendation stated that the program 

should successfully complete key tests—such as shock, anti-air 

warfare self-defense testing, or final survivability assessments—

What Remains to Be 

Done
DOD Weapon Systems Acquisition

Page 273 GAO-17-317 High-Risk Series

before contracting for additional ships. The Navy’s recent decision to 

restructure the program alters the timing of our recommendation, but 

does not change our intent to ensure that the Navy does not continue 

to commit to additional ships until it demonstrates that it has attained 

some level of knowledge in key areas, such as ship survivability.

• In September 2013, we made three priority recommendations for the 

lead ship in the Ford-class aircraft carrier fleet, designated as CVN 

78. DOD should explore capability trade-offs, update the Ford-class 

program’s test and evaluation master plan to allot sufficient time for 

testing, and adjust the post-delivery test schedule to ensure that 

system integration testing is completed prior to operational testing. 

DOD has made progress in implementing these recommendations by, 

for example, completing a cost-benefit analysis to determine the 

acquisition strategy for the follow-on ship. DOD, however, failed to 

fully explore capability trade-offs, and it remains to be seen whether 

additional time has been allotted to complete testing, as an updated 

test and evaluation master plan has not been approved.

• We made two priority recommendations in April 2013 for the Missile 

Defense Agency and its programs. We recommended that the agency 

both stabilize its acquisition baselines to enable meaningful 

comparisons over time and make its cost estimates more 

comprehensive by including military services’ operation and support 

costs. While DOD generally concurred with our recommendations, the 

Missile Defense Agency’s baselines continue to change, and agency 

decision makers still have not been informed of full program costs.

Finally, Congress has an important role to play in advancing weapon 

system acquisition reform overall, particularly in what it sanctions via

funding approvals. Programs that propose optimistic or rushed acquisition 

strategies represent opportunities for Congress to either maintain or 

change the defense acquisition culture—a prevailing set of incentives that 

encourages decisions to go forward with programs before they are ready, 

and a willingness to accept cost growth and schedule delays as the likely 

byproduct of such decisions. When programs that do not follow 

acquisition best practices are denied funding approval, those risky 

acquisition strategies, in effect, lack congressional sanction.
DOD Weapon Systems Acquisition

Page 274 GAO-17-317 High-Risk Series

DOD has met the criterion for leadership commitment. DOD continues to 

demonstrate a strong commitment, at the highest levels, to improving the 

management of its weapon system acquisitions. Over the past 6 years, 

the Office of the Under Secretary of Defense for Acquisition, Technology, 

and Logistics has implemented a series of efforts for acquisition reform 

through its Better Buying Power initiative. In January 2015, DOD updated 

its acquisition instruction, furthering this commitment as it incorporates 

many of the Better Buying Power initiatives, as well as acquisition reforms 

from the Weapon Systems Acquisition Reform Act of 2009 and other 

legislation. These actions are consistent with our past findings and 

recommendations.

If these initiatives are to have a lasting, positive effect, however, decision 

makers need to be held accountable for implementing them. Our recent 

work shows there is much ground yet to cover.

DOD has partially met the criterion for capacity. Across the portfolio, DOD 

has unevenly implemented knowledge-based acquisition practices that 

might prevent or mitigate cost growth. When we assessed DOD weapon 

programs in March 2016, we found that while DOD continues to show 

progress in following a knowledge-based approach to reduce risk, it has 

significant room for improvement.4 While programs that have recently 

passed through major decision points have demonstrated best 

practices—such as planning to constrain development times and 

achieving design stability—key practices like demonstrating technology 

maturity or controlling manufacturing processes are still not being fully 

implemented. Of the 17 programs we assessed that had recently passed 

through one of three key decision points in the acquisition process, only 3 

had implemented all of the applicable knowledge-based practices 

applicable for that decision point. The remaining programs will carry 

technology, design, and production risks, which increase cost and 

schedule risks, into subsequent phases of the acquisition process. In 

March 2016, we also reported that implementation of the Better Buying 

 4

GAO-16-329SP.

Additional Details on 

What GAO Found

Leadership Commitment

Capacity
DOD Weapon Systems Acquisition

Page 275 GAO-17-317 High-Risk Series

Power and acquisition reform initiatives varied across programs.5 While 

91 percent of programs successfully implemented “should-cost” initiatives 

and reported significant cost savings, only 67 percent had established 

affordability constraints.

In addition, DOD has not completely implemented the direction to improve 

competition. Of the 12 future programs we assessed in our March 2016 

report on selected weapon programs, half did not plan to conduct 

competitive prototyping before the start of development, and many 

current programs did not have acquisition strategies to ensure 

competition through the end of production. Eight current programs 

reported that they will not take actions to promote any competitive 

measures before or after development start.

A significant element of capacity is whether the agency has the workforce 

in place to resolve risks. DOD has made some progress in managing its 

acquisition workforce. Specifically, in October 2016, DOD issued its 

updated acquisition workforce strategic plan which, among other things, 

assessed the current capability of the workforce and identified risks that 

DOD needed to manage to meet future needs. DOD acknowledged, 

however, that it will need to develop and implement metrics to track 

progress towards meeting the four strategic goals identified in its October 

2016 strategic workforce plan. Further, the workforce plan does not 

establish specific career field goals or targets, which will hinder efforts to 

ensure DOD has the right people with the right skills to meet future 

needs.

DOD has partially met the criterion for an action plan as it lacks a 

comprehensive action plan for fully addressing this high-risk area and its 

root causes, but addresses some of these issues in its Better Buying 

Power initiatives. Better Buying Power outlines some steps DOD can take 

across its acquisition portfolio to achieve better results. These initiatives 

include measures such as setting and enforcing affordability constraints, 

instituting a long-term investment plan for portfolios of weapon systems, 

implementing “should cost” management to control contract costs, and 

eliminating redundancies within portfolios. The initiatives also emphasize 

the need to adequately grow and train the acquisition workforce.

 5

GAO-16-329SP.

Action Plan
DOD Weapon Systems Acquisition

Page 276 GAO-17-317 High-Risk Series

DOD has partially met the criterion for monitoring progress. In December 

2008, we, DOD, and the Office of Management and Budget discussed a 

set of cost growth metrics and goals to evaluate DOD’s progress on 

improving program performance for purposes of our high-risk report. 

These metrics were designed to capture total cost-growth performance 

over 1- and 5-year periods as well as from the original program estimate 

on a percentage basis, as opposed to dollar amount to control for the 

differences in the amount of funding among programs. DOD no longer 

supports the use of these metrics. We continue to believe that the current 

metrics have value.

DOD has made some progress in its efforts to assess the root causes of 

poor weapon system acquisition outcomes, and monitor the effectiveness 

of its actions to improve how it manages weapon systems acquisition. In 

2016, DOD issued the fourth in what is promised to be an annual series 

of performance reports on its portfolio of major defense acquisition 

programs. The report examines a wide range of acquisition-related 

information, such as contract type, contractor incentives, and the effects 

of statutes and policies to determine if there is any statistical correlation 

between these factors and good or poor acquisition outcomes. The report 

is a good step, but DOD needs to continue to refine and enhance this 

reporting. In addition, the department or Congress should formalize a 

requirement for the report to ensure it continues despite changes in 

leadership.

DOD has partially met the criterion for demonstrating progress. As we 

reported in March 2016, many DOD programs are making progress 

reducing costs, as demonstrated by improvements when measured 

against cost-growth targets.6 However, individual weapon programs are 

still not conforming to best practices for acquisition or implementing key

acquisition reforms and initiatives that could prevent long-term cost and 

schedule growth.

Over the past 4 fiscal years, our analyses of DOD’s weapon system 

acquisitions have resulted in nearly $30 billion in financial savings. We 

have reported on the F-35 Joint Strike Fighter (JSF) program, DOD’s 

most expensive aircraft acquisition, for over a decade. A recurring theme 

in this body of work has been the program’s very aggressive and risky 

 6

GAO-16-329SP.

Monitoring

Demonstrated Progress

Benefits Achieved by 

Implementing Our 

Recommendations
DOD Weapon Systems Acquisition

Page 277 GAO-17-317 High-Risk Series

acquisition strategy, particularly the substantial concurrency, or overlap,

among development, testing, and production activities. We repeatedly 

cautioned against procuring large quantities of aircraft before the system 

design was stable, performance verified through testing, and the 

manufacturing process capable of efficiently building aircraft at the 

planned production rates.

We made numerous recommendations aimed at reducing annual 

procurements, delaying plans to accelerate production, and focusing 

more time and resources on system development and testing.7 We 

amplified this message in annual “Quick Look” reports, congressional 

testimonies, and numerous budget justification reviews.8 Defense officials 

acknowledged the concurrency in the JSF acquisition strategy, but stated 

that the risks were manageable.

DOD’s position started to change, however, after years of cost growth 

and schedule delays. Consistent with our findings and recommendations, 

DOD decreased near-term procurement quantities by 103 aircraft for 

fiscal years 2013 and 2014 at a budgeted savings of about $9 billion, and 

by 187 aircraft for fiscal years 2015 through 2017 at a budgeted savings 

of about $12 billion. Congressional defense committees have depended 

on our work to provide accurate and realistic information to inform the 

ongoing debate on the F-35, and both congressional leaders and top 

DOD officials have noted that we were right about concurrency and the 

need to decrease annual aircraft purchases.

 7

GAO, Joint Strike Fighter: Restructuring Places Program on Firmer Footing, but Progress 

Still Lags, GAO-11-325 (Washington, D.C.: Apr. 7, 2011); Joint Strike Fighter: Additional 

Costs and Delays Risk Not Meeting Warfighter Requirements on Time, GAO-10-382 

(Washington, D.C.: Mar. 19, 2010); and Joint Strike Fighter: Accelerating Procurement 

before Completing Development Increases the Government’s Financial Risk, GAO-09-303 

(Washington, D.C.: Mar. 12, 2009).

8

GAO, F-35 Joint Strike Fighter: Development of New Capabilities Requires Continued 

Oversight, GAO-16-634T (Washington, D.C.: Apr. 26, 2016); Defense Acquisitions: 

Assessments of Selected Weapon Programs, GAO-16-329SP (Washington, D.C.: Mar. 

31, 2016); F-35 Joint Strike Fighter: Observations on Program Progress, GAO-15-429T

(Washington, D.C.: Apr. 14, 2015); Defense Acquisitions: Assessments of Selected 

Weapon Programs, GAO-15-342SP (Washington, D.C.: Mar. 12, 2015; F-35 Joint Strike 

Fighter: Slower Than Expected Progress in Software Testing May Limit Initial Warfighting 

Capabilities, GAO-14-468T (Washington, D.C.: Mar. 26, 2014; Defense Acquisitions: 

Assessments of Selected Weapon Programs, GAO-14-340SP (Washington, D.C.: Mar. 

31, 2014). 
DOD Weapon Systems Acquisition

Page 278 GAO-17-317 High-Risk Series

In addition, as part of our annual work on the Ballistic Missile Defense 

System and assessments of defense-wide funding requests for research, 

development, test and evaluation, and procurement, we reported to 

Congress several times from March 2011 to April 2013 on the high 

acquisition risks and lack of analysis supporting the Precision Tracking 

Space System (PTSS). PTSS was designed as a satellite system to track 

ballistic missiles. We found that the program had developed an optimistic 

acquisition approach, including elevated levels of concurrency, and faced 

significant design challenges. This approach would have precluded 

demonstrations that the laboratory satellite design worked as intended 

before the Missile Defense Agency committed to industry-built satellites. 

DOD canceled the PTSS program in 2013 because of concerns with the 

program’s high-risk acquisition strategy and technical challenges that we 

raised, saving approximately $2.7 billion in planned funding for fiscal 

years 2014 through 2018.9

For additional information about this high-risk area, contact Michael J. 

Sullivan, Director, Acquisition and Sourcing Management at (202) 512-

4841 or sullivanm@gao.gov .

F-35 Joint Strike Fighter: Continued Oversight Needed as Program Plans

to Begin Development of New Capabilities.GAO-16-390. Washington, 

D.C.: April 14, 2016.

KC-46 Tanker Aircraft: Challenging Testing and Delivery Schedules Lie 

Ahead. GAO-16-346. Washington, D.C.: April 8, 2016.

Defense Acquisitions: Assessments of Selected Weapon Programs. 

GAO-16-329SP. Washington, D.C.: March 31, 2016.

Defense Advanced Research Projects Agency: Key Factors Drive 

Transition of Technologies, but Better Training and Data Dissemination 

Can Increase Success. GAO-16-5. Washington, D.C.: November 18, 

2015.

 9

GAO, Missile Defense: Opportunity to Refocus on Strengthening Acquisition 

Management, GAO-13-432 (Washington, D.C.: Apr. 26, 2013); Missile Defense: 

Opportunity Exists to Strengthen Acquisitions by Reducing Concurrency, GAO-12-486

(Washington, D.C.: Apr. 20, 2012); Missile Defense: Actions Needed to Improve 

Transparency and Accountability, GAO-11-372 (Washington, D.C.: Mar. 24, 2011). 

GAO Contact

Related GAO 

Products
DOD Weapon Systems Acquisition

Page 279 GAO-17-317 High-Risk Series

Ford Class Aircraft Carrier: Poor Outcomes Are the Predictable 

Consequences of the Prevalent Acquisition Culture. GAO-16-84T. 

Washington, D.C.: October 1, 2015.

GPS: Actions Needed to Address Ground System Development Problems 

and User Equipment Production Readiness. GAO-15-657. Washington, 

D.C.: September 9, 2015.

Weapon System Acquisitions: Opportunities Exist to Improve the 

Department of Defense’s Portfolio Management. GAO-15-466. 

Washington, D.C.: August 27, 2015.

Defense Acquisition Process: Military Service Chiefs’ Concerns Reflect 

Need to Better Define Requirements before Programs Start. 

GAO-15-469. Washington, D.C.: June 11, 2015.

Defense Acquisitions: Better Approach Needed to Account for Number, 

Cost, and Performance of Non-Major Programs. GAO-15-188. 

Washington, D.C.: March 2, 2015.

Acquisition Reform: DOD Should Streamline Its Decision-Making Process 

for Weapon Systems to Reduce Inefficiencies. GAO-15-192. Washington, 

D.C.: February 24, 2015.

F-35 Joint Strike Fighter: Assessment Needed to Address Affordability 

Challenges. GAO-15-364. Washington, D.C.: April 14, 2015.

Littoral Combat Ship: Additional Testing and Improved Weight 

Management Needed Prior to Further Investments. GAO-14-749. 

Washington, D.C.: July 30, 2014.

Ford-Class Carriers: Lead Ship Testing and Reliability Shortfalls Will Limit 

Initial Fleet Capabilities. GAO-13-396. Washington, D.C.: September 5, 

2013.

Missile Defense: Opportunity to Refocus on Strengthening Acquisition 

Management. GAO-13-432. Washington, D.C.: April 26, 2013.
DOD Financial Management

Page 280 GAO-17-317 High-Risk Series

Since 2015, the Department of Defense’s (DOD) progress in improving its 

financial management processes and operations has been mixed. 

Without reliable, useful, and timely financial information, DOD is severely 

hindered in making sound decisions affecting the department’s 

operations.

DOD financial management was first added to our High-Risk List in 1995. 

Long-standing, uncorrected deficiencies with DOD’s financial 

management systems, business processes, financial manager 

qualifications, and material internal control and financial reporting 

weaknesses continue to negatively affect DOD’s ability to manage the 

department and make sound decisions on mission and operations. 

Having sound financial management practices and reliable, useful, and 

timely financial and performance information is important to help ensure 

accountability over DOD’s extensive resources and efficiently and 

economically manage the department’s assets and budgets. This is 

particularly important because DOD’s reported discretionary spending 

makes up about half of the federal government’s reported discretionary 

spending, and its reported assets represent more than 70 percent of the 

federal government’s reported physical assets. However, DOD remains 

one of the few federal entities that cannot demonstrate its ability to 

accurately account for and reliably report its spending or assets. DOD’s 

financial management problems remain one of three major impediments 

preventing us from expressing an opinion on the consolidated financial 

statements of the federal government.

The effects of DOD’s financial management problems extend beyond 

financial reporting. Long-standing internal control deficiencies have 

adversely affected the economy, efficiency, and effectiveness of 

operations. For example, as we have reported, DOD’s financial 

management problems have contributed to (1) inconsistent and

sometimes unreliable reports to Congress on weapon system operating 

and support costs, limiting the visibility that Congress needs to effectively 

oversee weapon system programs; and (2) an impaired ability to make 

cost-effective choices, such as deciding whether to outsource specific 

activities or how to improve efficiency through technology. DOD’s efforts 

to improve its financial management have been impaired by its 

decentralized environment; cultural resistance to change; lack of skilled 

financial management staff; lack of effective processes, systems, and 

controls; incomplete corrective action plans (CAP); and ineffective 

monitoring and reporting.

DOD Financial Management

Why Area Is High 

Risk
DOD Financial Management

Page 281 GAO-17-317 High-Risk Series

Effective financial management is also fundamental to achieving DOD’s 

broader business transformation goals. However, given DOD’s 

decentralized environment and hundreds of nonstandard financial 

management business processes and systems, DOD anticipates it will 

take several years of effort before it will reach these goals. Current 

budget constraints and fiscal pressures make the reliability of DOD’s 

financial information and its ability to maintain effective accountability for 

its resources increasingly important to the federal government’s ability to 

make sound decisions about allocating resources.

The Army, Navy, and Air Force underwent audits of their respective 

Schedules of Budgetary Activity (Budgetary Schedules) for fiscal years 

2015 and 2016.1 However, all three of the independent public 

accountants (IPA) that performed these audits issued disclaimers, 

meaning that the IPAs were not able to complete their work or issue an 

opinion because they lacked sufficient evidence to support the amounts 

presented. These IPAs also identified material weaknesses in internal 

control at the three military services and collectively issued hundreds of 

findings and recommendations. As of the end of fiscal year 2016, 700 IPA 

findings and recommendations related to the three military services’ fiscal 

years 2015 and 2016 Budgetary Schedules remained open. These 

weaknesses included the military services’ inability to, among other 

things, reasonably assure that the Budgetary Schedules reflected all of 

the relevant financial transactions that occurred and that documentation 

was available to support such transactions.

The results of these audits illustrate the significant amount of work that 

remains for DOD to have reliable, useful, and timely financial 

management and performance information for decision making on its 

mission and operations. In addition, DOD officials reported in the 

November 2016 Financial Improvement and Audit Readiness (FIAR) Plan 

Status Report that the department anticipates receiving disclaimers of 

 1

Unlike the Statement of Budgetary Resources (SBR), which reflects multiple-year budget 

activity, the military services’ Budgetary Schedules reflect the balances and associated 

activity related only to funding from fiscal year 2015 forward. As a result, the Budgetary 

Schedules exclude unobligated and unexpended amounts carried over from funding prior 

to fiscal year 2015, as well as information on the status and use of such funding (e.g., 

obligations incurred and outlays) in fiscal year 2015 and thereafter.
DOD Financial Management

Page 282 GAO-17-317 High-Risk Series

opinion on its full financial statements for several years but emphasized 

that being subject to audit will help the department make progress.2

Since 2015, DOD’s progress in improving its financial management 

processes and operations has been mixed. DOD has made partial 

progress toward demonstrating leadership commitment and developing 

capacity and action plans. For example, DOD continues its efforts to 

address its financial management challenges through (1) updating the 

FIAR Guidance related to service providers, financial reporting of 

property, and seven critical capabilities for full audit readiness; (2) 

implementing training programs to build a skilled financial management 

workforce; and (3) developing a number of action plans. However, DOD 

continues to face challenges in monitoring corrective actions and 

demonstrating progress.

In furtherance of financial management reform, Congress took the 

following actions during fiscal years 2013 through 2016:

• The National Defense Authorization Act (NDAA) for Fiscal Year 2013 

established certain requirements for the FIAR Plan, including actions 

to be taken to ensure that DOD’s Schedule of Budgetary Resources is 

validated as ready for audit not later than September 30, 2014, and an 

assessment of readiness for the SBR audit.

• The NDAA for Fiscal Year 2014 mandated an audit of DOD’s fiscal 

year 2018 full financial statements, and that the results be submitted 

to Congress not later than March 31, 2019.

• Further, the NDAA for Fiscal Year 2016 had several relevant financial 

management provisions that, among other things

• required coordination with the Federal Accounting Standards 

Advisory Board to establish accounting standards to value large 

 2

Congress mandated in the National Defense Authorization Act (NDAA) for Fiscal Year 

2010 that DOD develop and maintain a FIAR Plan that includes the specific actions to be 

taken and costs associated with (1) correcting the financial management deficiencies that 

impair DOD’s ability to prepare complete, reliable, and timely financial management 

information and (2) ensuring that DOD’s financial statements are validated as ready for 

audit not later than September 30, 2017. Pub. L. No. 111-84, § 1003(a),123 Stat. 2190, 

2439-40 (Oct. 28, 2009), codified at 10 U.S.C. § 2222 note. DOD is required to provide 

semi-annual reports to the congressional Defense committees on the status of the 

implementation of the FIAR Plan. 

What GAO Found
DOD Financial Management

Page 283 GAO-17-317 High-Risk Series

and unordinary general property, plant, and equipment items no 

later than September 30, 2017;

• required the Secretary of Defense to report to Congress, ranking 

the military departments and defense agencies in order of how 

advanced they are in achieving auditable financial statements;

• provided for DOD Office of Inspector General (OIG) involvement 

in each DOD component’s annual audit, including obtaining an 

audit of each component by an independent external auditor, 

participating in selecting the auditors, and monitoring the audits;

• required the financial audit reports issued by the independent 

external auditors to be submitted to the Under Secretary of 

Defense (Comptroller), Controller of the Office of Management 

and Budget’s (OMB) Office of Federal Financial Management, and 

appropriate congressional committees; and

• authorized the Secretary of Defense to carry out a pilot program 

allowing financial management personnel to temporarily exchange 

between DOD and contractors.

• Congressional oversight committees have continued to press for 

increased progress at DOD through hearings.

DOD needs to assure the sustained involvement of leadership at all levels 

of the department in addressing financial management reform and 

business transformation. DOD leadership has stated that it is committed 

to achieving effective financial management controls to support financial 

accountability and reliable and timely information for day-to-day 

management decision making, and auditable financial statements. 

However, DOD reported in its November 2016 FIAR Plan Status Report 

that because some remediation actions and major system and process 

changes will not be fully completed, it expects the fiscal year 2018 full 

financial statements audit to result in significant audit findings and a 

disclaimer of opinion. In addition, DOD reported that it anticipates 

receiving disclaimers of opinion on its financial statements for several 

years. DOD leadership needs to reasonably assure that DOD 

components adhere to the processes in the FIAR Plan and the 

accompanying FIAR Guidance so that components have effective 

What Remains to Be 

Done

Leadership
DOD Financial Management

Page 284 GAO-17-317 High-Risk Series

leadership, processes, systems, and controls in place to sustainably 

improve DOD’s financial management operations and audit readiness. 

Sustained leadership commitment is critical to DOD’s success in 

achieving financial accountability and in providing reliable information for 

day-to-day management decision making as well as financial audit 

readiness.

DOD needs to continue building a workforce with the level of training and 

experience needed to support and sustain sound financial management. 

DOD needs to address the availability of financial management staff in 

light of the mandatory workforce reductions at headquarters.3 In addition, 

to continue building a skilled and knowledgeable workforce, DOD needs 

to assure that its financial management certification program continues 

developing and refreshing required competencies, periodically assessing 

the workforce’s capabilities, identifying competency gaps, and closing 

those gaps.

DOD needs to continue to develop and deploy enterprise resource 

planning (ERP) systems as a critical component of DOD’s financial 

improvement and audit readiness strategy. DOD also will need to 

strengthen automated controls or design manual workarounds for the 

remaining legacy systems to satisfy audit requirements and improve data 

used for day-to-day decision making. The DOD OIG has reported that 

DOD continues to have schedule delays in effectively implementing its 

ERPs. These delays in implementing ERP systems increase the risk that 

DOD will not have reliable information for making important decisions on 

mission and operations or meet its goal of being validated as ready for an 

audit of its full financial statements by September 30, 2017.

DOD needs to address identified deficiencies in service providers’

systems, processes, and controls that affect the reliability of financial data 

and information used in the related business processes. In addition, each 

of the components needs to resolve integration issues with DOD service 

providers. Further, the military services need to work with Defense 

 3

The NDAA for Fiscal Year 2016 requires that the Secretary of Defense implement a plan 

to ensure that DOD achieves a minimum of $10 billion in cost savings from the 

headquarters, administrative, and support activities of the department, including through 

streamlining the department’s headquarters workforce, during the period beginning with 

fiscal year 2015 and ending with fiscal year 2019 with at least half the reductions occurring 

for fiscal years before fiscal year 2018. Pub. L. No. 114-92, § 346, 129 Stat. 796 (Nov. 25, 

2015), codified at 10 U.S.C. § 111, note.

Capacity
DOD Financial Management

Page 285 GAO-17-317 High-Risk Series

Finance and Accounting Service (DFAS) management to address 

suspense accounts and support for adjustments made by journal 

vouchers.

DOD needs to assure that military services enhance their policies and 

procedures for developing CAPs and improve processes for identifying, 

tracking, and remediating financial management related audit findings 

and recommendations. Improving remediation processes over these 

deficiencies will be more important in light of the hundreds of findings and 

recommendations resulting from the fiscal year 2015 and 2016 Budgetary 

Schedule audits.

DOD needs to effectively implement its FIAR Plan and FIAR Guidance to 

focus on strengthening processes, controls, and systems to improve the 

accuracy, reliability, and reporting for the Budgetary Schedule and the 

SBR and assess the existence, completeness, and valuation of missioncritical assets. It also needs to fully define, in the FIAR Guidance, actions 

needed to resolve long-standing department and component financial 

management weaknesses. In taking such actions, DOD should not lose 

sight of the ultimate goal of implementing lasting and sustainable financial 

management reform which provides reliable, useful, and timely 

information for decision making as a routine part of financial management 

operations. Auditable financial statements would be a natural byproduct 

of the department’s success.

To effectively monitor its components as they implement the FIAR 

Guidance and assess and test controls and remediate control 

deficiencies, DOD needs to establish a process for assuring that financial 

improvement plans have been effectively implemented.4 DOD 

management will need to monitor and assess the progress that the 

department is making. Additionally, the FIAR Directorate should validate 

that the military services and other components have achieved the seven 

critical capabilities. According to the April 2016 FIAR Guidance, these 

seven critical capabilities are related to DOD’s ability to: (1) produce a 

universe of transactions; (2) reconcile its Fund Balance with Treasury 

(FBWT) (i.e., balance its checkbook); (3) provide supporting 

 4

A financial improvement plan is a standard framework that organizes and prioritizes the 

financial improvement efforts of the reporting entities and aligns to the FIAR Methodology. 

Action Plan

Monitoring
DOD Financial Management

Page 286 GAO-17-317 High-Risk Series

documentation for material adjustments to its financial records; (4) 

validate the existence, completeness, and rights of its assets; (5) 

establish processes to manage and value its assets correctly; (6) 

establish an auditable process for estimating and recording its 

environmental and disposal liabilities; and (7) implement critical 

information technology controls for its financial systems.

DOD should take the following actions:

• assure that the Navy fully implements the FIAR Guidance for FBWT in 

the areas of analyzing processes, prioritizing, assessing and testing 

internal controls, and evaluating supporting documentation to support 

audit readiness;

• require the military services to improve their policies and procedures 

for monitoring their CAPs for financial management related findings 

and recommendations;

• improve its process for monitoring the military services’ audit 

remediation efforts by preparing a consolidated CAP management 

summary that provides a comprehensive picture of the status of 

corrective actions throughout the department; and

• expand the FIAR Plan Status Report so that Congress and other 

decision makers will have more sufficient information to assess DOD’s 

current audit readiness status and the improvements that still need to 

be made.

In addition, with regard to our open priority recommendations, DOD 

should monitor actions components are taking to

• direct DFAS to complete actions in response to our recommendations 

for implementing the requirements in the FIAR Guidance in the areas 

of planning, testing, and corrective actions;

• improve DOD processes to identify, estimate, reduce, recover, and 

report on improper payments to assure these processes fully comply 

with OMB guidance, the Improper Payments Information Act of 2002, 

as amended, and the Improper Payments Elimination and Recovery 

Act of 2010, and

• reconsider the status of three recommendations made by the House 

Armed Services Committee Panel on Defense Financial Management 

and Auditability Reform that the department determined to be met but 

that we determined to be partially met; these recommendations 

related to:
DOD Financial Management

Page 287 GAO-17-317 High-Risk Series

• attesting to audit readiness in each of the FIAR Plan Status 

Reports;

• including FIAR-related goals in Senior Executive Service 

performance plans and rewarding and evaluating performance 

over time based on these goals; and

• reviewing audit readiness assertions before component senior 

executive committees.

Improving the department’s financial management operations—and 

thereby providing DOD management and the Congress with more 

accurate and more reliable information on the results of its business 

operations—will not be an easy task. Key challenges remain, such as 

allocating the department’s workforce and budget among competing 

priorities, achieving the critical capabilities detailed in the FIAR Guidance, 

and executing CAPs to effectively remediate findings and 

recommendations from IPAs, the DOD OIG, and us.

According to its November 2016 FIAR Plan Status Report, DOD is 

continuing to work toward undergoing a full financial statement audit for 

fiscal year 2018; however, it expects to receive disclaimers of opinion on 

its financial statements for a number of years. This is why it is important 

for DOD and the military services to improve their processes for 

identifying, tracking, remediating, and monitoring audit findings and 

recommendations related to financial management. The military services 

will need to assure that they enhance their policies and procedures for 

remediating these findings and recommendations and DOD will need to 

obtain comprehensive information on the status of CAPs throughout the 

department in order to fully monitor and report on the progress being 

made to resolve financial management deficiencies. A lack of 

comprehensive information on the CAPs limits the ability of DOD and 

Congress to evaluate DOD’s progress toward achieving audit readiness, 

especially given the short amount of time remaining before DOD is 

required to undergo an audit of the department-wide financial statements 

for fiscal year 2018. Being able to show the progress that the department 

is making in remediating its financial management deficiencies will be 

useful as the department works toward implementing lasting financial 

management reform to ensure that it can generate reliable, useful, and 

timely information for financial reporting as well as for decision making 

and effective operations.

Demonstrated Progress
DOD Financial Management

Page 288 GAO-17-317 High-Risk Series

DOD continues to partially meet the leadership commitment criterion. 

Since the last high-risk update in 2015, the commitment of DOD’s senior 

leadership to improving the department’s financial management has 

continued to be encouraging. The statements, testimony, and actions of 

senior leaders have emphasized the importance of effective financial 

management and audit readiness to DOD’s stewardship over the 

substantial funding and other resources entrusted to the department.

In response to statutory requirements and targets, DOD leadership 

directives have set out a strategy and methodology for improving DOD’s 

financial management through the FIAR Plan Status Reports and FIAR 

Guidance. DOD’s current FIAR strategy and methodology focuses on four 

priorities—budgetary information, proprietary accounting and information, 

mission critical asset information, and valuation—with overall goals of 

improving the department’s financial management operations, helping 

provide service members with the resources they need to carry out their 

mission, and improving stewardship of the resources entrusted to DOD by 

the taxpayers. DOD Comptroller officials meet regularly with us for a 

constructive exchange of information on the status of DOD and 

component actions and to help sustain progress toward the FIAR goals.

The April 2016 FIAR Guidance incorporates recent policy updates related 

to integrating service providers and financial reporting on existence, 

completeness, and valuation of property. It also defines seven critical 

capabilities that reporting entities must address prior to asserting full audit 

readiness. According to DOD, the approach to achieving full financial 

statement auditability by September 30, 2017, relies upon each DOD 

component and service provider addressing the seven critical capabilities 

in a timely manner; failing to do so will put the entire department’s 

strategy at risk.

DOD continues to partially meet the capacity criterion. DOD faces 

capacity challenges because (1) its financial management personnel are 

insufficient in number, qualifications, and expertise; (2) its legacy financial 

systems data and ERPs lack the necessary standardization and reliability 

to support generating financial statements and related data; and (3) its 

service providers’ audit readiness activities are not fully integrated with 

Additional Details on 

What GAO Found

Leadership Commitment

Capacity
DOD Financial Management

Page 289 GAO-17-317 High-Risk Series

respective DOD components’ audit readiness activities. DOD continues to 

identify the need for sufficient numbers of qualified and experienced 

personnel as a challenge to achieving its goals of financial improvement 

and audit readiness. In the November 2016 FIAR Plan Status Report, 

DOD reported that audit readiness resources are expected to decline 

across the department as audit readiness activities continue to rise. For 

example, DOD reported that new financial statement audits will increase 

the work demands on headquarters staff. However, since the department 

has been mandated to reduce its headquarters workforce by fiscal year 

2020, this additional work could exacerbate the demands on the 

workforce. In addition, the Defense Health Program reported that 

resources needed to concurrently support audit readiness and financial 

management operations exceed the capacity of its available resources. 

Similarly, the Army identified resource constraints and the timing of its 

fiscal year 2016 Schedule of Budgetary Activity audit as challenges to its 

ability to remediate audit findings related to its ERP systems. Further, 

DOD reported in its November 2016 FIAR Plan Status Report that 

resource needs for financial statement audits will likely increase as the 

scope of the audits expand and work to correct audit findings increases.

DOD has undertaken efforts to increase the knowledge and skills of its 

financial management workforce by implementing its financial manager 

certification program. However, it will take some time before DOD’s 

financial management staff achieves the level of training and experience 

needed to support and sustain financial management as envisioned by 

the FIAR Plan. Further, DOD’s decentralized management environment 

may have an effect on the ability of its financial management personnel to 

gain the requisite expertise to develop and implement needed CAPs. 

Moreover, while DOD has made progress in financial manager training, it 

lacks the level of expertise needed to lead financial management reform 

across the department.

DOD faces challenges with its systems’ capacity to generate reliable, 

auditable financial information because it continues to rely on (1) legacy 

systems and related processes and controls that feed financial 

information to component general ledger systems and (2) general ledger 

systems, including ERP systems, that do not meet federal accounting 

standards, U.S. Standard General Ledger (USSGL)5 requirements, 

 5

The USSGL provides a uniform Chart of Accounts and technical guidance to be used in 

standardizing federal agency accounting practices. The Department of the Treasury 

issues USSGL Implementation Guidance.
DOD Financial Management

Page 290 GAO-17-317 High-Risk Series

federal financial management system requirements, and DOD’s Standard 

Financial Information Structure.6 DOD continues to report that relying on 

legacy systems is a challenge. This is because legacy systems produce 

data that are not standardized and are therefore difficult to reconcile to 

the financial statements. Many legacy systems will still be in use when the 

audit of DOD’s fiscal year 2018 full financial statements must commence. 

In its May 2016 FIAR Plan Status Report, DOD discussed continuing 

challenges regarding the large number of business and financial systems 

and the level of effort and cost of developing and maintaining an auditready systems environment.

DOD continues to implement and upgrade various ERP systems to 

establish an audit-ready systems environment. However, because these 

systems were not always designed to capture transaction-level 

information that can be tied to original supporting documents, significant 

time will be needed to make necessary modifications to assure that they 

generate reliable financial information. DOD components have varying 

plans for correcting system deficiencies; for some components, 

completion dates have either not been determined or extend into fiscal 

year 2019.

DOD uses service providers to improve efficiency and standardize 

business operations in various functional areas, including accounting, 

personnel and payroll, logistics, contracting, and system operations and 

hosting support. DOD service providers and their business systems are 

fundamental to reliable accounting and reporting and financial audit 

readiness. For example, to process and record payments to contractors, 

DOD components depend on over a dozen systems owned and operated 

by service providers and on nonstandard business processes that need to 

link between the components and service providers. This complex level of 

interdependency increases the difficulty of identifying the systems that 

need to be modified, upgraded, or eliminated to support financial 

management improvement and audit readiness and the difficulty of 

defining critical roles and responsibilities for carrying out such actions.

The FIAR Guidance calls for examinations of DOD service providers’

systems, processes, and controls. The IPAs that conduct these 

examinations have continued to identify deficiencies in service providers’

 6

The Standard Financial Information Structure is DOD’s comprehensive data structure 

that supports department-wide data requirements for budgeting, financial accounting, cost 

and performance management, and external reporting purposes. 
DOD Financial Management

Page 291 GAO-17-317 High-Risk Series

systems, processes, and controls that affect the reliability of financial data 

and information used in the related business processes. Each of the 

components has identified integration with DOD service providers as a 

challenge to completing financial improvement initiatives and audit 

readiness efforts. For example, the Army has expressed concerns about 

service providers’ abilities to provide timely responses to auditor samples, 

data requests, and sufficient supporting documentation. In addition, the 

Marine Corps has expressed concerns about the ability of service 

providers to provide supporting documentation for existence, 

completeness, rights, and valuation of Marine Corps assets. Further, the 

military services have expressed concerns about how DFAS manages 

suspense accounts and provides supporting documentation for 

adjustments made by journal vouchers.7

DOD continues to partially meet the action plan criterion. While the 

military services have developed, implemented, and validated many 

corrective actions, DOD’s limited progress in making needed financial 

management reform can be attributed to its decentralized management 

environment and cultural resistance to change, which have significantly 

impeded the department’s ability to modernize and transform business 

processes, systems, and controls. Sound financial management practices 

and reliable, useful, and timely financial information are important to help 

ensure accountability over DOD’s extensive resources and to efficiently 

and economically manage the department’s assets and budgets. Under 

DOD’s nonstandard, decentralized environment, each component is 

responsible for following steps in OMB’s guidance and DOD’s FIAR 

Guidance for addressing financial management related findings and 

recommendations reported by external auditors, including steps to (1) 

identify and track them, (2) prioritize them, (3) develop CAPs to remediate 

them, and (4) monitor the implementation status of the CAPs.

However, we found that the remediation processes designed by each 

military service had deficiencies in one or more of these areas. For 

example, each military service’s policies and procedures lacked sufficient 

controls to reasonably assure that they identified and tracked the 

complete universe of open findings and recommendations related to 

 7

Suspense accounts are accounts in the general ledger in which amounts are temporarily 

recorded. The suspense account is used because the proper account could not be 

determined at the time the transaction was recorded. When the proper account is 

determined, the amount will be moved from the suspense account to the proper account. 

Action Plan
DOD Financial Management

Page 292 GAO-17-317 High-Risk Series

financial management. Without identifying and tracking the complete 

universe of unresolved deficiencies, the military services cannot 

reasonably assure that the deficiencies will be addressed in a timely 

manner, which can ultimately affect the reliability of financial information 

and the auditability of their financial statements.

The need to effectively implement financial management remediation 

processes has become more important in light of (1) the hundreds of 

findings and recommendations that resulted from the fiscal year 2015 and 

2016 Budgetary Schedule audits, (2) future audits that will have a broader 

scope of work and may therefore identify additional findings and 

recommendations, and (3) the short period remaining before DOD is 

required to undergo a full financial statement audit for fiscal year 2018.

DOD components have self-identified completion dates for achieving the 

seven critical audit readiness capabilities for both their general funds and 

working capital funds in coordination with their service providers.8 As 

reported in DOD’s November 2016 FIAR Plan Status Report, most of 

DOD’s audit readiness tasks and associated audit readiness milestones 

have planned completion dates in fiscal year 2017. DOD faces significant 

challenges, given its limited progress in assuring it can attain the seven 

critical capabilities and the volume and magnitude of open audit findings 

and recommendations that still need to be addressed from the fiscal year 

2015 and 2016 Budgetary Schedule audits of the Army, Navy, and Air 

Force.

To date, the efforts of DOD components to implement the FIAR Guidance 

have not fundamentally transformed systems and operations as 

necessary to produce reliable, useful, and timely information for day-today decision making on mission and operations. Resolving these 

deficiencies also will be crucial to DOD’s efforts to meet the statutory 

requirement to undergo a full financial statement audit for fiscal year 

2018. However, much work remains to be completed in order for this date 

to be met. In its November 2016 FIAR Plan Status Report, DOD stated 

 8

General funds are accounts in the U.S. Treasury holding monies not allocated by law to 

any other program account in contrast to other types of accounts such as revolving funds 

or trust funds where the funds are earmarked for a specific purpose. The working capital 

fund operates as a self-sustaining entity, financing inventories of common supplies and 

providing working capital for industrial and commercial activities that provide common 

services within or among DOD entities. The working capital fund is intended to (1) 

generate sufficient resources to cover the full costs of support organizations and (2) 

operate on a break-even basis over time.
DOD Financial Management

Page 293 GAO-17-317 High-Risk Series

that readiness to undergo an audit does not mean that it expects to 

receive a positive opinion and that it is important to continue the audit 

regimen in order to gain valuable information from its early audit efforts, 

information that will help focus the department’s corrective actions in the 

most critical areas.

DOD has not met the monitoring criterion. Effective monitoring requires 

instituting a program to monitor and independently validate the 

effectiveness and sustainability of corrective measures. However, as we 

have reported, while the DOD Comptroller has established several 

elements of a department-wide audit readiness remediation process, the 

DOD Comptroller does not obtain the complete, detailed information on 

all corrective action plans (CAP) from the military services related to the 

department’s critical capabilities necessary to fully monitor and assess 

DOD’s progress. Specifically, DOD does not prepare a consolidated 

management summary that would provide a comprehensive, departmentwide picture of the status of CAPs needed for audit readiness that 

includes all of the elements that are recommended by the Implementation 

Guide for OMB Circular A-123.9 As a result, reports to external 

stakeholders, such as Congress, on the status of audit readiness do not 

provide comprehensive information on progress against the CAPs, 

limiting the ability of DOD and Congress to evaluate DOD’s progress 

toward achieving audit readiness, especially given the short amount of 

time remaining before the statutorily required full financial statement audit 

for fiscal year 2018. Further, the lack of comprehensive information on the 

status of CAPs increases DOD’s risk that it will not be able to fully, timely, 

and efficiently correct its long-standing deficiencies.

In addition, we reported that DOD’s FIAR Plan Status Reports do not 

provide adequate visibility for Congress and other decision makers 

regarding the extent to which DOD has addressed certain internal control 

 9

The Implementation Guide for OMB Circular A-123 recommends that a CAP include a (1) 

summary description of the deficiency; (2) the year the deficiency was first identified; (3) 

the target corrective action date (the date of management follow-up); (4) the agency 

official responsible for monitoring progress; (5) outcome measures for assessing the 

effectiveness of corrective actions; and (6) interim milestones for monitoring progress on 

interim actions. 

Monitoring
DOD Financial Management

Page 294 GAO-17-317 High-Risk Series

deficiencies that it refers to as deal-breakers.10 For example, the status 

reports do not include information on (1) audit assertions made without 

correcting internal control deficiencies along with actions and plans to 

remediate the deficiencies and (2) details of military services’ actions 

taken and progress made toward correcting the underlying deficiencies 

for reported deal-breakers. Without greater visibility of the status of 

DOD’s audit readiness or progress toward reported completion dates in 

its FIAR Plan Status Report, Congress and other decision makers may 

not have sufficient information to assess DOD’s current audit readiness 

status and the improvements that still need to be made.

DOD has not effectively implemented the FIAR Guidance because, in 

part, it lacks effective monitoring to assess the effectiveness of controls 

and the remediation of control deficiencies. For example, we reported that 

the Navy did not fully implement the FIAR Guidance for reconciling its 

FBWT in the areas of process analysis, prioritization, internal control 

assessment and testing, and evaluation of supporting documentation to 

support audit readiness. In addition, each of the IPAs that performed 

audits of the military services fiscal year 2016 Budgetary Schedules 

identified deficiencies in monitoring information technology controls for its 

financial systems.

DOD also has challenges with carrying out its strategy in the FIAR 

Guidance with regard to its critical capabilities. For example, the DOD 

OIG reported that the Army could not reconcile approximately $207 billion 

(68 percent) of its outlays, because the Army and DFAS did not 

coordinate to reengineer business processes when they implemented a 

new FBWT reconciliation tool. As a result, the DOD OIG reported that the 

Army cannot demonstrate an effective FBWT transaction-level 

reconciliation, which DOD identified as one of the deal-breakers to 

auditability. Furthermore, the DOD OIG reported that Army and DFAS 

could not adequately support material amounts of year-end adjustments 

to the Army General Fund financial data during the fiscal year 2015 

financial statement compilation. As a result, the data used to prepare the 

fiscal year 2015 Army General Fund statements were unreliable and

lacked an adequate audit trail. The DOD OIG also reported that DOD and 

Army managers could not rely on the data in the accounting systems 

 10Drawing on lessons learned from past audit readiness efforts, DOD compiled a list of 

deal-breakers that have prevented it from demonstrating audit readiness or receiving 

unmodified or “clean” opinions in audits. The seven critical capabilities noted previously in 

this report are a subset of these deal-breakers. 
DOD Financial Management

Page 295 GAO-17-317 High-Risk Series

when making management and resource decisions. According to the 

DOD OIG, until these control deficiencies are corrected, there is a 

considerable risk that the Army General Fund financial statements will be 

materially misstated and that the Army will not achieve the goal of being 

audit ready by September 30, 2017.

DOD has not met the demonstrated progress criterion, showing limited 

progress in implementing corrective measures to resolve its long-standing 

financial management challenges. For example, because of difficulties 

encountered in preparing for an audit of the multi-year Statement of 

Budgetary Resources (SBR), DOD decided that, beginning with fiscal 

year 2015, it would limit the scope of the initial audits for all DOD 

components to current-year budget activity reported on a Budgetary 

Schedule.11 This was intended to be an interim step toward achieving the 

audit of multiple-year budgetary activity required for an audit of the SBR, 

with subsequent audits including current-year appropriations as well as 

prior-year appropriations going back to fiscal year 2015. Consequently, 

the Budgetary Schedules for the Army, Navy, and Air Force for fiscal year 

2015 reflected only current year budget activity. As noted above, all three 

of the IPAs contracted to audit these fiscal year 2015 Budgetary 

Schedules issued disclaimers, meaning that the IPAs were unable to 

express an opinion because they lacked sufficient evidence to support the 

amounts presented.

The IPAs for the three military services also identified material 

weaknesses in internal control. These weaknesses included military 

services’ inability to, among other things, reasonably assure that the 

Budgetary Schedules reflected all of the relevant financial transactions 

that occurred and that documentation was available to support such 

transactions. The IPAs for the three military services also issued 

disclaimers on the three services’ fiscal year 2016 Budgetary Schedules 

for reasons similar to those identified in the fiscal year 2015 audits. 

Further, the results of these audits—with hundreds of open findings and 

recommendations—show the extent and complexity of improvements 

needed to provide reliable information for financial reporting as well as for 

sound decision making on mission and operations.

 11In addition to the military services, DOD components include entities such as the 

defense agencies. 

Demonstrated Progress
DOD Financial Management

Page 296 GAO-17-317 High-Risk Series

For additional information about this high-risk area, contact Asif Khan at 

(202) 512-9869 or khana@gao.gov.

DOD Financial Management: Significant Efforts Still Needed for 

Remediating Audit Readiness Deficiencies. GAO-17-85. Washington, 

D.C.: February 9, 2017.

DOD Financial Management: Improvements Needed in the Navy’s Audit 

Readiness Efforts for Fund Balance with Treasury. GAO-16-47. 

Washington, D.C.: August 19, 2016.

DOD Financial Management: Greater Visibility Needed to Better Assess 

Audit Readiness for Property, Plant, and Equipment. GAO-16-383. 

Washington, D.C.: May 26, 2016.

DOD Financial Management: Improved Documentation Needed to 

Support the Air Force’s Military Payroll and Meet Audit Readiness Goals. 

GAO-16-68. Washington, D.C.: December 17, 2015.

DOD Financial Management: Additional Efforts Needed to Improve Audit 

Readiness of Navy Military Pay and Other Related Activities. 

GAO-15-658. Washington, D.C.: September 15, 2015.

DOD Financial Management: Continued Actions Needed to Address 

Congressional Committee Panel Recommendations. GAO-15-463. 

Washington, D.C.: September 28, 2015.

DOD Financial Management: Actions Are Needed on Audit Issues 

Related to the Marine Corps’ 2012 Schedule of Budgetary Activity. 

GAO-15-198. Washington, D.C.: July 30, 2015.

GAO Contact

Related GAO 

Products
DOD Business Systems Modernization

Page 297 GAO-17-317 High-Risk Series

The Department of Defense (DOD) spends billions of dollars each year to 

acquire modernized systems that are fundamental to achieving its 

business transformation goals, including systems that address key areas 

such as personnel, financial management, health care, and logistics. 

While DOD’s capacity for modernizing its business systems has improved 

over time, significant challenges remain. These challenges include fully 

defining and establishing management controls for business systems 

modernization. Such controls are vital to ensuring that DOD can 

effectively and efficiently manage an undertaking with the size, 

complexity, and significance of its business systems modernization, and 

minimize the associated risks. DOD’s effort to modernize its business 

systems environment has been designated as high risk since 1995.

DOD has demonstrated elements of leadership commitment and has 

made progress in this area by taking steps to manage the modernization 

of its business systems more effectively and efficiently. For example, the 

department has begun to implement an improved investment 

management framework and processes, and has established the capacity 

to use its federated architecture to identify potentially duplicative 

investments. However, more needs to be done to leverage DOD’s 

capacity to identify potentially duplicative investments, and to ensure that, 

among other things, systems are reviewed at appropriate levels as part of 

the department’s improved investment management framework.

In addition, DOD’s business systems modernization efforts continue to fall 

short of cost, schedule, and performance expectations, and the 

department has not yet established an action plan (or plans) highlighting 

how it intends to improve its use of its business architecture, improve its 

business system investment management process, or improve its 

business system acquisition outcomes. The department can leverage the 

federal information technology (IT) dashboard as a mechanism for 

beginning to monitor progress in improving its business system 

acquisition outcomes. Nevertheless, without an action plan, DOD lacks a 

baseline against which it can monitor broader progress in its business 

systems modernization efforts.

Further, the National Defense Authorization Act for Fiscal Year 2017 and 

its accompanying conference report include provisions that might impact 

how the department will manage its business systems. Specifically, the 

act establishes a Chief Management Officer and the accompanying 

conference report calls for the department to develop a plan by June 

2017 to implement a more optimized organizational structure and 

DOD Business Systems Modernization

Why Area Is High 

Risk

What GAO Found
DOD Business Systems Modernization

Page 298 GAO-17-317 High-Risk Series

processes to support information management and cyber operations, 

including the policy, direction, oversight, and acquisition functions 

associated with, among other things, business systems. The impact of 

these provisions on the department’s business systems modernization 

efforts remains to be seen.

Although more needs to be done to address this high-risk issue, DOD has 

achieved important benefits by implementing our recommendations. For 

example, fiscal years 2013 and 2014 saw total financial savings of $970 

million due to the department cancelling the Air Force’s Expeditionary 

Combat Support System because of significant cost and schedule 

overages discovered as a result of increased oversight.

DOD must more fully demonstrate leadership commitment and progress 

in implementing critical IT modernization management controls. For 

example, the department needs to address the provisions of the 

conference report accompanying the Fiscal Year 2017 National Defense 

Authorization Act that call for DOD to develop a plan by June 2017 to 

implement a more optimized organizational structure and processes to 

support, among other things, business systems. DOD also needs to 

ensure that its business system investments are managed with the kind of 

rigor and discipline embodied in relevant acquisition management 

guidance and best practices so that each investment will deliver expected 

benefits and capabilities on time and within budget. In addition, DOD 

should ensure that its information reported on the Office of Management 

and Budget’s IT Dashboard is reliable and, over time, demonstrates 

improved achievement of cost, schedule, and performance expectations.1

DOD should also demonstrate that it is improving its guidance on 

incrementally developing IT systems to help ensure a timely delivery of 

needed capabilities, consistent with the Federal IT Acquisition Reform 

provisions of the Carl Levin and Howard P. ‘Buck’ McKeon National 

Defense Authorization Act for 2015.2

 1

The dashboard aims to provide transparency for these investments to aid public 

monitoring of government operations. It is to do so by reporting, among other things, how 

agency chief information officers rate investment risk. 

2

The Federal IT Acquisition Reform provisions of the Carl Levin and Howard P. ‘Buck’

McKeon National Defense Authorization Act for Fiscal Year 2015 require that OMB capital 

planning guidance require that the chief information officer of each covered agency, 

including DOD, certify that IT investments are adequately implementing incremental 

development, as defined in the guidance. 

What Remains to Be 

Done
DOD Business Systems Modernization

Page 299 GAO-17-317 High-Risk Series

In addition, DOD needs to take steps to address key portfolio 

management practices documented in our IT Investment Management 

Framework. For example, DOD has not yet defined criteria for reviewing 

defense business systems at an appropriate DOD level based on factors 

such as complexity, scope, cost, and risk in support of the certification 

and approval process. DOD also needs to develop plans defining how it 

will ensure that it is using its federated business architecture to identify 

and address potentially duplicative investments within its business 

systems environment.

Further, DOD should demonstrate that plans exist for addressing these 

various actions and associated recommendations, and that it is 

monitoring progress against these plans and demonstrating progress and 

related outcomes. DOD also needs to ensure that it has the appropriate 

capacity in place by conducting needed human capital analyses.

DOD has partially met the criterion for leadership commitment. For 

example, the department has taken steps to improve its publicly available 

Additional Details on 

What GAO Found

DOD’s Business System 

Acquisition Management

Leadership Commitment
DOD Business Systems Modernization

Page 300 GAO-17-317 High-Risk Series

investment ratings and encourage incremental development. However, 

more remains to be accomplished before the department can fully 

demonstrate leadership commitment. In particular, the department needs 

to take steps to improve the accuracy of the department’s ratings, 

improve its use of incremental development, and further define 

expectations for managing its business system investments.

In March 2014, the department revised its chief information officer ratings 

process for investments presented on the Federal IT Dashboard to take 

into account additional information about the risk of its investments, such 

as investment complexity, execution issues, and external risk 

assessments, including our reports. Establishing an accurate picture of 

program risk helps department management better understand which 

investments would benefit from additional oversight. Nevertheless, we 

reported in June 2016 that investment risk ratings presented on the 

Dashboard were not consistent with our assessment of investment risks.3

Specifically, our assessment of 25 DOD programs, 4 of which were 

defense business systems, determined that 19 of the programs, including 

all 4 defense business systems, were at a higher risk level than what was 

presented on the Dashboard.

Moreover, in January 2015, the department revised Department of 

Defense Instruction 5000.02: Operation of the Defense Acquisition 

System, which describes an incremental software development approach 

for IT investments. According to the instruction, the approach has been 

adopted for many defense business systems. This is partially consistent 

with the recommendation from our May 2014 report emphasizing the 

importance of IT investments delivering capabilities in smaller increments 

over shorter periods of time.4 However, the instruction does not provide a 

time frame for how often functionality is to be delivered. As a result, the 

instruction does not fully address our recommendation, which calls for 

DOD to update its incremental development policies to ensure that it 

complies with Office of Management and Budget guidance. This guidance 

requires federal agencies to deliver usable system functionality every 6 

months.

In addition, the results from our recent related work show that the 

department has not consistently implemented an incremental 

 3

GAO-16-494.

4

GAO-14-361.
DOD Business Systems Modernization

Page 301 GAO-17-317 High-Risk Series

development approach for all of its major IT investments. Specifically, in 

August 2016,5 we reviewed 14 business system projects associated with 

seven business system investments and found that, in fiscal year 2016, 

only 8 projects planned to deliver functionality every 6 months.6

Moreover, only nine projects planned to deliver functionality every 12 

months. Six of the projects that had planned to deliver functionality within 

6 months were associated with only one of the seven investments. 

According to DOD officials, the department allows its program managers 

to determine the appropriate delivery schedule. The officials also noted 

that a 6-month schedule would be too expensive to implement given the 

scale of the projects at the department. Nevertheless, until DOD modifies 

and implements its incremental development policy, it continues to run 

the risk of failing to deliver major investments in a cost-effective and 

efficient manner.

In November 2016, DOD officials from the Offices of the Deputy Chief 

Management Officer, Under Secretary for Acquisition, Technology, and 

Logistics, and DOD Chief Information Officer stated that the department 

had developed a draft DOD Instruction focused on improving business 

system acquisition. This instruction is to provide guidance in areas such 

as risk management, requirements management, and incremental 

development. However, as of December 2016, the department had not 

completed the instruction. In addition, as previously discussed, the impact 

of provisions included in the National Defense Authorization Act for Fiscal 

Year 2017, and its accompanying conference report, on DOD business 

system acquisition management remains to be seen.

DOD has not met the criterion for capacity. In May 2013, we reported that 

the Office of the Deputy Chief Management Officer, which is responsible 

for annually reviewing and approving the expenditure of funds associated 

with DOD business systems, had not conducted a human capital analysis 

and that no plans existed to analyze and address skill gaps, thus limiting 

the department’s capacity to lead improvement initiatives in these areas. 

In August 2016, department officials reported that the office had 

undergone two reorganizational changes and used skill inventories, 

 5

GAO-16-469.

6

The 14 business system projects were part of seven larger business systems 

investments. For example, the Defense Enterprise Accounting and Management System 

Increment 1 investment contained one project that was reviewed, while the Integrated 

Electronic Health Record Increment 1 investment contained two projects that were 

reviewed.

Capacity
DOD Business Systems Modernization

Page 302 GAO-17-317 High-Risk Series

needs assessments, and gap analyses as part of a strategic approach to 

human capital planning. However, DOD has not provided evidence of 

having performed a needs assessment or a gap analysis. In November 

2016, an official from the department’s Office of the Under Secretary of 

Defense for Acquisition, Technology and Logistics stated that the 

department planned to take additional steps to address human capital 

needs after issuing its forthcoming instruction on defense business 

systems.

DOD has not met the criterion for developing an action plan. In particular, 

the department lacks a plan (or plans) to monitor efforts to manage its 

business system investments with the rigor and discipline embodied in 

relevant acquisition guidance and best practices. In October 2016, the 

Assistant Deputy Chief Management Officer described steps the 

department is taking to make improvements in this area, but stated that 

the department has not developed an action plan to address this high-risk 

area.

DOD has partially met the criterion for monitoring progress. Specifically, 

the department can leverage the Federal IT Dashboard with more 

accurate data as a mechanism for beginning to monitor progress in 

improving its business system acquisition outcomes. However, without an 

approved action plan for addressing the DOD Business Systems 

Modernization high-risk area, the department lacks a means to monitor 

broader progress in making improvements to its business system 

acquisition management efforts.

DOD has partially met the criterion for demonstrating progress. As 

discussed previously, the department has taken steps to improve 

business system acquisition management. However, it needs to show 

continued progress as it takes steps to improve its efforts. For example, in 

our series of reports on DOD major automated information systems,7 we 

reported that the department has had mixed success in addressing key 

acquisition practices, such as risk and requirements management. We 

also continue to identify examples of business systems that do not meet 

performance expectations and experience significant cost overruns and 

schedule slippages.

 7

GAO-16-336, GAO-15-282, GAO-14-309, GAO-13-311.

Action Plan

Monitoring

Demonstrated Progress
DOD Business Systems Modernization

Page 303 GAO-17-317 High-Risk Series

For example, in March 2016,8 we reported that the projected cost of the 

Air Force system that provides financial capabilities, such as cost 

accounting and collections, had increased about 9 percent from the 

program’s first February 2012 estimate (from approximately $1.43 billion 

up to $1.56 billion). Program officials attributed the cost increase, in part, 

to program scope growth and the addition of software upgrade 

enhancements. We also reported that this system experienced a 1-year 

slippage in its full deployment decision date. Program officials attributed 

this slippage to findings identified in the system’s initial operational test 

and evaluation report. In addition, the system did not meet five of its nine 

key performance indicators. In November 2016, DOD officials stated that 

the system was not deployed as planned and is currently undergoing a 

critical change. Accordingly, as of November 2016, updated milestones 

have not yet been established.

DOD has partially met the criterion for leadership commitment. 

Specifically, the department has taken steps to improve its business 

 8

GAO-16-336.

DOD’s Business System 

Investment Management 

Process

Leadership Commitment
DOD Business Systems Modernization

Page 304 GAO-17-317 High-Risk Series

systems investment management process to include defining and 

implementing policies and procedures for managing portfolio-level 

investments consistent with our Information Technology Investment 

Management Framework, and relevant investment management and 

business system modernization requirements. For example, in July 2015, 

we reported that DOD was continuing its efforts to further define and 

implement its defense business system governance framework, called the 

Integrated Business Framework.9

In this regard, the department had taken steps to align its business 

system certification and approval process with its planning, programming, 

budgeting, and execution process. According to the department’s 

February 2015 certification and approval guidance, organizational 

execution plans, which are to summarize each component’s business 

strategy for each functional area (e.g., financial management), are to 

include information about certification requests for the upcoming fiscal 

year as well as over the course of the department’s Future Years Defense 

Program.10

In addition, DOD has generally concurred with our recommendations to 

address improvements to its management of business systems. 

Nevertheless, the department needs to show continued leadership 

commitment and progress in addressing our associated 

recommendations as it takes steps to improve its business system 

investment management process. These recommendations are aimed at 

ensuring that business systems receive the appropriate levels of review 

using a tiered investment review board approach, and that strategies for 

DOD functional areas include all of the critical elements identified in DOD 

investment management guidance.11 These critical elements include 

performance measures to determine progress toward achieving the goals 

that incorporate all of the attributes called for in the department’s 

guidance. Further, as previously discussed, the impact of provisions in 

the National Defense Authorization Act for Fiscal Year 2017, and its 

 9

GAO-15-627.

10The Future Years Defense Program is DOD’s financial plan over a 5-year period.

11Functional Strategies define business outcomes, priorities, measures, and standards for 

a given functional area within DOD. The functional areas are acquisition; defense security 

enterprise; enterprise IT infrastructure; financial management; human resources 

management and health management; installations and environment; logistics and 

materiel readiness; and security cooperation.
DOD Business Systems Modernization

Page 305 GAO-17-317 High-Risk Series

associated conference report, on the department’s business systems 

investment management process remains to be seen.

DOD has partially met the criterion for capacity. Although the department 

has established an investment review board to oversee its portfolio-based 

investment management process, much still remains to be accomplished 

to better define and institutionalize this process. For example, as of 

December 2016, the department had not yet issued an update to its 

February 2015 Certification Guidance. Officials from the Offices of the 

Deputy Chief Management Officer, Under Secretary for Acquisition, 

Technology and Logistics, and DOD Chief Information Officer stated in 

November 2016 that the department was developing a DOD Instruction 

aimed at improving the management of defense business systems. 

According to the officials, updated guidance on defense business 

systems, including updated certification guidance, will be issued after the 

instruction is finalized.

In addition, in May 2013, we reported that the Office of the Deputy Chief 

Management Officer, which is responsible for annually reviewing and 

approving the expenditure of funds associated with DOD business 

systems, had not conducted a human capital analysis and had not 

developed plans to analyze and address skill gaps, thus limiting the 

department’s capacity to lead improvement initiatives in these areas. In 

August 2016, department officials reported that the office had undergone 

two reorganizational changes and used skill inventories, needs 

assessments, and gap analyses as part of a strategic approach to human 

capital planning. However, DOD has not provided evidence of having 

performed a needs assessment or a gap analysis. Nevertheless, in 

November 2016, an official from the department’s Office of the Under 

Secretary for Acquisition, Technology and Logistics stated that the 

department planned to take additional steps to address human capital 

needs after issuing its forthcoming instruction on defense business 

systems.

DOD has not met the criterion for developing an action plan. Specifically, 

the department has not established an action plan (or plans) for 

addressing gaps in its business system investment management 

approach. In October 2016, the Assistant Deputy Chief Management 

Officer described steps the department is taking to make improvements in 

this area, but stated that the department has not developed an action plan 

to address this high-risk area.

Capacity

Action Plan
DOD Business Systems Modernization

Page 306 GAO-17-317 High-Risk Series

DOD has not met the criterion for monitoring progress. Specifically, 

without an approved action plan for addressing the DOD Business 

Systems Modernization high-risk area, the department lacks a means to 

monitor progress in making improvements to its business system 

investment management process.

DOD has partially met the criterion for demonstrated progress. As 

discussed previously, the department has taken steps to improve its 

business system investment management process. However, the 

department needs to show continued progress in addressing our 

associated recommendations as it takes steps to improve its business 

system investment management process. For example, as discussed, in 

February 2015, the department took steps to align its business system 

certification and approval process with its planning, programming, 

budgeting, and execution process. However, as we reported in July 2015, 

the department’s February 2015 certification and approval guidance does 

not specify a process for conducting an assessment or call for the use of 

actual versus expected performance data and predetermined thresholds.

Monitoring

Demonstrated Progress
DOD Business Systems Modernization

Page 307 GAO-17-317 High-Risk Series

DOD has partially met the criterion for leadership commitment for its 

federated business enterprise architecture.12 For example, in May 2014, 

we reported that the department’s Deputy Chief Management Officer 

required all business systems to be entered into the architecture 

compliance tool before they could be certified and approved as part of 

DOD’s business system investment management process. In addition, 

the Office of the Deputy Chief Management Officer has initiated an effort 

to improve how the department leverages the architecture, and the 

department has identified several associated milestones. However, as of 

December 2016, the department had not demonstrated that this effort and 

the associated milestones had obtained final approval from the Assistant 

Deputy Chief Management Officer. In addition, as previously discussed, 

the impact of provisions in the National Defense Authorization Act for 

 12DOD’s business enterprise architecture is intended to serve as a blueprint for the 

department’s business transformation efforts. In particular, the architecture is to guide and 

constrain implementation of interoperable defense business systems by, among other 

things, documenting the department’s business functions and activities and the business 

rules, laws, regulations, and policies associated with them. In a federated enterprise 

architecture, member architectures (e.g., Air Force, Army, and Navy) conform to an 

overarching corporate or parent architecture (e.g., DOD) and use a common vocabulary.

DOD’s Federated 

Business Enterprise 

Architecture

Leadership Commitment
DOD Business Systems Modernization

Page 308 GAO-17-317 High-Risk Series

Fiscal Year 2017, and its accompanying conference report, on the 

business architecture remains to be seen.

DOD has met the criterion for capacity by establishing tools and 

processes intended to improve the department’s efforts to identify 

potentially duplicative systems by leveraging the federated business 

enterprise architecture. For example, in 2014, the department completed 

efforts to automate its business architecture compliance review process. 

According to officials, this automation will improve the department’s 

efforts to identify potentially duplicative systems. In addition, the 

department’s December 2014 problem statement requirements validation 

guidance called for an enterprise architecture analysis to be conducted to 

determine if a capability already exists within the organization or 

elsewhere across the department. Further, the department’s April 2015 

business enterprise architecture compliance guidance reinforced this 

guidance by stating that programs should be examined for potential 

duplication and overlap during the problem statement requirements 

analysis process, which is to occur early in a program’s life cycle.

DOD has not met the criterion for developing an action plan. The 

department has initiated an effort to improve how it leverages the 

architecture and identified several associated milestones. However, as of 

December 2016, the department had not demonstrated that this effort and 

the associated milestones had been approved by the Assistant Deputy 

Chief Management Officer.

DOD has not met the criterion for monitoring progress. The department 

has developed a draft plan to improve how it leverages the architecture 

and identified several associated milestones. However, as of December 

2016, the department had not demonstrated that this effort and the 

associated milestones had been approved by the Assistant Deputy Chief 

Management Officer. Without approved plans, DOD lacks a means to 

monitor progress in leveraging its architecture compliance tool.

DOD has partially met the criterion for demonstrated progress. For 

example, the department has established the capacity to identify 

potentially duplicative investments. DOD has also provided examples of 

benefits attributed, at least in part, to the department’s business 

enterprise architecture. For example, according to officials from the Office 

of the Deputy Chief Management Officer, two proposed new defense 

business system investments were not approved by DOD due, in part, to 

architecture reviews that revealed the requested capabilities were already 

available in existing systems. In addition, in November 2016, the 

Capacity

Action Plan

Monitoring

Demonstrated Progress
DOD Business Systems Modernization

Page 309 GAO-17-317 High-Risk Series

department provided examples of programs that had been assessed for 

potential duplication and overlap based on their associated business 

activities. Nevertheless, the department has not yet demonstrated that it 

is actively and consistently using such assessments of potential 

duplication and overlap to eliminate duplicative systems. The 

department’s draft plan for improving how it leverages its business 

architecture acknowledges this gap and identifies steps the department 

can take to improve.

• In 2013, the department took actions to improve its investment 

management decision making. For example, the department’s 

investment management guidance, issued by the Office of the Deputy 

Chief Management Officer in April 2013, required the precertification 

authorities to include any open recommendations from us for program 

weaknesses, as well as a status update on addressing our 

recommendations as part of the certification requests. These actions 

help ensure that DOD’s Investment Review Board is provided with 

identified program weaknesses that can be appropriately considered 

and thus better inform and justify certification decisions for business 

systems investments.

• In 2014, the department reported all business system certification 

actions in its annual report to Congress. Specifically, DOD’s 2014 

annual report to Congress included, among other things, a list of all 

certification actions the department took in the previous year on its 

business systems modernization investments. For example, the report 

contained an attachment that reported all fiscal year 2014 certification 

actions, including the amount of funding requested, the amount 

approved or disapproved, and any conditions placed on funding not 

certified or conditionally certified.

• Additionally, fiscal years 2013 and 2014 saw total financial savings of 

$970 million due to the department cancelling the Air Force’s 

Expeditionary Combat Support System because of significant cost 

and schedule overages discovered as a result of increased oversight.

• In 2015, the department demonstrated that it took steps to help 

ensure that it was appropriately reengineering business processes on 

defense business systems. In particular, as part of DOD’s fiscal year 

2013 certification and approval process, the department placed 

conditions on certifications for these business systems requiring that a 

plan be submitted describing how each system would become 

compliant with business process re-engineering requirements. DOD 

officials also provided documentation showing that they tracked these 

Benefits Achieved by 

Implementing Our 

Recommendations
DOD Business Systems Modernization

Page 310 GAO-17-317 High-Risk Series

conditions. In addition, DOD has reported much higher levels of 

compliance with business process reengineering requirements in 

subsequent annual review cycles. For example, for the fiscal year 

2014 and 2015 certification cycles, DOD officials reported that only 

two systems and six systems, respectively, were approved that did 

not have complete business process reengineering assertions. 

Moreover, DOD officials provided justifications for why each of these 

systems did not have complete business process reengineering 

assertions.

• In 2016, the Air Force, Army, and Navy developed a plan for 

addressing core elements described in our Enterprise Architecture 

Management Maturity Framework.

For additional information about this high-risk area, contact Carol C. 

Harris at (202) 512-4456 or HarrisCC@gao.gov.

Information Technology Reform: Agencies Need to Increase Their Use of 

Incremental Development Practices. GAO-16-469. Washington, D.C.: 

August 16, 2016.

IT Dashboard: Agencies Need to Fully Consider Risks When Rating Their 

Major Investments. GAO-16-494. Washington, D.C.: June 2, 2016.

DOD Major Automated Information Systems: Improvements Can Be 

Made in Reporting Critical Changes and Clarifying Leadership 

Responsibility. GAO-16-336. Washington, D.C.: March 30, 2016.

DOD Business Systems Modernization: Additional Action Needed to 

Achieve Intended Outcomes. GAO-15-627. Washington, D.C.: July 16, 

2015.

Defense Major Automated Information Systems: Cost and Schedule 

Commitments Need to be Established Earlier. GAO-15-282. Washington, 

D.C.: February 26, 2015.

GAO Contact

Related GAO 

Products
DOD Support Infrastructure Management

Page 311 GAO-17-317 High-Risk Series

Since our 2015 high-risk update, the Department of Defense (DOD) has 

shown some improvement in managing its infrastructure to better achieve 

reductions and efficiencies, and has partially met each of the five criteria 

for removal from the High-Risk List. For this update, we are consolidating 

our evaluation of these two areas based on DOD officials’ assertion that 

achieving efficiencies in base support is integrated through numerous 

programs and efforts at the Office of the Secretary of Defense (OSD), 

military service, and installation levels, and is incorporated in DOD’s 

overall efforts to efficiently manage its infrastructure. Further, DOD 

officials stated that the joint basing program is no longer DOD’s primary 

effort for achieving efficiencies in base support services. For these 

reasons, we are reframing our evaluation to focus generally on DOD’s 

efforts to better align DOD’s support infrastructure with the needs of its 

forces and achieve efficiencies.

DOD manages a global real property portfolio that consists of more than 

562,000 facilities—including barracks, commissaries, data centers, office 

buildings, laboratories, and maintenance depots—located on about 4,800 

sites worldwide and covering more than 25 million acres. With a DODestimated replacement value of about $880 billion, this infrastructure is 

critical to maintaining military readiness, and the cost to build and 

maintain it represents a significant financial commitment.

Since designating this area as high risk in 1997, we have reported on 

various long-term challenges DOD faces in managing its infrastructure. 

Specifically, DOD has experienced obstacles reducing excess 

infrastructure, more efficiently using underutilized facilities, and reducing 

base support costs, as well as achieving efficiencies by consolidating or 

eliminating duplicate support services. In our 2015 high-risk update, we 

categorized the need for improvement into two areas: (1) reducing excess 

infrastructure, which included disposing of and consolidating facilities 

under the Base Realignment and Closure (BRAC) process and improving 

how DOD uses facilities; and (2) achieving efficiencies in base support 

through joint basing—a program aimed at consolidating support services 

by combining bases that are in close proximity or adjacent to one another. 

We reported that DOD retained significant excess capacity relative to its 

planned force structure; needed to improve the completeness and quality 

of its information on how it uses facilities to better manage and use them; 

and had not realized the anticipated cost savings and efficiencies in 

reducing duplicative support services through its joint basing program.

DOD Support Infrastructure Management

Why Area Is High 

Risk
DOD Support Infrastructure Management

Page 312 GAO-17-317 High-Risk Series

As cited previously, since our 2015 high-risk update, DOD has shown 

some improvement in managing its infrastructure to better achieve 

reductions and efficiencies, and has partially met each of the five criteria 

for removal from the High-Risk List. Specifically, DOD has demonstrated 

leadership by requesting more rounds of BRAC—its primary method for 

reducing excess infrastructure not needed to support its forces. DOD has 

also showed some improvement in its leadership commitment, capacity, 

action plans, monitoring, and progress by increasing the completeness of 

utilization data, publishing an overarching Real Property Efficiency Plan, 

communicating and addressing issues on consolidating installation 

services at the joint bases, and reducing excess infrastructure through the 

Freeze the Footprint policy. However, DOD needs to take additional steps 

across all five of our high-risk criteria. For example, DOD has not 

committed to take action on some of our recommendations related to it 

implementing any future BRAC rounds, such as improving DOD’s ability 

to estimate potential liabilities, and savings to achieve desired outcomes. 

Further, DOD continues to maintain excess capacity in relation to its force 

structure, including long-standing excess facilities, and needs to ensure 

accuracy of its real property data to better identify potential areas to 

reduce and consolidate facilities. DOD also needs to address in its plans 

any actions geared toward achieving efficiencies in base support 

services, such as through consolidating services. By acting on our 

recommendations to strengthen its efforts in each of these areas, DOD 

will be better positioned to align its support infrastructure with the needs 

of its forces and achieve efficiencies.

In April 2016, we provided DOD with a letter that outlined 19 actions and 

outcomes that we believe it should address in order to correct longstanding weaknesses in its support infrastructure management efforts. 

Based on discussions with DOD officials and recent efforts across the 

department, as of January 2017, we believe that DOD has addressed 4 of 

the 19 actions and outcomes related to capacity, monitoring, and 

demonstrated progress. Specifically, DOD evaluated the purpose of joint 

basing and whether its goals are still appropriate, reviewed and prioritized 

standards to ensure a shared framework for managing base support, 

provided guidance to the joint bases that directs them to identify 

opportunities for cost savings and efficiencies, and continued to develop 

an approach to identify and isolate cost savings resulting from 

consolidating support services at the joint bases. We also added one 

action on improving the accuracy and completeness of lease data, which 

we believe will assist DOD in managing its facilities more efficiently. 

Going forward, DOD needs to show measureable and sustained progress 

What GAO Found

What Remains to Be 

Done
DOD Support Infrastructure Management

Page 313 GAO-17-317 High-Risk Series

in addressing the remaining 16 actions and outcomes across each of the 

5 criteria for removal from the High-Risk List related to improving 

implementation of any future BRAC rounds, improving facility utilization 

data, reducing base support costs, and achieving efficiencies in base 

support.

In September 2016, we also provided DOD with a letter describing the 

overall status of DOD’s implementation of our recommendations, and 

noted specific open recommendations that we believe the department 

should give high priority to addressing. Included in the letter were 7 open 

priority recommendations related to improving initial cost estimates, 

limiting bundling of stand-alone realignments, developing baseline cost 

data, and establishing reduction targets for any future BRAC, which are 

also included in the 16 actions that are part of this high-risk update.

DOD needs to take the following 16 actions to satisfy the five high-risk 

criteria for DOD support infrastructure management:

Leadership Commitment: For any future BRAC rounds, DOD needs to 

commit to improve the process for identifying and entering into Cost of 

Base Realignment Actions (COBRA) requirements for

• military construction,

• information technology,

• relocating personnel and equipment,

• costs for alternatively financed projects, and

• limiting the practice of bundling multiple stand-alone realignments or 

closures into single recommendations, or when bundling is 

appropriate, itemize the costs and savings associated with each major 

discrete action.

DOD should provide clear direction to the joint bases about goals, time

frames, and measures in consolidating base support services.

Capacity: DOD needs to

• implement guidance on improving utilization data; and,

• continue to manage the reduction of long-standing excess facilities, 

such as proactively managing processes to meet historic preservation 

and environmental requirements and working with host nations to 
DOD Support Infrastructure Management

Page 314 GAO-17-317 High-Risk Series

avoid prolonged negotiations over returning excess infrastructure in 

foreign countries.

Action Plan: DOD needs to include in its plans any actions geared 

toward reducing duplication or consolidating support services, such as 

providing measurable goals linked to achieving savings and efficiencies 

stemming from consolidation at the joint bases.

Monitoring: DOD needs to

• improve the accuracy and completeness of data, including breaking 

out the cost and square footage information on multiple properties 

included in a single lease;

• in any future BRAC round, commit to improving the fidelity of initial 

BRAC cost estimates by working with military services and other 

appropriate stakeholders to fully identify requirements—the cost of 

military construction, information technology, and relocating personnel 

and equipment, and alternatively financed projects—and limit bundling 

multiple stand-alone realignments or closures into single 

recommendations. When bundling is appropriate, itemize the costs 

and savings associated with each major discrete action;

• direct the military departments to develop baseline cost data, 

including any consolidation resulting from a future BRAC round; and

• continue to periodically track service-level efforts to reduce excess 

infrastructure, such as planned service targets to reduce or better use 

excess space, based on reliable real property data, including 

information on utilization and leased space.

Demonstrate Progress: DOD needs to

• establish targets for eliminating excess capacity, consistent with the 

BRAC selection criteria chosen, for any future BRAC rounds;

• assess—using better data on the use of space and better monitoring 

of DOD-level and service-level efforts— whether its goals and efforts 

need to be reviewed to align space utilization with mission needs; and

• ensure its plans and programs to achieve reduction goals are 

implemented and progress monitored, in addition to other actions 

previously mentioned under the other high-risk criteria.

If Congress authorizes additional BRAC rounds, it may wish to consider 

amending BRAC legislation to require the Secretary of Defense to 

formally establish specific goals that the department expects to achieve 
DOD Support Infrastructure Management

Page 315 GAO-17-317 High-Risk Series

from a future BRAC process and require DOD to implement our 

recommendations related to BRAC.1

DOD partially met the criterion for leadership commitment. DOD has 

demonstrated some top leadership commitment to reducing excess 

infrastructure and more efficiently managing its infrastructure, but needs 

to demonstrate further commitment to better managing any future BRAC 

rounds and providing steps to achieve its joint basing goals, timeframes, 

and measures in achieving efficiencies in support services. Since 2013, 

DOD has been successful in reducing excess infrastructure through its 

past BRAC rounds and has demonstrated leadership in requesting 

additional BRAC rounds. In addition, since 2013, in coordination with the 

military services, DOD has developed and implemented more effective 

and efficient methods to reduce excess infrastructure, such as through 

more proactively managing DOD’s processes to meet historic 

preservation and environmental requirements. Additionally, DOD has 

worked with host nations to avoid prolonged negotiations over returning 

excess infrastructure in foreign countries.

However, DOD needs to demonstrate additional leadership commitment 

to ensuring the success of any future BRAC rounds by agreeing to 

implement key actions we have recommended from reviews of the most 

recent BRAC round. In March and April 2013, we reported that while the 

BRAC process was fundamentally sound, the way DOD implemented the 

2005 BRAC round at times limited its ability to estimate costs, potential 

liabilities, and savings to achieve desired outcomes. Specifically, we 

identified a number of issues with DOD’s process for estimating BRAC 

costs and savings, which was hindered in many cases by underestimating 

recommendation-specific requirements that were entered in the COBRA 

estimation model. For example, the primary reason costs increased for 

BRAC 2005 was higher-than-anticipated military construction costs—an 

increase of 86 percent from $13.2 billion originally estimated by the BRAC 

 1

GAO, Military Bases: Opportunities Exist to Improve Future Base Realignment and 

Closure Rounds, GAO-13-149 (Washington, D.C.: Mar. 7, 2013).

Additional Details on 

What GAO Found

Leadership Commitment
DOD Support Infrastructure Management

Page 316 GAO-17-317 High-Risk Series

Commission to $24.5 billion after BRAC implementation ended in 2011. 

DOD significantly understated initial requirements inputted into COBRA 

for information technology costs (e.g., realigning supply, storage, and 

distribution management initially estimated to be $31 million increased to 

over $190 million).

Also, DOD understated the costs of relocating military personnel positions 

and equipment, and did not consistently capture all costs associated with 

alternatively financed projects. We recommended various actions to 

improve the quality of information that forms the basis for the costs 

estimates. In written comments to our March 2013 report, DOD officials 

did not fully concur with these actions, stating that the COBRA model was 

not meant for the purposes we recommended. However, more recently, 

they agreed to take additional action to better forecast the initial costs 

inputted into COBRA related to military construction, information 

technology, and relocating military personnel positions and equipment, 

and have already taken some steps to do so, in support of any future 

BRAC round. Officials did not agree that liabilities from alternatively 

financed projects need to be consistently captured in the COBRA model, 

stating that it is difficult to estimate these costs. However, as we stated in 

the April 2013 report, in cases where the amount of the liability cannot be 

estimated, modifying the model with a capability to note the existence of a 

potential liability would provide decision makers with valuable information 

to inform their deliberations. DOD officials also cautioned that costs can 

increase during implementation of BRAC recommendations which cannot 

be easily foreseen, and increases in costs are reported to Congress. We 

agree that costs can and have increased during the implementation of 

BRAC recommendations. However, the intent of our recommendations 

are to improve the information provided to decision makers while they are 

comparing competing scenarios and making closure and realignment 

decisions, understanding that ultimate costs may differ from these initial 

estimates.

Further, DOD bundled multiple BRAC recommendations into single, 

highly complex recommendations without itemizing costs and savings 

associated with each separate major action, which limited visibility into 

the estimated costs and savings for individual closures and realignments 

and complicated the ability of the Defense Base Closure and Realignment 

Commission (BRAC Commission) to review the recommendations. We 

recommended actions to improve the quality of information that forms the 

basis for the cost estimates by limiting the bundling of recommendations, 

or if bundling is appropriate, to itemize the costs and savings associated 

with each major discrete action. In the March 2013 report, DOD did not 
DOD Support Infrastructure Management

Page 317 GAO-17-317 High-Risk Series

fully concur with these recommendations, stating that actions are bundled 

when they relate to a common outcome, and thus need to be viewed 

comprehensively rather than individually. More recently, officials agreed 

that when bundling is appropriate during any future BRAC round, they 

would provide additional details related to costs and savings as needed. 

We are encouraged by DOD’s agreement that improvements can be 

made in the quality of the information that supports BRAC cost estimates, 

and we continue to believe addressing these issues when planning for 

any future BRAC rounds will help the department improve initial cost 

estimates and provide a means for better evaluating the proposed closure 

and realignment recommendations. Improving its planning processes, 

including the cost estimates, would also help DOD implement the BRAC 

process more effectively towards reducing excess capacity and provide 

more confidence to Congress and the public on DOD’s efforts in 

implementing BRAC actions.

With respect to achieving efficiencies in base support, DOD reported 

relying on a multitude of efforts and initiatives at the OSD, military service, 

and installation levels. We have reported on DOD’s progress in 

implementing its joint basing program, one key initiative aimed at 

achieving efficiencies in base support. We reported that OSD 

demonstrated some leadership commitment to addressing issues 

affecting joint bases by issuing a memo to the Secretaries of the military 

departments asserting its support for joint basing and clarifying the 

program goals, but OSD and the military departments have not yet 

provided detailed guidance on how to meet the goals and related 

timeframes. DOD’s memo outlined key areas for continual success of the 

program, including continuing to consolidate installation support functions 

at the bases. While the 2014 memo did not provide detailed guidance on 

achieving cost savings and efficiencies or provide for milestones, as we 

have recommended, it affirmed the purpose and goals of the joint bases 

and demonstrated a commitment to the program.

Continued leadership by DOD, to include implementing our prior 

recommendations in any future BRAC rounds and focusing its efforts to 

reduce duplication of support services for its bases, among DOD’s other 

efficiency measures, will be important to sustain efforts to more effectively 

and efficiently align its infrastructure with its needs.

DOD partially met the criterion for capacity. DOD demonstrated its 

capacity to align its infrastructure with its force’s needs by disposing of 

excess infrastructure during past BRAC rounds, and by consolidating 

Capacity
DOD Support Infrastructure Management

Page 318 GAO-17-317 High-Risk Series

some installation services at the joint bases, among other efficiency 

efforts. However, DOD needs to ensure the accuracy of its real property 

data, and implement its utilization guide to improve its ability to identify 

potential areas to reduce and consolidate its infrastructure. DOD needs to 

further implement its Real Property Efficiency Plan, which is aimed at 

disposing of longstanding excess infrastructure.

DOD has improved the way it collects utilization data for its facilities since 

our 2015 high-risk update, and has issued a guide for calculating 

utilization to help improve completeness and accuracy of the utilization 

data. In following up on our September 2014 report recommendations on 

DOD’s use of its facilities, we found that DOD has utilization data on 

about 97 percent of its facilities as of September 2015, the most recent 

data available—increasing from 53 percent as of September 2013. 

However, the utilization rates entered into DOD’s database are likely not 

reliable, since a majority of the facilities (85 percent) have the highest 

possible rate of 100, which indicates full utilization at the same time that 

DOD believes it has over 20 percent excess facility capacity. In addition, 

of the facilities that have a rating of 100, 24 percent had either no 

inspection date or been mostly recently inspected prior to September 30, 

1999, which calls into question the accuracy of this data. In December 

2016, DOD issued a policy memorandum that provided guidance for 

calculating utilization to ensure utilization is measured and reported 

consistently throughout DOD, and to maintain current information on 

facility utilization. As the guidance is implemented, DOD officials expect 

improvement in the accuracy of utilization data as facilities are assessed 

and to increase the completeness of utilization data. Implementing the 

guidance will help focus DOD’s efforts on reducing excess facility 

capacity, and should improve information on the utilization of facilities to 

position DOD to better identify excess facility capacity in support of its 

efforts to reduce excess infrastructure.

In addition, we reported in September 2011 that long-standing excess 

facilities—those identified prior to DOD’s demolition program in fiscal 

2008—accounted for more than half of the excess inventory DOD 

identified and may be more costly to eliminate due to historic preservation 

of certain facilities and environmental issues. We recommended that 

DOD continue to manage reduction of long-term excess facilities, such as 

proactively managing processes to meet historic preservation and 

environmental requirements and working with host nations to avoid 

prolonged negotiations over returning excess infrastructure in foreign 

countries. While DOD officials stated that they have been proactively 

managing historic preservation and environmental requirements, the 
DOD Support Infrastructure Management

Page 319 GAO-17-317 High-Risk Series

amount of funding dedicated to future demolition is not consistent with the 

number of long-standing facilities yet to be demolished. In October 2015, 

DOD officials developed a DOD Real Property Efficiency Plan that 

describes DOD’s strategic and tactical approach to managing its real 

property effectively and efficiently, including reduction targets for fiscal 

years 2016 through 2020. The plan further provides for how DOD expects 

to dispose of long-standing excess facilities. However, DOD is in the early 

stages of implementing the plan, and thus it is too early to assess its 

results. If implemented effectively, the plan should help DOD improve its 

capacity and ability to identify excess facilities, and to more effectively 

and efficiently manage its real property.

We also reported that DOD has shown capacity to consolidate installation 

services at the joint bases. We reported in November 2012 that the joint 

bases reported meeting common standards more than 70 percent of the 

time in fiscal years 2010 and 2011. Also, in September 2014, we reported 

that the joint bases reported partially consolidating 80 percent of their 

installation functions. However, we noted that without comprehensively 

evaluating whether installation support functions were still suitable for 

consolidation, and without identifying and addressing limitations reported 

by the joint bases, DOD might not be able to fully consolidate all 

installation support functions. We recommended that DOD evaluate the 

support functions identified in its joint base guidance to determine which 

are still suitable for consolidation, and subsequently identify and make 

any appropriate changes. In 2015, DOD evaluated the possibility of a 

European joint base, and removed six support functions that it determined 

were not suitable because the functions provided limited opportunities for 

consolidation. In addition, as part of its regular annual review of joint base 

standards, DOD continues to evaluate which standards are suitable for 

consolidation. Together, these actions address the intent of our 

recommendation.

DOD partially met the criterion for having an action plan and has 

developed plans to better identify and dispose of excess infrastructure, 

including an overarching Real Property Efficiency Plan. However, these 

plans do not include actions geared toward improving infrastructure 

efficiencies related to achieving efficiencies in support services.

DOD developed a number of action plans to reduce infrastructure under 

various initiatives. These action plans together provide for corrective 

measures and solutions to reduce excess infrastructure. For example, in 

October 2015, in response to a requirement under the Office of 

Management and Budget’s (OMB) Reduce the Footprint policy, DOD 

Action Plan
DOD Support Infrastructure Management

Page 320 GAO-17-317 High-Risk Series

officials developed a Real Property Efficiency Plan that describes its 

strategic and tactical approach to managing its real property effectively 

and efficiently. This plan addresses our September 2014 

recommendation to establish a strategic plan to manage DOD’s real 

property and facilitate the department’s ability to identify potential 

consolidation and disposal opportunities. The finalized plan describes 

goals aligned with the National Strategy for the Efficient Use of Real 

Property and for reducing the footprint of its real property inventory. The 

plan also describes the strategies, programs, and methodology for 

meeting these goals through the real property management policies and 

procedures of the military departments, and metrics to gauge progress. 

Implementing the plan, which began in 2016 and is scheduled to run 

through 2020, will help DOD improve its ability to identify excess facilities 

and plan for the effective and efficient management of its real property.

However, DOD’s plans, such as the Real Property Efficiency Plan, do not 

address achieving efficiencies in support services. For example, for the 

joint base program, DOD has not established an action plan, including 

corrective measures and a timeline to benchmark progress, for achieving 

cost savings and efficiencies, as we recommended in November 2012 

and September 2014. As a result, joint base commanders are responsible 

for determining to what extent they will pursue initiatives to reduce 

redundancy and achieve potential cost savings or efficiencies, and the 

extent to which such initiatives have been pursued varies by joint base. 

We continue to believe that having an action plan related to reducing 

duplication and consolidating installation support services would improve 

DOD’s efforts to align its infrastructure to its mission needs and lead to 

efficiencies in the department’s base support efforts.

DOD partially met the criterion for monitoring. DOD has committed to 

taking actions that would improve its monitoring of any future BRAC 

rounds, and has demonstrated some ability to monitor its efforts to 

achieve reductions and efficiencies in infrastructure, but it does not have 

reliable real property data to effectively monitor property and facility 

utilization. Specifically, DOD is able to generally monitor excess 

infrastructure reduced through past BRAC rounds and ongoing property 

reduction efforts, and has improved its cost data monitoring for the joint 

bases. For example, DOD has some procedures in place to monitor 

excess infrastructure reduced from the 2005 BRAC round, the Freeze 

and Reduce the Footprint policies and each service’s efforts at monitoring 

its infrastructure. Under the Freeze and Reduce the Footprint policies, 

OMB directed federal agencies to limit expansion of property (no new 

Monitoring
DOD Support Infrastructure Management

Page 321 GAO-17-317 High-Risk Series

facilities without disposing of equivalent facilities), provide real property 

efficiency plans, and plan for and report on the reduction of property. 

Through DOD’s Real Property Efficiency Plan, each military department 

outlines its methods and metrics for identifying and reducing excess 

infrastructure, and DOD monitors the military departments’ progress 

towards meeting its reduction goals. However, it is too early to assess the 

results from the plan since implementation began in 2016 and is 

scheduled to run through 2020.

While DOD has made progress in improving its monitoring, it needs to 

improve the reliability of its real property data and the monitoring of costs 

and savings resulting from any future BRAC rounds. Specifically, as 

mentioned previously, we reported in September 2011 and September 

2014 that DOD does not have reliable real property data to assess how it 

uses property and facilities. Subsequently, in March 2016 we reported 

that DOD lacked reliable data to effectively assess how it uses leases. 

While DOD is taking some steps to address data issues, it cannot fully 

determine the number, size, and costs of its leases for real property 

because the real property inventory system that DOD uses to monitor its 

leased assets contains some inaccurate and incomplete data. For 

example, we reported that about 15 percent of the lease records for fiscal 

year 2011 and 10 percent of the records for fiscal year 2013 were 

inaccurate. We recommended actions to improve the accuracy and 

completeness of this data, such as breaking out the cost and square 

footage information on multiple properties included in a single lease. DOD 

concurred with our findings, but did not concur with our recommended 

method to update DOD’s database. If DOD does not improve the 

reliability of its data, the department will continue to be limited in its ability 

to monitor its reduction of excess infrastructure, identify opportunities to 

consolidate underutilized facilities, and identify opportunities to reduce 

reliance on costly leased space by moving DOD organizations into 

excess facilities.

Further, DOD has committed to taking some actions that would improve 

the monitoring of costs and savings from any future BRAC rounds, 

although some additional actions are needed. For example, we made a 

number of recommendations in March 2013 and April 2013 which would 

help DOD better monitor the implementation and effectiveness of the 

BRAC recommendations. DOD officials acknowledged that they could 

improve the initial estimates in future BRAC rounds, and have reported 

taking some action to do so, including updating standard factors for 

information technology as part of the European Infrastructure 

Consolidation effort. However, DOD also needs to consistently capture 
DOD Support Infrastructure Management

Page 322 GAO-17-317 High-Risk Series

liabilities from alternatively financed projects in the COBRA model for any 

future BRAC round. These actions would provide for better baseline data 

with which to make decisions as well as to track and monitor the results 

achieved through any future BRAC rounds. We also reported in February 

2016 that DOD’s implementation of certain BRAC recommendations 

limited its ability to determine cost savings because it lacked baseline 

cost data. Despite challenges in isolating cost information, without 

maintaining such information, DOD cannot determine the budgetary effect 

of implementing actions to achieve reductions and efficiencies in 

infrastructure.

With respect to improving baseline cost data for the joint bases, in 

November 2012, we recommended that DOD continue to develop and 

refine the joint bases common standards in order to eliminate data 

reliability problems, facilitate comparisons of joint basing costs with the 

costs of operating separate bases, and isolate costs and savings from the 

joint basing initiative. DOD partially concurred with our recommendation, 

and stated that it was working to improve the data’s reliability but found it 

impractical to isolate and distinguish joint basing cost savings from the 

savings that result from unrelated DOD- or service-wide actions. DOD 

provided guidance to the joint bases to correct baseline data and as a 

result, the quality of the data improved for fiscal years 2012 and 2013, 

resulting in a 2013 analysis showing that the joint bases cost less to 

operate than the separate installations. Together, these actions met the 

intent of our recommendation and provided DOD with an improved picture 

of the cost of operating the joint bases.

DOD partially met the criterion for demonstrated progress. DOD has 

demonstrated some progress in aligning its infrastructure to its forces’

needs by reducing excess infrastructure through BRAC and other service 

efforts, and in consolidating base support services. Although initially not 

agreeing to our related recommendations, DOD identified steps to 

improve the quality of information used to support recommendations for 

any future BRAC rounds, and improve the accuracy and completeness of 

utilization data. However, DOD needs to further improve lease data to 

better identify excess infrastructure for disposal and develop a plan for 

reducing duplication and consolidating support services to increase the 

efficiency of the department’s infrastructure services.

DOD has also reduced some excess infrastructure, but needs to develop 

targets for eliminating excess through any future BRAC rounds, and 

ensure that its plans and programs to reach reduction goals are 

Demonstrated Progress
DOD Support Infrastructure Management

Page 323 GAO-17-317 High-Risk Series

implemented and progress monitored. DOD did not concur with our 

recommendation to develop targets for eliminating excess infrastructure 

through any future BRAC rounds, stating that having overarching targets 

would subvert developing actions based on military value. However, in 

further discussion, DOD officials stated that qualitative goals, such as 

needing to reduce excess infrastructure, are helpful in focusing efforts 

and measuring success, but they continued to believe that quantitative 

goals would be in conflict with BRAC selection criteria. We have reported 

on the soundness of the BRAC selection criteria and generally endorsed 

their retention for the future, and do not believe that establishing targets 

for eliminating excess infrastructure affects DOD’s ability to apply these 

criteria. While we agree that stating a goal in future BRAC rounds, such 

as reducing excess infrastructure, is useful, we continue to believe that 

establishing specific targets would assist DOD in measuring progress in 

reducing excess infrastructure and not harm the department’s ability to 

consider military value as its primary selection criteria. Moreover, DOD 

would retain the ability to exercise military judgement in selecting from 

among the candidate recommendations to be put forward to the BRAC 

commission, as was the case in BRAC 2005 and which we have 

generally endorsed.

The military services have also demonstrated some progress in reducing 

excess infrastructure. For example, the services have disposed of and 

demolished excess facilities through their individual efforts, and under the 

Freeze the Footprint policy DOD has limited construction of new facilities 

without disposing of equivalent facilities. Further, for fiscal year 2013, 

DOD reported a net reduction of 7.7 million square feet, which is about 75 

percent of the total reduction across the federal government under this 

policy. As described above, DOD’s Real Property Efficiency Plan outlines 

goals, strategies and programs to reach goals, and metrics to gauge 

progress. It will be important for DOD to ensure that the plan is effectively 

implemented and progress is monitored so that the department can 

achieve its reduction goals. However, DOD’s progress in reducing excess 

infrastructure is limited by challenges with long-standing excess facilities 

and unreliable data related to the use of its facilities and of its leased 

space. Until DOD improves its capacity and monitoring of efforts aimed at 

reducing long-standing excess facilities, the department cannot fully 

demonstrate progress in better aligning its infrastructure to its mission 

needs.

DOD has demonstrated some progress in achieving efficiencies in base 

support, such as officials reporting reductions of redundant funded 

positions, contracts, and procedures at the joint bases. DOD’s data 
DOD Support Infrastructure Management

Page 324 GAO-17-317 High-Risk Series

shows that joint bases are obligating less funding than they would have 

as stand-alone bases, although some of the savings are attributable to 

other service actions, such as budget cuts unrelated to joint basing, as 

noted above. Further, DOD instituted mechanisms to facilitate routine 

communication to encourage jointly resolving common challenges and 

sharing best practices and lessons learned. DOD also issued a joint 

basing handbook to address inconsistent service level guidance. 

However, DOD has not provided clear direction to joint bases on steps 

needed to reach program goals, and lacks a plan for reducing duplication 

and consolidating support services.

• In October 2015, DOD issued its Real Property Efficiency Plan that 

describes DOD’s strategic and tactical approach to managing its real 

property effectively and efficiently. This plan addresses our 

September 2014 recommendation to establish a strategic plan to 

manage DOD’s real property and to facilitate the department’s ability 

to identify potential consolidation and disposal opportunities. The 

finalized plan describes goals aligned with the National Strategy for 

the Efficient Use of Real Property and for reducing the footprint of 

DOD’s real property inventory. The plan describes strategies, 

programs, and methodology to achieve these goals through the real 

property management policies and procedures of the DOD property 

holders—the three military departments and Washington 

Headquarters Service. The plan also provides baseline amounts and 

metrics to gauge progress toward goals established in the plan. As a 

result, we believe that DOD’s plan should help improve its ability to 

identify excess facilities and plan for effective and efficient 

management of its real property.

• In May 2015, DOD issued a handbook to provide basic information 

and clarify processes and procedures for the joint bases. The 

document is intended to serve as a first point of reference for 

information about the joint bases and the unique policies and 

guidance that govern them. This handbook, which addresses how 

joint bases differ from other military installations among other relevant 

issues, can better inform incoming servicemembers about the 

particular characteristics of joint bases, as well as reduce duplication 

or inconsistency in how the joint bases train incoming 

servicemembers. This document addresses our November 2012 

recommendation for DOD to develop guidance to ensure all joint 

bases develop and provide training materials to incoming personnel to 

increase opportunities for greater efficiencies and reduce duplication 

of efforts.

Benefits Achieved by 

Implementing Our 

Recommendations
DOD Support Infrastructure Management

Page 325 GAO-17-317 High-Risk Series

• In January 2015, DOD evaluated the possibility of a European joint 

base, and removed six support functions that it determined were not 

suitable because the functions provided limited opportunities for 

consolidation. In addition, DOD continues to evaluate which standards 

are suitable for consolidation in its annual review process. Together 

these actions address the intent of our September 2014 

recommendation to evaluate whether to continue including all current 

joint base support functions in future joint basing efforts and to make 

any changes appropriate to address these limitations.

For additional information about this high-risk area, contact Brian J. 

Lepore at (202) 512-4523 or leporeb@gao.gov.

Defense Infrastructure: More Accurate Data Would Allow DOD to Improve 

the Tracking, Management, and Security of Its Leased Facilities. 

GAO-16-101. Washington, D.C.: March 15, 2016.

Military Base Realignments and Closures: More Guidance and 

Information Needed to Take Advantage of Opportunities to Consolidate 

Training. GAO-16-45. Washington, D.C.: February 18, 2016.

DOD Joint Bases: Implementation Challenges Demonstrate Need to 

Reevaluate the Program. GAO-14-577. Washington, D.C.: September 19, 

2014.

Defense Infrastructure: DOD Needs to Improve Its Efforts to Identify 

Unutilized and Underutilized Facilities. GAO-14-538. Washington, D.C.: 

September 8, 2014.

Military Bases: DOD Has Processes to Comply with Statutory 

Requirements for Closing or Realigning Installations. GAO-13-645. 

Washington, D.C.: June 27, 2013.

Defense Infrastructure: Improved Guidance Needed for Estimating 

Alternatively Financed Project Liabilities. GAO-13-337. Washington, D.C.: 

April 18, 2013.

Military Bases: Opportunities Exist to Improve Future Base Realignment 

and Closure Rounds. GAO-13-149. Washington, D.C.: March 7, 2013.

GAO Contact

Related GAO 

Products
DOD Support Infrastructure Management

Page 326 GAO-17-317 High-Risk Series

DOD Joint Bases: Management Improvements Needed to Achieve 

Greater Efficiencies. GAO-13-134. Washington, D.C.: November 15, 

2012.

Military Base Realignments and Closures: Updated Costs and Savings 

Estimates from BRAC 2005. GAO-12-709R. Washington, D.C.: June 29, 

2012.

Excess Facilities: DOD Needs More Complete Information and a Strategy 

to Guide Its Future Disposal Efforts. GAO-11-814. Washington, D.C.: 

September 19, 2011.
DOD Approach to Business Transformation

Page 327 GAO-17-317 High-Risk Series

The Department of Defense (DOD) has taken some positive steps since 

the 2015 high-risk update to improve its business transformation efforts.1

For example, DOD has established the Defense Business Council (DBC) 

to serve as a senior-level governance forum for its business functions, 

and issued an Agency Strategic Plan that includes business 

transformation priorities and which the department is using to guide its 

business operations. However, additional steps are needed to address 

long-standing weaknesses in DOD’s business operations and remove this 

issue from the High-Risk List.

DOD spends billions of dollars each year to maintain key business 

operations intended to support the warfighter, including systems and 

processes related to the management of contracts, finances, the supply 

chain, support infrastructure, and weapon systems acquisition. 

Weaknesses in these areas adversely affect DOD’s efficiency and 

effectiveness, and render its operations vulnerable to waste, fraud, and 

abuse. DOD’s overall approach to transforming these business 

operations is inextricably linked to DOD’s ability to perform its overall 

mission, directly affecting the readiness and capabilities of U.S. military 

forces.

We added DOD’s overall approach to managing business transformation 

as a high-risk area in 2005 because DOD had not taken the necessary 

steps to achieve and sustain business reform on a broad, strategic, 

department-wide, and integrated basis. Further, DOD’s historical 

approach to business transformation has not proven effective in achieving 

meaningful and sustainable progress in a timely manner. For example, 

DOD had not established clear and specific management responsibility, 

accountability, and control over business transformation-related efforts 

and applicable resources across business functions. Also, DOD did not 

have an integrated plan for business transformation with specific goals, 

measures, and accountability mechanisms to monitor progress and 

achieve improvements.

 1

The scope of DOD’s approach to the business transformation high-risk area 

encompasses the activities of the Chief Management Officer and Deputy Chief 

Management Officer in engaging with responsible leaders to influence and oversee 

business transformation across DOD’s business functions to achieve progress. DOD’s 

business functions include: financial management, acquisition, defense security 

enterprise, installations and environment, logistics, human resources and healthcare 

management, security cooperation, and enterprise information technology infrastructure.

DOD Approach to Business Transformation

Why Area Is High 

Risk
DOD Approach to Business Transformation

Page 328 GAO-17-317 High-Risk Series

Since 2005, DOD has demonstrated some leadership commitment and 

notably improved capacity toward addressing business transformation 

efforts, such as assigning responsibility for agency goals and objectives. 

DOD has also taken several notable steps to improve its capacity to 

monitor DOD’s business transformation efforts, such as developing 

position descriptions for management analysts, and updating the mission 

for the Office of the Deputy Chief Management Officer’s (DCMO) 

Planning, Performance, and Assessment directorate to fulfill performance 

management-related requirements. While DOD has demonstrated some 

progress through undertaking initiatives intended to improve the efficiency 

of its business processes, DOD has not 1) fully developed a corrective 

action plan, 2) consistently held performance reviews that include 

department-wide performance information, and 3) fully established 

accountability mechanisms for meeting performance targets. Until DOD 

makes further progress in addressing these actions and outcomes, its 

progress in transforming into a more efficient department will be limited.

To date, Congress has passed legislation that could assist DOD in 

addressing this high-risk area. For example, the National Defense 

Authorization Act for Fiscal Year 2017, among other things, created a 

distinct Chief Management Officer (CMO) position effective February 1, 

2018, with the mission of managing, establishing policies on, and 

supervising the business operations of the department. This position 

would also have the authority to direct the Secretaries of the military 

departments and the heads of all other DOD components with regard to 

matters for which the CMO would have responsibility. Before the 

implementation of this position, the Secretary of Defense is required to 

conduct a review of the disposition of leadership positions, subordinate 

organizations, and defined relationships, including the placement and 

responsibilities of the new CMO position. Specifically, it requires

• a proposed implementation plan for how the Department would 

implement its recommendations;

• recommendations for revisions to appointments and qualifications, 

duties and powers, and precedent in the Department;

• recommendations for such legislative and administrative action, 

including conforming and other amendments to law, as the Secretary 

considers appropriate to implement the plan; and

• any other matters that the Secretary considers appropriate.

What GAO Found
DOD Approach to Business Transformation

Page 329 GAO-17-317 High-Risk Series

A final report is due to the defense committees by August 1, 2017. 

Continued congressional attention to addressing this high-risk area will be 

essential going forward.

In August 2014, we provided DOD with a letter that outlined 13 actions 

and outcomes that we believe it should address in order to mitigate or 

resolve long-standing weaknesses in its business transformation efforts. 

Based on discussions with DOD officials and recent efforts across the 

department as of October 2016, we believe that DOD has addressed 5 of 

the 13 actions and outcomes, but have yet to address 8 actions and 

outcomes. These actions and outcomes are based on the five high-risk 

criteria for removal: leadership commitment, capacity, action plan, 

monitoring, and demonstrated progress. For the capacity criterion, while 

we believe the actions and outcomes we have identified remain 

important, we also believe they have made notable progress in this 

criterion to be considered as met, such as reviewing the systems and 

functions of the Office of the DCMO and Office of the Secretary of 

Defense (OSD) organizations, and improving the alignment of its 

personnel with the strategic goals in the draft Agency Strategic Plan. For 

the remaining four criteria, DOD needs to show measureable and 

sustained positive outcomes in addressing the remaining eight actions 

and outcomes. This includes, among other things, DOD continuing to hold 

business function leaders accountable for performance, refining or 

developing a more comprehensive corrective action plan as well as 

existing performance measures, and achieving measurable and sustained 

outcomes.

Leadership Commitment: DOD should

• continue to hold business function leaders accountable for diagnosing 

performance problems and identifying strategies for improvement; and

• continue to lead regular DOD performance reviews regarding 

transformation goals and associated metrics and ensure that business 

function leaders attend these reviews to facilitate problem solving.

Action Plan: DOD should

• refine the performance action plan or develop a corrective action plan 

that identifies initiatives to address root causes, including critical links 

that must be present among the initiatives, and the processes, 

systems, personnel, and other resources needed for their 

implementation. The corrective action plan should also identify 

What Remains to Be 

Done
DOD Approach to Business Transformation

Page 330 GAO-17-317 High-Risk Series

tradeoffs, priorities, and any sequencing needed to implement the 

initiatives, and help leaders plan for and provide the resources 

needed to make the corrective actions identified.

Monitoring: DOD should

• continue to refine existing performance measures to ensure that 

measures assess progress in achieving all business transformation 

initiatives as needed, and hold owners of DOD’s business functions 

accountable for providing input into performance targets; and

• conduct frequent and regular data-driven performance reviews using 

established performance measures, and use existing governance 

structures, such as the DBC, to assess department-wide performance 

including the military departments.

Demonstrated Progress: DOD should

• make substantial progress in implementing a corrective action plan 

that includes measures addressing the root causes of shortfalls in 

business functions, and details how corrective actions designed to 

improve DOD business functions will be implemented;

• continue to implement initiatives that result in measurable and 

sustained positive outcomes over several years, including cost 

savings and increased efficiencies, thus promoting actions that control 

costs across the department envisioned by the Secretary of Defense, 

as noted in DOD’s 2014 Report to Congress on the Defense Business 

Operations; and

• document and report on progress in implementing corrective actions 

across business functions to Congress and other key stakeholders to 

strengthen accountability; progress could be reported in the annual 

report to Congress on DOD Business Operations or through other 

means.

DOD has taken steps to demonstrate leadership commitment over the 

department’s business transformation efforts and partially meets this 

criterion. However, DOD’s Office of the DCMO has not regularly led 

performance reviews to hold business function leaders accountable. In 

July 2015, DOD issued its Agency Strategic Plan for Fiscal Years 2015 –

2018, Version 1.0, which presents DOD’s strategic goals, objectives, and 

Additional Details on 

What GAO Found

Leadership Commitment
DOD Approach to Business Transformation

Page 331 GAO-17-317 High-Risk Series

a performance management framework that DOD intends to use to 

evaluate its effectiveness. DOD’s Agency Strategic Plan identifies five 

strategic goals that have associated strategic objectives, performance 

goals, agency priority goals, or cross-agency priority goals, as well as 

performance indicators with targets for assessing progress. One of these 

goals is to reform and reshape the defense institution. As part of the 

Agency Strategic Plan, OSD Principal Staff Assistants are responsible for 

reporting progress on performance goals, agency priority goals, or crossagency priority goals that are linked to DOD’s strategic goals and 

objectives.

OSD Principal Staff Assistants have reported on the progress of meeting 

these associated goals at the DBC meetings. In June and in August 2016, 

the Acting DCMO, through the DBC, conducted performance reviews 

intended to assess progress against agency priority goals and other 

performance measures in the Agency Strategic Plan, and provide 

opportunities to discuss problems and alternatives, among other things. 

However, these performance reviews have not been conducted on a 

regular basis. Specifically, prior to June 2016, the DBC had not 

conducted a performance review since November 2015. Office of the 

DCMO officials stated that the Acting DCMO plans to conduct a 

performance review in December 2016 and on a quarterly basis going 

forward. It will be important for the Acting DCMO to continue to conduct 

these performance reviews on a regular basis to hold business function 

leaders accountable for progress.

To further enhance DOD’s oversight of its business transformation efforts, 

the National Defense Authorization Act for Fiscal Year 2017, among other 

things, created a distinct CMO position with the mission of managing, 

establishing policies on, and supervising the business operations of the 

department. This new position, to begin in February 2018, is expected to 

provide greater management authority to oversee management of 

business operations, and could help DOD further demonstrate its 

commitment to addressing business transformation efforts. This new 

position would also report directly to the Secretary of Defense. The 

Deputy Secretary of Defense will no longer serve as CMO. However, the 

effect of this new structure on improving business transformation within 

DOD remains to be determined, to include the extent to which this 

position will have the authority and support needed to drive business 

transformation efforts across the department.
DOD Approach to Business Transformation

Page 332 GAO-17-317 High-Risk Series

The Office of the DCMO has taken several notable steps to improve its 

capacity to monitor DOD’s business transformation efforts and now meets 

this high-risk criterion. In September 2016, the Acting DCMO stated that 

DOD conducted a business process and systems review that included 

reviewing structures and functions within the Office of the DCMO. DOD 

DCMO officials said that the office completed the review of the Office of 

the DCMO in September 2014.

The review of the DCMO found that the overall structure of the office was 

sound from a mission perspective, but also identified opportunities to 

better align related organizations within the office. For example, the Office 

of the DCMO’s Planning, Performance, and Assessment Directorate was 

restructured to create outreach teams aligned to major strategic initiatives 

that are responsible for establishing goals and objectives. According to 

DOD officials, as part of this effort, the Office of the DCMO reassessed 

position descriptions to determine the appropriate structure for the office. 

The Office of the DCMO also developed position descriptions for 

management analysts, updated the mission for its Planning, 

Performance, and Assessment directorate, and reorganized the 

directorate to align its personnel with the strategic goals in the draft 

Agency Strategic Plan. They stated that this action was taken to ensure 

that the Office of the DCMO could work across each business function to 

accomplish department-wide goals. Further, Office of the DCMO officials 

stated that the Planning, Performance, and Assessment directorate hired 

personnel with expertise in strategic planning and performance 

management to increase its capacity to oversee business transformation 

efforts. Officials further stated that the directorate has assessed its staff’s 

knowledge, skills, and abilities related to strategic planning and 

performance management, and monitors progress towards addressing 

any gaps through annual performance reviews.

DOD has also updated its governance structures to include the Fourth 

Estate Working Group, which is devoted to addressing business 

operations-related challenges across DOD’s defense agencies, field 

activities, and OSD.2 According to Office of the DCMO officials, the 

 2

DOD defines the Fourth Estate as DOD organizations, other than the military services, 

that have DOD manpower resources. These organizations include OSD; the defense 

agencies; DOD field activities; the Office of the DOD Inspector General; the Joint Staff; 

and the combatant commands. The Fourth Estate Working Group serves as a governance 

forum that provides cross-functional review, guidance, and leadership to effectively and 

efficiently manage and discuss issues for DOD Fourth Estate business transformation 

efforts as well as provide DOD Fourth Estate business mission area oversight.

Capacity
DOD Approach to Business Transformation

Page 333 GAO-17-317 High-Risk Series

working group is used to leverage subject matter expertise, including 

conducting additional analyses on issues tied to business operations for 

the Office of the DCMO as needed. It will be important for the Office of 

the DCMO to continue to use its existing management analysis capacity 

along with the Fourth Estate Working Group to drive business 

transformation efforts across the department.

In addition to maintaining the capacity of the DCMO to drive business 

transformation efforts, it will be critical that the CMO position, established 

by the National Defense Authorization Act for Fiscal Year 2017, has the 

personnel and other resources needed to fulfill its significant 

responsibilities. Since this position will not go into effect until February 

2018 and the details of its implementation and responsibilities are not fully 

known, it is too early to determine whether it will have the capacity 

needed to lead the department’s business transformation efforts. We will 

monitor DOD’s progress in implementing this position moving forward to 

include its impact on DOD’s transformation efforts.

DOD now partially meets this criterion. In July 2015, DOD issued its first 

Agency Strategic Plan. Subsequently, in September 2016, DOD officials 

shared its draft update to the Agency Strategic Plan for Fiscal Years 2015 

– 2018, Version 2.0. This draft update has a performance action plan that 

contains some but not all elements of a corrective action plan. The 

performance action plan is intended to provide detailed information for 

monitoring and reporting DOD’s progress towards each strategic goal, 

objective, and performance goal as well as, where appropriate, to 

address actions the department is taking in response to our and DOD 

Inspector General recommendations. The performance action plan 

identifies business function leaders for each strategic objective and 

associated performance goals. In addition, the plan includes, among 

other things, a description of the problem and opportunity; relationship to 

strategic goal and objective; key barriers and challenges; mitigation 

efforts; and an implementation plan, initiatives, and targets for 

performance measures over time. However, the performance action plan 

does not define the root causes of business transformation weaknesses 

or the steps necessary to implement solutions we have recommended in 

our prior work. Further, the performance action plan does not identify 

processes and systems to implement initiatives to address root causes, or 

the tradeoffs needed to implement the initiatives. In January 2017, a 

senior DOD official stated that DOD does not plan to issue the update to 

its Agency Strategic Plan, and will instead continue to collect, review, and 

report on performance data using the draft update until it is superseded. 

Action Plan
DOD Approach to Business Transformation

Page 334 GAO-17-317 High-Risk Series

While the continued use of the draft update to the Agency Strategic Plan 

is a positive step forward, a more comprehensive performance action 

plan that outlines the necessary elements of a corrective action plan 

would allow DOD to more effectively hold business function leaders 

accountable.

DOD now partially meets this criterion. DOD’s performance action plan in 

its draft update to the Agency Strategic Plan contains performance 

measures intended to measure progress in DOD’s business 

transformation efforts and establishes clear linkages to performance and 

resource decisions. However, the Office of the DCMO has not established 

how it plans to hold owners of DOD business functions accountable for 

performance or monitor the military departments’ business transformation 

efforts. According to DOD and military department officials, there has 

been an increased emphasis on reviewing the performance of DOD’s 

business functions as part of the DBC meetings. However, the DBC did 

not conduct quarterly reviews of performance from November 2015 until 

June 2016, when the Acting DCMO conducted a briefing of DOD’s 

agency priority goals in June 2016. In September 2016, the Acting DCMO 

stated that the department plans to conduct quarterly performance 

reviews against the agency priority goals and other performance 

measures in the draft update to the Agency Strategic Plan, and in its most 

recent meeting in December 2016, the DBC conducted a quarterly 

performance review against these measures. Further, in January 2017, a 

senior DOD official stated that DOD does not plan to issue the update to 

its Agency Strategic Plan, and will instead continue to collect, review, and 

report on performance data using the draft update until it is superseded. 

Consistently conducting quarterly performance reviews is critical to 

assessing the department’s progress in its business transformation 

efforts, and issuing an updated Agency Strategic Plan that sets forth 

DOD’s approach to monitoring would further institutionalize such efforts.

In addition, the Office of the DCMO has not established how it plans to 

hold owners of DOD business functions accountable for performance 

targets or monitor performance information on the military departments’

business transformation goals. Office of the DCMO officials stated that 

DOD plans to issue guidance on the roles, responsibilities, requirements, 

and processes for department-wide strategic planning and performance 

management by the end of fiscal year 2017, including a performance 

review framework across the entire department to better track 

consistency in assessing progress. Moving forward, it will be important for 

the Office of the DCMO to issue this guidance and monitor departmentMonitoring
DOD Approach to Business Transformation

Page 335 GAO-17-317 High-Risk Series

wide performance to more effectively achieve business transformation 

goals.

DOD now partially meets this criterion. Since 2014, and in part to respond 

to congressional direction, DOD has undertaken initiatives intended to 

improve the efficiency of its business processes, but DOD has not been 

able to demonstrate clear results associated with these initiatives, as well 

as sustained attention and focus consistently across the business 

functions. DOD guidance states that the DCMO is responsible for working 

to better synchronize, integrate, and coordinate the business operations 

of DOD to optimally align them to support the DOD warfighting mission. 

DOD reviewed headquarters organizations and other DOD entities to 

identify cost savings, but it is unclear to what extent these initiatives will 

help the department achieve the savings it has identified. For example, in 

May 2015, DOD concluded its Core Business Process Review, which was 

intended to apply lessons learned and information technology approaches 

from the commercial sector to the department’s business processes in 

order to reduce cost and improve mission performance. Through this 

review, the Office of the DCMO identified at least $62 billion in potential 

cumulative savings opportunities across the six business processes for 

fiscal years 2016 through 2020. The review identified that these potential 

savings opportunities could be achieved through not replacing civilian 

personnel who attrite and retire over the next 5 years; matching labor 

productivity in comparable industries or sectors; and improving core 

processes, such as rationalizing organizational structures to reduce 

excessive layers, optimizing contracts, and using information technology 

to eliminate or reduce manual processes. However, in June 2016, we 

reported that the potential savings opportunities could not entirely be 

achieved, according to Office of the DCMO officials. The results of DOD’s 

reviews of headquarters organizations and other DOD entities are still 

being implemented across the department, and DOD has not yet reported 

on progress associated with these reviews.

In June 2016, we also reported that the Office of the DCMO began 

initiatives that, in effect, address the opportunities highlighted by the Core 

Business Process Review. These initiatives include reducing the number 

of layers in OSD and its related organizations, and validating contracted 

services requirements for the Fourth Estate. We reported that the 

initiatives were not completed or their results could not be validated 

based on the information the department provided, and therefore it is 

unclear to what extent these initiatives will contribute toward the cost 

savings and efficiencies identified by the Core Business Process Review. 

We have ongoing work assessing the department’s progress in achieving 

Demonstrated Progress
DOD Approach to Business Transformation

Page 336 GAO-17-317 High-Risk Series

efficiencies for delayering, contracted services, and other headquartersrelated initiatives. Identifying savings and increased efficiencies from 

these efforts is important to promoting actions that control costs as 

envisioned by the Secretary of Defense, and we have cited the need for 

DOD to implement initiatives that result in measurable and sustained 

positive outcomes.

The DCMO has used the DBC to continue to focus attention on 

modernizing its business systems versus more broadly on business 

transformation issues. While this is important in addressing another DOD 

high-risk area, the DCMO also needs to place greater attention on 

improving its business processes across the business functions. Further, 

the DCMO has not yet documented or reported on progress in 

implementing any corrective actions across business functions to 

Congress and other key stakeholders to strengthen accountability.

For additional information about this high-risk area, contact Zina D. Merritt 

at (202) 512-5257 or merrittz@gao.gov.

Defense Business Transformation: DOD Should Improve Its Planning with 

and Performance Monitoring of the Military Departments. GAO-17-9. 

Washington, D.C.: December 7, 2016.

Defense Headquarters: Improved Data Needed to Better Identify 

Streamlining and Cost Savings Opportunities by Function. GAO-16-286. 

Washington, D.C.: June 30, 2016.

DOD Financial Management: Greater Visibility Needed to Better Assess 

Audit Readiness for Property, Plant, and Equipment. GAO-16-383. 

Washington, D.C.: May 26, 2016.

High-Risk Series: Key Actions to Make Progress Addressing High-Risk 

Issues. GAO-16-480R. Washington, D.C.: April 25, 2016.

DOD Financial Management: Continued Actions Needed to Address 

Congressional Committee Panel Recommendations. GAO-15-463. 

Washington, D.C.: September 28, 2015.

DOD Business Systems Modernization: Additional Action Needed to 

Achieve Intended Outcomes. GAO-15-627. Washington, D.C.: July 16, 

2015.

GAO Contact

Related GAO 

Products
DOD Approach to Business Transformation

Page 337 GAO-17-317 High-Risk Series

Managing for Results: Agencies Report Positive Effects of Data-Driven 

Reviews on Performance but Some Should Strengthen Practices. 

GAO-15-579. Washington, D.C.: July 7, 2015.

Defense Business Transformation: DOD Has Taken Some Steps to 

Address Weaknesses, but Additional Actions Are Needed. GAO-15-213. 

Washington, D.C.: February 11, 2015.
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 338 GAO-17-317 High-Risk Series

Federal agencies and our nation’s critical infrastructures—such as 

energy, transportation systems, communications, and financial services—

are dependent on computerized (cyber) information systems and 

electronic data to carry out operations and to process, maintain, and 

report essential information.1 The security of these systems and data is 

vital to public confidence and the nation’s safety, prosperity, and wellbeing.

However, safeguarding federal computer systems and the systems that 

support critical infrastructures—referred to as cyber critical infrastructure 

protection—has been a long-standing concern. The security of federal 

cyber assets has been on our High-Risk List since 1997. In 2003, we 

expanded this high-risk area to include the protection of critical cyber 

infrastructure. In 2015, we added protecting the privacy of personally 

identifiable information (PII) that is collected, maintained, and shared by 

both federal and nonfederal entities.2

Over the last several years, we have made about 2,500 

recommendations to agencies aimed at improving the security of federal 

systems and information. These recommendations identified actions for 

agencies to take to strengthen technical security controls over their 

computer networks and systems. They also include recommendations for 

agencies to fully implement aspects of their information security 

programs, as mandated by the Federal Information Security 

Modernization Act (FISMA) of 2014 and its predecessor, the Federal 

Information Security Management Act of 2002, and to protect the privacy 

of PII held on their systems. However, many agencies continue to be 

challenged in safeguarding their information systems and information, in 

part because many of these recommendations have not been 

 1

Critical infrastructure includes systems and assets so vital to the United States that 

incapacitating or destroying them would have a debilitating effect on national security. 

These critical infrastructures are grouped by the following industries or “sectors”: 

chemical; commercial facilities; communications; critical manufacturing; dams; defense 

industrial base; emergency services; energy; financial services; food and agriculture; 

government facilities; health care and public health; information technology (IT); nuclear 

reactors, materials, and waste; transportation systems; and water and wastewater 

systems.

2

PII is any information that can be used to distinguish or trace an individual’s identity, such 

as name, date and place of birth, Social Security number, or other types of personal 

information that can be linked to an individual, such as medical, educational, financial, and 

employment information.

Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure 

and Protecting the Privacy of Personally

Identifiable Information

Why Area Is High 

Risk
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 339 GAO-17-317 High-Risk Series

implemented. As of October 2016, about 1,000 of our information 

security–related recommendations had not been implemented.

Risks to cyber assets can originate from unintentional and intentional 

threats. These include insider threats from disaffected or careless 

employees and business partners, escalating and emerging threats from

around the globe, the steady advances in the sophistication of attack 

technology, and the emergence of new and more destructive attacks. 

Ineffectively protecting cyber assets can facilitate security incidents and 

cyberattacks that disrupt critical operations; lead to inappropriate access 

to and disclosure, modification, or destruction of sensitive information; 

and threaten national security, economic well-being, and public health 

and safety.

Regarding PII, advancements in technology, such as new search 

technology and data analytics software for searching and collecting 

information, have made it easier for individuals and organizations to 

correlate data and track it across large and numerous databases. In 

addition, lower data storage costs have made it less expensive to store 

vast amounts of data. Also, ubiquitous Internet and cellular connectivity 

makes it easier to track individuals by allowing easy access to information 

pinpointing their locations. These advances—combined with the 

increasing sophistication of hackers and others with malicious intent, and 

the extent to which both federal agencies and private companies collect 

sensitive information about individuals—have increased the risk of PII 

being exposed and compromised.
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 340 GAO-17-317 High-Risk Series

Leadership at the White House and Department of Homeland Security 

(DHS) demonstrated commitment to improving cybersecurity. For 

example, the President issued strategy documents for improving aspects 

of cybersecurity and an executive order (E.O.) and policy directive for 

improving security and resilience of critical cyber infrastructure. However, 

challenges remain, such as shortages in qualified cybersecurity personnel 

and continued weaknesses in agencies’ information security programs. 

These challenges need to be addressed as initial steps toward removal 

from the High-Risk List. Furthermore, progress will need to be 

demonstrated by agencies fully implementing their information security 

programs and by critical infrastructure sectors improving their 

cybersecurity.

In addition, Congress enacted legislation intended to strengthen 

information security across the federal government and to improve the 

protection of critical cyber assets. The Cybersecurity Act of 2015 

established a voluntary framework for sharing cybersecurity threat 

information between and among the federal government, state 

governments, and private entities, and protects private sector entities 

from liability when sharing and receiving cyber threat information.3 The 

act also makes DHS’s National Cybersecurity and Communications 

Integration Center responsible for implementing these mechanisms, 

requires DHS to offer its intrusion and detection capabilities to any federal 

agency, and calls for agencies to assess their cyber-related workforce.

• Executive Office of the President (EOP) and federal agencies should 

implement our approximately 1,000 open recommendations, 

especially those related to implementing risk-based information 

security programs.

• The federal government should effectively execute the steps in the 

government-wide plans, including the Cybersecurity Strategy and 

Implementation Plan for the Federal Civilian Government,4

 3

The Cybersecurity Act of 2015 was enacted as Division N of the Consolidated 

Appropriations Act, 2016, Pub. L. No. 114-113, Dec. 18, 2015.

4

Office of Management and Budget, Cybersecurity Strategy and Implementation Plan for 

the Federal Civilian Government, OMB Memorandum M-16-04 (Washington, D.C.: Oct. 

30, 2015). 

What GAO Found

What Remains to Be 

Done
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 341 GAO-17-317 High-Risk Series

Cybersecurity National Action Plan,5 and Federal Cybersecurity 

Workforce Strategy.6

• The federal government needs to resolve the government-wide 

material weakness in information security for 2 consecutive years and 

reduce factors that contribute to a significant deficiency, as we 

reported in our annual audits of the financial statements for the United 

States government.7

• Federal agencies need to effectively implement risk-based, entitywide information security programs consistently over time. The 

following actions will assist agencies in implementing their information 

security programs:

• enhance capabilities to effectively identify cyber threats to agency 

high-impact systems and information,

• implement sustainable processes for securely configuring 

information systems and networks,

• patch vulnerable systems and replace unsupported software,

• develop comprehensive security test and evaluation procedures 

and conduct these examinations on a regular and recurring basis, 

and

• strengthen oversight of contractors providing information 

technology (IT) services.

• The federal government needs to improve its abilities to detect, 

respond to, and mitigate cyber incidents. The following actions will 

assist the federal government in these efforts:

 5

The White House, Office of the Press Secretary, Fact Sheet: Cybersecurity National 

Action Plan (Washington, D.C.: Feb. 9, 2016). 

6

Office of Management and Budget, Federal Cybersecurity Workforce Strategy, OMB 

Memorandum M-16-15 (Washington, D.C.: July 12, 2016).

7

A material weakness is a deficiency, or combination of deficiencies, that results in more 

than a remote likelihood that a material misstatement on the financial statements will not 

be prevented or detected. A significant deficiency is a deficiency, or combination of 

deficiencies, in internal control that is less severe than a material weakness, yet important 

enough to merit attention by those charged with governance. A control deficiency exists 

when the design or operation of a control does not allow management or employees, in 

the normal course of performing their assigned functions, to prevent or detect and correct 

misstatements on a timely basis.
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 342 GAO-17-317 High-Risk Series

• DHS needs to expand capabilities, improve planning, and support 

wider adoption of its government-wide intrusion detection and 

prevention system.

• Agencies need to develop and implement complete policies, 

plans, and procedures for responding to cyber incidents and 

effectively oversee response activities.

• Agencies need to consistently implement policies and procedures 

for responding to breaches of PII.

• The federal government needs to expand its cyber workforce planning 

and training efforts. Agencies need to

• enhance efforts for recruiting and retaining a qualified 

cybersecurity workforce and

• improve cybersecurity workforce planning activities.

• The federal government needs to expand efforts to protect cyber 

critical infrastructure. For example:

• DHS and sector-specific agencies need to collaborate with sector 

partners to develop performance metrics and determine how to 

overcome challenges to reporting the results of their cyber risk 

mitigation activities; and

• DHS needs to assess whether its efforts to share information on 

cyber threats, incidents, and countermeasures with federal and 

non-federal entities are useful and effective.

• The federal government needs to better oversee the protection of PII 

contained in electronic health information and health insurance 

marketplaces. Needed efforts include the following:

• Department of Health and Human Services (HHS) needs to 

enhance its oversight and guidance related to the actions to 

protect privacy implemented by entities that maintain electronic 

health information.

• HHS’s Centers for Medicare & Medicaid Services (CMS) needs to 

ensure that Healthcare.gov and state health insurance 

marketplaces have effective controls in place to safeguard 

electronic health information.

• Congress should consider amending privacy laws to more fully protect 

the PII collected, used, and maintained by the federal government.
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 343 GAO-17-317 High-Risk Series

The EOP and DHS met the criterion of demonstrating top leadership 

commitment to securing federal information and protecting the privacy of 

PII. For example, the President signed legislation, issued executive 

orders and a policy directive, and published a national action plan that 

were intended to improve aspects of federal information security, privacy 

safeguards, and critical infrastructure cybersecurity. In addition, updated 

guidance, as well as actions such as creating positions for a senior 

advisor for privacy and federal chief information security officer within the 

Office of Management and Budget (OMB), further demonstrated the 

extent to which the EOP was committed to securing federal information 

systems and protecting privacy. Specific actions taken by the 

administration and DHS included the following:

• In July 2016, the President released Presidential Policy Directive 

(PPD)-41 which set forth principles governing the federal 

government’s response to cyber incidents involving government or 

private sector entities.8 For significant cyber incidents, this PPD 

establishes lead federal agencies and a process for coordinating the 

broader federal government response. PPD-41 also requires the 

Department of Justice (DOJ) and DHS to maintain updated contact 

information for public use to assist entities affected by cyber incidents 

in reporting those incidents to the proper authorities.

• In February 2016, the President issued E.O. 13719, which created the 

Federal Privacy Council, a council of senior federal privacy officials 

established to share ideas and best practices and develop new 

approaches for protecting privacy in today’s technology driven 

environment.9 The President also directed his administration to 

systematically review where the federal government can reduce

reliance on Social Security numbers.

• In February 2015, the President issued E.O. 13691, Promoting Private 

Sector Cybersecurity Information Sharing, to encourage the formation 

of organizations and mechanisms to share information related to 

cybersecurity risks and incidents among private companies, nonprofit 

 8

PPD-41, United States Cyber Incident Coordination, July 26, 2016.

9

E.O. 13719 (Feb. 9, 2016); 81 Fed. Reg. 7687 (Feb. 12, 2016).

Additional Details on 

What GAO Found

Leadership Commitment
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 344 GAO-17-317 High-Risk Series

organizations, executive departments and agencies, and other entities 

and to collaborate to respond in as close to real time as possible.10

• In July 2016, OMB issued a revised Circular A-130, Managing 

Information as a Strategic Resource, to reflect changes in law and 

advances in technology and to ensure consistency with executive 

orders, presidential directives, recent OMB policy, and National 

Institute of Standards and Technology (NIST) standards and 

guidelines. 11 The revised circular establishes general policy for, 

among other things, information governance, security, and privacy. It 

incorporates security and privacy requirements as crucial elements of 

a comprehensive, strategic, and continuous risk-based program at 

federal agencies.

• DHS established the Critical Infrastructure Cyber Community (C3) 

Voluntary Program to encourage entities to adopt NIST’s Framework 

for Improving Critical Infrastructure Cybersecurity.12 As part of this 

program, DHS developed guidance and tools that are intended to help 

entities use the framework. The C3 Voluntary Program also includes 

outreach and awareness activities, promotion efforts targeting specific 

types of entities, and creation of communities of interest around 

critical infrastructure cybersecurity.

The EOP and DHS partially met the criterion for improving the capacity of 

federal agencies to sufficiently protect their information systems and PII. 

Resources and initiatives were identified to address federal cybersecurity 

capacity concerns. Increased budgetary resources and human capital 

strategies were proposed to address limitations on federal cybersecurity 

capacity. For example, the President’s 2017 budget request proposed 

funds to enhance the Scholarship for Service program, develop a 

cybersecurity core curriculum, increase the number of academic 

institutions that are National Centers for Academic Excellence in 

Cybersecurity, and offer student loan forgiveness for cybersecurity 

experts in the federal workforce. The President’s 2017 budget also 

proposed investing $19 billion in cybersecurity, an increase of about 35 

percent over fiscal year 2016.

 10E.O. 13691 (Feb. 13, 2015); 80 Fed. Reg. 9347 (Feb. 20, 2015).

11Office of Management and Budget, Managing Federal Information as a Strategic 

Resource, OMB Circular A-130 (Washington, D.C.: July 28, 2016).

12National Institute of Standards and Technology, Framework for Improving Critical 

Infrastructure Cybersecurity (Feb. 12, 2014).

Capacity
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 345 GAO-17-317 High-Risk Series

Nevertheless, according to OMB and agency chief information security 

officers, the federal government suffered from a shortage of cybersecurity 

professionals due to persistent recruitment and retention challenges. 

Also, it is unclear the extent to which efforts to improve the capacity of the 

cybersecurity workforce, among other cybersecurity-related initiatives, 

were focused on increasing resources at agencies devoted to privacy 

protection. Executing the human resources strategy and budget priorities 

could ensure that federal agencies have the necessary capacity to better 

address the information security and PII protection needs of federal 

civilian agencies.

The EOP and DHS partially met the criterion for having a corrective action 

plan to improve the protection of cyber assets and PII. Government-wide 

plans identified actions to be taken to enhance cybersecurity and PII 

protection. Examples included the following:

• OMB issued the Cybersecurity Strategy and Implementation Plan in 

October 2015. The plan aimed to strengthen federal civilian 

cybersecurity by (1) identifying and protecting high-value information 

and assets, (2) detecting and responding to cyber incidents in a timely 

manner, (3) recovering rapidly from incidents when they occur and 

accelerating the adoption of lessons learned, (4) recruiting and 

retaining a highly qualified cybersecurity workforce, and (5) efficiently 

acquiring and deploying existing and emerging technology.

• The President directed his administration to implement the 

Cybersecurity National Action Plan. The plan identified near-term 

actions and a long-term strategy that are intended to enhance 

cybersecurity awareness and protections, protect privacy, maintain 

public safety and economic and national security, and empower 

Americans to take better control of their digital security.

• OMB issued the Federal Cybersecurity Workforce Strategy on July 

12, 2016, which identified key actions to help recruit and retain a 

federal cybersecurity workforce. These key actions included directions 

to OMB and the Office of Personnel Management (OPM) to provide 

guidance on the use of special hiring authorities to recruit 

cybersecurity professionals as well as directions to DHS for piloting a 

new hiring tool.

However, agencies had not yet fully implemented the actions identified in 

the plans and strategy. In addition, the plans do not consistently address 

the implementation of about 1,000 of our information security–related 

recommendations identified across federal agencies.

Action Plan
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 346 GAO-17-317 High-Risk Series

The EOP, DHS, and federal agencies partially met the criterion for 

implementing programs to monitor corrective actions related to 

cybersecurity and PII protection. A government-wide reporting process 

provided a mechanism for monitoring the efforts of federal agencies in 

achieving cross-agency priority goals for cybersecurity. Specifically, the 

EOP and DHS developed and used metrics for measuring agency 

progress in implementing initiatives on information security regarding 

continuous monitoring, strong authentication, and anti-phishing and 

malware defense. In addition, OMB and DHS continued to monitor 

agencies’ implementation of information security requirements using 

FISMA reporting metrics that are tracked in the CyberScope system.13

Together, they had conducted CyberStat reviews that are intended to 

hold agencies accountable and offer assistance for improving their 

information security posture.14

Nevertheless, other cybersecurity monitoring efforts lacked metrics to 

measure and report on the effectiveness of the planned and implemented 

activities. Examples included the following:

• In December 2015, we reported that DHS had not developed metrics 

to measure the effectiveness of its efforts to promote the voluntary 

use of NIST’s Framework for Improving Critical Infrastructure 

Cybersecurity or to develop guidance and tools to help entities use 

the framework.15 We recommended that DHS develop metrics to 

monitor the effectiveness of its efforts to promote the framework. DHS 

agreed and indicated that these efforts are underway.

• In November 2015, we reported that the sector-specific agencies—

federal agencies responsible for leading, facilitating, or supporting the 

security and resilience programs and associated activities of their 

designated critical infrastructure sectors—had taken actions to help 

 13CyberScope is an interactive data collection tool that has the capability to receive data 

feeds on a recurring basis to assess the security posture of a federal agency’s information 

infrastructure.

14CyberStat reviews are in-depth sessions with national security staff, OMB, DHS, and an 

agency to discuss that agency’s cybersecurity posture and discuss opportunities for 

collaboration.

15GAO, Critical Infrastructure Protection: Measures Needed to Assess Agencies’

Promotion of the Cybersecurity Framework, GAO-16-152 (Washington, D.C.: Dec. 17, 

2015).

Monitoring
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 347 GAO-17-317 High-Risk Series

mitigate cyber risks and vulnerabilities for their respective sectors.16

However, most sector-specific agencies had not developed metrics to 

measure and report on the effectiveness of their cyber risk mitigation 

activities or their sectors’ cybersecurity posture. We recommended 

that federal agencies develop performance metrics to monitor their 

progress. These metrics have not yet been developed.

The EOP, DHS, and federal agencies partially met this criterion by 

demonstrating progress in implementing the many requirements for 

securing federal systems and networks. For example, the federal 

government had taken the following steps to enhance cybersecurity and 

protect PII:

• The EOP established an OMB Cyber Unit in January 2015 to improve 

overall federal cybersecurity oversight.

• OMB initiated a 30-day Cybersecurity Sprint in June 2015 to lead 

federal agencies to adopt strong authentication controls and deploy 

critical patches.

• OMB and DHS conducted CyberStat reviews at federal agencies 

during fiscal years 2015 and 2016.

Nevertheless, federal agencies need to consistently demonstrate 

progress in the following areas:

• Designing and implementing risk-based cybersecurity programs 

at federal agencies. Shortcomings persist in assessing risks, 

developing and implementing security controls, and monitoring results 

at federal agencies. We and agency inspectors general have 

consistently identified weaknesses in agency processes for 

configuring security in information systems and networks, patching 

systems, replacing unsupported software, testing and evaluating 

security controls on a comprehensive and recurring basis, and 

overseeing contractors who provide IT services. We have identified 

information security as a government-wide material weakness in our 

annual audits of the consolidated financial report of the United States 

government in every year since 1997. As of February 7, 2017, 19 of 

23 Chief Financial Officers (CFO) Act agencies reported that 

information security control deficiencies were either a material 

 16GAO, Critical Infrastructure Protection: Sector-Specific Agencies Need to Better 

Measure Cybersecurity Progress, GAO-16-79 (Washington, D.C.: Nov. 19, 2015).

Demonstrated Progress
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 348 GAO-17-317 High-Risk Series

weakness or significant deficiency in internal controls over financial 

reporting for fiscal year 2016.17 Further, inspectors general at 20 of 

the 23 agencies cited information security as a major management 

challenge for their agencies.

• Providing government-wide intrusion detection and prevention 

services. In January 2016, we reported that DHS’s National 

Cybersecurity Protection System (NCPS) was partially, but not fully, 

meeting its stated system objectives of detecting intrusions, 

preventing intrusions, analyzing malicious content, and sharing 

information.18 DHS also had not developed metrics for measuring the 

performance of NCPS. We recommended that DHS take action to 

enhance NCPS’s capabilities, among other things. DHS concurred 

with our recommendations but has not yet fully implemented them.

• Strengthening security over industry and public health data at 

FDA. In August 2016, we reported that the Food and Drug 

Administration (FDA) had a significant number of security control 

weaknesses jeopardizing the confidentiality, integrity, and availability 

of its information and systems.19 The agency did not fully or 

consistently implement access controls, which are intended to 

prevent, limit, and detect unauthorized access to computing 

resources. Specifically, FDA did not always (1) adequately protect the 

boundaries of its network, (2) consistently identify and authenticate 

system users, (3) limit users’ access to only what was required to 

perform their duties, (4) encrypt sensitive data, (5) consistently audit 

and monitor system activity, and (6) review the physical security of its 

facilities. We made 15 recommendations to FDA to fully implement its 

agency-wide information security program. In a separate report with 

limited distribution, we recommended that FDA take 166 specific 

actions to resolve weaknesses in information security controls. FDA 

concurred with our recommendations and stated it has begun 

implementing many of them.

 17As of February 7, 2017, the Department of Defense, 1 of the 24 CFO Act agencies, had 

not reported results of audits of its financial statements for fiscal year 2016. 

18GAO, Information Security: DHS Needs to Enhance Capabilities, Improve Planning, and 

Support Greater Adoption of its National Cybersecurity Protection System, GAO-16-294 

(Washington, D.C.: Jan. 28, 2016).

19GAO, Information Security: FDA Needs to Rectify Control Weaknesses That Place 

Industry and Public Health Data at Risk, GAO-16-513 (Washington, D.C.: Aug. 30, 2016).
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 349 GAO-17-317 High-Risk Series

• Improving security controls over high-impact systems.20 In May 

2016, we reported that 18 federal agencies with high-impact systems 

identified cyberattacks from “nations” as the most serious and most 

frequently occurring threat to the security of their systems.21 These 

agencies also noted that attacks delivered through e-mail were the 

most serious and frequent. During fiscal year 2014, 11 of the 18 

agencies reported 2,267 incidents affecting their high-impact systems, 

with almost 500 of the incidents involving the installation of malicious 

code. At least half of the 18 agencies reported that challenges in 

recruiting and retaining staff with appropriate skills, rapidly changing 

technologies, and the limited effectiveness of intrusion detection tools 

impaired their capability to identify cyber threats to high-impact 

systems to a great or moderate extent.

We also examined the security controls over eight high-impact systems at 

four agencies and reported that although the agencies had implemented 

numerous controls over the systems, they did not always fully implement 

key elements of their information security programs including developing 

security plans, assessing security controls, and remedying known 

vulnerabilities. We recommended that OMB complete its plans and 

practices for securing federal systems and that the National Aeronautics 

and Space Administration, Nuclear Regulatory Commission, OPM, and 

Department of Veterans Affairs fully implement key elements of their 

information security programs. The agencies generally concurred with the 

recommendations, with the exception of OPM. OPM did not concur with 

our recommendation to re-evaluate security control assessments to 

ensure they comprehensively test technical controls. We continue to 

believe the recommendation is warranted.

• Addressing cybersecurity for the nation’s critical infrastructures.

In December 2015, we reported that agencies responsible for 

supporting protection efforts in critical infrastructure sectors and NIST 

had promoted and supported adoption of NIST’s Framework for 

 20NIST Federal Information Processing Standards Publication 199, Standards for Security 

Categorization of Federal Information and Information Systems (FIPS Pub 199) defines 

how agencies should determine the security category of their information and information 

systems. Agencies are to consider the potential effect or magnitude of harm that could 

occur should there be a loss in the confidentiality, integrity, or availability of the information 

or information system as low, moderate, or high. For high-impact systems, the loss could 

be expected to have a severe or catastrophic adverse effect on organizational operations, 

organizational assets, or individuals. 

21GAO, Information Security: Agencies Need to Improve Controls over Selected HighImpact Systems, GAO-16-501 (Washington, D.C.: May 18, 2016).
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 350 GAO-17-317 High-Risk Series

Improving Critical Infrastructure Cybersecurity in the critical 

infrastructure sectors.22 For example, DHS established the Critical 

Infrastructure Cyber Community Voluntary Program to encourage 

entities to adopt the framework. However, DHS had not developed 

metrics to measure the success of its activities and programs. In 

addition, DHS and the General Services Administration (GSA) had not 

determined whether to develop tailored guidance for implementing the 

framework in government facilities sectors as other sector-specific 

agencies had done for their respective sectors. DHS concurred with 

our recommendation to develop metrics, but has not indicated that it 

has taken action as of yet, and DHS and GSA concurred with our 

recommendation and made a determination about whether to develop 

sector-specific guidance.

In November 2015, we reported that the sector-specific agencies had 

determined the significance of cyber risk to the nation’s critical 

infrastructures and took actions to mitigate cyber risks and vulnerabilities 

for their respective sectors.23 However, not all sector-specific agencies 

had metrics to measure and report on the effectiveness of all their 

activities to mitigate cyber risks or their sectors’ cybersecurity posture. 

We recommended that agencies lacking metrics develop them and 

determine how to overcome any challenges to reporting the results of 

their activities to mitigate cyber risks. Four of the agencies explicitly 

agreed with our recommendations and identified planned or on-going 

efforts to implement performance metrics, but none have yet to provide 

developed metrics or reports of outcomes.

• Protecting the security and privacy of electronic health 

information. In August 2016, we reported that guidance for securing 

electronic health information issued by HHS did not address all key 

controls called for by other federal cybersecurity guidance.24 In 

addition, HHS oversight efforts did not always offer pertinent technical 

guidance and did not always follow up on corrective actions when 

investigative cases were closed. HHS generally concurred with the 

five recommendations we made and stated it would take actions to 

implement them. Information about actions taken to address the 

recommendations had not been provided at the time of this report.

 22GAO-16-152.

23 GAO-16-79.

24GAO, Electronic Health Information: HHS Needs to Strengthen Security and Privacy 

Guidance and Oversight, GAO-16-771 (Washington, D.C.: Aug. 26, 2016).
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 351 GAO-17-317 High-Risk Series

• Ensuring privacy when face recognition systems are used. In 

May 2016, we reported that the Federal Bureau of Investigation (FBI) 

had not been timely in publishing and updating privacy documentation 

for using face recognition technology.25 Publishing such documents in 

a timely manner would better assure the public that the FBI is 

evaluating risks to privacy when implementing systems. Also, the FBI 

had taken limited steps to determine whether the face recognition 

system it was using was sufficiently accurate. Of the six 

recommendations we made, DOJ agreed with one, partially agreed 

with two, and disagreed with three. Information about actions taken to 

address the recommendations had not been provided at the time of 

this report.

• Protecting the privacy of users’ data on state-based 

marketplaces. In March 2016, we reported on weaknesses in 

technical controls for the “data hub” that CMS uses to exchange 

information between its health insurance marketplace and external 

partners.26 We also identified significant weaknesses in the controls in 

place at three selected state-based marketplaces established to carry 

out provisions of the Patient Protection and Affordable Care Act.27 We 

recommended that CMS define procedures for overseeing the 

security of state-based marketplaces and require continuous 

monitoring of state marketplace controls. HHS concurred with our 

recommendations. Information about actions taken to address the 

recommendations had not been provided at the time of this report.

• Improving consumer privacy protections. Major recommendations 

of the administration’s 2012 report on consumer privacy had not yet 

been implemented in 2016. The report included a framework as a 

broad action plan intended to improve consumer privacy protection, 

yet the administration’s recommendations to enact a consumer 

privacy bill of rights into law and to establish a national standard for 

data breach notification had not been implemented.

 25GAO, Face Recognition Technology: FBI Should Better Ensure Privacy and Accuracy, 

GAO-16-267 (Washington, D.C.: May 16, 2016).

26GAO, Healthcare.gov: Actions Needed to Enhance Information Security and Privacy 

Controls, GAO-16-265 (Washington, D.C.: Mar. 23, 2016).

27Pub. L. No. 111-148, 124 Stat. 119 (Mar. 23, 2010), as amended by the Health Care and 

Education Reconciliation Act of 2010, Pub. L. No. 111-152,124 Stat.1029 (Mar. 30, 2010). 
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 352 GAO-17-317 High-Risk Series

• Establishing a strategy for improving federal cybersecurity. In 

October 2015, OMB issued the Cybersecurity Strategy and 

Implementation Plan, which identified a series of action steps in 

several key areas that are intended to improve federal information 

security. As we had recommended in February 2013, the strategy 

clearly assigns responsibilities to specific organizations and 

individuals, sets specific dates for completing actions, and establishes 

a mechanism for monitoring progress.28 Implementing the strategy 

effectively and on time will likely improve the overall posture and 

capabilities of the federal government to protect its information and 

computer systems and networks.

• Bolstering information security at federal agencies. Over the last 

4 fiscal years, federal agencies have implemented over 330 of our 

recommendations related to strengthening the security over sensitive 

information and systems at the Census Bureau, Federal 

Communications Commission, Internal Revenue Service, Federal 

Deposit Insurance Corporation, Securities Exchange Commission, 

CMS, and Federal Aviation Administration, among others. Security 

vulnerabilities expose agency information to increased risk of 

unauthorized access, disclosure, modification, and use. Addressing 

vulnerabilities better assures the confidentiality, integrity, and 

availability of the information agencies maintain and use for 

conducting their missions.

• Improving privacy protections for PII. While more needs to be 

done, agencies have taken action in response to our 

recommendations for specific steps to enhance the protection of PII. 

For example, agencies have implemented 8 of the 23 

recommendations we made in 2013 to improve their practices in 

response to breaches of PII, improvements which can improve the 

consistency and effectiveness of data breach response programs. 

Likewise, HHS has implemented all 6 management recommendations 

we made in 2014 to ensure that PII contained in systems supporting 

the Healthcare.gov health insurance marketplace is properly protected 

from potential privacy threats.

For additional information about this high-risk area, contact Gregory C. 

Wilshusen at (202) 512-6244 or wilshuseng@gao.gov.

 28GAO, Cybersecurity: National Strategy, Roles, and Responsibilities Need to Be Better 

Defined and More Effectively Implemented, GAO-13-187 (Washington, D.C.: Feb. 14, 

2013).

Benefits Achieved by 

Implementing Our 

Recommendations

GAO Contact
Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and 

Protecting the Privacy of Personally 

Identifiable Information

Page 353 GAO-17-317 High-Risk Series

Federal Information Security: Actions Needed to Address Challenges. 

GAO-16-885T. Washington, D.C.: September 19, 2016.

Electronic Health Information: HHS Needs to Strengthen Security and 

Privacy Guidance and Oversight. GAO-16-771. Washington, D.C.: August 

26, 2016.

Federal Chief Information Security Officers: Opportunities Exist to 

Improve Roles and Address Challenges to Authority GAO-16-686. 

Washington, D.C.: August 26, 2016.

Information Security: FDA Needs to Rectify Control Weaknesses That 

Place Industry and Public Health Data at Risk. GAO-16-513. Washington, 

D.C.: August 30, 2016.

Information Security: Agencies Need to Improve Controls over Selected 

High-Impact Systems. GAO-16-501. Washington, D.C.: May 18, 2016.

Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way, but 

DOT Needs to Define Its Role in Responding to a Real-world Attack. 

GAO-16-350. Washington, D.C.: March 24, 2016.

SmartPhone Data: Information and Issues Regarding Surreptitious 

Tracking Apps That Can Facilitate Stalking. GAO-16-317. Washington, 

D.C.: April 21, 2016.

Information Security: DHS Needs to Enhance Capabilities, Improve 

Planning, and Support Greater Adoption of Its National Cybersecurity 

Protection System. GAO-16-294. Washington, D.C.: January 28, 2016.

Healthcare.gov: Actions Needed to Enhance Information Security and 

Privacy Controls. GAO-16-265. Washington, D.C.: March 23, 2016.

Critical Infrastructure Protection: Sector-Specific Agencies Need to Better 

Measure Cybersecurity Progress. GAO-16-79. Washington, D.C.: 

November 19, 2015.

Related GAO 

Products
Strengthening Department of Homeland 

Security Management Functions

Page 354 GAO-17-317 High-Risk Series

The Department of Homeland Security’s (DHS) top leadership, including 

the Secretary and Deputy Secretary of Homeland Security, has 

demonstrated exemplary commitment and support for addressing the 

department’s management challenges. However, DHS needs to continue

implementing its Integrated Strategy for High Risk Management and 

maintain engagement with us to show measurable, sustainable progress 

in implementing corrective actions and achieving outcomes. In 2003, we 

designated implementing and transforming DHS as high risk because 

DHS had to transform 22 agencies—several with major management 

challenges—into one department. Further, failure to effectively address 

DHS’s management and mission risks could have serious consequences 

for U.S. national and economic security. Given the significant effort 

required to build and integrate a department as large and complex as 

DHS, our initial high-risk designation addressed the department’s 

implementation and transformation efforts to include associated 

management and programmatic challenges. At that time, we reported that 

the creation of DHS was an enormous undertaking that would take time to 

achieve, and that successfully transforming large organizations, even 

those undertaking less strenuous reorganizations, could take years to 

implement.

Over the past 14 years, the focus of this high-risk area has evolved in 

tandem with DHS’s maturation and evolution. The overriding tenet has 

consistently remained DHS’s ability to build a single, cohesive, and 

effective department that is greater than the sum of its parts—a goal that 

requires effective collaboration and integration of its various components 

and management functions. In 2007, in reporting on DHS’s progress 

since its creation, as well as in our 2009 high-risk update, we reported

that DHS had made more progress in implementing its range of missions 

than its management functions—acquisition, information technology (IT), 

financial, and human capital—and that continued work was needed to 

address an array of management and programmatic challenges. As we 

reported in September 2011, DHS’s initial focus on mission 

implementation was understandable given the critical homeland security 

Strengthening Department of Homeland 

Security Management Functions

Why Area Is High 

Risk
Strengthening Department of Homeland 

Security Management Functions

Page 355 GAO-17-317 High-Risk Series

needs facing the nation after the department’s establishment, and the 

challenges posed by creating, integrating, and transforming it.1

As DHS continued to mature, and as we reported in our assessment of 

DHS’s progress and challenges in the 10 years following 9/11, we found 

that the department implemented key homeland security operations and 

achieved important goals in many areas to create and strengthen a 

foundation to reach its potential. For example, DHS developed strategic 

and operational plans to guide its efforts—such as the National Response 

Framework that outlines disaster response guiding principles—and 

successfully hired, trained, and deployed workforces, including the federal 

screening workforce to assume screening responsibilities at airports 

nationwide.

However, we also found that more work remained for DHS to address 

weaknesses in other areas of its operational and implementation efforts. 

For example, we reported in 2011 that DHS had not yet determined how 

to implement a biometric exit capability, had taken action to address a 

small portion of the estimated overstay population in the United States, 

and needed to strengthen efforts to assess national capabilities for allhazards preparedness. We further reported that continuing weaknesses 

in implementing and integrating DHS’s management functions continued 

to affect the department’s implementation efforts.

Recognizing DHS’s progress in mission implementation and 

transformation, our 2011 high-risk update focused on the department’s 

continued need to strengthen and integrate its management functions. In 

our 2013 high-risk update, we found that DHS had made considerable 

progress in strengthening and integrating its management functions, but 

that challenges remained and progress was needed to mitigate the risks 

that management weaknesses posed to DHS’s ability to accomplish its 

mission and use its resources efficiently and effectively. Therefore, in 

 1

GAO, Department of Homeland Security: Progress Made and Work Remaining in 

Implementing Homeland Security Missions 10 Years after 9/11, GAO-11-881 

(Washington, D.C.: Sept. 7, 2011). This report addressed DHS’s progress in implementing 

its homeland security missions since it began operations, work remaining, and issues 

affecting implementation efforts. Drawing from more than 1,000 GAO reports and 

congressional testimony issued related to DHS programs and operations, and 

approximately 1,500 recommendations made to strengthen mission and management 

implementation, this report addressed progress and remaining challenges in such areas 

as border security and immigration, transportation security, and emergency management, 

among others.
Strengthening Department of Homeland 

Security Management Functions

Page 356 GAO-17-317 High-Risk Series

2013 we narrowed the scope of the high-risk area and changed the name 

from Implementing and Transforming the Department of Homeland 

Security to Strengthening Department of Homeland Security Management 

Functions to reflect this focus. In our 2015 high-risk update, we found that 

DHS’s top leadership had continued to demonstrate exemplary 

commitment to and support for addressing the department’s management 

challenges and that DHS had made important progress in strengthening 

its management functions. However, we also found that DHS continued to 

face significant management challenges that hindered its ability to 

achieve its missions and concluded that DHS needed to continue to 

demonstrate sustainable, measureable progress in addressing key 

challenges that remained within and across its management functions.

DHS’s continued efforts to strengthen and integrate its acquisition, IT, 

financial, and human capital management functions have resulted in the

department meeting three criteria for removal from the High-Risk List

(leadership commitment, a corrective action plan, and a framework to 

monitor progress) and partially meeting the remaining two criteria 

(capacity and demonstrated, sustained progress). DHS’s top leadership, 

including the Secretary and Deputy Secretary of Homeland Security, has 

demonstrated exemplary commitment and support for addressing the 

department’s management challenges. For instance, the department’s 

Deputy Secretary, Under Secretary for Management, and other senior 

management officials have frequently met with us to discuss the 

department’s plans and progress, which serves as a model for seniorlevel engagement and helps ensure a common understanding of the 

remaining work needed to address our high-risk designation. Further, 

DHS established a framework for monitoring its progress in its Integrated 

Strategy for High Risk Management, in which it has included performance 

measures to track the implementation of key management initiatives 

since June 2012. In addition, since our 2015 high-risk update, DHS has 

strengthened its monitoring efforts for financial system modernization 

programs that are key to effectively supporting the department’s financial 

management operations, resulting in DHS meeting the monitoring criteria 

for the first time.

DHS has also issued updated versions of its Integrated Strategy for High 

Risk Management, demonstrating a continued focus on addressing this 

high-risk designation, and made important progress in identifying and 

putting in place the people and resources needed to resolve departmental 

management risks. The integrated strategy includes key management 

initiatives and related corrective action plans for achieving 30 outcomes, 

What GAO Found
Strengthening Department of Homeland 

Security Management Functions

Page 357 GAO-17-317 High-Risk Series

which we identified and DHS agreed are critical to addressing the 

challenges within the department’s management areas, and to integrating 

those functions across the department. DHS has continued to make 

important progress across all of its management functions, fully 

addressing 13 of these outcomes, 9 of which it has sustained as fully 

implemented for at least 2 years. For example, DHS fully addressed one 

outcome for the first time by demonstrating improvement in human capital 

management by linking workforce planning efforts to strategic and 

program planning efforts.

DHS also sustained full implementation of two other outcomes by 

obtaining a clean audit opinion on its financial statements for 4 

consecutive fiscal years. Further, DHS has mostly addressed an 

additional eight outcomes, meaning that a small amount of work remains 

to fully address them. Considerable work remains, however, in several 

areas for DHS to fully achieve the remaining 17 outcomes and thereby 

strengthen its management functions. Addressing some of these 

outcomes, such as those pertaining to improving employee morale and 

modernizing the department’s financial management systems, are 

significant undertakings that will likely require multiyear efforts. DHS 

needs to make additional progress identifying and allocating resources in 

certain areas to sufficiently demonstrate that it has the capacity (that is, 

the people and resources) to achieve and sustain all 30 outcomes, as 

well as demonstrate additional sustainable and measurable progress in 

addressing key challenges that remain within and across these 

management functions.

Congress has taken a number of actions to support and oversee DHS’s 

progress in strengthening its management functions, including the 

following examples:

• The National Defense Authorization Act for Fiscal Year 2017 includes 

a mandate that the DHS Under Secretary for Management report to 

us every 6 months to demonstrate measurable, sustainable progress 

made in implementing DHS’s corrective action plans to address the 

Strengthening DHS Management Functions high-risk area until we 

submit written notification of the area’s removal from the high-risk list 

to the appropriate congressional committees.2 Similar provisions were 

included in the DHS Headquarters Reform and Improvement Act of 

 2

Pub. L. No. 114-328, § 1903(b) (codified at 6 U.S.C. § 341(a)(11)). 
Strengthening Department of Homeland 

Security Management Functions

Page 358 GAO-17-317 High-Risk Series

2015,3 the DHS Accountability Act of 2016,4 and the DHS Reform and 

Improvement Act.5

• House Report 114-215, which accompanied H.R. 3128 (DHS 

appropriations bill for fiscal year 2016) and later became effective 

under the Consolidated Appropriations Act, 2016, includes mandates 

related to DHS’s financial management system modernization 

projects, which relate to three high-risk financial management 

outcomes.6 Specifically, the committee directed GAO to assess the 

risks of DHS utilizing the Department of Interior’s Business Center 

(IBC), whether IBC is capable of expanding its services to additional 

federal agencies, and a comparison of the services and capabilities of 

federal and commercial shared service providers. In addition, the 

committee directed the DHS Office of the Chief Financial Officer to 

update the lifecycle cost estimate to reflect all contract awards and 

projected overall costs, including those for every component that 

plans to migrate to a federal shared service provider.

• The Border Patrol Agent Pay Reform Act of 2014, enacted on 

December 18, 2014, includes a mandate related to cybersecurity 

workforce assessments, which relates to one human capital 

management outcome.7 Specifically, DHS must identify all 

cybersecurity workforce positions and identify positions and areas of 

critical need.

Congress also held a number of oversight hearings related to addressing 

DHS’s management challenges:

• U.S. Senate, Committee on Homeland Security and Governmental 

Affairs Hearing: DHS Management and Acquisition Reform. March 16, 

2016.

 3

H.R.3572, 114th Cong. (as passed by House, Oct. 20, 2015).

4

S. 2976, 114th Cong. § 101(b) (as reported by S. Comm. on Homeland Sec. and Gov’tal 

Affairs, June 28, 2016).

5

H.R. 6381, 114th Cong. (2016).

6

H.R. Rep. No. 114-215 (2015); Pub. L. No. 114-113, 129 Stat. 2242 (2015). The 

explanatory statement accompanying the Consolidated Appropriations Act, 2016, provided 

that House Report 114-215 carries the same weight as language included in the 

explanatory statement, unless specifically addressed to the contrary in the bill or the 

explanatory statement.

7

Pub. L. No. 113-277, § 4,128 Stat. 2995, 3008-3010 (2014).
Strengthening Department of Homeland 

Security Management Functions

Page 359 GAO-17-317 High-Risk Series

• U.S. House of Representatives, Committee on Homeland Security, 

Subcommittee on Oversight and Management Efficiency Hearing: 

Assessing DHS’s Performance: Watchdog Recommendations to 

Improve Homeland Security. February 26, 2015.

• U.S. House of Representatives, Committee on Homeland Security 

Hearing: Preventing Waste, Fraud, Abuse and Mismanagement in 

Homeland Security – A GAO High-Risk List Review. May 7, 2014.

• U.S. Senate, Committee on Homeland Security and Governmental 

Affairs Hearing: The Department of Homeland Security at 10 Years: A 

Progress Report on Management. March 21, 2013.

In the coming years, DHS needs to continue implementing its Integrated 

Strategy for High Risk Management and maintain engagement with us to 

show measurable, sustainable progress in implementing corrective 

actions and achieving outcomes. In doing so, it will be important for DHS 

to

• maintain its current level of top leadership support and sustained 

commitment to ensure continued progress in executing its corrective 

actions through completion;

• continue to identify the people and resources necessary to make 

progress towards achieving outcomes, work to mitigate shortfalls and 

prioritize initiatives, as needed, and communicate to senior leadership 

critical resource gaps;

• continue to implement its plan for addressing this high-risk area and 

periodically provide assessments of its progress to us and Congress;

• closely track and independently validate the effectiveness and 

sustainability of its corrective actions, and make midcourse 

adjustments as needed; and

• make continued progress in achieving the 17 outcomes it has not fully 

addressed and demonstrate that systems, personnel, and policies are 

in place to ensure that progress can be sustained over time.

We will continue to monitor DHS’s efforts in this high-risk area to 

determine if the outcomes are achieved and sustained over the long term. 

Further, in order to address the outcomes, DHS must implement our prior 

recommendations listed below.

• DHS should address employee morale problems through 

comprehensively examining root causes and establishing clear 

metrics of success within DHS and its components’ action plans.

What Remains to Be 

Done
Strengthening Department of Homeland 

Security Management Functions

Page 360 GAO-17-317 High-Risk Series

• DHS should ensure that its Human Resources IT Program (HRIT), of 

which the Performance and Learning Management System is the 

primary active project, receives necessary oversight and attention by 

ensuring the HRIT Executive Steering Committee is consistently 

involved. DHS should also address HRIT’s poor progress and 

ineffective management by: (1) updating and maintaining a schedule 

estimate for when DHS plans to implement each of the strategic 

improvement opportunities; (2) developing a complete life-cycle cost 

estimate for the implementation of HRIT; (3) documenting and 

tracking all costs, including components’ costs, associated with HRIT; 

and (4) updating and maintaining the department’s human resources 

system inventory, among other things.

• To more accurately communicate DHS’s funding plans for U.S. Coast 

Guard’s major acquisitions programs, DHS should ensure the funding 

plans presented to Congress are comprehensive and clearly account 

for all operations and maintenance funding DHS plans to allocate to 

each of the programs.

• DHS should enhance its leadership’s ongoing efforts to improve the 

affordability of the department’s major acquisitions portfolio by 

requiring components to submit funding certification memorandums 

for all major acquisition programs that have not been reviewed at an 

Acquisition Decision Event; and convening Acquisition Review Boards 

to discuss affordability and make tradeoffs between cost, schedule, 

and performance, as necessary. In addition, DHS should ensure that 

the Fiscal Year 2017 Future Years Homeland Security Program report 

reflects the results of any tradeoffs stemming from the acquisition 

affordability reviews; and require components to establish formal, 

repeatable processes for addressing major acquisition affordability 

issues.

• DHS’s Chief Information Officer should use accurate and reliable 

information, such as operational assessments of the new architecture 

and cost and schedule parameters approved by the Under Secretary 

of Management, to help ensure that assessments prepared by the 

Office of the Chief Information Officer in support of the department’s 

updates to the federal IT Dashboard more fully reflect the current 

status of the Transformation Program.

• DHS should continue to work to address its IT mission critical skills 

gaps, such as those related to its cybersecurity workforce. Further, 

DHS needs to remediate the material weakness in information 

security controls reported by its financial statement auditor in fiscal 

year 2016 by effectively addressing weaknesses in controls related to 

access, configuration management, and segregation of duties.
Strengthening Department of Homeland 

Security Management Functions

Page 361 GAO-17-317 High-Risk Series

• DHS should ensure consistent, effective oversight of DHS’s 

acquisition programs and make the Comprehensive Acquisition Status 

Report (CASR) more useful by adjusting CASR to enable DHS to hold 

programs accountable for maintaining their cost, schedule, and 

performance data. For example, CASR could report an individual 

rating for each program’s cost, schedule, and technical risks, and the 

level at which the program’s life-cycle cost estimate was approved.

The Secretary and Deputy Secretary of Homeland Security, the DHS 

Under Secretary for Management, and other senior DHS officials have 

demonstrated exemplary commitment and top leadership support for 

addressing the department’s management challenges. They have also 

taken actions to institutionalize this commitment to help ensure the longterm success of the department’s efforts. For example, the Secretary of 

Homeland Security’s Unity of Effort initiative has helped to strengthen the 

integration of DHS’s business operations across the department by, for 

example, finalizing a management directive in June 2015 that formally 

establishes multiple senior leader forums for ongoing review of 

departmental initiatives.8 The Secretary’s Unity of Effort initiative also 

established enhancements to DHS’s budgeting process by creating a new 

approach to mission-focused, cross-DHS budget development and 

assessment. Senior DHS officials have also routinely met with us over the 

past 8 years to discuss the department’s plans and progress in 

addressing this high-risk area. During this time, we provided specific 

feedback on the department’s efforts. According to DHS officials, and as 

demonstrated through their progress, the department continues to be 

committed to demonstrating measurable, sustained progress in 

addressing this high-risk area. For example, during monthly leadership 

meetings with the Under Secretary for Management, the department’s 

Chief Executive Officers for each management area provide status 

updates on their respective business function’s efforts to achieve 

 8

DHS, Secretary of Homeland Security, Strengthening Departmental Unity of Effort, 

Memorandum for DHS Leadership (Washington, D.C.: Apr. 22, 2014). This memorandum 

committed to, among other things, improving DHS’s planning, programming, budgeting, 

and execution processes through strengthened departmental structures and increased 

capability. DHS, Strengthening Departmental Unity of Effort, Management Directive 071-

01 (Washington D.C.: June 30, 2015).

Additional Details on 

What GAO Found

Leadership Commitment
Strengthening Department of Homeland 

Security Management Functions

Page 362 GAO-17-317 High-Risk Series

progress on outstanding actions that are to be accomplished related to 

the high-risk area. According to DHS officials, these meetings provide an 

opportunity to maintain leadership support and accountability for making 

progress toward resolving management challenges facing the 

department. It will be important for DHS to maintain its current level of top 

leadership support and commitment to ensure continued progress in 

successfully completing its corrective actions.

DHS has taken important actions to identify and put in place the people 

and resources needed to resolve departmental management risks; 

however, DHS needs to make additional progress identifying and 

allocating resources in certain areas to sufficiently demonstrate that it has 

the capacity to achieve and sustain corrective actions and outcomes. In 

particular, in a September 2010 letter to DHS, we identified and DHS 

agreed to achieve 31 outcomes that are critical to addressing challenges 

within the department’s management areas and in integrating those 

functions across the department. In March 2014, we updated these 

outcomes in collaboration with DHS to reduce overlap and ensure their 

continued relevance and appropriateness. These updates resulted in a 

reduction from 31 to 30 total outcomes. Toward achieving the outcomes, 

DHS has issued 10 updated versions of its initial January 2011 Integrated 

Strategy for High Risk Management, most recently in August 2016.

Prior to the January 2016 Integrated Strategy for High Risk Management, 

DHS did not identify sufficient resources in a number of areas that could 

undermine DHS’s efforts to strengthen its management functions. For 

example, in June 2015, DHS identified that it had resources and 

personnel needed to implement 8 of the 11 key management initiatives it 

was undertaking to achieve the 30 outcomes, but did not identify sufficient 

resources for the 3 remaining initiatives. In addition, our prior work has 

identified specific capacity gaps that could undermine achievement of 

management outcomes.

In contrast, DHS’s January and August 2016 updated versions of its 

strategy stated that it had addressed previously identified capacity 

shortfalls in areas such as IT human capital management and acquisition 

management, it had sufficient resources to achieve all 30 outcomes, and 

it had self-assessed the capacity criterion as fully met. In its August 2016 

updated version of its strategy, DHS also provided illustrative examples of 

actions it had taken within and across its management areas to 

demonstrate the department’s ability to resolve potential risks to 

achieving the 30 outcomes, such as establishing a permanent office for 

Capacity
Strengthening Department of Homeland 

Security Management Functions

Page 363 GAO-17-317 High-Risk Series

the Unity of Effort Integration within the Office of Policy to oversee Unity 

of Effort implementation.

However, we found that DHS needs to make additional progress 

identifying and allocating resources in certain areas.

• Acquisition management. With respect to acquisition, DHS’s 2016 

staffing assessments focused on identifying critical acquisition-related 

position gaps rather than all major program acquisition-related 

positions; consequently, some programs were assessed as being fully 

or almost fully staffed for critical positions despite significant staffing 

shortfalls in the overall program. This increased focus on critical gaps 

may limit DHS’s insight into the size and nature of acquisition-related 

staffing shortfalls, making it difficult for DHS to develop a plan or 

process to address these vacancies. In December 2016, DHS 

updated its staffing assessment guidance to refocus the assessment 

process on all major program acquisition-related positions. However, 

DHS plans to pilot the implementation of this policy update 

incrementally during 2017, and the timing of full implementation is not 

yet known.

• IT management. DHS’s fiscal year 2015-2018 IT Strategic Plan 

introduced the department’s plan to shift the IT paradigm from 

acquiring assets to acquiring services and acting as a service broker. 

The department’s August 2016 updated version of its strategy

reported that this shift is a mechanism for building capacity to resolve 

risk. However, while DHS issued a workforce planning contract in July 

2016 to help DHS headquarters transition to the skillsets needed to 

accommodate the service broker model, department officials stated 

that they have not yet defined what those skill sets are or analyzed 

the skills gaps resulting from the paradigm shift. Because DHS has 

yet to comprehensively assess IT human capital gaps within 

headquarters, it remains unclear whether DHS has the capacity to 

support this paradigm shift.

• Financial management. Additionally, although DHS continues to 

make progress towards modernizing its financial management 

systems, critical information needed to determine the resources 

required for two of three key modernization projects is not available as 

the projects are not yet to a point where DHS can determine what 

resources are required. Specifically, the discovery phase of these 

projects provides essential information for determining the 

implementation schedule and finalizing cost estimates that are 

needed prior to approving the projects for implementation; however, 

this phase is not expected to be completed for DHS’s Federal 
Strengthening Department of Homeland 

Security Management Functions

Page 364 GAO-17-317 High-Risk Series

Emergency Management Agency and U.S. Immigration and Customs 

Enforcement modernization projects until April 2017.9

DHS has taken actions to address some of its previous capacity 

shortcomings and ensure that the department has the people and 

resources necessary to resolve risk. However, additional progress is 

needed to ensure that DHS has sufficient capacity not only to resolve 

risks, but to fully achieve and sustain the 30 outcomes. As a result, we 

assess DHS having partially met the capacity criterion. DHS needs to 

continue to comprehensively identify the people and resources necessary 

to make progress towards achieving all 30 outcomes; work to mitigate 

shortfalls and prioritize initiatives, as needed; and communicate to senior 

leadership about critical resource gaps requiring resolution.

DHS previously established a plan for addressing this high-risk area as 

discussed above, and has continued to take critical, actionable steps 

towards addressing challenges faced within the department. As with prior 

iterations, DHS included in its most recent August 2016 version of its 

Integrated Strategy for High Risk Management key management 

initiatives and related corrective actions for addressing each of the 

management challenges and related outcomes we identified. For 

example, the August 2016 updated version of its strategy includes 

information on actions DHS is taking for an initiative focused on financial 

systems modernization and an initiative focused on IT human capital 

management, which support various outcomes. DHS’s strategy and 

approach, if effectively implemented and sustained, provides a path for 

DHS to be removed from our High-Risk List.

DHS has met the monitor progress criterion as a result of steps the 

department has taken since our 2015 high-risk update to strengthen its 

monitoring of key financial system modernization programs. DHS 

established a framework for monitoring its progress in implementing key 

management initiatives in the Integrated Strategy for High Risk 

Management. In the June 2012 updated version of its strategy, DHS 

included, for the first time, performance measures to track its progress in 

implementing all of its key management initiatives. DHS continued to 

include performance measures in its August 2016 updated version of its 

 9

The discovery phase includes an in-depth analysis of the requirements and capabilities of 

the new system, also known as a gap analysis, and is also performed to determine the 

feasibility of implementing, deploying, and maintaining financial management services for 

the chosen solution.

Action Plan

Monitoring
Strengthening Department of Homeland 

Security Management Functions

Page 365 GAO-17-317 High-Risk Series

strategy. For example, to monitor progress made towards strengthening 

the DHS acquisition process by improving the acquisition workforce, DHS 

management continues to monitor the percent of its nine acquisition 

certification policies completed—policies related to program 

management, cost estimating, and contracting among others—and the 

percent of required acquisition certification training developed.

However, in our 2015 high-risk update, we found that DHS could 

strengthen its financial management monitoring efforts and thus 

concluded that the department had partially met the criterion for 

establishing a framework to monitor progress. In particular, according to 

DHS officials, as of November 2014, the department was establishing a 

monitoring program that would include assessing whether the projects 

modernizing key components of their financial management systems 

were following industry best practices and meeting users’ needs. 

Effectively implementing these modernization projects is important 

because until they are complete, the department’s systems will not 

effectively support financial management operations. Following the 2015 

high-risk update, DHS entered into a contract for independent verification 

and validation services that should help ensure that financial 

management systems modernization projects meet key requirements.

Moving forward, DHS will need to continue to closely track and 

independently validate the effectiveness and sustainability of its corrective 

actions, and make midcourse adjustments as needed.

DHS has continued to make important progress in strengthening its 

management functions, but needs to demonstrate additional sustainable 

and measurable progress in addressing key challenges that remain within 

and across these functions. DHS has either fully or mostly addressed 21 

of the 30 outcomes, demonstrating the department’s progress in 

strengthening its management functions, and partially addressed or 

initiated the remaining 9 outcomes. For example, DHS established the 

Joint Requirements Council, an acquisition oversight body, through which 

it has created a process for validating capability and requirements 

documents, among other things. DHS has also worked to improve the 

management and oversight of its IT investments by establishing and

implementing a tiered governance and portfolio management structure. In 

addition, DHS obtained a clean audit opinion on its financial statements 

for 4 consecutive fiscal years—2013, 2014, 2015, and 2016.

However, as we found in our 2015 report, considerable work remains as 

DHS continues to face significant management challenges in key areas 

Demonstrated Progress
Strengthening Department of Homeland 

Security Management Functions

Page 366 GAO-17-317 High-Risk Series

that hinder the department’s ability to meet its missions. For this update, 

we determined that DHS has partially addressed 6 and initiated 3 of the 

30 outcomes. For example, while DHS has initiated acquisition program 

health assessments to demonstrate that major acquisition programs are 

on track to achieve their cost, schedule, and capability goals, it will take 

time to demonstrate that these initiatives will improve program 

performance. In addition, DHS does not have modernized financial 

management systems, which affects its ability to have ready access to 

reliable information for informed decision making. Further, it is important 

that DHS retain and attract the talent required to complete its work—a 

challenge the department continues to face due to employee morale 

issues. Addressing these and other management challenges will be a 

significant undertaking, but will be critical to mitigate the risks that 

management weaknesses pose to mission accomplishment.

Achieving sustained progress across the outcomes, in turn, requires 

leadership commitment, effective corrective action planning, adequate 

capacity (that is, the people and other resources), and monitoring the 

effectiveness and sustainability of supporting initiatives. Table 7

summarizes DHS’s progress in addressing the 30 key outcomes and is 

followed by selected examples.

Table 7: GAO Assessment of DHS Progress in Addressing Key Outcomes

Key management 

function

Fully 

addresseda Mostly addressedb Partially addressedc Initiatedd Total

Acquisition 

management

2 2 1 5

Information 

technology 

management

3 3 6

Financial 

management

2 3 3 8

Human capital 

management

3 3 1 7

Management 

integration

3 1 4

Total 13 8 6 3 30

Source: GAO analysis of DHS documents, interviews, and prior GAO reports. | GAO-17-317

a

”Fully addressed”: Outcome is fully addressed.

b

”Mostly addressed”: Progress is significant and a small amount of work remains.

c

”Partially addressed”: Progress is measurable, but significant work remains.

d

”Initiated”: Activities have been initiated to address the outcome, but it is too early to report progress.
Strengthening Department of Homeland 

Security Management Functions

Page 367 GAO-17-317 High-Risk Series

• Acquisition management. DHS has fully addressed two of the five 

acquisition management outcomes, mostly addressed two outcomes, 

and partially addressed the remaining outcome. For example, DHS 

has validated the required acquisition documentation for all of its 

major acquisition programs and plans to continue to ensure that all 

major acquisition programs have approved acquisition program 

baselines, and to use a pre-Acquisition Review Board checklist to 

confirm that programs have all required documentation for Acquisition 

Decision Events. In addition, DHS has taken a number of recent 

actions to establish and operate the Joint Requirements Council. 

These actions include (1) establishing a process for validating 

capability and requirements documents, and (2) piloting a joint 

assessment of requirements process that is intended to eventually 

inform the department’s budget decisions.

Further, DHS continues to assess and address whether appropriate 

numbers of trained acquisition personnel are in place at the 

department and component levels. Finally, we reported in March 2016 

that only 11 of the 25 major DHS acquisition programs we reviewed 

remained on track to meet their current schedule and cost goals.10

DHS has initiated acquisition program health assessments to report to 

senior DHS management the status of major acquisition programs 

toward achieving cost, schedule, and capability goals; however, it will 

take time to demonstrate that such initiatives are improving program 

performance.

• IT management. DHS has fully addressed three of the six IT 

management outcomes and mostly addressed the remaining three. 

For example, DHS established and implemented a tiered governance 

and portfolio management structure for overseeing and managing its 

IT investments, and annually reviews each of its portfolios and the 

associated investments to determine the most efficient allocation of 

resources within each of the portfolios. The department also made 

progress in implementing strategic IT human capital planning goals 

that support the department’s IT Strategic Plan. In this strategic plan, 

DHS shifted its IT paradigm from acquiring assets to acquiring 

services and acting as a service broker, or intermediary between the 

purchaser of a service and seller of that service. However, according 

to DHS officials, this shift will require a major transition in the skill sets 

 10GAO, Homeland Security Acquisitions: DHS Has Strengthened Management, but 

Execution and Affordability Concerns Endure, GAO-16-338SP (Washington D.C.: Mar. 31, 

2016).
Strengthening Department of Homeland 

Security Management Functions

Page 368 GAO-17-317 High-Risk Series

of DHS’s IT workforce, as well as hiring, training, and managing staff 

with those new skill sets.

While DHS issued a contract in July 2016 for support services to 

assist DHS headquarters in implementing this transition, department 

officials stated in September 2016 that they have not yet defined the 

skill sets needed to implement the paradigm shift or identified what 

skills gaps exist. Additionally, we found that DHS continues to take 

steps to enhance its information security program. According to 

independent auditors of the department’s financial statements, DHS 

had made progress in correcting its prior year IT security weaknesses. 

However, in November 2016—for the 13th consecutive year—the 

auditors designated deficiencies in IT systems controls as a material 

weakness for financial reporting purposes.11

• Financial management. DHS has fully addressed two financial 

management outcomes, partially addressed three, and initiated 

three.12 Most notably, DHS received a clean audit opinion on its 

financial statements for 4 consecutive years, fiscal years 2013, 2014, 

2015 and 2016—fully addressing two outcomes. In addition, in 

November 2016, DHS’s financial statement auditors reported that one 

of four material weaknesses in its internal controls over financial 

reporting had been remediated since our last high-risk update. DHS 

has continued efforts to improve internal controls and expects that it 

will remediate the remaining three by fiscal year 2017. Until 

remediated, these weaknesses will continue to hamper DHS’s ability 

to establish effective internal controls over financial reporting and 

comply with financial management system requirements. DHS also 

continues to make progress on three multiyear projects to modernize 

financial management systems for selected DHS components. 

Specifically, DHS has made progress on its U.S. Coast Guard 

modernization project, whereas additional efforts need to be 

completed on its projects to modernize Federal Emergency 

Management Agency and U.S. Immigration and Customs 

 11A material weakness is a deficiency, or a combination of deficiencies, in internal control 

such that there is a reasonable possibility that a material misstatement of the entity’s 

financial statements will not be prevented, or detected and corrected, on a timely basis. A 

significant deficiency is a deficiency, or combination of deficiencies, in internal control that 

is less severe than a material weakness, but is important enough to merit attention by 

those charged with governance. 

12As previously discussed, in March 2014, we updated the actions and outcomes in 

collaboration with DHS to reduce overlap and ensure their continued relevance and 

appropriateness. These updates resulted in a reduction from nine to eight total financial 

management actions and outcomes. 
Strengthening Department of Homeland 

Security Management Functions

Page 369 GAO-17-317 High-Risk Series

Enforcement financial management systems before DHS will be in a 

position to implement modernized solutions for these components and 

their customers.

For example, discovery phase activities to determine the feasibility of 

implementing, deploying, and maintaining the chosen solution are not 

expected to be completed for these two projects until April 2017. Such 

information is essential for determining the implementation schedule 

and finalizing cost estimates that are needed prior to approving the 

projects for implementation. Further, without sound internal controls 

and systems, DHS faces long-term challenges in sustaining a clean 

audit opinion on its financial statements and in obtaining and 

sustaining a clean opinion on its internal controls over financial 

reporting, which are needed to ensure that its financial management 

systems generate reliable, useful, and timely information for day-today decision making as a routine business operation.

• Human capital management. DHS has fully addressed three human 

capital management outcomes, mostly addressed three, and partially 

addressed the remaining one. For example, the Secretary of 

Homeland Security signed a human capital strategic plan in 2011—

which was revised and reissued in 2014—that DHS has since made 

sustained progress in implementing, thereby fully addressing one 

outcome.13 In addition, DHS successfully demonstrated the ability to 

conduct structured workforce planning for the majority of its priority 

mission critical occupations at the department in fiscal year 2015, and 

for all mission critical occupations in fiscal year 2016. To support this 

planning, DHS issued its Workforce Planning Guide in 2015, which 

enabled DHS components to apply a consistent and departmentallyapproved methodology, including the use of standardized tools and 

templates.14 DHS also published and implemented a department-wide 

Employee Engagement Action Plan, which DHS’s components used 

to develop tailored action plans for their own employee engagement 

and outreach.

However, DHS has considerable work ahead to improve employee 

morale. For example, the Office of Personnel Management’s Federal 

Employee Viewpoint Survey data showed that DHS’s scores generally 

declined in four areas (leadership and knowledge management, 

 13DHS, Human Capital Strategic Plan Fiscal Years 2015-2019 (Washington, D.C.: October 

2014). 

14DHS, Office of the Chief Human Capital Officer, DHS Workforce Planning Guide

(Washington, D.C.: July 2015).
Strengthening Department of Homeland 

Security Management Functions

Page 370 GAO-17-317 High-Risk Series

results-oriented performance culture, talent management, and job 

satisfaction) from 2008 through 2015. DHS has developed plans for 

addressing its employee satisfaction problems and improved scores in 

all four areas in 2016, but as we previously recommended, in 

September 2012, DHS needs to continue to improve its root-cause 

analysis efforts related to these plans.15 DHS also needs to continue 

strengthening its learning management capabilities. Specifically, in 

February 2016, we reported that DHS had initiated the Human 

Resources Information Technology (HRIT) investment in 2003 to 

address issues presented by its human resource environment.

With respect to learning management, we found limitations resulting 

from nine disparate learning management systems that did not 

exchange information. DHS established the Performance and 

Learning Management System (PALMS) to consolidate DHS’s nine 

existing systems into one system, and enable comprehensive training 

reporting and analysis across the department, among other things. 

However, in our February 2016 report, we found that selected PALMS 

capabilities had been deployed to DHS headquarters and two 

components, but full implementation at four components was not 

planned, leaving uncertainty about whether PALMS would be used 

enterprise-wide to accomplish these goals. As of September 2016, 

DHS has deployed selected PALMS capabilities to one additional 

component and has plans to implement it at two additional 

components in the first half of fiscal year 2017.

• Management integration. DHS has sustained its progress in fully 

addressing three of the four management integration outcomes, and 

partially addressed the remaining outcome. For example, in January 

2011, DHS issued a comprehensive action plan to guide its 

management integration efforts—the Integrated Strategy. Since then, 

DHS has generally improved the strategy with each updated version 

of its strategy based on feedback we provided. DHS has also shown 

important progress in addressing the last and most significant 

management integration outcome—to implement outcomes in each 

management area to develop consistent or consolidated processes 

and systems within and across its management functional areas. For 

example, the Secretary’s April 2014 Strengthening Departmental 

Unity of Effort memorandum highlighted a number of initiatives 

 15GAO, Department of Homeland Security: Taking Further Action to Better Determine 

Causes of Morale Problems Would Assist in Targeting Action Plans, GAO-12-940 

(Washington D.C.: Sept. 28, 2012).
Strengthening Department of Homeland 

Security Management Functions

Page 371 GAO-17-317 High-Risk Series

designed to allow the department to operate in a more integrated 

fashion.

Further, in support of this effort, in August 2015, the Under Secretary 

for Management identified four integrated priority areas to bring focus 

to strengthening integration among the department’s management 

functions. According to DHS’s August 2016 updated version of its 

strategy, these priorities—which include, for example, strengthening 

resource allocation and reporting reliability and developing and 

deploying secure technology solutions—each include detailed goals, 

objectives, and measurable action plans that are monitored at monthly 

leadership meetings led by senior DHS officials, including the Under 

Secretary for Management. Accomplishments DHS officials attribute 

to the Unity of Effort initiative and integrated priorities initiatives 

include the following, among others:

• DHS’s Office of Program Accountability and Risk Management 

developed and implemented a policy directive to monitor and track 

critical staffing gaps for major acquisition programs to ensure that 

such gaps are identified and remediated in a timely manner.16

• DHS Science and Technology Directorate established Integrated 

Product Teams to better link the department’s research and 

development investments with the department’s operational 

needs.

• DHS strengthened its strategy, planning, programming, budgeting, 

execution, and acquisition processes by improving existing 

structures and creating new ones where needed to build additional 

organizational capability. DHS has institutionalized these reforms 

by issuing a range of departmental management directives and 

instructions.

However, given that these main management integration initiatives 

are in the early stages of implementation and contingent upon DHS 

sustaining implementation plans and efforts over a period of years, it 

is too early to assess their effects. To achieve this outcome, DHS 

needs to continue to demonstrate sustainable progress integrating its 

management functions within and across the department and its 

components, as well as fully address the other 17 outcomes it has not 

yet achieved.

 16DHS, Major Acquisition Program Staffing Management, DHS Policy Directive 102-05 

(Washington, D.C.: June 30, 2016). 
Strengthening Department of Homeland 

Security Management Functions

Page 372 GAO-17-317 High-Risk Series

• In 2016, we recommended, among other things, that DHS (1) update 

the HRIT executive steering committee charter to establish the 

frequency with which HRIT executive steering committee meetings 

are to be held, (2) establish time frames for re-evaluating the strategic 

improvement opportunities and associated projects in the Human 

Capital Segment Architecture Blueprint and determining how to move 

forward with HRIT, and (3) evaluate the strategic improvement 

opportunities and projects within the Human Capital Segment 

Architecture Blueprint to determine whether they and the goals of the 

blueprint are still valid and reflect DHS’s HRIT priorities going forward, 

and update the blueprint accordingly. We reported that HRIT’s limited 

progress was due in part to lack of involvement of its executive 

steering committee and, as a result, key governance activities, such 

as approval of HRIT’s operational plan, were not completed. We 

concluded that until DHS takes actions to reevaluate and manage this 

neglected investment, it was unknown when its human capital 

weaknesses would be addressed. In response, in 2016, DHS 

addressed these three recommendations. As a result, DHS should 

have better assurance that the HRIT executive steering committee will 

meet regularly and carry out its responsibility to provide oversight and 

guidance to the HRIT investment. Further, DHS is better positioned to 

update the blueprint and address inefficiencies in its human resources 

environment, make informed resource decisions on the 

implementation of the strategic improvement opportunities, and 

address inefficiencies in its human resources environment.

• In 2015, we recommended that DHS re-baseline cost, schedule, and 

performance expectations for the remainder of the U.S. Citizenship 

and Immigration Services Transformation Program. We reported that 

the Transformation Program had an increased cost of $1 billion and 

delay of over 4 years from its initial July 2011 baseline, mostly due to 

changes in its acquisition strategy to address various technical 

challenges. These changes significantly delayed the program’s 

planned schedule, which in turn had adverse effects on when the 

program expects to achieve cost savings, operational efficiencies, and 

other benefits. In response, in 2015, DHS addressed this 

recommendation, and the re-baseline helps ensure that progress 

made by the program can be monitored against established and 

approved parameters.

• In 2015 and 2016, DHS addressed four recommendations to help 

ensure consistent, effective oversight of DHS’s acquisition programs. 

DHS (1) directed its Office of Program Accountability and Risk 

Management (PARM) to develop written guidance that defines roles 

and responsibilities of its component leads; (2) directed the Under 

Benefits Achieved By 

Implementing Our 

Recommendations
Strengthening Department of Homeland 

Security Management Functions

Page 373 GAO-17-317 High-Risk Series

Secretary for Management (USM) to develop written guidance to 

clarify roles and responsibilities of PARM and the Office of the Chief 

Information Officer Enterprise Business Management Office for 

conducting oversight of major acquisition programs; (3) directed the 

USM to produce operations and maintenance cost estimates for 

programs in sustainment and establish responsibility for tracking 

sustainment programs’ adherence to those estimates; and (4) directed 

the USM to determine mechanisms to hold programs accountable for 

entering data in the Next Generation Periodic Reporting System 

consistently and accurately, and to hold Component Acquisition 

Executives accountable for validating the information and evaluate the 

root causes of why programs are not using the Next Generation 

Periodic Reporting System as intended. By PARM issuing a handbook 

that provides oversight roles and responsibilities and other guidance 

to PARM component leads, and by the USM and Acting Deputy USM 

issuing multiple memorandums regarding the clarification of 

acquisition oversight roles and responsibilities, the verification and 

certification of the data in designated fields, the verification and 

certification of the data on a biannual basis, and the requirement of 

root cause analyses, DHS is helping ensure consistent and effective 

oversight of its acquisition programs.

• In 2015, we recommended that DHS should ensure the Director of 

Operational Test and Evaluation explicitly address all of the relevant 

key performance parameters in each letter of assessment appraising 

operational test results of DHS’s major acquisitions programs. As a 

result, in 2015, DHS finalized an internal office procedure that 

established that each letter of assessment should provide detailed 

analysis indicating whether or not the key performance parameters 

were met.

• In 2014, we recommended that DHS clearly identify Leader 

Development Program goals and ensure program performance 

measures include key attributes, such as linkage, clarity, and 

measurable targets. As a result, in December 2014, Leader 

Development Program Office officials provided us with updated 

documentation on the program’s assessment approach. This 

documentation established 10 program goals. It also explained how 

the program’s performance measures link to the 10 program goals 

and to department-wide goals. Further, the documentation established 

targets for each performance measure and provided clarification for 

ambiguous measures. These enhancements to the Leader 

Development Program assessment approach should help produce 

actionable information for the program’s management to use in 

identifying the need for, and making, program improvements.
Strengthening Department of Homeland 

Security Management Functions

Page 374 GAO-17-317 High-Risk Series

• In 2013, we recommended that DHS should direct the Office of the 

Chief Human Capital Officer (OCHCO) to require all components to 

provide recruiting cost information in a consistent manner to allow 

better tracking of overall recruiting costs, and use this information to 

assess the extent to which recruiting costs are being reduced by 

components as a result of increased coordination and leveraging 

resources as called for in the Coordinated Recruiting and Outreach 

Strategy. In June 2015, OCHCO provided us with examples of 

recruiting cost information that it has begun tracking in response to 

this recommendation. The data provided demonstrate that OCHCO 

has begun to better track component-level recruiting expenditures in a 

way that illustrates coordination among components, and could be 

used to track reduction in costs stemming from this coordination.

• In 2015, in response to one of our recommendations, DHS developed 

a financial systems modernization transition plan that included the 

tasks, milestones, and time frames for implementing new systems, 

and establishing the optimal sequencing of activities. If effectively 

implemented, the transition plan will help DHS increase its ability to 

effectively manage its financial management system modernization 

efforts. Also, in 2015, DHS developed a financial systems 

modernization transition plan and an updated architecture roadmap 

that collectively describe a target state architecture for DHS financial 

management segment in business terms (e.g., business functions and 

business processes) and technical terms (e.g., account classification 

standards data model, shared services, and federated solution 

approach). These DHS actions have helped improve DHS’s ability to 

ensure the effectiveness of financial management system investment 

decisions.

For additional information about this high-risk area, contact Rebecca 

Gambler (202) 512-8777 or gamblerr@gao.gov.

Homeland Security Acquisitions: Joint Requirements Council’s Initial 

Approach Is Generally Sound and It Is Developing a Process to Inform 

Investment Priorities. GAO-17-171. Washington, D.C.: October 24, 2016.

Homeland Security Acquisitions: DHS Has Strengthened Management, 

but Execution and Affordability Concerns Endure. GAO-16-338SP. 

Washington, D.C.: March 31, 2016.

GAO Contact

Related GAO 

Products
Strengthening Department of Homeland 

Security Management Functions

Page 375 GAO-17-317 High-Risk Series

Department of Homeland Security: Progress Made, but Work Remains in

Strengthening Acquisition and Other Management Functions. 

GAO-16-507T. Washington, D.C.: March 16, 2016.

Homeland Security: Oversight of Neglected Human Resources 

Information Technology Investment Is Needed. GAO-16-253. 

Washington, D.C.: February 11, 2016.

Immigration Benefits System: Better Informed Decision Making Needed 

on Transformation Program. GAO-15-415. Washington, D.C.: May 18, 

2015.

Homeland Security Acquisitions: DHS Should Better Define Oversight 

Roles and Improve Program Reporting to Congress. GAO-15-292. 

Washington, D.C.: March 12, 2015.

Department of Homeland Security: Progress Made, but More Work 

Remains in Strengthening Management Functions. GAO-15-388T. 

Washington, D.C.: February 26, 2015.

DHS Training: Improved Documentation, Resource Tracking, and 

Performance Measurement Could Strengthen Efforts. GAO-14-688. 

Washington, D.C.: September 10, 2014.

DHS Financial Management: Continued Effort Needed to Address 

Internal Control and System Challenges. GAO-14-106T. Washington, 

D.C.: November 15, 2013.

DHS Financial Management: Additional Efforts Needed to Resolve 

Deficiencies in Internal Controls and Financial Management Systems. 

GAO-13-561. Washington, D.C.: September 30, 2013.
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 376 GAO-17-317 High-Risk Series

Technological superiority is critical to U.S. military strategy. Thus, the 

Department of Defense (DOD) spends billions of dollars each year to 

develop and acquire sophisticated technologies to provide an advantage 

for the warfighter during combat or other missions. Many of these 

technologies are also sold or transferred to foreign partners to promote 

U.S. economic, foreign policy, and national security interests. These 

technologies can also be acquired through foreign investment in the U.S. 

companies that develop or manufacture them. In addition, they are 

targets for unauthorized transfer, such as theft, espionage, reverse 

engineering, and illegal export.

To identify and protect technologies critical to U.S. interests, the U.S. 

government has a portfolio of programs. These include export controls—

those developed to regulate exports and ensure that items and 

information are transferred in a manner consistent with U.S. interests—as 

well as a number of non-export control programs, including the Foreign 

Military Sales (FMS) program, anti-tamper measures, and the National 

Industrial Security Program, which oversees government contractors 

handling classified information, including that associated with critical 

technologies. These programs and activities are administered by multiple 

federal agencies with various interests, including DOD and the 

Departments of Commerce, Homeland Security, Justice, State, and the 

Treasury. We designated this area as high risk in 2007 because these 

programs, established decades ago, were ill-equipped to address the 

evolving challenges of balancing national security concerns and 

economic interests. While these agencies are making progress in 

addressing challenges identified by our work, we believe that additional 

leadership and coordination of programs and activities in the non-export 

control programs, among other things, is needed to identify strategic 

reforms that will help to advance U.S. interests.

Ensuring the Effective Protection of 

Technologies Critical to U.S. National 

Security Interests

Why Area Is High 

Risk
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 377 GAO-17-317 High-Risk Series

Since this area was added to the High-Risk List in 2007, our body of work 

in this area has identified progress in the programs designed to protect 

technologies critical to U.S. national security interests, but governmentwide challenges remain, including the need to adopt a more consistent 

leadership approach, improve coordination among programs, address 

weaknesses in individual programs, and implement export control reform.

Hence, we continue to consider each of our high-risk criteria in this area 

to be partially met:

• Leadership commitment to addressing challenges has been evident in 

some areas of the critical technologies portfolio, particularly with 

respect to the Export Control Reform initiative. However, as we 

reported in our 2015 update, greater collaboration among the critical 

technologies programs not directly related to export controls—

including the FMS program, the anti-tamper program, and the 

National Industrial Security Program—could ensure that lead and 

stakeholder agencies take a more consistent approach to meeting 

program goals.

• The capacity for addressing challenges and implementing reforms has 

improved for some programs. However, many efforts remain limited to 

individual programs or activities within the overall program portfolio, 

and there are areas where broader coordination could be beneficial, 

such as determining an appropriate technical reference to inform key 

decisions relating to critical technologies.

• Action plans to guide improvements are in place for some programs; 

however, additional steps have yet to be taken to develop and 

implement action plans that will address ongoing challenges, such as 

administering the anti-tamper program.

• Monitoring of efforts to meet key challenges also has improved at 

some programs. DOD and State have implemented some, but not all, 

of our past recommendations on developing performance measures 

and monitoring program outcomes.

The need for action remains both at the individual program level and the 

portfolio level. We have made a number of recommendations to agencies 

aimed at improving coordination among the programs that are intended to 

protect technologies critical to U.S. national security. We believe that 

implementing these recommendations could result in significant 

improvements. Our body of work shows that challenges remain.

What GAO Found

What Remains to Be 

Done
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 378 GAO-17-317 High-Risk Series

To address existing challenges, we have previously reported that the 

executive branch and Congress should consider reevaluating the wider 

portfolio of programs protecting critical technologies, including assessing 

the prospects for achieving collaboration across separate but related 

programs designed to protect critical technologies. Executive branch 

leadership has been committed to reforming the area of export controls, 

an important step forward. But leadership commitment is less evident in 

the critical technologies programs that fall outside the scope of export 

control reform.

Individual agencies need to continue to implement our recommendations 

to address weaknesses in their respective programs. Doing so could 

increase these programs’ capacity for implementing reforms. For 

example, the export control agencies should work to develop standard 

operating procedures for the Export Enforcement Coordination Center—a 

primary forum within the federal government to coordinate export 

enforcement efforts and identify and resolve conflicts—to facilitate data 

sharing.

Developing a concrete action plan for achieving collaboration across 

separate but related programs designed to protect critical technologies 

remains important. Executive branch leadership has developed a 

thorough action plan for export control reform. But formal and integrated 

planning is less evident in the critical technologies programs that fall 

outside the scope of export control reform.

Individual agencies need to continue to implement our recommendations 

to address weaknesses in their respective programs. Doing so could 

increase these programs’ ability to monitor progress. For example, DOD 

should take additional actions to enhance its ability to provide security 

assistance through, for example, its FMS program by establishing 

performance measures for all phases of the security assistance process.

Across the critical technologies portfolio, steps have been taken 

demonstrating progress, but more remains to be done. For example, 

efforts to develop procedures for coordination between the export 

enforcement community and the intelligence community remain 

incomplete. Similarly, we recommended in January 2013 that the 

Secretary of Defense should determine the best approach to meeting 

Leadership Commitment

Capacity

Action Plan

Monitoring

Demonstrated Progress
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 379 GAO-17-317 High-Risk Series

users’ needs for a technical reference, whether it be the U.S. Munitions 

List or the Industrial Base Technologies List, other alternatives being 

used, or some combination thereof, and ensure that resources are 

coordinated and efficiently devoted to sustain the approach chosen.1

Since our recommendation, DOD officials said the department has moved 

toward using the U.S. Munitions List. However, DOD has not changed its 

policy requiring use of the Militarily Critical Technologies List (MCTL) as it 

has not yet received relief from that statutory requirement.

At the portfolio level, implementing export control reforms demonstrates 

leadership commitment, but the agencies involved in export controls must 

continue to implement reforms to achieve the goals set to protect U.S. 

interests. For non-export control reform, increased collaboration between 

DOD’s offices responsible for administering the FMS program and 

approving exports represents an important step forward in coordinating 

the activities of selected programs. However, leadership still must decide, 

among other things, how to address protection of critical technologies at a 

more strategic level. In particular, in February 2015 we recommended 

that, to ensure a consistent and more collaborative approach to protecting 

critical technologies, the Secretaries of Commerce, Defense, Homeland 

Security, State, and the Treasury as well as the Attorney General of the 

United States—who have lead and stakeholder responsibilities for the 

programs within the critical technologies portfolio—should take steps to 

promote and strengthen collaboration mechanisms among their 

respective programs while they implement and assess ongoing 

initiatives.2 These steps need not be onerous; for example, they could 

include conducting an annual meeting to discuss their programs, 

including the technologies they are protecting, their programs’ intent, and 

any new developments or changes planned for their programs, as well as 

defining consistent critical technologies terminology and sharing important 

updates.

 1

GAO, Protecting Defense Technologies: DOD Assessment Needed to Determine 

Requirement for Critical Technologies List, GAO-13-157 (Washington, D.C.: Jan. 23, 

2013).

2

GAO, Critical Technologies: Agency Initiatives Address Some Weaknesses, but 

Additional Interagency Collaboration Is Needed, GAO-15-288 (Washington, D.C.: Feb. 10, 

2015).
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 380 GAO-17-317 High-Risk Series

Export control reform is being implemented in three phases. Phases I and 

II reconcile various definitions, regulations, and policies for export 

controls. As of August 2015, Phase I was finished. Phase II is nearing 

completion. This is all building toward Phase III, which will result in 

implementation of major changes supported by these reconciliations by 

consolidating export control efforts in four reform areas: creating a single, 

consolidated control list; designating a single licensing agency; 

designating a primary export enforcement coordination agency; and 

establishing a unified information technology system. We reported in 

February 2015 that significant collaboration by the participating agencies 

is essential to the Phase III consolidation efforts.3 In that same report, we 

noted that in order for full implementation of this third and final phase to 

occur, congressional action is needed to designate a single licensing 

agency and a primary export enforcement coordination agency. For 

example, since there are currently separate statutory bases for State and 

Commerce to review and issue export licenses, legislation will be required 

to consolidate the current system into a single licensing agency.

 3

GAO-15-288. 

Congressional Actions 

Needed

Additional Details on 

What GAO Found
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 381 GAO-17-317 High-Risk Series

Some of the issues identified through past reports on export controls 

include poor interagency coordination, inefficiencies in the license 

application process, and a lack of systematic assessments.

This criterion has been met. The Obama administration directed an 

interagency review of the U.S. export control system that resulted in the 

2010 establishment of an Export Control Reform initiative, which has 

continued to demonstrate strong leadership commitment, both from that 

administration and from leaders at the key federal agencies. This initiative 

is under way and actions toward the four key goals of reform—creation of 

a single, consolidated control list, a single licensing agency, a primary 

export enforcement coordination agency, and a unified information 

technology system—have been implemented using a phased approach, 

which we have concluded has the potential to address weaknesses in the 

U.S. export control system.

This criterion has been partially met. As part of export control reform, 

DOD’s USXPORTS system has undergone several enhancements to 

allow it to have the capacity to be the single export licensing database for 

the key agencies responsible for export controls. DOD has worked with 

State and the Department of Commerce (Commerce) to adopt its 

USXPORTS system to improve communication and coordination in the 

export licensing process. Past problems in implementing system 

requirements needed by Commerce have been resolved, and as of 2016, 

Ensuring Protection of 

Critical Technologies -

Export Controls

Leadership Commitment

Capacity
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 382 GAO-17-317 High-Risk Series

the three key export control agencies are using this single system, and 

other agencies, such as Treasury, are working toward joining this system.

However, other efforts under this criterion have yet to be completed. 

Fifteen federal agencies have come together through the establishment of 

the Export Enforcement Coordination Center (the Center), which, 

according to statistics the Center Director provided to us, has heightened 

awareness by exchanging investigation-related information. The Center 

had made good progress in addressing our February 2015 findings that 

export enforcement agencies had poor interagency coordination, but 

remaining efforts have stalled.4 For example, the Center has not yet 

finalized procedures for coordination between the investigative export 

control enforcement and intelligence communities. Center officials cited 

understaffing of interagency personnel as a key barrier, and, in August 

2016, Commerce assigned new staff to the Center to assist in this 

process.

This criterion has been met. The export control reform efforts lay out a 

clear plan of action—consisting of a three-phase framework of agency 

actions to implement reforms to export control lists, licensing, 

enforcement, and information technology—which has the potential to 

improve the efficiency and effectiveness of the export control process.

This criterion has been partially met. We made four recommendations in 

March 2012 that departments with responsibilities for export control 

enforcement take steps to more effectively monitor resources spent on 

export control enforcement activities and develop and implement metrics 

for monitoring their effectiveness.5 As of 2016, one of these 

recommendations has been implemented by Homeland Security, but not 

Justice; a second has been implemented by both Homeland Security and 

Commerce; a third has not been implemented by Homeland Security; and 

a fourth has been implemented by both Commerce and State.

This criterion has been partially met. Some important steps for export 

control reform have been completed. For example, the export control 

licensing agencies have reviewed 17 of the 21 U.S. Munitions List 

categories to determine whether the items in those categories should 

 4

GAO-15-288. 

5

GAO, Export Controls: Proposed Reforms Create Opportunities to Address Enforcement 

Challenges, GAO-12-246 (Washington, D.C.: Mar. 27, 2012). 

Action Plan

Monitoring

Demonstrated Progress
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 383 GAO-17-317 High-Risk Series

remain under State control or move to Commerce control. The goal is to 

move certain less sensitive items from State’s jurisdiction to Commerce’s, 

while leaving high-risk and high-priority items on State’s list. However, 

other key steps, such as implementation of the Center’s procedures for 

coordination with the intelligence communities, remain incomplete.

This criterion has been partially met. For critical technology protection 

programs not related to export controls—such as the FMS program, the 

anti-tamper program, and the National Industrial Security Program—DOD 

has demonstrated increased leadership commitment at the program level; 

however, as we reported in our 2015 update, the overall portfolio of 

programs remains fragmented. For example, DOD leadership has placed 

an increased emphasis on weapon system exportability—ensuring 

technology protections are assessed and designed into a system before 

its potential foreign sale—by issuing policy in 2015 clarifying roles and 

authorities for its anti-tamper program. This policy formalizes authority of 

the Under Secretary of Defense for Acquisition, Technology, and 

Logistics as DOD’s anti-tamper lead and the Secretary of the Air Force as 

the Executive Agent for Anti-Tamper, and articulates their oversight roles 

Ensuring Protection of 

Critical Technologies -

Non-Export Controls

Leadership Commitment
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 384 GAO-17-317 High-Risk Series

for ensuring consistent protection of critical technologies across weapon 

systems and their respective export variants.

The Defense Security Service, which is responsible for administering the 

National Industrial Security Program and overseeing the protection of 

classified information at contractor facilities, has also made leadership 

progress in its technology protection role by beginning implementation of 

an enterprise-wide risk management approach that it expects to allow 

more effective oversight of technology and classified information. In 2016, 

agency officials reported that this approach has improved the overall 

oversight of all contractors by increasing visibility of security management 

issues across the agency’s individual directorates.

This criterion has been partially met. In our 2015 update, we reported that 

DOD had initiated a plan and instituted the capacity for oversight and 

collaboration on those programs related to security cooperation and 

disclosure, and, while DOD has continued to expand these capacities, 

they remain fragmented across the portfolio of programs. For example, 

based on direction in the National Defense Authorization Act for Fiscal 

Year 2011, DOD created a Defense Exportability Features Pilot Program 

to reduce program costs and facilitate export sales for U.S. and foreign 

customers while balancing program protection needs.6 Since it was 

created, this pilot program has funded a limited number of designated 

systems to conduct initial feasibility studies, follow-on studies, and design 

efforts relating to protection of critical information on systems that may be 

candidates for export. Our ongoing work suggests that the pilot program 

has achieved some significant initial successes in helping assure greater 

value and effectiveness in preparing weapon programs for export. DOD 

officials also reported improved collaboration between agencies involved 

in the protection of critical technologies. Specifically, DOD officials 

responsible for administering FMS and export license requests, 

respectively, highlighted areas of increased collaboration, including joint 

briefings to Congress and temporary staff details across their 

organizations.

This criterion has been partially met. In our 2015 update, we reported that 

DOD had established plans for oversight and collaboration on those 

programs related to security cooperation and disclosure. However, 

 6

Pub. L. No. 111-383, § 243. The pilot program was initially set to expire on October 1, 

2015. The National Defense Authorization Act for Fiscal Year 2014 extended the pilot 

program through the end of fiscal year 2020. Pub. L. No. 113-66, § 264.

Capacity

Action Plan
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 385 GAO-17-317 High-Risk Series

significant work remains to be done in this area. Specifically, DOD 

officials said they do not have a strategic plan for administering the antitamper program, and officials also noted that, although technology 

protection is a strategic priority within the department, it was not included 

in a recent presidential transition strategy in terms of performance and 

tracking measures.

This criterion has been partially met. While DOD has made some 

progress in establishing data-driven performance measures and tracking 

them against organizational goals, additional work is needed in some 

areas relating to the transfer of U.S. military equipment to foreign 

governments. For example, in our last update we noted that DOD has not 

implemented our recommendations to improve monitoring of the security 

assistance process for FMS and other security cooperation programs in 

which military equipment is provided directly to foreign governments. 

Since then, one recommendation—from November 2012—that DOD 

establish performance measures to assess the timeliness of the security 

assistance case closure process for FMS and related programs, has been 

implemented, but another—from the same report—calling for DOD to 

establish a performance measure to assess timeliness for the acquisition 

phase of the security assistance process remains unaddressed.7

Additionally, DOD officials responsible for administering the Defense 

Exportability Features Pilot Program said they have not yet developed 

meaningful metrics relating to aspects of the program International 

Cooperation officials would like to measure, such as cost savings and the 

defense industry’s ability to handle increased production to accommodate 

both U.S. and export items.

This criterion has been partially met. While DOD’s actions demonstrate 

increased leadership commitment and capacity for ensuring efficient 

protection of critical technologies, these and other DOD efforts remain 

largely limited in scope, with a focus on individual program areas 

dedicated to the identification and protection of critical technologies, such 

as anti-tamper, the National Industrial Security Program, or FMS. 

Moreover, we reported in 2015 that this portfolio of critical technologies 

programs is fragmented and poorly coordinated across the government, 

and there are still some areas for which coordination across the critical 

technologies portfolio needs improvement and overall direction. For 

 7

GAO, Security Assistance: DOD’s Ongoing Reforms Address Some Challenges, but 

Additional Information Is Needed to Further Enhance Program Management, GAO-13-84 

(Washington, D.C.: Nov. 16, 2012). 

Monitoring

Demonstrated Progress
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 386 GAO-17-317 High-Risk Series

example, we have previously reported that DOD’s MCTL, originally 

developed in response to the Export Administration Act of 1979 in order 

to inform export decisions, is no longer being updated or used by DOD 

officials who provide input on the criticality of technologies as part of 

export license determinations and reviews of foreign acquisition of U.S. 

companies.

We recommended in January 2013 that DOD determine the best 

approach for meeting users’ requirements for a technical reference and 

DOD officials noted that a memorandum is pending final signature that 

would cancel DOD’s policy requiring use of the MCTL.8 In the meantime, 

DOD officials we spoke with in August 2016 highlighted an ongoing effort 

to update the U.S. Munitions List, which is now more widely used in 

security cooperation efforts. Additionally, the Defense Security Service 

maintains a separate list—the Industrial Base Technology List—which is 

used by many DOD entities to characterize threats to information and 

technology and to categorize technology acquisitions.

• In March 2012, we issued a report identifying delays in the license 

determination process, by which agencies confirm whether an item for 

export is controlled and requires a license.9 We recommended that 

Commerce establish timeliness goals for responding to license 

determination requests. According to Commerce, in April 2014, 

Commerce’s Bureau of Industry and Security began implementing the 

license determination module of the Commerce USXPORTS Export 

Support System. This system has enabled them to reduce their 

average processing time for license determinations to around 14 

days, well below Commerce’s internal requirement for processing 

license determinations of 35 days.

• In February 2014, we found that the absence of State Department 

procedures for identifying defense articles eroded confidence that 

State officials were applying recommended end-use monitoring and 

security safeguards on defense equipment.10 We recommended that 

the Secretary of State direct State bureaus transferring equipment to 

 8

GAO-13-157.

9

GAO-12-246.

10GAO, Countering Overseas Threats: DOD and State Need to Address Gaps in 

Monitoring of Security Equipment Transferred to Lebanon, GAO-14-161 (Washington, 

D.C.: Feb. 26, 2014). 

Benefits Achieved by 

Implementing Our 

Recommendations
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 387 GAO-17-317 High-Risk Series

foreign security forces under security-related assistance programs to 

establish formal written procedures to consult with the Directorate of 

Defense Trade Controls to determine if there are additional 

safeguards recommended for the transfer of the defense articles. 

According to State officials, in October 2015, the Department of 

State’s Bureau of International Narcotics Control and Law 

Enforcement Affairs issued new standard operating procedures 

directing end-use monitoring officials to ensure that all U.S. 

government personnel utilize an end-use monitoring defense article 

checklist when conducting inspections.

For additional information about this high-risk area, contact Marie A. Mak 

at (202) 512-4841 or makm@gao.gov.

Critical Technologies: Agency Initiatives Address Some Weaknesses, but 

Additional Interagency Collaboration Is Needed. GAO-15-288. 

Washington, D.C.: February 10, 2015.

Export Controls: NASA Management Action and Improved Oversight 

Needed to Reduce the Risk of Unauthorized Access to Its Technologies. 

GAO-14-315. Washington, D.C.: April 15, 2014.

Countering Overseas Threats: DOD and State Need to Address Gaps in 

Monitoring of Security Equipment Transferred to Lebanon. GAO-14-161. 

Washington, D.C.: February 26, 2014.

Protecting Defense Technologies: DOD Assessment Needed to 

Determine Requirement for Critical Technologies List. GAO-13-157. 

Washington, D.C.: January 23, 2013.

Security Assistance: DOD’s Ongoing Reforms Address Some 

Challenges, but Additional Information Is Needed to Further Enhance 

Program Management. GAO-13-84. Washington, D.C.: November 16, 

2012.

Export Controls: Compliance and Enforcement Activities and 

Congressional Notification Requirements under Country-Based License 

Exemptions. GAO-13-119R. Washington, D.C.: November 16, 2012.

GAO Contact

Related GAO 

Products
Ensuring the Effective Protection of 

Technologies Critical to U.S. National Security 

Interests

Page 388 GAO-17-317 High-Risk Series

Nonproliferation: Agencies Could Improve Information Sharing and EndUse Monitoring on Unmanned Aerial Vehicle Exports. GAO-12-536. 

Washington, D.C.: July 30, 2012.

Export Controls: U.S. Agencies Need to Assess Control List Reform’s 

Impact on Compliance Activities. GAO-12-613. Washington, D.C.: April 

23, 2012.

Export Controls: Proposed Reforms Create Opportunities to Address 

Enforcement Challenges. GAO-12-246. Washington, D.C.: March 27, 

2012.

Export Controls: Agency Actions and Proposed Reform Initiatives May 

Address Previously Identified Weaknesses, but Challenges Remain. 

GAO-11-135R. Washington, D.C.: November 16, 2010.
Improving Federal Oversight of Food Safety

Page 389 GAO-17-317 High-Risk Series

The Department of Health and Human Services (HHS), the U.S. 

Department of Agriculture (USDA), and the Office of Management and 

Budget (OMB) have taken some positive steps since the 2015 high-risk 

update to address fragmentation in the federal food safety oversight 

system. For example, HHS and USDA have continued and expanded 

collaboration on specific food safety issues, and HHS has updated its 

strategic plan to address interagency coordination on food safety. 

However, additional steps are needed to address the system’s 

fragmentation and remove this issue from the High-Risk List.

For more than four decades, we have reported on the fragmented federal 

food safety oversight system, which has caused inconsistent oversight, 

ineffective coordination, and inefficient use of resources. We added 

federal food safety oversight to the High-Risk List in 2007 because of 

risks to the economy, to public health, and to safety.1 A 2011 estimate by 

the Centers for Disease Control and Prevention (CDC)—its most recent 

estimate—indicates that, as a result of foodborne illness, roughly 1 in 6 

Americans (48 million people) gets sick each year, 128,000 are 

hospitalized, and 3,000 die. CDC data also show that the number of 

reported multistate foodborne illness outbreaks is increasing. This is 

notable because although multistate outbreaks make up a small 

proportion of total outbreaks, they affect greater numbers of people. For 

example, according to CDC data, 3 percent of reported outbreaks from

2010 to 2014 were multistate, but these outbreaks were associated with 

11 percent of illnesses, 34 percent of hospitalizations, and 56 percent of 

deaths. CDC cites several potential contributors to the increase in 

reported multistate outbreaks, including greater centralization of food 

processing practices, wider food distribution, and improved detection and 

investigation methods.

Most who get sick from a foodborne illness will recover without any lasting 

effects; however, some individuals may suffer long-term health effects, 

such as kidney failure, chronic arthritis, or nerve damage. For example, 

according to CDC data, each year in the United States an estimated 1.3 

million people are affected by an infection with the foodborne pathogen 

Campylobacter. Of these, approximately 1 in 1,000 develop Guillain-Barré 

syndrome, a disorder in which a person’s immune system attacks the 

body’s own nerves. Researchers have also linked exposure to E. coli, 

Salmonella, and other foodborne pathogens to a long-term risk of 

 1

GAO, High-Risk Series: An Update, GAO-07-310 (Washington, D.C.: January 2007).

Improving Federal Oversight of Food Safety 

Why Area Is High 

Risk
Improving Federal Oversight of Food Safety

Page 390 GAO-17-317 High-Risk Series

developing Crohn’s disease, a chronic inflammatory bowel disease. 

According to a May 2015 estimate from USDA’s Economic Research 

Service, the most common 15 foodborne pathogens together impose an 

economic burden related to foodborne illnesses, hospitalizations, and 

deaths in the United States of over $15.5 billion annually.2 That same 

year, researchers at HHS’s Food and Drug Administration (FDA) 

estimated health costs associated with foodborne illness at about $36 

billion annually.3

In addition to the human health toll, foodborne illness outbreaks can 

impose high costs to industry from food recalls. An October 2011 study 

published by the Grocery Manufacturers Association (GMA), in 

partnership with Covington & Burling LLP and Ernst & Young, estimated 

the cost of food recalls. The study surveyed 36 GMA member companies 

and found that more than half had been affected by a product recall in the 

prior 5 years. For companies that had faced a recall in the past 5 years, 

48 percent estimated the financial impact to be less than $9 million; 29 

percent, from $10 million to $29 million; and 23 percent, $30 million or 

more. Based on the survey results, the four largest costs that companies 

face as a result of a recall are business interruption or lost profits; recall 

execution costs, such as destroying and replacing recalled products; 

liability risk; and company or brand reputation damage.

As we reported in December 2014, three major trends create food safety 

challenges.4 First, a substantial and increasing portion of the U.S. food 

supply is imported, which stretches the federal government’s ability to 

ensure the safety of these foods. Second, consumers are eating more 

raw and minimally processed foods, which in general are more 

susceptible to foodborne pathogens. Third, segments of the population 

that are particularly susceptible to foodborne illnesses, such as older 

adults and immune-compromised individuals, are growing.

 2

Economic burden measures the impact of disease on the welfare of all individuals in a 

society—also referred to as welfare loss. Economists measure the economic burden of a 

disease as the sum of the willingness to pay by all individuals in society to reduce its 

incidence or likelihood.

3

Differences between the estimates may be explained by the number of identified 

pathogens included, whether or not unidentified causes of foodborne illness are included, 

and analytical methods used for developing the estimate.

4

GAO, Federal Food Safety Oversight: Additional Actions Needed to Improve Planning 

and Collaboration, GAO-15-180 (Washington, D.C.: Dec. 18, 2014).
Improving Federal Oversight of Food Safety

Page 391 GAO-17-317 High-Risk Series

The safety and quality of the U.S. food supply, both domestic and 

imported, are governed by a highly complex system stemming from at 

least 30 federal laws that are collectively administered by 16 federal 

agencies. The federal agencies with primary responsibility for food safety 

oversight are USDA’s Food Safety and Inspection Service (FSIS) and 

FDA. FSIS is responsible for the safety of meat, poultry, processed egg 

products, and catfish.5 FDA is responsible for virtually all other food. As 

we reported in May 2016, the federal food safety oversight system is 

supplemented by states, localities, tribes, and territories, which may have 

their own laws and agencies to address the safety and quality of food.6

HHS, USDA, and OMB have taken some positive steps since the 2015 

high-risk update to address fragmentation in the federal food safety 

oversight system—including in relation to crosscutting requirements for 

individual strategic and performance planning documents and 

collaboration on specific food safety issues—but they have not addressed 

our March 2011 recommendation for a government-wide plan and 

Congress has not acted on our December 2014 matters for it to consider 

for government-wide planning and leadership. We continue to believe that 

these actions are important to federal food safety oversight efforts. A 

framework for addressing these actions could be provided through 

development and implementation of a national strategy for food safety 

oversight. Food safety and government performance experts who 

participated in a 2-day meeting that we, with the assistance of the 

National Academies of Sciences, Engineering, and Medicine (National 

Academies), convened in June 2016 stated that there is a compelling 

need for such a strategy to provide a framework for strengthening the 

federal food safety oversight system and addressing fragmentation.7

Developing a national strategy for food safety oversight could also 

provide a framework for addressing our March 2011 recommendation for 

 5

As a result of 2008 Farm Bill provisions amending the Federal Meat Inspection Act, 

regulatory responsibility for catfish inspection fell to FSIS in December 2015, when FSIS 

issued final regulations for a mandatory catfish examination and inspection program. The 

program regulations became effective in March 2016. 80 Fed. Reg. 75,590 (Dec. 2, 2015).

6

GAO, Food Safety: FDA Coordinating with Stakeholders on New Rules but Challenges 

Remain and Greater Tribal Consultation Needed, GAO-16-425 (Washington, D.C.: May 

19, 2016).

7

GAO, Food Safety: A National Strategy Is Needed to Address Fragmentation in Federal 

Oversight, GAO-17-74 (Washington, D.C.: Jan. 13, 2017).

What GAO Found
Improving Federal Oversight of Food Safety

Page 392 GAO-17-317 High-Risk Series

a government-wide plan and our December 2014 matters for Congress to 

consider for government-wide planning and leadership. In addition, 

developing and implementing a national strategy could provide a 

framework for addressing criteria for removing food safety from the HighRisk List. Such a strategy could also include actions consistent with our 

prior suggestion that Congress may wish to assess the need for 

comprehensive, uniform, risk-based food safety legislation or amendment 

of FDA’s and USDA’s existing authorities.

To address capacity constraints for addressing fragmentation in federal 

oversight of food safety and to guide corrective actions and monitor 

progress, Congress should consider directing OMB to develop a 

government-wide performance plan for food safety and formalizing the 

Food Safety Working Group (FSWG) through statute. To provide building 

blocks toward OMB’s development of a government-wide performance 

plan for food safety, USDA should implement our priority recommendation 

to continue building upon its efforts to implement the GPRA 

Modernization Act of 2010 (GPRAMA) requirements to address 

crosscutting food safety efforts in its strategic and performance planning 

documents, which HHS has already done.8 These actions should provide 

federal food safety agencies with vehicles to demonstrate strong 

commitment to, top leadership support for, and progress in implementing 

corrective measures to address fragmentation in federal oversight of food 

safety. These actions could also be addressed through development and 

implementation of a national strategy for food safety oversight, which 

could thereby address criteria for removing food safety oversight from the 

High-Risk List. In addition, such a strategy could include actions 

consistent with our prior suggestion that Congress may wish to assess 

the need for comprehensive, uniform, risk-based food safety legislation or 

amendment of FDA’s and USDA’s existing authorities. If, over the next 

several years, weaknesses in the food safety system persist, Congress 

should also consider commissioning a detailed analysis of alternative 

organizational structures for food safety.

 8

Pub. L. No. 111-352, 124 Stat. 3866 (2011). GPRAMA amended provisions of the 

Government Performance and Results Act of 1993 (GPRA), Pub. L. No. 103-62, 107 Stat. 

285.

What Remains to Be 

Done
Improving Federal Oversight of Food Safety

Page 393 GAO-17-317 High-Risk Series

The criterion of demonstrating commitment to, and top leadership support 

for, addressing fragmentation in federal oversight of food safety has been 

partially met. With the enactment of GPRAMA in January 2011,9

Congress and the executive branch demonstrated strong commitment 

and top leadership support for improving collaboration across the federal 

government. GPRAMA further highlights the need for crosscutting 

strategic and performance planning for issues that involve multiple federal 

agencies and could provide the initial steps toward a government-wide 

performance plan for food safety.

GPRAMA added new requirements for addressing crosscutting efforts in 

federal strategic and performance planning. For example, GPRAMA 

requires agencies to describe in their strategic and performance planning 

documents how they are working with other agencies to achieve their 

goals and objectives. In December 2014, we found that HHS and USDA 

had taken steps to implement GPRAMA’s crosscutting requirements for 

their food safety efforts.10 However, the agencies did not fully address 

crosscutting food safety efforts in their strategic and performance 

planning documents. We recommended that HHS and USDA continue to

build upon their efforts to implement GPRAMA requirements to address 

crosscutting food safety efforts in their strategic and performance 

planning documents. Both agencies agreed with the recommendation.

In response to the recommendation, HHS took steps to update its 

strategic and performance planning documents to better address 

crosscutting food safety efforts. For example, in February 2015, HHS 

updated its strategic plan to more fully describe how it is working with 

other agencies to achieve its food safety-related goals and objectives. As 

a result, we closed the recommendation to HHS as implemented. As of 

January 2017, USDA had not fully implemented our recommendation, 

although it had taken some steps toward doing so. For example, FSIS 

 9

Pub. L. No. 111-352, 124 Stat. 3866 (2011). GPRAMA amended provisions of the 

Government Performance and Results Act of 1993 (GPRA), Pub. L. No. 103-62, 107 Stat. 

285.

10GAO-15-180.

Additional Details on 

What GAO Found

Leadership Commitment
Improving Federal Oversight of Food Safety

Page 394 GAO-17-317 High-Risk Series

included more information on crosscutting food safety efforts in its fiscal 

year 2017-2021 strategic plan and in its draft fiscal year 2017 annual plan 

than it did in its prior strategic and annual plans; USDA planned to include 

information on interagency collaboration in its next strategic plan, 

according to USDA officials.

Fully addressing crosscutting food safety efforts in individual strategic and 

performance planning documents is an important first step toward 

providing a comprehensive picture of the federal government’s

performance in overseeing food safety. However, the agency-by-agency 

focus of individual planning documents alone does not provide the 

integrated perspective on federal food safety performance necessary to 

guide congressional and executive branch decision making and to inform 

the public about what federal agencies are doing to ensure food safety. 

Those individual documents could, however, provide building blocks 

toward the next, more challenging task of developing a single, 

government-wide performance plan for food safety.

The President demonstrated strong commitment and top leadership in 

March 2009, when the President established the FSWG to coordinate 

federal efforts and develop goals to make food safer. In March 2011, we 

indicated that creation of the FSWG was a positive step.11 However, the 

group stopped meeting after about 2 years. In December 2014, we 

reported that, according to senior FDA and FSIS officials and OMB staff, 

the FSWG was no longer needed, given the existence of other 

collaborative mechanisms.12 FDA and FSIS are involved in numerous 

mechanisms to facilitate interagency coordination on food safety; 

however, existing mechanisms focus on specific issues, and none 

provides for broad-based, centralized collaboration. For example, FDA 

and FSIS are collaborating with CDC through the Interagency Food 

Safety Analytics Collaboration to improve estimates of the most common 

sources of foodborne illnesses. However, this and other mechanisms do 

not allow FDA, FSIS, and other agencies to look across their individual 

programs and determine how they all contribute to federal food safety 

goals.

 11GAO, Federal Food Safety Oversight: Food Safety Working Group Is a Positive First 

Step but Governmentwide Planning Is Needed to Address Fragmentation, GAO-11-289 

(Washington, D.C.: Mar. 18, 2011).

12GAO-15-180. 
Improving Federal Oversight of Food Safety

Page 395 GAO-17-317 High-Risk Series

In addition, the FDA Food Safety Modernization Act (FSMA)13—enacted 

in 2011 to amend existing food safety laws—includes numerous 

provisions requiring interagency collaboration, but these too focus on 

specific topics and do not provide for centralized, broad-based 

collaboration across food safety regulations and programs. In December 

2014, we suggested that Congress consider formalizing the FSWG 

through statute to help ensure sustained leadership across food safety 

agencies over time.14

As of January 2017, HHS, USDA, and OMB had taken some positive 

steps since our 2015 high-risk update to address fragmentation in the 

federal food safety oversight system—including continued and expanded 

collaboration on specific food safety issues—but they had not addressed 

our March 2011 recommendation for a government-wide plan and 

Congress had not acted on our December 2014 matters for it to consider 

for government-wide planning and leadership.15 We continue to believe 

that these actions are important to federal food safety oversight efforts. In 

January 2017, however, we also concluded that a framework for 

addressing these actions could be provided through development and 

implementation of a national strategy for food safety oversight.16 Food 

safety and government performance experts who participated in a 2-day 

meeting that we, with the assistance of the National Academies, 

convened in June 2016 stated that there is a compelling need for such a 

strategy to provide a framework for strengthening the federal food safety 

oversight system and addressing fragmentation.

The experts identified stating the purpose, establishing sustained 

leadership, identifying resource requirements, monitoring progress, and 

including actions for gaining traction as key elements that should be 

included in a national strategy for food safety oversight; these elements 

are consistent with characteristics that we have identified as desirable in 

a national strategy. We have found that complex interagency and 

intergovernmental efforts, which could include food safety, can benefit 

from developing a national strategy and establishing a focal point with 

sufficient time, responsibility, authority, and resources to lead the effort. 

 13Pub. L. No. 111-353, 124 Stat. 3885 (2011). 

14GAO-15-180.

15GAO-17-74.

16GAO-17-74.
Improving Federal Oversight of Food Safety

Page 396 GAO-17-317 High-Risk Series

The experts did not specify which entity should lead such a strategy, but 

they emphasized that it should be led by the highest level of the 

administration.

Past efforts to develop high-level strategic planning for food safety have 

depended on leadership from entities within the Executive Office of the 

President (EOP). By developing a national strategy to guide the nation’s 

efforts to improve the federal food safety oversight system and address 

ongoing fragmentation, the appropriate entities within the EOP, in

consultation with relevant federal agencies and other stakeholders, could 

provide a comprehensive framework for considering organizational 

changes and making resource decisions. Experts identified the following 

stakeholders as key contributors to a national strategy for food safety: 

federal, tribal, state, and local government agencies; industry; consumer 

groups; academia; and key congressional committees.

In our January 2017 report, we found that a national strategy for food 

safety, as described by the experts and possessing the desirable 

characteristics identified in our past work, could fulfill the intent behind our 

March 2011 recommendation for a government-wide plan and our 

December 2014 matters for congressional consideration for governmentwide planning and leadership. Such a strategy could include all of the 

elements of a government-wide performance plan for federal food safety 

oversight, such as government-wide goals and performance indicators. In 

addition, we found that, to the extent that such a strategy establishes 

sustained leadership, it could fulfill the intent behind our December 2014 

matter for Congress to consider formalizing the FSWG through statute to 

help ensure sustained leadership across food safety agencies over time. 

We therefore recommended that the appropriate entities within the EOP, 

in consultation with relevant federal agencies and other stakeholders, 

should develop a national strategy that states the purpose of the strategy, 

establishes high-level sustained leadership, identifies resource 

requirements, monitors progress, and identifies short- and long-term 

actions to improve the food safety oversight system. HHS and OMB did 

not comment on our recommendation. USDA disagreed with the need for 

a national strategy but cited factors to consider should changes be 

proposed. Even with USDA’s reservations, we continue to believe that a 

national strategy would provide a comprehensive framework for 

considering organizational changes and resource decisions to improve 

the federal food safety oversight system. It will be up to the stakeholders 

participating in such a strategy to decide which actions to pursue.
Improving Federal Oversight of Food Safety

Page 397 GAO-17-317 High-Risk Series

Among the actions identified by experts at our June 2016 meeting for 

potential inclusion in a national strategy was alignment of FDA’s and

USDA’s existing authorities. For example, several experts mentioned 

modifying the statutes that FSIS implements, such as the Federal Meat 

Inspection Act and the Poultry Improvement Act, to align the authorities of 

USDA with the Federal Food, Drug, and Cosmetic Act, as amended by 

FSMA, which outlines FDA’s responsibilities. This could help ensure a 

consistent approach across food commodities. Such actions would 

comport with our prior suggestion that Congress may wish to assess the 

need for comprehensive, uniform, risk-based food safety legislation or to 

amend FDA’s and USDA’s existing authorities.

Federal food safety agencies have partially met the criterion for capacity 

to address the fragmentation in food safety oversight. USDA and HHS 

have the capacity to more fully address crosscutting food safety efforts in 

their individual strategic and performance planning documents; however, 

OMB action is needed to use those documents as building blocks to 

develop a government-wide performance plan on food safety. Federal 

food safety agencies also have the capacity to participate in a centralized 

collaborative mechanism on food safety—like the FSWG—but 

congressional action would be required to formalize such a mechanism 

through statute. Furthermore, appropriate entities within the EOP have 

the capacity to consult with relevant federal agencies and other 

stakeholders to develop a national strategy for food safety. Doing so 

could address our March 2011 recommendation for a government-wide 

plan and our December 2014 matters for congressional consideration for 

government-wide planning and leadership.

The criterion of having a corrective action plan has not been met. Without 

a government-wide performance plan for food safety, Congress, program 

managers, and other decision makers are hampered in their ability to 

identify agencies and programs addressing similar missions and to set 

priorities, allocate resources, and restructure federal efforts, as needed, 

to achieve long-term goals. Moreover, without a centralized collaborative 

mechanism on food safety—like the FSWG—there is no forum for 

agencies to reach agreement on a set of broad-based food safety goals 

and objectives that could be articulated in a government-wide 

performance plan on food safety. Development and implementation of a 

national strategy for food safety could also fulfill these government-wide 

planning and leadership needs.

Capacity

Action Plan
Improving Federal Oversight of Food Safety

Page 398 GAO-17-317 High-Risk Series

The criterion of having a program to monitor corrective measures has not 

been met. Without a government-wide performance plan for food safety, 

federal food safety efforts are not clear and transparent to the public. 

Currently, to understand what government is doing to ensure the safety of 

the food supply, Congress, program managers, other decision makers, 

and the public must access, attempt to make sense of, and reconcile 

individual documents across the 16 federal agencies responsible for 

administering the more than 30 federal statutes that govern food safety 

and quality. This government-wide planning need could also be 

addressed through a national strategy for food safety.

The criterion of demonstrating progress in implementing corrective 

measures to address fragmentation in federal oversight of food safety has 

been partially met. As noted, HHS, USDA, and OMB took some positive 

steps to address fragmentation in the federal food safety oversight 

system—including in relation to GPRAMA crosscutting requirements and 

collaborative mechanisms on specific food safety issues—but they did not 

address our March 2011 recommendation for a government-wide plan 

and Congress did not act on our December 2014 matters for it to consider 

for government-wide planning and leadership. Development and 

implementation of a national strategy for food safety could fulfill these 

government-wide planning and leadership needs and show sustained 

progress in addressing fragmentation in the federal food safety oversight 

system.

In response to a recommendation we made in December 2014, HHS took 

steps to update its strategic and performance planning documents to 

better address crosscutting food safety efforts.17 For example, in February 

2015, HHS updated its strategic plan to more fully describe how it is 

working with other agencies to achieve its food safety related goals and 

objectives. Among other things, HHS described its collaboration with 

USDA, the Environmental Protection Agency, and others through 

collaborative mechanisms such as the National Antimicrobial Resistance 

Monitoring System, the Partnership for Food Protection, and the Food 

Emergency Response Network. As a result, we closed the 

recommendation to HHS as implemented.

 17GAO-15-180. 

Monitoring

Demonstrated Progress

Benefits Achieved by 

Implementing Our 

Recommendations
Improving Federal Oversight of Food Safety

Page 399 GAO-17-317 High-Risk Series

For additional information about this high-risk area, contact Steve D. 

Morris at (202) 512-3841 or morriss@gao.gov.

Food Safety: A National Strategy Is Needed to Address Fragmentation in 

Federal Oversight. GAO-17-74. Washington, D.C.: January 13, 2017.

Food Safety: FDA Coordinating with Stakeholders on New Rules but 

Challenges Remain and Greater Tribal Consultation Needed. 

GAO-16-425. Washington, D.C.: May 19, 2016.

Federal Food Safety Oversight: Additional Actions Needed to Improve 

Planning and Collaboration. GAO-15-180. Washington, D.C.: December 

18, 2014.

Federal Food Safety Oversight: Food Safety Working Group Is a Positive 

First Step but Governmentwide Planning Is Needed to Address 

Fragmentation. GAO-11-289. Washington, D.C.: March 18, 2011.

High-Risk Series: An Update. GAO-07-310. Washington, D.C.: January 

2007.

GAO Contact

Related GAO 

Products
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 400 GAO-17-317 High-Risk Series

Millions of medical products—drugs, biologics, and medical devices—are 

used daily by Americans at home, in the hospital, and in other health care 

settings. The Food and Drug Administration (FDA) has the vital mission of 

protecting the public health by overseeing the safety and effectiveness of 

these products marketed in the United States. The agency’s 

responsibilities begin long before a product is brought to market and 

continue after FDA approves a product, regardless of whether it is 

manufactured in the United States or abroad.

The importance of FDA’s role in ensuring our citizens’ well-being cannot 

be overstated. In recent years, FDA has been confronted with multiple 

challenges. Rapid changes in science and technology, globalization, 

unpredictable public health crises, an increasing workload, and the 

continuing need to monitor the safety of thousands of marketed medical 

products are among the many challenges with which FDA must routinely 

contend. The oversight of medical products was added to our High-Risk 

List in 2009 because these obstacles threatened to compromise FDA’s 

ability to protect the public health. While progress has been made, we 

have found that some challenges remain and new ones, such as drug 

shortages, have emerged.

In 2015, we found that FDA had made substantial progress in addressing 

some of the concerns we raised in this high-risk area. Specifically, we 

determined that FDA had significantly improved its oversight of medical 

device recalls and the implementation of the Safe Medical Devices Act of 

1990. In recognition of the agency’s significant strides in these two areas, 

we narrowed the scope of our high-risk designation. FDA met all five 

criteria—demonstrating strong leadership commitment, ensuring sufficient 

capacity, developing both specific action plans and effective monitoring 

tools, and demonstrating progress—for having the high-risk designation 

removed for both medical device areas. At that time we also found that 

FDA had action plans in place to help it respond to two remaining issues 

of high importance: the effect of globalization on FDA’s ability to monitor 

medical product manufacturing, and the availability of medically 

necessary drugs. In addition, we reported that the agency’s leadership 

was committed to and supportive of initiatives in these two remaining 

areas. However, the agency’s capacity to address these issues was 

unclear, and the effectiveness of its monitoring and lack of adequate 

progress was a concern. Therefore, FDA’s oversight of medical products 

remained as a high-risk area.

Protecting Public Health through Enhanced 

Oversight of Medical Products

Why Area Is High 

Risk

What GAO Found
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 401 GAO-17-317 High-Risk Series

Since 2015, we have found FDA has made some progress addressing 

our remaining concerns about globalization and drug availability. For 

example, FDA has demonstrated progress in responding to globalization 

by increasing the number of inspections it conducts of foreign 

manufacturing establishments producing drugs for the U.S. market. It has 

also improved the accuracy and completeness of information in its 

catalog of drug manufacturing establishments subject to inspection (which 

we referred to as an “inventory” in previous reports). The availability of 

more reliable data should enhance FDA’s oversight and help FDA apply 

its risk-based model for selecting drug establishments for inspection. FDA 

also has the opportunity to better monitor drug shortages by fully utilizing 

a recently implemented tracking system.

Although these are positive steps, we continue to have concerns in both 

areas. The effectiveness of FDA’s foreign offices, which began opening in 

2008, has not yet been meaningfully assessed. In addition, persistently 

high vacancy rates in these offices suggest that they may lack the 

capacity to robustly monitor the global arena as the agency originally 

envisioned. As of July 2016, 46 percent of FDA foreign offices positions 

were vacant. Moreover, we found that some of the challenges FDA faces 

in recruiting staff to work in these offices are the same as those we 

reported on in 2010 and 2015.

With regard to ensuring drug availability, the way FDA monitors its drug 

shortage information remains a concern. Although it implemented a new 

tracking system—the Shortage Tracker—in March 2016, this is the fourth 

approach to monitoring shortages that the agency has taken in 5 years. 

According to FDA, it routinely enters data into the system, but the agency 

has not yet developed standard reports to help it manage its efforts, nor 

has it made plans to use these data to analyze trends or identify patterns 

to help it predict future shortages. Similarly, we remain concerned about 

the reliability and availability of information that is necessary to monitor 

postmarket drug safety. For example, FDA has not yet fully implemented 

a recommendation we made in 2013 to ensure its databases collect 

reliable and timely data on inspections of certain establishments that 

compound drugs.

In our 2015 high-risk report, we acknowledged the agency’s development 

of an action plan to respond to drug shortages. However, the agency did 

not follow through on its agreement to implement a recommendation we 

made in 2014 to periodically analyze its drug shortage data, and its 

implementation of an earlier recommendation to develop an information 

system to systematically track data about drug shortages, including their 
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 402 GAO-17-317 High-Risk Series

causes, has been inconsistent. These inconsistencies may undermine 

FDA’s action plan and its effectiveness. In addition, in December 2015 

and May 2016, we identified new concerns regarding the agency’s 

collection of reliable data regarding postmarket drug safety and 

shortcomings in its broader strategic planning efforts for drugs and other 

medical products. As a result, we no longer consider that FDA has met 

the criteria associated with having an effective action plan, and are 

therefore changing its rating in this area from met to partially met.

In recent years, Congress has taken actions that have facilitated FDA’s 

ability to address concerns we have identified, and make progress in this 

important high-risk area.

• In July 2013, we reported that FDA’s authority to oversee drug 

compounding was unclear. The Drug Quality and Security Act, 

enacted in November 2013, helped clarify FDA’s authority to oversee 

drug compounding nationally. In November 2016, we reported that 

since the law’s enactment, FDA has issued numerous guidance 

documents related to compounding and conducted more than 300 

inspections of drug compounders. These inspections have resulted in 

actions such as FDA issuing warning letters, which are issued for 

violations of regulatory significance, and recalls voluntarily initiated by 

manufacturers of potentially contaminated drugs.

• The Food and Drug Administration Safety and Innovation Act 

(FDASIA), enacted in July 2012, directed FDA to take a risk-based 

approach to inspecting both foreign and domestic drug manufacturing 

establishments, consistent with our 2008 recommendation. FDA has 

now fully implemented this provision. The number of foreign 

inspections has consistently increased each year since fiscal year 

2009. In fiscal year 2015, FDA conducted more foreign than domestic 

inspections. The agency has also enhanced its risk-based approach 

to prioritizing drug establishments for inspection.

FDA’s oversight of medical products has been on our High-Risk List since 

2009 and has also been considered one of the top 10 management 

challenges identified by the Department of Health and Human Services 

Office of Inspector General for more than a decade. While concerns 

remain, FDA has made progress and, in 2015, we determined that FDA’s 

leadership was committed to addressing our concerns related to both 

globalization and drug availability. In 2015, we also determined FDA had 

developed meaningful action plans to address both globalization and drug 

availability challenges. However, FDA has not sustained this level of effort 

for drug availability activities in the intervening years, and we no longer 

What Remains to Be 

Done
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 403 GAO-17-317 High-Risk Series

consider the agency to meet the criteria for having an effective action 

plan.

In addition to redoubling its efforts to develop—and sustain—an effective 

action plan for both globalization and drug availability, FDA needs to 

demonstrate that it has the capacity to address multiple challenges we 

have identified, along with effective monitoring strategies. For example, it 

needs to fully execute its plan to inspect the many foreign drug 

establishments making drugs for the U.S. market, for which it has no 

inspectional history, over the next 3 years.

Furthermore, FDA should implement our prior recommendations to 

resolve new and previously identified concerns, including the following:

• FDA should assess the effectiveness of the foreign offices’

contributions, by systematically tracking information to measure 

whether the offices’ activities specifically contribute to drug safetyrelated outcomes, such as inspections, import alerts, and warning 

letters.

• FDA should establish goals to achieve the appropriate staffing level 

for its foreign offices.

• FDA should routinely use its new Shortage Tracker and conduct 

periodic analyses to systematically assess drug shortage information 

to proactively identify risk factors for potential drug shortages.

• FDA should develop comprehensive plans, including goals and time 

frames, to correct problems with its postmarket safety data and 

ensure that these data can be easily used for oversight.

• FDA should consistently collect reliable and timely information in 

FDA’s databases on inspections and enforcement actions associated 

with compounded drugs.
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 404 GAO-17-317 High-Risk Series

FDA has met this criterion. In 2015, we noted FDA showed leadership 

commitment to this area by creating an office dedicated to confronting the 

challenges of globalization and helping prepare the agency to move from 

regulating domestic products to overseeing a worldwide market. The 

agency’s leadership commitment was made further evident by its 

strategic priorities for fiscal years 2014 through 2018, which discuss its 

goal of expanding its regulatory presence and partnerships overseas.

FDA has partially met this criterion. We have had longstanding concerns 

with the agency’s capacity to respond to globalization. Its magnitude and 

rapid pace has complicated FDA’s efforts to ensure that the medical 

products marketed in the United States are of high quality. Many of the 

medical products Americans use on a daily basis are manufactured 

overseas. FDA estimates that approximately 80 percent of active 

pharmaceutical ingredients—the key ingredients in the drugs we take—

along with nearly 40 percent of finished drugs and 50 percent of medical 

devices are manufactured in more than 150 countries. China and India 

have both significantly increased their production of medical products in 

recent years. India now has more drug manufacturing establishments 

Additional Details on 

What GAO Found

Response to Globalization

Leadership Commitment

Capacity
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 405 GAO-17-317 High-Risk Series

producing drugs for the U.S. market than any other country, followed 

closely by China. While globalization brings benefits, it also carries risks, 

as some of these countries have regulatory systems less sophisticated 

than our own. This global marketplace has placed greater pressure on 

FDA to oversee the safety and effectiveness of all medical products 

marketed in the United States, regardless of where they are produced.

In 2008, we reported that FDA inspected relatively few foreign drug 

manufacturing establishments each year. We also pointed out that FDA 

had not used its risk-based process to select foreign establishments for 

inspection to the extent it had for selecting domestic establishments. Two 

years later, in 2010, we reported FDA had increased the number of 

foreign drug inspections it conducted, but that it still conducted relatively 

fewer foreign drug inspections. However, since 2009, FDA has enhanced 

its capacity to conduct inspections and has increased the number of 

foreign establishments it inspects each year. In fiscal year 2015, FDA 

conducted more foreign than domestic inspections. Establishments in 

China and India were inspected by FDA more than those in other foreign 

countries.

More recently, we have questioned the effectiveness of FDA’s foreign 

offices, which are overseen by its Office of International Programs (OIP). 

FDA began opening these offices in 2008 to obtain better information on 

products coming from overseas. Among other things, these offices help 

FDA build partnerships with its regulatory counterparts and industry 

members overseas, and help certain countries improve their regulatory 

capacities. Staff in these offices also inspect foreign establishments, 

gather intelligence, and foster information sharing with FDA headquarters. 

In December 2016, we reported that, while foreign office staff have 

inspected drug establishments overseas, they have conducted relatively 

few such inspections and may not have the capacity to do more. Most 

inspections of foreign drug establishments have been conducted by 

FDA’s domestically-based staff. Foreign office staff have conducted 5 

percent of these inspections since fiscal year 2010.

Further, the persistently high vacancy rates in these offices suggest that 

they may lack the capacity to robustly assist FDA and monitor the global 

arena, as the agency originally envisioned. As of July 2016, 46 percent of 

the offices’ positions were vacant, up slightly from 44 percent in October 

2014. Moreover, we found that FDA still faces some of the challenges of 

recruiting staff to work in these offices that we identified in 2010 and 

2015.
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 406 GAO-17-317 High-Risk Series

Although FDA recently finalized a strategic workforce plan, as we 

recommended in 2010, we have identified several weaknesses in it. For 

example, the plan does not target vacancies by specific position types. 

While FDA recognizes its vacancy rate in its foreign offices is high and 

has set a goal of reducing this rate, the measure it has developed targets 

all of the staff in OIP, including those who are domestically-based. Thus, 

FDA could increase the number of domestically-based staff in OIP and 

fulfill its goal without reducing vacancies in its foreign offices. We remain 

concerned that, without targeting the foreign offices specifically or the 

types of positions most likely to have vacancies, FDA will not have a 

meaningful measure reflecting its true staffing needs overseas. In 

December 2016, we recommended that FDA establish goals to achieve 

the appropriate staffing levels for its foreign offices, which would include 

separating foreign office vacancies from the OIP-wide vacancy rate and 

setting goals by position type. We believe such actions are needed in 

order for FDA to demonstrate progress and help ensure that its foreign 

offices have the capacity to monitor conditions abroad and meaningfully 

contribute to drug safety. FDA said it is taking immediate steps to address 

this recommendation.

FDA has met this criterion. In 2015, we recognized that FDA had 

developed an action plan for building a stronger, more secure global 

product safety net. In addition, we noted that FDA developed plans to 

partner with foreign regulatory authorities to leverage resources through 

increased information sharing following the enactment of FDASIA in 

2012, which increased FDA’s ability to strengthen its efforts in this area. 

FDASIA also reinforced our 2008 recommendation that the agency 

should take a risk-based approach to selecting both foreign and domestic 

drug manufacturing establishments for inspection, which helped FDA 

develop plans to prioritize its drug inspections.

FDA has partially met this criterion. We have been critical of FDA’s 

internal monitoring of its drug inspection program since as early as 1998, 

when we reported that the agency’s own internal evaluations concluded 

that it did not have a comprehensive data management system to monitor 

foreign manufacturers. The evaluations concluded that unless corrected, 

problems in FDA’s foreign inspection program could allow adulterated 

and low-quality drugs to be imported, posing serious health risks to 

Americans. Although the agency was aware of this problem, we found 

that similar problems persisted in 2008 and 2010, which affected the 

agency’s ability to manage the foreign drug inspection program.

Action Plan

Monitoring
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 407 GAO-17-317 High-Risk Series

FDA has recently taken steps to better monitor its drug inspection 

program. In December 2016, we reported that FDA formalized its process 

for developing, evaluating, and documenting key decisions about the riskbased model that it will use to select drug establishments to inspect each 

year. FDA previously lacked a process for tracking revisions to its model 

and, as a result, officials were unable to recall or explain all the changes 

to the model over time. FDA’s documentation will now chronicle decisions 

made regarding which factors were included in the model in a particular 

year, according to officials. FDA officials also said that our prior reviews 

reinforced the need for written procedures.

FDA has also taken steps to improve the accuracy and completeness of 

the information it uses to manage its foreign drug inspection program. 

The databases that FDA was using to select establishments to inspect did 

not contain accurate information on the number of establishments 

manufacturing drugs for the U.S. market, as we reported in 2008. Two 

years later, in 2010, we also found that 64 percent of the foreign 

establishments in FDA’s catalog may have never been inspected, almost 

half of which were in China and India. To help the agency manage its 

catalog of data, FDA established a data governance board in May 2015 to 

define standards, best practices, and policies, on which FDA’s oversight 

depends, including the veracity of its risk-based site selection model. FDA 

officials said the board has developed guidance for merging data 

processes and is working toward defining data metrics to determine 

whether they have improved on their reporting. The board has also 

defined data standards for storing key attributes of establishments, such 

as companies’ names, and continues to examine best practices for 

sharing establishment data across FDA.

This action has helped FDA reduce the number of establishments in its 

catalog that may never have had a surveillance inspection. Currently, 

FDA lacks information on the inspection history of 33 percent of the 

foreign establishments in its catalog, compared to the 64 percent for 

which it lacked inspection history in 2010. While the agency has made 

progress in reducing this knowledge gap, it is important to note that the 

overall number of foreign establishments with no surveillance inspection 

history remains large, with about 1,000 of the approximately 3,000 in its 

catalog of establishments with no inspection history. To address this 

persistent concern, the agency plans to inspect all establishments in its 

catalog with no prior surveillance inspection history over the next 3 years 

(approximately one-third each year), beginning in fiscal year 2017.
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 408 GAO-17-317 High-Risk Series

In addition, FDA has not sufficiently monitored the contributions of its 

foreign offices or meaningfully assessed their effectiveness. While these 

offices engage in collaborative activities with foreign stakeholders, FDA 

does not systematically track how information collected by the offices has 

contributed to drug safety. The agency has been considering the best 

approach to assessing the future needs of its foreign offices and 

measuring their performance. In 2014 and 2015, FDA’s Office of Planning 

compiled detailed information about their operations, including their 

workforce composition.

More recently, in July 2016, FDA’s Office of Planning completed an 

internal evaluation to develop an evidence-based, collaborative, and 

repeatable process to select foreign post locations, considering the 

effects of cost, legislation, and program alignment on FDA foreign post 

operations, and the appropriate mix of FDA staffing at the posts. This 

evaluation proposed a process for determining the correct mix of staffing 

and position types for the foreign offices. The results of this evaluation 

suggest that the foreign offices would benefit from strategically aligning 

their operational activities and desired public health impacts. However, 

OIP has yet to implement and apply the process to the foreign offices. In 

December 2016, we recommended that FDA assess the effectiveness of 

the foreign offices’ contributions, which would require systematically 

tracking information to measure whether the offices’ activities specifically 

contribute to drug safety-related outcomes. FDA said it is taking 

immediate steps to address this recommendation.

FDA has partially met this criterion. Since 2015, FDA has taken a variety 

of steps to respond to globalization and has made progress in meeting 

this challenge. For example, FDA has

• strengthened its monitoring of foreign drug establishments by 

improving the accuracy and completeness of information used to 

develop its catalog of drug manufacturing establishments subject to 

inspection. The availability of more reliable data should enhance 

FDA’s monitoring and oversight while helping it apply its risk-based 

model for prioritizing drug establishments for inspection.

• taken a risk-based approach to inspecting both foreign and domestic 

drug manufacturing establishments, in accordance with a directive in 

FDASIA and consistent with our 2008 recommendation.

• formalized its process for prioritizing the establishments it inspects to 

determine compliance with good manufacturing requirements, based 

on certain risk factors specified by FDASIA.

Demonstrated Progress
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 409 GAO-17-317 High-Risk Series

• decided that, starting in fiscal year 2017, the agency will allow no 

more than 5 years to elapse between inspections at a specific 

establishment.

Yet, FDA still faces challenges overseeing the global marketplace and 

must continue to demonstrate progress in conducting more inspections of 

foreign establishments. There remain a large number of foreign 

establishments making drugs for the U.S. market—almost 1,000—that 

may never have been inspected.

Over the last decade, prescription drugs—including those that are lifesaving and life-sustaining—have been in short supply, preventing health 

care providers and patients from accessing medications that are essential 

for treatment. Those in shortage have included essential therapies, such 

as anesthetic, anti-infective, cardiovascular, nutritive, and oncology drugs. 

Although the number of new shortages reported each year has generally 

decreased since 2011, the number of ongoing shortages—those that 

began in prior years—have remained high. Since 2013, the majority of the 

ongoing shortages in a given year were first reported at least 2 years 

earlier. We have issued several reports on this topic since 2011 and 

made recommendations to enhance the agency’s ability to respond and 

oversee shortages. FDA has since implemented some of these 

recommendations.

FDA has met this criterion by demonstrating leadership commitment to 

responding to drug shortages, which we recognized in 2015. Its strategic 

priorities for fiscal years 2014 through 2018 emphasize its continued 

commitment to responding to shortages. FDASIA also required FDA to 

issue a strategic plan to enhance the agency’s ability to prevent and 

mitigate shortages. FDA issued this strategic plan in October 2013.

FDA has partially met this criterion. For example, we recommended that 

FDA assess how it allocates its resources to improve the agency’s 

capacity to respond to drug shortages. FDA has done so and increased 

the number of personnel devoted to shortages as of 2013. In 2014, we 

Drug Availability

Leadership Commitment

Capacity
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 410 GAO-17-317 High-Risk Series

found that, while shortages persisted, FDA had prevented more potential 

shortages than it had in the prior 2 years by, for example, working with 

manufacturers to increase production. More recently, in 2016, we 

reported that FDA prioritized its review of nearly 400 applications to 

market generic drugs (or supplements to existing approved new or 

generic drug applications) to address shortages from January 2010 

through July 2014. We analyzed a subset of those submissions and found 

that some were approved before the shortage was prevented or resolved. 

Although the timing of FDA’s approvals of submissions could not be 

directly linked to the resolution of particular shortages, we believe that 

prioritizing reviews may be a useful strategy in addressing some drug 

shortages. Despite the agency efforts, shortages persist and we 

recognize that FDA cannot resolve this concern alone. Nonetheless, there 

is more FDA could do. For example, given that the median time to 

approve prioritized generic drug applications is over a year, this approach 

is generally not a strategy for addressing shortages in the short term. In 

addition, FDA’s ability to manage risk-based decisions and proactively 

help prevent and resolve shortages may be hindered because it does not 

routinely analyze the data it collects.

FDA now partially meets this criterion. In 2015, we rated FDA as meeting 

this criterion. However, we are changing this rating to partially meets due 

to shortcomings that we identified in recent reports, as discussed below.

In order to protect public health, FDA works to ensure the availability of 

medically necessary drugs and the safety of the drug supply. In our 2015 

high-risk report, we credited FDA for having an action plan that focuses 

on its capacity to respond when alerted to supply disruptions and on 

developing long-term prevention strategies to address the causes 

underlying supply disruptions. However, more recently we have identified 

several concerns with the agency’s readiness and plans to collect, track, 

and analyze data related to drug shortages and postmarket drug safety. 

We have also reported on shortcomings in its broader strategic planning 

efforts related to drugs and other medical products. We no longer 

consider that FDA has met the criteria associated with having an effective 

action plan.

In 2011, we recommended that FDA develop an information system to 

enable the agency to manage its daily workload in a systematic manner, 

track data about drug shortages—including their causes and FDA’s 

responses—and share information across FDA offices regarding drugs 

that are in short supply. Later, in 2014, we went a step further by 

recommending that FDA periodically analyze its drug shortages data to 

Action Plan
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 411 GAO-17-317 High-Risk Series

routinely and systematically assess this information, and use it proactively 

to identify risk factors for potential drug shortages. FDA’s response to 

these two recommendations has been mixed and an action plan has not 

been fully developed to implement these recommendations.

In 2011, FDA relied on e-mail status reports to track shortages. Later that 

year it began using an electronic spreadsheet, which was replaced by a 

drug shortage database in 2012. A new drug shortage data system 

followed in 2014. But FDA’s planning did not result in a smooth transition 

from one system to another. FDA suspended its use of the drug shortage 

database at the end of 2013 while it was developing the more robust drug 

shortage data system. The transition to the new data system took longer 

than anticipated and FDA documented limited information about 

shortages using manual logs during an extended period in 2014. FDA 

began using its new data system in late 2014, and information on new 

and active shortages in 2014 was entered retroactively into this system. 

However, that system is no longer in use and FDA has now adopted an 

even newer system—its fourth approach to monitoring shortages in 5 

years. The Shortage Tracker was implemented in March 2016. While it 

appears promising, FDA officials said it has been populated with data 

going back to January 2015 only, precluding the agency from easily 

conducting extensive analyses of trends prior to that date. Moreover, the 

agency has not yet made plans to use these data to analyze trends or 

identify patterns to help it predict future shortages, nor has it developed 

standard reports to assist with managing its efforts.

Similar to our concerns with FDA’s drug shortage data, the reliability and 

availability of information that is necessary to monitor postmarket drug 

safety is limited. FDA lacks an action plan to address these issues. For 

example, in July 2013 we reported that FDA lacks timely and reliable 

information to oversee the entities that compound drugs, including timely, 

reliable information on the findings of inspections of these entities. FDA’s 

inspection database did not always distinguish compounding pharmacies 

from manufacturers of human or veterinary drugs. In addition, its 

database did not consistently reflect the agency’s final determination of 

an individual inspection’s results. We also found that the agency lacked 

reliable data to make decisions to prioritize its inspections of such 

pharmacies and other follow-up and enforcement actions. We 

recommended that FDA ensure its databases collect reliable and timely 

data on inspections of certain establishments that compound drugs, but 

the agency has not yet fully implemented this recommendation, which 

would improve its monitoring.
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 412 GAO-17-317 High-Risk Series

Similarly, in December 2015, we found that FDA lacks reliable, readily 

accessible data on tracked safety issues and postmarket studies needed 

to meet certain postmarket safety reporting responsibilities, and to 

conduct systematic oversight. Tracked safety issues are potential safety 

issues that FDA determines are significant and that it tracks using an 

internal database. However, FDA’s evaluations of its database revealed 

problems with the completeness, timeliness, and accuracy of the data. 

For example, data on tracked safety issues were incomplete, postmarket 

study data were outdated and contained inaccuracies, and tracked safety 

issue and postmarket study data were not readily accessible to FDA staff 

for analysis. These problems, as well as problems with the way data are 

recorded that impair their accessibility, have prevented FDA from 

publishing statutorily required reports on certain potential safety issues 

and postmarket studies in a timely manner, and have restricted the 

agency’s ability to perform systematic oversight of postmarket drug 

safety.

FDA has demonstrated some progress in addressing the problems with 

its data. However, the agency lacks plans that comprehensively outline its 

efforts and establish related goals and time frames. We recommended 

that FDA develop plans to correct problems with its postmarket safety 

data and ensure that these data can be easily used for oversight. While 

FDA recognized the challenges with its ability to track safety issues and 

has begun some efforts to improve its data, the agency has not provided 

comprehensive plans, with goals and time frames, to help ensure that 

FDA corrects the identified problems with its database on safety issues 

and postmarket studies.

In addition to our concerns about FDA’s action plan to improve its 

oversight capabilities, we recently identified shortcomings in the agency’s 

broader strategic planning efforts. In May 2016, we reported that FDA’s 

strategic integrated management plan for its three centers that oversee 

medical products (biologics, drugs, and medical devices) does not 

incorporate leading practices for strategic planning or document a 

comprehensive long-term strategy for the centers. For example, the plan 

presents high-level information on goals and performance measures for 

medical product oversight, but lacks detail on how it will be used or 

implemented. Furthermore, while the plan states that it reflects 

coordination and cooperation among the medical product centers to 

address their program-specific needs, share best practices, and share 

common solutions, FDA officials acknowledged that they do not use the 

plan to address issues requiring center collaboration, and acknowledged 

that the plan did not represent the full range of working relationships 
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 413 GAO-17-317 High-Risk Series

among the centers. Moreover, the strategic integrated management plan 

does not fully link its performance goals to its general goals and 

objectives.

We also found in May 2016 that FDA lacks measurable goals to assess 

its progress in advancing regulatory science—the science supporting its 

effort to assess the products it regulates. Although the agency issued 

strategic planning documents in 2011 and 2013 to guide its regulatory 

science efforts and identify priority areas for conducting work, these 

documents do not specify the targets and time frames necessary for the 

agency to measure progress overall or within each of the eight priority 

areas related to medical products. According to leading practices for 

strategic planning, identifying and using consistent measurable goals in 

planning and progress documents is important to assessing 

effectiveness. While FDA cited examples of its achievements in 

regulatory science in a 2015 report, it cannot assess how those 

achievements constitute progress towards its goals. In addition, FDA 

lacks information about how funding targeted at regulatory science is 

distributed across the priority areas. Decisions to award these funds are 

made by individual FDA centers and offices, which generally did not 

collect information on the associated priority areas of funded projects. 

Rather, FDA retrospectively identified these areas for the purpose of our 

review. The lack of consistent information limits FDA’s ability to examine 

obligations across, or progress within, specific priority areas. 

Furthermore, multiple centers or offices fund projects toward a given 

priority area and leading practices for strategic planning encourage 

agencies to manage efforts that cut across the agency.

Given the totality of our concerns, which range from needing action plans 

to address specific weaknesses we have identified to the agency’s overall 

strategic planning, we no longer consider that FDA has met the criteria 

associated with having an effective action plan. This criterion requires that 

a corrective action plan exist that defines the root cause, identifies 

solutions, and explains how an agency will substantially complete 

corrective measures, including steps necessary to implement solutions

we recommended. We are therefore changing FDA’s action plan rating in 

this area, as well as its overall rating, from met to partially met.

FDA has partially met this criterion and we remain concerned about the 

extent of the agency’s monitoring efforts. FDA officials said they have not 

yet developed standard reports to help the agency manage its efforts, nor 

has the agency implemented our 2014 recommendation to periodically 

analyze its drug shortages data to analyze trends or identify patterns to

Monitoring
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 414 GAO-17-317 High-Risk Series

help it predict future shortages. While the drug shortage staff said that 

FDA’s Office of Pharmaceutical Quality will be interested in using data to 

conduct rigorous analyses for predicting shortages and risk factors, the 

drug shortage staff have not provided reports to any FDA components, 

raising questions about the agency’s commitment to conducting such 

analyses and leaving this recommendation unimplemented.

We are also concerned that the annual reports FDA has issued to 

Congress on drug shortages have been limited, with no report providing 

data for more than a 9-month period. This annual report, which is required 

by FDASIA, is due no later than the end of the calendar year. FDA staff 

explained to us that it is not possible to issue a report containing 12

months of calendar year data by December 31, and they therefore report 

data from the first 9 months. However, FDA has not met the December 31 

deadline, with publication dates ranging from February 5 through April 17. 

Given that the agency has never met its publication deadline, we believe 

it would be more helpful that policymakers receive a full year’s worth of 

data—such as data covering the federal fiscal year (October 1 through 

September 30)—so they could more closely monitor shortage information 

themselves and obtain a more realistic view of this serious public health 

problem.

FDA has partially met this criterion by taking actions in recent years. FDA 

has implemented some of our recommendations, including one we made 

in 2014 regarding the need for the agency to develop policies and 

procedures for its drug shortages information management system, now 

known as the Shortage Tracker. These policies and procedures should 

help ensure information is entered into the Shortage Tracker consistently 

and accurately. FDA has assessed how it allocates its resources to 

improve the agency’s capacity to respond to drug shortages and 

increased the number of personnel devoted to shortages, as we 

recommended in 2011. In addition, FDA elevated the office of its drug 

shortage staff to a more prominent position in the agency and assigned 

drug shortage coordinators in each of its 20 district offices to help bring 

drug shortage-related concerns to light earlier, such as inspections citing 

violations of good manufacturing practices at establishments producing a 

large volume of drugs. And as we recommended in 2011, FDA has issued 

a strategic plan to enhance the agency’s ability to prevent and mitigate 

shortages, and also developed results-oriented performance metrics that 

can help evaluate program performance.

FDA has demonstrated some progress in this area, but drug shortages 

remain a serious public health concern and there is more FDA can do, 

Demonstrated Progress
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 415 GAO-17-317 High-Risk Series

including fully addressing the recommendations we made in 2011 and 

2014. While FDA developed the new Shortage Tracker in March 2016—

its fourth approach to monitoring shortages in the last 5 years—it needs 

to use this system consistently and share information across FDA offices 

regarding drugs that are in short supply. FDA also needs to periodically 

analyze this information to proactively identify risk factors for potential 

drug shortages early, thereby potentially helping FDA to recognize trends, 

clarify causes, and resolve problems before drugs go into short supply.

• FDA is now conducting more inspections of foreign manufacturing 

establishments producing drugs for the U.S. market, and is taking a 

risk-based approach by combining foreign and domestic 

establishments into a single list to prioritize establishments for 

inspection.

• FDA has improved the accuracy and completeness of information in 

its catalog of drug manufacturing establishments subject to inspection.

• FDA has developed a new drug shortage tracking system.

For additional information about this high-risk area, contact Marcia 

Crosse at 202-512-7114 or crossem@gao.gov

Drug Safety: FDA Has Improved Its Foreign Drug Inspection Program, but 

Needs to Assess the Effectiveness and Staffing of Its Foreign Offices. 

GAO-17-143. Washington, D.C.: December 16, 2016.

Drug Compounding: FDA Has Taken Steps to Implement Compounding 

Law, but Some States and Stakeholders Reported Challenges. 

GAO-17-64. Washington, D.C.: November 17, 2016.

Drug Shortages: Certain Factors Are Strongly Associated with This 

Persistent Public Health Challenge. GAO-16-595. Washington, D.C.: July 

7, 2016.

Food and Drug Administration: Comprehensive Strategic Planning 

Needed to Enhance Coordination between Medical Product Centers. 

GAO-16-500. Washington, D.C.: May 16, 2016.

Medical Product Oversight: FDA Needs More Strategic Planning to Guide 

Its Scientific Initiatives. GAO-16-432. Washington, D.C.: May 16, 2016

Benefits Achieved by 

Implementing Our 

Recommendations

GAO Contact

Related GAO 

Products
Protecting Public Health through Enhanced 

Oversight of Medical Products

Page 416 GAO-17-317 High-Risk Series

Drug Safety: FDA Expedites Many Applications, But Data for 

Postapproval Oversight Need Improvement. GAO-16-192. Washington, 

D.C.: December 15, 2015.

Drug Shortages: Better Management of the Quota Process for Controlled 

Substances Needed; Coordination between DEA and FDA Should Be 

Improved. GAO-15-202. Washington, D.C.: February 2, 2015.

Drug Shortages: Public Health Threat Continues, Despite Efforts to Help 

Ensure Product Availability. GAO-14-194. Washington, D.C.: February 

10, 2014.

Drug Compounding: Clear Authority and More Reliable Data Needed to 

Strengthen FDA Oversight. GAO-13-702. Washington, D.C.: July 31, 

2013.

Drug Shortages: FDA’s Ability to Respond Should Be Strengthened. 

GAO-12-116. Washington, D.C.: November 21, 2011.
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 417 GAO-17-317 High-Risk Series

The Environmental Protection Agency’s (EPA) ability to effectively 

implement its mission of protecting public health and the environment is 

critically dependent on assessing the risks posed by chemicals in a 

credible and timely manner. Such assessments are the cornerstone of 

scientifically sound environmental decisions, policies, and regulations 

under a variety of statutes, such as the Safe Drinking Water Act, the 

Toxic Substances Control Act (TSCA), and the Clean Air Act. EPA 

conducts assessments of chemicals under its Integrated Risk Information 

System (IRIS) program. EPA is also authorized under TSCA to obtain 

information on the risks of chemicals and to control those the agency 

determines pose an unreasonable risk. Because EPA had not developed 

sufficient chemical assessment information under these programs to limit 

exposure to many chemicals that may pose substantial health risks, we 

added this issue to the High-Risk List in 2009 as a government program 

in need of broad-based transformation. The Frank R. Lautenberg 

Chemical Safety for the 21st Century Act, enacted on June 22, 2016, 

provides EPA with greater authority to address chemical risks, but 

implementing it will take time.

EPA has again met the criteria for leadership commitment, and its former 

administrator and top leadership publicly stated their focus on improving 

the IRIS program and implementing the 2016 TSCA reform legislation 

through its TSCA program. The agency has begun to align people and 

resources to address the current and future workload of these programs. 

For the IRIS program, EPA has partially met the criteria for capacity, an 

improvement over its previous rating, in part because it issued an IRIS 

Multi-Year Agenda in December 2015 that focused on the need for IRIS 

assessments over the next few years. EPA has again not met the criteria 

for capacity for its TSCA program, and with new TSCA authority, it is 

unclear if EPA has the people and resources to implement the new law. 

Overall, EPA needs to continue to determine for both the IRIS and TSCA 

programs if it has adequate capacity to resolve this high-risk area. EPA 

needs to work with Congress to ensure that the resources dedicated to 

IRIS and TSCA activities are sufficient to maintain a viable IRIS database 

of chemical assessments, and effectively implement TSCA reform 

activities. EPA has partially met the criteria for having a corrective action 

plan by issuing an IRIS Multi-Year Agenda. EPA has also partially met the 

criteria for having a corrective action plan by increasing its efforts to 

obtain chemical toxicity and exposure data, initiating chemical risk 

assessments, and reviewing certain new uses of chemicals, but it is too 

early to tell whether these actions will reduce chemical risks. EPA needs 

Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Why Area Is High 

Risk

What GAO Found
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 418 GAO-17-317 High-Risk Series

to continue to implement the TSCA reform legislation and define how it 

will implement corrective actions to assess and control toxic chemicals.

EPA has now met the criteria for monitoring the IRIS program by finalizing 

the IRIS Multi-Year Agenda and other actions, including continuing to 

submit IRIS assessments for independent review to entities with scientific 

and technical credibility. EPA has not met the criteria for monitoring the 

TSCA program; to help ensure that the resources dedicated to TSCA are 

sufficient for effectively implementing the new law, EPA needs to institute 

a program to monitor and independently validate the effectiveness and 

sustainability of its initiative to use the new TSCA authorities. For the IRIS 

program, EPA has now partially met the criteria for demonstrated 

progress by, among other things, issuing five IRIS assessments since 

fiscal year 2015—as of January 19, 2017—and making three 

assessments available for public comment in fiscal year 2016 in 

preparation for an external peer review meeting associated with that 

particular assessment. For the TSCA program, EPA has not met the 

criteria for demonstrated progress. Both the IRIS and TSCA programs 

need to continue to implement corrective actions to resolve this complex 

high-risk area.

Passing the Frank R. Lautenberg Chemical Safety for the 21st Century 

Act may facilitate EPA’s effort to improve its processes for assessing and 

controlling toxic chemicals in the years ahead. The new law provides EPA 

with greater authority and the ability to take actions that could help EPA 

implement its mission of protecting human health and the environment. 

Continued leadership commitment from EPA officials and Congress will 

be needed to fully implement reforms. Additional work will also be needed 

to issue a workload analysis to demonstrate capacity, complete a 

corrective action plan, and demonstrate progress implementing the new 

legislation.

• We recommended that EPA periodically assess the level of resources 

that should be dedicated to the Integrated Risk Information System 

(IRIS) program to meet user needs and maintain a viable database.1

 1

GAO, Chemical Assessments: Low Productivity and New Interagency Review Process 

Limit the Usefulness and Credibility of EPA’s Integrated Risk Information System, 

GAO-08-440 (Washington D.C: Mar. 7, 2008).

What Remains to Be 

Done

Integrated Risk 

Information System
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 419 GAO-17-317 High-Risk Series

EPA determined the types of IRIS assessments to conduct, based on 

the needs of EPA’s Program Offices and other users, as reported in 

the IRIS Multi-Year Agenda and in deliberative documents provided to 

us in October 2016. However, EPA has not established a schedule for 

regularly revisiting its assessment of resource needs to ensure that 

priorities are consistent with user needs over time.

• We recommended two actions about EPA’s time frames for IRIS 

assessments.2 First, we recommended that EPA assess the feasibility 

and appropriateness of the established time frames for each step in 

the IRIS assessment process, including whether different time frames 

should be established for different types of IRIS assessments. 

Second, should different time frames be necessary, we recommended 

that EPA establish a written policy that clearly describes the 

applicability of the time frames for each type of IRIS assessment to 

provide greater predictability to stakeholders. In July 2013, EPA 

issued what the agency described as enhancements to the IRIS 

process to address, in part, these priority recommendations. EPA 

developed two sets of timelines for the IRIS assessment process and 

provided us with details about them and its online chemical 

information tracking system; however, EPA needs to determine 

whether different time frames should be established.

• We recommended three actions encouraging transparency about the 

status of planned and ongoing IRIS assessments.3 First, we 

recommended that EPA indicate in published IRIS agendas which 

chemicals it is actively assessing and when it plans to start 

assessments of the other listed chemicals. Second, we recommended 

that EPA update the IRIS Substance Assessment Tracking System 

(IRISTrack) including projected and actual start dates and other 

information, and to keep this information current. Third, we 

recommended that EPA publish the IRIS agenda in the Federal 

Register on an annual basis. In October 2016, EPA officials told us 

that they believed they had met the intent of these recommendations 

by publishing an IRIS Multi-Year Agenda in December 2015. 

However, EPA still needs to provide current and accurate information 

on chemicals that the agency plans to assess through the IRIS 

program for IRIS users on an annual basis. The Multi-Year Agenda 

does not identify projected start dates for new assessments, and 

 2

GAO, Chemical Assessments: Challenges Remain with EPA’s Integrated Risk 

Information System Program, GAO-12-42 (Washington, D.C.: Dec. 9, 2011).

3

GAO-12-42.
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 420 GAO-17-317 High-Risk Series

therefore is not ensuring that current and accurate information on 

chemicals that EPA plans to assess through IRIS is available to IRIS 

users. Using the Federal Register to communicate these plans offers 

greater transparency to the public about the IRIS process than other 

forms of communication.

• We recommended that EPA develop a strategy to address the needs 

of its Program Offices and regions when IRIS toxicity assessments 

are not available.4 Officials from select EPA offices stated that, in the 

absence of agency-wide guidance, they used a variety of sources, 

other than IRIS toxicity assessments to meet their needs, including 

toxicity information from other EPA offices, or other state or federal 

agencies. IRIS program officials also stated that there is no agencywide mechanism for EPA to ensure that chemicals without sufficient 

scientific data during one nomination period will have such information 

by subsequent nomination periods. We recognize that the 

development of EPA’s Multi-Year Agenda, issued in December 2015, 

was a productive effort that EPA told us included an extensive 

evaluation of user needs. However, the agency does not have a 

strategy for addressing data gaps or have assurance that its efforts 

will be sustainable over time. EPA needs to address this priority 

recommendation by developing: (1) an agency-wide strategy that 

addresses coordination across EPA offices and with other federal 

research agencies to help identify and fill data gaps that preclude the 

agency from conducting IRIS toxicity assessments, and (2) guidance 

that describes alternative sources of toxicity information and when it 

would be appropriate to use them when IRIS values are not available, 

applicable, or current.

After many years of congressional committees considering legislation 

aimed at reforming the Toxic Substances Control Act (TSCA), in June 

2016, Congress passed and the President signed the Frank R. 

Lautenberg Chemical Safety for the 21st Century Act, which gave EPA 

greater authority to improve its processes for assessing and controlling 

toxic chemicals. EPA and Congress need to continue to ensure that the 

resources dedicated to TSCA activities are sufficient to effectively 

implement the new law.

 4

GAO, Chemical Assessments: An Agencywide Strategy May Help EPA Address Unmet 

Needs for Integrated Risk Information System Assessments, GAO-13-369 (Washington, 

D.C.: May 10, 2013).

Toxic Substances Control 

Act
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 421 GAO-17-317 High-Risk Series

• We made three priority recommendations to address challenges EPA 

has faced obtaining toxicity and exposure data, banning or limiting the 

use of chemicals, and identifying resource needs.5 First, we 

recommended that EPA issue a rule to obtain toxicity and exposure 

data that chemical companies have submitted to the European 

Chemicals Agency. Second, we recommended that EPA issue a rule 

to obtain exposure-related data from processors. Third, we 

recommended that EPA develop strategies for addressing challenges 

associated with obtaining these data, banning or limiting the use of 

chemicals, and identifying resource needs. Because EPA has used its 

authority to limit or ban only five chemicals since TSCA was originally 

enacted in 1976, in part, because it believed it didn’t have enough 

information, we made these recommendations to address these 

concerns. The Frank R. Lautenberg Chemical Safety for the 21st 

Century Act, enacted on June 22, 2016, provides EPA with greater 

authority to address chemical risks, but implementing it will take time.

With the implementation of the Frank R. Lautenberg Chemical Safety for 

the 21st Century Act, we believe EPA can make progress on these open 

recommendations. The act substantially revises TSCA and requires EPA 

to carry out numerous rulemaking and other activities within the next 2 

years. In early 2016, we started a review of the TSCA program. With the 

passage of TSCA reform, we decided to suspend our review and give 

EPA time to implement the new law. In October 2016, as part of our 

recommendation follow-up process, we reviewed information on the new 

TSCA provisions. EPA officials told us that with new TSCA authority, the 

agency is better positioned to take action to require chemical companies 

to report chemical toxicity and exposure data. The new law authorizes 

EPA to order companies to develop new information relating to a 

chemical as necessary for prioritization and risk evaluation. This authority 

may help EPA to gather new information, as necessary, to evaluate 

hazard and exposure risks. TSCA reform legislation offers promise for 

EPA implementation of our recommendations and bringing the agency 

closer to achieving its goal of ensuring the safety of chemicals.

 5

GAO, Toxic Substances: EPA Has Increased Efforts to Assess and Control Chemicals 

but Could Strengthen Its Approach, GAO-13-249 (Washington, D.C.: Mar. 22, 2013).
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 422 GAO-17-317 High-Risk Series

EPA has met the criteria for leadership commitment. In July 2013, the 

then-EPA Administrator demonstrated leadership commitment to the IRIS 

program by identifying action on toxics and chemical safety as one of her 

top seven priorities for the agency. EPA’s IRIS database is intended to 

provide the basic information the agency needs to determine whether it 

should establish controls to, for example, protect the public from exposure 

to toxic chemicals in the air, in water, and at hazardous waste sites. 

“Taking action on toxics and chemical safety” was one of the prior EPA 

Administrator’s priorities for meeting the challenge ahead—a priority that 

includes the IRIS program. In addition, EPA established an IRIS 

Executive Review Committee after the 2014 National Research Council 

report identified the need for quality management of IRIS assessments. 

According to internal EPA documents, the Executive Review Committee 

provides a mechanism for the National Center for Environmental 

Assessment—the center that houses the IRIS program—to endorse IRIS 

assessments prior to public release, and among other goals, serves to 

Additional Details on 

What GAO Found

IRIS 

Leadership Commitment
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 423 GAO-17-317 High-Risk Series

provide a management-level review for consistency and quality control 

across assessments. Also, the Office of Research and Development’s 

Deputy Assistant Administrator worked with other EPA Deputy Assistant 

Administrators in Program Offices, such as the Office of Water and 

Deputy Regional Administrators, to develop the IRIS Multi-Year Agenda. 

EPA’s top leadership has also demonstrated support for improving the 

IRIS program by continuing to implement recommendations from us and 

EPA’s Science Advisory Board, and suggestions from the National 

Academies.

EPA has partially met the criteria for capacity, after not meeting the 

criteria in 2015. In May 2013, we reported that EPA had not recently 

evaluated the demand for IRIS toxicity assessments with input from users 

inside and outside EPA. In response to our report, EPA started work on 

an IRIS Multi-Year Agenda in the summer of 2013 and issued it in 

December 2015. According to EPA, the purpose of the agenda was to: (1) 

identify IRIS assessments currently underway and their status; (2) 

prioritize IRIS assessments that will be initiated over the next few years; 

and (3) evaluate assessment needs and develop an update process for 

existing IRIS values. Now that EPA has finalized the agenda, the agency 

is better informed about how many people and resources to dedicate to 

the IRIS program.

We have reviewed internal EPA documents on the need for people and 

resources, and the IRIS program has started to determine if it has the 

capacity to address the issues it faces. Because of EPA’s efforts to 

develop the Multi-Year Agenda, in October 2016, we closed a priority 

recommendation we made to EPA in 2008 for the program to determine 

the types of IRIS assessments to conduct on the basis of the needs of 

EPA’s Program Offices and other users. EPA’s actions are a good 

starting point for EPA’s continued process for determining the types of 

IRIS assessments to conduct on the basis of the needs of EPA’s Program 

Offices and others.

EPA continues to partially meet the criteria for having an action plan to 

address measures we recommended, and has made progress. For 

example, by developing the IRIS Multi-Year Agenda and providing us with 

internal EPA documents, EPA has begun to document how the agency 

applies its selection criteria for IRIS toxicity assessments, including the 

circumstances under which Program Offices and Regions may or may not 

need an IRIS toxicity assessment—a priority recommendation we made 

in 2013 and closed in October 2016. As of October 2016, EPA officials 

told us that the agency evaluated user needs for toxicity assessments as 

Capacity

Action Plan
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 424 GAO-17-317 High-Risk Series

part of its process for developing the Multi-Year Agenda it issued in 

December 2015. EPA also indicated that the agency used six general 

criteria to inform the selection of chemicals for assessment or 

reassessment, and it documented this process in an internal working 

table as part of its process for developing the agenda. By beginning to 

document how it applies its IRIS selection criteria, the IRIS program can 

start to determine a corrective action plan that defines root causes and 

solutions to move the program forward. EPA needs to be as transparent 

as possible when applying the selection criteria so that IRIS stakeholders 

can know how EPA is choosing what assessments to start and why.

EPA has met the criteria for monitoring the IRIS program—after partially 

meeting the criteria in 2015—by finalizing the IRIS Multi-Year Agenda and 

other actions. Specifically, the program identified and evaluated demand 

for the number of IRIS toxicity assessments and resources required to 

meet users’ needs—a priority recommendation we made in 2013 and 

closed recently based on internal documents provided by EPA. Moreover, 

EPA presented a plan for how the agency will implement the National 

Academies’ suggestions for improving IRIS assessments in the “roadmap 

for revision” included in the National Academies’ peer review report on 

the draft formaldehyde assessment. The National Academies’ most 

recent report on the IRIS program, issued in May 2014, independently 

validates some of the corrective measures the program is implementing. 

EPA also created the Chemical Assessment Advisory Committee in 

January 2013, and uses it to provide continuing, consistent review of IRIS 

assessments and comment on implementing the National Academies’

suggestions in specific IRIS assessments—a recommendation we made 

in December 2011 and closed in the fall of 2016. All of these actions 

demonstrated EPA’s commitment to monitoring the IRIS program.

EPA has partially met the criteria for demonstrating progress in 

implementing corrective measures by taking actions, such as releasing 

the IRIS Multi-Year Agenda that publicly identifies the current and future 

IRIS assessments. As of January 19, 2017, EPA issued two assessments 

in fiscal year 2017, two assessments in fiscal year 2016, and one 

assessment in fiscal year 2015. In addition, EPA made three 

assessments available for public comment in fiscal year 2016 in 

preparation for an external peer review meeting associated with that 

particular assessment.

The IRIS program has also demonstrated progress by establishing 

Stopping Rules, which, among other things, were implemented to 

increase flexibility to revise draft assessments as needed after hearing 

Monitoring

Demonstrated Progress
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 425 GAO-17-317 High-Risk Series

the public’s comments prior to peer review. EPA told us that the Stopping 

Rules also are important to the IRIS process to determine how to include 

new studies in an assessment without delaying the process or cycling 

through repeated revisions and re-revisions.

Because of these actions, we closed a 2008 priority recommendation that 

demonstrated progress in implementing corrective measures. The 

recommendation called for EPA to conduct IRIS assessments on the 

basis of peer-reviewed scientific studies available at the time of the 

assessment, and develop criteria for allowing assessments to be 

suspended to await the completion of scientific studies only under 

exceptional circumstances. Although EPA officials told us that the agency 

has not formally invoked the Stopping Rules in response to a request to 

delay an assessment to incorporate studies, they told us they apply the 

rules in their everyday work when deciding whether to include new 

studies at different points in the IRIS development process. EPA said they 

would characterize the Stopping Rules as public IRIS policies that are in 

place to avoid delay for the inclusion of new studies or analysis that they 

believe would not affect the assessment’s conclusions.

Over the past two decades, we reported that EPA had found much of 

TSCA difficult to implement—hampering the agency’s ability to obtain 

certain chemical data or place limits on chemicals. For example, EPA has 

found it difficult to obtain adequate information on toxicity—that is, the 

degree to which the chemical is harmful or deadly—and exposure 

levels—the frequency and duration of contact with the chemical. Without 

this information, it is difficult for EPA to determine whether a chemical 

poses an unreasonable risk to human health or the environment, and 

then take any action necessary to regulate such chemicals. The Frank R. 

Lautenberg Chemical Safety for the 21st Century Act, which reformed 

TSCA, was enacted on June 22, 2016. The new law provides EPA with 

greater authority and the ability to take actions that could help EPA 

implement its mission of protecting human health and the environment.

EPA continues to meet the criteria for leadership commitment because of 

the former EPA Administrator’s explicit support for taking action on toxics, 

TSCA

Leadership Commitment
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 426 GAO-17-317 High-Risk Series

including TSCA. In addition, the former Administrator and top leadership 

have expressed support for implementing TSCA reform. For example, the 

former Administrator said that, as with any major policy reform, this one 

includes compromises. But the former Administrator noted that the 

legislation should help EPA’s mission to protect public health and the 

environment.

As in 2015, EPA has not met the criteria for capacity because the agency 

has not yet issued a workload analysis which is needed to determine 

whether EPA’s TSCA program has the capacity—people and resources—

to resolve the risk to the program. The TSCA reform legislation requires 

EPA to report to Congress by December 2016 on its capacity to 

implement certain aspects of the legislation, including carrying out 

chemical risk evaluations and issuing rules regulating specific chemicals. 

In January 2017, EPA issued a report in response to this deadline. The 

report estimates the costs of carrying out risk evaluations under the TSCA 

reform legislation and discusses actions underway or planned for 

increasing EPA’s capacity to carry out these evaluations. The report does 

not, however, contain estimates of EPA’s capacity for carrying out risk 

evaluations or promulgating associated rules. We have previously 

reported that EPA has found many provisions of TSCA cumbersome and 

time consuming to implement. It is currently unclear if EPA has the people 

and resources to implement the new law. We will continue to monitor the 

program to determine if progress is made and the criteria for capacity are 

met.

EPA continues to partially meet the criteria for having an action plan. As 

we reported in 2015, EPA has increased its efforts to obtain chemical 

toxicity and exposure data, initiate chemical risk assessments, and review 

certain new uses of chemicals, but it is too early to tell whether these 

actions will reduce chemical risks. With new TSCA authority, EPA officials 

stated that the agency is better positioned to take action to require 

chemical companies to report chemical toxicity and exposure data. 

Officials also stated that the new law gives the agency additional 

authorities, including the authority to require companies to develop new 

information relating to a chemical as necessary for prioritization and risk 

evaluation. Using both new and previously existing TSCA authorities 

should enhance the agency’s ability to gather new information as 

necessary to evaluate hazard and exposure risks.

As in 2015, EPA has not met the criteria for monitoring because it is too 

soon to determine whether EPA’s approach to managing chemicals within 

the new TSCA authorities will position the agency to achieve its goal of 

Capacity

Action Plan

Monitoring
Transforming EPA’s Process for Assessing

and Controlling Toxic Chemicals

Page 427 GAO-17-317 High-Risk Series

ensuring the safety of chemicals. We will continue to monitor the TSCA 

program as the agency implements this important legislation.

As in 2015, EPA has not met the criteria for demonstrating progress, 

although it has recently begun implementing corrective measures to 

resolve this high-risk area. For example, the first TSCA reform reporting 

deadline directed EPA to publish in the Federal Register a list of mercury 

compounds that will be prohibited from export, not later than 90 days after 

the date of enactment. That reporting deadline was September 20, 2016; 

on August 26, 2016, EPA published a list of the mercury compounds that 

will be prohibited from export effective January 1, 2020. TSCA reform 

actions required by December 19, 2016, included the following topics and 

actions: (1) Risk Evaluations: EPA must ensure that risk evaluations are 

being conducted on 10 chemical substances drawn from the 2014 TSCA 

Work Plan; (2) Small Business: EPA must review, and potentially revise, 

its definitions of small businesses for reporting purposes after consulting 

with the Small Business Administration; and (3) Congressional Report: 

EPA must submit a report to Congress regarding the agency’s capacity to 

carry out risk evaluations and associated actions.

According to EPA, the promulgation of these rules will better position the 

agency to increase the rate at which chemicals are evaluated for human 

and environmental health and safety. As of December 19, 2016, EPA had 

taken steps to respond to the December deadlines for risk evaluations 

and small business. Specifically, EPA has announced the first 10 

chemicals it will evaluate for potential risks to human health and the 

environment and published a Federal Register notice on Standards for 

Small Manufacturers and Processors. In January 2017, EPA took action 

in response to December deadline 3 by issuing a report: Initial Report to 

Congress on the EPA’s Capacity to Implement Certain Provisions of the 

Frank R. Lautenberg Chemical Safety for the 21st Century Act. We will 

continue to monitor EPA as it implements this important piece of chemical 

legislation and determine if it is satisfying all the criteria for removal from 

the High-Risk List.

EPA has taken actions to address many of our priority recommendations 

on chemicals management and Congress has used our work to support 

legislative deliberations. For example, EPA’s efforts, such as developing 

the IRIS Multi-Year Agenda, addressed a number of our 

recommendations related to the IRIS program. EPA identified and 

evaluated demand for the number of IRIS toxicity assessments and 

resources required to meet users’ needs, which was a priority 

Demonstrated Progress

Benefits Achieved by 

Implementing Our 

Recommendations
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 428 GAO-17-317 High-Risk Series

recommendation we made in 2013 and closed recently based on EPA’s 

actions.

Our work has also supported deliberations by Congress about TSCA and 

about strengthening EPA’s ability to regulate chemicals. For example, as 

far back as 1994, we reported that Congress should consider setting 

specific deadlines for reviewing existing chemicals, which the new TSCA 

legislation would address because it requires EPA to establish a chemical 

prioritization process, and to initiate risk evaluations of high priority 

chemicals, among other issues.

Our work since then has addressed a variety of chemical management 

policy matters for Congress. For example, in 2009, we testified that EPA 

does not routinely assess the risks of chemicals in commerce, and in 

2013, we testified about possible statutory changes to TSCA to give EPA 

additional authorities to obtain information, and shift more of the burden to 

chemical companies for demonstrating the safety of their chemicals. 

Finally, in 2016, Congress passed the Frank R. Lautenberg Chemical 

Safety for the 21st Century Act, which we found addresses key challenge 

areas we’ve identified previously.

For additional information about this high-risk area, contact Alfredo 

Gómez at (202) 512-3841 or gomezj@gao.gov.

Chemicals Management: Observations on Human Health Risk 

Assessment and Management by Selected Foreign Programs. 

GAO-16-111R. Washington, D.C.: October 9, 2015.

Chemical Assessments: Agencies Coordinate Activities, but Additional 

Action Could Enhance Efforts. GAO-14-763. Washington, D.C.: 

September 29, 2014.

Chemical Regulation: Observations on the Toxic Substances Control Act 

and EPA Implementation. GAO-13-696T. Washington, D.C.: June 13, 

2013.

Chemical Assessments: An Agencywide Strategy May Help EPA Address 

Unmet Needs for Integrated Risk Information System Assessments. 

GAO-13-369. Washington, D.C.: May 10, 2013.

GAO Contact

Related GAO 

Products
Transforming EPA’s Process for Assessing 

and Controlling Toxic Chemicals

Page 429 GAO-17-317 High-Risk Series

Toxic Substances: EPA Has Increased Efforts to Assess and Control 

Chemicals but Could Strengthen Its Approach. GAO-13-249. Washington, 

D.C.: March 22, 2013.

Chemical Assessments: Challenges Remain with EPA’s Integrated Risk 

Information System Program. GAO-12-42. Washington, D.C.: December 

9, 2011.

Chemical Assessments: Low Productivity and New Interagency Review 

Process Limit the Usefulness and Credibility of EPA’s Integrated Risk 

Information System. GAO-08-440. Washington D.C: March 7, 2008.
Mitigating Gaps in Weather Satellite Data

Page 430 GAO-17-317 High-Risk Series

The two federal agencies responsible for managing weather satellites, the 

Department of Commerce’s National Oceanic and Atmospheric 

Administration (NOAA) and the Department of Defense (DOD), are in 

different stages in their efforts to ensure continued weather satellite 

coverage in their respective satellite orbits. In recognition of NOAA’s 

significant progress, we have narrowed the scope of this high-risk area to 

remove the segment on NOAA’s geostationary weather satellites. At the 

same time, we are expanding this high-risk area to include a segment on 

DOD’s polar-orbiting weather satellites because the agency has been 

slow to replace aging satellites and, as a result, is at risk of a gap in 

weather satellite data in the early morning orbit. We did not include a 

segment on DOD weather satellites in our prior high-risk update because 

the department was not, at that time, facing an imminent satellite data 

gap.1

The United States relies on two complementary types of satellite systems 

for weather observations and forecasts: (1) polar-orbiting satellites that 

provide a global perspective every morning and afternoon, and (2) 

geostationary satellites that maintain a fixed view of the United States. 

Both types of systems are critical to weather forecasters, climatologists, 

and the military, who map and monitor changes in weather, climate, the 

oceans, and the environment. Federal agencies are currently planning or 

executing major satellite acquisition programs to replace existing polar 

and geostationary satellite systems that are nearing the end of, or 

beyond, their expected life spans. Specifically, NOAA is responsible for 

the polar satellite program that crosses the equator in the afternoon and 

for the geostationary satellite program, while DOD is responsible for the 

polar satellite program that crosses the equator in the early morning orbit. 

However, these programs have troubled legacies of cost increases, 

missed milestones, technical problems, and management challenges that 

have reduced functionality and delayed launch dates. As a result, the 

continuity of weather satellite data is at risk.

 1

In our February 2013 high-risk update, we noted that DOD had two weather satellites that 

it planned to launch. These satellites, called the Defense Meteorological Satellite Program 

(DMSP)-19 and 20, were planned for launch in 2014 and 2020. By our February 2015 

high-risk update, DOD had successfully launched DMSP-19 and was still planning to 

launch DMSP-20. However, the continuity of DOD satellite data has become less assured 

since that time. The DMSP-19 satellite stopped providing data in February 2016. Further, 

DOD halted its plans to launch DMSP-20 after the department did not certify that it would 

launch the satellite by the end of calendar year 2016. DOD is now relying on an older 

satellite for data in that early morning orbit.

Mitigating Gaps in Weather Satellite Data

Why Area Is High 

Risk
Mitigating Gaps in Weather Satellite Data

Page 431 GAO-17-317 High-Risk Series

NOAA officials acknowledge that there is a risk of a gap in polar satellite 

data in the afternoon orbit, between the time that the current polar 

satellite is expected to reach the end of its life and the time when the next 

satellite is expected to be in orbit and operational. This gap could span up 

to a year or more, depending on how long the current satellite lasts and 

whether there are any delays in launching or operating the new one.2 In 

addition, there is a risk of a gap in polar satellite data in the early morning 

orbit because DOD has not yet replaced satellites that are nearing the 

end of their life spans. While NOAA does not anticipate gaps in 

geostationary satellite observations, such a gap could occur if the 

satellites currently in orbit do not last as long as anticipated or if the major 

satellite acquisition currently underway encounters schedule delays.

According to NOAA program officials, a satellite data gap would result in 

less accurate and timely weather forecasts and warnings of extreme 

events—such as hurricanes, storm surges, and floods. Such degraded 

forecasts and warnings would endanger lives, property, and our nation’s 

critical infrastructures. Similarly, according to DOD officials, a gap in 

space-based weather monitoring capabilities could affect the planning, 

execution, and sustainment of U.S. military operations around the world. 

Given the criticality of satellite data to weather forecasts, the likelihood of 

significant gaps, and the potential impact of such gaps on the health and 

safety of the U.S. population and economy, we concluded that the 

potential gap in weather satellite data is a high-risk area and added it to 

the High-Risk List in 2013. It remained on the High-Risk List in 2015.

For this high-risk update, we are both narrowing and expanding the highrisk area. We are narrowing this high-risk area to remove NOAA’s 

geostationary weather satellite program because the agency improved its 

gap mitigation contingency plans and made substantial progress in 

ensuring it had the capacity to integrate and test the next satellite, called 

 2

In our February 2013 high-risk update, we reported that—instead of the 18- to 24-month 

gap that NOAA anticipated—the gap could span from 17 to 53 months or more, depending 

on how long the current satellites last and whether there are any delays in launching or 

operating the new one. In October 2013, NOAA officials reported that the gap could be as 

short as 3 months because of the relatively strong performance of the current satellite and 

their plan to reduce the expected length of the next satellite’s on-orbit checkout period. 

However, we noted that the gap could occur sooner and last longer than NOAA 

anticipated if the launch date was delayed, the on-orbit checkout period took longer than 

anticipated, or space debris caused the current satellite to fail early. In October 2016, 

NOAA determined that it would need to delay the launch of the next satellite by 4 to 6 

months to address issues in the development of the ground system. As a result, the 

potential for a gap remains.
Mitigating Gaps in Weather Satellite Data

Page 432 GAO-17-317 High-Risk Series

the Geostationary Operational Environmental Satellite-R (GOES-R) 

series. Moreover, the agency successfully launched this satellite in 

November 2016 and is now better able to ensure continuous satellite 

coverage.

In contrast, we are expanding the high-risk area to include a segment on 

DOD’s polar-orbiting satellite program, which provides weather 

observations in the early morning orbit. The department has been slow to 

establish plans for its follow-on satellite program and has made little 

progress in determining how it will meet selected weather satellite 

requirements in the early morning orbit. Moreover, DOD is currently 

relying on an older satellite that is well past its expected life span. As a 

result, there is a real risk of a weather satellite data gap in the early 

morning orbit. Such a gap could negatively affect military operations that 

depend on weather data.

The two federal agencies responsible for managing weather satellites, 

NOAA and DOD, are in different stages in their efforts to ensure 

continued weather satellite coverage in their respective satellite orbits. 

NOAA’s efforts to strengthen mitigation planning for its polar-orbiting 

satellites in the afternoon orbit have resulted in it meeting three of the five 

criteria for removal from the high-risk area: leadership commitment, 

capacity, and monitoring progress. Specifically, NOAA has demonstrated 

leadership commitment in mitigating data gaps on its polar-orbiting 

weather satellites by establishing gap mitigation action plans, improving 

its computing capacity, and monitoring progress in implementing multiple 

mitigation activities. However, the agency has not yet addressed key 

shortfalls in its gap mitigation plans and several mitigation projects are not 

yet complete. Moreover, the agency recently decided to delay the launch 

date of the next polar-orbiting satellite due to problems in development. 

These issues increase the likelihood of a data gap in the afternoon orbit. 

The agency’s efforts to further improve its gap mitigation plans, complete 

gap mitigation projects, and successfully launch the next polar satellite 

will help ensure that it is in a good position to mitigate the possibility of 

gaps in satellite data.

Regarding its geostationary satellites, NOAA’s efforts to strengthen 

mitigation planning have resulted in it meeting all five of the criteria for 

removal from the high-risk area. Specifically, NOAA has demonstrated 

leadership commitment in acquiring the next geostationary satellite, 

developing and implementing mitigation plans, and monitoring the health 

of the satellite constellation. In addition, NOAA and the National 

What GAO Found
Mitigating Gaps in Weather Satellite Data

Page 433 GAO-17-317 High-Risk Series

Aeronautics and Space Administration (NASA) successfully launched the 

latest geostationary weather satellite in November 2016, a step which 

improved the agency’s ability to ensure robust satellite coverage. In 

recognition of the agency’s significant progress, we have narrowed the 

scope of this high-risk area to remove the segment on NOAA’s 

geostationary satellites.

On the other hand, DOD has been slow to establish a new satellite 

program, selected high-priority capabilities are not addressed by the 

department’s planned program, and problems with existing satellites have 

increased the risk of a gap in satellite data in the early morning orbit. In 

October 2016, over 6 years after the department was directed to establish 

a program to launch new satellites in the early morning orbit, DOD 

established a plan for its Weather Satellite Follow-on—Microwave 

program. The department plans to launch the first operational satellite 

under this program in 2022. However, this program does not address two 

high-priority capabilities—cloud characterization and area-specific 

weather imagery—and the department has not yet determined how it will 

provide those capabilities. Further, DOD’s primary satellite in the early 

morning orbit failed in February 2016, and the department is now using 

an older satellite that is well past its expected life span. Until the 

department launches its next satellite and establishes a plan to provide 

the two high-priority capabilities, it faces a significant risk of a gap in 

satellite data should the existing operational satellite fail. As a result of 

DOD’s limited progress in developing and implementing a plan to fulfill its 

weather satellite requirements, we are expanding this high-risk area to

include a segment on DOD’s progress in addressing the need for satellite 

coverage in the early morning orbit.

Over the last 4 years, congressional committees have held multiple 

hearings to address this high-risk area. Examples include:

• Subcommittees of the House Science, Space, and Technology 

Committee have held multiple hearings to provide oversight of major 

satellite acquisitions and the risk of gaps in satellite coverage 

(September 2013, February 2015, December 2015, July 2016) and on 

private sector weather forecasting (May 2015, June 2016).

• In March 2016, the Subcommittee on Commerce, Justice, Science, 

and Related Agencies of the Senate Appropriations Committee held a 

hearing on the President’s fiscal year 2017 budget proposal that 

included a discussion of current and future satellite programs.
Mitigating Gaps in Weather Satellite Data

Page 434 GAO-17-317 High-Risk Series

• In July 2016, the House Science, Space, and Technology 

Committee’s Subcommittee on Environment held a hearing to provide 

oversight of DOD’s efforts to plan a new satellite acquisition and 

address the potential for gaps in satellite coverage.

Also over the last 4 years, Congress has worked on legislation to address 

this high-risk area. Examples include:

• The Weather Research and Forecasting Innovation Act of 2015 was 

introduced as a bill in the House of Representatives to advance 

programs and activities related to improving weather warnings and 

forecasts—including analysis of potential observing system gaps—

and clarifying NOAA’s ability to access commercial weather data and 

products.3

• Congress appropriated funds for satellite data gap mitigation activities 

through the Disaster Relief Appropriations Act, 2013.4

NOAA has made considerable progress over the last 2 years, particularly 

in mitigating the risk of a geostationary satellite data gap and in improving 

its capacity to mitigate polar-orbiting satellite data gaps. NOAA 

demonstrated leadership commitment, improved its high-performance 

computing capacity, developed gap mitigation plans, and successfully 

launched a geostationary weather satellite in November 2016. As a result, 

we are narrowing our high-risk area to remove the segment on NOAA’s 

geostationary weather satellites. However, NOAA’s polar-orbiting weather 

satellites remain on the High-Risk List because more remains to be done 

before the remaining two criteria can be met. NOAA needs to address the 

shortfalls we identified in its gap mitigation plans and to demonstrate 

progress in key gap mitigation projects. Specifically, NOAA needs to

 3

See H.R.1561 - Weather Research and Forecasting Innovation Act of 2015 — 114th 

Congress (2015-2016). The House committee report includes an extensive discussion 

related to commercially provided weather data. This bill passed the in the House and 

Senate, but the Senate made changes and sent it back to the House on December 2, 

2016.

4

See supplemental enacted to provide assistance for relief of Hurricane Sandy: Public 

Law 113-2, Disaster Relief Appropriations, containing Division A: Disaster Relief 

Appropriations Act, 2013 and Division B: Sandy Recovery Improvement Act of 2013.

What Remains to Be 

Done

NOAA’s Weather Satellites
Mitigating Gaps in Weather Satellite Data

Page 435 GAO-17-317 High-Risk Series

• address residual shortfalls in its mitigation plan, including providing 

key information about the cost and effects of the mitigation options, 

and establishing when the testing of selected options would be 

completed (this is a recommendation that we identified as a priority 

recommendation to the Secretary of Commerce); and

• demonstrate progress by completing the remaining gap mitigation 

projects identified in the polar satellite gap mitigation plan, including 

addressing the technical challenges that delayed the scheduled 

launch date for the next satellite, deciding when the next satellite will 

be launched, and acting to ensure a timely and successful launch.

DOD has made limited progress in its efforts to replace aging satellites 

and is now at risk of a gap in weather satellite data in the early morning 

orbit. As a result, we are expanding this high-risk area to include DOD’s 

polar-orbiting weather satellites. The department needs to

• demonstrate progress on its next generation of weather satellites, 

called the Weather System Follow-on—Microwave (WSF-M) program, 

to address the risk of a gap in the early morning orbit; and

• establish and implement plans to mitigate the risk of a gap in the highpriority capabilities that are not included in WSF-M .

DOD’s Polar-Orbiting 

Weather Satellites
Mitigating Gaps in Weather Satellite Data

Page 436 GAO-17-317 High-Risk Series

NOAA has met the criterion of demonstrating a strong leadership 

commitment to mitigating potential gaps in polar-orbiting satellite data. In 

April 2015, NOAA issued an updated polar satellite gap mitigation plan 

which identifies the specific technical, programmatic, and management 

steps the agency is taking to ensure that satellite mitigation options are 

viable. Moreover, NOAA continues to oversee the implementation of 35 

gap mitigation projects, including efforts to assimilate data from new 

sources into weather models and to explore how manned and unmanned 

aircraft observations could increase the accuracy of numerical weather 

predictions for high-impact weather events. In addition, NOAA executives 

oversee the acquisition of the next generation of polar-orbiting satellites 

through monthly briefings on the cost, schedule, and technical risks 

affecting the satellites’ development and planned launch dates.

NOAA has met the criterion for improving its capacity to address the risk 

of a satellite data gap, which is an increase over its prior rating. In 

December 2014, we reported that delays in improving the agency’s highAdditional Details on 

What GAO Found

NOAA’s Polar-Orbiting 

Weather Satellites

Leadership Commitment

Capacity
Mitigating Gaps in Weather Satellite Data

Page 437 GAO-17-317 High-Risk Series

performance computing capacity resulted in reduced scope or delayed 

work on other critical mitigation projects, and recommended that NOAA 

investigate ways to prioritize the gap mitigation projects with the greatest 

potential benefit to weather forecasting. NOAA agreed with this 

recommendation, implemented it, and has since completed efforts to 

improve its high-performance computing capacity. Specifically, in May 

and December 2015, the agency completed upgrading its highperformance computers that support research and operations. These 

upgrades allowed the agency to move forward on multiple other mitigation 

activities, including experimenting with other data sources and 

assimilating these data into its weather models.

NOAA has partially met the criterion for having a plan to address the risk 

of a polar satellite data gap. In April 2015, NOAA issued an updated 

satellite mitigation plan, which includes several improvements over its 

prior plan. For example, in response to a recommendation we made in 

December 2014 to address shortfalls in the mitigation plan, NOAA’s latest 

plan includes an expanded list of mitigation projects and identifies 

opportunities for accelerating the availability of satellite products after the 

next satellite is launched. However, the agency has not yet addressed 

residual shortfalls in its mitigation plan, including providing key 

information about the cost and impact of the mitigation options, and 

establishing when the testing of selected options would be completed. 

Until NOAA fully addresses the shortfalls in its gap mitigation plan, it may 

not be sufficiently prepared to mitigate potential gaps in polar satellite 

coverage.

NOAA has met the criterion for monitoring progress on its gap mitigation 

activities, which is an increase over its prior rating. In December 2014, we 

reported that NOAA’s oversight of its many gap mitigation projects was 

not consistent or comprehensive. For example, only one of three NOAA 

organizations had briefed management on a monthly basis on the status 

of its mitigation projects and the agency had not yet reported progress on 

nine mitigation activities outlined in its plan. We recommended that NOAA 

ensure that the relevant entities provide regular progress updates on all 

mitigation projects and activities. NOAA agreed and implemented this 

recommendation. All three responsible NOAA organizations are now 

regularly briefing management on all active gap mitigation projects.

NOAA has partially met the criterion for demonstrating progress in 

mitigating the risk of a gap in polar-orbiting satellite data. NOAA has 

identified 35 different gap mitigation projects and is making progress in 

implementing many of them. These projects fall into three general 

Action Plan

Monitoring

Demonstrated Progress
Mitigating Gaps in Weather Satellite Data

Page 438 GAO-17-317 High-Risk Series

categories: (1) understanding the likelihood and impact of a gap, (2) 

reducing the likelihood of a gap, and (3) reducing the impact of a gap. As 

of May 2016, 16 projects had been completed; 18 were ongoing; and 1 

was planned for the future. However, one of the most important steps in 

reducing the likelihood of a gap—keeping the launch of the next polar 

satellite on schedule—has had problems. While NOAA targeted a March 

2017 launch date for the next polar-orbiting satellite, agency officials 

recently decided to delay the launch by 4 to 6 months due to problems in 

developing the ground system and a critical instrument on the spacecraft. 

This launch delay exacerbates the probability of a gap in satellite data 

since the current operational satellite is now past its expected 5-year life 

span and one key instrument on that satellite has been experiencing 

technical issues.

NOAA acknowledged that if this instrument fails before the next satellite is 

launched and operational, it would result in degraded weather forecasts, 

exposing the nation to a 15 percent chance of missing an extreme 

weather event forecast. While NOAA has made progress on its many 

mitigation projects, the agency acknowledges that no steps will 

completely mitigate a sudden failure of the primary operational polarorbiting satellite. Until NOAA demonstrates that it is making swift and 

effective progress in mitigating potential near-term gaps in polar satellite 

data, there will be a growing risk that degraded forecasts and warnings 

will negatively impact the U.S. population and economy.
Mitigating Gaps in Weather Satellite Data

Page 439 GAO-17-317 High-Risk Series

NOAA has met the criterion of demonstrating strong leadership 

commitment to mitigating potential gaps in geostationary satellite data by 

revising and improving its geostationary satellite contingency plans, 

updating an assessment of the viability of the program schedule leading 

up to the launch date, and taking steps to ensure that the GOES-R 

satellite was successfully launched in November 2016.

NOAA has met the criterion for ensuring it has the capacity to address the 

risk of a gap in backup coverage, which is an increase over its prior 

rating. Over the past several years, the agency has demonstrated its 

ability to mitigate operational satellite outages by monitoring the health of 

the satellites and by moving a backup satellite into operation when 

needed. Moreover, we rated capacity as partially met in our 2015 report 

due to concerns about NOAA’s ability to complete critical testing activities 

because it was already conducting testing on a round-the-clock, 

accelerated schedule. Since then, NOAA adjusted its launch schedule 

from March 2016 to November 2016 to allow time to complete critical 

integration and testing activities.

NOAA has met the criterion for having an action plan to address the risk 

of a geostationary satellite data gap, which is an increase over its prior 

NOAA’s Geostationary 

Weather Satellites

Leadership Commitment

Capacity

Action Plan
Mitigating Gaps in Weather Satellite Data

Page 440 GAO-17-317 High-Risk Series

rating. In December 2014, we reported on shortfalls in the satellite 

program’s gap mitigation/contingency plans and made recommendations 

to NOAA to address these shortfalls. For example, we noted that the plan 

did not sufficiently address strategies for preventing a launch delay, 

timelines and triggers to prevent a launch delay, and whether any of its 

mitigation strategies would meet minimum performance levels. NOAA 

agreed with these recommendations and released a new version of its 

geostationary satellite contingency plan in February 2015. The new plan 

includes information on steps planned or underway to mitigate potential 

launch delays, the potential impact of failure scenarios in the plan, and 

the minimum performance levels expected under such scenarios.

NOAA has met the criterion for monitoring progress in addressing its 

risks. Officials responsible for satellite operations actively monitor the 

health of the satellite constellation and are prepared to implement 

contingency operations if they are warranted. In addition, GOES-R 

program officials actively monitored and analyzed the program schedule 

in order to minimize changes to the launch date. Program officials also 

regularly report to senior managers on progress and risks.

NOAA has met the criterion for demonstrating progress in mitigating risks, 

which is an increase over its prior rating. In September 2013, we reported 

that the agency had weaknesses in its schedule management practices 

on its core ground system and spacecraft, and we made 

recommendations to address those weaknesses. The weaknesses 

pertained to the sequencing of all activities, ensuring there were adequate 

resources for the activities, and conducting a schedule risk analysis. 

NOAA agreed with the recommendations and the GOES-R program 

made improvements to its schedule management practices. In early 

2016, the program improved the links between remaining activities on the 

spacecraft schedule, included needed schedule logic for a greater 

number of activities on the ground schedule, and included indications in 

the ground schedule that the results of a schedule risk analysis were 

used in calculating the duration of its activities.

In addition, the GOES-R program made significant progress in developing 

and testing the GOES-R satellite and successfully launched it in 

November 2016. The agency now has a robust constellation of 

operational satellites and backup satellites in orbit. As a result, the 

agency has made significant progress in addressing the risk of a gap in 

geostationary satellite data coverage.

Monitoring

Demonstrated Progress
Mitigating Gaps in Weather Satellite Data

Page 441 GAO-17-317 High-Risk Series

In 2010, when the Executive Office of the President decided to disband a 

tri-agency polar weather satellite program, DOD was given responsibility 

for providing polar-orbiting weather satellite capabilities in the early 

morning orbit. However, the department was slow to develop plans to 

replace its existing satellites that provide this coverage. The department 

conducted a requirements review and analysis of alternatives from 

February 2012 through September 2014 to determine the best way 

forward for providing needed polar-orbiting satellite environmental 

capabilities in the early morning orbit. In October 2016, DOD approved 

plans for the WSF-M program. Through this program, the department 

plans to launch a demonstration satellite in 2017 and to launch its first 

operational satellite in 2022.

However, DOD’s plans for the early morning orbit are not comprehensive. 

The department did not thoroughly assess options for providing its two 

highest-priority capabilities (cloud characterization and area-specific 

weather imagery) due to an incorrect assumption about the capabilities 

that would be provided by international partners. WSF-M does not include 

these two highest-priority capabilities and the department has not yet 

determined its long-term plans for providing them.

Due to DOD’s delay in establishing plans for its next generation of 

weather satellites, there is now a significant risk of a satellite data gap in 

the early morning orbit. The last satellite that the department launched, 

called Defense Meteorological Satellite Program (DMSP)-19, stopped 

providing recorded data used in weather models in February 2016. A prior 

satellite, called DMSP-17, is now the primary satellite operating in the 

early morning orbit. However, this satellite was launched in 2006 and is 

operating with limitations due to the age of its instruments. DOD had 

developed another satellite, called DMSP-20, but plans to launch that 

satellite were canceled after the department did not certify that it would 

launch the satellite by the end of calendar year 2016. As a result, the 

department will need to continue to rely on the older DMSP-17 satellite 

until (1) its new satellite becomes operational in 2022, and (2) it 

determines how it will address the high priority capabilities that the new 

satellite will not provide. Given the age of the DMSP-17 satellite and 

uncertainty on how much longer it will last, the department could face a 

gap in critical satellite data that lasts for years.

In August 2016, DOD reported to Congress its near-term plans to address 

potential satellite data gaps. These plans include a greater reliance on 

international partner capabilities, exploring options to move a 

geostationary satellite over an affected region, and plans to explore 

DOD’s Polar-Orbiting 

Weather Satellites
Mitigating Gaps in Weather Satellite Data

Page 442 GAO-17-317 High-Risk Series

options for acquiring and fielding new equipment, such as satellites and 

satellite components, to provide the capabilities. In addition, the 

department anticipates that the demonstration satellite to be developed 

as a precursor to WSF-M could help mitigate a potential gap by providing 

some data. However, these proposed solutions may not be available in 

time or be comprehensive enough to avoid near-term coverage gaps. 

Such gaps could negatively affect operations that depend on weather 

data, such as long-range strike capabilities and aerial refueling.

Over the next 2 years, we will assess DOD’s progress in addressing 

polar-orbiting weather satellites against the high-risk criteria and will 

report this information as appropriate.

Examples of benefits achieved over the last 4 fiscal years by 

implementing our recommendations include the following actions by 

NOAA:

• Improving its gap mitigation/contingency plans for its polar-orbiting 

weather satellites.

• Prioritizing its gap mitigation efforts supporting its polar-orbiting 

weather satellites.

• Improving its oversight of its gap mitigation projects for its polarorbiting weather satellites.

• Improving its schedule management practices on its geostationary 

satellite program.

• Improving its outreach to key external users of geostationary satellite 

data.

• Addressing shortfalls in its geostationary gap mitigation plans.

In December 2014, we recommended that NOAA revise its polar satellite 

gap mitigation plan (also called a contingency plan) to address residual 

shortfalls we identified, including providing an assessment of alternatives 

based on their costs and potential impacts, establishing a schedule with 

meaningful timelines, and defining completion dates for testing and 

validating the alternatives.5 In May 2016, we reported that NOAA updated 

 5

GAO, Polar Weather Satellites: NOAA Needs To Prepare for Near-term Data Gaps 

[Reissued on January 16, 2015], GAO-15-47 (Washington, D.C.: Dec. 16, 2014).

Benefits Achieved by 

Implementing Our 

Recommendations
Mitigating Gaps in Weather Satellite Data

Page 443 GAO-17-317 High-Risk Series

its plan in April 2015 and addressed several of the identified shortfalls.6

However, we also reported that the plan does not include all elements 

needed to fully implement our recommendation, such as a schedule with 

meaningful timelines and linkages among mitigation activities. NOAA 

plans to update its polar satellite contingency plan to address these 

residual shortfalls in early 2017.

For additional information about this high-risk area, contact David Powner 

at (202) 512-9286, or pownerd@gao.gov.

Environmental Satellites: NOAA Needs to Ensure Its Timelines Are 

Accurate, Clear, and Fully Documented.GAO-16-767. Washington, D.C.: 

September 8, 2016.

Polar Satellites: NOAA Faces Challenges and Uncertainties that Could 

Affect the Availability of Critical Weather Data. GAO-16-773T. 

Washington, D.C.: July 7, 2016.

Defense Weather Satellites: DOD Faces Acquisition Challenges for 

Addressing Capability Needs. GAO-16-769T. Washington, D.C.: July 7, 

2016.

Polar Weather Satellites: NOAA Is Working to Ensure Continuity but 

Needs to Quickly Address Information Security Weaknesses and Future 

Program Uncertainties. GAO-16-359. Washington, D.C.: May 17, 2016.

Defense Weather Satellites: Analysis of Alternatives Is Useful for Certain 

Capabilities, but Ineffective Coordination Limited Assessment of Two 

Critical Capabilities. GAO-16-252R. Washington, D.C.: March 10, 2016.

Environmental Satellites: Launch Delayed; NOAA Faces Key Decisions 

on Timing of Future Satellites. GAO-16-143T. Washington, D.C.: 

December 10, 2015.

 6

GAO, Polar Weather Satellites: NOAA Is Working to Ensure Continuity but Needs to 

Quickly Address Information Security Weaknesses and Future Program Uncertainties, 

GAO-16-359 (Washington, D.C.: May 17, 2016).

GAO Contact

Related GAO 

Products
Mitigating Gaps in Weather Satellite Data

Page 444 GAO-17-317 High-Risk Series

Environmental Satellites: Improvements Needed in NOAA’s Mitigation 

Strategies as It Prepares for Potential Satellite Coverage Gaps. 

GAO-15-386T. Washington, D.C.: February 12, 2015.

Polar Weather Satellites: NOAA Needs To Prepare for Near-term Data 

Gaps [Reissued on January 16, 2015]. GAO-15-47. Washington, D.C.: 

December 16, 2014.

Geostationary Weather Satellites: Launch Date Nears, but Remaining 

Schedule Risks Need to be Addressed. GAO-15-60. Washington, D.C.: 

December 16, 2014.
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 445 GAO-17-317 High-Risk Series

Since our high-risk report in February 2015, the Department of Energy 

(DOE) continued to meet the leadership commitment criterion and to 

partially meet the criterion for having a corrective action plan. DOE has 

improved its monitoring of the effectiveness of corrective measures and 

now partially meets this criterion. DOE did not meet the criterion for 

having the capacity to resolve contract and project management 

problems, nor did DOE meet the criterion for demonstrating progress 

toward implementing measures to resolve high-risk areas.

DOE oversees a broad range of programs related to nuclear security, 

science, energy, and nuclear waste cleanup, among other areas. To 

support these missions, DOE has several offices, each of which oversees 

numerous programs that often design and construct large capital asset 

projects to meet the department’s mission needs. DOE relies primarily on 

contractors to carry out its programs. It is the largest civilian contracting 

agency in the federal government, and spends approximately 90 percent 

of its fiscal year 2017 funding of more than $32 billion on contracts and 

large capital asset projects. We designated DOE’s contract 

management—which has included both contract administration and 

project management—a high-risk area in 1990 because DOE’s record of 

inadequate management and oversight of contractors has left the 

department vulnerable to fraud, waste, abuse, and mismanagement.

In January 2009, to recognize progress made at DOE’s Office of Science, 

we narrowed the focus of DOE’s high-risk designation to 2 DOE program 

elements—the Office of Environmental Management (EM) and the 

National Nuclear Security Administration (NNSA). Together, these 2 

elements accounted for almost 60 percent of DOE’s annual budget. In 

February 2013, we further narrowed the focus of the high-risk designation 

to NNSA and EM’s major contracts and projects—those with an estimated 

cost of $750 million or greater—to acknowledge progress made in 

managing nonmajor projects, those with an estimated cost below $750 

million. We continue to monitor DOE’s management of nonmajor projects 

to ensure that progress in this area is sustained.

In our 2015 assessment, we found that, of the five criteria needed for 

removal from the High-Risk List, DOE satisfied one: leadership 

commitment. During the last 2 years, we again observed DOE’s strong 

leadership commitment to addressing the high-risk area. The Secretary of 

Energy has taken several high-profile steps that demonstrate the 

department’s commitment to improving project management—steps that 

have been embraced by senior leadership within the department. 

Similarly, we continued to observe progress as DOE developed and 

DOE’s Contract Management for the 

National Nuclear Security Administration and 

Office of Environmental Management

Why Area Is High 

Risk
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 446 GAO-17-317 High-Risk Series

implemented corrective actions that aim to identify and address root 

causes of persistent project management challenges and implement 

solutions. Since our 2015 assessment, we also observed progress in 

DOE’s monitoring of the effectiveness and sustainability of corrective 

measures. As in previous years, however, EM and NNSA struggled to 

ensure they have the capacity (both people and resources) to mitigate 

risks. They have also demonstrated limited progress in contract 

management, particularly in the area of financial management, and have 

struggled to stay within cost and schedule estimates for some major 

projects.

DOE has made progress in its contract and project management. DOE 

continued to meet the criterion for demonstrating a strong commitment 

and top leadership support for improving project management. The 

Secretary of Energy issued two memorandums, in December 2014 and 

June 2015, that lay out a series of changes to policies and procedures to 

improve project management. These changes were included in DOE’s 

revised project management order, DOE Order 413.3B, issued in May 

2016. As noted in the memorandums, some of these changes are in 

response to recommendations we made in prior years, such as requiring 

that projects develop cost estimates and analyses of alternatives 

according to our best practices.

According to DOE officials, the two memorandums serve as DOE’s 

corrective action plan, but we note that this plan does not appear to be 

comprehensive and, as such, DOE continues to partially meet this 

criterion. Specifically, DOE’s corrective action plan does not address 1) 

acquisition planning for its major contracts—a phase during which critical 

contract decisions are made that have significant implications for the cost 

and overall success of an acquisition; 2) the quality of enterprise-wide 

cost information available to DOE managers and key stakeholders; 3) 

DOE’s need for a program management policy; and 4) how DOE’s new 

requirements will be applied to the department’s major legacy projects, 

which receive billions of dollars in annual funding and often present the 

most intractable project management challenges.

DOE also made significant efforts to improve its performance in 

monitoring and independently validating the effectiveness and 

sustainability of corrective measures and now partially meets our 

monitoring criterion. For example, the Secretary improved the 

department’s senior-level monitoring capability. These efforts are 

important and can substantively improve how DOE oversees and 

What GAO Found
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 447 GAO-17-317 High-Risk Series

executes its major projects and programs, but additional time is needed 

for us to assess how effectively these recent monitoring improvements 

will validate the sustainability of corrective measures. We have not yet 

evaluated the operations of the newly created Project Management Risk 

Committee (PMRC). In addition, DOE’s new oversight and monitoring 

efforts are not comprehensive, as certain activities within EM are not 

subject to review by the PMRC, even though together they cost billions of 

dollars and last for numerous years. Finally, the effectiveness of DOE’s 

monitoring of its contracts, projects, and programs depends upon the 

availability of reliable enterprise-wide cost information on which to base 

oversight activities.

DOE did not meet the criterion for having the capacity to mitigate risks 

with project and contract management. Since 2015, DOE has taken steps 

to improve capacity, such as increasing its number of contract specialists, 

but even with these recent steps, capacity challenges remain. The 

Secretary’s December 2014 and June 2015 memorandums were 

generally silent on capacity issues. In several recently issued reports, we 

found capacity shortfalls in key contract management functions, including 

cost and schedule performance evaluation, as well as in oversight of 

major projects and programs. For example, in May 2015, we found that 

NNSA had not determined whether it has sufficient, qualified personnel to 

ensure it used information from contractor assurance systems (CAS) 

consistently, which include information on contractors’ cost and schedule 

performance. In 2016, DOE issued a new Supplemental Directive on 

NNSA Site Governance requiring NNSA to develop training for NNSA 

organizations to help them implement the governance model that relied 

on information from CAS for oversight, but it is unclear whether this 

training has been developed and initiated. In November 2016, we found 

that DOE and NNSA had not established training programs, such as a 

career development program, for program managers. On December 14, 

2016, the President signed the Program Management Improvement 

Accountability Act. The act, among other things, requires that each 

agency head appoint a Program Management Improvement Officer, who 

must develop a strategy for enhancing the role of program managers 

within the agency that includes enhanced training and educational 

opportunities for program managers. Finally, in July 2016, we found 

problems with DOE’s effort to evaluate the environment for raising 

concerns without fear of reprisal.

As noted earlier, DOE implemented a series of changes to policies and 

procedures to improve project management, but the department does not 

yet meet the criterion for demonstrating progress. DOE’s recent reforms 
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 448 GAO-17-317 High-Risk Series

are in the early stages, and more time is needed to assess the 

effectiveness of corrective measures and associated progress, especially 

with respect to ongoing major projects. DOE has taken significant actions 

regarding two of its six ongoing major projects but continues to encounter 

significant project management challenges, cost increases, and schedule 

delays on others. In addition, even though we removed nonmajor projects 

from our High-Risk List, we continue to monitor how DOE manages these 

projects to ensure that DOE sustains progress in this area. Finally, DOE’s 

recent reforms do not address contract management, and our work since 

the last high-risk report has identified several significant challenges with 

DOE contract management on which DOE has taken little action. 

Specifically, in May 2015, we found that NNSA had not established 

policies or guidance specific to using information from CAS to evaluate 

management and operations (M&O) contractor performance.

Congress has taken several actions related to this high-risk area. For 

example, the fiscal year 2016 National Defense Authorization Act (NDAA) 

was enacted with several provisions on the basis of our 

recommendations, including modifications to requirements for cost-benefit 

analyses for competing management and operating contracts and 

additional requirements related to the oversight of the Hanford Waste 

Treatment and Immobilization Plant (WTP). In addition, the Senate Armed 

Services Committee report accompanying the fiscal year 2017 NDAA 

included requirements for DOE relevant to many issues highlighted in our 

high-risk report, including specific provisions for the Mixed Oxide (MOX) 

Fuel Fabrication Facility, the Chemistry and Metallurgy Research 

Replacement (CMRR) project, and the WTP. The Senate Armed Services 

Committee also held hearings in 2015 and 2016 on challenges identified 

in this high-risk area. We testified on our observations on DOE’s 

management challenges and the steps taken to address them. The 

House Energy and Commerce Committee also held a hearing in 2015 in 

which we testified on the actions needed to improve DOE and NNSA 

oversight of management and operating contracts.

DOE continues to face persistent problems with design and construction 

of nuclear facilities and with program and contract management. DOE’s 

removal from the High-Risk List requires meeting all five of our longestablished criteria. DOE must sustain the leadership commitment it has 

already demonstrated to address its project and contract management 

challenges. For the criteria that DOE has partially or not met, it should 

also address the following:

What Remains to Be 

Done
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 449 GAO-17-317 High-Risk Series

Capacity: DOE will need to commit sufficient people and resources to 

resolve its project, program, and contract management problems. DOE 

must develop a strategy to address these needs. We note that the 

initiatives DOE established in 2015, some of which we described in our 

last high-risk report, are not yet complete. NNSA’s issuance of a new 

Supplemental Directive on NNSA Site Governance is a good first step 

toward addressing the recommendations we made with regard to the 

agency’s capacity to conduct oversight activities using information from 

CAS. Specifically, the Supplemental Directive includes requirements for 

NNSA’s Office of Safety, Infrastructure and Operations to develop training 

for NNSA organizations to assist their implementation of the site 

governance model and to annually review and update the training as 

needed to ensure continuous improvement. However, NNSA has not yet 

established comprehensive guidance, beyond the general framework 

described in the new Supplemental Directive, to consistently implement 

the described governance model across the nuclear security enterprise, 

and this is needed to ensure that the training developed is aligned with 

the specifics of that governance model.

In addition, significant additional action is required by both EM and NNSA 

to fully address our recommendations. DOE must implement program 

management policies and develop a strategy for enhancing the role of 

program managers, including for training, as required by the Program 

Management Improvement Accountability Act, and address our and 

others’ recommendations on whistleblower protection to ensure a safetyconscious work environment where staff are encouraged to use their 

expertise, identify risks, and proactively mitigate them without fear of 

workplace retaliation.

Action Plan: DOE will need to ensure that its corrective action plan is 

comprehensive and addresses all root causes—including all front-end 

planning challenges and contract and program management, as well as 

capacity issues. To be considered a corrective action plan, DOE’s plan 

must also set milestones and timelines, assign responsibilities for 

implementing and completing corrective measures, and identify 

mechanisms to monitor progress and provide measurable outcomes. 

DOE must also ensure the corrective action plan includes steps 

necessary to implement solutions we and others have recommended.

The plan should be a living document that can reflect progress made, 

reconcile past plans and root cause analyses, reflect improved 

understanding of underlying causes and corrective measures, and identify 

what challenges remain. DOE’s corrective action plan should also 
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 450 GAO-17-317 High-Risk Series

address acquisition planning for its major contracts, the quality of 

enterprise-wide cost information, and how DOE’s new requirements will 

be applied to major legacy projects. Finally, we will monitor how DOE 

applies—enterprise-wide—the standards, policies and guidelines for 

program management that are to be established at federal agencies in 

response to the Program Management Improvement Accountability Act.

Monitoring: DOE will need to continue to monitor and independently 

validate the effectiveness and sustainability of its corrective measures, 

particularly for major projects. Meeting the monitoring criterion will require 

a comprehensive corrective action plan—as described above—against 

which progress can be monitored. DOE has created the PMRC to track 

progress of projects across the agency, but it is too early to assess its 

effectiveness, especially on major projects. As a next step, DOE should 

create a framework in which the PMRC and programs use existing and 

other tools as needed to track progress against a comprehensive 

corrective action plan and regularly update the plan with progress and 

any newly identified root causes based on the PMRC’s validation of 

completion.

DOE should also ensure it has the reliable, enterprise-wide cost 

information that is needed to effectively monitor projects and programs. 

DOE will also need to ensure that EM’s operations activities that are 

currently outside of project management requirements are included in this 

framework and are subject to comparable monitoring and oversight by the 

PMRC or another body.

Demonstrated Progress: DOE will need to demonstrate progress in 

implementing corrective measures, especially measures intended to 

improve the performance of major projects and contracts. For example, 

for projects, DOE must continue to show improvements on meeting cost 

and schedule targets and a commitment to applying new requirements to 

all of its major projects. DOE should also continue to monitor progress 

and apply corrective measures to nonmajor projects. For contracts, once 

DOE’s corrective action plan addresses contract management, DOE must 

apply these measures to address its longstanding contract management 

problems. More specifically, DOE should address some of the problems 

we found, such as developing a contract management framework 

addressing the use of CAS so that DOE staff have the ability to evaluate 

contractor performance.
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 451 GAO-17-317 High-Risk Series

The department continued to meet the criterion for demonstrating a 

strong commitment and top leadership support for improving project 

management in EM and NNSA. The Secretary of Energy issued two 

memorandums, in December 2014 and June 2015, that lay out a series of 

changes to policies and procedures to improve project management. The 

Secretary’s changes were included in DOE’s revised project management 

order, DOE Order 413.3B, issued in May 2016. As noted in the 

memorandums, some of these changes are in response to 

recommendations we made in prior years, as shown in the following 

examples:

• DOE added requirements for program offices to conduct a root cause 

analysis if a major project is expected to exceed its approved cost or 

schedule.

• DOE added requirements for program offices to ensure that major 

projects’ designs and technologies are sufficiently mature before 

contractors are allowed to begin construction.

• DOE added a requirement to its revised project management order for 

program offices to conduct analyses of alternatives consistent with 

industry best practices, independent of the contractor organization 

responsible for managing the construction or constructing a capital 

asset project.

• DOE added a requirement to its project management order that 

projects’ cost estimates be developed, maintained, and documented 

in a manner consistent with industry best practices. DOE also 

required that its cost estimating guidance and Acquisition Regulations 

be consistent with cost estimating best practices reflected in our Cost 

Estimating and Assessment Guide.1

DOE also enhanced project and contract oversight, improving senior 

managers’ ability to identify and mitigate risks. For example, the 

Secretary strengthened the Energy Systems Acquisition Advisory Board 

(ESAAB) by changing it from an ad hoc body to an institutionalized board 

 1

GAO, GAO Cost Estimating and Assessment Guide: Best Practices for Developing and 

Managing Capital Program Costs, GAO-09-3SP (Washington, D.C.: March 2009). 

Additional Details on 

What GAO Found

Leadership Commitment
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 452 GAO-17-317 High-Risk Series

responsible for reviewing all capital asset projects with a total project cost 

of $100 million or more. DOE officials told us that the ESAAB met 16 

times in fiscal year 2015 and 14 times in fiscal year 2016 after not 

meeting at all during fiscal years 2013 and 2014. The Secretary also 

created the PMRC, which includes senior DOE officials and is chaired by 

a new departmental position—the Chief Risk Officer (CRO). According to 

its charter, the committee meets biweekly to assess the risks of projects 

across the department, as well as to advise DOE senior leaders and the 

ESAAB on cost, schedule, and technical issues for projects.

We also continue to monitor nonmajor projects, and we note that the 

Secretary’s December 2014 and June 2015 memorandums applied 

project management reforms to nonmajor projects previously not subject 

to such requirements. For example, DOE’s new project management 

reforms require full upfront funding for projects costing $50 million or 

less—a reform that should help deliver such projects on time and within 

costs. Notably, DOE’s performance in meeting cost and schedule 

milestones for nonmajor projects continues to improve, with nearly 95 

percent of such projects meeting cost and schedule milestones over the 

last 3 years, according to DOE officials.

DOE did not meet the criterion for having the capacity to mitigate risks 

with project and contract management. The department has long faced 

challenges in ensuring it has the right number of qualified individuals in 

crucial oversight areas. For example, we first noted capacity shortfalls in 

the department’s contract management in our 1994 high-risk report. At 

that time, we noted that the department did not have the necessary staff 

expertise and information systems to monitor contractors. In our February 

2015 high-risk report, we found that DOE did not meet this criterion and 

noted that an internal DOE review determined that the department had an 

extremely low number of contract specialists. We noted in our 2015 highrisk report that DOE had established the Acquisition Fellows Program to 

recruit, acquire, develop, and retain contract specialists, and NNSA had 

signed an agreement with the U.S. Army Corps of Engineers (USACE) to 

supplement NNSA’s capacity needs.

Since 2015, DOE has taken the following steps to improve capacity:

• DOE increased its number of contract specialists by 4, from 550 to 

554. In November 2016, DOE officials told us that the department still 

faces shortfalls of contract specialists. They noted that there are 

statutory caps on the number of staff DOE can hire.

Capacity
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 453 GAO-17-317 High-Risk Series

• The Acquisition Fellows Program’s first class of 11 participants is 

expected to graduate in January 2017. DOE is analyzing lessons 

learned from the program’s first cohort and determining ways to 

improve the program for the second cohort.

• NNSA officials stated that they continue to use USACE specialists 

because it helps NNSA manage its workload within the statutory 

workforce caps. DOE officials also stated that, on the basis of a 

USACE staffing model, NNSA recently increased the number of staff 

on certain major projects, in some cases more than doubling the 

number of staff responsible for project management activities.

Even with these recent steps, capacity challenges remain. The

Secretary’s December 2014 and June 2015 memorandums—which DOE 

has stated serve as its corrective action plan—were generally silent on 

capacity issues. The Secretary’s memorandums required the department 

to create a Project Leadership Institute and both the ESAAB and PMRC 

are to evaluate, among other things, issues related to organization and 

staffing if such factors present a risk to a project; however, other capacity 

issues, such as those related to contract oversight, were not explicitly 

addressed.

In several recently issued reports, we found capacity shortfalls in key 

contract management functions, including cost and schedule performance 

evaluation, as well as in oversight of major projects and programs, as 

shown in the following examples:

• In May 2015, we found that NNSA had not determined whether it has 

sufficient, qualified personnel to ensure it used information from CAS 

consistently, which include information on contractors’ cost and 

schedule performance. Federal field office officials raised concerns

that staffing levels and the mix of staff skills may not be adequate to 

use information from CAS to conduct appropriate oversight, potentially 

resulting in NNSA staff over relying on this information without the 

ability to ensure it is reliable.

We recommended, among other things, that DOE assess NNSA’s 

staffing needs to determine whether it has sufficient, qualified 

personnel to conduct oversight activities using information from CAS. 

In 2016, DOE issued a new Supplemental Directive on NNSA Site 

Governance requiring NNSA to develop training for NNSA 

organizations to help them implement the governance model that 

relied on information from CAS for oversight, but it is unclear whether 

this training has been developed and initiated. Moreover, even though 

the supplemental directive does require some staffing assessment by 
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 454 GAO-17-317 High-Risk Series

project, field office, and functional managers, it appears that the scope 

of this staffing assessment may not address all aspects covered by 

the supplemental directive itself.

• In May 2015, we found that DOE faced persistent and significant 

technical and management challenges at its WTP at Hanford and, 

consequently, we recommended that DOE take steps to augment its 

capacity to oversee the contractor. External reviews found that 

technical challenges continue to affect the facilities needed to treat 

radioactive waste, and the extent of the challenges was beyond the 

capacity of DOE to monitor and prevent recurrence. Under the WTP 

construction contract, and as recommended by an external DOE 

advisory group, DOE can employ an owner’s agent to help the 

department review the contractor’s approach to design management 

and mitigate design challenges.

We recommended that DOE enlist the services of another agency or 

external entity to serve as an owner’s agent in reviewing and 

evaluating the WTP contractor’s design and approach to mitigating 

design challenges. Congress also included a provision in the 2016 

NDAA requiring DOE to enlist the services of an owner’s agent who 

was to have certain oversight responsibilities independent of the 

contractor. In 2016, DOE instituted an owner’s representative, but the 

responsibilities of the owner’s representative do not include key 

elements of an owner’s agent’s responsibilities that we discussed in 

our report, such as independence and authority to oversee the 

contractor’s approach to design management.

• In February 2016, we found that the B-61-12 Life Extension Program 

faced staff shortfalls. We reported that NNSA may need about two or 

three times more personnel in the federal program manager’s office to 

ensure sufficient federal oversight. NNSA’s federal program office 

employs about 20 people—8 federal FTEs and about 12 FTEequivalent contractors—to manage NNSA activities. In contrast, the 

Air Force office—the armed service office responsible for air-delivered 

weapons such as the B61—employs about 80 federal FTEs and 

contractors to manage comparable Air Force activities.

• In August 2016, we examined DOE’s use of M&O contracts, and we 

found that one of the main reasons DOE uses this type of contract is 

because it is less burdensome to manage. According to DOE officials, 

such contracts are easier to manage with fewer DOE personnel 

because they are less frequently competed and have broadly written 

scopes of work, among other attributes. A 2013 study found that on 

average each NNSA M&O procurement employee was associated 
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 455 GAO-17-317 High-Risk Series

with about $287 million in contract spending, compared with a federal 

government average of $9 million per procurement employee.

• In November 2016, we found that DOE faced capacity challenges in 

program management. Program management can help ensure that a 

group of related projects and activities are managed in a coordinated 

way to obtain benefits not available from managing them individually. 

This approach helps federal agencies get what they need, at the right 

time, and at a reasonable price. We found that DOE and NNSA had 

not established training programs, such as a career development 

program, for program managers. In contrast, DOE has established a 

training program for project managers, which the department said is 

open to program managers. In the absence of a current DOE or 

NNSA training program for program managers, most of the NNSA 

program managers we interviewed did not have training related to 

program management. As a result, NNSA may have difficulty 

developing and maintaining a cadre of professional, effective, and 

capable program managers. We recommended that DOE establish a 

training program for program managers.

Notably, a new federal law may help NNSA address some of its 

capacity challenges in program management. In December 2016, the 

President signed the Program Management Improvement 

Accountability Act. The act, among other things, requires the Director 

of the Office of Personnel Management, in consultation with the 

Director of the Office of Management and Budget, to issue regulations 

that identify key skills and competencies needed for program and 

project managers; establish a new job series, or update and improve 

an existing job series; and establish a new career path for program 

and project managers. The act also requires that each agency head 

appoint a Program Management Improvement Officer, who must 

develop a strategy for enhancing the role of program managers within 

the agency that includes enhanced training and educational 

opportunities for program managers.

Having capacity—the right people and resources—is necessary to 

mitigate risks, but it is not always sufficient to ensure that risks are 

identified and appropriately addressed. Management must foster a culture 

where staff are encouraged to identify risks and use their expertise to 

proactively mitigate them. In July 2016, we examined DOE’s effort to 

evaluate the environment for raising concerns without fear of reprisal. We 

found, among other things, that DOE used flawed and inconsistent 

methodologies to evaluate the environment for raising safety and other 

concerns and therefore cannot reliably judge its openness or ensure that 

appropriate action is taken in response to evaluation results. We noted 
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 456 GAO-17-317 High-Risk Series

that several factors may limit the use and effectiveness of mechanisms 

for contractor employees to raise concerns and seek whistleblower 

protections. We also found that DOE infrequently used its enforcement 

authority to hold contractors accountable for unlawful retaliation against 

whistleblowers, issuing just 2 violation notices in the past 20 years. 

Additionally, in 2013, DOE determined that it does not have the authority 

to enforce a key aspect of policies that prohibit retaliation for nuclear 

safety-related issues—despite having taken such enforcement actions 

previously.

We made several recommendations, including that DOE independently 

assess the environment for raising concerns, evaluate whether the 

whistleblower pilot program will mitigate challenges with the existing 

program, expedite time frames for clarifying regulations, and clarify 

policies to hold contractors accountable. DOE concurred with most of 

these recommendations. In August 2016, DOE issued a proposed rule to 

change DOE’s nuclear safety rules to clarify the department’s authority to 

assess civil penalties against certain contractors and subcontractors for 

violating the prohibition against retaliating against whistleblowers. The 

comment period closed in September 2016, and DOE is now considering 

the comments that were submitted.

In September 2016, DOE also updated its Order 221.1B that establishes 

the requirements and responsibilities for reporting fraud, waste, and 

abuse. The revised order provides some additional specificity to its Office 

of Inspector General’s role in processing employee allegations and 

provides additional language intended to prohibit contractors from 

deterring or dissuading employees from reporting concerns.

DOE partially met the criterion for having a corrective action plan that 

defines root causes and identifies effective solutions. In issuing two 

memorandums to improve project management, the Secretary required 

project management reforms that—if fully implemented—will help ensure 

that future projects are not affected by the challenges that have persisted 

for DOE’s major projects. According to DOE officials, the memorandums 

serve as DOE’s corrective action plan to address the root causes DOE 

identified in its November 2014 report. DOE codified the memorandums’

reforms in its revised project management order, DOE Order 413.3B, 

which includes instituting best practices we and industry have identified 

for cost estimating, schedule estimating, and applying an analysis of 

alternatives (AOA) framework to the early stages of project planning. 

Action Plan
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 457 GAO-17-317 High-Risk Series

DOE also plans to publish a guide to instruct DOE staff on how to conduct 

an AOA.

We are encouraged by DOE’s project management reforms but note that 

the memorandums and the November 2014 report, as well as associated 

changes to DOE’s project management order, do not fully include all 

important elements of a corrective action plan. For example, these 

documents do not identify goals and performance measures, establish 

milestones and metrics for implementing plan goals, or establish 

processes for reporting progress. In addition, DOE’s corrective action 

plan does not appear to be comprehensive. For example, DOE’s plan 

does not address challenges with (1) acquisition planning for its major 

contracts, (2) the quality of enterprise-wide cost information, or (3) the 

policy on program management. It also does not fully address how DOE 

will apply these new requirements to major legacy projects. Specifically:

• DOE’s corrective action plan does not address acquisition planning for 

its major contracts—a phase during which critical contract decisions 

are made that have significant implications for the cost and overall 

success of an acquisition. In August 2016, we found that DOE did not 

consider acquisition alternatives beyond continuing its longstanding 

M&O contract approach for 16 of its 22 M&O contracts. Without 

considering broader alternatives, DOE cannot ensure that it is 

selecting the most effective scope and form of contract, raising risks 

for both contract cost and performance. The size and duration of 

DOE’s M&O contracts—22 M&O contracts with an average potential 

duration of 17 years, representing almost three-quarters of the 

agency’s spending in fiscal year 2015—underscore the importance of 

planning for each M&O acquisition.

• DOE’s corrective action plan does not address the quality of 

enterprise-wide cost information available to DOE managers and key 

stakeholders. Reliable enterprise-wide cost information is needed to 

identify the cost of activities, to ensure the validity of cost estimates, 

and to provide information to Congress to make budgetary decisions. 

In January 2017, we found that NNSA’s recently developed plan to 

improve and integrate financial data to better understand and 

compare costs across NNSA programs, contractors, and sites did not 

fully incorporate leading strategic planning practices, which limits its 

usefulness as a planning tool as well as the effectiveness of NNSA’s 

effort to provide meaningful financial information to Congress and 

other stakeholders. NNSA’s plan also contains few details for all the 

elements it must include, such as its feasibility assessment, estimated 

costs, expected results, and an implementation timeline. 
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 458 GAO-17-317 High-Risk Series

Consequently, NNSA’s plan does not provide a useful roadmap for 

guiding NNSA’s effort. We recommended that NNSA develop a plan 

for producing cost information that fully incorporates leading planning 

practices. NNSA agreed with our recommendation.

• DOE’s corrective action plan does not address its need for a program 

management policy. For example, in November 2016, we found that 

DOE had not established a department-wide program management 

policy, and that NNSA had cancelled its program management policy 

in 2013 without establishing a new policy in its place. We concluded 

that having a policy that incorporates existing key internal control 

standards and leading industry program management practices may 

help ensure that EM and NNSA program offices are better able to 

achieve their missions, goals, and objectives. For example, in an 

August 2016 report examining NNSA’s plans to build the CMRR, we 

found that the agency had not clarified whether the project would 

satisfy the mission needs of other NNSA and DOE programs.

NNSA might have been better able to clarify this project’s mission 

needs if DOE and NNSA had been operating under a DOE-wide 

program management policy incorporating leading practices. DOE 

and NNSA officials said they recognize the importance of establishing 

a program management policy, but at the time DOE had not taken 

steps to develop such a policy. We recommended that DOE establish 

a program management policy addressing internal control standards 

and leading practices. DOE had no comments on our 

recommendation. After our report was issued, the President signed 

the 2016 Program Management Improvement Accountability Act, also 

requiring the development of standards, policies, and guidelines for 

program and project management across the federal government. As 

required in the act, we will continue to monitor and report on its 

implementation in connection with our biennial high-risk updates, 

including on the effectiveness of the standards, policies, and 

guidelines that will be developed.

• DOE’s corrective action plan also does not fully address how DOE’s 

new requirements will be applied to the department’s major legacy 

projects, which receive billions of dollars in annual funding and often 

present the most intractable project management challenges. For 

example, we found in May 2015 that DOE continues to allow 

construction of certain WTP facilities before designs are 90 percent 

complete and other facilities before establishing updated cost and 

schedule baselines.

This contrasts with DOE’s revised project management order that now 

requires (1) a facility’s design to be at least 90 percent complete 
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 459 GAO-17-317 High-Risk Series

before establishing cost and schedule baselines and (2) cost and 

schedule estimates that meet industry best practices. The WTP is 

DOE’s largest project, and it has faced numerous technical and 

management challenges that have added decades to its schedule and 

billions of dollars to its cost. We recommended in 2015 that DOE 

consider limiting construction for certain waste treatment facilities until 

technical challenges are addressed, but DOE did not implement our 

recommendation. For DOE to fully meet the corrective action criterion, 

it must demonstrate its willingness to apply project management 

reforms to the projects that need them the most.

Moreover, the department still may not understand all of the root causes 

of its contract and project management problems. The most recent 

corrective actions taken by DOE represent the third such cycle since 

2008, and the root causes DOE identified in November 2014 included 

some issues that the department had declared it previously mitigated, 

such as difficulties with front-end planning. Specifically, DOE 

acknowledged in its November 2014 root cause analysis its longstanding 

problems with front-end planning, stating that insufficient front-end 

planning has consistently contributed to DOE projects not finishing on 

budget or schedule.

That root cause analysis also found that more rigorous front-end planning 

and AOA would likely have resulted in DOE selecting different capital 

construction projects for some of its major projects. DOE has taken some 

actions on front-end planning such as requiring that analyses of 

alternatives be conducted in accordance with best practices by an entity 

independent of a project’s chain of command. However, in our prior work 

we found that front-end planning problems persist, indicating that the 

department has either not fully identified the root causes or established 

effective corrective actions to mitigate them. For example:

• In July 2015, we found that NNSA had not followed established 

departmental policy for front-end planning—which requires developing 

a mission need independent of a particular solution—when 

considering how it might replace an aging lithium production facility. 

NNSA included a description of alternatives for addressing its mission 

need, such as building a new facility or outsourcing lithium 

processing, but it also expressed a preference for a particular 

solution—specifically, a new facility, which could cost more than $600 

million and take 8 to 10 years to construct. Expressing such a 

preference before all viable alternatives are considered could 

potentially undermine NNSA’s ability to choose the alternative that 

best satisfies the mission need. We recommended that NNSA 
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 460 GAO-17-317 High-Risk Series

objectively consider all alternatives, without preference for a particular 

solution, as it proceeds with its AOA process. NNSA neither agreed 

nor disagreed with our recommendation.

• In August 2016, we found problems with DOE’s front-end project 

planning at the Waste Isolation Pilot Plant (WIPP) for the new 

permanent ventilation system. This system is being built to enable 

DOE to resume full operations of the geological nuclear waste 

repository, which were suspended after a radiological release 

accident in February 2014. DOE did not follow all best practices in 

analyzing and selecting an alternative for the new ventilation system 

at WIPP, which DOE estimated will cost between $270 million and 

$398 million to build and will be completed by the end of March 2021.

For example, DOE did not select the preferred alternative based on 

assessing the difference between the life-cycle costs and benefits of 

each alternative, as called for by best practices and required by 

DOE’s revised project management order. We recommended that 

DOE require projects, including the WIPP ventilation system, to 

implement recommendations from independent AOA reviews or 

document the reasons for not doing so. DOE concurred with the 

recommendation and planned to incorporate guidance in its updated 

project review guide on how DOE offices should address 

recommendations from independent reviews.

DOE made significant efforts to improve its performance in monitoring 

and independently validating the effectiveness and sustainability of 

corrective measures and now partially meets our monitoring criterion. 

Changes DOE has made are important and can substantively improve 

how DOE oversees and executes its major projects and programs. We 

have not evaluated the effectiveness of the new monitoring measures 

because it will take time for DOE to employ them, and we note that they 

do not cover all aspects of contract management or certain EM activities 

and depend upon the availability of reliable enterprise-wide cost 

information.

The Secretary has instituted the following measures to improve 

monitoring:

• The Secretary improved the department’s senior-level monitoring 

capability by establishing the PMRC and strengthening the ESAAB, 

enhancing DOE’s ability to monitor its projects by conducting regular 

and more frequent reviews, among other things. The PMRC is 

comprised of the department’s leading project management experts, 

Monitoring
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 461 GAO-17-317 High-Risk Series

and it meets on a biweekly basis. According to DOE officials, during 

2015, the committee reviewed 19 project milestones, 2 proposals for 

updating major projects’ cost and schedule, and received 15 briefings 

from independent project review teams. Also in 2015, the PMRC 

reviewed multiple major projects, such as the Uranium Processing 

Facility (UPF), the MOX facility, the CMRR project, WTP, and the Salt 

Waste Processing Facility. The PMRC also prepared information on 

these projects for ESAAB meetings in which most of these major 

projects were discussed. In addition, according to senior DOE 

officials, the PMRC focuses on all elements of project risk, not just 

those elements related to DOE’s project management order but also 

projects’ contract terms and regulatory compliance.

• DOE has included the role of the PMRC in its updated project 

management order, issued in May 2016, and created the CRO 

position, which DOE plans to institutionalize. The CRO’s primary 

function is to independently oversee capital asset projects and alert 

the Secretary to any particular risks that may threaten projects’ ontime or on-budget delivery.

• DOE enhanced oversight of projects during the commissioning 

phase—the phase after construction is complete but before 

operations begin. DOE did so in response to its experience with the 

Sodium-Bearing Waste Treatment Facility at its Idaho site. In March 

2016, DOE’s Office of Inspector General found major design and 

construction problems during the commissioning phase of this facility. 

The Inspector General’s investigation found that DOE had moved the 

scope of work associated with the comprehensive performance test, 

which demonstrates that the facility would perform its mission as 

designed, from the construction phase of the project to the operations 

phase of the project. The project modification prevented DOE from 

rigorously testing the facility before construction was declared 

complete. The Inspector General’s investigation concluded that the 

total actual construction cost for this facility was likely understated by 

about $181 million, and additional future costs to make the facility 

operational could exceed $40 million.

In August 2016, DOE senior management created a new “operational 

release” phase of project management that applies to the time frame. 

During this phase, program offices must continuously oversee 

projects. The program offices are required to develop and execute a 

detailed plan to attain full operational capability and to provide 

quarterly progress updates to senior decision makers and the PMRC 

until full operational capability is attained. DOE officials stated that the 

first project in the commissioning phase to be reviewed by the PMRC 
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 462 GAO-17-317 High-Risk Series

will be the Sodium-Bearing Waste Treatment Facility. Officials also 

stated that the department intends to provide guidance to project 

managers through a new Commissioning Guide to be issued in fiscal 

year 2017.

• DOE established project assessment offices, independent of line 

management, which review projects at least annually. Through a May 

2015 memorandum, NNSA elevated its Office of Project Assessment 

to report directly to the Under Secretary, increasing the prominence of 

this function and the likelihood that problems, if encountered, will 

receive senior-level attention within NNSA. According to EM officials, 

EM uses its Office of Project Management to conduct regular 

independent project reviews for projects under $100 million, and since 

July 2016, DOE’s Office of Project Management, Oversight, and 

Assessments has reviewed EM projects with a cost greater than $100 

million.

DOE officials stated that DOE’s Office of Project Management, 

Oversight, and Assessments follows up monthly with the EM project 

teams to make sure they implement its recommendations. We will 

continue to assess whether these offices effectively conduct project 

assessments and other independent reviews. In August 2016, while 

reviewing the WIPP recovery, we found that DOE did not follow a 

recommendation from an independent review and selected an 

alternative without conducting a cost-benefit analysis, as suggested 

by industry best practices. We recommended that DOE revise its 

Order 413.3B to require DOE offices either to implement 

recommendations from independent reviews or justify and document 

the rationale for not doing so. DOE concurred with our 

recommendation.

• DOE established new and enhanced data systems for project data 

and documentation. In October 2016, DOE officials stated that the 

department improved its Earned Value Management System—a tool 

that measures the value of completed work against the planned work 

schedule and estimated cost—to enhance receipt of accurate and 

reliable information, and enhanced its Project Assessment and 

Reporting System II—its central repository and system of record for 

contractor’s cost and schedule performance data. Nevertheless, DOE 

does not have current cost and schedule baselines for certain major 

projects, limiting the department’s ability to monitor cost and schedule 

performance. For example, NNSA has not updated the cost and 

schedule baseline for the MOX facility since 2012, even though DOE’s 

current cost estimates show a cost increase of approximately $10 

billion. For the WTP, DOE does not have a current cost baseline for 
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 463 GAO-17-317 High-Risk Series

key waste treatment facilities. DOE’s cost performance data shows 

that the approved total project cost of $16.8 billion is underestimated, 

and a senior DOE official recently informed Congress that the WTP’s 

cost will increase significantly.

DOE’s efforts to improve monitoring are encouraging, but additional time 

is needed for us to assess how effectively these recent monitoring 

improvements will validate the sustainability of corrective measures. We 

have not yet evaluated the operations of the PMRC, but according to its 

charter this committee serves in an advisory role to the ESAAB and the 

programs, while the program offices remain responsible for delivering 

projects. DOE officials stated that the PMRC provides a list of its 

recommendations for the ESAAB meetings, but DOE does not track 

which PMRC recommendations are implemented. In our ongoing work, 

we have identified an example that raises questions about whether the 

programs are following the guidance of the PMRC. For the Tank Waste 

Characterization and Staging facility at Hanford, DOE estimated a cost 

range of $390 million to $690 million. However, we reported in May 2015 

that this cost range was not reliable. We also found that EM officials had 

estimated that the cost for this facility would range from $1 billion to $1.5 

billion, making it a major project and subject to more rigorous oversight 

requirements. The PMRC reviewed the cost estimates showing that this 

facility should be classified as a major project, but the program office 

responsible for the facility did not modify the cost range for the project at 

inception, raising questions about the extent of the PMRC’s influence.

DOE’s new oversight and monitoring efforts are not comprehensive, as 

certain activities within EM are not subject to review by the PMRC, even 

though together they cost billions of dollars and last for numerous years. 

Specifically, the PMRC does not review the cost and schedule 

performance of operations activities within EM. These operations 

activities include programs such as groundwater treatment at the Hanford 

site, which has annually cost between about $140 million and $185 million 

in recent years.

Moreover, some of these activities are not covered by the requirements of 

DOE’s revised project management order and have experienced 

problems similar to DOE’s major projects. For example, in August 2016, 

we reported that DOE’s protocol that governs EM cleanup operations 

does not require EM to use industry best practices in developing cost and 

schedule estimates, as DOE’s project management order does. We found 

that DOE’s recovery activities to start WIPP waste disposal operations—

which are considered EM operations activities—incurred a cost increase 
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 464 GAO-17-317 High-Risk Series

of about $64 million and a schedule delay of nearly 9 months, in part 

because DOE’s initial estimates to complete the recovery activities did not 

follow all best practices and were therefore unreliable. Notably, DOE 

estimated it would restart waste operations based on a schedule that 

gave DOE less than a 1 percent chance of meeting its restart date. We 

recommended that EM revise its protocol to require it to use best 

practices in developing cost and schedule estimates. DOE concurred with 

our recommendation and stated that EM plans to transition from the 

operations activities protocol to a new directive for operations activities, 

which will include guidance on using cost and schedule best practices.

Finally, the effectiveness of DOE’s monitoring of its contracts, projects, 

and programs depends upon the availability of reliable enterprise-wide 

cost information on which to base oversight activities. Such information is 

needed to, among other things, identify the costs of activities and ensure 

the validity of its cost estimates. However, meaningful cost analysis—

including comparisons across programs, contractors, and sites—is not 

possible because NNSA’s contractors use different methods of 

accounting for and tracking costs. NNSA developed a plan to improve 

and integrate its cost reporting structures; however, we found in our 

January 2017 report that the plan did not provide a useful roadmap for 

guiding NNSA’s effort. Until a plan is in place that incorporates leading 

strategic planning practices, NNSA cannot be assured that its efforts will 

result in a cost collection tool that produces reliable enterprise-wide cost 

information that satisfies the information needs of Congress and program 

managers, and enables DOE to effectively monitor its progress in 

improving how it manages its contracts and programs.

As noted earlier, DOE implemented a series of changes to policies and 

procedures to improve project management, but the department does not 

yet meet the criterion for demonstrating progress. DOE’s recent reforms 

are in the early stages, and more time is needed to assess the 

effectiveness of corrective measures and associated progress, especially 

with respect to ongoing major projects. DOE has taken significant actions 

regarding two of its six ongoing major projects but continues to encounter 

significant project management challenges, cost increases, and schedule 

delays on others. In addition, DOE’s recent reforms do not address 

contract management, and our work since the last high-risk report has 

identified several significant challenges with DOE contract management 

on which DOE has taken little action.

Demonstrated Progress
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 465 GAO-17-317 High-Risk Series

For two major projects, DOE has taken significant steps to address cost 

and schedule problems. For example, NNSA proposed, in its fiscal year 

2017 budget request, to terminate the MOX project and pursue an 

alternative path for disposing of plutonium, under which DOE would dilute 

plutonium for disposal in a geologic repository. For the UPF, NNSA has 

cancelled its plans for a large uranium facility, and proposed to use both 

existing and new smaller facilities and new technologies to meet its 

needs. It is too early to determine the effects of these changes. DOE has 

not developed a complete, reliable cost estimate for its new approaches 

at the MOX or UPF facilities. NNSA officials believe the new approaches 

will allow the agency to meet its mission needs at lower costs to the 

taxpayer.

Our recent work has identified continuing challenges for two major 

projects that DOE’s recent project management reforms in theory should 

have addressed. For example,

• In May 2015, we found that DOE continues with its design build 

approach at the WTP, which is not consistent with DOE’s revised 

project management order. DOE’s revised project management order 

requires a facility’s design to be at least 90 percent complete before 

establishing cost and schedule baselines. We found that construction 

had outpaced design at some facilities at WTP, and external reviews 

had identified hundreds of vulnerabilities in the waste treatment 

facilities after assessing only half of the facilities’ systems. However, 

EM has not applied DOE’s requirement to the WTP. We 

recommended that DOE (1) limit construction on the WTP until risk 

mitigation strategies are developed to address known technical 

challenges, and (2) determine the extent to which the quality problems 

exist, in accordance with its quality assurance policy, for the facilities’

systems that have not been reviewed to determine if additional 

vulnerabilities exist. DOE neither agreed nor disagreed with these 

recommendations and has not implemented them.

• In August 2016, we found that DOE did not follow project 

management requirements in its front-end planning for an alternative 

to the CMRR project. After spending $450 million designing the 

project, NNSA reversed its decision to build a large nuclear facility 

because of projected excessive cost growth. Instead, NNSA revised 

the CMRR project to use existing and smaller new facilities. We found 

that NNSA defined requirements for the new project without specifying 

the capacity for analyzing plutonium that the project should provide, 

as required in DOE’s project management order. We made several 

recommendations, including that NNSA identify the capacity for 
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 466 GAO-17-317 High-Risk Series

analyzing plutonium for the revised CMRR project. NNSA neither 

agreed nor disagreed with the recommendations.

As noted earlier, DOE’s corrective action plan does not address problems 

with DOE’s oversight of major contracts. These problems have been 

longstanding. For example, we noted in 1991 that DOE lacked assurance 

that its oversight and control of contract expenditures will deter and detect 

potential fraud, waste, and abuse. In addition to the contract management 

issues noted earlier, such as acquisition planning for major contracts and 

the quality of enterprise wide-cost information, our recent work identifies 

additional challenges DOE continues to face in contract management. In 

May 2015, we found that NNSA had not established policies or guidance 

specific to using information from CAS to evaluate M&O contractor 

performance. NNSA did not have policy or guidance on how or to what 

extent NNSA officials should use information from CAS in evaluating 

M&O contractors’ performance. We recommended that NNSA revise its 

policy, guidance, and procedures for evaluating performance to fully 

address how and under what circumstances those responsible for 

evaluating M&O contractors’ performance should use information from 

CAS. NNSA agreed with this recommendation and revised the policy in 

2016. NNSA also created a website and held a summit to share CAS 

lessons learned and strengthen the CAS community of practice. 

However, NNSA has not established comprehensive guidance for 

implementing this policy consistently.

Even though we removed nonmajor projects from our High-Risk List, we 

continue to monitor how DOE manages these projects to ensure that 

DOE sustains progress in this area. We note that the Secretary’s 

December 2014 and June 2015 memorandums applied project 

management reforms to nonmajor projects previously not subject to such 

requirements, and DOE’s performance in meeting cost and schedule 

milestones for nonmajor projects continues to improve, with nearly 95 

percent of such projects meeting cost and schedule milestones over the 

last 3 years, according to DOE officials. Our recent work, however, shows 

that several nonmajor projects exhibit some of the challenges that have 

long persisted for DOE’s major projects, such as incomplete front-end 

planning and unreliable cost and schedule estimates, which means that 

nonmajor projects still warrant our observation.

For example, in May 2015, we found that DOE had unreliable cost and 

schedule estimates for constructing two proposed facilities that are 

considered separate, nonmajor projects at the Hanford site’s WTP. These 

facilities are (1) a pretreatment system to treat some of the low-activity 
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 467 GAO-17-317 High-Risk Series

waste in the tanks and (2) a tank waste characterization and staging 

facility to stage, mix, sample, and characterize high-level waste from the 

tanks prior to delivery to the pretreatment facility. They have a combined 

total estimated cost of $633 million to at least $1 billion. We found DOE 

excluded from its estimates the costs of some major activities necessary 

to construct these facilities, and did not sequence activities to complete 

them in accordance with schedule estimating best practices. We 

recommended, among other things, that DOE revise cost and schedule 

estimates for these two facilities in accordance with industry best 

practices. DOE generally agreed with our recommendations but has not 

yet implemented them.

In 2014, we reviewed DOE’s request for fiscal year 2015 funding for the 

WTP. We found that DOE requested an additional $23 million for the 

design of a system to address technical problems the WTP had recently 

encountered. We noted that because engineering and construction at key 

WTP facilities had been stalled or slowed in fiscal year 2013, it was 

unclear whether DOE needed the full funding for WTP plus the additional 

amount to address technical problems. In the fiscal year 2015 

appropriations bill, Congress provided $667 million for work at the WTP, 

which was $23 million less than DOE’s budget request for the WTP for 

that year.

DOE achieved some benefits by implementing several of our 

recommendations in fiscal years 2015 and 2016. Specifically

• DOE instituted requirements for projects and programs to follow costestimating best practices.

• DOE instituted requirements for projects and programs to follow 

analysis of alternatives best practices.

• DOE analyzed root causes of the Plutonium Disposition Program cost 

increases and instituted a department-wide requirement for root cause 

analysis of cost and schedule breaches.

• DOE’s Office of Environmental Management developed a 

consolidated workforce plan.

• DOE provided independent reviews of nonmajor projects, and defined 

and tracked performance targets for nonmajor projects.

For additional information about this high-risk area, contact David Trimble 

at (202) 512-3841 or trimbled@gao.gov.

Benefits Achieved 

from Implementing 

Our 

Recommendations

GAO Contact
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 468 GAO-17-317 High-Risk Series

National Nuclear Security Administration: A Plan Incorporating Leading 

Practices Is Needed to Guide Cost Reporting Improvement Effort, 

GAO-17-141, Washington, D.C.: January 19, 2017.

Program Management: DOE Needs to Develop a Comprehensive Policy 

and Training Program. GAO-17-51. Washington, D.C.: November 21, 

2016.

Department of Energy: Actions Needed to Strengthen Acquisition 

Planning for Management and Operating Contracts. GAO-16-529. 

Washington, D.C.: August 9, 2016.

DOE Project Management: NNSA Needs to Clarify Requirements for Its 

Plutonium Analysis Project at Los Alamos. GAO-16-585. Washington, 

D.C.: August 9, 2016.

Nuclear Waste: Waste Isolation Pilot Plant Recovery Demonstrates Cost 

and Schedule Requirements Needed for DOE Cleanup Operations. 

GAO-16-608. Washington, D.C.: August 4, 2016.

Department of Energy: Whistleblower Protections Need Strengthening. 

GAO-16-618. Washington, D.C.: July 11, 2016.

Department of Energy: Observations on Efforts by NNSA and the Office 

of Environmental Management to Manage and Oversee the Nuclear 

Security Enterprise. GAO-16-422T. Washington, D.C.: February 23, 2016.

Nuclear Weapons: NNSA Has a New Approach to Managing the B61-12 

Life Extension, but a Constrained Schedule and Other Risks Remain. 

GAO-16-218. Washington, D.C.: February 4, 2016.

DOE Project Management: NNSA Should Ensure Equal Consideration of 

Alternatives for Lithium Production. GAO-15-525. Washington, D.C.: July 

13, 2015.

Department of Energy: Actions Needed to Improve DOE and NNSA 

Oversight of Management and Operating Contractors. GAO-15-662T. 

Washington, D.C.: June 12, 2015.

National Nuclear Security Administration: Actions Needed to Clarify Use 

of Contractor Assurance Systems for Oversight and Performance 

Evaluation. GAO-15-216. Washington, D.C.: May 22, 2015.

Related GAO 

Products
DOE’s Contract Management for the National 

Nuclear Security Administration and Office of 

Environmental Management

Page 469 GAO-17-317 High-Risk Series

Hanford Waste Treatment: DOE Needs to Evaluate Alternatives to 

Recently Proposed Projects and Address Technical and Management 

Challenges. GAO-15-354. Washington, D.C.: May 7, 2015.

National Nuclear Security Administration: Observations on Management 

Challenges and Steps Taken to Address Them. GAO-15-532T. 

Washington, D.C.: April 15, 2015.

National Nuclear Security Administration: Reports on the Benefits and 

Costs of Competing Management and Operating Contracts Need to Be 

Clearer and More Complete. GAO-15-331. Washington, D.C.: March 23, 

2015.

Nuclear Waste: DOE Needs to Improve Cost Estimates for Transuranic 

Waste Projects at Los Alamos. GAO-15-182. Washington, D.C: February 

18, 2015.
NASA Acquisition Management

Page 470 GAO-17-317 High-Risk Series

The National Aeronautics and Space Administration (NASA) plans to 

invest billions of dollars in the coming years to explore space, understand 

Earth’s environment, and conduct aeronautics research. We designated 

NASA’s acquisition management as high risk in 1990 in view of NASA’s 

history of persistent cost growth and schedule delays in the majority of its 

major projects. Our work has shown that NASA has made progress over 

the past 5 years in a number of key acquisition management areas, but it 

faces significant challenges in some of its major projects largely driven by 

the need to improve the completeness and reliability of its cost and 

schedule estimating, estimating risks associated with the development of 

its major systems, and managing to aggressive schedules.

NASA has continued to strengthen and integrate its acquisition 

management functions, resulting in the agency continuing to meet three 

criteria for removal from our High-Risk List: leadership commitment, a 

corrective action plan, and monitoring. For example, NASA has 

established metrics to monitor progress in improving acquisition 

management, and in recent years, we have found that many of the 

projects within the agency’s major project portfolio have improved their 

cost and schedule performance.1 NASA’s metrics include cost and 

schedule performance indicators and we have found that NASA’s 

performance metrics generally reflect improved performance. These 

actions have helped NASA to create better baseline estimates and track 

performance such that NASA has been able to launch more projects on 

time and within cost estimates.

Although NASA has taken steps toward meeting our criteria for capacity 

by issuing guidance and implementing tools to reduce acquisition risk, our 

reviews have found that these efforts have not always been consistent 

with best practices in areas such as cost and schedule estimating and 

earned value management (EVM). Finally, while the agency has taken 

steps to demonstrate progress toward improving acquisition outcomes 

overall, we found that NASA continues to face significant challenges in its 

ability to manage and oversee its most expensive and complex projects, 

most notably its human spaceflight development programs. NASA must 

ensure that it conducts adequate and ongoing assessments of risks and 

 1

GAO, NASA: Assessments of Major Projects, GAO-16-309SP (Washington, D.C.: Mar. 

30, 2016); NASA: Assessments of Selected Large-Scale Projects, GAO-15-320SP 

(Washington, D.C.: Mar. 24, 2015); and NASA: Assessments of Selected Large-Scale 

Projects, GAO-14-338SP (Washington, D.C.: Apr. 15, 2014).

NASA Acquisition Management

Why Area Is High 

Risk

What GAO Found
NASA Acquisition Management

Page 471 GAO-17-317 High-Risk Series

understands the long-term costs for its larger human exploration 

programs, as the effects of any potential miscalculations could be felt 

across NASA’s portfolio. Such efforts should help maximize 

improvements and to demonstrate that the improved cost and schedule 

performance will be sustained, even for the agency’s most expensive and 

complex projects.

In our 2015 high-risk update, we found that NASA has satisfied our highrisk criteria for the areas of leadership commitment, monitoring, and an 

action plan.2 We believe NASA’s progress in these areas is reflected in 

the improved cost and schedule performance of NASA’s portfolio of major 

acquisition projects, which includes projects with a life-cycle cost of more 

than $250 million. For example, in 2016, overall development cost growth 

for the portfolio of 12 development projects fell to 1.3 percent and launch 

delays averaged 4 months.3 Both of these measures are at or near the 

lowest levels we have reported since we began our annual assessments 

in 2009.4 These measures exclude the James Webb Space Telescope 

(JWST), which NASA rebaselined in September 2011 with significant cost 

 2

GAO, High-Risk Series: An Update, GAO-15-290 (Washington, D.C.: Feb. 11, 2015).

3

GAO-16-309SP. 

4

The explanatory statement of the House Committee on Appropriations accompanying the 

Consolidated Appropriations Act of 2008 directed us to prepare project status reports on 

selected large-scale NASA programs, projects, or activities—which we began in 2009. 

Each assessment is presented in a two-page summary that analyzes the project’s cost 

and schedule status and project challenges. We also provide general observations about 

the performance of NASA’s major projects and the agency’s management of those 

projects during development.
NASA Acquisition Management

Page 472 GAO-17-317 High-Risk Series

increase and schedule delays.5 As of December 2016, we found that 

program continues to meet its revised cost and schedule commitments.6

NASA manages a portfolio of projects that will always have inherent 

technical, design, and integration risks because its projects are complex, 

specialized, and often push the state of the art in space technology. 

NASA has already taken steps to reduce acquisition risk from both a 

technical and management standpoint. The next few years will certainly 

test the extent to which these measures have taken hold in NASA’s 

largest programs. However, more needs to be done with respect to 

anticipating and mitigating risks—especially with regard to large 

programs, estimating and forecasting costs for its largest projects, and 

implementing management tools. Actions that will be critical to improving 

NASA’s acquisition outcomes include the following:

• Ensure that NASA conducts adequate and ongoing assessments of 

risks for larger programs—JWST, Space Launch System (SLS), Orion 

Multi-Purpose Crew Vehicle (Orion), and Exploration Ground Systems 

(EGS)—especially since each of these programs is at a different 

critical point in development and implementation, and the impacts of 

any potential miscalculations will be felt across NASA’s portfolio.

• Ensure that NASA understands long-term human exploration program 

costs. While the three major exploration programs have been 

baselined, none of the three programs have a baseline that covers 

activities beyond the second planned flight. Long-term estimates, 

which could be revised as potential mission paths are narrowed and 

selected, would provide decision makers with a more informed 

 5

NASA projects are rebaselined when their estimated development cost exceeds NASA’s 

baseline commitment development cost by 30 percent or more and Congress has 

reauthorized the project; events external to NASA make a rebaseline appropriate; or a 

NASA associate administrator determines that the project’s scope changed from the 

approved project baseline. NASA rebaselined the JWST program in 2011 with an 

estimated cost of $8.8 billion—a 78 percent increase over its fiscal year 2009 baseline—

and a planned launch date of October 2018, a 52-month delay from its baseline. We 

excluded JWST cost and schedule growth from the calculations of the portfolio because 

including its cost and schedule growth masks any changes in the rest of the portfolio, as 

the magnitude of JWST, in terms of both schedule and cost growth, is larger than the 

other projects in the portfolio that are in implementation.

6

GAO, James Webb Space Telescope: Project Meeting Cost and Schedule Commitments 

but Continues to Use Reserves to Address Challenges, GAO-17-71 (Washington, D.C.: 

Dec. 7, 2016).

What Remains to Be 

Done
NASA Acquisition Management

Page 473 GAO-17-317 High-Risk Series

understanding of costs and schedules associated with potential 

agency development paths.

• Ensure that the Orion program analyzes the cost of deferred work in 

relation to levels of management reserves and unallocated future 

expenses, and actual contractor performance, and report the results 

of that analysis to NASA management.

• Ensure that rebaselined projects report cost and schedule growth 

from original baselines in order to provide stakeholders and Congress 

with a more accurate view of project performance and to enhance 

accountability.

• Ensure that program offices regularly and consistently update their 

Joint Cost and Schedule Confidence Levels (JCL) across the 

portfolio.7 As a project reaches the later stages of development, 

especially integration and testing, its risk posture may change. An 

updated project JCL would provide both project and agency 

management with data on relevant risks that can guide project 

decisions.

• Ensure that NASA continues its efforts to build capacity in areas such 

as cost and schedule estimating, and measuring contractor 

performance.

• Revisit schedules to ensure programs have fully considered the 

effects of managing programs in order to meet aggressive schedule 

dates.

Our ongoing work assessing Commercial Crew, EGS, Orion, SLS, JWST, 

and the performance of the portfolio as a whole will provide insight into 

how well NASA is performing over the next several years.

We determined in our 2015 update that NASA had met our criteria in the 

area of leadership commitment, which the agency continues to meet. We 

believe that the agency’s efforts in this area—including the strengthening 

of its acquisition policy and oversight functions—have resulted in 

 7

The JCL is a point in time estimate that, among other things, includes all cost and 

schedule elements, and incorporates and quantifies known risks that support each 

program’s acquisition baseline.

Additional Details on 

What GAO Found

Leadership Commitment
NASA Acquisition Management

Page 474 GAO-17-317 High-Risk Series

improvement of major acquisition projects’ cost and schedule 

performance.

NASA has partially met our high-risk criteria for capacity. While NASA has 

taken steps to issue guidance and implement tools to reduce acquisition 

risk, our reviews have found that these efforts have not always been 

consistent with best practices in areas such as estimating costs and 

schedules and EVM surveillance.

In February 2015, NASA published a new version of its Cost Estimating 

Handbook that includes an appendix on JCL analysis. But NASA does not 

require its projects to update JCLs. Our prior work has found that projects 

do not regularly update cost risk analyses to take into account newly 

emerged risks. Our Cost Estimating and Assessment Guide recommends 

that cost estimates should be updated to reflect changes to a program or 

kept current as it moves through milestones. 8 As new risks emerge for a 

project, updating the cost risk analysis can provide realistic estimates to 

decision makers, including Congress.

Further, we have found that NASA’s three costliest acquisition 

programs—JWST, SLS, and Orion—did not fully follow best practices 

when developing their JCLs. For example, in July 2016 we found that the 

Orion program’s cost estimate met or substantially met 7 of 20 best 

practices and its schedule estimate met only 1 of 8 best practices.9 The 

cost estimate lacked necessary support and the schedule estimate did 

not include the level of detail required for high-quality estimates. Without 

sound cost and schedule estimates, decision makers do not clearly 

understand the cost and schedule risk inherent in the program and lack 

important information they need to make programmatic decisions. In 

October 2015, NASA decided to decentralize its independent assessment 

function and deploy the staff to the agency’s centers, in part, to better use 

its workforce to meet program needs in areas such as program 

management, cost estimating, and resource analysis, and to fill gaps in 

program analysis skills at the center level. It is too early to tell whether 

this change will address skills gaps and ultimately improve the quality of 

 8

GAO, GAO Cost Estimating and Assessment Guide: Best Practices for Developing and 

Managing Capital Program Costs, GAO-09-3SP (Washington, D.C.: Mar. 2, 2009).

9

GAO, Orion Multi-Purpose Crew Vehicle: Action Needed to Improve Visibility into Cost, 

Schedule, and Capacity to Resolve Technical Challenges, GAO-16-620 (Washington, 

D.C.: July 27, 2016).

Capacity
NASA Acquisition Management

Page 475 GAO-17-317 High-Risk Series

JCLs in the future as programs will need to hold reviews under this 

organization of the assessment function, and compare those reviews to 

actuals in order to assess the change.

NASA has made progress implementing EVM analysis—another key 

project management tool— but the agency has not yet fully implemented 

a formal EVM surveillance plan in accordance with best practices. NASA 

has made significant progress rolling out EVM to its centers and 

supported these efforts with training, including classroom and online 

training to projects. In November 2012, we recommended that NASA 

update its procedural requirements to include a formal EVM surveillance 

program in order to improve the reliability of EVM data collected by NASA 

programs.10 While NASA agreed with our conclusion that EVM data 

reliability needed improvement, it has yet to implement a formal 

surveillance requirement due to resource constraints. In our December 

2015 review of JWST, we found EVM data anomalies and recommended 

that project officials require the contractors to explain and document all 

such anomalies in their monthly EVM reports.11 A continuous surveillance 

program could have identified these anomalies earlier, allowing the 

project to pursue corrective action with its contractors. NASA has since 

implemented this recommendation for the JWST program. Proper 

surveillance of EVM contractor data is a best practice in the NASA 

Earned Value Management Handbook and our Cost Estimating and 

Assessment Guide.12

In our 2015 high-risk update, we found that NASA had satisfied our highrisk criteria for an action plan and it continues to do so. NASA, which 

reports its action plan metrics to us on a semiannual basis, continues to 

perform within the parameters outlined in the plan—such as meeting 

metrics for cost and schedule performance, and mission success 

measures. These and other steps have enabled NASA to launch more 

projects on time and within cost estimates.

 10GAO, NASA: Earned Value Management Implementation across Major Spaceflight 

Projects Is Uneven, GAO-13-22 (Washington, D.C.: Nov. 19, 2012).

11GAO, James Webb Space Telescope: Project on Track but May Benefit from Improved 

Contractor Data to Better Understand Costs, GAO-16-112. (Washington, D.C.: Dec. 17, 

2015).

12GAO-09-3SP.

Action Plan
NASA Acquisition Management

Page 476 GAO-17-317 High-Risk Series

We found in 2015 that NASA had met our high-risk criteria for monitoring 

and it continues to do so. NASA has established metrics to monitor 

progress in improving acquisition management, and we have found that 

those metrics generally reflect improved performance. The NASA 

Systems Engineering Handbook includes several technical indicators for 

design maturity, and the agency’s project management policy and 

systems engineering policy have been updated to require projects to track 

these metrics. In March 2016, we found that NASA had sustained prior 

improvement in design stability for its major acquisition projects.13

NASA has partially met our criteria for demonstrating progress. The 

agency has taken steps to improve acquisition outcomes, but we continue 

to find that the agency faces significant challenges in its ability to manage 

and oversee its most expensive and complex projects, most notably 

regarding human spaceflight development. Other programs demonstrate 

that NASA continues to face challenges accurately estimating or quickly 

responding to risks. Also, NASA inconsistently reports on the 

performance of some programs, which masks the full extent of cost and 

schedule growth.

Together, NASA’s three human spaceflight efforts constitute more than 

half of NASA’s portfolio development cost baseline, and helped make the 

2016 portfolio the most expensive collection of NASA projects in 

development since we began our annual assessment in 2009. Although 

NASA’s human spaceflight programs are generally better positioned for 

success than the agency’s most recent effort to replace the space shuttle, 

managing weaknesses—including unreliable cost estimating, overly 

ambitious internal deadlines, limited reserves, and operating for extended 

periods of time without definitized contracts—have increased the 

likelihood that it will incur overruns and schedule delays, particularly when 

coupled with the broad array of technical risks that are inherent in any 

human spaceflight development.

Moreover, all three human spaceflight projects will be significantly 

challenged in the next 2 years as NASA aims to launch its first exploration 

mission by November 2018. This mission, which will not have a crew, will 

fly some 70,000 kilometers beyond the moon—using the SLS launch 

vehicle, Orion, and EGS. During this time, the human spaceflight 

 13GAO-16-309SP.

Monitoring

Demonstrated Progress
NASA Acquisition Management

Page 477 GAO-17-317 High-Risk Series

programs will need to resolve a multitude of technical and design 

challenges, complete fabrication and testing, and be delivered to the 

Kennedy Space Center where they will be integrated with each other and 

prepared for launch. Numerous activities along this development path are 

sequential and cannot be rearranged to gain back time lost from prior 

delays. Other activities can be deleted or performed concurrently, but not

without more risk to the program. If delays materialize during individual 

systems integration and testing, they could cause a cascading effect of 

cross-program problems. NASA has already made these later phases 

more complicated by postponing key activities in order to keep pace with 

internal deadlines. In addition, because the agency will be in the final 

throes of other major programs, such as JWST, senior leaders’ attention 

may be divided amongst many programs in the months leading up to the 

first exploration mission.

Examples of management risk for human spaceflight programs that we 

have recently identified include:

• As we found in July 2016, each program manages to an aggressive 

internal NASA launch readiness date, which creates an environment 

for programs to make decisions based on reduced knowledge to meet 

a date that is not realistic.14 For example, the EGS program has 

consolidated future schedule activities to prepare the mobile 

launcher—the vehicle used to bring SLS to the launch pad—to meet 

this internal goal. The program acknowledged that consolidating 

activities—which includes conducting verification and validation 

concurrent with installation activities—increases risk because of 

uncertainties about how systems not yet installed may affect the 

systems already installed. Officials added, however, that this 

concurrency is necessary to meet the internal schedule.

• All three programs are operating with limited cost reserves, which limit 

each program’s ability to address risks and unforeseen technical 

challenges. For example, we found in July 2016 that the Orion 

program will maintain very low levels of annual cost reserves until 

2018.15 The lack of currently available cost reserves has caused the 

program to defer work to address technical issues to stay within 

 14GAO, NASA Human Space Exploration: Opportunity Nears to Reassess Launch Vehicle 

and Ground Systems Cost and Schedule, GAO-16-612 (Washington, D.C.: July 27, 2016), 

and GAO-16-620.

15GAO-16-620.
NASA Acquisition Management

Page 478 GAO-17-317 High-Risk Series

budget. As a result, the Orion program’s reserves in future years 

could be overwhelmed by deferred work—a practice that contributed 

to the rebaseline of the JWST program, which included a $3.6 billion 

cost increase and a 52-month schedule delay.

• We found in July 2016 that the SLS program has not positioned itself 

well to accurately assess progress with the core stage—SLS’s 

structural backbone and fuel tank—because it did not have a 

performance measurement baseline for that contract.16 Such a 

baseline is necessary to support EVM reporting that can provide early 

warning signs of impending schedules delays and cost overrun, and 

provide unbiased estimates of anticipated costs at completion. The 

lack of an accurate performance measurement baseline stemmed 

from different assumptions between NASA and the contractor about 

when funding would be available to start different work and ultimately 

led to a contract modification. NASA and the contractor signed the 

contract replan in May 2016—with a cost increase of approximately 

$1 billion—and the program began receiving contractor EVM data in 

July 2016, more than 4.5 years after NASA awarded the contract.

• The cost and schedule baselines NASA has established for these 

three programs provide little visibility into long-term planning and 

costs. The baselines for SLS and EGS are applicable through the first 

exploration mission, and the baseline for Orion extends through the 

second exploration mission. However, the limited scope that NASA 

has chosen for constructing these cost estimates means that these 

estimates are unlikely to serve as a way to measure progress and 

track cost growth over the life of the projects which are expected to 

extend well beyond these first missions.

In addition to these human spaceflight programs, NASA plans to 

reestablish a domestic capability to fly astronauts to the International 

Space Station through its Commercial Crew program by the end of 2018. 

This is also proving to be an aggressive schedule and NASA’s two 

contractors are concurrently developing, testing, and producing their 

vehicles in an effort to maintain schedule. Significant delays could lead to 

a gap in U.S. access to the International Space Station as NASA has 

acquired seats on the Russian Soyuz vehicle only through 2018.

NASA also continues to have trouble demonstrating progress in executing 

two projects that we found in our 2015 high-risk update illustrated 

instances in which the agency had either underestimated risks and 

 16GAO-16-612.
NASA Acquisition Management

Page 479 GAO-17-317 High-Risk Series

potential effects or had not reacted quickly enough to risks when they 

worsened:17

The Ice, Cloud, and Land Elevation Satellite-2 (ICESat-2) project—also 

scheduled to launch in 2018—continues to experience issues with its sole 

instrument, a laser altimeter. The project may require an additional 10 

months or more to resolve technical challenges. The project already 

underwent one rebaseline in 2014, resulting in a 37 percent higher 

development cost than its original baseline—from $558.9 million to 

$763.7 million—which NASA officials at the time primarily attributed to 

underestimating the technical complexity of the project’s design.

The Space Network Ground Segment Sustainment (SGSS) project’s 

contractor provided overly optimistic estimates, which—despite project 

officials being aware of this issue during project confirmation—

necessitated a rebaseline shortly after the project was confirmed. NASA 

approved a new baseline in June 2015, which increased its estimated 

cost by $345 million and delayed its estimated completion by 27 months. 

In February 2016, NASA reclassified SGSS as a sustainment project 

rather than a major project, which reduces reporting and oversight 

requirements.

Finally, as we highlighted in the 2015 high-risk update, the inconsistent 

way NASA measures its progress toward reducing acquisition risk masks 

true cost and schedule growth for some programs.18 When NASA reports 

on cost and schedule performance for individual projects or across its 

portfolio, it uses rebaseline data rather than original project baseline data 

for measuring outcomes. Cost and schedule growth that occurred prior to 

the rebaseline of a troubled project are excluded from calculations of 

overall progress. As a result, when the agency reports program 

performance in this manner—as it has for JWST, ICESat-2, and others—

it makes it difficult to track cost and schedule growth compared to the 

agency’s original commitment levels.

 17GAO-15-290.

18GAO-15-290.
NASA Acquisition Management

Page 480 GAO-17-317 High-Risk Series

• In November 2012, we found that NASA employee skill sets available 

to analyze and implement EVM vary widely from center to center, and 

we recommended that NASA conduct an EVM skills gap analysis to 

identify areas requiring augmented capability across the agency, and, 

based on the results of the assessment, develop a workforce training 

plan to address any deficiencies.19 NASA developed an EVM training 

plan in 2014 based on the results of an EVM skills gap analysis that 

was conducted in 2013.

• In November 2012, we found that NASA faced cultural and technical 

challenges that it must overcome to successfully implement an EVM 

system and to use this data on a regular basis to inform decision 

making.20 We recommended that the agency develop an EVM change 

management plan to assist managers and employees throughout the 

agency with accepting and embracing earned value techniques while 

reducing the operational effect on the agency. In response to our 

recommendation, in 2014, NASA developed an EVM change 

management plan. This plan was approved by the EVM Steering 

Committee, which is comprised of senior-level NASA officials who 

provide guidance to the agency on implementing EVM. In addition, the 

plan was briefed to the EVM Focal Points who are responsible for 

implementing the plan within their respective organizations.

• In November 2012, we found that 10 NASA major spaceflight projects 

had not yet fully implemented EVM.21 As a result, NASA was not 

taking full advantage of an important tool that could help reduce 

acquisition risk. We recommended that NASA establish a time frame 

by which all new spaceflight projects will be required to implement 

NASA’s newly developed EVM system to ensure that in-house efforts 

are compliant with ANSI/EIA-748, accounting for the need to increase 

NASA’s institutional capability for conducting EVM and analyzing and 

reporting the data. In fiscal year 2013, NASA started a phased rollout 

at selected centers to increase the agency’s EVM capacity by 

implementing its EVM Capability process at projects at those centers. 

According to NASA officials, as future projects at those centers 

implement EVM, they expect centers will follow the agency EVM 

process, which will better ensure that they are using systems which 

are compliant with ANSI/EIA-748.

 19GAO-13-22.

20GAO-13-22.

21GAO-13-22.

Benefits Achieved by 

Implementing Our 

Recommendations
NASA Acquisition Management

Page 481 GAO-17-317 High-Risk Series

• In August 2014, NASA addressed concerns we raised about the SLS 

by taking actions to balance the program’s cost and schedule risk in 

line with agency policies. At the time of our report in July 2014, we 

found that NASA’s funding plan for the first test flight of SLS in 

December 2017 was insufficient to meet needs. 22 We recommended 

that the program match resources to requirements that would result in 

a level of risk in line with NASA policy by—for example—establishing 

cost and schedule baselines that supported a joint cost and schedule 

confidence level (JCL) of 70 percent. We indicated that NASA could, 

for example, increase funding or delay the scheduled launch date to 

reduce risks and meet the 70 percent JCL. In August 2014, the 

program addressed our concerns by establishing its agency cost and 

schedule baselines at a 70 percent JCL of $9.7 billion with a launch 

readiness date of November 2018.

For additional information about this high-risk area, contact Cristina T. 

Chaplain at (202) 512-4841 or chaplainc@gao.gov.

James Webb Space Telescope: Project Meeting Cost and Schedule 

Commitments but Continues to Use Reserves to Address Challenges. 

GAO-17-71. Washington, D.C.: December 7, 2016.

Orion Multi-Purpose Crew Vehicle: Action Needed to Improve Visibility 

into Cost, Schedule, and Capacity to Resolve Technical Challenges. 

GAO-16-620. Washington, D.C.: July 27, 2016.

NASA Human Space Exploration: Opportunity Nears to Reassess Launch 

Vehicle and Ground Systems Cost and Schedule. GAO-16-612. 

Washington, D.C.: July 27, 2016.

NASA: Assessments of Major Projects. GAO-16-309SP. Washington, 

D.C.: March 30, 2016.

James Webb Space Telescope: Project on Track but May Benefit from 

Improved Contractor Data to Better Understand Costs. GAO-16-112. 

Washington, D.C.: December 17, 2015.

 22GAO, Space Launch System: Resources Need to be Matched to Requirements to 

Decrease Risk and Support Long Term Affordability, GAO-14-631 (Washington, D.C.: July 

23, 2014).

GAO Contact

Related GAO 

Products
NASA Acquisition Management

Page 482 GAO-17-317 High-Risk Series

Space Launch System: Management Tools Should Better Track to Cost 

and Schedule Commitments to Adequately Monitor Increasing Risk. 

GAO-15-596. Washington, D.C.: July 16, 2015.

NASA: Assessments of Selected Large-Scale Projects. GAO-15-320SP. 

Washington, D.C.: March 24, 2015.
DOD Contract Management

Page 483 GAO-17-317 High-Risk Series

The Department of Defense (DOD) obligated $273.5 billion in fiscal year 

2015 on contracts for goods and services, including major weapon 

systems, support for military bases, information technology, consulting 

services, and commercial items. Contracts also include those supporting 

contingency operations, such as those in Afghanistan. DOD is, by far, the 

single largest contracting agency in the federal government, typically 

accounting for about two-thirds of all federal contracting activity. Our work 

and that of others, however, has identified challenges DOD faces within 

three segments of contract management: (1) the acquisition workforce, 

(2) service acquisitions, and (3) operational contract support (OCS). 

Ensuring DOD has the people, skills, capacities, tools, and data needed 

to make informed acquisition decisions is essential if DOD is to effectively 

and efficiently carry out its mission in an era of more constrained 

resources. We added this area to our High-Risk List in 1992.

Senior DOD leadership remains committed to addressing its contract 

management challenges and, in particular, has made significant progress 

in addressing OCS issues since 2015. For example, DOD held meetings 

of its senior executive level governance forum to institutionalize OCS, 

issued revised guidance, and made progress in incorporating OCS 

concepts into operational plans. Further, DOD has taken steps to address 

education and training shortfalls and has dedicated additional training 

resources to enhance OCS. DOD also updated its action plan for OCS, 

which includes both revised and new tasks with measurable metrics and 

milestones. As a result of these actions, for the OCS subarea, we have 

raised our assessments for capacity to partially met and consider DOD to 

have met our criterion for having an action plan.

DOD has also made some progress in managing its acquisition 

workforce. Specifically, in October 2016, DOD issued its updated 

acquisition workforce strategic plan which, among other things, assessed 

the current capability of the workforce and identified risks that DOD 

needed to manage to meet future needs. As a result of these actions, we 

have raised the action plan criterion for the acquisition workforce subarea 

to partially met. DOD acknowledged, however, that it will need to develop 

and implement metrics to track progress toward meeting the four strategic 

goals identified in its October 2016 strategic workforce plan. Further, the 

workforce plan does not establish specific career field goals or targets, 

which will hinder efforts to ensure DOD has the right people with the right 

skills to meet future needs.

DOD Contract Management

Why Area Is High 

Risk

What GAO Found
DOD Contract Management

Page 484 GAO-17-317 High-Risk Series

Congress has also taken action to help improve the acquisition workforce. 

In the National Defense Authorization Act for Fiscal Year 2016, Congress 

made permanent the requirement for the military departments and 

defense agencies to remit $500 million for each fiscal year to the Defense 

Acquisition Workforce Development Fund (DAWDF)—a fund used by 

DOD to increase hiring and provide additional training. This enabled 

critical support for acquisition workforce development initiatives for DOD.

While DOD continues to take action to improve how it manages services 

acquisitions, demonstrated progress was more limited. In January 2016, 

DOD issued a new instruction for service acquisitions that provides a 

management structure for acquiring services and identifies the roles and 

responsibilities of key leadership positions, but DOD still lacks an action 

plan that will enable it to assess progress toward achieving its goals, and 

efforts to identify goals and associated metrics are still in the early stages 

of development.

One critical element in improving services acquisition is to know what the 

department is buying today and what it intends to buy in the future. We 

found that while data on future service acquisitions are generally 

maintained by DOD program offices, DOD and military department 

guidance does not require that data to be specifically identified in DOD’s 

budget forecasts. In that regard, DOD’s January 2016 service acquisition 

instruction includes requirements to generate data on anticipated future 

service acquisition spending, but this requirement does not clearly identify 

what level of detail should be collected, leaving DOD at risk of developing 

inconsistent data between each military department.

To further improve outcomes on the billions of dollars spent annually on 

goods and services, DOD needs to take the following actions.

• Continue efforts, including strategic planning and aligning funding, to 

increase the department’s capacity to negotiate, manage, and 

oversee contracts by ensuring that its acquisition workforce is 

appropriately sized and trained to meet the department’s needs.

• Determine the appropriate mix of military, civilian, and contractor 

personnel. To assist with this, DOD needs to make decisions about 

the department’s approach for compiling its inventory of contracted 

What Remains to Be 

Done
DOD Contract Management

Page 485 GAO-17-317 High-Risk Series

services and defining the roles and responsibilities of those involved 

with the inventory.

• Strategically manage how it acquires services by defining desired 

outcomes, establishing goals and measures, and obtaining data 

needed to measure progress. To enhance available information on 

service acquisitions, the military departments should revise 

programming guidance to collect information on how contracted 

services will be used to meet requirements beyond the budget year.

• Sustain efforts throughout the department to integrate OCS through 

policy, planning, training, and application of necessary resources for 

both current and future contingency operations.

Listed below are additional recommendations that need to be addressed:

• In December 2015, we recommended that DOD update its acquisition 

workforce plan, including revising career field goals. DOD concurred 

with our recommendation. In October 2016, DOD issued an updated 

acquisition workforce strategic plan which, among other things, 

assessed the current capacity and capability of the workforce and 

identified the risks that DOD needed to manage to meet future needs. 

The updated workforce plan also established four strategic goals, 

approved by the Defense Acquisition Workforce Senior Steering 

Board, to guide future efforts, including shaping the acquisition 

workforce to achieve current and future acquisition requirements. The 

October 2016 plan did not, however, establish specific career field 

goals or targets for its 13 career fields, including priority career fields 

where it has not met its targets, such as contracting, business, and 

auditing, which will hinder efforts to ensure that DOD has the right 

people with the right skills to meet future needs.

• In June 2013, we recommended that DOD identify baseline data on 

the status of service acquisitions, develop specific goals associated 

with their actions to improve service acquisitions, and establish 

metrics to assess progress in meeting these goals. DOD concurred 

with our recommendations and is developing service acquisition goals 

and metrics as well as an action plan for improving service 

acquisition.

• In relation to strategic sourcing—a process of moving away from 

numerous individual procurements to a broader aggregate 

approach—in September 2012, we recommended that the department 

issue direction that sets goals for spending managed through strategic 

sourcing vehicles, establishes procedures for tracking strategic 

sourcing efforts, and establishes metrics to track progress toward 
DOD Contract Management

Page 486 GAO-17-317 High-Risk Series

these goals. We also recommended that DOD identify and evaluate 

the best way to strategically source DOD’s highest spending 

categories. DOD concurred with these two priority recommendations 

and has been working with the Office of Management and Budget’s 

Category Management Leadership Council to determine appropriate 

strategic sourcing goals, but specific goals and corresponding metrics 

have not yet been established. DOD officials stated that appointing 

senior officials to manage the acquisition of services should help DOD 

further expand strategic sourcing efforts for high-spend service 

categories. As of October 2016, however, many of these efforts are in 

the early stages of implementation.

• We noted in our 2015 high-risk report that DOD’s top leadership has 

taken significant steps to plan and monitor progress in the 

management and oversight of contracting techniques and 

approaches. For example, we noted that DOD had been using its 

Business Senior Integration Group—the Under Secretary of Defense 

for Acquisition, Technology, and Logistics’ executive-level leadership 

forum for providing oversight in the planning, execution, and 

implementation of DOD’s Better Buying Power initiatives—as a 

mechanism to review ongoing and emerging issues, including 

competition. It is important for DOD to continuously promote 

competition, which is a critical tool for achieving the best possible 

return on investment for taxpayers.

In addition, congressional action is needed to enhance visibility into 

DOD’s planned spending on contract services. In February 2016, we 

found that, unlike DOD budget exhibits for weapon systems, DOD’s other 

budget exhibits which contain information on contracted services do not 

include data on projected spending beyond the current budget year. 

Without a roadmap of future projected service contract spending needs, 

Congress has limited visibility into an area that constitutes more than half 

of DOD’s annual contract spending. Given that the intent of section 235 of 

Title 10 United States Code was to provide both DOD and Congress with 

increased oversight of the procurement of services, we suggested that 

Congress should consider amending reporting requirements to include 

estimated spending on services beyond the budget year.
DOD Contract Management

Page 487 GAO-17-317 High-Risk Series

DOD has met this criterion by implementing its Better Buying Power 

initiative—which included specific actions to improve the professionalism 

of the acquisition workforce—and through continued efforts to sustain and 

train the workforce in times of budget constraints and cost-cutting 

pressures. For example, in June 2016, the Under Secretary of Defense 

for Acquisition, Technology and Logistics stated that DOD intends to 

sustain the acquisition workforce at current levels and continue to 

improve its professionalism. Similarly, DOD’s October 2016 acquisition 

workforce strategic plan stated that DOD must sustain the acquisition 

workforce size, factoring in workload demand and requirements; ensure 

its personnel continue to increase their professionalism, and continue to 

expand talent management programs to include recruitment, hiring, 

training, development, recognition, and retention incentives by using 

DAWDF and other appropriate tools. DOD components plan to spend 

more than $3.0 billion in DAWDF funding between fiscal years 2018 

through 2022 in support of these objectives.

DOD has partially met this criterion. Since 2015, DOD has continued to 

increase the size of the acquisition workforce by about 2,000 acquisition 

Additional Details on 

What GAO Found

DOD’s Management of Its 

Acquisition Workforce

Leadership Commitment

Capacity
DOD Contract Management

Page 488 GAO-17-317 High-Risk Series

personnel. Overall, the size of its military and civilian acquisition 

workforce grew by about 26 percent—from close to 126,000 to more than 

158,000 between September 2008 and March 2016—or about 12,000 

more than the target identified in DOD’s April 2010 acquisition workforce 

plan. While DOD met the overall acquisition growth goal, it did not 

accomplish the goals set for some career fields. The plan indicated that 

targeted growth in 5 of these priority career fields—auditing, business, 

contracting, engineering, and program management—would help DOD

strategically reshape its acquisition workforce. As of March 2016, our 

analysis shows that DOD met or exceeded its planned growth for 8 career 

fields by about 12,500 personnel, including the priority career fields of 

program management and engineering, but fell short by about 2,800 

personnel in 5 other career fields, including the priority career fields of 

contracting, business, and auditing. DOD has also used DAWDF to 

increase hiring and provide for additional training. In the National Defense 

Authorization Act for Fiscal Year 2016, Congress further enabled critical 

support for acquisition workforce development initiatives by making 

permanent the requirement for the military departments and defense 

agencies to remit $500 million for each fiscal year to the fund.

Increasing the number of people performing acquisition work is only part 

of DOD’s strategy to improve the capability of its workforce; another part 

is ensuring that the workforce has the requisite skills and tools to perform 

their tasks. DOD developed a five-phase process that included surveys of 

its employees to assess the skills of its workforce and to identify and 

close skill gaps. DOD completed competency assessments for 12 of its 

13 career fields and is developing new training classes to address some 

skill gaps. However, DOD has not determined the extent to which 

workforce skill gaps identified in initial career field competency 

assessments have been addressed and what workforce skill gaps 

currently exist. In our December 2015 report, we recommended that DOD 

establish time frames to conduct follow-up career field competency 

assessments so that it can determine if skill gaps are being addressed.1

DOD agreed with the recommendation. The department’s October 2016 

acquisition workforce strategic plan stated that career field competency 

assessments should be conducted at a minimum of every 5 years, but it 

is too soon to tell whether DOD will conduct these assessments as 

recommended in its workforce plan.

 1

GAO, Defense Acquisition Workforce: Actions Needed to Guide Planning Efforts and 

Improve Workforce Capability, GAO-16-80 (Washington, D.C.: Dec. 14, 2015).
DOD Contract Management

Page 489 GAO-17-317 High-Risk Series

DOD has now partially met this criterion. The National Defense 

Authorization Act for Fiscal Year 2010 required DOD to develop and 

submit to Congress a strategic plan for DOD’s acquisition workforce, to 

be updated biennially.2 In a December 2015 report, we found that DOD 

had exceeded its workforce growth target established in 2010 and was 

focused on sustaining the size of its acquisition workforce.3 We noted that 

an updated workforce plan that included revised career field goals, 

coupled with guidance on how to use DAWDF, could help DOD 

components focus future hiring efforts on priority career fields. Without an 

integrated approach, we concluded that the department would be at risk 

of using the funds to hire personnel in career fields that currently exceed 

their targets or are not considered a priority. Therefore, we recommended 

that DOD update its acquisition workforce plan, including revising career 

field goals, so that it could ensure that the most critical acquisition needs 

are being met. DOD officials agreed with our recommendation. In October 

2016, DOD issued an updated acquisition workforce strategic plan which, 

among other things, assessed the current capacity and capability of the 

workforce and identified the risks that DOD needed to manage to meet 

future needs. The updated workforce plan also established four strategic 

goals, approved by the Defense Acquisition Workforce Senior Steering 

Board, to guide future efforts, including shaping the acquisition workforce 

to achieve current and future acquisition requirements.4 The October 

2016 plan did not, however, establish specific career field goals or 

targets, which will hinder efforts to ensure that DOD has the right people 

with the right skills to meet future needs.

We also continue to find that DOD faces challenges in meeting its 

statutory requirement to prepare an annual inventory of contracted 

services—one that could help it make more strategic decisions about the 

right workforce mix of military, civilian, and contractor personnel and 

better align resource needs through the budget process to achieve that 

mix. Specifically, in October 2016, we found DOD faced continued delays 

in (1) deciding on the path forward for its underlying data collection 

system for the inventory of contracted services, (2) staffing its inventory 

 2

This requirement was repealed in the National Defense Authorization Act for Fiscal Year 

2017. Pub. L. No. 114-328, § 1102.

3

GAO-16-80.

4

The other three strategic goals include (1) making DOD an employer of choice, (2) 

improving the quality and professionalism of the acquisition workforce, and (3) improving 

workforce policies, programs, and processes. 

Action Plan
DOD Contract Management

Page 490 GAO-17-317 High-Risk Series

management support office, and (3) formalizing roles and responsibilities 

of that office and stakeholders.5 These continued delays hinder DOD’s 

ability to use the inventory to inform workforce and budget decisionmaking processes.

DOD has partially met this criterion. DOD acknowledged that it will need 

to develop and implement metrics to track progress toward meeting the 

four strategic goals identified in its October 2016 strategic workforce plan, 

including those related to shaping the future acquisition workforce. DOD, 

however, has been tracking workforce growth against targets established 

in 2010, as well as other metrics, such as those related to education and 

training.

DOD has partially met this criterion. The metrics show that the 

department has exceeded its overall acquisition workforce growth target 

and education and training rates have increased significantly since 2008. 

For example, in its October 2016 acquisition workforce plan, DOD 

reported that the number of personnel with bachelor’s degrees or higher 

increased from 77 percent in fiscal year 2008 to 84 percent in fiscal year 

2015, while those with graduate degrees increased from 29 percent to 39 

percent over the same period. DOD also reported that more than 96 

percent of the acquisition workforce either met or was on track to meet 

certification requirements within required time frames. DOD has not, 

however, verified that the current composition of the workforce will meet 

its future workforce needs.

 5

GAO, DOD Inventory of Contracted Services: Timely Decisions and Further Actions 

Needed to Address Long-Standing Issues, GAO-17-17 (Washington, D.C.: Oct. 31, 2016).

Monitoring

Demonstrated Progress
DOD Contract Management

Page 491 GAO-17-317 High-Risk Series

DOD has demonstrated sustained leadership commitment in improving its 

approach to managing the acquisition of services, which accounted for 

more than 50 percent of DOD’s contract obligations in fiscal year 2015, 

and has met this criterion. This commitment is reflected in DOD’s 

issuance in January 2016 of a service acquisition instruction, which 

established policy, assigned responsibilities, and provided procedures for 

defining, assessing, reviewing, and validating requirements for the 

acquisition of services. This instruction, which provides a management 

structure for acquiring services, builds on DOD’s efforts to improve how it 

acquires services that were contained in its Better Buying Power initiative. 

We are currently assessing the actions the military departments are 

taking to implement the service acquisition instruction.

DOD has partially met this criterion by establishing a number of 

management and oversight positions intended to address its capacity for 

strategically managing the acquisition of services. These include 

designating the Principal Deputy Under Secretary of Defense for 

Acquisition, Technology, and Logistics as the department’s senior 

manager for service acquisition in 2013, as well as building capacity to 

address service acquisition issues by designating a senior manager for 

service acquisitions in each military department. We are currently 

assessing the effects of these new positions.

DOD has not met this criterion. DOD does not have an action plan that 

would enable it to assess progress toward achieving its goals, and its 

Improving DOD’s 

Acquisition of Services

Leadership Commitment

Capacity

Action Plan
DOD Contract Management

Page 492 GAO-17-317 High-Risk Series

efforts to develop goals and associated metrics unique to each category 

of service it acquires are also in the early stages of development.

DOD has partially met this criterion. Because DOD lacks an action plan, it 

is not yet positioned to fully assess its progress in improving service 

acquisition. A key element to being more strategic in acquiring services is 

knowing how and where service acquisition dollars are currently being 

spent and how those dollars will be spent in the future. We found in 

February 2016 that program offices within each of the military 

departments that we met with maintained data on current and estimated 

future spending needs for contracted service requirements, but they did 

not identify service contract spending needs beyond the next year, as 

they were not required to do so.6 We recommended that the military 

departments revise their programming guidance to collect information that 

is already available on how contracted services will be used to meet 

requirements beyond the budget year.

We also recommended that DOD establish a mechanism, such as a 

working group of key stakeholders, to coordinate these efforts. DOD 

partially concurred with these two priority recommendations, citing 

challenges in estimating future spending, but as of July 2016, had 

generally not taken action to address them. In February 2016, however, 

the Army included service contract reporting requirements in its 

Command Program Guidance Memorandum for fiscal years 2018-2022. 

The memorandum instructs Army commands and operating agencies to 

document all current and future requirements for contracted services for 

fiscal years 2018-2022. In its memorandum, the Army noted that this data 

will provide transparency over contracted services funding and 

requirements and enable the Army to track dollars programmed for 

services. Further, the Army stated that this effort will provide data that can 

be used to make resource decisions and inform processes that determine 

workload requirements and assess the appropriate mix of military, civilian, 

and contractors to execute workload requirements.

In addition, DOD has made progress in acquiring services through 

strategic sourcing but has more to do to improve monitoring. For 

example, in September 2015, we found that each of the military 

departments we reviewed had designated officials responsible for 

 6

GAO, DOD Service Acquisition: Improved Use of Available Data Needed to Better 

Manage and Forecast Service Contract Requirements, GAO-16-119 (Washington, D.C.: 

Feb. 18, 2016).

Monitoring
DOD Contract Management

Page 493 GAO-17-317 High-Risk Series

strategic sourcing and created offices to identify and implement strategic 

sourcing opportunities, including those specific to information technology 

services.7 The military departments did not monitor spending or establish 

savings goals and metrics for the use of their preferred strategic sourcing 

contracts for information technology services, which resulted in most of 

their dollars for information technology services being obligated through 

hundreds of potentially duplicative contracts that diminished the 

government’s buying power and resulted in missed opportunities to 

achieve savings and obtain other benefits.

DOD has partially met this criterion. The January 2016 DOD services 

acquisition instruction included additional requirements to generate data 

on past and anticipated future service acquisition spending, but did not 

clearly identify what level of detail should be collected, leaving the 

department at risk of developing inconsistent data between each military 

department and limiting DOD leadership’s insight into future spending on 

contracted services. DOD plans to develop service acquisition related 

goals and metrics in fiscal year 2017 to develop additional baseline data 

to gauge progress. As DOD and the military departments mature efforts 

to develop more refined data on past and future service contract spending 

and develop specific goals related to each, DOD will be better positioned 

to assess its progress.

 7

GAO, Strategic Sourcing: Opportunities Exist to Better Manage Information Technology 

Services Spending, GAO-15-549 (Washington, D.C.: Sept. 22, 2015).

Demonstrated Progress
DOD Contract Management

Page 494 GAO-17-317 High-Risk Series

DOD has met this criterion by continuing to demonstrate sustained 

commitment and strong leadership support in addressing OCS issues. 

DOD held its first OCS Summit in October 2015, attended by senior 

leaders from across the department, to review and discuss strategies to 

better formalize capability and capacity in the Joint Force. DOD officials 

are planning to host a similar forum in 2017. Additionally, the Functional 

Capabilities Integration Board serves as a single senior executive-level 

governance forum for OCS issues. It convenes quarterly, or as required, 

providing strategic leadership to multiple stakeholders working to 

institutionalize OCS.

DOD has partially met this criterion. Specifically, DOD has made progress 

toward addressing agency capacity by identifying several actions to 

develop its personnel and training resources since our last high-risk 

update. The July 2014 update to the Joint Staff’s primary OCS guidance, 

according to DOD officials, changed doctrine and obviated the results of 

an earlier study that had found capacity shortfalls in OCS positions. 

Subsequently, according to officials, in September 2016 the Office of the 

Secretary of Defense established a joint OCS Policy Working Group to 

clarify and refine OCS policy. Also, DOD officials told us, in October 2016, 

that DOD is pursuing a joint OCS capacity review process to implement 

corrective actions to address OCS shortfalls in personnel, education, 

training, and materiel and to better incorporate OCS requirements. Joint 

Addressing Challenges 

Related to Operational 

Contract Support

Leadership Commitment

Capacity
DOD Contract Management

Page 495 GAO-17-317 High-Risk Series

Staff also identified priority items that combatant commanders should 

consider emphasizing in their training and exercise programs to improve 

OCS capacity.

DOD has made significant progress in addressing the action plan criterion 

and has met this criterion. In September 2016, DOD issued its fourth 

iteration of the OCS Action Plan, which is organized around 10 capability 

gaps that needed to be closed in order to effectively institutionalize OCS 

capability and is DOD’s primary mechanism for monitoring and validating 

the effectiveness and sustainability of those tasks. We found, in February 

2015, that the 2014 Action Plan lacked performance measures or metrics 

to evaluate if actions taken had filled the capability gaps. DOD’s 2016 

action plan, however, revised tasks and added new tasks to include 

measurable metrics and provided a cross-walk to show the status of the 

tasks. For example, the 2016 plan shows 90 tasks completed or deleted 

from the preceding years. Further, the 2016 plan highlighted a number of 

other ongoing efforts, such as initiating a new joint capability 

requirements document and process that, if approved, may accelerate 

significant changes across DOD.

DOD has partially met this criterion. Each task identified in the 2016 

Action Plan has a deliverable or outcome measured against a target 

completion date, and a senior-level board serves as the primary monitor 

for these performance targets. Moreover, the 2016 Action Plan included a 

new annex managed by the Joint Staff logistics directorate to capture 

subtasks that supplement the 36 overarching tasks in the DOD action 

plan. However, some of these subtasks are not clearly defined and will be 

difficult to monitor. For example, one subtask associated with a gap—

personnel being insufficiently aware of the significance of OCS—suggests 

the need for an enduring culture change, but it is unclear how DOD will 

monitor this effort.

DOD has partially met this criterion. DOD continues to make progress in 

incorporating OCS concepts into plans and addressing education and 

training shortfalls. For example, we found, in December 2015, that U.S. 

Africa Command developed some annexes to plans that generally 

contained key considerations discussed in Joint Staff and other DOD 

guidance such as force protection, host nation agreements, and 

contractor oversight.8 Additionally, Joint Staff has revised the Universal 

 8

GAO, Operational Contract Support: Additional Actions Needed to Manage, Account for, 

and Vet Defense Contractors in Africa, GAO-16-105 (Washington, D.C.: Dec. 17, 2015).

Action Plan

Monitoring

Demonstrated Progress
DOD Contract Management

Page 496 GAO-17-317 High-Risk Series

Joint Tasks—which support DOD in conducting training and exercises—

incorporating lessons learned related to OCS and new doctrine identified 

in Joint Publication 4-10.

However, DOD has not implemented several priority recommendations 

related to OCS guidance. For example, we reported, in February 2013, 

that the Navy, Marine Corps, and Air Force have not developed 

comprehensive guidance, limiting the military departments’ planning 

efforts to accurately reflect how they use contract support.9 We 

recommended that DOD direct the Navy and Air Force to provide servicewide guidance for the Navy, Marine Corps, and Air Force that describes 

how each service should integrate OCS into its respective organization to 

include planning for contingency operations. DOD concurred with this 

priority recommendation.

Since that time, the Marine Corps has developed guidance and definitions 

within the Marine Corps Capabilities List, and the Air Force has issued a 

memorandum on OCS integration and updated existing guidance to 

include OCS concepts. OSD officials told us, in December 2016, that 

Navy planners are drafting an OCS instruction for internal review, which 

they estimate will be completed in the summer of 2017. However, the 

September 2016 OCS Action Plan reflects the target publication date as 

the first quarter of fiscal year 2017.

In March 2015, we recommended that DOD revise existing guidance to 

detail the roles and responsibilities of the military departments in 

collecting OCS lessons learned.10 We also recommended that DOD direct 

the Navy and Air Force to include the military departments’ roles and 

responsibilities to collect OCS lessons learned in military department 

specific guidance on how the Navy, Marine Corps, and Air Force should 

integrate OCS. DOD concurred with these priority recommendations, and, 

according to senior DOD officials, the department is revising a DOD 

instruction and directive to address these recommendations.

 9

GAO, Warfighter Support: DOD Needs Additional Steps to Fully Integrate Operational 

Contract Support into Contingency Planning, GAO-13-212 (Washington, D.C.: Feb. 8, 

2013).

10GAO, Operational Contract Support: Actions Needed to Enhance the Collection, 

Integration, and Sharing of Lessons Learned, GAO-15-243 (Washington, D.C.: Mar. 16, 

2015).
DOD Contract Management

Page 497 GAO-17-317 High-Risk Series

In addition, the 2016 action plan identified foreign vendor vetting as a 

significant issue that should replace base access as a capability gap. 

DOD also noted that addressing this potential gap will likely require 

support from beyond the OCS community. Specifically, according to DOD 

officials, the OCS community of interest determined that the issue of 

vendor vetting is outside the responsibility and expertise of the OCS 

community. DOD established a separate working group on vendor vetting 

to address this issue. However, DOD has not developed comprehensive 

guidance on foreign vendor vetting, as we previously recommended.

In December 2015, we recommended that the department develop 

guidance that clarifies the conditions under which combatant commands 

should have a foreign vendor vetting process or cell in place to determine 

whether potential vendors actively support any terrorist, criminal, or other 

sanctioned organization.11 DOD concurred with this priority 

recommendation, stating that the Office of the Secretary of Defense in 

collaboration with the Joint Staff had established a joint working group to 

identify key stakeholders and develop DOD policy requiring combatant 

commands to develop processes for vetting foreign vendors. As of 

December 2016, the department was in the process of preparing a 

directive type memorandum to the military departments and combatant 

commands with additional information. According to officials, DOD 

continues to gain stakeholder support and assess and analyze vendor 

vetting issues, in order to develop comprehensive guidance, as we 

previously recommended.

• In February 2016, we recommended that the military departments 

revise their programming guidance to collect information on how 

contracted services will be used to meet requirements beyond the 

budget year. DOD partially concurred with this recommendation, citing

challenges with accurately quantifying service contract requirements 

beyond the budget year. In its February 2016 Command Program 

Guidance Memorandum, the Army required all its organizations to 

provide contract service requirements data for fiscal years 2018-2022, 

including all current and planned requirements. The Army recognized 

that this will enable the Army and its commands to analyze contract 

service requirements and execution trends and allow the Army to 

prioritize growth or reductions to specific contract service 

requirements.

 11GAO-16-105.

Benefits Achieved by 

Implementing Our 

Recommendations
DOD Contract Management

Page 498 GAO-17-317 High-Risk Series

• In March 2010, we recommended that DOD update its planning 

guidance to address the potential need for contractor support where 

appropriate.12 DOD concurred with this recommendation. In October 

2012, the Chairman of the Joint Chiefs of Staff issued updated 

guidance on operational planning which contains information related 

to planning for contracted support. As a result of this change in 

guidance, senior DOD leaders will have a better understanding of how 

the department relies on contractors as it undertakes contingency 

operations, and will be more attuned to the potential risks of using 

contractors and better prepared to manage those risks.

For additional information about this high-risk area, contact Timothy J. 

DiNapoli at (202) 512-4841 or dinapolit@gao.gov.

DOD Inventory of Contracted Services: Timely Decisions and Further 

Actions Needed to Address Long-Standing Issues. GAO-17-17. 

Washington, D.C.: October 31, 2016.

DOD Service Acquisition: Improved Use of Available Data Needed to 

Better Manage and Forecast Service Contract Requirements. 

GAO-16-119. Washington, D.C.: February 18, 2016.

Operational Contract Support: Additional Actions Needed to Manage, 

Account for, and Vet Defense Contractors in Africa. GAO-16-105. 

Washington, D.C.: December 17, 2015.

Defense Acquisition Workforce: Actions Needed to Guide Planning Efforts 

and Improve Workforce Capability. GAO-16-80. Washington, D.C.: 

December 14, 2015.

DOD Inventory of Contracted Services: Actions Needed to Help Ensure 

Inventory Data are Complete and Accurate. GAO-16-46. Washington, 

D.C.: November 18, 2015.

DOD Contract Services: Improvements Made to Planning and 

Implementation of Fiscal Controls. GAO-15-780. Washington, D.C.: 

September 30, 2015.

 12GAO, Warfighter Support: DOD Needs to Improve Its Planning for Using Contractors to 

Support Future Military Operations, GAO-10-472 (Washington, D.C.: Mar. 30, 2010). 

GAO Contact

Related GAO 

Products
DOD Contract Management

Page 499 GAO-17-317 High-Risk Series

Strategic Sourcing: Opportunities Exist to Better Manage Information 

Technology Services Spending. GAO-15-549. Washington, D.C.: 

September 22, 2015.

Operational Contract Support: Actions Needed to Enhance the Collection, 

Integration, and Sharing of Lessons Learned. GAO-15-243. Washington, 

D.C.: March 16, 2015.

Contingency Contracting: Contractor Personnel Tracking System Needs 

Better Plans and Guidance. GAO-15-250. Washington, D.C.: February 

18, 2015.
Enforcement of Tax Laws

Page 500 GAO-17-317 High-Risk Series

The Internal Revenue Service (IRS) continues to demonstrate top 

leadership support for improving tax compliance and addressing the tax 

gap. However, IRS’s capacity to implement new initiatives, carry out 

ongoing enforcement and taxpayer service programs, and combat identity 

theft (IDT) refund fraud under an uncertain budgetary environment 

remains a challenge. Enforcement of the tax laws helps fund the U.S. 

government. IRS enforcement collects revenue from noncompliant 

taxpayers and, perhaps more importantly, promotes voluntary compliance 

by giving taxpayers confidence that others are paying their fair share. In 

2016, IRS estimated that the average annual gross tax gap—the 

difference between taxes owed and taxes paid on time—was $458 billion 

for tax years 2008-2010. IRS is able to recover a portion of the tax gap. In 

2016, IRS estimated that it will eventually collect $52 billion of the tax gap 

through enforcement actions and late payments, leaving an annual 

estimated net tax gap of $406 billion for tax years 2008-2010.

In 2015, we expanded the enforcement of tax laws high-risk area to 

include IRS’s efforts to address tax refund fraud due to IDT, which occurs 

when an identity thief files a fraudulent tax return using a legitimate 

taxpayer’s identifying information and claims a refund. According to IRS, it 

estimates that at least $14.5 billion in IDT tax refund fraud was attempted 

in tax year 2015, of which it prevented at least $12.3 billion (85 percent). 

Of the amount attempted, IRS estimated that at least $2.2 billion (15 

percent) was paid.1

 1

Because of the difficulties in estimating the amount of undetectable fraud, the actual 

amount could differ from these estimates.

Enforcement of Tax Laws

Why Area Is High 

Risk
Enforcement of Tax Laws

Page 501 GAO-17-317 High-Risk Series

As previously mentioned, IRS continues to demonstrate top leadership 

support for improving tax compliance and addressing the tax gap. For 

example, it continues to research the extent and causes of taxpayer 

noncompliance, and released an updated tax gap estimate in April 2016. 

The agency has also taken steps to address IDT refund fraud, such as 

increasing the number of staff and resources dedicated to combating this 

issue. IRS has now partially met the criterion for capacity with respect to 

combating IDT refund fraud. But as also cited above, IRS’s capacity to 

implement new initiatives, carry out ongoing enforcement and taxpayer 

service programs, and combat IDT refund fraud under an uncertain 

budgetary environment remains a challenge. Annual appropriations 

increased by $290 million between fiscal years 2015 ($10.9 billion) and 

2016 ($11.2 billion), but remain about $900 million (about 7 percent) 

below fiscal year 2011 levels ($12.1 billion).

IRS continues to take actions toward meeting three other criteria for 

removal from our High-Risk List: developing a corrective action plan, 

monitoring, and demonstrating progress. For example, IRS’s strategic 

plan includes general approaches to make voluntary compliance easier 

for taxpayers. IRS also has a strategic plan that identifies refund fraud 

and IDT as challenges facing the nation’s tax system over the next 

several years. However, IRS has not yet implemented some of our 

recommendations highlighted in the 2015 high-risk report that could help 

it improve its corrective action plan, such as better measuring return-oninvestment (ROI), better leveraging automated processes, and improving 

enforcement data. Also, for some compliance initiatives, such as those 

related to the Foreign Account Tax Compliance Act or the Patient 

Protection and Affordable Care Act (PPACA), IRS will need to continue to 

focus on measuring results and the effect of these initiatives on the tax 

gap.

While IRS has developed research efforts to assess its IDT defense 

effectiveness, the agency needs to do more to demonstrate progress. 

Due in part to substantial methodological changes used to estimate the 

amount of IDT refund fraud prevented, year over year comparisons in 

IRS’s estimates of IDT refund fraud prevented and paid are not 

comparable. In addition, the agency has yet to address key weaknesses 

in authenticating taxpayers. While IRS is taking steps to improve 

authentication, it will still be vulnerable until it completes and uses the 

results of its analysis of costs, benefits, and risk to inform decisionmaking.

What GAO Found
Enforcement of Tax Laws

Page 502 GAO-17-317 High-Risk Series

Although more needs to be done, Congress and IRS have taken steps to 

implement a number of our recommendations that have resulted in 

benefits. For example, Congress passed legislation targeted at further 

strengthening tax law enforcement, including the Tax Equity and Fiscal 

Responsibility Act (TEFRA), which will improve the efficiency of 

partnership audits. Congress also passed legislation that will increase tax

compliance through improved third-party reporting requirements, 

strengthened controls over higher education tax benefits to reduce 

inaccurate claims, and provided IRS with authority to correct errors 

related to the First-Time Home Buyer’s Credit. IRS and congressional 

actions based on our work in this area resulted in a total financial savings 

of approximately $7.8 billion between 2011 and 2016 and an estimated 

$12.5 billion in additional revenue over the next 8 years.

IRS should implement our open recommendations, especially those that 

focus on improving audit effectiveness, taxpayer services, and resource 

investment decision making and oversight. Specifically, IRS should:

• continue to develop and implement a long-term strategy to address 

operations amidst an uncertain budget environment;

• determine resource allocation strategies for its enforcement efforts 

such as large partnership audits;

• assess the performance of its information technology (IT) investments 

as well as improve its IT security and online web services;

• develop a strategy for better identifying partnership noncompliance 

and assessing the effectiveness of exam selection;

• strengthen referral programs so whistleblowers and other 

stakeholders can more easily submit information to IRS about tax 

noncompliance; and

• enhance taxpayer services by developing a long-term strategy for 

providing web-based services to taxpayers, and improve telephone 

service by establishing a customer service standard and identifying 

resources needed to achieve that standard.

What Remains to Be 

Done

Enforcing Tax Laws
Enforcement of Tax Laws

Page 503 GAO-17-317 High-Risk Series

With regard to IDT refund fraud, IRS should implement our open 

recommendations, including

• identifying and addressing authentication risks associated with the 

Taxpayer Protection Program;

• estimating and documenting the costs, benefits, and risks of possible 

options for taxpayer authentication; and

• improving third-party partnership programs.

Given that the tax gap has been a persistent issue, we have previously

reported that reducing it will require targeted legislative actions, including 

the following:

• Additional third-party information reporting. Taxpayers are much 

more likely to report their income accurately when the income is also 

reported to IRS by a third party. In 2008 and 2009, we suggested 

Congress consider expanding third-party information reporting to 

include payments for services to rental real estate owners and 

payments for services provided by corporations, respectively. In 2010, 

the Joint Committee on Taxation estimated that, for a 10-year period, 

tax compliance could potentially increase by $2.5 billion if third parties 

reported rental real estate service payments, and $3.4 billion if third 

parties reported service payments to corporations. Congress enacted 

a more expansive regime in 2010 covering reporting of payments for 

goods as well as services, and subsequently repealed these 

provisions.

• Enhanced electronic filing. Requiring additional taxpayers to 

electronically file tax and information returns could help IRS improve 

compliance efficiently. Current law requires entities that file more than 

250 returns during a year or partnerships with more than 100 partners 

to file electronically.2 In 2014, we suggested that Congress consider 

expanding the mandate for partnerships and corporations to 

electronically file their tax returns, as this could help IRS reduce return 

processing costs, select the most productive tax returns to examine, 

and examine fewer compliant taxpayers.

Increased electronic filing would also allow IRS to obtain timely, accurate 

data from a significant number of additional employers, and could further 

enhance the benefits IRS could obtain from the accelerated Wage and 

 2

26 U.S.C. § 6011(e)(2).

IDT Refund Fraud

Congressional Actions 

Needed
Enforcement of Tax Laws

Page 504 GAO-17-317 High-Risk Series

Tax Statement (W-2) deadline and prerefund W-2 matching. Treasury has 

requested authority to reduce the current 250-return threshold for 

employers electronically filing information returns. In 2014, we suggested 

that Congress consider authorizing Treasury to lower the threshold for 

electronic filing of W-2s from 250 returns annually to between 5 to 10 

returns, as appropriate.

• Math error authority. Providing IRS with correctible authority with 

appropriate safeguards to permit it to correct errors in cases where 

information provided by the taxpayer does not match information in 

government databases, among other things, could help IRS correct 

additional errors and avoid burdensome audits and taxpayer 

penalties. Congress enacted legislation in December 2015 that 

expands the circumstances in which IRS may use math error authority 

in some situations for selected refundable tax credits.3 While 

expanding math error authority is consistent with what we have 

previously suggested, we had suggested that math error authority be 

authorized on a broader basis with appropriate controls rather than on 

a piecemeal basis, and that controls may be needed to ensure that 

this authority is used properly. Our prior work identified potential 

controls, such as requiring IRS to report on its use of math error 

authority.

• Paid preparer regulation. Establishing requirements for paid tax 

return preparers could improve the accuracy of the tax returns they 

prepare. In 2014, we suggested Congress consider granting IRS the 

authority to regulate paid tax preparers, if it agrees that significant 

paid preparer errors exist. The Joint Committee on Taxation estimated 

that legislation to regulate paid preparers would increase tax 

compliance by $135 million in revenue through fiscal year 2025.

• Tax reform and simplification. A broader opportunity to address the 

tax gap involves simplifying the Internal Revenue Code, as complexity 

can confuse taxpayers and provide opportunities to hide willful 

noncompliance. Fundamental tax reform could result in a smaller tax 

gap if the new system has fewer tax preferences or complex tax code 

provisions; such reform could reduce IRS’s enforcement challenges 

and increase public confidence in the tax system. Short of 

fundamental reform, targeted simplification opportunities also exist. 

Amending the tax code to define terms more consistently across tax 

 3

Pub. L. No. 114-113, div. Q, title II, §§ 203(e), 208(b), 129 Stat. 2242, 3080, 3084 (Dec. 

18, 2015).
Enforcement of Tax Laws

Page 505 GAO-17-317 High-Risk Series

provisions could help taxpayers more easily understand and comply 

with their obligations and get the maximum tax benefit for their 

situations. For example, there are several provisions in the tax code 

benefiting taxpayers’ educational expenses, but the definition of what 

qualifies as a higher-education expense varies between these tax 

expenditures.

IRS has met the criterion of demonstrating a strong commitment to, and 

top leadership support for, improving tax compliance and addressing the 

tax gap. Some steps IRS has taken include the following:

• IRS adopted a new, more strategic approach to identifying and 

selecting budget program priorities. IRS prioritized a subset of its 19 

strategic objectives for action and established six themes that 

represent its “future state” vision for tax administration. In the fiscal 

year 2017 congressional justification, IRS linked requests for 

increased funding to the themes and included details on how much 

would be funded by each appropriation account. IRS also identified 

enterprise goals to guide the IRS toward the future state. However, as 

of December 2016, IRS has yet to set targets for meeting the goals, 

but plans to have targets in place by June 2017.

Additional Details on 

What GAO Found

Enforcement of Tax laws

Leadership Commitment
Enforcement of Tax Laws

Page 506 GAO-17-317 High-Risk Series

• IRS has continued to research the extent and causes of taxpayer 

noncompliance. We have consistently stressed the importance of IRS 

conducting tax compliance research.

• IRS extended a program to encourage taxpayers to voluntarily report 

their previously undisclosed foreign accounts and assets. IRS has 

collected over $10 billion since this program was initiated in 2009, and 

has implemented some of our recommendations on better managing 

the program.

IRS has not met the criterion of having the capacity to demonstrate 

progress toward improving compliance and addressing the tax gap. IRS’s 

ability to carry out ongoing enforcement programs and implement new 

initiatives to improve tax law enforcement, such as those required by 

PPACA, could be challenged under an uncertain budget environment. 

IRS is further challenged because it does not calculate ROI estimates for 

each enforcement program— information IRS could use to inform 

resource allocation decisions. IRS has also not determined how to best 

leverage automated processes and stakeholders such as whistleblowers.

Between fiscal years 2011 and 2016, IRS’s annual appropriations 

declined about $900 million.4 Likewise, staffing has declined: full-time 

equivalent staff members funded by annual appropriations declined by 

12,000 between fiscal year 2011 and fiscal year 2016, a 13 percent 

reduction. At the same time, IRS’s enforcement performance has 

declined. For example, the individual examination (or audit) coverage rate 

declined by 20 percent from fiscal years 2013 to 2015—the most recent 

years available. Reductions in examinations can reduce revenue 

collected and may indirectly reduce voluntary compliance. These declines 

have also contributed to fluctuations in taxpayer service and longer wait 

times on the phones than taxpayers have historically experienced.

IRS partially meets the criterion for having a corrective action plan to 

improve tax compliance and address the tax gap. Specifically, IRS has a 

strategic plan that discusses general approaches to make voluntary 

compliance easier for taxpayers and to ensure taxes owed are paid. 

However, in some areas, the plan does not include specific tactics for 

improving compliance strategies. We have identified and made 

recommendations in several areas that could help IRS improve its 

corrective action plan. We subsequently designated several of these as 

 4

Annual appropriations increased by $290 million between fiscal years 2015 ($10.9 billion) 

and 2016 ($11.2 billion).

Capacity

Action Plan
Enforcement of Tax Laws

Page 507 GAO-17-317 High-Risk Series

priority recommendations, because if implemented, they could yield 

significant improvements to IRS’s operations.

• Better measure return on investment. IRS’s budget environment 

and increased workload underscore the importance of IRS maximizing 

its resources in fulfilling its mission. By further refining direct revenue 

ROI measures of its enforcement programs, IRS could improve how it 

allocates resources across its programs. In 2012, we made various 

recommendations advising IRS to make better use of ROI measures, 

subject to other considerations of tax administration, such as 

minimizing compliance costs and ensuring equitable treatment across 

different groups of taxpayers.

IRS is taking steps to implement these priority recommendations. For 

example, IRS has made progress developing a methodology for 

estimating marginal ratios for a limited subset of cases within the 

correspondence examination program. IRS officials are working to 

apply this methodology more broadly; however, they expect this effort 

will be complex and time consuming. As of November 2016, officials 

do not have a timeline for full implementation. Until IRS takes into 

account some measure of revenue yield per dollar of cost when 

making allocation decisions, it may be missing opportunities to collect 

significant amounts of additional revenue.

• Better leverage automated processes. Taking greater advantage of 

automated processes could enhance some IRS enforcement 

programs. For example, IRS does not routinely match the K-1 

information return—on which partnerships and S corporations report 

income distributed to partners or shareholders—to income information 

on tax returns for partners and shareholders that are themselves 

partnerships and S corporations. Matching such information might be 

another tool for detecting noncompliance by these types of entities. In 

2014, we recommended that IRS test the feasibility of such matching.

IRS stated it would consider studying such testing if resources 

become available.

Likewise, continuing to enhance automated taxpayer services, such 

as web services, could result in lower-cost methods of interacting with 

taxpayers. In 2013, we made various recommendations for IRS to 

improve web services provided to taxpayers. IRS has made progress 

in addressing these priority recommendations but has not yet 

completed its efforts. IRS’s strategy has evolved from a singular focus 

on online services to a more comprehensive strategy of taxpayer 

interaction—the Future State Initiative—through all service channels. 
Enforcement of Tax Laws

Page 508 GAO-17-317 High-Risk Series

We will continue to assess the new initiative as IRS continues its 

development.

• Improve enforcement data. More complete enforcement data could 

help IRS better allocate resources across programs. For example, in 

2014, we found that IRS did not know the full extent to which 

partnerships and S-corporations misreported income, and that IRS 

examinations and automated document matching have not been 

effective at finding most of the estimated misreported income. Further, 

IRS does not know how partnerships misreporting income affects 

taxes paid by partners. We recommended, among other things, that 

IRS (1) develop and implement a strategy to improve its information 

on the extent and nature of partnership misreporting, and (2) use the 

information to potentially improve how it selects partnership returns to 

examine. IRS agreed with these priority recommendations and 

developed a strategy, which will involve a multiyear examination effort 

to collect audit data from a representative, statistical sample of 

partnerships. Information from the full study will help IRS make betterinformed data-based decisions on enforcement decisions. IRS 

officials also reported that in January 2016, IRS launched a research 

study on a subset of the population of partnerships with three or fewer 

individual partners. The results of this study could improve IRS’s 

ability to estimate the extent and nature of partnership misreporting, 

and the effectiveness of partnership examinations in detecting 

misreporting. However, as of December 2016, IRS had not fully 

implemented the strategy or the research study on small partnerships.

IRS partially meets the criterion of having a program to monitor corrective 

measures. As previously mentioned, IRS continues to research the extent 

of taxpayer noncompliance, and periodically estimates the voluntary 

compliance rate—the amount of tax for a given year that is paid on time. 

However, IRS does not adequately measure the impact of some specific 

compliance programs, such as the following:

• Correspondence examinations. IRS does not have information to 

determine how its program of examining tax returns via 

correspondence affects the agency’s broader strategic goals for 

compliance, taxpayer burden, and cost. Thus, it is not possible to tell 

whether the program is performing better or worse from one year to 

the next. In 2014, we made several recommendations, including a 

priority recommendation, related to monitoring program performance. 

IRS officials provided documents intended to establish 

correspondence audit program objectives and measures, and link 

them to the overall IRS goals and objectives; but the objectives, 

measures, and links were not clear. As of January 2017, officials had 

Monitoring
Enforcement of Tax Laws

Page 509 GAO-17-317 High-Risk Series

no planned date by which to clearly document the objectives, 

measures, and links. They said they expect to describe the objectives 

in program guidance changes anticipated in the next 12 to 18 months.

• Compliance Assurance Process. IRS does not fully assess the 

savings it achieves through its Compliance Assurance Process 

(CAP)—through which large corporate taxpayers and IRS agree on 

how to report tax issues before tax returns are filed. In 2013, we 

recommended that IRS track savings from CAP and develop a plan 

for reinvesting any savings to help insure the program is meeting its 

goals. Although IRS has taken steps to track savings by analyzing 

and comparing the workload inventory of account coordinators who 

handle CAP cases against team coordinators who handle non-CAP 

cases, it did not show how such a workload comparison demonstrated 

savings from CAP. IRS has also not developed a plan for reinvesting 

any savings. Without a plan for tracking savings and using the savings 

to increase audit coverage, IRS cannot be assured that the savings 

are effectively invested in either CAP or non-CAP cases with high 

compliance risk. As of November 2016, IRS is evaluating the CAP 

program to determine how it fits with IRS’s future vision for 

examinations, but it has no timetable for completing this evaluation. 

Also, IRS did not accept new CAP applications for 2016.

IRS has partially met the criterion of demonstrating progress in 

implementing corrective measures to improve compliance and reduce the 

tax gap. For example, IRS is taking steps to better leverage stakeholders 

by strengthening its nine public referrals programs—which enable 

individuals to submit information to IRS about tax noncompliance—but 

has not yet determined how to measure results for other programs 

intended to leverage third-party information to improve compliance. 

Specifically,

• Public Referral Programs. Public referral programs are an important 

piece of IRS’s overall enforcement strategy and can help reduce the 

tax gap. We made several recommendations to IRS, including that it 

establish a coordination mechanism to communicate across the 

multiple referral programs, develop an online referral submission 

process, streamline the review process, and improve external 

communication. IRS has taken some actions to establish a 

mechanism to coordinate on a plan and timeline for developing a 

consolidated, online referral submission, which is also a priority 

recommendation. For example, IRS established a cross-functional 

team in February 2016 to conduct a comprehensive review of IRS’s 

referral programs. In November 2016, the cross-functional team 

proposed creating an online submission referral application to simplify 

Demonstrated Progress
Enforcement of Tax Laws

Page 510 GAO-17-317 High-Risk Series

access and filing of information referrals by the public. The team also

requested information technology resources for fiscal year 2019 to 

develop an online system which it said could potentially replace four 

separate referral forms, filter out incomplete referrals, and 

electronically route referrals for further IRS action. IRS assessed 

options for consolidating all forms for the various referral programs 

and determined that a consolidated single form was not feasible at 

this time due to the technical nature and complexity of the various 

referral types. As of December 2016, IRS said it will consider further 

consolidation of the referral programs once the online application is in 

place.

• Whistleblower Office. We also identified key problems specific to the 

whistleblower program, which is the largest of IRS’s nine referral 

programs. For example, few large awards have been paid, claims 

take years to process, and communication with whistleblowers is 

limited. IRS agreed with our 10 recommendations to strengthen the 

whistleblower program, has already implemented several of them, and 

is in the process of implementing the rest. Until IRS completes these 

actions, it may be missing opportunities to assist the public, collect 

billions in uncollected taxes owed, and leverage resources to 

streamline processes, which could help it to better coordinate and 

identify possible efficiencies, as well as better manage fragmentation 

and overlap among its referral programs.

• Efforts to Encourage Voluntary Compliance. Also, as previously 

mentioned, IRS has collected more than $10 billion through its 

program to encourage taxpayers to voluntarily report their previously 

undisclosed foreign accounts and assets. However, for some 

initiatives—such as those related to the Foreign Account Tax 

Compliance Act or using payment data from credit card companies to 

improve compliance among small businesses—IRS is still determining 

how to best measure results, including the effect on the tax gap.
Enforcement of Tax Laws

Page 511 GAO-17-317 High-Risk Series

IRS has met the criterion for demonstrating leadership commitment for 

combating IDT refund fraud. The agency has taken steps to address IDT 

refund fraud, including recognizing the challenge of IDT refund fraud in its 

fiscal year 2014-2017 strategic plan, and expanding its automated fraud 

filters to detect IDT and prevent fraudulent refunds. The IRS 

Commissioner has testified numerous times about the challenges from 

IDT refund fraud and the agency’s progress on the issue. Further, the IRS 

Commissioner convened a Security Summit in March 2015 to bring 

together representatives of the tax preparation and software industry and 

state tax administrators to launch a collaborative effort to combat IDT 

refund fraud. According to IRS officials, this collaboration has resulted in 

enhanced authentication procedures and data sharing. IRS’s Identity 

Theft Tax Refund Fraud Information Sharing and Analysis Center—where 

IRS, states, and industry can share information—is intended to become 

operational at the start of the 2017 Filing Season in January.

IRS has partially met the criterion for having the capacity to combat IDT 

refund fraud. In fiscal year 2016, IRS reported that it staffed more than 

4,000 full-time equivalents (FTE) and spent about $516 million on all 

refund fraud and IDT activities. Under the Consolidated Appropriations 

Act 2016, IRS received an additional $290 million to improve customer 

service, IDT identification and prevention, and cybersecurity efforts. The 

agency requested an additional $90 million and an additional 491 FTEs 

Refund Fraud Related to 

Identity Theft

Leadership Commitment

Capacity
Enforcement of Tax Laws

Page 512 GAO-17-317 High-Risk Series

for fiscal year 2017 to help prevent IDT refund fraud and reduce other 

improper payments. At the same time, IRS’s ability to combat IDT refund 

fraud will continue to be challenged by “adaptive adversaries” that 

continuously change their methods as IRS improves its defenses. For 

example, recent schemes have involved fraudsters targeting sources of 

personal and financial information—such as payroll providers and IRS’s 

Get Transcript service—in order to file returns that look like past returns 

filed by legitimate taxpayers. IRS is also constrained in its ability to 

combat IDT refund fraud because it must balance the need to prevent 

fraud against increasing the burden on legitimate taxpayers filing their 

taxes.

IRS has met the criterion for having an action plan to address IDT refund 

fraud. IRS has a strategic plan that identifies refund fraud and IDT as 

major challenges facing the nation’s tax system over the next several 

years. IRS has also identified several strategic objectives relevant to its 

efforts to combat IDT, including balancing the speed of refund delivery 

with the need to verify taxpayers’ identities; and using third-party data, 

risk modeling, and a historical view of taxpayer interactions to prevent 

fraud before issuing refunds. In addition, IRS developed a more detailed 

Refund Fraud & IDT Strategy in January 2015 and updated it in January

2016. The strategy identifies and assesses the costs and benefits of 

actions IRS can take to combat IDT refund fraud (both with and without 

legislative change or a significant change in taxpayer expectations). The 

strategy has not been updated to reflect new, earlier W-2 filing deadlines 

enacted in December 2015 as part of the 2016 Consolidated 

Appropriations Act.5 However, officials told us that the agency is working 

with the Social Security Administration to accommodate earlier W-2 data, 

and plans to use the data, when available, to match to information 

reported on tax returns. According to IRS, prerefund matching using 

earlier W-2 data would potentially save a substantial part of the billions of 

taxpayer dollars currently lost to fraudsters.

IRS has partially met the criterion of having a program to monitor 

corrective measures. IRS’s Identity Theft Taxonomy (Taxonomy) is a 

research-based effort to provide information to internal and external 

stakeholders about the effectiveness of IRS’s IDT defenses and help IRS 

identify IDT trends and evolving risks. While IRS has implemented a new 

methodology to improve its 2014 estimates in response to our past 

 5

26 U.SC. § 6071(c).

Action Plan

Monitoring
Enforcement of Tax Laws

Page 513 GAO-17-317 High-Risk Series

recommendations, additional action is needed. We will analyze the 2015 

Taxonomy estimates to determine the extent to which our 

recommendations have been implemented.

IRS has partially met the criterion for demonstrating progress in 

implementing corrective measures to address IDT refund fraud. IRS has 

developed tools and programs to further detect and prevent IDT refund 

fraud. IRS has also enhanced its authentication efforts for some online 

services, such as the Get Transcript application. However, IRS could 

further demonstrate progress by, for example, implementing our previous 

priority recommendation related to authentication weaknesses. While IRS 

has taken steps to address this recommendation, the agency has not 

used cost-benefit-risk analysis to select which authentication tools to use 

for certain taxpayer interactions. Without analysis of costs, benefits, and 

risks, IRS and Congress may not have quantitative information that could 

inform decisions about whether and how much to invest in the various 

authentication options.

While IRS has developed research efforts to assess the effectiveness of 

its IDT defenses, it is unclear whether yearly changes in the amount of 

estimated IDT refund fraud prevented and paid are due to:

• methodological changes (i.e., using a different data source);

• overall changes in fraud patterns (i.e., an increase or decrease in 

fraud attempts);

• improvements in IRS IDT defenses; or

• fraudsters’ ability to file returns using schemes IRS has not yet 

learned to detect.

Specifically, IRS’s 2014 estimates cannot be compared to 2013 estimates 

because of substantial methodology changes that better reflect new IDT 

refund fraud schemes and improve the accuracy of its estimates, 

according to IRS officials.

• Improving Efficiency of Partnership Audits. Congress enacted 

legislation that alters the Tax Equity and Fiscal Responsibility Act 

(TEFRA) audit procedures, as we suggested in September 2014. The 

Bipartisan Budget Act of 2015, which was enacted in November 2015, 

repeals TEFRA audit procedures and mandates audit procedures that 

Demonstrated Progress

Benefits Achieved by 

Implementing our 

Recommendations
Enforcement of Tax Laws

Page 514 GAO-17-317 High-Risk Series

require partnerships with more than 100 partners to pay audit 

adjustments at the partnership level, among other changes.6 The 

legislative changes enacted to TEFRA we suggested could help with 

the time constraints of large partnership audits as well as reduce the 

resource demands of those audits. The Joint Committee on Taxation 

estimates this should raise $9.3 billion in additional revenue from 

fiscal years 2019 to 2025.

• Increasing Tax Compliance through Third-Party Reporting. Our 

past work underscored that data reported to IRS by third parties about 

taxpayers’ income is a powerful tool to improve taxpayer compliance. 

In response, Congress passed legislation in 2008—effective in 2011, 

which required banks and others to report income that merchants 

received through certain payment methods such as credit cards or 

third-party networks like PayPal.7 IRS compares this information to 

the merchants’ tax returns to help verify taxpayer compliance, which 

the Joint Committee on Taxation estimated would increase tax 

compliance by $3.9 billion between 2013 and 2016.

• Improving Tax Reporting on the Sale of Securities. We reported 

that many taxpayers misreported their capital gains or losses from the 

sale of securities. This often happened because taxpayers failed to 

accurately report the cost of the securities they sold. We suggested 

that Congress require brokers to report to both taxpayers and IRS the 

adjusted cost of the securities sold by taxpayers. In response, 

Congress enacted this requirement in 2008,8 which the Joint 

Committee on Taxation estimated would increase tax compliance by 

$3.2 billion between 2012 and 2016.

• Reporting Additional Mortgage Debt Information to Increase Tax 

Compliance. In 2015, Congress enacted the Surface Transportation 

and Veterans Health Care Choice Improvement Act. Section 2003 of 

the act requires taxpayers receiving mortgage interest payments to 

report the origination date of the mortgage, the amount of outstanding 

principal at the beginning of the calendar year, and the property’s 

address.9 In response to the legislation, IRS updated Form 1098 

Mortgage Interest Statement for 2016, which is available for the 2017 

 6

Pub. L. No. 114-74, § 1101, 129 Stat. 584, 625–638 (Nov. 2, 2015).

7

26 U.S.C. § 6050W. 

8 26 U.S.C. §§ 6045(g), 6045A, and 6045B.

9

Pub. L. No. 114-41, § 2003, 129 Stat. 443, 454 (July 31, 2015).
Enforcement of Tax Laws

Page 515 GAO-17-317 High-Risk Series

filing season. The Joint Committee on Taxation estimated that this 

change would increase tax compliance by $1.8 billion between 2015 

and 2025.

• Strengthening Controls Over Higher Education Tax Benefits. 

Congress enacted three provisions in 2015 to strengthen controls 

over higher education tax benefits to reduce inaccurate claims. These 

provisions: 1) require educational institutions to report only the 

aggregate amount of qualified tuition and related expenses actually 

paid to the educational institution during the calendar year; 2) require 

taxpayers to receive a completed Form 1098-T to claim a credit or 

deduction for education expenses for tax years beginning after the 

date of enactment; and 3) require educational institutions to provide 

their employer identification number on the Form 1098-T, and 

taxpayers claiming a credit for qualified tuition and educational 

expenses to provide this employer identification number.10 The Joint 

Committee on Taxation estimated that these changes would increase 

tax compliance by $2 million, $576 million, and $837 million, 

respectively, between fiscal years 2016 and 2025.

• Reducing Funding Requests by Modifying Cost Calculation of 

New Hires. Prior to the fiscal year 2015 budget request, IRS assumed 

all new staff requested for new initiatives in the budget request would 

be hired at the start of the fiscal year, although actual hiring patterns 

indicated new staff were brought on throughout the fiscal year and 

primarily in the 3rd and 4th quarters. As a result, IRS modified its 

calculation for new hires using a later estimated hire date. In the fiscal 

year 2015 and 2016 request, the estimated hire date was January 

1st—the end of the 1st quarter. In the fiscal year 2017 request, the 

estimated hire date was April 1st—the start of the 3rd quarter. As a 

result, the funding requests for fiscal years 2015, 2016 and 2017 were 

approximately $518 million less than if IRS used its prior methodology 

for calculating FTE costs associated with new initiatives.

• Expanding Math Error Authority to Enforce First-Time 

Homebuyer Credit (FTHBC) Repayment Provision. In 2009, we 

found that IRS lacked math error authority, which must be provided by 

statute, to automatically correct tax returns on which taxpayers 

claimed the 2008 version of the FTHBC but did not repay it as 

required. We suggested that IRS be granted math error authority to 

enforce the FTHBC repayment provision. In response, Congress 

 10Pub. L. No. 114-113, div Q §§ 211, 212, 129 Stat. 2242, 3085–3086 (Dec. 18, 2015); 

Public Law 114-27, § 804, 129 Stat. 362, 415–416 (June 29, 2015).
Enforcement of Tax Laws

Page 516 GAO-17-317 High-Risk Series

enacted legislation in 2009 granting IRS math error authority for this 

purpose,11 which we estimate has increased tax compliance by 

approximately $206 million between 2011 and 2014, after accounting 

for IRS costs.

• Redirecting Resources to Improve Taxpayer Services. In 

December 2012, we reported that IRS had made incremental 

efficiency gains in delivering taxpayer services, but the agency 

needed to do more to combat the imbalance between taxpayer 

demand for services and available resources. IRS acknowledged it 

needed to adjust its taxpayer service delivery because the agency 

lacked sufficient resources to answer every telephone call and serve 

every taxpayer who visits a walk-in site. Consistent with our finding 

that a more dramatic revision in providing service was necessary, IRS 

implemented six service initiatives in fiscal year 2014 that shifted 

taxpayers from using telephone and walk-in services to more costeffective self-service options. As a result of these initiatives, IRS 

realized about $50.6 million of IRS resources in fiscal year 2016 

dollars.

• Identifying Taxpayers Using Quiet Disclosures to Circumvent 

Taxes. In March 2016, IRS officials reported completing research to 

determine and implement the best option for identifying and pursuing 

potential quiet disclosures, as we recommended in March 2013. IRS 

reported that it identified more than 350 cases using its new 

methodology and as of October 2016 had completed examinations of 

179 taxpayers, resulting in approximately $9.1 million in additional tax 

assessments.

• Using Data to Improve Taxpayer Services. IRS officials analyzed 

correspondence response timeliness data through the end of fiscal 

year 2014 and found that delays were continuing and more 

improvements were needed, including further revisions to notices and 

a revised automated recorded telephone message for taxpayers 

calling about the status of an audit. By analyzing the data as we 

recommended in June 2014, and using that data to change outgoing 

recorded messages starting in January 2015, IRS is better able to 

improve taxpayer service, reduce the need for taxpayer calls, and 

more efficiently use IRS resources.

• Taking Steps to Improve Claims Process and Communications to 

Encourage Tax Whistleblowers. Our 2015 review of the IRS 

 1126 U.S.C. § 6213(g)(2)(N).
Enforcement of Tax Laws

Page 517 GAO-17-317 High-Risk Series

whistleblower program resulted in ten recommendations. IRS 

concurred with these recommendations and has already implemented 

several of them. Both whistleblowers and IRS stand to benefit greatly 

as a result of actions IRS has taken such as streamlining the intake 

and initial review process of whistleblower claims and improving 

communications. For example, having a more streamlined staffing 

strategy will allow the Whistleblower Office to review more claims in a 

timely manner and get information to examiners more quickly to help 

IRS collect additional revenue. Also, communicating relevant 

information earlier to whistleblowers will help address a common 

complaint of the whistleblower community about the lack of timely 

communication from the Whistleblower Office and could encourage 

more whistleblowers to come forward with information.

• Using Employer Wage Data to Prevent Identity Theft Fraud. In 

2014, we found that fraudsters take advantage of IRS’s “look back”

compliance model, where the agency issues refunds before 

completing all compliance checks. If IRS matched employer wage 

data to tax returns earlier, before issuing refunds, it could help prevent 

fraud. We recommended that IRS assess the costs and benefits of 

accelerating W-2 deadlines and provide this information to Congress. 

Based on our review, in September 2015, IRS presented Congress 

with a document detailing the costs and benefits of W-2 acceleration. 

The document discusses the IRS systems and work processes that 

will need to be adjusted to accommodate earlier, prerefund matching 

of W-2s, the time frames for when these changes could be made; 

potential impacts on taxpayers, IRS, other parties; and what other 

changes will be needed (such as delaying refunds) to ensure IRS can 

match tax returns to W-2 data before issuing refunds. Congress 

accelerated W-2 filing deadlines to January 31 as part of the 2016 

Consolidated Appropriations Act.12 This change will provide IRS with 

earlier access to W-2 data. According to IRS, prerefund matching 

would potentially save a substantial part of the billions of taxpayer 

dollars currently lost to fraudsters.

• Improving IRS’s estimates of IDT refund fraud. Based on our 

review, in August 2014 IRS changed its methodology for counting 

fraudulent IDT refunds paid, which increased the estimate of IDT 

refunds paid in 2013 by about $1 billion (from its original estimate of 

$4.8 billion to $5.8 billion).The research IRS used to develop these 

refund fraud estimates is important as it helps IRS better understand 

 12Pub. L. No. 114-113, div Q § 201, 129 Stat. 2242, 3076 (Dec. 18, 2015). This change 

goes into effect for W-2s reporting payments made in 2016 and filed in 2017.
Enforcement of Tax Laws

Page 518 GAO-17-317 High-Risk Series

how IDT refund fraud is bypassing agency defenses to improve IDT 

controls. In June of 2016, we made additional recommendations that 

IRS improve its IDT cost estimates by removing refund thresholds and 

using return-level data where available.

• Improving the design and implementation of exempt organization 

examination selection. The Exempt Organizations Exam unit within 

IRS completed an action plan for the process of reviewing and 

updating its Internal Revenue Manual sections on an ongoing basis, 

as we recommended in July 2015. Implementation of the plan began 

at the end of 2015. Updated and accurate procedures help ensure 

that employees follow correct procedures and consistently administer 

tax laws.

For additional information about this high-risk area, contact James R. 

McTigue, Jr., or Jessica Lucas-Judy at 202-512-9110 or 

mctiguej@gao.gov or lucasjudyj@gao.gov.

Refundable Tax Credits: Comprehensive Compliance Strategy and 

Expanded Use of Data Could Strengthen IRS’s Efforts to Address 

Noncompliance. GAO-16-475. Washington, D.C.: May 27, 2016.

GAO Series of Reports on Identity Theft: Identity Theft and Tax Fraud: 

IRS Needs to Update Its Risk Assessment for the Taxpayer Protection 

Program. GAO-16-508; Washington, D.C.: May 24, 2016; Identity Theft 

and Tax Fraud: Enhanced Authentication Could Combat Refund Fraud, 

but IRS Lacks an Estimate of Costs, Benefits and Risks. GAO-15-119. 

Washington, D.C.: January 20, 2015; and Identity Theft: Additional 

Actions Could Help IRS Combat the Large, Evolving Threat of Refund 

Fraud. GAO-14-633. Washington, D.C.: August 20, 2014.

IRS Referral Programs: Opportunities Exist to Strengthen Controls and 

Increase Coordination across Overlapping Programs, GAO-16-155. 

Washington, D.C.: February 23, 2016.

2015 Tax Filing Season: Deteriorating Taxpayer Service Underscores 

Need for a Comprehensive Strategy and Process Efficiencies. 

GAO-16-151. Washington, D.C.: December 16, 2015.

IRS Whistleblower Program: Billions Collected, but Timeliness and 

Communication Concerns May Discourage Whistleblowers. GAO-16-20. 

Washington, D.C.: October 29, 2015.

GAO Contact

Related GAO 

Products
Enforcement of Tax Laws

Page 519 GAO-17-317 High-Risk Series

Small Businesses: IRS Considers Taxpayer Burden in Tax 

Administration, but Needs a Plan to Evaluate the Use of Payment Card 

Information for Compliance Efforts. GAO-15-513. Washington, D.C.: June 

30, 2015.

Large Partnerships: With Growing Number of Partnerships, IRS Needs to 

Improve Audit Efficiency. GAO-14-732. Washington, D.C.: September 18, 

2014.

IRS Correspondence Audits: Better Management Could Improve Tax 

Compliance and Reduce Taxpayer Burden. GAO-14-479. Washington, 

D.C.: June 5, 2014.

Partnerships and S Corporations: IRS Needs to Improve Information to 

Address Tax Noncompliance. GAO-14-453. Washington, D.C.: May 14, 

2014.
Medicare Program

Page 520 GAO-17-317 High-Risk Series

We designated Medicare as a high-risk program in 1990 due to its size, 

complexity, and susceptibility to mismanagement and improper 

payments. Addressing Medicare’s short-term and long-term challenges is 

vitally important, not only for the millions of aged and disabled individuals 

who depend upon the program for health care coverage, but also for the 

families of these individuals who might otherwise bear the cost of their 

health care, the taxpayers who finance the program, and the health care 

providers who depend upon receiving fair compensation for their services. 

The aging of the population, coupled with the growth in per capita health 

care costs, will magnify these challenges over time. Therefore, continued 

close attention will be necessary to ensure that Medicare is sustainable 

for generations to come.

Medicare continues to pose challenges to the federal government for 

many of the same reasons we designated it a high-risk program. 

Specifically, Medicare’s substantial size and scope result in the current 

program having wide ranging effects on beneficiaries, the health care 

sector, and the overall U.S. economy. In 2016, Medicare was projected to 

spend $696 billion and provide health care coverage to over 57 million 

beneficiaries. Medicare pays about 60 percent of the health care costs of 

beneficiaries enrolled in fee-for-service (FFS) who do not reside in 

institutions.1 Over 1 million health care providers, contractors, and 

suppliers—including private health plans, physicians, hospitals, skilled 

nursing facilities, durable medical equipment (DME) suppliers, ambulance 

providers, and many others—receive payments from Medicare. Every 

year, Medicare pays over a billion claims submitted by these health care 

providers. Consequently, Medicare must be closely monitored because 

even relatively small changes can have large short-term effects in the 

aggregate. For example, Medicare provider payment rates that are set 

too high unnecessarily financially burden beneficiaries—through higher 

premiums and cost sharing—taxpayers, and the federal budget. Payment 

rates that are set too low may diminish providers’ willingness to treat 

Medicare beneficiaries and adversely affect their access to appropriate, 

high-quality health care.

 1

The remainder of these health care costs are financed by beneficiaries’ direct spending, 

private supplements—such as Medigap—and other public sources.

Medicare Program

Current State of the 

Medicare Program

Overview of Medicare’s 

Challenges

Ongoing Challenges
Medicare Program

Page 521 GAO-17-317 High-Risk Series

Medicare also has an outsize effect on the federal budget, which creates 

challenges when the federal government is determining how to prioritize 

its spending. The program’s expenditures currently account for about 3.6 

percent of the country’s gross domestic product (GDP).The 

Congressional Budget Office (CBO) projects that in fiscal year 2016, 

Medicare outlays will total more than is projected to be spent on defense 

($579 billion) and almost double federal spending on Medicaid ($365 

billion). Medicare spending will account for approximately 17.8 percent of 

the approximately $3.9 trillion in federal outlays.

Medicare also poses substantial long-term financial challenges for the 

federal government. Program spending is expected to increase 

significantly over time as the number of beneficiaries grows and per 

capita health care costs increase. CBO projects that, in just 10 years (in 

2026) under current law, Medicare spending will reach almost $1.3 trillion. 

The Medicare Trustees 2016 report stated that, under current law, 

Medicare’s share of GDP would rise to 5.6 percent by 2040. As Medicare 

spending grows disproportionately to other federal spending and the 

economy, it will put increasing pressure on the federal budget and tend to 

squeeze out spending for other programs.

However, the Trustees have stated that Medicare spending projections, 

especially those stretching out over decades, are highly uncertain and 

cautioned that future Medicare spending could be substantially higher 

than projected. In their 2016 report, they noted that some Medicare costreduction provisions may be difficult to sustain. 2 For example, one set of 

Medicare provisions affecting many types of health care providers 

reduces the annual payment rate updates to account for economy-wide 

productivity growth. However, the productivity growth rates historically 

achieved by health care providers have been lower than the economywide rates. If health care providers do not realize sufficiently high 

productivity growth and these cost-reduction measures are not sustained, 

Medicare projected spending could rise to 6.2 percent of GDP in 2040 

and 9.1 percent in 2090, according to the Trustees.

 2

In reporting the results of our audit of the U.S. government’s consolidated financial 

statements for fiscal years 2016 and 2015, we noted that significant uncertainties, 

primarily related to achieving these projected reductions in Medicare cost growth reflected 

in the 2016, 2015, 2014, 2013, and 2012 Statements of Social Insurance, prevented us 

from expressing an opinion on those statements as well as on the 2015 and 2014 

Statements of Changes in Social Insurance Amounts. See Financial Audit: U.S. 

Government’s Fiscal Years 2016 and 2015 Consolidated Financial Statements, 

GAO-17-283R (Washington, D.C.: Jan. 12, 2017). 

Long-Term Challenges
Medicare Program

Page 522 GAO-17-317 High-Risk Series

Another uncertainty is whether advances in medical technology will tend 

to slow or accelerate Medicare spending growth. Technological advances 

may enhance the ability of providers to diagnose, treat, or prevent health 

problems. Examples include new drugs, devices, procedures, and 

therapies, as well as new applications of existing technologies. Although 

new technologies may decrease or increase health care costs, in 2013 

we reported that technological change had likely been the dominant 

cause (accounting for 36 to 55 percent) of the increases in overall U.S. 

health care per capita spending over the past several decades.3 It should 

be noted, however, that a complete assessment of health care spending 

for new technologies should also consider the associated value for 

individuals, often measured by improved health functioning, increased life 

expectancy, or improved economic productivity.

In the past few years, growth in Medicare spending has slowed, as overall 

health care spending has also slowed. Analysts debate whether this 

slowdown can be attributed to transitory effects, such as the recent 

economic turndown, or broader changes in the health care system that 

may be longer lasting. Nonetheless, Medicare’s historical trends, the 

aging of the population, and the uncertainties associated with recent 

reforms and the effects of advances in medical technology all underscore 

the need for continued efforts to moderate spending growth while 

ensuring that beneficiaries have appropriate access to high-quality health 

care. Achieving these goals will likely remain an important challenge and 

require a continued focus on the Medicare program.

 3

In general, a technological change that enables providers to treat a previously 

untreatable disease will increase health care spending, while expanding disease 

management or shifting disease management to prevention or cure can lead to either 

increased or decreased health care spending. However, introducing new treatments and 

technologies may result in increased health care spending due to the possibility that 

health complications may arise from a new treatment, or that patients survive one disease 

long enough and eventually are diagnosed with an additional disease with additional 

treatment costs. For more information on the effects of technological change on health 

care spending growth, see GAO, Patient Protection and Affordable Care Act: Effect on 

Long-Term Federal Budget Outlook Largely Depends on Whether Cost Containment 

Sustained, GAO-13-281 (Washington, D.C.: Jan. 31, 2013).
Medicare Program

Page 523 GAO-17-317 High-Risk Series

In March 2010, the Patient Protection and Affordable Care Act (PPACA) 

was enacted, which, among other things, made numerous statutory 

changes to Medicare.

4 CBO estimated that PPACA would reduce 

Medicare spending by about $400 billion over 10 years from fiscal year 

2010 to fiscal year 2019. Major savings were expected from several 

actions, including constraining annual payment updates to certain 

Medicare providers, tying Medicare Advantage (MA)—Medicare’s private 

plan alternative to the traditional Medicare FFS program—maximum 

payment amounts to near or below FFS spending, reducing payments to 

hospitals that serve a large number of low-income patients—reflecting the 

expectation that PPACA’s health insurance expansion provisions would 

result in far fewer uninsured hospital patients—and modifying the highincome threshold for adjusting beneficiary Part B premiums, among other 

changes.

Some PPACA provisions sought to establish financial incentives for 

providers to increase the efficiency and quality of Medicare services, or to 

test new ways of achieving those goals. For example, PPACA required 

the establishment of a national, voluntary pilot program to bundle 

payments for physician, hospital, and post-acute care services to improve 

patient care and reduce spending. Another provision modified payments 

to hospitals that experience patient readmissions related to certain 

potentially preventable conditions. Certain PPACA payment changes 

seek to provide a strong financial incentive for health care providers to 

enhance productivity, improve efficiency, or otherwise reduce their costs 

per service. Notably, several of PPACA’s changes seek to implement 

value-based purchasing of health care and transform the program into 

one that encourages efficiency and quality, instead of simply 

compensating providers for the volume of health care services.

In April 2015, the Medicare Access and CHIP Reauthorization Act of 2015 

(MACRA) was enacted, bringing additional changes to the way Medicare 

reimburses physicians, among other changes to Medicare. MACRA 

repealed the sustainable growth rate (SGR) system—which was first 

implemented in 1998 to moderate spending for physician services—and 

established a new payment framework to encourage efficiency in the 

provision of health care and to reward health care providers for higher 

 4

Pub. L. No. 111-148, 124 Stat. 119 (2010), as amended by the Health Care and 

Education Reconciliation Act of 2010, Pub. L. No. 111-152, 124 Stat. 1029 (2010). In this 

report, references to “PPACA” include amendments made by the Health Care and 

Education Reconciliation Act of 2010.

Highlights of Recent 

Key Legislation and 

Significant Reform 

Efforts
Medicare Program

Page 524 GAO-17-317 High-Risk Series

quality of care. Specifically, MACRA created a Merit-based Incentive 

Payment System (MIPS) that will be used to increase or decrease certain 

physicians’ payments based on their performance. Under MIPS, the 

Centers for Medicare & Medicaid Services (CMS) will assess physician 

performance in four categories: quality; cost; clinical practice 

improvement activities; and advancing care information through the 

meaningful use of electronic health records technology. MACRA also 

included provisions to incentivize Medicare providers to participate in 

alternative payment models, such as qualifying accountable care 

organizations.5 In addition to reforming physician payment, MACRA made 

several other changes to Medicare, including making income-related 

adjustments to premiums in Medicare Parts B and D.

It is too early to tell the extent to which these changes in PPACA and 

MACRA may help constrain Medicare spending over the long run, as the 

changes have only recently been implemented, or their implementation is 

ongoing. Moreover, future legislation could modify payment reforms, such 

as those established by PPACA and MACRA, and affect their impact on 

program spending. In addition, uncertainty about PPACA’s and MACRA’s 

effects on spending exists because future spending may also depend on 

changes in the rest of the health care system. For example, provisions of 

PPACA are designed to increase the number of individuals with health 

insurance and reduce the number of uninsured. In 2013, we found that 

Medicare beneficiaries who had continuous health insurance coverage 

before enrollment in Medicare reported being in better health in the 6 

years after Medicare enrollment and, in the first year of Medicare 

coverage, had significantly lower Medicare spending.6

Additional spending uncertainty stems from concerns raised by the 

Medicare Trustees, CBO, and the Office of the Actuary (OACT) about 

whether some of the Medicare cost-containment mechanisms included in 

PPACA can be sustained over the long term, such as the provider 

productivity payment adjustment, and physician payment updates and 

incentives included in MACRA. For example, additional payments for 

 5

Accountable care organizations are groups of physicians, hospitals, and other health 

care providers who voluntarily work together to give coordinated care to the Medicare 

patients they serve. When an accountable care organization succeeds in delivering highquality care and spending health care dollars more efficiently, part of the savings 

generated goes to the organization and part is kept by Medicare.

6

GAO, Medicare: Continuous Insurance before Enrollment Associated with Better Health 

and Lower Program Spending, GAO-14-53 (Washington, D.C.: Dec. 17, 2013).
Medicare Program

Page 525 GAO-17-317 High-Risk Series

alternative payment models provided under MACRA will expire in 2025, 

and physician payment update amounts, which are not tied to economic 

conditions, are not expected to keep pace with average physician cost 

increases. The Medicare Trustees report for 2016 projected that, 

beginning in 2048, physician payment rates will be lower than they would 

have been under the SGR formula and will continue to be lower after that. 

CBO and OACT both produced alternative projections of future spending 

that assume that certain cost-containment mechanisms are not fully 

maintained over the long term.

The effects of these recent changes to the Medicare program will 

continue to emerge in the coming years and may add to the challenges 

that already confront the federal government as it oversees and manages 

the program. Our work to date illustrates the challenges facing Medicare 

and the need for improved federal oversight in five areas.

1. Payments and Provider Incentives in Traditional Medicare

2. Medicare Advantage and Other Medicare Health Plans

3. Program Design Effects on Beneficiaries, Including Those Eligible for 

Medicaid

4. Program Management

5. Oversight of Patient Care and Safety

Medicare is transitioning from a payment system that largely rewards the 

volume and complexity of health care services provided to a system that 

explicitly rewards quality and efficiency. Many of the broad-based reforms 

being implemented to Medicare’s payment systems in the traditional FFS 

program have introduced financial incentives into payment structures to 

explicitly reward quality and efficiency, such as creating the Merit-based 

Incentive Payment System discussed previously. To help ensure that 

physicians are able to respond to these new incentives and are able to 

improve their performance, CMS recently began to provide more frequent 

feedback to physicians on their performance, as we recommended, to 

help them identify opportunities to reduce costs and pinpoint high-cost 

beneficiaries who may benefit from enhanced care coordination. MACRA 

also required that CMS consider physician and other providers’

improvement and their opportunity for continued improvement when 

establishing benchmarks for Merit-based Incentive Payment System 

performance measures. As CMS progresses toward fully implementing its 

value-based payment system, it will be important for the agency to use 

Our Work Suggests 

the Need for 

Continued Attention in 

Five Principal Areas

Payments and Provider 

Incentives in Traditional 

Medicare
Medicare Program

Page 526 GAO-17-317 High-Risk Series

reliable quality and cost measures and methodological approaches that 

maximize the number of physicians for whom value can be determined.

As CMS implements these broad-based payment reforms, we have 

identified additional areas where continued monitoring of payment 

methods is warranted to encourage efficiency and reduce the risk of 

overspending.

Payment methods for cancer hospitals. Currently, 11 cancer hospitals, 

designated in the 1980s and 1990s, that meet certain statutory criteria are 

exempt from Medicare’s inpatient prospective payment system (PPS) and 

are also receiving payment adjustments under the outpatient PPS. The 

Medicare PPS introduced better control over program spending and 

provided hospitals with an incentive for efficient resource use. Yet for 

decades, as required by law, Medicare has paid these cancer hospitals 

differently than PPS hospitals in recognition of their specialized focus and 

concerns that reimbursements under PPS would be inadequate to cover 

costs for the types of care provided at cancer hospitals. This has 

remained the case even as the inpatient PPS methodology has been 

refined to better account for variation in the severity and complexity of 

beneficiaries and the resource intensity of hospital care.

The 11 cancer hospitals currently exempted from the inpatient PPS and 

receiving payment adjustments under the outpatient PPS are reimbursed 

largely based on their reported costs and as such have little incentive for 

containing costs. In 2012, we estimated that PPS-exempt cancer 

hospitals received, on average, about 42 percent more in Medicare 

inpatient payments per discharge than what Medicare would have paid a 

local PPS teaching hospital to treat cancer beneficiaries with the same 

level of complexity. Similarly, Medicare outpatient payment adjustments 

to these cancer hospitals resulted in overall payments that were about 37 

percent higher, on average, than payments Medicare would have made to 

PPS teaching hospitals for the same set of services.7 Had beneficiaries of 

PPS-exempt cancer hospitals received services at nearby PPS teaching 

hospitals in 2012, the Medicare program may have saved almost $500 

million. We suggested that Congress require Medicare to pay PPSexempt hospitals as it pays PPS teaching hospitals, or provide the 

Secretary of Health and Human Services the authority to otherwise 

 7

GAO, Medicare: Payment Methods for Certain Cancer Hospitals Should Be Revised to 

Promote Efficiency, GAO-15-199 (Washington, D.C.: Feb. 20, 2015).
Medicare Program

Page 527 GAO-17-317 High-Risk Series

modify how Medicare pays these PPS-exempt hospitals. To generate 

cost savings, we also suggested that Congress provide that all forgone 

outpatient payment adjustment amounts be returned to the 

Supplementary Medical Insurance Trust Fund, which funds Medicare Part 

B services, such as physician visits, and Medicare Part D services, such 

as prescription drugs. The 21st Century Cures Act, enacted in December 

2016, slightly reduces the additional payments cancer hospitals receive 

for outpatient services and returns savings to the Supplementary Medical 

Insurance Trust Fund. However, the law keeps in place the payment 

system for outpatient services that differs from how Medicare pays PPS 

teaching hospitals. Moreover, the law does not change how PPS-exempt 

cancer hospitals are paid for inpatient services.8 Until Medicare pays 

PPS-exempt cancer hospitals in a way that encourages efficiency, rather 

than largely on the basis of reported costs, Medicare remains at risk for 

overspending.

Hospital-physician consolidation. Because Medicare often pays more 

for services when they are performed in a hospital outpatient department 

than when they are performed in a physician’s office, hospitals may have 

an incentive to acquire physician practices, hire physicians as salaried 

employees, or both—financial arrangements commonly referred to as 

vertical consolidations. After hospitals and physicians vertically 

consolidate, the same services that were once reimbursed by Medicare at 

a lower total payment rate could be classified as hospital outpatient 

department services and reimbursed at a higher rate. In our work, we 

found that the number of vertically consolidated hospitals increased by 

about 20 percent from 2007 through 2013 and the number of physicians 

in these arrangements nearly doubled.9 Some have questioned whether 

or to what extent vertical consolidations have contributed to the rapid rise 

in Medicare expenditures for hospital outpatient departments, which 

increased by more than eight percent annually from 2007 through 2013. 

We found that the percentage of evaluation and management (E/M) office 

 8

The 21st Century Cures Act reduced by 1 percentage point the target payment-to-cost 

ratio used to calculate additional outpatient payments that PPS-exempt cancer hospitals 

receive, for services furnished on or after January 1, 2018. Pub. L. No. 114-255, § 16002, 

130 Stat. 1033 (2016).

9

GAO, Medicare: Increasing Hospital-Physician Consolidation Highlights Need for 

Payment Reform, GAO-16-189 (Washington, D.C.: Dec. 18, 2015). 
Medicare Program

Page 528 GAO-17-317 High-Risk Series

visits performed in hospital outpatient departments was generally higher 

in counties with higher levels of vertical consolidation.10

The rise in vertical consolidation exacerbates a financial vulnerability in 

Medicare’s payment policy—paying different rates for the same service, 

depending on where the service is performed. Estimates from entities 

such as the Bipartisan Policy Center and the Medicare Payment Advisory 

Commission suggest that equalizing payments rates for E/M office visits 

could save nearly $1 billion to $2 billion a year for the Medicare program 

and beneficiaries. We suggested that Congress direct the Secretary of 

Health and Human Services to equalize payment rates between settings 

for E/M office visits and other services as appropriate. Until the disparity 

in payment rates for E/M office visits is addressed, Medicare could be 

expending more resources than necessary.11

Payments for hospital uncompensated care. Hospital uncompensated 

care costs are a long-standing concern because of their potential to 

weaken hospitals’ financial stability and thereby hospitals’ abilities to 

serve their communities. Both Medicare and Medicaid provide funds to 

help offset hospitals’ uncompensated care costs. In fiscal year 2014, 

Medicare made over $14 billion in payments to hospitals for 

uncompensated care through a variety of payment types, including a 

relatively new type of payment called Medicare Uncompensated Care 

(UC) payments. We have raised concerns that Medicare UC payments 

are largely based on hospitals’ Medicaid workload rather than hospitals’

actual uncompensated care costs, which can result in poor alignment 

between payments and uncompensated care costs.12 This may be 

particularly true in states that have expanded Medicaid—that is, coverage 

expanded through PPACA to nearly all adults with incomes up to 133 

 10E/M office visits are a common type of service that can be performed in both HOPDs 

and physician offices. GAO-16-189.

11In 2015, Congress partially addressed this trend by excluding services furnished by offcampus hospital outpatient departments from this higher payment, effective January 1, 

2017. However, this exclusion will not apply to services furnished by providers billing as 

hospital outpatient departments prior to enactment of the legislation—that is, all providers 

billing as hospital outpatients during our study—who would continue to be paid under 

higher rate or to services provided by on-campus hospital outpatient departments. 

Congress later added providers meeting a mid-build requirement to the list of providers to 

which the exclusion would not apply.

12GAO, Hospital Uncompensated Care: Federal Action Needed to Better Align Payments 

with Costs, GAO-16-568 (Washington, D.C.: June 30, 2016).
Medicare Program

Page 529 GAO-17-317 High-Risk Series

percent of the poverty level—and therefore where lower uncompensated 

care costs are expected.13

In an April 2016 proposed rule, CMS announced that it is considering 

making hospitals’ actual uncompensated care costs the sole basis for 

making Medicare UC payments by fiscal year 2020. Another concern, 

however, is that when making Medicare UC payments, CMS does not 

account for payments hospitals received from Medicaid, even though the 

bulk of Medicare’s payments are made on the basis of Medicaid 

workloads, for which hospitals may have also received Medicaid 

payments. We recommended that CMS improve the alignment of 

Medicare UC payments with hospital uncompensated care costs and 

account for Medicaid payments received when making Medicare UC 

payments to individual hospitals. HHS concurred with these 

recommendations and in its final rule indicated that it planned to 

implement them beginning in fiscal year 2021 to allow time for hospitals to 

collect and report reliable uncompensated care cost data.

Physician self-referral. Our work has identified opportunities for CMS to 

introduce additional payment method refinements and controls in 

Medicare FFS to encourage appropriate use of services. For example, 

self-referral—when a provider refers patients to entities in which the 

provider or the provider’s family members have a financial interest—

continues to be a concern in relation to the rapid growth of Medicare FFS 

expenditures. In recent years, we found that certain services—including 

diagnostic imaging, certain cancer treatments, and diagnostic pathology 

services—performed by self-referring groups have increased 

dramatically.14 For example, from 2004 through 2010, the number of selfreferred magnetic resonance imaging (MRI) services increased by more 

than 80 percent; in comparison, the number of non-self-referred MRI 

services increased by 12 percent during this time period.15 We have 

 13PPACA also provided for 5 percent of an applicant’s income to be disregarded when 

calculating modified adjusted gross income, which effectively increases this income level 

to 138 percent of the federal poverty level. As of October 2016, 31 states and the District 

of Columbia had opted to expand Medicaid eligibility under PPACA.

14See GAO, Medicare: Higher Use of Advanced Imaging Services by Providers Who SelfRefer Costing Medicare Millions, GAO-12-966 (Washington, D.C.: Sep. 28, 2012); GAO, 

Medicare: Higher Use of Costly Prostate Cancer Treatment by Providers who Self-Refer 

Warrants Scrutiny, GAO-13-525 (Washington, D.C.: July 19, 2013); and GAO, Medicare: 

Action Needed to Address Higher Use of Anatomic Pathology Services by Providers who 

Self-Refer, GAO-13-445 (Washington, D.C.: June 24, 2013). 

15GAO-12-966. 
Medicare Program

Page 530 GAO-17-317 High-Risk Series

recommended that CMS determine and implement an approach to ensure 

providers appropriately self-refer for advanced imaging services. HHS did 

not concur with this recommendation but is in the process of establishing 

an appropriate use criteria program for advanced imaging services that 

would apply to all physicians—including those that self-refer—and which, 

depending on implementation, could address our recommendation. CMS 

has yet to take definitive steps to monitor physician self-referral for certain 

cancer treatment and diagnostic pathology services, and until it does so, 

the Medicare FFS program and its beneficiaries will continue to be at risk 

for these rapidly increasing expenditures.

High-expenditure Part B drugs. In 2014, Medicare spent over $24 

billion on drugs covered under Part B. Part B drugs are those commonly 

administered by a physician or under a physician’s close supervision, 

such as vaccines or some oral cancer drugs. The vast majority of these 

expenditures ($21 billion) were based on the drug’s average sales price 

(ASP), the amount physicians and other purchasers pay manufacturers 

for the drug, which CMS calculates based on sales data reported by drug 

manufacturers. Ensuring the accuracy of the data on which CMS bases 

payment rates for part B ASP drugs is important given Medicare’s 

substantial expenditures for these drugs and given beneficiaries’ general 

responsibility to cover 20 percent of Medicare’s payment for these drugs 

via cost-sharing requirements, which amounted to about $4 billion in 

2014. We found, however, that CMS is not able to assess the accuracy of 

all sales price data because not all manufacturers are required to submit 

these data.16 Further, while CMS conducts certain checks to assess the 

completeness of the sales data it does receive, the agency does not 

verify the accuracy of the data by tracing it to source documents, such as 

sales invoices. We suggested that Congress require all manufacturers of 

Part B drugs to submit sales price data to CMS and to ensure CMS has 

the authority to request source documentation and periodically validate 

such data.

Additionally, the ASP does not account for drug coupon discounts that 

manufacturers provide to privately insured patients, which reduce the 

effective market price for these drugs. In our work, we found that the ASP 

for several part B drugs with drug coupon discounts exceeded the 

 16GAO, Medicare Part B: CMS Should Take Additional Steps to Verify Accuracy of Data 

Used to Set Payment Rates for Drugs, GAO-16-594 (Washington, D.C.: July 1, 2016). 
Medicare Program

Page 531 GAO-17-317 High-Risk Series

effective market price that manufacturers ultimately received.17 As a 

result, Medicare may be paying more than necessary for these drugs. 

Regular monitoring of the implications of coupon programs for Medicare’s 

payment methodology for part B drugs is needed as CMS works to 

propose an alternative payment system. CMS, however, lacks the 

authority to collect data from drug manufacturers on coupon discounts to 

patients because the authority to collect information relating to ASP is 

based on manufacturer sales to purchasers. We suggested that Congress 

consider granting CMS authority to collect data from drug manufacturers 

on coupon discounts for Part B drugs based on ASP and require the 

agency to periodically collect these data and report on the implications of 

coupon programs for Part B drug payment rate methodology.

Low-volume payment adjustments. Medicare’s payment adjustment for 

low-volume dialysis facilities is one of several modifications in Medicare’s 

payment systems designed to help maintain beneficiaries’ access to care. 

Low-volume providers in areas where other care options are limited may 

warrant higher payments, and CMS intended this low-volume payment 

adjustment (LVPA) to encourage small dialysis facilities to continue 

operating in areas where beneficiary access might be jeopardized if such 

facilities closed. However, in 2013 we found that, as designed, the LVPA 

did not effectively achieve this goal because it did not target all relatively 

low-volume, high-cost facilities that were in areas where beneficiaries 

may have lacked other dialysis care options, and it targeted some 

facilities that appeared unnecessary for ensuring access to dialysis, such 

as dialysis facilities located in close proximity to other facilities.18 In 

response to our report, CMS revised the LVPA, beginning in 2016, to 

more effectively target low-volume facilities necessary for ensuring 

access to care; and in 2015, CMS issued clarifying guidance on the LVPA 

in a final rule and held outreach calls to dialysis facilities and Medicare 

contractors to ensure their understanding of the guidance. The agency 

has not acted, however, to implement an improvement we recommended 

to change the design of LVPA to reduce the incentive for facilities to 

restrict the services they provide in order to avoid reaching treatment 

thresholds that determine eligibility for the program.

 17GAO, Medicare Part B: Data on Coupon Discounts Needed to Evaluate Methodology for 

Setting Drug Payment Rates, GAO-16-643 (Washington, D.C.: July 27, 2016). 

18GAO, End-Stage Renal Disease: CMS Should Improve Design and Strengthen 

Monitoring of Low-Volume Adjustment, GAO-13-287 (Washington, D.C.: Mar. 1, 2013).
Medicare Program

Page 532 GAO-17-317 High-Risk Series

Physician payment rates. The accuracy of Medicare’s payment rate for 

physician services has major implications for the health care system 

given spending on these services—$70 billion in fiscal year 2015—and 

the fact that other payers, such as private insurers, base their payment 

rates at least in part on Medicare rates. Inaccurate payment rates can 

create distorted incentives for physicians to either over- or underprovide 

services or to pursue certain specialties. We and others have identified 

several weaknesses in CMS’s processes for setting physician payment 

rates.19 This process involves CMS assigning relative values to each 

service by taking into account recommendations made by the American 

Medical Association’s Specialty Society Relative Value Scale Update 

Committee (RUC).

Some of our concerns with this process include issues with the survey 

data the RUC uses in part to develop relative value recommendations, 

including low survey response rates. In 2015, the median survey 

response rate for over 200 physician services was about 2 percent. 

Additionally, although CMS officials state that all Medicare services are 

reviewed every 5 years as required by statute, the agency does not 

maintain a database to track when services were last valued. CMS 

officials acknowledge that the agency relies heavily on RUC 

recommendations. Given the process and data-related weaknesses 

associated with the RUC’s recommendations, this process could 

potentially result in inaccurate payment rates. To address these concerns, 

we recommended that CMS incorporate data and expertise from 

physicians and other relevant stakeholders into the process for 

establishing relative values. CMS concurred with this recommendation 

and has begun to research ways to develop an approach for validating 

relative values, but until it develops a timeline and a plan for determining 

its approach, CMS risks continuing to use payment rates that may be 

inaccurate.

The MA program, an alternative to the traditional Medicare FFS program, 

provides health care coverage to Medicare beneficiaries through private 

health plans. The number and percentage of Medicare beneficiaries 

enrolled in MA has grown steadily over the past several years, increasing 

 19See, for example, GAO, Medicare Physician Payment Rates: Better Data and Greater 

Transparency Could Improve Accuracy, GAO-15-434 (Washington, D.C.: May 21, 2015) 

and Medicare Payment Advisory Commission, Moving Forward from the Sustainable 

Growth Rate (SGR) System, letter to Congress (Washington, D.C.: October 2011). 

Medicare Advantage and 

Other Medicare Health 

Plans
Medicare Program

Page 533 GAO-17-317 High-Risk Series

from 8.1 million (20 percent of all Medicare beneficiaries) in 2007 to 15.8 

million (30 percent of all Medicare beneficiaries) in 2014. Congress has 

taken a number of steps to introduce financial incentives to explicitly 

reward quality and efficiency in the MA program. For example, PPACA 

provided that MA plans with a quality rating of four or more stars—with 

five stars indicating the highest quality—receive bonus payments, and 

required MA maximum payment amounts to be adjusted to near or below 

FFS spending.20 Moreover, in January 2013, Congress enacted the 

American Taxpayer Relief Act of 2012 (ATRA), which increased the 

statutory minimum for the annual MA coding intensity adjustment in order 

to account for differences in the comprehensiveness with which MA plans 

and FFS providers code medical diagnoses.21 CBO estimated that this 

change alone would save Medicare about $1.4 billion over 5 years. The 

recently enacted 21st Century Cures Act also includes several changes to 

the MA risk adjustment model that must be implemented beginning in 

2019. For example, the MA risk adjustment model will be required to take 

into account the number of diseases or conditions of enrollees and allows 

CMS to use 2 years of diagnosis data when determining the health 

condition of beneficiaries.22

CMS has yet to take action to improve the accuracy of its payments to 

MA programs or to ensure that MA beneficiaries have sufficient access to 

providers. We have identified additional opportunities for CMS to improve 

the accuracy of MA payments, such as adjusting its methodology to 

account for diagnostic coding differences between MA and FFS, and 

improve CMS’s oversight of MA network adequacy.

 20PPACA changed how the maximum per capita payment amount to an MA plan is 

calculated so that it more closely aligned with Medicare FFS spending. Specifically, the 

changes, which are to be phased in from 2012 through 2017, will result in maximum 

payments being tied to a percentage of per capita Medicare FFS spending in each county. 

In general, for those counties in the highest Medicare FFS spending quartile, the 

maximum payment to an MA plan will be 95 percent of county per capita Medicare FFS 

spending, and for those counties in the lowest Medicare FFS spending quartile, the 

maximum payment amount will be equal to 115 percent of county per capita Medicare 

FFS spending.

21Since 2004, when CMS transitioned from using only a beneficiary’s principal inpatient 

diagnosis to using a larger set of major medical conditions to risk adjust MA payments, 

MA plans have had a financial incentive to ensure that all relevant diagnoses are coded, 

as this can increase beneficiaries’ risk scores and ultimately the payments that plans 

receive. In contrast, CMS pays many Medicare FFS providers for services provided rather 

than on the basis of beneficiaries’ diagnoses. 

22Pub. L. No. 114-255, § 17006, 130 Stat. 1033 (2016).
Medicare Program

Page 534 GAO-17-317 High-Risk Series

MA plan payment adjustments. Concerns remain about the discrepancy 

between FFS and MA payments because CMS has yet to improve the 

accuracy of the adjustment to account for excess payments due to 

differences in how MA plans and FFS providers code medical diagnoses. 

We have found that CMS’s risk adjustment model—which uses one 

year’s diagnoses to predict the following year’s health care costs for each 

MA enrollee—has led it to overpay MA organizations because of different 

diagnostic coding patterns between the FFS and MA programs.23 In 2013, 

we estimated that these overpayments ranged from at least $3.2 billion to 

$5.1 billion from 2010 through 2012.24 We have recommended that CMS 

take steps to improve the accuracy of its risk score adjustments by, for 

example, accounting for additional beneficiary characteristics such as 

sex, health status, and Medicaid enrollment status, as well as including 

the most recent data available.25 In April 2016, CMS indicated that after 

analyzing MA data, the agency planned to implement the statutory 

minimum for the annual MA coding adjustment mandated in ATRA. 

However, as of October 2016, CMS had not provided documentation of 

its analysis to determine, for example, the extent to which the agency’s 

methodology accounted for additional beneficiary statistics, as we 

recommended.

In addition, CMS has taken steps to collect encounter data—information 

on the services and items furnished to enrollees—which are more 

comprehensive than the beneficiary diagnosis data the agency currently 

uses to risk adjust payments to MA organizations, and has reported that it 

will use these data in calculating risk adjustments. However, CMS has not 

fully developed plans for validating and using MA encounter data, missing 

an opportunity to detect potentially inaccurate or unreliable data that is 

being used to direct billions of federal dollars. We recommended that 

CMS fully validate the MA encounter data it is collecting before using 

 23GAO, Medicare Advantage: CMS Should Improve the Accuracy of Risk Score 

Adjustments for Diagnostic Coding Practices, GAO-12-51 (Washington, D.C.: Jan. 12, 

2012) and GAO, Medicare Advantage: Substantial Excess Payments Underscore Need 

for CMS to Improve Accuracy of Risk Score Adjustments, GAO-13-206 (Washington, 

D.C.: Jan. 31, 2013).

24GAO, Medicare Advantage: Substantial Excess Payments Underscore Need for CMS to 

Improve Accuracy of Risk Score Adjustments, GAO-13-206 (Washington, D.C.: Jan. 31, 

2013).

25GAO-12-51. 
Medicare Program

Page 535 GAO-17-317 High-Risk Series

these data for payment purposes.26 In 2015, CMS began using encounter 

data as an additional source of diagnostic data in calculating beneficiary 

risk scores but acknowledged that the agency had yet to complete all 

steps to validate the data before using them for payment purposes, as we 

had recommended. Without fully validating the completeness and 

accuracy of MA encounter data, CMS and MA organizations would be 

unable to confidently use the data for risk adjustment or any other 

program management purpose.

Provider network adequacy. CMS is responsible for ensuring adequate 

access to care for MA enrollees, but reports that some MA organizations 

have been narrowing their provider networks raise questions about CMS 

oversight of MA plans’ network adequacy. In 2015, we reported on 

shortcomings in CMS’s criteria for determining network adequacy, how 

the agency oversees MA organizations’ adherence to its requirements, 

and how it ensures enrollees are properly notified about provider network 

changes.27 For example, unlike other managed care programs, CMS’s 

network adequacy criteria do not consider measures of provider 

availability, such as appointment wait times and whether providers are 

accepting new patients. CMS also assesses very few networks (less than 

one percent) each year against its network adequacy criteria and does 

little to evaluate the accuracy of the network data MA organizations 

submit. We made several recommendations, including that CMS augment 

MA network adequacy criteria to address provider availability. HHS 

concurred with this recommendation, and in early 2016, officials stated 

that they will review how to augment the MA network adequacy criteria to 

address provider availability in future years. However, until this happens, 

provider networks may appear to regulators and beneficiaries as more 

robust than they actually are.

The Medicare Trustees estimate that Medicare spending will grow at a 

faster rate than workers’ earnings or the economy overall, which will 

impose a significant burden on Medicare beneficiaries and the U.S. 

economy over time. Because most Medicare beneficiaries pay their Part 

B premium by having it withheld from their monthly Social Security 

 26GAO, Medicare Advantage: CMS Should Fully Develop Plans for Encounter Data and 

Assess Data Quality before Use, GAO-14-571 (Washington, D.C.: Jul. 31, 2014).

27GAO, Medicare Advantage: Actions Needed to Enhance CMS Oversight of Provider 

Network Adequacy, GAO-15-710 (Washington, D.C.: Aug. 31, 2015).

Program Design Effects on 

Beneficiaries, Including 

Those Eligible for 

Medicaid
Medicare Program

Page 536 GAO-17-317 High-Risk Series

benefits, and because growth in Medicare premiums and cost sharing has 

outpaced growth in Social Security benefits, beneficiaries and their 

families may increasingly need to draw on other income or resources to 

help pay for necessary medical care. Moving forward, it will be important 

to find approaches that help avert or mitigate this growing financial 

burden, particularly for those beneficiaries with high health care needs 

and few economic resources. For example, understanding how 

beneficiaries make medical decisions and what information would help 

them identify and use providers that efficiently deliver appropriate, highquality care could lead to savings for both beneficiaries and taxpayers.

Our work has identified additional opportunities to improve how the 

Medicare program ensures that beneficiaries, including those who are 

also eligible for Medicaid, receive the appropriate services they need.

Care for dual-eligible beneficiaries. The federal government, states, 

and others have been focusing on care coordination as a key strategy for 

improving the quality of care for dual-eligible beneficiaries—individuals 

who qualify for both Medicare and Medicaid—while also reducing costs. 

Dual-eligible beneficiaries, who are often in poorer health compared with 

other Medicare and Medicaid beneficiaries, typically receive benefits 

through each program separately, which can lead to fragmented care due 

to different program rules for receiving benefits and reimbursing 

providers. In 2013, CMS began implementing the Financial Alignment 

Demonstration to integrate Medicare and Medicaid services and 

financing, and to improve coordination for dual-eligible beneficiaries. 

While CMS established a framework of monitoring activities to oversee 

the demonstration, the extent of care coordination is not entirely clear 

from the information being collected. For example, CMS monitors two 

core measures related to care coordination, but because these are being 

used in only one of two models being tested in the demonstration, CMS 

cannot compare the two demonstration models using these measures. 

Similarly, demonstration states had state-specific measures that explored 

aspects of care coordination, but they were not comparable across states. 

We recommended, among other things, that CMS align existing statespecific measures of the extent to which individualized care plans are 

being developed to make them comparable.28 The agency agreed with 

this recommendation, and CMS officials said they plan to develop a care 

 28GAO, Medicare and Medicaid: Additional Oversight Needed of CMS’s Demonstration to 

Coordinate the Care of Dual-Eligible Beneficiaries, GAO-16-31 (Washington, D.C.: Dec. 

18, 2015).
Medicare Program

Page 537 GAO-17-317 High-Risk Series

plan measure that more closely aligns specifications across 

demonstrations, but data collection is not expected to begin until January 

2018.

Dual-eligible special needs plans. Special needs plans are MA private 

plans designed to address the unique needs of certain Medicare 

populations, and among these plans are those targeted specifically to 

dual-eligible beneficiaries. CMS and Congress have taken steps to 

coordinate care for those enrolled in dual-eligible special needs plans to 

increase benefit integration and care coordination. For example, PPACA 

established a type of plan referred to as a fully integrated dual-eligible 

special needs plan, which is designed to integrate program benefits for 

dual-eligible beneficiaries through a single managed care organization. In 

addition, dual-eligible special needs plans that meet certain performance 

and quality-based standards may seek CMS approval to offer benefits 

beyond what other MA plans offer if such benefits would help bridge the 

gap between Medicare- and Medicaid-covered services. Although a large 

percentage of dual-eligible beneficiaries (43 percent in 2012) were under 

age 65 and qualified for Medicare because they were disabled, we found 

that few fully integrated dual-eligible special needs plans serve disabled 

dual-eligible beneficiaries or report lower costs for Medicare services.29 In 

addition, moderately better health outcomes for disabled dual-eligible 

beneficiaries in dual-eligible special needs plans do not necessarily 

translate into lower levels of costly Medicare services—that is, inpatient 

stays, readmissions, and emergency room visits.30

Access to preventive services. Over the past several years, 

researchers have found that certain preventive services are effective in 

early diagnosis or reduced prevalence of diseases that contribute to the 

growth in Medicare spending. To encourage beneficiary use, PPACA 

removed beneficiary cost-sharing requirements for many Medicarecovered preventive services, such as mammograms and colorectal 

cancer screening. However, in our work we found that while Medicare 

beneficiaries’ use of some preventive services—cardiovascular disease 

screening and cervical cancer screening—generally aligned with clinical 

recommendations, the use of other preventive services, such as 

 29GAO, Disabled Dual-Eligible Beneficiaries: Integration of Medicare and Medicaid 

Benefits May Not Lead to Expected Medicare Savings, GAO-14-523 (Washington, D.C.: 

Aug. 29, 2014).

30GAO-14-523. 
Medicare Program

Page 538 GAO-17-317 High-Risk Series

osteoporosis screening and immunizations, did not.31 Medicare 

beneficiaries who did not receive certain preventive services commonly 

reported that they had limited information on prevention; had concerns 

about discomfort, side effects, or efficacy; or their doctor did not 

recommend the services. Furthermore, we found better use of preventive 

services by beneficiaries is unlikely without appropriate Medicare 

coverage. For instance, low use of some recommended services—such 

as osteoporosis screenings—may result, in part, from limiting which 

beneficiaries are covered or how frequently the service is covered. 

Conversely, the absence of required cost sharing for certain services that 

are not recommended, such as prostate-specific antigen testing for 

prostate cancer for men aged 75 or older, may contribute to the 

inappropriate use of those services. In 2012, we suggested Congress 

require beneficiaries to share the cost when they receive services that the 

U.S. Preventive Services Task Force recommends against.

CMS has overcome some challenges in managing the Medicare program 

as it implemented some program improvements in recent years, including 

a competitive bidding program for durable medical equipment (DME). 

However, more could be done to improve how CMS manages the 

Medicare program, including its handling of the growing number of 

appeals for denied claims.

Competitive bidding program. We had previously reported that 

Medicare sometimes overpaid for DME items relative to other payers.32

Congress required that CMS implement a competitive bidding program for 

DME suppliers, which the agency began in 2009. In early assessments, 

we found that beneficiary access and satisfaction appeared stable and 

the competitive bidding program has led to savings.33 More recently in 

2016, we found that the number of beneficiaries receiving DME items 

covered under the competitive bidding program generally decreased after 

 31GAO, Medicare: Use of Preventive Services Could Be Better Aligned with Clinical 

Recommendations, GAO-12-81 (Washington, D.C.: Jan. 18, 2012).

32GAO, Medicare: Competitive Bidding for Medical Equipment and Supplies Could 

Reduce Program Payments, but Adequate Oversight Is Critical, GAO-08-767T 

(Washington, D.C.: May 6, 2008). 

33GAO, Medicare: Review of First Year of CMS’s Durable Medical Equipment Competitive 

Bidding Program’s Round 1 Rebid, GAO-12-693 (Washington, D.C.: May 9, 2012).

Program Management
Medicare Program

Page 539 GAO-17-317 High-Risk Series

implementation of phases of the program that began in July 1, 2013.34

Available evidence from CMS’s monitoring efforts indicates no 

widespread effects on beneficiary access, but some beneficiary advocacy 

groups have reported specific access issues, such as difficulty locating 

contract suppliers and delays in delivery of DME items. Changes such as 

expanding the program into additional competitive bidding areas; using 

pricing from competitive bidding areas to set prices in non-competitive 

bidding areas (which was fully phased in as of July 2016); and selecting 

new contract suppliers for contracts for new rounds of bidding will provide 

significant new data to further assess the effect of the program. 

Continued monitoring of the competitive bidding program experience is 

important to determine the full effects it may have on Medicare 

beneficiaries and DME suppliers.

Appeals process. Medicare has seen significant growth in the number of 

appeals submitted by providers, beneficiaries, and others dissatisfied with 

the program’s decisions to deny or reduce payment for claims. The 

Department of Health and Human Services (HHS) attributes the increase 

in appeals to several factors, including for example, CMS’s recent 

increased focus on program integrity activities, which has resulted in 

more denied claims and more appeals. In fiscal year 2014, Medicare 

denied 128 million FFS claims, or 10.5 percent of claims submitted. 

Medicare’s administrative appeals process for FFS claims consists of 4 

levels of review (Levels 1 through 4) and allows appellants who are 

dissatisfied with decisions at one level to appeal to the next level, with 

separate appeals bodies making decisions at each level. From fiscal year 

2010 to 2014, the number of appeals at all levels of Medicare’s 

administrative appeals process increased significantly but varied by level. 

The largest rate of increase (over 900 percent) was experienced at Level 

3, in which cases are reviewed by administrative law judges. The large 

volume of appeals has resulted in backlogs in decisions; in fiscal year 

2014, more than 90 percent of Level 3 decisions were issued after the 90-

day statutory time frame.

We recommended that HHS take additional steps to improve its oversight 

of the appeals process, including collecting more complete and consistent 

data that would assist in monitoring efforts and addressing inefficiencies 

in the way certain repetitious claims—such as those for monthly oxygen 

 34GAO, Medicare: CMS’s Round 2 Durable Medical Equipment and National Mail-order 

Diabetes Testing Supplies Competitive Bidding Programs, GAO-16-570 (Washington, 

D.C.: Sept. 15, 2016). 
Medicare Program

Page 540 GAO-17-317 High-Risk Series

equipment rentals—are adjudicated.35 HHS has taken some actions to 

reduce the backlog of appeals. For instance, CMS has offered 

administrative agreements to eligible hospitals that are willing to withdraw 

their pending appeals in exchange for timely partial payments, in order to 

more quickly reduce the volume of claims pending in the appeals 

process. As of August 2016, CMS has executed settlements amounting to 

nearly $1.5 billion with 2,022 hospitals, representing approximately 

346,000 claims that were in the appeals system. In September 2016, 

CMS announced it would execute another round of settlements for 

hospitals with inpatient claims in appeals. In addition, in July 2016, HHS 

issued a proposed rule that would revise certain appellate procedures in 

an effort to improve the Medicare appeals process and reduce the 

backlog. However, HHS has not yet taken actions to address our specific 

recommendations, and the backlog shows no signs of abating, as the 

number of incoming appeals continues to surpass adjudication capacity at 

certain review levels. For fiscal year 2016, the average length of time to 

process Level 3 appeals was 877 days, compared with the 90 days 

generally required by statute, and up from the 662 days for fiscal year 

2015.36

CMS has made progress in improving the health and safety of millions of 

Medicare beneficiaries, which represent a significant portion of the U.S. 

population. According to CMS, Medicare Quality Improvement 

Organizations—which work with providers, beneficiaries, and others to 

improve health care delivery systems to achieve better care for lower 

costs—-supported efforts that from fiscal year 2011 through fiscal year 

2014 helped to prevent tens of thousands of beneficiaries from being 

admitted or readmitted to hospitals; reduce the number of health care 

associated infections; and reduce the number of nursing home patients 

who experienced pressure ulcers or the use of restraints. CMS has also 

improved its oversight of quality of care. In 2012, in response to our 

recommendation, CMS included long-term care hospitals in its validation 

surveys, which are used to measure the effectiveness of surveys 

conducted by accrediting organizations on the extent to which facilities 

 35GAO, Medicare Fee-For-Service: Opportunities Remain to Improve Appeals Process, 

GAO-16-366 (Washington, D.C.: May 10, 2016).

36On December 5, 2016, the U.S. District Court for the District of Columbia issued a 

decision granting summary judgment to the American Hospital Association and ordering 

HHS to resolve the current backlog of Medicare appeals by December 31, 2020. Am. 

Hosp. Ass’n v. Burwell, 2016 WL 7076983 (D.D.C. Dec. 5, 2016).

Oversight of Patient Care 

and Safety
Medicare Program

Page 541 GAO-17-317 High-Risk Series

meet federal standards for quality of care. However, CMS can further 

improve how it oversees patient care and safety, as described below.

Clinical data registries. Clinical data registries (CDR) have the potential 

to improve the quality and efficiency of care for all Medicare beneficiaries 

by collecting extensive, standardized data and providing feedback to 

physicians on their performance based on their peers. CDRs are entities 

that collect detailed information on the therapies that patients receive and 

changes in their clinical condition over time in order to evaluate and 

improve care practices and outcomes. In 2013, we recommended that 

HHS adopt several key requirements to ensure qualified CDRs actually 

improve the quality and efficiency of care that beneficiaries receive.37 For 

example, CMS should require qualified CDRs to demonstrate 

improvements on key measures of quality and efficiency for their target 

population and establish a process for monitoring qualified CDRs’

compliance with requirements. HHS should also enhance the effect of 

qualified CDRs on quality and efficiency by making it easier to develop 

them by promoting the use of health information technology. HHS 

concurred with each of our recommendations, but also noted some 

challenges it expects, for example in establishing a set of core measures 

for qualified CDRs, as we recommended, given the number of clinical 

specialties on which qualified CDRs may focus. We maintain, however, 

that a minimum set of core measures—even if small—could help CDRs 

promote national-level quality improvement initiatives.

End-stage renal disease. In 2013, Medicare spent about $11.7 billion on 

dialysis care for about 376,000 Medicare patients. Dialysis is the most 

common treatment for individuals with end-stage renal disease, and while 

the vast majority of dialysis treatments are performed in dialysis facilities, 

dialysis treatments received at home may increase autonomy and healthrelated quality of life for some patients. Physicians and other stakeholders 

estimate that between 15 and 25 percent of patients needing dialysis 

could realistically be on home dialysis. In 2012, about 11 percent of 

patients needing dialysis received home dialysis.

A number of factors can affect the type of dialysis patients receive, 

including patients’ preference and clinical factors, but Medicare payment 

policy may also play a role. In 2015, we found that dialysis facilities have 

 37GAO, Clinical Data Registries: HHS Could Improve Medicare Quality and Efficiency 

through Key Requirements and Oversight, GAO-14-75 (Washington, D.C.: Dec. 16, 2013).
Medicare Program

Page 542 GAO-17-317 High-Risk Series

financial incentives in the short term to increase dialysis treatments 

provided in facilities.38 Medicare’s monthly payments to physicians for 

managing the care of home patients are often lower than those for 

managing in-center patients, which may also discourage physicians from 

prescribing home dialysis. Further, just a small fraction of Medicare 

patients have used the Kidney Disease Education benefit—which 

provides pre-dialysis education and is designed to help patients make 

informed decisions related to their treatment. Limited use of this benefit 

may be due to statutory limitations on the types of providers who are 

permitted to furnish the benefit and on the patients eligible to receive it. 

We recommended that CMS examine and, if necessary, revise policies 

for paying physicians to manage the care of dialysis patients, and 

examine the Kidney Disease Education benefit, and if appropriate, seek 

legislation to revise the categories of providers and patients eligible for 

the benefit.39 HHS concurred with the first recommendation but did not 

agree with the second, stating that CMS must prioritize its activities to 

improve care for dialysis patients. We maintain the importance of 

ensuring that Medicare patients with chronic kidney disease understand 

their condition and the implications of various treatment options; however, 

the limited use of the Kidney Disease Education benefit suggests it may 

be difficult for patients to receive this education.

Congress, HHS, and CMS have taken steps to improve the fiscal integrity 

of Medicare, and CMS has implemented some of our recommendations, 

such as providing more frequent feedback to physicians so they can 

identify opportunities to reduce costs and rebasing payments for endstage renal disease services using more recent data, which resulted in 

per treatment payment reductions. However, continued federal 

improvements to the oversight of Medicare are warranted given the size 

and complexity of the program as well as the number and scope of 

ongoing changes to the program.

We have a number of Matters for Congressional Consideration for 

addressing Medicare payments, costs, and quality of care. Specifically:

 38GAO, End-Stage Renal Disease: Medicare Payment Refinements Could Promote 

Increased Use of Home Dialysis, GAO-16-125 (Oct. 15, 2015). 

39GAO-16-125. 

What Remains to Be 

Done
Medicare Program

Page 543 GAO-17-317 High-Risk Series

• To increase beneficiaries’ awareness of providers’ financial interest in 

a particular treatment, Congress should consider directing the 

Secretary of Health and Human Services to require providers who 

self-refer intensity-modulated radiation therapy services—a type of 

cancer treatment—to disclose to their patients that they have a 

financial interest in the service.

• To further align Medicare beneficiary use of preventive services with 

U.S. Preventive Task Force recommendations, Congress should 

consider requiring beneficiaries who receive services that the Task 

Force recommends against to share the cost, notwithstanding that 

cost sharing may not be required for beneficiaries with different 

characteristics or under different circumstances.

• To help HHS better control spending and encourage efficient delivery 

of care, Congress should consider requiring Medicare to pay PPSexempt cancer hospitals as it pays PPS teaching hospitals, or provide 

the Secretary with the authority to otherwise modify how Medicare 

pays these providers. To generate cost savings from any reduction in 

outpatient payments to PPS-exempt cancer hospitals, Congress 

should also provide that all forgone outpatient payment adjustment 

amounts be returned to the Supplementary Medical Insurance Trust 

Fund.

• In order to prevent the shift of services from physician offices to 

hospital outpatient departments from increasing costs for the 

Medicare program and beneficiaries, Congress should consider 

directing the Secretary of Health and Human Services to equalize 

payment rates between the settings for evaluation and management

office visits—and other services that the Secretary deems 

appropriate—and to return the associated savings to the Medicare 

program.

• To help HHS ensure accuracy in Part B drug payment rates, 

Congress should consider requiring all manufacturers of Part B drugs 

paid at ASP, not only those with Medicaid drug rebate agreements, to 

submit sales price data to CMS, and ensure that CMS has authority to 

request source documentation to periodically validate all such data.

• To determine the suitability of Medicare’s Part B drug payment rate 

methodology for drugs with coupon programs, Congress should 

consider (1) granting CMS the authority to collect data from drug 

manufacturers on coupon discounts for Part B drugs paid based on 

ASP, and (2) requiring the agency to periodically collect these data 

and report on the implications that coupon programs may have for this 

methodology.
Medicare Program

Page 544 GAO-17-317 High-Risk Series

In addition, we have made a range of recommendations to HHS and CMS 

intended to improve program management and control costs that remain 

open, including the following:

• To ensure that MA encounter data are of sufficient quality for their 

intended purposes, the Administrator of CMS should (1) establish 

specific plans and time frames for using the data for all intended 

purposes in addition to risk adjusting payments to MA organizations; 

and (2) complete all the steps necessary to validate the data, 

including performing statistical analyses, reviewing medical records, 

and providing MA organizations with summary reports on CMS’s 

findings, before using the data to risk adjust payments or for other 

intended purposes.

• To ensure that future low-volume payment adjustments (LVPA) are 

made only to eligible facilities and to rectify past overpayments, the 

Administrator of CMS should (1) require Medicare contractors to 

promptly recoup 2011 LVPA payments that were made in error, (2) 

improve the timeliness and efficacy of CMS’s monitoring regarding the 

extent to which Medicare contractors determine LVPA eligibility 

correctly and promptly redetermine eligibility when all necessary data 

become available, and (3) investigate errors that contributed to 

facilities not consistently receiving the 2011 LVPA and ensure that 

such errors are corrected. Additionally, to reduce the incentive for 

facilities to restrict the services they provide to avoid reaching the 

LVPA treatment threshold, the Administrator of CMS should consider 

revisions such as changing the LVPA to a tiered adjustment.

• In order to improve CMS’s ability to identify self-referred advanced 

imaging services and help CMS address the increases in these 

services, the Administrator of CMS should (1) insert a self-referral flag 

on its Medicare Part B claims form and require providers to indicate 

whether the advanced imaging services for which provider bills 

Medicare are self-referred or not; (2) reduce payments for selfreferred advanced imaging services to recognize efficiencies when 

the same provider refers and performs a service; and (3) determine 

and implement an approach to ensure the appropriateness of

advanced imaging services referred by self-referring providers.

• To increase dual-eligible special needs plans’ accountability and 

ensure that CMS has the information it needs to determine whether 

dual-eligible special needs plans are providing the services needed by 

dual-eligible beneficiaries, especially those who are most vulnerable, 

the Administrator of CMS should evaluate the extent to which dualeligible special needs plans have provided sufficient and appropriate 
Medicare Program

Page 545 GAO-17-317 High-Risk Series

care to the population they serve, and report the results in a timely 

manner.

• To help ensure appropriate payments to MA plans, the Administrator 

of CMS should take steps to improve the accuracy of the adjustment 

made for differences in diagnostic coding practices between MA and 

Medicare FFS. Such steps could include, for example, accounting for 

additional beneficiary characteristics, including the most current data 

available, identifying and accounting for all years of coding differences 

that could affect the payment year for which an adjustment is made; 

and incorporating the trend of the impact of coding differences on risk 

scores.

For additional information about this high-risk area, contact James 

Cosgrove at (202) 512-7114 or cosgrovej@gao.gov, or Kathleen King at 

(202) 512-7114 or kingk@gao.gov.

Medicare: CMS’s Round 2 Durable Medical Equipment and National MailOrder Diabetes Testing Supplies Competitive Bidding Programs. 

GAO-16-570. Washington, D.C.: September 15, 2016.

Medicare Part B: Data on Coupon Discounts Needed to Evaluate 

Methodology for Setting Drug Payment Rates. GAO-16-643. Washington, 

D.C.: July 27, 2016.

Medicare Part B: CMS Should Take Additional Steps to Verify Accuracy 

of Data Used to Set Payment Rates for Drugs. GAO-16-594. Washington, 

D.C.: July 1, 2016.

Hospital Uncompensated Care: Federal Action Needed to Better Align 

Payments with Costs. GAO-16-568. Washington, D.C.: June 30, 2016.

Medicare Fee-For-Service: Opportunities Remain to Improve Appeals 

Process. GAO-16-366. Washington, D.C.: May 10, 2016.

Medicare Advantage: Action Needed to Ensure Appropriate Payments for 

Veterans and Nonveterans. GAO-16-137. Washington, D.C.: April 11, 

2016.

Medicare: Increasing Hospital-Physician Consolidation Highlights Need 

for Payment Reform. GAO-16-189. Washington, D.C.: December 18, 

2015.

GAO Contact

Related GAO 

Products
Medicare Program

Page 546 GAO-17-317 High-Risk Series

Medicare and Medicaid: Additional Oversight Needed of CMS’s 

Demonstration to Coordinate the Care of Dual-Eligible Beneficiaries. 

GAO-16-31. Washington, D.C.: December 18, 2015.

Medicare Part B: Expenditures for New Drugs Concentrated among a 

Few Drugs; and Most Were Costly for Beneficiaries. GAO-16-12. 

Washington, D.C.: October 23, 2015.

End-Stage Renal Disease: Medicare Payment Refinements Could 

Promote Increased Use of Home Dialysis. GAO-16-125. Washington, 

D.C.: October 15, 2015.

Medicare Advantage: Actions Needed to Enhance CMS Oversight of 

Provider Network Adequacy. GAO-15-710. Washington, D.C.: August 31, 

2015.

Medicare Physician Payment Rates: Better Data and Greater 

Transparency Could Improve Accuracy. GAO-15-434. Washington, D.C.: 

May 21, 2015.

Medicare: Payment Methods for Certain Cancer Hospitals Should Be 

Revised to Promote Efficiency. GAO-15-199. Washington, D.C.: February 

20, 2015.

Medicare: Bidding Results from CMS’s Durable Medical Equipment 

Competitive Bidding Program. GAO-15-63. Washington, D.C.: November 

7, 2014.
Medicare Improper Payments

Page 547 GAO-17-317 High-Risk Series

We designated Medicare as one of the original high-risk programs in 

1990 due to its size, complexity, and susceptibility to mismanagement 

and improper payments. In 2016, Medicare was projected to finance 

health services for more than 57 million elderly and disabled beneficiaries 

at a cost of $696 billion, and account for approximately 17.8 percent of 

federal spending. Improper payments—payments that are either made in 

an incorrect amount or should not be made at all—are a significant risk 

for Medicare and reached an estimated $60 billion in fiscal year 2016. 

The Centers for Medicare & Medicaid Services (CMS), which administers 

Medicare for the Department of Health and Human Services (HHS), is 

responsible for overseeing the program and safeguarding it from loss. 

While Medicare, the largest federal health program, remains inherently 

complex and susceptible to improper payments, CMS can continue to 

take actions to prevent and reduce improper payments in the program. 

This high-risk rating and assessment focuses on CMS’s efforts to reduce 

Medicare improper payments. We discuss the broader challenges and 

risks associated with the Medicare program separately.

CMS has continued to demonstrate leadership commitment to preventing 

and reducing Medicare improper payments, but consistently high 

improper payment rates and unimplemented improvement opportunities 

have resulted in the agency partially meeting the four remaining criteria 

for removal from our High-Risk List—capacity, action plan, monitoring, 

and demonstrated progress. Since our last high-risk update, agency 

leadership took action to prevent improper payments by strengthening 

certain provider enrollment and prepayment controls, as we 

recommended. CMS also implemented our recommendation to improve 

oversight of contractors that carry out postpayment reviews, such as the 

Medicare Administrative Contractors (MAC) and Recovery Auditors (RA). 

The agency also took certain program integrity actions authorized by the 

Patient Protection and Affordable Care Act (PPACA) and the Medicare 

Access and CHIP Reauthorization Act of 2015 (MACRA). However, 

despite these efforts, Medicare improper payment rates remained high in 

2016. According to HHS’s Agency Financial Report for 2016, although 

reported improper payments decreased for Medicare fee-for-service 

(FFS) from 12.1 percent in fiscal year 2015 to 11.0 percent in fiscal year 

2016, this rate remained above the statutorily defined compliance 

threshold of 10 percent.1 In addition, the improper payment rates 

 1

See Pub. L. No. 111-204, § 3(a)(3)(F), 124 Stat. 2224, 2233 (codified at 31 U.S.C. § 

3321 note).

Medicare Improper Payments

Why Area Is High 

Risk

What GAO Found
Medicare Improper Payments

Page 548 GAO-17-317 High-Risk Series

increased for Medicare Part C (9.5 percent in fiscal year 2015 to 10.0 

percent in fiscal year 2016) and improved somewhat for Part D (3.6 

percent in fiscal year 2015 to 3.4 percent in fiscal year 2016).2 These 

rates suggest that additional actions are needed to reduce improper 

payments in the Medicare program. By implementing our open 

recommendations, CMS will be able to reduce improper payments and 

progress toward fulfilling the outstanding criteria to remove Medicare 

improper payments from our High-Risk List.

Congress has also taken actions aimed at helping CMS address this 

high-risk issue. For example, Congress passed and the President signed 

into law MACRA in April 2015, which included several provisions aimed at 

improving Medicare program integrity, such as requiring and providing 

funding for CMS to remove beneficiaries’ Social Security numbers (SSN) 

from Medicare cards, requiring MACs to have improper payments 

outreach and education programs, and modifying surety bond conditions 

of participation for home health agencies. Congress has also continued to 

appropriate discretionary funding for CMS to take action to reduce 

improper payments. In addition, the House and Senate have held more 

than 20 hearings in the last 4 fiscal years to identify additional program 

integrity improvements, including 7 hearings since our 2015 high-risk 

report.

Improper payments in all parts of Medicare remain unacceptably high. As 

Medicare program spending and enrollment are projected to continue to 

grow under current law, sustained effort will be needed to ensure program 

integrity and reduce improper payments. If CMS were to effectively 

implement our numerous recommendations, it could improve program 

management, make fewer improper payments, and recover more of those 

it makes. For example, to improve the effectiveness of efforts to reduce 

and recover improper payments in Part C, CMS should improve the 

processes for selecting contracts to include in its risk adjustment data 

validation (RADV) audits—audits of Medicare Advantage (MA) 

organizations that help CMS recover improper payments in cases where 

beneficiary diagnoses are unsupported by medical records. We also 

 2

Medicare contains four parts. Parts A and B are known as Medicare FFS. Part A covers 

hospital and other inpatient stays and Part B covers hospital outpatient, physician, and 

other services. Part C, also known as Medicare Advantage (MA), is the private plan

alternative to Medicare FFS under which beneficiaries receive benefits through private 

health plans. Part D is the outpatient prescription drug benefit. 

What Remains to Be 

Done
Medicare Improper Payments

Page 549 GAO-17-317 High-Risk Series

recommend that CMS enhance the timeliness of these audits and 

incorporate recovery audit contractors (RAC) into the RADV audit. CMS 

should also revise its guidance for verifying provider practice locations so 

that MACs conduct additional research on questionable practice location 

addresses to help improve Medicare provider and supplier enrollmentscreening procedures.

Moreover, CMS should fully implement the following priority 

recommendations and available procedures authorized by PPACA and 

MACRA to improve the Medicare improper payment rate and remove this 

area from our High-Risk List:

• set clear expectations in contract work statements for Part D RAC, 

conduct annual RAC performance evaluations, and review the 

process for developing new audit issues to improve the agency’s Part 

D RAC program operations and contractor oversight;

• seek legislative authority to allow the RAs—which typically conduct 

postpayment reviews—to conduct prepayment claim reviews for 

Medicare FFS as another means of preventing improper payments 

before they occur;

• provide guidance to MACs on how to accurately calculate and report 

savings from prepayment claim reviews to ensure that CMS has the 

information it needs to evaluate MAC effectiveness in preventing 

improper payments and evaluate and compare MACs’ performance to 

that of other contractors;

• monitor the database used to track Medicare FFS recovery audit 

activities to ensure that all postpayment review contractors submit 

required data and that the data contained in the database are 

accurate and complete;

• clarify and standardize as much as possible the requirements for the 

contents of postpayment claims review contractors’ correspondence 

with providers and assess regularly whether contractors are 

complying with content requirements to improve the efficiency of 

postpayment claims reviews and simplify compliance for providers; 

and

• require surety bonds for certain types of at-risk providers and 

suppliers as authorized by PPACA and MACRA.3

 3

A surety bond guarantees that if a provider or supplier does not fulfill its obligation to 

Medicare, CMS can recover its losses via the surety bond. 
Medicare Improper Payments

Page 550 GAO-17-317 High-Risk Series

CMS continues to meet our criterion for leadership commitment to 

reducing Medicare improper payments. Improper payment reduction 

remains a strategic priority for HHS, and CMS leadership has taken 

multiple actions that demonstrate its commitment to reducing such 

payments in the Medicare program, including implementing several of our 

recommendations. For example, CMS leadership indicated that the 

agency took steps since our last high-risk update to co-locate all offices 

whose primary mission is ensuring the integrity of Medicare FFS claims 

payments, which it believes will improve efficiency for dealing with 

program integrity issues. CMS also implemented some of our 2012 and 

2013 recommendations to improve postpayment reviews and prepayment 

control efforts. For example, CMS uses several contractors to conduct 

postpayment reviews for improper payments and the agency has made 

changes to standardize contractor requirements as we highlighted as a 

priority recommendation in the 2015 high-risk update.

4 By aligning these 

contractor requirements, CMS will likely improve the efficiency and 

effectiveness of its Medicare program integrity efforts by strengthening 

the control environment, lessening providers’ confusion, and reducing 

administrative burdens.

In response to our priority recommendations, CMS also began 

disseminating information about certain contractors’ most successful 

prepayment edits—controls preprogrammed into payment processing 

systems—and requested that these contractors share information about 

their top edits, thereby ensuring more widespread use of effective 

prepayment controls.5 In 2015, we also recommended changes to 

improve CMS’s enrollment screening procedures for Medicare providers 

 4

See GAO, Medicare Program Integrity: Increasing Consistency of Contractor 

Requirements May Improve Administrative Efficiency, GAO-13-522 (Washington, D.C.: 

July 23, 2013).

5

See GAO, Medicare Program Integrity: Greater Prepayment Control Efforts Could 

Increase Savings and Better Ensure Proper Payment, GAO-13-102 (Washington, D.C.: 

Nov. 13, 2012).

Additional Details on 

What GAO Found

Leadership Commitment
Medicare Improper Payments

Page 551 GAO-17-317 High-Risk Series

and suppliers, and CMS has implemented several updates to its provider

enrollment database that will address identified weaknesses.6

CMS partially met our criterion that it have the capacity to reduce 

improper payments in the Medicare program. The Medicare integrity 

program—along with other activities to detect, prevent, and combat 

factors that contribute to improper payments—is funded through the 

Health Care Fraud and Abuse Control (HCFAC) program, which has 

reported returns on investment of $6.10 for every $1 spent from fiscal 

year 2013 through 2015. In fiscal year 2016, Congress provided more 

discretionary HCFAC funding than in any prior year. These funds helped 

CMS implement planned initiatives to protect Medicare dollars. While 

CMS received increased discretionary funding since 2015, the budgetary 

environment remains uncertain, as demonstrated by the 6 percent decline 

in discretionary Medicare integrity funding from fiscal year 2011 to 2014. 

Given funding uncertainty and projected spending increases, it is even 

more important for CMS to prioritize its most effective program integrity 

initiatives and to maximize the effect of those initiatives already underway 

by implementing our recommendations.

CMS has partially met our action plan criterion. While CMS identifies and 

reports progress on corrective actions related to Medicare improper 

payments in HHS’s annual Agency Financial Report, the agency has not 

implemented all of the recommendations we made that could reduce 

improper payments nor fully developed an action plan for addressing our 

high-risk area. HHS’s Agency Financial Report for 2016 identified 

insufficient documentation and medical necessity errors as root causes of 

improper payments for Medicare FFS, and insufficient documentation and 

administrative errors as root causes of improper payments for both Parts 

C and D. The report also identified actions that CMS has taken or is 

taking to address these causes. For example:

• CMS took action to revalidate existing Medicare providers and 

suppliers, as required by PPACA. The provider and supplier 

revalidation is in the second round of a multiyear process to improve 

 6

See GAO, Medicare Program: Additional Actions Needed to Improve Eligibility 

Verification of Providers and Suppliers, GAO-15-448 (Washington, D.C.: June 25, 2015).

Capacity

Action Plan
Medicare Improper Payments

Page 552 GAO-17-317 High-Risk Series

enrollment screening that we reported on in 2016. 7 Specifically, we 

reported that CMS’s revised enrollment screening process resulted in 

over 703,000 existing enrollment records being deactivated or 

revoked but that CMS needed to establish performance measures to 

assess the revised process.

• CMS took several corrective actions to address improper payment 

rates for home health claims, which have historically had improper 

payment rates over 50 percent. For example, CMS took action to 

clarify face-to-face requirements for home health providers and 

implemented prepayment claims reviews in 2015 to help educate 

home health providers. The improper payment rate for home health 

claims decreased from 59.0 percent in fiscal year 2015 to 42.0 

percent in fiscal year 2016.

• CMS also expanded the use of prior authorization to prevent improper 

payments for various suppliers. For example, CMS published a final 

rule in December 2015 that established a Master List of Durable 

Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) 

items that providers frequently bill to Medicare when recipients don’t 

need them. The rule, which took effect on February 29, 2016, requires 

prior authorization for certain DMEPOS items on the Master List, 

which CMS believes will reduce or prevent questionable billing 

practices and improper payments for these items. In December 2016, 

CMS announced that it would begin implementing prior authorization 

for two types of power wheelchairs not previously covered in a 

demonstration beginning in March 2016.

Despite these efforts, we have found problems with some of the proposed 

corrective actions. For Part C improper payments, HHS’s 2015 and 2016 

Agency Financial Reports identified RADV audits as a primary corrective 

action. These audits of MA organizations—to which Medicare pays a riskadjusted monthly amount for each enrolled beneficiary—help CMS 

recover improper payments from such organizations if they requested 

CMS to adjust payments based on beneficiary diagnoses unsupported by 

medical records. However, in April 2016, we reported significant problems 

with the methods used to select MA contracts for RADV audits and the 

 7

See GAO, Medicare: Initial Results of Revised Process to Screen Providers and 

Suppliers, and Need for Objectives and Performance Measures, GAO-17-42 (Washington, 

D.C.: Nov. 15, 2016). In 2011, CMS implemented a revised enrollment screening process 

and undertook its first program-wide effort to rescreen or revalidate existing providers 

using the new process. It began its second program-wide revalidation effort in 2016.
Medicare Improper Payments

Page 553 GAO-17-317 High-Risk Series

time it took to complete the audits.8 For example, using current methods, 

CMS is unable to select contracts for audit that have the greatest 

potential for recovering improper payments. These issues limit CMS’s 

ability to recover the billions of dollars in MA improper payments that 

occur each year.

In addition, CMS has yet to address some problems including those 

where we have recommended changes. For example, in 2016, we 

recommended that CMS seek legislative authority to allow RAs to review 

Medicare FFS claims before they are paid as another means to prevent 

improper payments before they occur. Although CMS and RA officials told 

us that a demonstration of RA prepayment reviews was considered 

successful, the agency disagreed with our recommendation to seek 

authority to extend this ability and told us that other claim review 

contractors conduct prepayment reviews and that CMS has implemented 

other programs as part of its strategy to move away from the “pay and 

chase” process of recovering overpayments.9 We continue to believe that 

prepayment reviews better protect agency funds compared to 

postpayment reviews, and that seeking the authority to allow RAs to 

conduct prepayment reviews is consistent with CMS’s strategy to pay 

claims properly the first time. In not seeking the authority, CMS may be 

missing an opportunity to reduce the amount of uncollectable 

overpayments from RA reviews and save administrative resources 

associated with recovering overpayments. Finally, CMS officials have 

indicated that the agency is developing an action plan to address our 

identified high-risk areas, but as of January 2017, the plan was not yet 

complete.

CMS has taken steps to monitor the effectiveness of its corrective 

measures, but only partially met our monitoring criterion due to data and 

oversight challenges. For example, in response to our 2011 

recommendation, CMS implemented changes to the data systems its 

contractors use to track spending on Medicare integrity efforts, thereby 

improving the agency’s ability to assess the effectiveness of these 

 8

See GAO, Medicare Advantage: Fundamental Improvements Needed in CMS’s Effort to 

Recover Substantial Amounts of Improper Payments, GAO-16-76 (Washington, D.C.: Apr. 

8, 2016).

9

See GAO, Medicare: Claim Review Programs Could Be Improved with Additional 

Prepayment Reviews and Better Data, GAO-16-394 (Washington, D.C.: Apr. 13, 2016).

Monitoring
Medicare Improper Payments

Page 554 GAO-17-317 High-Risk Series

activities.10 However, other weaknesses limit CMS’s ability to monitor 

activities of the contractors that review Medicare claims before and after 

payment. In 2016, we reported that CMS does not have reliable data on 

savings from prepayment claims reviews to evaluate MACs’ performance 

in preventing improper payments or to compare performance across 

contractors.11 In response to our report, CMS is developing 

methodologies to estimate amounts CMS would have paid providers had 

claim denials based on prepayment review not occurred. Until CMS 

completes these activities and calculates and reports savings from 

prepayment reviews, this remains a priority recommendation.

In 2016, we also found that, although CMS has improved its provider and 

supplier enrollment screening process, it lacked objectives for monitoring 

this screening process and performance measures to assess progress 

toward achieving its goals for revalidating enrollment information.12

Finally, in 2015, we reported that CMS did not adequately set 

expectations for the RAC hired to oversee Part D payments, did not 

conduct timely performance evaluations, and did not have a good process 

for approving audit work.13 As a result of these management weaknesses, 

CMS collected fewer than $10 million in Part D improper payments as of 

May 2015. Given that Part D improper payments increased from $2.2 

billion to $2.4 billion from fiscal year 2015 to 2016, CMS will need to 

address these issues when it solicits the next Part D RAC contracts.14

CMS has demonstrated some progress, including a decrease in the 

Medicare FFS and Part D improper payment rates in fiscal year 2016, but 

the size of the program and persistently high improper payment rates for 

some parts of Medicare indicate further progress is needed. As noted, 

CMS has taken various actions to improve Medicare program integrity, 

such as updating eligibility enrollment software, revalidating existing 

 10See GAO, Medicare Integrity Program: CMS Used Increased Funding for New Activities 

but Could Improve Measurement of Program Effectiveness, GAO-11-592 (Washington, 

D.C.: July 29, 2011).

11GAO-16-394.

12GAO-17-42. 

13See GAO, Medicare Part D: Changes Needed to Improve CMS’s Recovery Audit 

Program Operations and Contractor Oversight, GAO-15-633 (Washington, D.C.: Aug. 14, 

2015).

14Although the Part D error rate decreased from 3.6 percent to 3.4 percent from fiscal year 

2015 to 2016, the dollar value increased.

Demonstrated Progress
Medicare Improper Payments

Page 555 GAO-17-317 High-Risk Series

providers and suppliers, and reducing differences in contractor 

postpayment review requirements; however, it has yet to be determined 

how many of these changes will affect CMS’s long-term ability to prevent 

and collect improper payments. In addition, Congress enacted MACRA, 

which, among other things, required and provided funding for CMS to 

remove beneficiaries’ SSNs from Medicare cards and develop a new, 

unique identifier—which we also recommended in 2012 and have 

highlighted as a priority recommendation.15 In 2016, CMS reported that it 

had begun the process of removing SSNs from Medicare cards and will 

begin replacing them with randomly generated Medicare Beneficiary 

Identifiers in 2018; however, such changes will not be fully implemented 

until 2019. CMS has indicated that certain other corrective actions—like 

expanding the use of prior authorization—have successfully reduced 

improper payments in several demonstration projects and provider 

education initiatives, and as a result, the agency is in the process of 

expanding such efforts. Moreover, CMS has yet to implement certain 

PPACA-authorized actions as we encouraged the agency to do in our 

2015 high-risk report. For example, PPACA authorized CMS to impose 

surety bonds on certain at-risk providers to strengthen provider 

enrollment protections.16 MACRA also included a provision to require 

surety bonds for all home health agencies as a condition of Medicare 

participation.17 CMS has stated that the agency is working to implement 

this requirement, but, as of December 2016, CMS had not issued rules to 

do so. Continued progress in these and other efforts is needed, as 

Medicare FFS, Part C, and Part D all remained on the Office of 

Management and Budget’s list of high-error programs in 2015. Sustained 

control over payments and program integrity management is needed 

before Medicare improper payments can fully meet our criterion for 

demonstrated progress.

 15Pub. L. No. 114-10, § 501, 129 Stat. 87, 163 (2015). See GAO, Medicare: CMS Needs 

an Approach and a Reliable Cost Estimate for Removing Social Security Numbers from 

Medicare Cards, GAO-12-831 (Washington, D.C.: Aug. 1, 2012) and GAO, Medicare 

Information Technology: Centers for Medicare and Medicaid Services Needs to Pursue a 

Solution for Removing Social Security Numbers from Cards, GAO-13-761 (Washington, 

D.C.: Sept. 10, 2013).

16Pub. L. No. 111-148, § 6402(g), 124 Stat. 119, 759 (2010) (codified at 42 U.S.C. § 

1395y(n)). A surety bond is a three-party agreement in which a company, known as a 

surety, agrees to compensate the bondholder if the bond purchaser fails to keep a 

specified promise. 

17Pub. L. No. 114-10, § 513, 129 Stat. at 171 (codified at 42 U.S.C. § 1395x(o)(7)).
Medicare Improper Payments

Page 556 GAO-17-317 High-Risk Series

• Our body of work on improper payments has raised the level of 

attention to this issue, including Medicare improper payments, and 

contributed to the passage of the Improper Payments Information Act 

of 2002 (IPIA) and subsequent improper payment legislation. These 

laws require, among other things, agencies to estimate their annual 

amount of improper payments and report on actions to reduce them. 

In part from our continued oversight of CMS’s efforts to meet the 

requirement of IPIA, both Medicare Part C and Part D have reduced 

overpayment rates, a component of the total program improper 

payment rate, since each program began reporting improper 

payments in 2009 and 2011, respectively. Specifically, we determined 

that Medicare Part C had cost savings associated with overpayment 

error rate reductions of $1.2 billion in fiscal year 2010, $5.1 billion in 

fiscal year 2011, $6.2 billion in fiscal year 2013, and $8.9 billion in 

fiscal year 2014. Part D had cost reduction of $209.8 million in fiscal 

year 2014 and $51.1 million in fiscal year 2015.

• In 2012, we reported that CMS had not integrated its predictive 

analytics system, known as the Fraud Prevention System (FPS), with 

its claims processing and payment systems to allow for the automated 

prevention of potentially fraudulent Medicare claims payments.18 We 

recommended that the agency develop schedules for completing 

integration of these systems. In response, CMS implemented 

capabilities which allowed FPS to stop payment of certain improper 

and non-payable claims including a total of $26.2 million of cost 

savings in 2014 and 2015.

• In 2012, we made several recommendations to CMS to promote 

greater use of effective prepayment edits and better ensure proper 

payment, to promote implementation of effective edits based on 

national policies, and to encourage more widespread use of effective 

local edits by MACs.19 In response to these recommendations, CMS 

began disseminating information about certain contractors’ most 

successful prepayment edits—controls preprogrammed into payment 

processing systems—requested that these contractors share their top 

edits, and made improvements to certain edits that identify services 

billed in medically unlikely amounts. The agency also revised its 

standard operating procedures to ensure consideration of automated 

 18GAO, Medicare Fraud Prevention: CMS Has Implemented a Predictive Analytics 

System, but Needs to Define Measures to Determine Its Effectiveness, GAO-13-104 

(Washington, D.C.: Oct. 15, 2012).

19GAO-13-102.

Benefits Achieved by 

Implementing Our 

Recommendations
Medicare Improper Payments

Page 557 GAO-17-317 High-Risk Series

edits for all new and existing national coverage determinations—

which describe the circumstances under which Medicare will cover 

services nationwide—as we recommended. These changes help CMS 

ensure Medicare payments are made properly the first time.

• Beginning in 2013, CMS took several actions to improve its process 

for addressing RAC-identified vulnerabilities that led to improper 

payments as we recommended in 2010.20 For example, the agency 

created a protocol to determine the effectiveness of certain corrective 

actions and established regular meetings to discuss RAC issues. By 

taking these steps, CMS established monitoring and control activities 

to ensure that corrective actions are taken that help meet the overall 

goal of reducing improper payments in the Medicare program.

• In response to our 2011 recommendation, CMS implemented 

changes in 2014 to the data systems MACs use to track spending on 

Medicare integrity efforts, thereby improving the accuracy of spending 

estimates.21 These changes improve the agency’s ability to assess 

the effectiveness of their Medicare integrity activities.

• In 2015, we reported weaknesses in the screening procedures CMS 

uses to prevent and detect ineligible or potentially fraudulent providers 

and suppliers from enrolling in the Medicare Provider Enrollment, 

Chain and Ownership System (PECOS).22 Specifically, we found that 

the computer software CMS uses to validate applicants’ addresses 

does not flag potentially ineligible addresses. In addition, we found 

that CMS’s process for verifying providers’ licenses did not always 

identify providers’ adverse actions when enrolling, revalidating, or 

reviewing provider’s licenses unless the provider self-reported the 

action. In response to recommendations we made to address these 

issues, CMS updated its address verification software and 

incorporated information from the Federation of State Medical Boards 

into its automatic screening process thereby improving the integrity of 

Medicare provider enrollment.

• In 2012 and 2013, we made recommendations to CMS to remove 

beneficiary SSNs from the Medicare insurance card in order to protect 

 20GAO, Medicare Recovery Audit Contracting: Weaknesses Remain in Addressing 

Vulnerabilities to Improper Payments, Although Improvements Made to Contractor 

Oversight, GAO-10-143 (Washington, D.C.: Mar. 31, 2010).

21GAO-11-592.

22GAO-15-448.
Medicare Improper Payments

Page 558 GAO-17-317 High-Risk Series

beneficiaries from identity theft.23 In response to our 

recommendations and in accordance with MACRA, CMS initiated a 

project in 2016 to replace beneficiary SSNs with a non SSN-derived 

Medicare Beneficiary Number. Removing SSNs from Medicare cards 

better protects Medicare beneficiaries from identity theft and provides 

CMS with a useful tool in combatting Medicare fraud and medical 

identity theft.

• In 2011, we identified instances of questionable access to prescription 

drugs in the Part D program and made a recommendation to CMS to 

improve its efforts to curb overutilization in Part D.24 In response to 

our recommendation, CMS conducted a case management pilot in 

2012 to improve retrospective drug utilization program controls, 

developed a drug utilization review methodology to target Part D 

beneficiaries who are at risk due to high use of opioids, and 

implemented an overutilization monitoring system to ensure Part D 

sponsors are implementing effective controls against opioid 

overutilization. By implementing these changes, CMS has taken an 

important step toward insuring the safety of Medicare beneficiaries 

and reducing the abusive practice of doctor shopping for prescription 

drugs.

For additional information about this high-risk area, contact Kathleen King 

at (202) 512-7114 or kingk@gao.gov.

Medicare: Initial Results of Revised Process to Screen Providers and 

Suppliers, and Need for Objectives and Performance Measures. 

GAO-17-42. Washington, D.C.: November 15, 2016.

Skilled Nursing Facilities: CMS Should Improve Accessibility and 

Reliability of Expenditure Data. GAO-16-700. Washington, D.C.: 

September 7, 2016.

Medicare Fee-For-Service: Opportunities Remain to Improve Appeals 

Process. GAO-16-366. Washington, D.C.: May 10, 2016.

 23GAO-12-831, GAO-13-761.

24GAO, Medicare Part D: Instances of Questionable Access to Prescription Drugs, 

GAO-11-699 (Washington, D.C.: Sept. 6, 2011).

GAO Contact

Related GAO 

Products
Medicare Improper Payments

Page 559 GAO-17-317 High-Risk Series

Medicare: Claim Review Programs Could Be Improved with Additional 

Prepayment Reviews and Better Data. GAO-16-394. Washington, D.C.: 

April 13, 2016.

Medicare Advantage: Fundamental Improvements Needed in CMS’s 

Effort to Recover Substantial Amounts of Improper Payments. 

GAO-16-76. Washington, D.C.: April 8, 2016.

Health Care Fraud: Information on Most Common Schemes and the 

Likely Effect of Smart Cards. GAO-16-216. Washington, D.C.: January 

22, 2016.

Medicare Part D: Changes Needed to Improve CMS’s Recovery Audit 

Program Operations and Contractor Oversight. GAO-15-633. 

Washington, D.C.: August 14, 2015.

Medicare Program: Additional Actions Needed to Improve Eligibility 

Verification of Providers and Suppliers. GAO-15-448. Washington, D.C.: 

June 25, 2015.

Medicare: Potential Uses of Electronically Readable Cards for 

Beneficiaries and Providers. GAO-15-319. Washington, D.C.: March 25, 

2015.
Medicaid Program

Page 560 GAO-17-317 High-Risk Series

The size, growth, and diversity of the Medicaid program presents 

oversight challenges, and we designated Medicaid as a high-risk program 

in 2003 due to concerns about the adequacy of fiscal oversight. Medicaid 

is one of the largest sources of funding for acute health care, long-term 

care, and other services for low-income and medically needy populations. 

This federal-state program covered an estimated 72.2 million people in 

fiscal year 2016 and is the largest health program as measured by 

enrollment and the second largest as measured by expenditures, second 

only to Medicare. A source of significant pressure on federal and state 

budgets, estimated Medicaid outlays for fiscal year 2016 were $575.9 

billion, of which $363.4 billion was financed by the federal government 

and $212.5 billion by the states.1

Medicaid allows states significant flexibility to design and implement their 

programs, resulting in more than 50 distinct programs; this variability 

complicates program oversight and has contributed to challenges in 

overseeing program payments and beneficiaries’ access to services.2

Each state Medicaid program, by law, must cover certain categories of 

individuals and provide a broad array of benefits. Populations covered 

include children in low-income families and low-income individuals who 

are elderly, disabled, or are experiencing high medical needs. Medicaid’s 

extensive benefit package includes coverage for acute care services, 

primary care services, long-term care services, and comprehensive 

screening and treatment services for children.

Within these broad parameters, however, states administer their own 

programs, deciding whether to cover any health services or populations 

beyond what are mandated by law, setting provider reimbursement rates, 

and operating state-specific data systems to enroll eligible beneficiaries 

and providers and to process and pay claims. For example, states may 

pay health care providers for each service they provide on a fee-for-

 1

Centers for Medicare & Medicaid Services, Office of the Actuary, 2016 Actuarial Report 

on the Financial Outlook for Medicaid (Baltimore, Md.: 2017).

2

Medicaid essentially operates as 56 separate programs—1 in each of the 50 states, the 

District of Columbia, and each of the 5 largest U.S. territories: American Samoa, the 

Commonwealth of the Northern Mariana Islands, Guam, Puerto Rico, and the U.S. Virgin 

Islands.

Medicaid Program

Current State of the 

Medicaid Program

Overview of Medicaid’s 

Challenges
Medicaid Program

Page 561 GAO-17-317 High-Risk Series

service (FFS) basis; contract with managed care organizations (MCO) to 

provide a specific set of Medicaid-covered services to beneficiaries, and 

pay them a set amount per beneficiary per month; or rely on a 

combination of both delivery systems.

Variability among state Medicaid programs also results from key Medicaid 

reform efforts that states may initiate. For example, under Section 1115 of 

the Social Security Act, the Secretary of Health and Human Services can 

waive traditional Medicaid requirements and authorize states to expend 

funds on Medicaid demonstrations to test new ways to deliver services. 

State Medicaid programs also differ in whether and how they have 

elected to expand Medicaid as allowed under the Patient Protection and 

Affordable Care Act (PPACA), which gave states the option to expand 

Medicaid eligibility to nearly all adults under age 65 with incomes up to 

133 percent of the federal poverty level (hereafter referred to as newly 

eligible adults).3 States that elected to expand Medicaid received 100 

percent federal funding for this newly eligible population through 2016, 

with the federal share declining to 90 percent for 2020 and subsequent 

years. As of October 2016, 31 states and the District of Columbia had 

opted to expand Medicaid eligibility under PPACA. In 2015, the Centers 

for Medicare & Medicaid Services (CMS) projected that total spending for 

Medicaid will rise an average of 6.4 percent per year from 2015 to 2024 

(see figure 19).

 3

PPACA also provides for 5 percent of an applicant’s income to be disregarded when 

calculating modified adjusted gross income for determining Medicaid eligibility, which 

effectively increases this income level to 138 percent of the federal poverty level. 
Medicaid Program

Page 562 GAO-17-317 High-Risk Series

Figure 19: Growth Trends in Total Medicaid Spending by Eligibility Group

States also vary in the extent to which they are affected by economic 

downturns, which in turn can affect their Medicaid programs. The federal 

government matches most state expenditures using a statutory formula 

based in part on each state’s per capita income. We and others have 

noted that states’ efforts to fund Medicaid can be challenged during 

economic downturns, when Medicaid enrollment can rise and state 

revenues can decline. To ensure that federal funding efficiently and 

effectively responds to the program’s countercyclical nature, we have 

emphasized the need for timely and targeted federal assistance to 
Medicaid Program

Page 563 GAO-17-317 High-Risk Series

stabilize states’ funding of Medicaid during such periods.4 Such 

assistance would support states with declining revenues or increased 

enrollment during a national economic downturn, further stabilizing the 

financing of this important program.

An overarching challenge for the Medicaid program is the lack of 

accurate, complete, and timely data CMS needs to oversee the diverse 

and complex state Medicaid programs. Our work has made it clear that 

insufficient data have affected CMS’s ability to ensure proper payments 

and beneficiaries’ access to services. CMS’s two primary data sets—the 

CMS-64, which serves as the basis for calculating the amount of federal 

matching funds for states, and the Medicaid Statistical Information 

System (MSIS), which is designed to report individual beneficiary claims 

data—have the potential to offer a robust view of state financing, 

payments, and overall spending in the Medicaid program. However, the 

data’s usefulness is limited because of issues with completeness, 

timeliness, and accuracy. Improved data would enhance CMS oversight, 

allowing for improved monitoring of program financing and payments, 

beneficiary access, and compliance with Medicaid laws and 

requirements. CMS has acknowledged the need for improved Medicaid 

data and has undertaken a number of steps aimed at streamlining and 

improving the quality of data currently reported by states and available to 

CMS for oversight purposes.5

 4

See GAO, Medicaid: Changes to Funding Formula Could Improve Allocation of Funds to 

States, GAO-16-377T (Washington, D.C.: Feb. 10, 2016); and Medicaid: Prototype 

Formula Would Provide Automatic, Targeted Assistance to States during Economic 

Downturns, GAO-12-38 (Washington, D.C. Nov. 10, 2011). 

5

In its Comprehensive Medicaid Integrity Plan, CMS noted efforts to improve the quality 

and consistency of Medicaid data reported to CMS. See CMS, Comprehensive Medicaid 

Integrity Plan, Fiscal Years 2014-2018. For example, CMS has an ongoing effort to 

implement the Transformed Medicaid Statistical Information System (T-MSIS) to increase 

and improve the data collected through MSIS. T-MSIS is to include data about enrollees, 

services, and costs, including FFS claims, managed care encounters, beneficiary eligibility 

and demographics, and provider enrollment.
Medicaid Program

Page 564 GAO-17-317 High-Risk Series

The effects of ongoing reforms and other changes to the Medicaid 

program will continue to emerge in the coming years, and congressional 

interest in how to improve this important program remains high. In July 

2015—the 50th anniversary of Medicaid—we testified on key issues 

facing the program and oversight gaps, based on dozens of our reviews 

of the Medicaid program.6 That report and our other work to date illustrate 

the continuing challenges facing Medicaid and the need for improved 

federal oversight in five areas:

1. Financing and Provider Payment Transparency and Oversight

2. Managed Care Payments and Utilization Oversight

3. Growing Expenditures for and Oversight of Large Medicaid 

Demonstrations

4. Monitoring and Measurement of Access to Quality Care

5. Growing Expenditures for Long-Term Care Services

Complete and accurate data on state financing and payments to 

individual providers is essential for CMS to effectively oversee state 

Medicaid programs. Without more transparent information on state 

funding sources and program payments, CMS is unable to determine 

whether program expenditures are appropriate or to ensure the fiscal 

integrity of the program. Congress has held multiple hearings on these 

issues, including a November 2015 hearing at which the House 

Committee on Energy and Commerce, Subcommittee on Health, 

examined possible legislative remedies to address concerns we have 

raised in multiple reports about the transparency of Medicaid financing 

and payments to individual providers.7

Financing transparency and oversight. In recent years, states have 

increasingly relied on funds from providers and local governments to 

finance the nonfederal share of Medicaid, with implications for federal 

 6

See GAO, Medicaid: Overview of Key Issues Facing the Program, GAO-15-746T 

(Washington, D.C.: July 8, 2015). 

7

See GAO, Medicaid: Completed and Preliminary Work Indicate that Transparency 

around State Financing and Payments to Providers Is Still Needed for Oversight, 

GAO-14-817T (Washington, D.C.: July 29, 2014); Medicaid: Overview of Key Issues 

Facing the Program, GAO-15-746T (Washington, D.C.: July 8, 2015); and Medicaid: 

Improving Transparency and Accountability of Supplemental Payments and State 

Financing Methods, GAO-16-195T (Washington, D.C.: Nov. 3, 2015). 

Our Work Suggests 

the Need for 

Continued Attention in 

Five Principal Areas

Financing and Provider 

Payment Transparency 

and Oversight
Medicaid Program

Page 565 GAO-17-317 High-Risk Series

costs. While states finance the nonfederal share in large part through 

state general funds, they also depend on other sources of funds, such as 

taxes on health care providers and transfers of funds from local 

governments. Our 2013 survey of states found that, in 2012, states 

financed over one-quarter—over $46 billion—of the nonfederal share of 

Medicaid with funds from health care providers and local governments, an 

increase of over 21 percent since 2008 from these sources. Our work has 

illustrated that by requiring providers to supply all or more of the 

nonfederal share of Medicaid payments, states can claim an increase in 

federal matching funds without a commensurate increase in state 

expenditures. This shifts costs from the state to the federal government.

Identifying the sources of nonfederal funds is essential to assessing their 

effect; however, CMS does not collect complete or accurate information 

on these sources of nonfederal funds. Apart from data on provider taxes 

and donations, CMS does not require states to provide information on the 

funds they use to finance Medicaid nor ensure that the data they do 

collect are accurate and complete. This lack of transparency in states’

sources of funding hinders CMS’s ability to determine whether increasing 

payments to providers provides fiscal relief to the state or whether 

increasing payments to providers improves beneficiary access. Without 

accurate information on how states finance their Medicaid programs, 

CMS is also unable to ensure that states comply with federal 

requirements. For instance, under federal law, at least 40 percent of the 

state share must be from state funds, which includes state general funds, 

provider taxes and donations, and transfers from other state agencies.8

CMS disagreed with our recommendation to take action to improve the 

information available on states’ sources of the nonfederal share of 

Medicaid payments. In 2015, legislation was introduced that would 

require CMS to take such action.9

 8

The remaining 60 percent may be derived from funds from local governments. 42 U.S.C. 

§ 1396a(a)(2).

9

For example, H.R. 1362 was introduced in March 2015 to require each state to report 

each source of funds, each entity providing such funds, and the amount of funds from 

each source, used by the state to finance the non-federal share of expenditures under 

Medicaid. On November 3, 2015, the House Committee on Energy and Commerce, 

Subcommittee on Health, held a hearing at which our concerns related to transparency of 

state financing arrangements were discussed. However, no additional action was taken on 

H.R. 1362 in the 114th Congress. 
Medicaid Program

Page 566 GAO-17-317 High-Risk Series

Oversight of payments to institutional providers. Over the years, we 

and others have reported on CMS’s oversight of payments that states 

often make to institutional providers, such as hospitals and nursing 

facilities, which have raised questions. In particular, concerns have been 

raised about states making large Medicaid supplemental payments—

payments in addition to the regular, claims-based payments made to 

providers for services they provided—often to government providers, 

such as local government and state-operated hospitals and other health 

care facilities.10 In fiscal year 2015, the latest date for which data are 

available, these payments totaled about $55 billion. Supplemental 

payments that result in total Medicaid payments well in excess of a 

provider’s costs raise questions about whether payments are consistent 

with the statutory requirement that payments be economical and efficient 

and are actually for covered Medicaid services.11

Among other concerns related to CMS oversight of supplemental 

payments, we have found the agency lacks a policy and process for 

determining whether payments made to individual providers are 

economical and efficient, as required by law, and lacks clear guidance on 

appropriate methods for states to distribute payments.12 For example, in 

2015, we reported that three hospitals in New York received 

supplemental payments that resulted in overall Medicaid payments to the 

hospitals that greatly exceeded their cost of providing Medicaid services. 

 10Supplemental payments made by states include Disproportionate Share Hospital (DSH) 

payments, Medicaid Upper Payment Limit (UPL) payments, and supplemental payments 

authorized under Medicaid demonstrations. States are required by federal law to make 

DSH payments to certain hospitals to help offset these hospitals’ uncompensated care 

costs for serving large numbers of Medicaid and uninsured low-income individuals. 

Medicaid UPL supplemental payments are made by states to hospitals and other 

providers that are above the regular Medicaid payments but within the UPL, which is 

defined as the amount that Medicare would pay for comparable services. Under Section 

1115 of the Social Security Act, states may apply to and receive approval from CMS for a 

demonstration that allows states to deviate from their traditional Medicaid program. 

Spending authorities under the demonstrations provide states with the ability to claim 

federal Medicaid funds for new types of expenditures, including the costs of making 

additional payments, that is, supplemental payments, to providers from funding pools 

authorized under the demonstrations. 

11Concerns have also been raised about higher, regular claims-based payments made to 

government facilities.

12Federal law requires that payments to providers be economical and efficient, as well as 

sufficient to ensure that Medicaid care and services are available at least the extent that 

such care and services are available to the general population in the same geographic 

area. 42 U.S.C. § 1396a(a)(30)(A). 
Medicaid Program

Page 567 GAO-17-317 High-Risk Series

CMS, in response, required New York to retroactively reduce 

supplemental payments to the hospitals by more than $1.5 billion—

including $771 million in federal funds—over 4 years.

Further, in a 2016 report, we found that selected states distributed 

supplemental payments to hospitals largely based on the availability of 

local government funds to finance the nonfederal share, rather than on 

the volume of services each hospital provided. In addition, officials from 

hospitals that received payments above costs reported using the excess 

revenues from these supplemental payments broadly, from covering the 

costs of uninsured patients to funding general hospital operations, 

maintenance, and capital purchases, such as for a helicopter.

Based on the findings from these reports, we have recommended that 

CMS (1) clarify criteria for determining the economy and efficiency of 

payments to individual providers, (2) issue guidance clarifying its policies 

that supplemental payments should be linked to the provision of Medicaid 

services and not be contingent on the availability of local financing, and 

(3) require provider-specific reporting of certain types of supplemental 

payments. In 2015, legislation was proposed that would require CMS to 

collect provider-specific data on states’ supplemental payments.13 As of 

fall 2016, CMS was pursuing regulatory actions to address some of the 

concerns we raised, including requiring states to report information about 

how they distribute supplemental payments.

As of 2014, the latest date for which this information is available, more 

than three-fourths of Medicaid beneficiaries received some of their 

services in a managed care delivery system, in which the state typically 

contracts with managed care organizations (MCO) to provide a specific 

set of services for beneficiaries for a set amount per beneficiary per 

month. Federal spending for managed care in fiscal year 2014 was $107 

billion, which accounted for over one-third of federal Medicaid spending 

that year and represented a significant increase from 2013. Increased 

 13For example, H.R. 2151 was introduced in April 2015, to require states to conduct 

annual audits, and report annually on Medicaid UPL payments to individual institutional 

providers. It would also require the Secretary of HHS to issue guidance to states that 

identifies permissible methods for calculating Medicaid UPL payment amounts. On 

November 3, 2015, the Subcommittee on Health, House Energy and Commerce 

Committee held a hearing to discuss this and other legislation proposed to improve the 

Medicare and Medicaid programs. However, no additional action was taken on H.R. 2151 

in the 114th Congress.

Managed Care Payments 

and Utilization Oversight
Medicaid Program

Page 568 GAO-17-317 High-Risk Series

enrollment and spending for Medicaid managed care makes effective 

federal and state oversight of this large and complex component of the 

Medicaid program critical, and underscores the need for reliable data to 

assess the appropriateness of states’ payments to MCOs and 

beneficiaries’ access to MCO services. In our work examining federal 

expenditures for MCOs, we determined that state payments to MCOs in 

2014 varied widely across and within 8 states as did the average annual 

MCO payments per beneficiary, which ranged from $2,784 in California to 

$5,180 in Pennsylvania.14 While this variation could be due, in part, to 

differences in the enrolled population and geographic costs and utilization 

patterns, it suggests the need to further examine the relationship between 

higher MCO spending and beneficiaries’ experiences.

Further, federal law requires states to collect encounter data—records of 

health care services for which MCOs pay—and submit these data to CMS 

using MSIS. Having reliable encounter data that provides information on 

service utilization is important as MCOs receive a fixed amount per 

beneficiary regardless of the number of services used and therefore may 

have financial incentives to limit beneficiaries’ access to services. 

However, in our work examining beneficiary utilization of services, we 

could not fully assess utilization patterns for Medicaid managed care 

beneficiaries in 19 states because MSIS data were either not available 

(11 states) or were unreliable (8 states).15 In May 2016, CMS issued a 

final rule for Medicaid managed care that includes provisions aimed at 

improving Medicaid managed care encounter data submissions.16 For 

example, for contracts with MCOs and limited benefit health plans 

beginning on or after July 1, 2017, states are required to include 

provisions regarding the maintenance of encounter data, and, by July 1, 

 14These numbers reflect the average payment per full year equivalent, which represents 

12 months of enrollment. 

15Among other reasons, we determined that data were unreliable in that states reported 

that fewer than 30 percent of beneficiaries used at least 1 service, a threshold established 

by Mathematica for evaluating the completeness and usability of the data, and states did 

not report services using a standard coding convention. See GAO, Medicaid: Service 

Utilization Patterns for Beneficiaries in Managed Care, GAO-15-481 (Washington, D.C.: 

May 29, 2015).

1681 Fed. Reg. 27498 (May 6, 2016).
Medicaid Program

Page 569 GAO-17-317 High-Risk Series

2018, to have procedures in place to validate that the enrollee encounter 

data these entities submit are complete and accurate.17

Medicaid demonstrations have become a significant proportion of 

Medicaid expenditures, growing steadily from about $50 billion, or about 

14 percent of total Medicaid expenditures in fiscal year 2005, to $165 

billion, or close to one-third of total Medicaid expenditures in fiscal year 

2015.18 Section 1115 of the Social Security Act authorizes the Secretary 

of HHS to waive certain federal Medicaid requirements and allow costs 

that would not otherwise be eligible for federal matching funds for 

experimental, pilot, or demonstration projects that are likely to assist in 

promoting Medicaid objectives. The demonstrations can provide a way for 

states to test and evaluate new approaches for delivering Medicaid 

services. By policy, demonstrations should be budget neutral to the 

federal government; that is, they must not increase federal costs. In July 

2015, CMS changed its organizational structure and increased its staffing 

to oversee section 1115 demonstrations and their growing role in the 

Medicaid program, and we continue to assess CMS’s approval and 

oversight of spending for these demonstrations.

Expenditure authorities in Medicaid demonstrations. Using its 

authority under Section 1115 of the Social Security Act to approve costs 

that would not otherwise be matchable under Medicaid, HHS has 

approved Medicaid spending for a wide range of purposes beyond 

extending coverage to new populations or for new benefits. For example, 

HHS approved demonstrations that allowed 5 states to spend up to $9.5 

billion to fund state health programs that were previously financed at least 

in part by the state or potentially other federal programs. HHS also 

approved 8 states to make more than $26 billion in supplemental 

payments to hospitals and other providers. We found that HHS’s criteria 

and approval documents were not always clear as to how approved 

spending would further Medicaid objectives.19 For example, some of 

 17Under the rule, CMS may defer or disallow federal matching funds on all or part of an 

MCO’s contract if its data do not comply with regulatory requirements. 81 Fed. Reg. at 

27881, 27895 (to be codified at 42 C.F.R. §§ 438.242, 438.818).

18Expenditures are adjusted for inflation to 2015 dollars using the gross domestic product 

price index and exclude administrative costs. 

19GAO, Medicaid Demonstrations: Approval Criteria and Documentation Need to Show 

How Spending Furthers Medicaid Objectives, GAO-15-239 (Washington, D.C.: Apr. 13, 

2015). 

Growing Expenditures for 

and Oversight of Large 

Medicaid Demonstrations
Medicaid Program

Page 570 GAO-17-317 High-Risk Series

these state programs appeared to be only tangentially related to 

improving health outcomes for low-income individuals and lacked 

documentation explaining how approving them would promote Medicaid 

objectives. We also found that demonstration approvals sometimes 

lacked assurances that demonstration spending would not duplicate other 

federal funds received by states.

In response to our work, HHS issued general criteria for determining 

whether demonstrations met Medicaid objectives, which it had not 

delineated before. HHS also committed to identifying in approval 

documents how each expenditure authority promoted Medicaid objectives

and providing assurances that demonstration funds would not duplicate 

other federal funds. While issuing the general criteria is a useful first step, 

we maintain that given the breadth of the Secretary’s authority under 

section 1115—the exercise of which can result in billions of dollars of 

federal expenditures for costs that would not otherwise by allowed under 

Medicaid—more explicit criteria are needed.

Budget neutrality of Medicaid demonstrations. We remain concerned 

about the Secretary of HHS’s lack of an adequate budget neutrality policy 

including the criteria and process for reviewing and approving 

demonstration spending limits and the lack of a written, up-to-date policy 

that is readily available to state Medicaid directors and others. In multiple 

reports, we have found that federal spending on Medicaid demonstrations 

could be reduced by billions of dollars if HHS were required to improve 

the process for reviewing, approving, and making transparent the basis 

for spending limits approved for Medicaid demonstrations. For example, 

in 2014, we reported that HHS had approved a spending limit for 

Arkansas’s demonstration—to test whether providing premium assistance 

to purchase private coverage through the health insurance exchange 

would improve access for newly eligible Medicaid beneficiaries—that was 

based, in part, on hypothetical, not actual, costs. We estimated that by 

allowing the state to use hypothetical costs, HHS approved a 

demonstration spending limit that was over $775 million more than what it 

would have been if it was based on the state’s actual payment rates for 

services under the traditional Medicaid program.

Another troubling precedent is that HHS granted Arkansas and 11 other 

states additional flexibility in their demonstrations to increase the 
Medicaid Program

Page 571 GAO-17-317 High-Risk Series

spending limit if costs proved higher than expected.20 Our report on 

Arkansas was the latest in a series of reports showing significant 

concerns with HHS’s process for reviewing and approving spending 

under demonstrations. For example, in 2013 we reported that, for 4 of 10 

demonstrations we reviewed, HHS approved spending limits that 

exceeded those that were supported in documentation and by HHS’s own 

policy by an estimated $32 billion. We have recommended that HHS (1) 

better ensure that valid methods are used to demonstrate budget 

neutrality, (2) clarify criteria for reviewing and approving demonstration 

spending limits, (3) document and make public the basis for approved 

spending limits, and (4) update its written budget neutrality policy to 

reflect the actual criteria and processes used to develop and approve 

demonstration spending limits.

HHS has generally disagreed that changes to its policy and process are 

needed. Congress has held hearings, sent letters to CMS, and proposed 

legislation regarding how CMS reviews and approves demonstration 

spending limits. Although HHS has not issued a written budget neutrality 

policy as of October 2016, HHS has taken some steps to improve its 

oversight, including issuing a report in October 2015 to Congress on 

actions taken with respect to Medicaid demonstrations. The report 

discussed some steps HHS has taken and planned to take to improve 

access to program information and the transparency of its criteria for 

approving expenditures. Further, in 2016 HHS took steps to change its 

budget neutrality methodology that are intended to result in more 

appropriate demonstration spending limits.21 Nonetheless, we maintain 

that HHS must take the additional actions specified in our 

recommendations to improve the transparency of its demonstration 

approvals.

 20In September 2014, the Chairman of the House Committee on Energy & Commerce and 

the Ranking Member of the Senate Committee on Finance sent a letter to CMS asking 

among other things how the agency planned to ensure that spending for those newly 

eligible under Arkansas’s demonstration would not cost the federal government more than 

it would have cost under traditional Medicaid. 

21For example, according to CMS officials, starting in May 2016, the agency began 

reducing the amount of accumulated savings that states can carry over when 

demonstrations are renewed, which was previously unlimited. 
Medicaid Program

Page 572 GAO-17-317 High-Risk Series

Access to appropriate care has been a concern because of the needs 

and vulnerability of the individuals covered by Medicaid, including 

children, the elderly, and the disabled. National survey data have 

suggested that access reported by Medicaid beneficiaries is comparable 

to that of individuals with private health insurance in many areas, but that 

Medicaid beneficiaries do face particular challenges in accessing certain 

types of care.22 To help assess Medicaid enrollees’ access to care, CMS 

needs better data.

Access to preventive, oral, and mental health services. The higher 

prevalence of some health conditions among Medicaid beneficiaries 

nationally that can be identified and managed by preventive services 

suggests that more can and should be done to ensure Medicaid 

beneficiaries receive these services. For example, states are required to 

provide preventive services for children through the Early and Periodic 

Screening, Diagnostic, and Treatment (EPSDT) benefit. However, 

national data collected by HHS suggest that Medicaid beneficiaries 

receive these services at rates below established goals. In addition, our 

2016 work showed that, due to variation across states in the scope, 

functionality, and availability of resources on provider information, 

Medicaid beneficiaries in FFS arrangements may face challenges in 

identifying available providers in their respective states. State Medicaid 

programs have also struggled to ensure that beneficiaries, particularly 

children, receive appropriate oral health and mental health services when 

needed. High rates of dental diseases remain prevalent across the nation, 

especially in vulnerable and underserved populations. Medicaid 

beneficiaries, children in particular, have increased their use of dental 

services but still visited the dentist less often than privately insured 

children. These visits are essential to preventing future high cost dental 

services. Medicaid children may also have problems accessing mental 

health providers and may not be receiving appropriate mental health 

treatment and services. For example, national survey data indicate 

concerns that some children enrolled in Medicaid may be inappropriately 

prescribed psychotropic drugs and are not receiving needed mental 

health services, such as counseling and therapy.

Better data needed to assess enrollees’ access to care. CMS’s ability 

to assess beneficiaries’ access to services is complicated by insufficient 

 22In calendar years 2008 and 2009, less than four percent of beneficiaries who had 

Medicaid coverage for a full year reported difficulty obtaining medical care, which was 

similar to individuals with full-year private insurance. 

Monitoring and 

Measurement of Access to 

Quality Care
Medicaid Program

Page 573 GAO-17-317 High-Risk Series

data. For example, in reviewing states’ EPSDT reports for our 2011 

report, we found reporting errors large enough to overstate the extent to 

which children received services, and we found that states did not always 

report required data on the number of children referred for additional 

services. Further, the currently reported state data do not indicate 

whether children referred for preventive services actually received the 

services.

CMS has taken steps to better identify reporting errors and obtain 

corrected data, but as of September 2016, CMS has no plans to require 

states to report whether children received the treatment services for 

which they were referred. Our 2015 work on MCOs described above also 

points out the need for better data to understand MCO beneficiaries’

access to covered services, including differences in access that could 

help explain the wide variation in MCO payments per beneficiary we 

identified. Finally, given that PPACA requires states to cover certain 

recommended preventive services for newly eligible adults in states that 

expanded Medicaid under the law, data are needed to determine whether 

this coverage helps improve beneficiaries’ access to and receipt of these 

services.

Medicaid is the nation’s primary payer of long-term care services and 

supports (LTSS) for aged and disabled individuals. Medicaid spending 

(federal and state) on LTSS is significant—in 2016, we reported LTSS 

spending was an estimated $152 billion in fiscal year 2014 (see figure 

20), or about one-quarter of the program’s total expenditures annually. 

The demand for LTSS is expected to increase as the nation’s population 

ages and life expectancy increases, including individuals with disabilities 

and complex health needs who require long-term services and supports.

Growing Expenditures for 

Long-Term Care Services
Medicaid Program

Page 574 GAO-17-317 High-Risk Series

Figure 20: Medicaid Expenditures for Long-Term Services and Supports, Fiscal Years 1994-2014

Monitoring of long-term care services provided in the community. 

Medicaid LTSS spending for services provided to beneficiaries in homeand community-based settings has grown rapidly and now exceeds 

spending for care provided in institutional settings, such as nursing 

homes. Monitoring and oversight of these services is important for 

ensuring quality of care, as the individuals who rely on these services are 

among Medicaid’s most vulnerable, and while home- and communitybased services can enable people to live more independently, the 

services are not without risk.

In the case of personal care services—an important type of long-term 

care service to help individuals who have limited ability to care for 

themselves—beneficiaries receiving these services include aged 

individuals and individuals with physical, developmental, or intellectual 

disabilities. When personal care services are provided in a private home, 

other providers or community members may not be present to help 

discourage or report questionable activities. Further, depending on the 

state and the personal care services program, personal care attendants 
Medicaid Program

Page 575 GAO-17-317 High-Risk Series

who provide personal care services may not be required to have 

specialized training. Personal care services—for which Medicaid paid $15 

billion on a fee-for-service basis in calendar year 2015—are also among 

the highest at risk for improper payments, including for services which 

were billed but never provided to the beneficiary. In 2014, CMS estimated 

over $2 billion of payment errors for Medicaid personal care services.23 In 

2016, we found that while CMS has taken several steps to improve 

oversight of personal care services, it has not collected all required state 

reports on beneficiaries’ health and welfare for some programs, and it 

could do more to harmonize the patchwork of federal program 

requirements intended to oversee beneficiary safety and assure that 

billed services are provided. Such harmonization would help ensure a 

more consistent administration of policies and procedures and could 

enhance oversight.24

Finally, another important change in the delivery of Medicaid-funded 

LTSS is the rapid growth in managed care, which in 2014 accounted for 

almost 15 percent of Medicaid LTSS expenditures. We will continue to 

monitor Medicaid’s use of managed care to deliver LTSS as well as other 

aspects of the program’s growing support for LTSS and examine the 

implications for oversight.

We have a number of Matters for Congressional Consideration and 

recommendations to HHS and CMS for addressing issues related to 

financing, payment oversight, demonstration spending, and accessrelated issues.

We have suggested Congress take the following actions:

• To improve the transparency of and accountability for certain high-risk 

Medicaid payments that total tens of billions of dollars annually, 

Congress should consider requiring CMS to improve reporting of and 

 23The challenges and risks associated with these and other Medicaid improper payments 

are discussed on page 578 of this report.

24The 21st Century Cures Act imposes new requirements for personal care and home 

health services offered under the state plan that require an in-home visit by a provider.

Specifically, personal care services provided on or after January 1, 2019, and home health 

services provided on or after January 1, 2023, must be electronically verified with respect 

to service type, date, and location, among other factors. Pub. L. No. 114-255, § 12006 

(2016).

What Remains to Be 

Done
Medicaid Program

Page 576 GAO-17-317 High-Risk Series

guidance related to certain supplemental payments and to require 

states to submit annual independent audits of such payments.

• To improve the fiscal integrity of Medicaid, Congress should consider 

requiring increased attention to fiscal responsibility in approving 

Section 1115 Medicaid demonstrations by requiring the Secretary of 

HHS to improve the demonstration review process through steps such 

as (1) clarifying criteria for reviewing and approving states’ proposed 

spending limits, (2) better ensuring that valid methods are used to 

demonstrate budget neutrality, and (3) documenting and making 

public material explaining the basis for any approvals.

• To ensure that federal funding efficiently and effectively responds to 

the countercyclical nature of the Medicaid program, Congress should 

consider enacting a federal matching formula that targets variable 

state Medicaid needs and provides automatic, timely, and temporary 

increased federal assistance in response to national economic 

downturns.

In addition, we have made recommendations to HHS and CMS, including:

• To improve CMS’s oversight of Medicaid payments, the Administrator 

of CMS should develop (1) a policy establishing criteria for when such 

payments at the provider level are economical and efficient; and (2) a 

process for identifying and reviewing payments to individual providers, 

once criteria are developed, in order to determine whether they are 

economical and efficient.

• To improve the transparency of the process for reviewing and 

approving spending limits for comprehensive section 1115 

demonstrations, the Secretary of Health and Human Services should 

update the agency’s written budget neutrality policy to reflect actual 

criteria and processes used to develop and approve demonstration 

spending limits, and ensure the policy is readily available to state 

Medicaid directors and others.

• To meet HHS’s fiduciary responsibility of ensuring that section 1115 

waivers are budget neutral, the Secretary should better ensure that 

valid methods are used to demonstrate budget neutrality, by 

developing and implementing consistent criteria for considering 

proposals for section 1115 demonstration waivers.

• To better understand the effect of certain personal care services on 

beneficiaries and more consistently administer policies and 

procedures across personal care services programs, the Secretary of 

HHS should direct the Administrator of CMS to (1) collect and analyze 

required state information on the impact of certain personal care 
Medicaid Program

Page 577 GAO-17-317 High-Risk Series

services programs, and (2) take steps to further harmonize federal 

requirements across programs providing personal care services.

• In light of the need for accurate and complete information on 

children’s access to health services under Medicaid and State 

Children’s Health Insurance Program (CHIP), CMS should work with 

states to identify additional ways to improve reports used to monitor 

children’s access to services, including identifying how to capture 

information related to whether children receive treatment services for 

which they are referred.

For additional information about this high-risk area, contact Katherine 

Iritani at (202) 512-7114 or iritanik@gao.gov, or Carolyn L. Yocom at 

(202) 512-7114 or yocomc@gao.gov.

Medicaid Personal Care Services: CMS Could Do More to Harmonize 

Requirements Across Programs. GAO-17-28. Washington, D.C.: 

November 23, 2016.

Medicaid Fee-For-Service: State Resources Vary for Helping 

Beneficiaries Find Providers. GAO-16-809. Washington, D.C.: August 29, 

2016.

Medicaid: Federal Guidance Needed to Address Concerns About 

Distribution of Supplemental Payments. GAO-16-108. Washington, D.C.: 

February 5, 2016.

Medicaid Managed Care: Trends in Federal Spending and State 

Oversight of Costs and Enrollment. GAO-16-77. Washington, D.C.: 

December 17, 2015.

Medicaid: Improving Transparency and Accountability of Supplemental 

Payments and State Financing Methods. GAO-16-195T. Washington, 

D.C.: November 3, 2015.

Medicaid: Overview of Key Issues Facing the Program. GAO-15-746T. 

Washington, D.C.: July 8, 2015.

Medicaid: Key Issues Facing the Program. GAO-15-677. Washington, 

D.C.: July 30, 2015.

GAO Contact

Related GAO 

Products
Medicaid Program

Page 578 GAO-17-317 High-Risk Series

Medicaid Demonstrations: More Transparency and Accountability for 

Approved Spending Are Needed. GAO-15-715T. Washington, D.C.: June 

24, 2015.

Medicaid: Service Utilization Patterns for Beneficiaries in Managed Care. 

GAO-15-481. Washington, D.C.: May 29, 2015.

Medicaid Demonstrations: Approval Criteria and Documentation Need to 

Show How Spending Furthers Medicaid Objectives. GAO-15-239. 

Washington, D.C.: April 13, 2015.

Medicaid: CMS Oversight of Provider Payments Is Hampered by Limited 

Data and Unclear Policy. GAO-15-322. Washington, D.C.: April 10, 2015.

Medicaid and CHIP: Reports for Monitoring Children’s Health Care 

Services Need Improvements. GAO-11-293R. Washington, D.C.: April 5, 

2011.
Medicaid Improper Payments

Page 579 GAO-17-317 High-Risk Series

The Centers for Medicare & Medicaid Services (CMS) in the Department 

of Health and Human Services (HHS) has taken several actions that 

demonstrate its commitment to reduce improper payments, including 

using rulemaking to strengthen state capacity and oversight of managed 

care organizations (MCO) and the ongoing implementation of a new 

claims data system that could address issues with incomplete, inaccurate, 

and untimely state data. Despite these efforts, however, overall Medicaid 

improper payments continue to increase, rising to about $36.3 billion in 

fiscal year 2016 compared with $29.1 billion in fiscal year 2015.

We designated Medicaid as a high-risk program in 2003 in part due to 

concerns about the adequacy of the fiscal oversight that is necessary to 

prevent inappropriate program spending. This federal and state program 

covered acute health care, long-term care, and other services for an 

estimated 72.2 million low income and medically needy individuals in

fiscal year 2016, making it one of the largest sources of funding for 

medical and health-related services. Under current law, the program is 

expected to continue to grow—covering as many as 13.2 million 

additional individuals by 2025—as states may expand their Medicaid 

programs under the Patient Protection and Affordable Care Act (PPACA). 

As with any estimate, changes to PPACA or other laws could affect the 

projected federal spending on major federal health care programs and 

federal revenues.

By design, Medicaid allows significant flexibility for states to design and 

implement their programs, which has resulted in over 50 distinct statebased programs.1 The federal government matches state expenditures 

for most Medicaid services using a statutory formula.2 The federal 

matching rate varies under the program, with increased federal matching 

funds for individuals newly eligible through the expansion of Medicaid 

under PPACA. The program is a significant expenditure for the federal 

government and the states, with total estimated expenditures of $575.9 

billion in fiscal year 2016, of which $363.4 billion was financed by the 

federal government and $212.5 billion by the states.

 1

Medicaid consists of 56 distinct programs, including 1 for each of the 50 states, the 

District of Columbia, Puerto Rico, the Commonwealth of the Northern Mariana Islands, 

American Samoa, Guam, and the U.S. Virgin Islands.

2

The Federal Medical Assistance Percentage (FMAP) is calculated annually using the 

following formula: FMAP = 1.00- 0.45 (state per capita income (PCI)/U.S. PCI).2 Federal 

law specifies that the FMAP will be no lower than 50 percent and no higher than 83 

percent. See 42 U.S.C. §1396d(b). 

Medicaid Improper Payments

Why Area Is High 

Risk
Medicaid Improper Payments

Page 580 GAO-17-317 High-Risk Series

Within broad federal guidelines, states have some discretion in setting 

Medicaid eligibility standards and provider payment rates, and in 

determining the amount, scope, and duration of covered benefits and how 

these benefits are delivered. For example, states may pay health care 

providers for each service they provide on a fee-for-service (FFS) basis; 

contract with MCOs to provide a specific set of Medicaid-covered services 

to beneficiaries and pay them a set amount per beneficiary per month; or 

rely on a combination of both delivery systems. Roughly three-fourths of 

Medicaid beneficiaries receive some or all of their services from MCOs, 

and payments to MCOs account for over one-third of federal Medicaid 

spending. Increased enrollment and spending for Medicaid-managed care 

makes effective federal and state oversight of this large and complex 

component of the Medicaid program critical.

The size and diversity of the Medicaid program make it particularly 

vulnerable to improper payments—including payments made for people 

not eligible for Medicaid or made for services not actually provided. Over 

recent years, improper payments have increased substantially and 

represent a significant cost to the program, an estimated $36.3 billion in 

federal dollars in fiscal year 2016. While states have the first-line 

responsibility for preventing improper payments, CMS has an important 

role in overseeing and supporting state efforts to reduce and recover 

improper payments. This high-risk assessment focuses solely on CMS’s 

efforts to prevent and reduce improper payments. Medicaid vulnerabilities 

include more than improper payments, and we discuss the broader 

challenges and risks associated with the Medicaid program separately 

(see page 520).
Medicaid Improper Payments

Page 581 GAO-17-317 High-Risk Series

As mentioned above, the continued growth in the overall estimated 

improper payment rate—10.5 percent in 2016 compared with 9.8 percent 

in 2015—underscores the need for additional federal action and has 

resulted in the agency partially meeting the 5 key criteria for removal from 

our High-Risk List: leadership commitment, capacity, action plan, 

monitoring, and demonstrated progress. Until additional actions are 

taken, gaps in oversight remain that will challenge CMS’s ability to reduce 

improper payments.

Congress has taken action to address improper payments and oversight 

challenges in the Medicaid program. For example, HHS identified 

provider screening and enrollment as a main area contributing to 

increased estimates in Medicaid improper payments, and Congress 

recently enacted legislation requiring MCOs only use providers that have 

been screened and enrolled by the appropriate state Medicaid program. 

The legislation also requires states to report information about terminated 

Medicaid providers to CMS and requires CMS to include such 

information, as appropriate, in the agency’s Medicaid provider termination 

notification system.3 Additionally, Congress has held several hearings 

related to Medicaid improper payments, including a May 2016 hearing 

held by the House Energy and Commerce Subcommittee on Oversight 

and Investigations and an October 2015 hearing held by the Senate 

Committee on Finance. Further indicating a continued focus on agency 

action on Medicaid program integrity, the chairmen of two congressional 

committees and subcommittees sent letters to CMS regarding Medicaid 

program integrity, including a letter on eligibility determinations and one 

on how CMS sets its target improper payment rate for the Medicaid 

program.

CMS has taken steps to improve the improper payment rate in recent 

years, including implementing certain recommendations we previously 

made and using rulemaking to strengthen program integrity efforts. 

Several of these efforts are in progress, with staggered compliance dates 

for changes to oversight of MCOs and continued state implementation of 

the Transformed Medicaid Statistical Information System (T-MSIS). For 

example, the requirement in the May 2016 managed care rule for states 

to audit the accuracy, truthfulness, and completeness of the financial data 

 3

21st Century Cures Act, Pub. L. No. 114-255, § 5005 (2016) (to be codified at 42 U.S.C. § 

1396c(kk)(8)).

What GAO Found

What Remains to Be 

Done
Medicaid Improper Payments

Page 582 GAO-17-317 High-Risk Series

submitted by MCOs will not take effect until July 2017. Additionally, TMSIS, which aims to collect more complete and timely state data, 

including claims and utilization data, is not fully implemented across all 

states. Continued oversight and leadership will be necessary in these 

areas.

Further, there are several areas where CMS needs to take action to 

address issues and recommendations that have not been fully 

implemented, including:

• considering which additional databases that states and Medicaid 

managed care plans use to screen providers, which could be helpful 

in improving the effectiveness of these efforts, and determining 

whether any of these databases should be added to the list of 

databases identified by CMS for screening purposes;

• developing a plan to regularly assess the effectiveness of checks for 

duplicate coverage between Medicaid and federally facilitated 

exchanges, including thresholds for the level of duplicate coverage it 

deems acceptable;

• continuing its efforts to work with Social Security Administration to 

share its Death Master File with states and providing additional 

guidance to states to better identify beneficiaries who are deceased; 

and

• conducting systematic assessments of federal determinations of 

Medicaid eligibility in states that delegated this authority to the federal 

marketplace until it is part of the regular review processes that are 

expected to resume in 2018.

Fully addressing these recommendations would help CMS address the 

growing levels of improper payments. Until CMS takes additional actions 

to address these and other gaps in oversight, the Medicaid program 

remains at risk for unacceptable levels of improper payments and 

therefore remains on our High-Risk List.

CMS continues to partially meet the criteria for leadership commitment to 

reducing improper payments; however, questions remain about the 

success of its efforts. Since 2014, the agency has reorganized its 

Additional Details on 

What GAO Found

Leadership Commitment
Medicaid Improper Payments

Page 583 GAO-17-317 High-Risk Series

program integrity activities with the aim of creating more streamlined 

operations; established an agency-wide Program Integrity Board to 

identify and set priorities for addressing vulnerabilities in its programs; 

and taken steps to improve coordination activities with Medicare. CMS 

also published a final rule on Medicaid managed care in May 2016 that is 

intended to improve oversight of MCOs. The rule is responsive to our 

priority recommendations that CMS should hold states accountable for 

Medicaid MCO program integrity by requiring states to audit payments to 

and by MCOs, and updating its guidance on Medicaid managed care 

program integrity practices and effective handling of MCO recoveries. As 

1 example, the rule requires that states, at least once every 3 years, audit 

the data submitted by MCOs with contracts starting on or after July 1, 

2017.4 Prior to issuance of this rule, there had been no requirement for 

states to audit payments to and by MCOs. However, given that CMS only 

recently reorganized its program integrity activities, and issued the new 

rule, and that the rule’s provisions will be implemented in staggered time 

frames that extend to 2018, the effects on program integrity efforts are 

unclear.

Further, additional leadership is needed to address remaining 

weaknesses in federal oversight, including ensuring complete, accurate, 

and timely data to support oversight and program integrity efforts. CMS is 

continuing its national effort to implement the T-MSIS. However, 

implementation has been delayed for several years, and it remains 

unclear when data will be available from all states or how CMS will use 

these data for oversight purposes.

CMS continues to partially meet the criteria for capacity. The agency has 

taken actions to enhance the resources and guidance available to states 

for program integrity purposes. For example, CMS issued a final rule in 

December 2015 that permanently extends the availability of a 90 percent 

federal match for states’ expenditures related to enhancing or replacing 

their Medicaid eligibility and enrollment information technology (IT) 

systems, and aims, in part, to enhance states’ program reporting and 

management tools to support program integrity efforts.5 In addition, the 

 4

81 Fed. Reg. 27498 (May 6, 2016); 42 C.F.R. § 438.602(e) (2016).

5

80 Fed. Reg. 75817 (Dec. 4, 2015). The rule also allows CMS to reduce the federal 

match from 75 percent to 50 percent for states’ costs associated with ongoing 

maintenance and operation for these systems for states that do not meet the system 

standards. 42 C.F.R. § 433.119(c) (2016).

Capacity
Medicaid Improper Payments

Page 584 GAO-17-317 High-Risk Series

May 2016 managed care rule includes provisions to strengthen data 

available on managed care utilization and imposes financial 

consequences on states that do not submit MCO utilization data. For 

example, state contracts with MCOs must provide for the collection and 

maintenance of sufficient data on managed care service utilization, also 

known as encounter data, and states must have procedures to ensure 

that these required enrollee encounter data are complete and accurate.6

However, these provisions do not take effect until July 2017 or 2018, so 

their success in improving data available for program integrity is unknown 

and will depend on how states and CMS implement them.

In response to our 2015 priority recommendation to support state thirdparty liability efforts, CMS produced an updated guide to compile and 

share effective and innovative Medicaid third-party liability practices 

reported by states, an important tool that could help states ensure that 

Medicaid pays only after other liable third parties. In response to our 

priority recommendation to provide guidance to states on their oversight 

of third-party liability efforts conducted by Medicaid managed care plans, 

CMS subsequently published a handbook, which provides guidance to 

states on third party liability efforts, including such efforts conducted by 

Medicaid MCOs. Finally, our recent work has also identified limitations in 

program integrity efforts in Puerto Rico and other U.S. territories that put 

Medicaid funding in these areas at risk for fraud, waste, and abuse, and 

underscore the need for CMS to develop a cost-effective approach to 

protecting Medicaid funding in these territories.

CMS has documented a strategic approach to reducing improper 

Medicaid payments, but only partially meets the criteria due to a missing 

report the agency is legally required to provide to Congress. In July 2014, 

CMS issued the Comprehensive Medicaid Integrity Plan for fiscal years 

2014 through 2018, in which CMS established goals to expand its 

capacity to protect the program’s integrity and manage risk in 

administering federal grants to states. The agency is required to report to 

Congress annually on the use and effectiveness of funds appropriated for 

the Medicaid Integrity Program. The agency reported for fiscal years 2013 

and 2014 in July 2016, well after the required timeframes, and the agency 

 6

42 C.F.R. § 438.242 (2016). Under the rule, CMS may take steps to defer federal 

financial participation (FFP), disallow FFP, or defer and disallow FFP on all or part of an 

MCO’s contract based on the non-compliant data. 42 C.F.R. § 438.818(c) (2016). 

Action Plan
Medicaid Improper Payments

Page 585 GAO-17-317 High-Risk Series

is out of compliance with the requirement for fiscal year 2015 because it 

has not submitted a report for fiscal year 2015, as of December 2016.

With regard to specific actions, CMS has taken steps to identify duplicate 

coverage for individuals transitioning from Medicaid to federally facilitated 

exchanges created under PPACA, and had performed three checks as of 

October 2016. In response to our priority recommendation that CMS 

establish a schedule for regular checks for duplicate coverage, CMS 

reported that it intends to check for duplicate coverage at least two times 

per coverage year going forward. CMS also reported that it was reviewing 

these data to assess whether the checks were effective. However, the 

agency has not developed a plan, including thresholds for the level of 

duplicate coverage it deems acceptable, to routinely monitor the 

effectiveness of these checks.

CMS continues to partially meet the criteria for monitoring. CMS has 

enhanced its oversight of states’ program integrity activities, particularly 

by increasing its focus on collaborative audits and working with states to 

improve compliance with PPACA’s provider screening requirements. In 

focusing on collaborative audits, CMS has engaged more states than 

before, targeted federal audit resources to state needs, and identified an 

increasing amount of overpayments. In addition, CMS now provides 

states with federal data to strengthen Medicaid provider enrollment 

screening and has provided guidance and technical assistance to assist 

states on their revalidation efforts. CMS also recently provided additional 

guidance to states on specific provider screening and reporting provisions 

included in the 21st Century Cures Act. Our prior work has shown that 

available federal data do not include all of the information necessary for 

states to effectively and efficiently process Medicaid provider applications. 

Due to this issue and other challenges, we found that states and 

managed care plans rely on fragmented information from multiple and 

disparate databases to screen managed care providers, and often 

struggle to access and use these databases because of difficulties 

conducting provider matches across databases.

CMS also needs to take additional steps to better monitor states’

beneficiary eligibility determinations. Specifically, we found that CMS is 

not always able to assess the accuracy of federal Medicaid eligibility 

determinations, which is particularly problematic where states delegate 

this determination authority to the federal government through federally 

facilitated exchanges. While CMS is relying upon operational controls 

within the federal marketplaces to ensure accurate eligibility 

Monitoring
Medicaid Improper Payments

Page 586 GAO-17-317 High-Risk Series

determinations, without a systematic review of these determinations, the 

agency lacks a mechanism to ensure that only eligible individuals are 

enrolled in the program and to identify associated improper payments 

until CMS’s updated eligibility review program resumes in 2018.

CMS continues to partially meet the criteria for demonstrated progress. 

The agency has taken actions to improve federal and state oversight of 

Medicaid MCOs, to extend funding to help states modernize their 

eligibility systems, and to help states come into compliance with recent 

legislation by providing updated guidance. Nonetheless, additional 

actions are warranted to identify and reduce improper payments, given 

the rise in the Medicaid improper payment rate and expected growth of 

the Medicaid program.

Several factors will complicate CMS efforts to identify improper payments. 

Specifically, CMS’s improper payment rate estimates may be inaccurate 

because the agency has frozen a component used to calculate improper 

payments based on beneficiary eligibility through fiscal year 2018.7

Additionally, CMS estimates of improper payments to MCOs do not 

consider underlying medical data such as the use of medically 

unnecessary services and other contributing factors. Finally, CMS will not 

fully implement certain provisions to strengthen program integrity in 

Medicaid managed care—such as requiring MCOs to only use providers 

that have been screened and enrolled by the appropriate state Medicaid 

program—until January 2018. Thus, it is critical that CMS take other 

actions to ensure that only providers in good standing participate in the 

program during this interim period.

 7

HHS is updating the eligibility component measurement methodology to reflect changes 

in the way states adjudicate eligibility for Medicaid and the State Children’s Health 

Insurance Program under PPACA. For fiscal years 2015 through 2018, HHS will not 

conduct the eligibility measurement component of Payment Error Rate Measurement 

program, but will hold the eligibility component’s error rate constant at the fiscal year 2014 

reported rate of 3.11 percent. See HHS, FY 2016 Agency Financial Report, (Washington, 

D.C.: November 2016). 

Demonstrated Progress
Medicaid Improper Payments

Page 587 GAO-17-317 High-Risk Series

• CMS is conducting collaborative audits with states, which allows the 

states to augment their own program integrity audit capacity by 

leveraging the resources of CMS and its audit contractors. These 

efforts have increased the amount of identified Medicaid 

overpayments.8

• CMS provided training to states through the Medicaid Integrity 

Institute on correct reporting of program integrity recoveries. Efforts to 

ensure correct reporting of recoveries will make it easier for CMS to 

determine whether states are returning the federal share of recovered 

overpayments.

• CMS posted guidance on its website regarding the requirements that 

must be met in order for Medicaid administrative expenditures to be 

eligible for federal matching funds. A CMS official said that the agency 

ensures that the policies are applied consistently across all states 

through internal training. These efforts should improve CMS’s 

financial management of Medicaid administrative claiming activities.

• CMS reconfigured the National Medicaid Audit Program to eliminate 

the review contractor function altogether in response to concerns that 

the federal review was duplicative of actions undertaken by audit 

contractors within a state or geographic area. By eliminating 

duplication in the review function, CMS will realize greater efficiencies 

in its audits and reduce state burden.

For additional information about this high-risk area, contact Carolyn 

Yocom at (202) 512-7114 or yocomc@gao.gov

Medicaid: Program Oversight Hampered by Data Challenges, 

Underscoring Need for Continued Improvements. GAO-17-173. 

Washington, D.C.: January 6, 2017.

Medicaid Program Integrity: Improved Guidance Needed to Better 

Support Efforts to Screen Managed Care Providers. GAO-16-402. 

Washington, D.C.: April 22, 2016.

 8

As the entities responsible for collecting overpayments, states reported combined audit 

recoveries of $4.7 million from this program and returned the federal share of $2.9 million 

to the Treasury in fiscal year 2013. In fiscal year 2014, states reported combined audit 

recoveries of $11.5 million from this program and returned the federal share of $7.8 million 

to the Treasury.

Benefits Achieved by 

Implementing Our 

Recommendations

GAO Contact

Related GAO 

Products
Medicaid Improper Payments

Page 588 GAO-17-317 High-Risk Series

Medicaid and CHIP: Increased Funding in U.S. Territories Merits 

Improved Program Integrity Efforts. GAO-16-324. Washington, D.C.: April 

8, 2016.

Nonemergency Medical Transportation: Updated Medicaid Guidance 

Could Help States. GAO-16-238. Washington, D.C.: February 2, 2016.

Medicaid: Additional Federal Controls Needed to Improve Accuracy of 

Eligibility Determinations and for Coordination with Exchanges. 

GAO-16-157T. Washington, D.C.: October 23, 2015.

Medicaid: Additional Efforts Needed to Ensure That State Spending Is 

Appropriately Matched with Federal Funds. GAO-16-53. Washington, 

D.C: October 16, 2015.

Medicaid and Insurance Exchanges: Additional Federal Controls Needed 

to Minimize Potential for Gaps and Duplication in Coverage. GAO-16-73. 

Washington, D.C.: October 9, 2015.

Medicaid: Key Issues Facing the Program. GAO-15-677. Washington, 

D.C.: July 30, 2015.

Medicaid: Additional Actions Needed to Help Improve Provider and 

Beneficiary Fraud Controls. GAO-15-313. Washington, D.C: May 14, 

2015.

Medicaid: Additional Federal Action Needed to Further Improve ThirdParty Liability Efforts. GAO-15-208. Washington, D.C.: January 28, 2015.
Improving and Modernizing Federal Disability 

Programs

Page 589 GAO-17-317 High-Risk Series

An estimated one in six working-age Americans reported that they had a 

disability in 2010; many of them may require assistance finding or 

retaining employment, or rely on cash benefits if they cannot work.1

Nevertheless, disability programs across the federal government face 

significant challenges in addressing the needs of Americans with 

disabilities. In particular, 3 of the largest federal disability programs—2 

managed by the Social Security Administration (SSA) and 1 by the 

Department of Veterans Affairs (VA), which together dispensed about 

$256 billion in cash benefits to over 20 million people in fiscal year 

2015—are grappling with large workloads and have struggled to make 

timely decisions on who is eligible for cash benefits.2 These issues are 

most evident when individuals appeal their decisions, as the number of 

pending appeals increased 30 and 34 percent respectively at SSA and 

VA when comparing fiscal years 2012 and 2015. Workloads for these 

agencies are likely to remain a challenge as the population ages and 

large numbers of servicemembers are expected to transition out of the 

military in the next several years. In addition, SSA and VA rely on 

outdated criteria to determine whether individuals qualify for benefits. 

While these agencies reported efforts underway to update their rules, 

they continue to emphasize individuals’ medical conditions without 

sufficiently considering whether they could work because of 

improvements in workplace accommodations and assistive technologies. 

In addition to these 3 cash assistance programs, we found that there are 

45 programs managed by 9 different federal agencies that provide a 

patchwork of employment supports to people with disabilities. Although 

 1

We define this measure of disability to include non-institutionalized individuals aged 21 to 

64, and is based on annual U.S. Census Bureau Survey of Income and Program 

Participation (SIPP) data from 2010. We selected SIPP data over other available data 

sources because the SIPP included additional questions regarding the effect of health 

conditions on, for example, the respondents’ ability to work. The percent of noninstitutionalized individuals of any age—or age 15 and older—with a disability is even 

higher. See Brault, Matthew W. “Americans With Disabilities: 2010,” Household Economic 

Studies (Washington, D.C.: U.S. Census Bureau, July 2012) accessed on January 7, 

2017, https://www.census.gov/content/dam/Census/library/publications/2012/demo/p70-

131.pdf.

2

Comparing fiscal years 2011 and 2015, the amount of cash benefits paid by SSA’s 

Disability Insurance and Supplemental Security Income programs has grown from $178 

billion to $196 billion; and by VA from $39 billion to $60 billion. Benefits paid under these 

programs are expected to continue growing for the foreseeable future. In particular, SSA’s 

Disability Insurance Trust Fund is projected to deplete its assets in 2023 according to the 

Board of Trustees of the Federal Old-Age and Survivors Insurance and Federal Disability 

Insurance Trust Funds. This is due in part to a growing population of beneficiaries. After 

2023, revenues in the Disability Insurance Trust Fund are projected to only be sufficient to 

pay 89 percent of Disability Insurance scheduled benefits. 

Improving and Modernizing Federal 

Disability Programs

Why Area Is High 

Risk
Improving and Modernizing Federal Disability 

Programs

Page 590 GAO-17-317 High-Risk Series

programs that support employment can divert individuals from the 

disability rolls, these programs lack a unified vision, strategy, or set of

goals to guide their outcomes. We first designated improving and 

modernizing federal disability programs as high risk in 2003.

The federal government’s progress in improving and modernizing 

disability programs remains mixed. We assessed progress across five 

broad areas: two reflecting SSA’s and VA’s actions to manage their 

disability claims workloads; two reflecting SSA’s and VA’s progress to 

modernize their criteria for deciding who is eligible for disability benefits; 

and, lastly, the Office of Management and Budget’s (OMB) efforts to 

create unified strategies and goals for programs that support employment 

for people with disabilities. Some of the agencies we assessed met 

certain criteria while others did not, and when combined, the resulting 

summary rating shows that the five criteria were partially met. SSA and 

VA have continued to make progress managing their claims workloads, 

but both agencies currently face challenges managing their appeals 

backlogs. SSA and VA also have made progress updating the criteria 

they use to determine eligibility for disability benefits, especially with 

respect to developing action plans. In terms of plans to mitigate the 

potential effects of program fragmentation, OMB—which performs a 

management role for the executive branch—has made some progress 

developing plans to test interventions that may improve employment 

outcomes in the private as well as public sector, but has not yet 

developed a unified vision, or government-wide goals and related 

strategies for improving employment outcomes outside of the federal 

sector.

With respect to SSA updating the criteria it uses to determine eligibility for 

benefits, more needs to be done to address this high-risk issue, but in 

response to our 2012 recommendation, SSA took action that resulted in 

cost savings. Specifically, SSA replaced its earlier, highly ambitious plans 

to develop its own occupational information system (OIS) (to house 

occupational data used to make disability determinations) with a 

potentially more cost-effective approach that uses existing expertise and 

resources in the federal government. In doing so, SSA partnered with the 

Bureau of Labor Statistics (BLS) to collect and update occupational 

information by surveying employers. As a result of SSA implementing our 

recommendation, we determined that, as of 2015, SSA saved 

approximately $27 million dollars.

What GAO Found
Improving and Modernizing Federal Disability 

Programs

Page 591 GAO-17-317 High-Risk Series

• Managing SSA Disability Claims Workloads: SSA should 

implement our past recommendation to prepare for wide-ranging 

management challenges by continuing to move forward with 

operationalizing its Vision 2025—a long-term strategic plan—to 

ensure that the agency is well positioned to serve its customers in the 

future. In addition to carefully planning and implementing systems 

support for initial claims, SSA should continue to implement and 

monitor the success of its plans for addressing the growing appeals 

workload and improving appeals decision timeliness.

• Managing VA Disability Claims Workloads: Predicting growth in 

both disability compensation claims and appeals, VA should maintain 

focus on (1) managing its workloads at both levels; (2) ensuring that it 

has detailed plans in place for creating capacity and reforming its 

appeals process; and (3) collecting and reporting appropriate data 

and metrics to fully understand factors influencing timeliness under 

both its legacy and proposed appeals process, and transparently 

reporting progress.

• Updating SSA Disability Benefit Eligibility Criteria: As part of its 

effort, SSA tasked the Health and Medicine Division (HMD) of the 

National Academies of Sciences, Engineering, and Medicine, under 

an existing contract, to further study the issue of how assistive 

technologies and workplace accommodations can affect disability 

determination decisions Once the study is complete in July 2017, SSA 

should determine if and how it can incorporate the findings into its 

disability decision-making process, consistent with our past 

recommendation. We will consider removing the area of updating 

SSA’s disability benefit criteria from the High-Risk List once the study 

is complete and SSA determines a course of action. In the meantime, 

we will continue to monitor SSA’s progress finalizing medical criteria 

and developing its OIS.

• Updating VA Disability Benefit Eligibility Criteria: VA made steady 

progress updating its disability criteria. However, given that only a 

third of the initial round of updates are complete and the remainder 

were delayed, VA should maintain leadership focus and continue 

monitoring its progress against its project plans to ensure that 

sufficient resources are dedicated to this effort and that its plans to 

subsequently revisit its criteria at least once every 10 years thereafter 

continue to be realistic.

• Ensuring Programs Have Unified Strategies and Goals: Efforts by 

the previous administration and OMB to improve coordination across 

federal programs were positive, but also limited in scope or lack 

funding. For example, the administration proposed an interagency 

What Remains to Be 

Done
Improving and Modernizing Federal Disability 

Programs

Page 592 GAO-17-317 High-Risk Series

council to run early intervention demonstration programs, which has 

the potential to uncover approaches worth pursuing at a national level. 

However, to date, the proposed council to achieve that vision has not 

been funded. Further, while common measures recently implemented 

will help assess the relative success of specific programs across 

agencies, the prior administration did not develop goals or strategies 

for measuring and tracking the cumulative effect of disparate 

programs on employment outcomes beyond the federal sector—which 

could also help inform and target the types of interventions to be 

piloted by the new administration.

Since our 2015 update, SSA has demonstrated mixed progress in 

addressing its workload challenges, such that partially met ratings did not 

change from 2015. Specifically, SSA made progress reducing its backlog 

of initial disability claims, while its appeals workload continued to grow.

Since our 2015 high-risk report, SSA has continued to meet our 

leadership criterion. As described below, SSA officials told us that they 

continued to develop plans to implement its Vision 2025—a long-term 

strategic plan that articulates how SSA will serve its customers in the 

future. SSA also designated reducing wait times for hearings decisions as 

a priority goal for fiscal years 2016 and 2017.

Additional Details on 

What GAO Found

Managing Disability 

Claims Workload (SSA)

Leadership Commitment
Improving and Modernizing Federal Disability 

Programs

Page 593 GAO-17-317 High-Risk Series

SSA continued to partially meet our criterion for building capacity. With 

respect to ensuring sufficient capacity at the initial claims level, while SSA 

has reduced the number of pending initial claims each year since 2010, 

efforts to further reduce costs and process claims more efficiently using 

technology were stalled. Specifically, SSA halted development of its 

Disability Case Processing System (DCPS), after a consulting firm 

contracted by SSA reported the agency spent about $288 million with few 

results. Subsequently, SSA selected a new development path for the 

DCPS, and officials still expect that DCPS will improve workflows and 

reduce administrative costs; however, SSA’s Office of Inspector General 

found that SSA did not evaluate all alternatives or consider all costs 

required to maintain a new system before pursuing a DCPS alternative. 

SSA officials reported in October 2016 that the agency was developing an 

initial product to deliver to three test sites focused on processing certain 

fast-track claims.3 To address its priority goal of reducing the time for 

hearing decisions, officials reported that SSA increased the number of 

administrative law judges (ALJ) who decide appeals cases by 349 in 

fiscal years 2015 and 2016—about a 24 percent increase. In its plan to 

address its appeals backlog, SSA noted that it is exploring ways to 

improve ALJ hiring in difficult-to-staff locales, leverage SSA’s Office of 

Quality Review to obtain assistance with critical case processing 

activities, and use judges from the Appeals Council to hold hearings on 

some cases. However, SSA officials noted in October 2016 that plans to 

increase hiring and leverage other resources are on hold due to a hiring 

freeze expected to extend into fiscal year 2017.

SSA still partially met our criterion for action plans. Notably, the agency 

published a plan in January 2016 to address its appeals backlog that calls 

for:

• hiring an additional 250 ALJs each year through fiscal year 2018, 

which the agency projected is needed to reduce average appeals wait 

times for hearing decisions to its goal of 270 days by the end of fiscal 

year 2020;

• improving business processes, including increasing the number of 

prehearing conferences to better prepare unrepresented claimants for 

 3

Specifically, claims under the Quick Disability Determination and Compassionate 

Allowances processes. These processes are intended to quickly render decisions for 

claimants whose medical conditions are serious enough to clearly meet SSA’s disability 

criteria.

Capacity

Action Plan
Improving and Modernizing Federal Disability 

Programs

Page 594 GAO-17-317 High-Risk Series

their hearings, and sharing resources across the agency to help 

process appeals at backlogged hearing offices; and

• improving the use of information technology (IT), such as expanding 

the use of video hearings, providing online records access to medical 

and vocational experts, and reducing the use of physical paperwork at 

hearings-level cases.

While this plan is a positive step, the extent to which proposed actions will 

reduce the hearings backlog remains to be seen. In September 2016, 

SSA’s OIG reported that more than half of the initiatives in the agency’s 

plan duplicated past backlog initiatives, including a 2007 plan that did not 

result in long-term reductions of the backlog. Additionally, SSA notes in its 

plan that some efforts, such as increased hiring, will depend on the 

agency receiving additional funding. Regarding SSA’s broader Vision 

2025 effort, officials told us that SSA is still in the process of developing 

plans to implement it. Among other things, Vision 2025 touches on the 

agency’s capacity to process initial claims and appeals. SSA officials told 

us that SSA is integrating aspects of Vision 2025 into its fiscal year 2018-

2022 strategic plan—scheduled to be issued in January 2018—and 

conducting working sessions with a cross-section of SSA employees to 

gather input about how to realize Vision 2025 priorities.

SSA continued to meet our criterion for monitoring by continuing to 

monitor and report on the timeliness of its initial claims and appeals 

workloads.

SSA partially met our criterion, demonstrating mixed progress. In 

addressing its initial claims backlogs, SSA continued to reduce the 

number of pending claims in each fiscal year since 2010—from about 

842,000 in fiscal year 2010 to 621,000 in fiscal year 2015. However, the 

timeliness of its appeals workload worsened. The number of hearings 

pending as of the end of 2016 was over 1.1 million and the average time 

needed to complete appeals increased from 353 days in fiscal year 2012 

to 545 days in fiscal year 2016. SSA’s goal is to eventually reduce this 

time to 270 days, as articulated in its appeals reform plan.

Monitoring

Demonstrated Progress
Improving and Modernizing Federal Disability 

Programs

Page 595 GAO-17-317 High-Risk Series

Since our 2015 high-risk update, VA has demonstrated mixed progress in 

addressing its workload challenges. Progress is evident in regards to 

VA’s efforts to reduce the Veterans Benefit Administration’s (VBA) 

compensation claims backlog. However, VA’s appeals workload 

continued to grow, and several efforts to address this challenge are still 

underway. In particular, VA’s proposed framework to reform the appeals 

process—developed by VBA and the Board of Veterans’ Appeals 

(Board)—requires legislative authority to pursue. We have ongoing work 

related to VA’s efforts to address appeals workloads and timeliness that 

we plan to issue in the first quarter of 2017.

VA continued to meet our criterion for leadership commitment. Since 

2015, VA tracked progress toward eliminating the disability compensation 

claims backlog, an agency priority goal set for fiscal years 2014 and 

2015. It also renewed its commitment to reducing appeals inventories and 

improving timeliness of appeals decisions by updating its appeals 

strategic plan in 2016, making development of a simplified appeals 

process 1 of VA’s 12 breakthrough priorities for 2016, and working closely 

with veterans service organizations (VSO) and other stakeholders to 

propose a new framework and associated legislation to reform the current 

appeals process.

VA partially met this criterion. Since 2015, officials told us that VA has 

taken steps to build capacity to process compensation claims, such as:

• implementing, in 2015, a centralized mail program that will consolidate 

paper mail from the regional offices to a centralized intake site, where 

all documents received are scanned into an electronic format;

• adding capabilities to its online benefits management system, such as 

integration with Department of Defense systems, electronic access for 

veterans, and an automated mechanism that flags a claim when new 

Managing Disability 

Claims Workload (VA)

Leadership Commitment

Capacity
Improving and Modernizing Federal Disability 

Programs

Page 596 GAO-17-317 High-Risk Series

evidence is received. VA states that these automation capabilities will 

increase the efficiency of compensation claims processing; and

• implementing a national work queue distribution tool at all regional 

offices that should allow VA to electronically distribute claims across 

regional offices to even out workloads.

According to VA, these efforts have resulted, to date, in reducing the 

compensation claims backlog by 88 percent from a peak of 611,073 

claims in March 2013 to a low of 71,690 as of September 30, 2016. 

Further, VA reported that it increased compensation claim productivity per 

full-time equivalent (FTE) by 25 percent since 2011. However, it remains 

to be seen if VA can maintain these gains as workloads are projected to 

increase in the future.

At the appellate level, VA proposed a streamlined appeals framework 

through which it hopes to gain efficiencies; however this new 

framework—which is still in the planning stages—requires legislative 

authority to implement. VA is developing and implementing technology 

improvements that could result in enhanced productivity, such as a new 

appeals processing system that would better support a paperless 

process. VA also added 300 FTEs at VBA to help process appeals in 

fiscal years 2015 and 2016, and according to agency officials, VA 

received a 42 percent increase in funding for the Board in fiscal year 2017 

that will support the hiring of additional FTEs. VA plans further 

improvements related to capacity, such as increasing human resources 

and training support, and is developing a recruitment plan with the Office 

of Personnel Management (OPM) to hire additional staff, primarily in the 

attorney role. However, these staffing increases and technology 

improvements were underway as of January 2017, and it is too early to 

determine the extent to which the sum of these efforts will improve VA’s 

capacity to process appeals.

VA partially met our criterion for action plans. As previously mentioned, 

officials noted that VA has taken steps since 2015 to increase its capacity 

to reduce VBA’s compensation claims backlog. VA also has developed 

plans to reduce appeals inventories and improve the timeliness of 

appellate decisions. In 2016, VA published a strategic plan for addressing 

the appeals process, which lays out the need to hire additional staff and 

improve IT supports in order to improve productivity. VA also worked with 

stakeholders, such as VSOs and congressional committees, to develop a 

reform proposal to streamline the appeals process. The proposed 

streamlined appeals process will provide new options for timely review of 

prior VA decisions, which VA expects to result in efficiencies while 

Action Plan
Improving and Modernizing Federal Disability 

Programs

Page 597 GAO-17-317 High-Risk Series

providing veterans with a more simple, timely, transparent, and fair 

appeals process. While potentially promising, as of October 2016, VA 

was still developing implementation plans and did not have legislative 

authority to pursue its proposed reforms. Regarding staffing, VA officials 

reported in March 2016 that they were working with OPM on a strategic 

recruitment plan, but had not finalized this plan.

VA partially met our criterion for monitoring. VA continued to have clear 

goals for processing compensation claims and a system for monitoring 

them on a regular basis; however, gaps exist in VA’s ability to measure 

performance and proposed process changes related to appeals. In fiscal 

year 2015, VA developed new measures to publicly report appeals 

processing performance in its Annual Performance Reports, which VA 

officials said focus on the discrete steps in the appeals process and help 

show where bottlenecks exist. However, VA no longer publicly reports the 

total average amount of time needed across VBA and the Board to 

resolve an appeal. As we noted in our 2015 update, not reporting broad 

measures—such as the average time needed to resolve appeals across 

VA—reduces the transparency of VA’s progress. Additionally, VA 

currently lacks data that could help it more fully understand factors 

currently affecting appeals decision timeliness, such as data on the 

number of actions taken on cases or the number of times claims were rereviewed because new evidence was submitted. To help address this, VA 

officials told us that they are developing a data dashboard as a part of IT 

improvements, but it is too early to tell how the agency will use the 

dashboard to evaluate proposed improvements to the appeals process.

VA partially met our criterion for demonstrating progress. VA continued to 

make progress with reducing its compensation claims backlog. 

Specifically, VA decreased the total inventory of compensation claims by 

57 percent from a peak of 883,930 in fiscal year 2012 to 377,107 in fiscal 

year 2016. Additionally, VA has improved its claim processing timeliness 

by reducing the average length of time a claim is pending from an 

average of 282 days in fiscal year 2013 to 85 days in fiscal year 2016.

At the appellate level, VA officials told us that they resolved more than 

138,608 appeals in fiscal year 2016, an increase of 25 percent compared 

to fiscal year 2013. However, the volume of appealed claims and number 

of days required to decide appealed claims increased recently. According 

to VA officials, the total appeals inventory grew approximately 33 percent 

from about 350,000 in fiscal year 2013 to about 464,000 in fiscal year 

2016. Further, the average processing time for all appeals—that is, those 

resolved either by VBA or the Board—grew from 903 days in fiscal year 

Monitoring

Demonstrated Progress
Improving and Modernizing Federal Disability 

Programs

Page 598 GAO-17-317 High-Risk Series

2012 to 936 days in fiscal year 2015. Appeals that were decided by the 

Board in fiscal year 2015 required an average of 1,789 days for a 

decision, compared to an average of 1,691 days in fiscal year 2012.

Since 2015, SSA has continued to make progress on several fronts to 

update the criteria that it uses to determine eligibility for disability benefits. 

SSA’s progress is evident across the five high-risk criteria, especially with 

respect to capacity and action plans, which improved from partially met to 

met. However, SSA has not yet finished reviewing all medical listings, and 

is still developing and testing its approach for updating occupational 

information that is also used to determine eligibility. It is also unclear how 

SSA will consider incorporating the results of a study on accommodations 

in the workplace into its decision-making process.

SSA continued to meet our criterion for leadership commitment, by 

maintaining focus and ensuring progress toward updating the medical 

criteria and occupational information used to determine eligibility for 

disability benefits, as well as by agreeing to study the role of assistive 

technologies and workplace accommodations in mitigating impairments, 

and how this might be considered in its disability decision making.

SSA has met the criterion for capacity, improving from partially met in 

2015. Consistent with our recommendation in past work, SSA continued 

to work with BLS to develop an OIS to replace its outdated Dictionary of 

Occupational Titles, which SSA relies on in making disability 

determination decisions. In 2016, SSA and BLS completed the first of 3 

years of production data, as well as a study, which SSA officials said 

found that the occupational data it is collecting will remain current for 5 to 

10 years. Based on actual costs from 1 year of production data, and 

assuming a 5-year update cycle, SSA estimated that the life-cycle cost of 

Updating Disability Benefit 

Eligibility Criteria (SSA)

Leadership Commitment

Capacity
Improving and Modernizing Federal Disability 

Programs

Page 599 GAO-17-317 High-Risk Series

the first update of occupational data (due to be completed in 2024) will be 

$178 million. We found SSA’s cost estimate to contain sufficient analysis 

and information to support its scaled-back and more feasible approach for 

developing an OIS. Thus, SSA met the intention of our prior 

recommendation that it develop life-cycle cost estimates for the project in 

accordance with best practices, which may help SSA make program 

decisions and ensure sufficient resources are allocated to the effort. With 

respect to our prior recommendation to consider the roles of assistive 

technologies and workplace accommodations in disability decision 

making, SSA built capacity by tasking the Health and Medicine Division 

(HMD) of the National Academies of Sciences, Engineering, and 

Medicine under a contract to study this issue. Its final report is due in July 

2017.

SSA has also met our criterion for developing action plans, improving 

from partially met in 2015. As we noted earlier, SSA has plans in place for 

updating its medical criteria, and it continued to make progress towards 

its goals. With respect to updating its OIS, SSA has developed a project 

plan for developing the OIS, and recently provided a life-cycle cost 

estimate as noted earlier. Lastly, SSA tasked HMD under a contract to 

further study the issue of how assistive technologies and workplace 

accommodations can affect disability determination decisions, with a 

proposed completion date of July 2017.

SSA continued to meet the criterion of monitoring progress toward 

updating its medical criteria, and has project plans and schedules against 

which to monitor its progress toward developing a new OIS to replace its 

outdated Dictionary of Occupational Titles.

SSA partially met our criterion for demonstrating progress. With respect to 

updating its medical listings, SSA officials reported that, as of October 

2016, the agency had published final rules for 13 of the 14 body systems 

for adults, and drafted a proposed rule for the remaining system. SSA 

expects to publish that final rule in 2017 once OMB under the new 

administration has reviewed it. Officials stated they are on track to revisit 

the 14 body systems every 3 to 5 years once the first round of 

comprehensive updates is complete. SSA officials also reported steady 

progress updating its occupational information.

• In 2016, SSA and BLS completed the first year of its 3-year cycle of 

collecting survey data for the OIS, which followed its completion of a 

large-scale, preproduction test involving collecting occupational 

information from about 2,500 employers.

Action Plan

Monitoring

Demonstrated Progress
Improving and Modernizing Federal Disability 

Programs

Page 600 GAO-17-317 High-Risk Series

• In May 2016, SSA officials also reported that they are working with a 

contractor to develop a Web-based system to house its occupational 

data, which they expect to complete in fiscal year 2017.

With respect to assistive technologies and workplace accommodations, 

officials reported progress under SSA’s contract with HMD to study 

workplace accommodations and assistive technologies. Officials reported 

that HMD held public forums in July and September 2016 and invited 

experts to present information on various aspects of workplace 

accommodations and assistive technologies, which HMD plans to 

incorporate into its report findings. SSA expects HMD to conclude its 

study by July 2017, but it remains to be seen whether and how SSA will 

consider the results of the study in its decision-making process.

VA continued to make progress toward updating the medical criteria that 

it uses to determine eligibility for disability compensation, and has now 

improved to met for action plan and monitoring. However, VA has 

experienced delays, and officials told us that VA will not meet its prior 

target for completing this effort by March 2017.

VA met our criterion for leadership commitment. As noted in sections 

below, VA leadership continued to dedicate attention and resources to 

completing an initial revision of its medical criteria and developing plans 

to keep them updated.

Updating Disability Benefit 

& Eligibility Criteria (VA)

Leadership Commitment

Capacity
Improving and Modernizing Federal Disability 

Programs

Page 601 GAO-17-317 High-Risk Series

VA partially met our criterion for capacity. Since 2015, VA has taken steps 

to ensure it has the capacity to revise and maintain its medical criteria, 

and officials told us that VA has drafted or is in the process of drafting 

revised regulations for 14 of the 15 body systems. However, VA will not 

meet its target date for completing a final review and revision of all body 

systems by March 2017. Specifically, officials told us that VA:

• finished impact analyses—studies of how revisions will affect 

veterans’ disability ratings—for 10 of 15 body systems and extended 

timelines for completing analyses for the remaining body systems to 

the end of calendar year 2017;

• promulgated proposed regulations for 5 of 15 body systems with plans 

to finalize 4 of those 5 by its original target date of March 2017, and 

extended its target dates for finalizing new rules for all body systems 

until the end of fiscal year 2018; and

• plans to assemble cross-functional teams to identify what changes VA 

will need to make to its policies, procedures, communications, 

training, and computer systems to implement the regulations, which 

VA officials said is in accordance with the agency’s standard process 

for implementing new and revised regulations.

In addition, officials told us that VA lacks the necessary internal resources 

or expertise to conduct earnings loss studies, which take into account 

how advances in medical treatments and assistive technologies might be 

used to reduce functional loss due to disability. As such, VA requested 

funding for a new earnings loss study to begin in 2017. If funding is not 

provided, VA officials noted that they will use any available information to 

meet VA’s goal of reviewing and revising its medical criteria on a 

staggered 5-year cycle. We will continue to monitor VA’s efforts toward 

making fact-based and timely revisions to the VA ratings schedule, and 

ultimately implement these revisions in its decision making process.

VA has now met our criterion for action plans, up from partially met in 

2015. VA made noteworthy progress in accordance to its original project 

plan, as noted above, and updated timeframes in its plan in response to 

delays. VA officials currently expect to promulgate final rules for all body 

systems by the end of fiscal year 2018. Moreover, officials also told us 

that VA is on track to achieve its plans to keep criteria current once initial 

updates are complete by placing each of the 15 body systems into a 5-

year cycle of staggered reviews, and intends to document work plans and 

maintain working groups for each system to ensure that medical 

advancements and new research are incorporated as necessary.

Action Plan
Improving and Modernizing Federal Disability 

Programs

Page 602 GAO-17-317 High-Risk Series

VA met our criterion for monitoring, up from partially met in 2015. Since 

August 2013, VA has tracked its progress against its project plan for 

finishing its first round of updates of medical criteria, completing earning 

loss studies, and ensuring all body systems are updated once every 10 

years. In doing so, it has also updated its project plan to include new 

timeframes for completing its first round of updates in response to delays 

described below.

VA partially met our criterion for demonstrated progress. Since 2015, VA 

has continued to make progress updating its medical criteria, but, as 

previously mentioned, VA will not meet its target to review and revise 

regulations for all body systems by March 2017. Specifically, it is not on 

target to promulgate regulations for 11 of the 15 body systems it is 

updating, and now expects to promulgate proposed regulations for the 11 

systems by the end of fiscal year 2017, and final regulations by the end of 

fiscal year 2018. Officials also reported progress in completing impact 

analyses; as of August 2016, VA had completed analyses for 10 of the 15 

body systems. VA extended timeframes for the 5 remaining analyses to 

be completed by the end of 2017, prior to the new target date for 

promulgating final regulations. We will continue to monitor VA’s progress 

toward finalizing regulations for all body systems, and, as referenced 

earlier, how it will keep earnings loss information updated.

Monitoring

Demonstrated Progress
Improving and Modernizing Federal Disability 

Programs

Page 603 GAO-17-317 High-Risk Series

Since our 2015 update, OMB has made some progress towards 

enhancing coordination and capacity across programs that support 

employment for people with disabilities. Some progress is evident in all 

five high-risk criteria. However, the scope of its current efforts to improve 

employment outcomes and coordination is limited to federal agencies and 

contractors, and OMB has not yet articulated a broader vision for 

supporting employment for people with disabilities outside the federal 

sector that includes appropriate government-wide goals and strategies for 

achieving them.

OMB continued to partially meet our criterion for leadership commitment. 

To better coordinate disability employment efforts across the federal 

government, the previous administration proposed establishing the 

Interagency Coordinating Council on Workforce Attachment (the Council). 

As planned, the Council would help support and fund early intervention4

demonstrations that promote workforce attachment in all employment 

sectors. The administration sought funding for the Council in its 2017 

budget request. In addition, the previous administration made progress in 

existing areas that support employment of people with disabilities in the 

federal sector. For example, it issued a resource guide as part of its Curb 

Cuts to the Middle Class initiative5 and OMB officials noted that the 

Department of Labor (Labor) entered into a contract to track progress 

toward the prior administration’s goal of government contractors further 

employing people with disabilities. While these efforts are potentially 

 4

That is, providing employment services before a potentially disabling condition results in 

an individual leaving the workforce.

5

Curb Cuts to the Middle Class is a cross-agency initiative design to coordinate and 

leverage resources across the federal government, with the goal of placing individuals 

with disabilities in jobs with the federal government or federal contractors.

Programs with Unified 

Strategies and Goals 

(OMB)

Leadership Commitment
Improving and Modernizing Federal Disability 

Programs

Page 604 GAO-17-317 High-Risk Series

promising, they continue to fall short of developing government-wide 

strategies and measurable goals to help people with disabilities attain 

employment in both the public and private sectors. Finally, OMB officials 

told us that they are preparing transition plans to help ensure current 

efforts continue under the new administration, but it remains to be seen 

whether the administration will support and sustain these efforts.

OMB continued to partially meet our criterion for building capacity. In 

addition to proposing the creation of the Council and issuing a resource 

guide for employers regarding people with disabilities, OMB officials 

noted that the prior administration took two other actions to improve the 

capacity for agency coordination:

• The Departments of Education and Labor finalized regulations under 

the Workforce Innovation and Opportunity Act (WIOA), which includes 

a provision that requires states to set aside funds to assist students 

with disabilities transition from school to postsecondary education or 

the workforce, and allows state vocational rehabilitation agencies to 

prioritize serving students with disabilities.

• The administration proposed increased funding for supported 

employment programs in fiscal years 2016 and 2017 that could, for 

example, provide supported employment services for up to 2 years for 

individuals already in vocational rehabilitation programs. These 

efforts, however, are limited in scope or have not yet been 

implemented. Moreover, they do not relate to creating capacity for 

establishing goals and other mechanisms to ensure agencies are 

accountable for having a measureable impact on employment 

outcomes outside the federal sector.

OMB continued to not meet our criterion for developing action plans. As 

mentioned previously, the prior administration proposed establishing the 

Council. While the proposed Council is a promising approach, the Council 

has not received—as of January 2017—funding for fiscal year 2017, and 

it remains to be seen whether this proposal will be funded in the future. 

Moreover, the administration has yet to establish government-wide goals 

for people with disabilities achieving employment outside the federal 

sector. To help ensure focus through the new administration, OMB 

officials noted that, in addition to OMB developing transition plans, a 

number of agencies have 5-year strategic plans that will span the 

outgoing and incoming administrations. OMB officials also noted that it is 

ultimately up to the new administration to decide how to plan and 

coordinate across federal disability programs.

Capacity

Action Plan
Improving and Modernizing Federal Disability 

Programs

Page 605 GAO-17-317 High-Risk Series

OMB partially met our criterion for monitoring. Since 2015, the 

administration continued to track and work toward increasing employment 

for people with disabilities at federal agencies, achieving the former 

President’s goal of hiring 100,000 employees with disabilities over 5 

years.6 With respect to the goal to have people with disabilities comprise 

7 percent of federal contractors, OMB officials told us that Labor is 

updating its case management system to track progress toward this goal. 

They added that Labor will collect information on contractor performance 

against this goal as it conducts compliance evaluations, thereby creating 

a good source of trend data over time. With respect to standardizing the 

way programs and agencies measure employment, OMB officials told us 

that the prior administration took a number of steps:

• The Departments of Labor and Education promulgated a joint final 

rule,7 pursuant to a requirement in WIOA, which defines common 

measures to be used by the six core job training programs under the 

two departments.

• Other programs, such as the Supplemental Nutrition Assistance 

Program’s Employment and Training program, have adopted similar 

measures.

• OMB officials stated that it is coordinating an interagency group to 

ensure all relevant agencies develop the necessary data infrastructure 

to collect information on these common measures.

• OMB officials said that the administration worked with VA to add 

employment-oriented measures to its Vocational Rehabilitation and 

Employment Program. Relatedly, officials noted that it is reasonable 

to expect the manner in which programs and agencies measure 

employment to vary to reflect the different challenges they face.

While common measures are helpful in measuring across programs, they 

do not provide and OMB still lacks a comprehensive picture of how 

disparate federal efforts support employment of those with disabilities 

outside the federal sector.

OMB partially met our criterion for demonstrating progress. In fiscal years 

2011 through 2015, the administration reported hiring nearly 110,000 

 6

This hiring goal was established by Exec. Order No. 13,163, and reiterated by Exec. 

Order No. 13,548. See 65 Fed. Reg. 46,563 (July 28, 2000) and 75 Fed. Reg. 45,039 

(July 30, 2010).

7

See 81 Fed. Reg. 55,792 (Aug. 19, 2016).

Monitoring

Demonstrated Progress
Improving and Modernizing Federal Disability 

Programs

Page 606 GAO-17-317 High-Risk Series

permanent employees with disabilities—including 98,000 full-time 

employees—exceeding the former President’s goal of hiring 100,000 over 

this period. However, additional hiring goals have not been set and OMB 

officials said it is up to the new administration whether and how to do so. 

With respect to the administration’s goal to have people with disabilities 

comprise 7 percent of most federal contractors, OMB officials reported 

that Labor’s initial results from this effort will not be available until mid2017.8 With respect to implementing measures across programs, OMB 

officials told us that, although the administration has yet to develop 

government-wide goals for the employment of people with disabilities 

across all sectors, they anticipate that demonstration projects overseen 

by the Council, if implemented, would identify successful early 

intervention approaches, which would inform the development of 

reasonable outcome measures.

• SSA Workloads: In response to a past recommendation, SSA 

appointed a chief strategic officer responsible for coordinating agencywide planning efforts, including those related to managing SSA’s 

disability claims workloads.

• VA Workloads: Consistent with our past recommendation, in 2013 

VA published its Strategic Plan to Eliminate the Compensation Claims 

Backlog, which identified implementation risks and metrics for the 

major initiatives mentioned in the Plan.

• SSA Modernizing: In response to past recommendations, SSA 

developed a project plan to assess risks to the success of the OIS, 

and has taken steps to estimate costs for necessary data collection 

and planned IT expenditures. SSA also worked with BLS to contract 

with experts to ensure they had the appropriate expertise to complete 

the OIS.

• In response to a past recommendation, SSA agreed to further study 

how it considers assistive technology in evaluating disability, and 

plans to seek input from the public and the medical community 

regarding changes in assistive technology in applicable upcoming 

medical listings. According to SSA, in September 2015 a committee 

convened by the National Academies of Science, Engineering and 

Medicine’s Health and Medicine Division, was tasked under an 

existing contract with SSA, to analyze the use of selected assistive 

 8

To meet this goal, Labor estimates that contractors will need to hire almost 600,000 

people with disabilities.

Benefits Achieved by 

Implementing Our 

Recommendations
Improving and Modernizing Federal Disability 

Programs

Page 607 GAO-17-317 High-Risk Series

products and technologies for adults, and a final report for SSA is 

expected in July 2017.

• VA Modernizing: In response to a past recommendation, in 2013 VA 

developed a project management plan that included plans for initiating 

subsequent updates to its disability rating schedule at regular 

intervals—whereby reviews of each body system are initiated on a 

staggered 5-year cycle to ensure no more than 10 years transpires 

without a review and possible revision of each body system.

• VA Modernizing: In response to a past recommendation, in 2014 VA 

updated its project management plan to reflect planned actions—such 

as identifying human resources to assist in developing and 

implementing proposed changes, and needed updates to guidance, 

training and systems—that would ensure smooth and timely 

implementation of revisions to its ratings schedule.

For additional information about this high-risk area, contact Barbara 

Bovbjerg at (202) 512-7215 or bovbjergb@gao.gov.

Social Security Disability: SSA Could Increase Savings by Refining Its 

Selection of Cases for Disability Review. GAO-16-250. Washington, D.C.: 

February 11, 2016.

Veterans Disability Benefits: VA Can Better Ensure Unemployability 

Decisions are Well Supported. GAO-15-464. Washington, D.C.: July 2, 

2015.

Veterans’ Disability Benefits: Improvements Could Further Enhance 

Quality Assurance Efforts. GAO-15-50. Washington, D.C.: November 19, 

2014.

Social Security Administration: Long-Term Strategy Needed to Address 

Key Management Challenges. GAO-13-459. Washington, D.C.: May 29, 

2013.

Veterans’ Disability Benefits: Timely Processing Remains a Daunting 

Challenge. GAO-13-89. Washington, D.C.: December 21, 2012.

VA Disability Compensation: Actions Needed to Address Hurdles Facing 

Program Modernization. GAO-12-846. Washington, D.C.: September 10, 

2012.

GAO Contact

Related GAO 

Products
Improving and Modernizing Federal Disability 

Programs

Page 608 GAO-17-317 High-Risk Series

Employment for People with Disabilities: Little Is Known about the 

Effectiveness of Fragmented and Overlapping Programs. GAO-12-677. 

Washington, D.C.: June 29, 2012.

Modernizing SSA Disability Programs: Progress Made, but Key Efforts 

Warrant More Management Focus. GAO-12-420. Washington, D.C.: June 

19, 2012.
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 609 GAO-17-317 High-Risk Series

With nearly $100 billion in assets, the Pension Benefit Guaranty 

Corporation’s (PBGC) financial portfolio is one of the largest of any 

federal government corporation. Through its single-employer and 

multiemployer insurance programs, PBGC insures the pension benefits of 

nearly 40 million American workers and retirees who participate in nearly 

24,000 private-sector defined benefit plans. PBGC’s financial future 

remains uncertain, due in part to a long-term decline in the number of 

traditional defined benefit plans and the collective financial risk of the 

many underfunded pension plans that PBGC insures. We designated the 

single-employer program as high risk in July 2003 and added the 

multiemployer program in January 2009.

Since fiscal year 2013, PGBC’s financial deficits have more than doubled. 

At the end of fiscal year 2016, PBGC’s net accumulated financial deficit 

was over $79 billion—an increase of about $44 billion since 2013. At the 

same time, PBGC estimated that its exposure to future losses for 

underfunded plans was nearly $243 billion.1 The single-employer 

program, composed of about 22,200 plans, accounted for $20.6 billion of 

PBGC’s overall deficit (see figure 21). The multiemployer program, 

composed of only about 1,400 plans, accounted for about $59 billion. 

According to PBGC, these dramatic increases were attributable to broad 

economic factors and financial conditions of the plans PBGC insures.

 1

At the end of fiscal year 2016, PBGC estimated that its loss exposure in its singleemployer program for reasonably possible plan terminations was over $223 billion and 

that its loss exposure in its multiemployer program for reasonably possible plans requiring 

future financial assistance was nearly $20 billion.

Pension Benefit Guaranty Corporation 

Insurance Programs

Why Area Is High 

Risk
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 610 GAO-17-317 High-Risk Series

Figure 21: PBGC’s Net Financial Position of the Single-Employer and Multiemployer Programs Combined – Net Position (in 

billions of dollars)

Various laws have been enacted to strengthen PBGC’s financial position. 

For instance, the Pension Protection Act of 2006 (PPA) strengthened 

pension funding requirements for plans,2 the Moving Ahead for Progress 

in the 21st Century Act (MAP-21) included measures to increase premium 

rates3 and the Bipartisan Budget Act of 2013 increased premium rates 

further.4 However, some of this legislation also included provisions that 

 2

Pub. L. No. 109-280, §§ 101,102, 111, 112, 201, 202, 211 and 212, 120 Stat. 780, 784-

809, 820-46, 858-86 and 890-917. In response to the recession, these provisions were 

substantially softened—initially, by phasing in PPA’s changes (Worker, Retiree, and 

Employer Recovery Act of 2008, Pub. L. No. 110-458, §§ 101, 102, 121 and 122, 122 

Stat. 5092, 5093-5103, and 5113-14), and then through changes in how minimum 

contributions are calculated (Preservation of Access to Care for Medicare Beneficiaries 

and Pension Relief Act of 2010, Pub. L. No. 111-192, tit. II, 124 Stat.1280, 1283-1306). 

3

Pub. L. No. 112-141, §§ 40221 and 40222, 126 Stat. 405, 850-853.

4

Pub. L. No. 113-67, § 703, 127 Stat. 1165, 1190-92.
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 611 GAO-17-317 High-Risk Series

would allow single employer plan sponsors to defer mandatory 

contributions to their defined benefit pension plans.5 To the extent that 

sponsors reduce contributions in the short term, they may increase plan 

underfunding and expose PBGC to greater risk. Recognizing the dramatic 

increase in PBGC’s deficit because of particular financial and 

demographic challenges facing many multiemployer plans, the 

Multiemployer Pension Reform Act of 2014 (MPRA) was enacted in 

December 2014 with a number of provisions to promote the long-term 

viability of the multiemployer program.6

As with our last report in 2015, there is no rating for this high-risk area

because addressing the issues in this area primarily involves 

congressional action, while the high-risk criteria and subsequent ratings 

were developed to reflect the status of agencies’ actions and the 

additional steps they need to take.

While PBGC faces a significant long-term challenge with its singleemployer program, it faces an immediate and critical challenge with its 

multiemployer program. In a 2013 report, we recommended that 

Congress consider comprehensive and balanced structural reforms to 

 5

Highway Transportation and Funding Act of 2014, Pub. L. No. 113-159, § 2003, 128 Stat. 

1839, 1849-51.

6

Pub. L. No. 113-325, div. O, 128 Stat. 2130, 2773-2822 (enacted as part of the 

Consolidated and Further Continuing Appropriations Act, 2015).

What GAO Found
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 612 GAO-17-317 High-Risk Series

reinforce and stabilize the multiemployer system.7 In December 2014, 

Congress took action to address the growing crisis in the multiemployer 

pension system by passing MPRA, which enacted several reforms 

responsive to our 2013 report on PBGC’s multiemployer program.8

Specifically, MPRA provided severely underfunded plans, under certain 

conditions and only with the approval of federal regulators, the option to 

reduce the retirement benefits of current retirees to avoid plan insolvency9

and expanded PBGC’s ability to intervene when plans are in financial 

distress.10 In addition, MPRA doubled the premiums paid by 

multiemployer plans (from $13 to $26 per participant).11 While these 

reforms are intended to improve the program’s financial condition, 

projections suggest that the future insolvency of the multiemployer 

 7

Private Pensions: Timely Action Needed to Address Impending Multiemployer Plan 

Insolvencies, GAO-13-240 (Washington, D.C.: March 2013).

8

Private Pensions: Timely Action Needed to Address Impending Multiemployer Plan 

Insolvencies, GAO-13-240 (Washington, D.C.: March 2013). Stakeholders with whom we 

spoke in connection with our report identified reduction of retiree benefits as a last resort. 

We recommended that Congress consider comprehensive and balanced structural 

reforms, taking into consideration the relative burdens that each reform option would 

impose on the competing interests of all plan stakeholders. In a 2010 report, we also

made several recommendations to PBGC regarding the multiemployer program. In 

response, PBGC took steps to improve its oversight of multiemployer plans. Agency 

officials reported that they began sharing more information on these plans with other 

agencies, and that they strengthened their monitoring by, among other things, reassigning attorneys to work primarily on multiemployer plan matters, awarding an audit 

services contract to develop nonfinancial assistance to plans, and authorizing additional 

positions to oversee financial assistance for troubled plans. Private Pensions: Changes 

Needed to Better Protect Multiemployer Pension Benefits, GAO-11-79, (Washington, D.C.: 

Oct. 18, 2010.)

9

§ 201(a)(6) and (b)(5), 128 Stat. 2799-2809 and 2811-22 (to be codified at 29 U.S.C. § 

1085(e)(9) and 26 U.S.C. § 432(e)(9)). Benefits may not be reduced to less than 110 

percent of the monthly amount guaranteed by PBGC. The maximum annual guarantee for 

2016 was $12,870 for a retiree with 30 years of service. Benefit reductions are further 

limited for retirees over 75 and no benefits based on disability may be suspended. The 

Department of the Treasury, in consultation with the Department of Labor and PBGC, 

must approve any proposal to suspend benefits.

10§§ 121 and 122, 128 Stat. 2794-96 (to be codified at 29 U.S.C. §§ 1411(e) and 1413).

11§ 131(a)(1), 128 Stat. 2796-97 (to be codified at 29 U.S.C. § 1306(a)(3)(A)(vi)). In 

addition, the law established a mechanism to automatically adjust premiums annually for 

multiemployer plans and they increased to $28 in 2017. § 131(a)(2), 128 Stat. 2796-97 (to 

be codified at 29 U.S.C. § 1306(a)(3)(M)). Furthermore, MPRA requires PBGC to analyze 

the effect of the most recent premium increases on the multiemployer program deficit. If 

current premiums are not sufficient to meet current and future obligations of the program, 

PBGC must propose to Congress a schedule of revised premiums. § 131(c), 128 Stat. 

2797-80.
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 613 GAO-17-317 High-Risk Series

program remains likely. Prior to passage of MPRA, PBGC estimated that 

the multiemployer insurance fund would likely be exhausted by 2022 as a 

result of current and projected plan insolvencies. PBGC officials noted 

that the act did not fully address the crisis in the multiemployer program 

and they predict that the changes will only forestall insolvency of the 

program probably by about an additional 3 years. Current estimates 

indicate that these changes will allow some plans to stay solvent and will 

reduce the cumulative unmet need for financial assistance to 

multiemployer plans by about half. As of January 2017, 10 pension plans 

had submitted 11 applications to suspend benefits under MPRA. (4 

applications have been denied, 2 were withdrawn, 4 are under review, 

and 1 has been approved.) In addition, the Bipartisan Budget Act of 2013 

and the Bipartisan Budget Act of 2015 increased premium rates for the 

single-employer program.12

PBGC continues to face long-standing funding challenges for its singleemployer insurance program as well, due to an overall decline in the 

defined benefit pension system. While tens of thousands of companies 

continue to offer traditional defined benefit plans, the total number of 

plans has declined significantly, as has participation in those plans. Since 

1985, there has been a 79 percent decline in the number of plans insured 

by PBGC to 23,769 plans in 2014 and more than 11 million fewer workers 

are actively participating in these plans. As a result, PBGC’s premium 

base has been eroding over time as fewer sponsors are paying premiums 

for fewer participants.

Additionally, the structure of PBGC’s premium rates—a key component of 

PBGC’s funding—has long been another area of concern. Despite 

periodic increases in premium rates, which are set according to statute, 

the level of premiums has not kept pace with the magnitude and 

multiplicity of risks that PBGC insures against.13 Moreover, plan 

underfunding is the only risk factor currently considered in determining a 

sponsor’s premium rate. Since 2011, the administration has proposed 

legislative reforms that would authorize the PBGC board to adjust 

premiums and to explore designing a more risk-based premium structure. 

Under the current premium structure for its single-employer program, 

PBGC collects from sponsors a per-participant flat-rate premium and a 

 12Pub. L. No. 113-67, § 703, 127 Stat. 1165, 1190-92 and Pub. L. No. 114-74, § 501, 129 

Stat. 584, 591-92.

13See 29 U.S.C. §§ 1306 and 1307.
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 614 GAO-17-317 High-Risk Series

variable-rate premium that is based on a plan’s level of underfunding.14 In 

2012, we recommended that Congress consider authorizing a redesign of 

PBGC’s premium structure for single-employer plans to allow 

incorporation of additional risk factors, such as consideration of a 

sponsor’s financial health. PBGC officials stated that they have continued 

efforts to enhance understanding of alternative premium structures by 

analyzing the limitations of the current system and by modeling various 

alternative risk-based options. However, to date no legislation 

incorporating additional risk factors into PBGC’s premium structure has 

been enacted.

PBGC’s governance structure is another area of weakness noted in 

several of our past reports. In particular, we have long recommended that 

PBGC’s board—currently composed of the Secretaries of the Treasury, 

Commerce, and Labor—be expanded to include additional members with 

diverse backgrounds who possess knowledge and expertise useful to 

PBGC’s mission. This recommendation has not yet been enacted into 

law, but MAP-21 included provisions to improve PBGC’s governance by 

prescribing in greater detail the working relationships between its Board 

of Directors and its Inspector General, General Counsel, Advisory 

Committee, and Director.15 It also called for the National Academy of 

Public Administration (NAPA) to review PBGC’s governance structure 

and to report on the ideal size and composition of its board.16 In its 

September 2013 report, NAPA recommended to Congress that if the 

agency is provided greater responsibility over its policies, PBGC’s board 

should be expanded.17 Furthermore, we have long emphasized that 

PBGC requires strong and stable leadership to ensure that it can meet its 

future financial challenges.

In August 2016, the Secretary of Labor provided updated information 

related to several of these areas of concern. Regarding the long-term 

financial stability of both insurance programs, the Secretary noted that the 

President’s 2017 budget again proposed that the PBGC Board be granted 

 14PBGC also collects termination premiums from sponsors of single-employer plans that 

terminate their plans under certain circumstances. 29 U.S.C. § 1306(a)(7).

15§ 40231(a) and (d), 126 Stat. 853-54 and 855,.

16§ 40231(f), 126 Stat. 855-56.

17NAPA, The Governance Structure of the Pension Benefit Guaranty Corporation: An 

Independent Review (Washington, D.C.: September 2013).
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 615 GAO-17-317 High-Risk Series

the authority to adjust premiums, and with that authority directed the 

Board to raise $15 billion in additional premium revenue from the 

multiemployer program. With regard to the recommendation to improve 

PBGC’s governance structure, the PBGC Board has declined to pursue 

the matter further absent authorizing legislation. PBGC has recently 

established an Enterprise Risk Management function and plans to hire a 

Risk Management Officer to identify and determine appropriate actions to 

mitigate the risks identified. As of October 2016, PBGC had not yet filled 

this position or determined the areas of potential risk to be targeted.

Although Congress and PBGC have taken significant and positive steps 

to strengthen the agency over the past 3 years, concerns persist related 

to the multiemployer program and challenges related to PBGC’s overall 

funding structure and governance. While changes were made with 

passage of MPRA, PBGC officials believe there is a 50 percent chance 

that the multiemployer program will be insolvent by the year 2025, and 

after that, the risk of insolvency rises rapidly—reaching 90 percent by 

2032. Further, the premium structure for PBGC’s single-employer 

program continues to result in rates that do not align with the risk the 

agency insures against and the effectiveness of PBGC’s board remains 

hampered by its size and composition.

Moreover, PBGC continues to face the ongoing threat of losses from the 

termination of underfunded plans, while grappling with a steady decline in 

the defined benefit pension system. With each passing year, fewer 

employers are sponsoring defined benefit plans and the sources of funds 

to finance future claims are becoming increasingly inadequate. Absent 

additional steps to improve PBGC’s finances, the long-term financial 

stability of the agency remain uncertain and the retirement benefits of 

millions of American workers and retirees could be at risk of dramatic 

reductions.

To improve the long-term financial stability of both PBGC’s insurance 

programs, Congress should consider:

• authorizing a redesign of PBGC’s single employer program premium 

structure to better align rates with sponsor risk;

• adopting additional changes to PBGC’s governance structure—in 

particular, expanding the composition of its board of directors;

What Remains to Be 

Done

Congressional Actions 

Needed
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 616 GAO-17-317 High-Risk Series

• strengthening funding requirements for plan sponsors as appropriate 

given national economic conditions;

• working with PBGC to develop a strategy for funding PBGC claims 

over the long term, as the defined benefit pension system continues to 

decline; and

• enacting additional structural reforms to reinforce and stabilize the 

multiemployer system that balance the needs and potential sacrifices 

of contributing employers, participants and the federal government.

Table 8: Financial Savings from Fiscal Years (FY) 2013-2016: $4,570 million

Title Amount 

($ in millions)

Increase in Federal Revenues Based on Increased Premiums 

for the Pension Benefit Guaranty Corporation (PBGC) - MAP21 (FY16 YR 4)

1,885

Increase in Federal Revenues Based on Increased Premiums 

for PBGC - Bipartisan Budget Act (FY16 YR 2)

850

Increase in Federal Revenues Based on Increased Premiums 

for PBGC - MAP-21 (FY15 YR 3)

1,065

Increase in Federal Revenues Based on Increased Premiums 

for PBGC - Bipartisan Budget Act (FY15 YR 1)

200

Increase in Federal Revenues Based on Increased Premiums 

for PBGC (FY14 YR 2)

350

Increase in Federal Revenues Based on Increased Premiums 

for PBGC - MAP 21 (FY13 YR 1)

220

Source: GAO. | GAO-17-317

• Multiemployer Pension Reform. We identified specific policy options 

to help multiemployer plans and the PBGC insurance program avoid 

insolvency, including recommending that Congress consider 

comprehensive reforms to stabilize the system. Congress enacted the 

Multiemployer Pension Reform Act, which included several options we 

identified.

• Interagency Sharing of Multiemployer Plan Information. To 

improve the quality of information and oversight of these plans, we 

recommended that the Employee Benefits Security Administration 

(EBSA) in the Department of Labor, the Internal Revenue Service 

(IRS) in the Department of the Treasury, and the Pension Benefit 

Guaranty Corporation (PBGC) revise existing interagency memoranda 

of understanding to address, among other things, the agencies’

process for sharing information they collect on multiemployer plans on 

Benefits Achieved by 

Implementing Our 

Recommendations
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 617 GAO-17-317 High-Risk Series

an ongoing basis. In response to this recommendation, PBGC took 

numerous steps in the last 2 fiscal years to share multiemployer plan 

information with IRS and EBSA, including providing lists of (1) the 

universe of multiemployer plans, and terminated, insolvent, or 

terminated and insolvent multiemployer plans; (2) plans filing critical 

and endangered status notices; and (3) plans that failed to provide 

annual funding notices.

• Proactive Monitoring of Multiemployer Plans. To implement better 

and more effective oversight practices, we recommended that PBGC 

develop a more proactive approach to monitoring multiemployer 

plans, such as assigning case managers to work with the plans that 

pose the greatest risk to the agency and providing non-financial 

assistance to troubled plans on an ongoing basis before the plans 

became insolvent. PBGC has taken numerous actions since 2011 to 

implement better and more effective oversight practices including: (1) 

re-assigning four attorneys to work primarily on multiemployer plan 

matters; (2) awarding an audit services contract to allow PBGC staff 

time to develop nonfinancial assistance to plans; (3) initiating 

proactive efforts to identify plans that would benefit from PBGC 

technical assistance and informal guidance; (4) contacting troubled 

multiemployer plans to obtain data on the plan’s financial situation and 

to create avenues to improve plan health and the financial assistance 

process; and (5) authorizing five additional positions to administer and 

oversee financial assistance extended to troubled multiemployer 

plans.

For additional information about this high-risk area, contact Charles A. 

Jeszeck at (202) 512-7215 or jeszeckc@gao.gov.

Pension Plan Valuation: Views on Using Multiple Measures to Offer a

More Complete Financial Picture. GAO-14-264. Washington, D.C.: 

September 30, 2014.

Private Pensions: Timely Action Needed to Address Impending 

Multiemployer Plan Insolvencies. GAO-13-240. Washington, D.C.: March 

28, 2013.

Private Pensions: Multiemployer Plans and PBGC Face Urgent 

Challenges. GAO-13-428T. Washington, D.C.: March 5, 2013.

GAO Contact

Related GAO 

Products
Pension Benefit Guaranty Corporation 

Insurance Programs

Page 618 GAO-17-317 High-Risk Series

Pension Benefit Guaranty Corporation: Redesigned Premium Structure 

Could Better Align Rates with Risk from Plan Sponsors. GAO-13-58. 

Washington, D.C.: November 7, 2012.

Pension Benefit Guaranty Corporation: Improvements Needed to 

Strengthen Governance Structure and Strategic Management. 

GAO-11-182T. Washington, D.C.: December 1, 2010.

Private Pensions: Changes Needed to Better Protect Multiemployer 

Pension Benefits. GAO-11-79. Washington, D.C.: October 18, 2010.
National Flood Insurance Program

Page 619 GAO-17-317 High-Risk Series

The National Flood Insurance Program (NFIP) is a key component of the 

federal government’s efforts to limit the damage and financial effect of 

floods. However, it likely will not generate sufficient revenues to repay the 

billions of dollars borrowed from the Department of the Treasury 

(Treasury) to cover claims from the 2005 and 2012 hurricanes or potential 

claims related to future catastrophic losses. This lack of sufficient revenue 

highlights what have been structural weaknesses in how the program is 

funded. Since the program offers rates that do not fully reflect the risk of 

flooding, NFIP’s overall rate-setting structure was not designed to be 

actuarially sound in the aggregate, nor was it intended to generate 

sufficient funds to fully cover all losses. 

Instead, Congress authorized the Federal Emergency Management 

Agency (FEMA)—the agency within the Department of Homeland 

Security (DHS) responsible for managing NFIP—to borrow from Treasury, 

within certain limits, when needed. Until the 2005 hurricanes, FEMA had 

used its authority to borrow intermittently and was able to repay the loans. 

As of March 2016, FEMA owed Treasury $23 billion, up from $20 billion 

as of November 2012. FEMA made a $1 billion principal repayment at the 

end of December 2014—its first such payment since 2010.

The Biggert-Waters Flood Insurance Reform Act of 2012 (Biggert-Waters 

Act) contained provisions to help strengthen the financial solvency of the 

program, including phasing out almost all discounted insurance premiums 

(for example, subsidized premiums). However, the extent to which its 

changes would have reduced NFIP’s financial exposure is unclear. In July 

2013, we reported that FEMA was starting to implement some of the 

required changes. However, on March 21, 2014, the Homeowner Flood 

Insurance Affordability Act of 2014 (HFIAA) was enacted. HFIAA 

reinstated certain premium subsidies and slowed down certain premium 

rate increases that had been included in the Biggert-Waters Act. Aspects 

of HFIAA were intended to address affordability concerns for certain 

property owners, but may also increase NFIP’s long-term financial burden 

on taxpayers. Further, an outdated policy and claims management 

system has also placed the program at risk. As a result of its substantial 

financial exposure and management and operations challenges, the 

program has been on our High-Risk List since 2006.

National Flood Insurance Program 

Why Area Is High 

Risk 
National Flood Insurance Program

Page 620 GAO-17-317 High-Risk Series

Congress and FEMA have made progress in meeting the criteria for 

removing NFIP from the High-Risk List. In July 2012, the Biggert-Waters 

Act was enacted. The Biggert-Waters Act contained provisions to help 

strengthen the financial solvency of the program, including phasing out 

almost all discounted insurance premiums (for example, subsidized 

premiums). In March 2014, HFIAA was enacted. HFIAA reinstated certain 

premium subsidies and slowed down certain premium rate increases that 

had been included in the Biggert-Waters Act.

FEMA leadership has also shown a commitment to taking a number of 

actions to implement our recommendations. However, implementing 

required changes under the Biggert-Waters Act, as amended by HFIAA, 

and addressing allegations of improper claims adjusting practices after 

Hurricane Sandy have created capacity challenges for FEMA in 

addressing the financial exposure created by NFIP as well as improving 

program administration. FEMA has identified actions to implement our 

recommendations, but it has not yet developed a comprehensive plan to 

address all the issues that have placed NFIP on our High-Risk List. 

For example, FEMA has a process in place to monitor progress in taking 

actions to implement our recommendations related to NFIP. But broader 

monitoring of the effectiveness and sustainability of its actions would help 

ensure that FEMA takes appropriate corrective actions. While FEMA has 

demonstrated progress toward improving NFIP’s financial stability and 

program efficiency, these efforts are not complete. For example, FEMA 

has addressed our recommendations to improve the monitoring and 

reporting of NFIP contractor performance and validate data system 

changes before they become effective. 

FEMA also has initiated actions to improve the accuracy of full-risk rates, 

but some of these efforts will continue over the next 5 to 10 years. In 

addition, we estimate that policyholders with certain subsidized premiums 

paid $216 million more in premiums as of the end of fiscal year 2015 than 

they would have paid prior to the enactment of the Biggert-Waters Act as 

a result of changes FEMA made in rates for these properties. However, 

FEMA still does not have all the necessary information to appropriately 

revise premium rates for certain subsidized properties. Other important 

actions, such as modernizing its policy and claims management system, 

also remain to be completed.

What GAO Found 
National Flood Insurance Program

Page 621 GAO-17-317 High-Risk Series

While FEMA leadership has displayed a commitment to addressing the 

challenges that have placed NFIP on the High-Risk List and has made 

progress in a number of areas, FEMA needs to take the following actions.

• Complete Biggert-Waters Act and HFIAA requirements that have not 

been fully met.

• Develop a comprehensive plan for removing NFIP from the High-Risk 

List.

• Initiate broader monitoring of the effectiveness and sustainability of its 

actions to help ensure that appropriate corrective actions are being 

taken.

• Continue ongoing efforts to improve its NFIP rate-setting methods and 

evaluate approaches to obtain flood risk information needed to 

determine full-risk rates for properties with previously subsidized 

rates. 

• Complete efforts to establish a new information technology system for 

NFIP.

By completing the actions noted above, FEMA will likely improve its ability 

to address the financial exposure of the program and help ensure that the 

funds allocated to NFIP and premiums paid to the program are used 

effectively.

In addition, Congress should continue to consider changing the program 

to further address the competing goals of financial solvency and 

affordability.

FEMA partially meets this criterion. FEMA’s leadership continues to show 

a commitment to implement our recommendations designed to help 

strengthen NFIP’s future financial solvency and administrative efficiency. 

However, the 2014 enactment of HFIAA continues to present 

administrative challenges for FEMA leadership and affect the program’s 

capacity to address the financial exposure created by NFIP. For example, 

HFIAA reinstated certain premium subsidies and slowed down some 

premium rate increases that had been included in the Biggert-Waters Act. 

In addition, the Biggert-Waters Act required that FEMA establish a 

What Remains to Be 

Done

Additional Details on 

What GAO Found

Leadership Commitment
National Flood Insurance Program

Page 622 GAO-17-317 High-Risk Series

reserve fund to be available for meeting the expected future obligations of 

NFIP, and HFIAA includes an annual surcharge for all policies ($25 for 

most policies) to be added to the reserve fund. However, FEMA stated in 

its June 2016 Quarterly NFIP Reserve Fund Report to Congress that it 

would not reach the required reserve fund balance of $12.8 billion for 

fiscal year 2015. 

FEMA stated that as long as the NFIP maintains outstanding debt, it

would expect that the reserve fund will not reach the required balance, as 

amounts collected may be periodically transferred to Treasury to reduce 

the NFIP’s debt or to pay claims and expenses in years when claims are 

high. For example, according to DHS officials, FEMA notified Congress in 

October 2016 that it planned to use reserve funds to pay for claims 

related to the 2016 flooding in Louisiana and Hurricane Matthew because 

the National Flood Insurance Fund had been exhausted. FEMA further 

stated in its June 2016 report that in order to make any significant 

progress toward increasing the reserve fund balance or paying down the 

NFIP debt, the reserve assessment would need to be significantly 

increased. In January 2017, FEMA obtained reinsurance for NFIP 

effective January 1, 2017 through January 1, 2018. A FEMA official noted 

that securing reinsurance was a key step toward building a stronger 

financial framework for NFIP. Under the agreement, reinsurers agreed to 

cover 26 percent of NFIP claims between $4 billion and $8 billion on 

losses from events that occur in 2017.

FEMA partially meets this criterion. FEMA’s capacity continues to be 

strained as it deals with multiple challenges, including implementing 

required changes under the Biggert-Waters Act, as amended by HFIAA. 

For example, as we reported in December 2016, FEMA officials told us 

that the agency’s progress implementing the Biggert-Waters Act 

requirement to revise its compensation methodology had slowed as 

litigation over Hurricane Sandy claims escalated and more resources 

were assigned to that issue. 

FEMA has made some progress to address weaknesses that we 

previously noted could limit its ability to effectively and efficiently 

implement NFIP. For example, we made two recommendations in a 

January 2014 report aimed at improving FEMA’s monitoring and reporting 

of contractor performance, such as ensuring that federal contracting 

officials have complete and timely information about contractor 

performance. FEMA provided us with documentation describing how the 

Capacity
National Flood Insurance Program

Page 623 GAO-17-317 High-Risk Series

agency plans to ensure the timeliness of contractor performance 

assessments and address our other concerns.

We also recommended in a December 2014 report that FEMA institute 

controls to validate changes to the NFIP data system. In March 2015, 

FEMA instituted the use of a new procedure manual, including a testing 

plan, for data system programming changes required to implement NFIP 

rate and rule changes. This procedure manual outlines the steps and 

approvals needed to plan, develop, test, and deploy NFIP data system 

changes. 

However, FEMA faces challenges implementing required Biggert-Waters 

Act and HFIAA requirements, including the complexity of the legislation 

and timing of the enactment of HFIAA, resource constraints, and the 

competing program goals of financial solvency and affordability. In 

October 2016, DHS officials told us that FEMA had met requirements to 

complete 20 of the 34 Biggert-Waters sections and 14 of the 25 HFIAA 

sections and was taking action on other sections. 

FEMA partially meets this criterion. FEMA has identified actions to 

address the recommendations from our individual reports. In January 

2017, a FEMA official noted that the agency tracks GAO 

recommendations through its internal controls program. The official added 

that FEMA is planning to enhance its Enterprise Risk Management

approach to track those GAO recommendations that impact its risk 

profile. However, FEMA lacks a comprehensive plan that addresses the 

issues that have placed NFIP on our High-Risk List. While addressing our 

recommendations is part of such a plan, a comprehensive plan defines 

the root causes, identifies effective solutions, and provides for 

substantially completing corrective measures near term. Such a plan 

could help FEMA ensure that all important issues, and all aspects of 

those issues, are addressed.

FEMA partially meets this criterion. FEMA has a process in place to 

monitor progress in taking actions to implement our recommendations 

related to NFIP. For example, the status of efforts to address the 

recommendations is regularly discussed both within FEMA and at the 

DHS level, according to a DHS official. However, FEMA lacks a specific 

process for independently validating the effectiveness or sustainability of 

those actions. According to a DHS official, once FEMA implements a 

recommendation related to NFIP, it does not track separately the effects 

Action Plan

Monitoring
National Flood Insurance Program

Page 624 GAO-17-317 High-Risk Series

of the actions taken to do so, but instead regularly reviews the 

effectiveness of the entire program. Additional monitoring of the 

effectiveness and sustainability of its specific actions taken to address our 

recommendations would help ensure that appropriate corrective actions 

are being taken.

FEMA partially meets this criterion. FEMA has demonstrated progress 

toward improving NFIP’s financial stability and program operations. As 

previously discussed, FEMA has taken steps to address our 

recommendations to improve how it monitors and reports NFIP contractor 

performance and validates data system changes before they become 

effective. However, progress is needed in other areas. For example, in 

2008 we recommended that FEMA take steps to ensure that rate-setting 

methods and the data used to set rates result in full-risk premiums that 

accurately reflect the risk of flooding. We found that FEMA’s method for 

setting its full-risk rates may not ensure that the rates accurately reflect 

the actual risk of flood damage. In 2013, we also recommended that 

FEMA develop and implement a plan to obtain flood risk information 

needed to determine full-risk rates for properties with previously 

subsidized rates. We found that FEMA generally lacks information 

needed to apply full-risk rates to certain subsidized properties.

As of March 2016, FEMA officials identified a number of actions the 

agency has taken or has underway to improve its NFIP rate-setting 

methods, but the officials noted that some of these efforts would continue 

over the next 5 to 10 years. In addition, as a result of changes FEMA has 

made in rates for certain subsidized properties (specifically, subsidies for 

primary residences, non-primary residences, and residential severe 

repetitive loss properties), we estimate that policyholders with these 

subsidized premiums paid $216 million more in premiums as of the end of 

fiscal year 2015 than they would have paid prior to the enactment of the 

Biggert-Waters Act. FEMA officials also said that they are evaluating 

approaches, including using new technologies, to collect elevation 

information for subsidized properties without financially burdening 

policyholders. 

FEMA has demonstrated progress in improving other areas of the 

program’s operations, such as continuity planning. However, some 

important actions, such as modernizing its information technology 

systems—including those for financial reporting and its policy and claims 

management system—remain to be completed. In 2011, we 

recommended that FEMA develop guidance and a related plan for 

Demonstrated Progress
National Flood Insurance Program

Page 625 GAO-17-317 High-Risk Series

continuing operations during federal disasters to help ensure consistent 

day-to-day operations when staff are deployed to disaster sites or 

reassigned to work on disaster-related issues. As part of developing its 

2012 continuity plan, FEMA identified critical staff as well as the key 

operations that need to continue when staff are deployed in response to a 

federal disaster and how operations will continue during such periods. 

In 2011, in our review of FEMA’s financial management, we reported that 

staff faced multiple challenges in their day-to-day operations due to 

limitations in the systems they must use to perform these operations. In 

this same report, we also noted that FEMA faces challenges modernizing 

NFIP’s insurance policy and claims management system. After 7 years 

and $40 million, FEMA ultimately canceled its NextGen effort in 

November 2009 because the system did not meet user expectations. 

Since that time, FEMA established a steering committee tasked with 

overseeing FEMA’s next attempt to modernize its policy and claims 

processing system and began implementing some changes to its 

acquisition management practices. It remains to be seen if these efforts 

will help FEMA avoid some of the problems that led to NextGen’s failure. 

In late-November 2014, FEMA officials told us that the agency was in the 

acquisition stage for a new system called “Phoenix” that will replace 

NextGen and NFIP’s current financial and reporting system. In January 

2017, a FEMA official stated the DHS acquisition review board had 

granted FEMA permission to procure and build the new system.

For additional information about this high risk area, contact Alicia Puente 

Cackley at (202) 512-8678 or cackleya@gao.gov.

Flood Insurance: FEMA Needs to Address Data Quality and Consider 

Company Characteristics When Revising Its Compensation Methodology. 

GAO-17-36. Washington, D.C.: December 8, 2016.

Flood Insurance: Review of FEMA Study and Report on CommunityBased Options. GAO-16-766. Washington, D.C.: August 24, 2016.

Flood Insurance: Potential Barriers Cited to Increased Use of Private 

Insurance. GAO-16-611. Washington, D.C.: July 14, 2016.

National Flood Insurance Program: Continued Progress Needed to Fully 

Address Prior GAO Recommendations on Rate-Setting Methods. GAO16-59. Washington, D.C.: March 17, 2016.

GAO Contact

Related GAO 

Products
National Flood Insurance Program

Page 626 GAO-17-317 High-Risk Series

National Flood Insurance Program: Options for Providing Affordability 

Assistance. GAO-16-190. Washington, D.C.: February 10, 2016.

Flood Insurance: Status of FEMA's Implementation of the Biggert-Waters 

Act, as Amended. GAO-15-178. Washington, D.C.: February 19, 2015.

Flood Insurance: Forgone Premiums Cannot Be Measured and FEMA 

Should Validate and Monitor Data System Changes. GAO-15-111. 

Washington, D.C.: December 11, 2014.

Overview of GAO’s Past Work on the National Flood Insurance Program. 

GAO-14-297R. Washington, D.C.: April 9, 2014.

Flood Insurance: Strategies for Increasing Private Sector Involvement. 

GAO-14-127. Washington, D.C.: January 22, 2014.

National Flood Insurance Program: Progress Made on Contract 

Management but Monitoring and Reporting Could Be Improved. GAO-14-

160. Washington, D.C.: January 15, 2014.

Flood Insurance: More Information Needed on Subsidized Properties. 

GAO-13-607. Washington, D.C.: July 3, 2013.

FEMA: Action Needed to Improve Administration of the National Flood 

Insurance Program. GAO-11-297. Washington, D.C.: June 9, 2011.
Managing Risks and Improving VA Health Care

Page 627 GAO-17-317 High-Risk Series

Since designating Department of Veterans Affairs (VA) health care as a 

high-risk area in 2015, we continue to be concerned about VA’s ability to 

ensure its resources are being used cost-effectively and efficiently to 

improve veterans’ timely access to health care, and to ensure the quality 

and safety of that care. VA’s Veterans Health Administration (VHA) 

operates one of the largest health care delivery systems in the nation, 

with 168 medical centers and more than 1,000 outpatient facilities 

organized into regional networks. VA has faced a growing demand by 

veterans for its health care services—due, in part, to servicemembers 

returning from the United States’ military operations in Afghanistan and 

Iraq and the needs of an aging veteran population—and that trend is 

expected to continue. For example, the total number of veteran enrollees 

in VA’s health care system rose from 7.9 million to almost 9 million from 

fiscal year 2006 through fiscal year 2016. Over that same period, VHA’s 

total budgetary resources have increased substantially, from $37.8 billion 

in fiscal year 2006 to $91.2 billion in fiscal year 2016.

Although VA’s budget and the total number of medical appointments 

provided have substantially increased for at least a decade, there have 

been numerous reports in this same period of time—by us, VA’s Office of 

the Inspector General, and others—of VA facilities failing to provide timely 

health care. In some cases, the delays in care or VA’s failure to provide 

care at all reportedly have resulted in harm to veterans. In response to 

these serious and longstanding problems with VA health care, the 

Veterans Access, Choice, and Accountability Act of 2014 (Pub. L. No. 

113-146, 128 Stat. 1754) was enacted, which provided temporary 

authority and $10 billion in funding through August 7, 2017 (or sooner, if 

those funds are exhausted) for veterans to obtain health care services 

from community (non-VA) providers to address long wait times, lengthy 

travel distances, or other challenges accessing VA health care. Under this 

authority, VA introduced the Veterans Choice Program in November 

2014. The $10 billion is meant to supplement VA’s medical services 

budget and is funded through a separate appropriations account, the 

Veterans Choice Fund. The 2014 law also appropriated $5 billion to 

expand VA’s capacity to deliver care to veterans by hiring additional 

clinicians and improving the physical infrastructure of VA’s medical 

facilities.

VA faces challenges regarding the reliability, transparency, and 

consistency of its budget estimates for medical services, as well as 

weaknesses in tracking obligations for medical services and estimating 

budgetary needs for future years. These challenges were evident in June 

2015, when VA requested additional funds from Congress because 

Managing Risks and Improving VA Health 

Care

Why Area Is High 

Risk
Managing Risks and Improving VA Health Care

Page 628 GAO-17-317 High-Risk Series

agency officials projected a fiscal year 2015 funding gap of about $3 

billion in its medical services appropriation account.1 The projected 

funding gap was largely due to administrative weaknesses that slowed 

the utilization of the Veterans Choice Program in fiscal year 2015 and 

resulted in higher-than-expected demand for VA’s previously established 

VA community care programs. In particular, VA officials expected that the 

Veterans Choice Program would absorb much of the increased demand 

from veterans for health care services delivered by non-VA providers, but 

instead the slow utilization resulted in veterans continuing to receive care 

through previously established VA community care programs that drew 

funds from VA’s medical services appropriation account. To avoid a 

projected funding gap in VA’s medical services appropriation account, the 

VA Budget and Choice Improvement Act provided VA temporary authority 

to use up to $3.3 billion from the Veterans Choice Program appropriation 

for obligations incurred for other specified medical services, starting May 

1, 2015, until October 1, 2015.2

While timely and cost-effective access to needed health care services is 

essential, care coordination between VA and community providers, and 

between VA and the Department of Defense (DOD) (for transitioning 

servicemembers), is also critical to preventing unfavorable health 

outcomes for veterans. With the increased utilization of community 

providers that has occurred as a result of the Veterans Access, Choice, 

and Accountability Act, veterans are required to navigate multiple 

complex health care systems—the VA health care system and those of 

community providers—to obtain needed health care services. The quality 

of veterans’ care may be adversely affected if VA and community 

providers do not promptly communicate important clinical information. In 

addition, servicemembers transitioning from DOD to VA health care may 

experience problems if, for example, VA inappropriately discontinues 

medications, such as those for mental health conditions, because of a 

lack of clarity in VA’s medication continuation policy, potentially increasing 

the risk for adverse health effects.

 1

In this report, the projected funding gap refers to the period in fiscal year 2015 when VA’s 

obligations for medical services were projected to exceed its available budget authority for 

that purpose for that year. The Antideficiency Act prohibits agencies from incurring 

obligations in excess of available budget authority. 31 U.S.C. § 1341(a). An evaluation of 

whether an Antideficiency Act violation occurred in fiscal year 2015 was outside the scope 

of our work.

2

Pub. L. No. 114-41, Tit. IV, § 4004, 129 Stat. 443, 463-464 (2015). 
Managing Risks and Improving VA Health Care

Page 629 GAO-17-317 High-Risk Series

Overall, VA has partially met the criteria for leadership commitment and 

an action plan to address the five areas of concern we identified when we 

placed VA health care on our High-Risk List in 2015. These five areas of 

concern are: (1) ambiguous policies and inconsistent processes; (2) 

inadequate oversight and accountability; (3) information technology (IT) 

challenges; (4) inadequate training for VA staff; and (5) unclear resource 

needs and allocation priorities. VA has not met the other criteria for 

removal: capacity to address the areas of concern, monitoring 

implementation of corrective actions, and demonstrating progress.

Although we concluded in our overall assessment that VA’s actions 

partially met two of our five criteria for removal from the High-Risk List, it 

is worth noting that the department made significantly less progress in 

addressing the action plan criterion than it has in demonstrating 

leadership commitment. Specifically, VA partially met the action plan 

criterion for only one of the five areas of concern—ambiguous policies 

and inconsistent processes—whereas VA partially met the leadership 

commitment criterion for four out of five areas of concern (VA did not 

meet the leadership commitment criterion for inadequate training for VA 

staff). The department must make significant progress on the action plan 

criterion for all five areas of concern we identified in order to meet this 

criterion for removal from our High-Risk List.

VA officials have expressed their commitment to addressing the 

department’s High-Risk List designation, and have taken actions such as 

establishing a task force, working groups, and a governance structure for 

addressing the issues contributing to the designation. For example, in 

July 2016, VA chartered the GAO High-Risk List Area Task Force for 

Managing Risk and Improving VA Health Care (task force) to develop and 

oversee implementation of VA’s plan to address the root causes of the 

five areas of concern we identified. VHA’s Deputy Under Secretary for 

Health (USH) for Organizational Excellence serves as the executive 

agent for the task force, with support from a combination of permanent 

and temporary staff. This senior VHA position was created in 2015 and is 

responsible for overseeing offices focused on assessing and improving 

health care quality and safety, providing VA leadership with analytics to 

assess VHA’s performance, and addressing issues related to public trust 

and integrity. For each of the five areas of concern we identified, VA has 

established a working group with two senior-level VA officials as leaders. 

These workgroups and officials are responsible for developing and 

executing VA’s high-risk mitigation plan for each of our five areas of 

concern.

What GAO Found
Managing Risks and Improving VA Health Care

Page 630 GAO-17-317 High-Risk Series

VA has also contracted with two entities to support VA’s actions to 

address the high-risk designation. The first contract—with a Federally 

Funded Research and Development Center operated by the MITRE 

Corporation—is focused on (1) developing and executing an action plan, 

(2) creating a plan to enhance VA’s capacity to manage High-Risk List

areas, and (3) recommending changes to the organizational structure VA 

set up to address the high-risk designation. The total contract value is 

$5.2 million, with an 8-month performance period that began on June 20, 

2016 and 1 option year. The second contract—with Atlas Research, 

LLC—is for project management staff who will help establish a program 

executive office within the office of the VHA Deputy USH for 

Organizational Excellence, and assist with establishing the management 

functions necessary to oversee the five high-risk area working groups. 

The total contract value is $2.6 million, with a 1-year performance period 

that began on September 9, 2016 and the option to extend services for up 

to 6 additional months.

Since we added VA health care to our High-Risk List in 2015, VA’s 

leadership has increased its focus on implementing our 

recommendations. Between January 2010 and February 2015 (when we 

designated VA health care as a high-risk area), we issued products 

containing 178 recommendations related to VA health care. When we 

made our designation in 2015, the department had only implemented 

about 22 percent of them—39 of the 178 recommendations. In the last 2 

years, VA has made good progress, but additional work is needed. Since 

we designated VA health care as a high-risk area, we have made 66 new 

recommendations related to VA health care, for a total of 244 

recommendations from January 1, 2010 through December 31, 2016. VA 

has implemented about 50 percent of the recommendations we have 

made since 2010—122 of the 244 recommendations. (See table 9.) It is 

critical that VA implement our recommendations not only to remedy the 

specific weaknesses identified, but because they may be symptomatic of 

larger underlying problems that also need to be addressed.
Managing Risks and Improving VA Health Care

Page 631 GAO-17-317 High-Risk Series

Table 9: Status of GAO Recommendations Related to Department of Veterans 

Affairs (VA) Health Care from Calendar Year 2010 through Calendar Year 2016

Status of recommendations Number of 

recommendations 

when VA health care 

was added to GAO’s 

High-Risk List

(February 11, 2015)

Number of 

recommendations as of 

December 31, 2016

Open because VA has not yet 

implemented them

134 109a

Closed because VA implemented 

them

39 122

Closed without VA implementing 

themb 5 13

Total 178 244

Source: GAO. | GAO-17-317.

a

Of these 109 recommendations, 27 have been open for 3 or more years.

b

We close recommendations without agencies having implemented them primarily if the 

recommendation is no longer valid because circumstances have changed.

On August 18, 2016, VA provided us with an action plan for addressing 

the High-Risk List designation that acknowledged the deep-rooted nature 

of the areas of concern we identified, and stated that these concerns 

would require substantial time and work to address. Although the action 

plan outlined some steps VA plans to take over the next several years to 

address its high-risk designation, the overall document did not satisfy the 

action plan criterion for removal. Specifically, several sections were 

missing actions that support our criteria for removal, such as analyzing 

the root causes of the issues and measuring progress with clear metrics. 

In our feedback to VHA on drafts of their action plan, we highlighted these 

missing actions and also stressed the need for specific timelines and an 

assessment of needed resources for implementation. For example, VA 

plans to use staff from various sources, including contractors and 

temporarily detailed employees, to support their high-risk area working 

groups, so it will be important for VA to ensure that these efforts are 

sufficiently resourced.

While VA has demonstrated partial leadership commitment in most of the 

five areas of concern, significant gaps remain between VA’s stated plans 

and its actual progress. This lack of progress is evidenced by findings 

from our recent work, which have led us to make new recommendations 

that relate to each of the five areas of concern we highlighted in 2015. 

(See table 10.)
Managing Risks and Improving VA Health Care

Page 632 GAO-17-317 High-Risk Series

Table 10: GAO Recommendations Related to Department of Veterans Affairs (VA) Health Care from Calendar Year (CY) 2010 

through CY 2016, by Area of Concern

VA health care area of concern Number of 

recommendations prior to 

GAO high-risk designation

(Jan. 1, 2010 through Feb. 

11, 2015)a

Number of 

recommendations added 

since GAO high-risk 

designation

(Feb. 11, 2015 through Dec. 

31, 2016)a

Cumulative percentage of 

GAO recommendations VA 

has implemented, CY 2010 

through CY 2016

Ambiguous policies and inconsistent 

processes

42 20 52%

Inadequate oversight and 

accountability

63 31 50

Information technology challenges 11 2 44

Inadequate training for VA staff 6 7 46

Unclear resource needs and 

allocation priorities

48 5 65

Not assigned to an area of concern 8 1 44

Total 178 66 50%

Source: GAO. | GAO-17-317.

a

Recommendation counts listed include both implemented and not implemented recommendations as 

of the dates indicated.

Since we added VA health care to our High-Risk List in 2015, VA has 

acknowledged the significant scope of the work that lies ahead. VA took 

an important step toward addressing our criteria for removal by 

establishing the leadership structure necessary to ensure that actions 

related to the High-Risk List are prioritized within the department. It is 

imperative, however, that VA maintain strong leadership support as it 

completes its transition into a new presidential administration.

In its action plan, VA separated its discussion of department-wide 

initiatives from its description of High-Risk List mitigation strategies. 

These department-wide initiatives include MyVA, which intends to make 

changes to VA’s systems and structures to (1) improve the veteran 

experience, (2) improve the employee experience, (3) achieve support 

services excellence, (4) establish a culture of continuous performance 

improvement, and (5) enhance strategic partnerships. We do not view 

high-risk mitigation strategies as separate from other department 

initiatives; actions to address the High-Risk List can and should be 

integrated in VA’s existing activities. As a new administration sets its 

priorities, VA will need to integrate those priorities with its high-risk related 

actions, and facilitate their implementation at the local level through 

What Remains to Be 

Done
Managing Risks and Improving VA Health Care

Page 633 GAO-17-317 High-Risk Series

strategies that link strategic goals to actions and guidance. In addition, VA 

will need to demonstrate that it has the capacity to sustain efforts by 

devoting appropriate resources—including people, training, and funds—to 

address the high-risk challenges we identified.

VA’s action plan for addressing its high-risk designation describes many 

planned outcomes with overly ambitious deadlines for completion. We are 

concerned about the lack of root cause analyses for most areas of 

concern, and the lack of clear metrics and needed resources for 

achieving stated outcomes. This is especially evident in VA’s plans to 

address the IT and training areas of concern. In addition, with the 

increased use of community care programs, it is imperative that VA’s 

action plan include a discussion of the role of community care in 

decisions related to policies, oversight, IT, training, and resource needs. 

We will continue to monitor VA’s institutional capacity to fully implement 

and sustain needed changes, including those related to its IT 

transformation, comprehensive training management plan, and 

resourcing decisions.

Finally, to help address our high-risk designation, VA should continue to 

implement our recommendations and recommendations from other 

reviews such as the Commission on Care. The Veterans Access, Choice, 

and Accountability Act of 2014 established the Commission on Care to 

examine, assess, and report on veterans’ access to VA health care and to 

strategically examine how best to organize VHA, locate health resources, 

and deliver health care to veterans during the next 20 years.3 The 

Commission’s June 2016 report to the President included 18 

recommendations to improve veterans’ access to care and, more broadly, 

to improve the quality and comprehensiveness of that care. For example, 

the Commission recommended that VHA create local, networked systems 

of care that integrate VA-based care and community care and remove 

restrictions to veterans seeking care from community providers. On 

September 1, 2016, the President concurred with 15 of the 18 

recommendations and directed VA to implement them.

We will continue to monitor VA’s efforts to address our high-risk areas of 

concern, including the department’s efforts to implement the 15 

Commission on Care recommendations for which the President directed 

VA action. We also have ongoing work focusing on VA health care, 

 3

Pub. L. No. 113-146, § 202(a)(1), 128 Stat. 1754, 1773 (2014). 
Managing Risks and Improving VA Health Care

Page 634 GAO-17-317 High-Risk Series

including its policy development and dissemination process; controls and 

oversight for controlled substances; Veterans Choice Program 

implementation; physician recruitment and retention; the process for 

enrolling veterans in VA health care. In particular, the following selected 

recommendations require VA’s immediate attention:

• improving oversight of access to timely medical appointments, 

including the development of wait-time measures that are more 

reliable and not prone to user error or manipulation, as well as 

ensuring that medical centers consistently and accurately implement 

VHA’s scheduling policy.

• improved oversight of VA community care to ensure—among other 

things—timely payment to community providers.

• improved planning, deployment and oversight of VA/VHA IT systems, 

including identifying outcome-oriented metrics and defining goals for 

interoperability with DOD.

• ensuring that recommendations resulting from internal and external 

reviews of VHA’s organizational structure are evaluated for 

implementation. This process should include the documentation of 

decisions and assigning officials or offices responsibility for ensuring 

that approved recommendations are implemented.

It is critical that Congress maintain its focus on oversight of VA health 

care to help address this high-risk area. Congressional committees 

responsible for authorizing and overseeing VA health care programs held 

more than 70 hearings in 2015 and 2016 to examine and address VA 

health care challenges. In addition, as VA continues to change its health 

care service delivery in the coming years, some changes may require 

congressional action—such as VA’s planned consolidation of community 

care programs after the Veterans Choice Program expires. Sustained 

congressional attention to these issues will help ensure that VA continues 

to improve its management and delivery of health care services to 

veterans.
Managing Risks and Improving VA Health Care

Page 635 GAO-17-317 High-Risk Series

When we designated VA health care as a high-risk area in 2015, we 

reported that ambiguous VA policies led to inconsistent processes at local 

VA medical facilities. Based on actions taken since 2015, VA has partially 

met our criteria for removal for its leadership commitment and action plan. 

However, VA has not met our criteria for removal for capacity, monitoring, 

and demonstrated progress for this area of concern.

VA has partially met the leadership commitment criterion because it has 

established a framework for developing and reviewing policies—with the 

goal of ensuring greater consistency and clarity—and set goals for 

making the policy-development process more efficient. VA outlined this 

framework in the 2016 revision of a VHA directive on policy development 

and management, which clarifies the types of VHA documents that 

constitute policy. VA’s action plan for this high-risk area of concern further 

described VHA’s plans to review its 168 medical centers’ local policies to 

ensure they are consistent with national policy. VHA has also established 

a long-term goal of reviewing all of its approximately 800 health care 

policies to determine they are current and have undergone the revised 

review process by the end of fiscal year 2021. In 2016, VHA estimated 

that almost 60 percent of the 800 policies had not been recertified, 

meaning they had not been reviewed in at least 5 years to ensure they 

are up-to-date and still relevant. Although VA has established a policyrelated framework and goals, its action plan does not clearly outline how 

VA intends to achieve these goals. As a result, VA leadership has limited 

ability to demonstrate continuing oversight and accountability, which is 

Additional Details on 

What GAO Found

Ambiguous Policies and 

Inconsistent Processes

Leadership Commitment
Managing Risks and Improving VA Health Care

Page 636 GAO-17-317 High-Risk Series

one example of an action that would contribute to meeting the leadership 

commitment criterion for removal from our High-Risk List.

VA has not met the capacity criterion because of significant gaps between 

its stated goals and the resources available to achieve them. VA’s highrisk working group on ambiguous policies and inconsistent processes is a 

first step towards establishing the capacity necessary to address this area 

of concern. VA has allocated staff and awarded contracts to support the 

department’s overall high-risk effort, but its action plan for this area does 

not explain how VA will allocate staff and resources to support its plans to 

address ambiguous policies and inconsistent processes, such as the 

professional policy writers VA states it needs to ensure consistent policy 

content and quality.

Other actions VA needs to take to demonstrate capacity in this area of 

concern include maintaining procedures that have recently been 

established; training appropriate staff in policy development, 

implementation, and oversight; and addressing gaps such as unofficial 

policy documents. One example of unofficial policy is memoranda sent by 

the VHA Deputy USH for Operations and Management to regional 

network offices and VA medical centers. These memoranda are treated 

as new policy, but they have not been vetted by other VA offices, 

potentially creating confusion at the local level between mandatory and 

suggested actions.

VA has partially met the action plan criterion for this high-risk area of 

concern because its action plan described an analysis of the root causes 

of problems related to ambiguous policies and inconsistent processes, an 

important aspect of an action plan. VA’s root cause analysis for this area 

of concern identified a lack of collaboration (“an inability to span 

boundaries”), good performance metrics, and a proper skill set as the 

three most common root causes for 20 shortcomings it identified in 

processes associated with developing, implementing, and overseeing 

policy. VA has specific actions planned to address the identified root 

causes, including milestones such as piloting the revised policy process 

in the first half of fiscal year 2017. However, without meeting the capacity 

actions described previously, VA’s time frames for completing tasks may 

not be realistic. For example, VA has a milestone of reviewing and 

recertifying 40 percent of the VHA policies that need such a review by the 

first quarter of fiscal year 2018. Using VHA’s estimate of 471 (59 percent 

of 800) policies being past their recertification date, VHA officials would 

have to review and revise 188 policies between fiscal year 2017 and the 

first quarter of fiscal year 2018 to achieve this 40 percent goal. Without a 

Capacity

Action Plan
Managing Risks and Improving VA Health Care

Page 637 GAO-17-317 High-Risk Series

fully-established policy revision process in place, or the professional 

policy writers available to revise policies, VA cannot effectively meet 

these milestones. VA needs to use the root cause analysis results to 

develop more realistic milestones and metrics for this area, and ensure 

that critical actions and outcomes are prioritized given any identified 

limitations in capacity.

VA has not met the monitoring criterion for our concerns related to 

ambiguous policies and inconsistent processes. VA has many planned 

actions that have not yet been implemented, including plans to ensure 

policy is implemented consistently at local and national levels, as well as 

plans to identify and address unofficial sources of policy. We also have 

continued to find evidence in our recent work of inconsistencies in policy 

application that will need to be addressed to show that VA is monitoring 

policies. For example, we highlighted the inconsistent application of 

policies in two recent reports examining mental health and primary care 

access at VA medical facilities in 2015 and 2016, respectively. In both 

reports, we found wide variation in the time that veterans waited for 

primary and mental health care, which was in part caused by a lack of 

clear, updated policies for scheduling—therefore, we recommended that 

VA update these policies. These ambiguous policies contributed to errors 

made by appointment schedulers, which led to inconsistent and unreliable 

wait-time data. For mental health, we also found that two policies 

conflicted, leading to confusion among VA medical center staff as to 

which wait-time policy to follow. In 2015, VA resolved this policy conflict 

by revising its mental health handbook, but other inconsistent applications 

of mental health policy have not yet been addressed, such as our 

recommendation to issue guidance about the definitions used to calculate 

veteran appointment wait times, and communicate any changes to those 

definitions within and outside VHA.

VA has not met the demonstrated progress criterion for removal. We are 

unable to assess VA’s actions in this area because without the clear 

milestones and metrics necessary to track performance, VA cannot 

demonstrate that its actions are linked to identified root causes and that it 

is effectively managing this area of concern. We have ongoing work 

examining VA’s actions to ensure that policies related to veterans’ health 

care are consistently communicated and implemented, and we will 

continue to monitor VA’s progress in this area.

Monitoring

Demonstrated Progress
Managing Risks and Improving VA Health Care

Page 638 GAO-17-317 High-Risk Series

In our 2015 high-risk report, we found that VA has had problems holding 

its facilities accountable for their performance because it relied on selfreported data from facilities, its oversight activities were not sufficiently 

focused on compliance, and it did not routinely assess policy 

implementation. VA has partially met the leadership commitment criterion 

for this area of concern because it established a high-level governance 

structure and adopted a new model to guide the department’s oversight 

and accountability activities. However, VA has not met our criteria for 

removal for capacity, action plan, monitoring, or demonstrated progress 

because the department continues to rely on existing processes that 

contribute to inadequate oversight and accountability.

VA partially met the leadership commitment criterion because it has made 

progress in establishing the governance structure necessary to address 

oversight and accountability concerns. In 2016, VA established the VHA 

office of the Assistant Deputy USH for Integrity, who reports to the Deputy 

USH for Organizational Excellence. The Office of Integrity is responsible 

for the day-to-day management of subordinate offices focused on internal 

and external audits, compliance, and ethics. It is also an important 

component of VA’s new “Three Lines of Defense” model for risk 

management and control, which VA estimates it will adopt beginning in 

fiscal year 2017: (1) front line managers oversee policy implementation; 

(2) regional-network- and national-level program officials ensure national 

programs are consistently implemented; and (3) VA central office 

independently conducts assurance activities and investigations, such as 

inspections and audits. The Assistant Deputy USH for Integrity is primarily 

responsible for the third line of defense, but will interact with all three 

lines. In order to fully meet the leadership commitment criterion, VA will 

need to demonstrate that it is providing oversight of, and ensuring 

accountability for, implementation of the Three Lines of Defense model at 

each level of VHA (medical centers, networks, and central office). It will 

also need to finish establishing the offices and resources needed to 

support oversight and accountability functions. For example, VA’s third 

line of defense includes establishing a new office of Internal Audit and 

Risk Assessment. However, as of December 2016, VA leadership had not 

Inadequate Oversight and 

Accountability

Leadership Commitment
Managing Risks and Improving VA Health Care

Page 639 GAO-17-317 High-Risk Series

yet approved the draft directive establishing this office and authorizing it 

to carry out its planned functions.

VA has not taken sufficient actions to meet the capacity criterion for 

removing this area of concern from our High-Risk List. Although VA has 

begun to allocate staff and resources by establishing the VHA office of 

the Assistant Deputy USH for Integrity, the success of its new oversight 

and accountability model depends on establishing consistent policies and 

ensuring that staff at all levels are complying with them. VA staff will need 

sufficient guidance and training to address skills gaps and to correct 

identified deficiencies, and VA’s new office of Internal Audit and Risk 

Assessment (a key component of its new oversight and accountability 

model) will need to be fully resourced, staffed, and operational. In 

addition, VA identified a need for increased training in ethics, as well as a 

need for staff with this specific expertise at the local level. However, VA’s 

action plan does not discuss how these actions will be resourced, 

including hiring staff or obtaining other resources necessary to ensure 

that such knowledge is in place.

VA also has not met the action plan criterion for addressing our concerns 

about oversight and accountability. In its action plan, VA identifies root 

causes based on an “environmental analysis” of its health care oversight 

structure, such as the lack of a formal audit capacity. However, the 

identified root causes are not linked to clear milestones, metrics, or 

processes for reporting on progress. VA plans to include metrics in every 

new or revised policy to allow officials to determine whether the policy is 

being appropriately implemented and meets objectives. However, as 

described earlier, VHA’s new policy development and revision process is 

still in its early stages. Without clear milestones and metrics linked to root 

causes of the problem, VA cannot assess its implementation status or 

demonstrate progress against goals. For example, in our May 2016 report 

on the Veterans Crisis Line (a 24-hour telephone line staffed by 

responders who assist veterans in emotional crisis), we found VA 

established key performance indicators to evaluate crisis line operations 

but had no measureable targets or time frames established for their 

completion. One of the indicators related to rate at which crisis line callers 

abandoned their calls prior to speaking with a responder, but VA did not 

set a minimum or ideal performance target for this indicator. We 

recommended that VA document clearly stated and measurable targets 

and time frames for key performance indicators needed to assess 

Veterans Crisis Line performance, in order to improve the timeliness and 

quality of crisis line responses to veterans.

Capacity

Action Plan
Managing Risks and Improving VA Health Care

Page 640 GAO-17-317 High-Risk Series

VA has not met the criterion for monitoring its progress in improving 

oversight and accountability. VA’s action plan for this area of concern 

does not explain how it will ensure that medical facilities are consistently 

reporting reliable data, which is critical to monitoring actions. We have 

continued to find instances where VA lacked reliable data to determine 

whether its medical centers were following policies, which will continue to 

make it difficult for VA to monitor improved oversight and accountability. 

For example, in 2015, as part of our review of VA’s primary care 

oversight, we found inaccuracies in VA’s data on primary care panel 

sizes, which are used to help medical centers manage their workload and 

ensure that veterans receive timely and efficient care. We found that 

while VA’s primary care panel management policy requires facilities to 

ensure the reliability of their panel size data, it does not assign 

responsibility for verifying data reliability to regional- or national-level 

officials or require them to use the data for monitoring purposes. As a 

result, VA could not be assured that local panel size data were reliable, or 

whether its medical centers have met VA’s goals for efficient, timely, and 

quality care. We recommended that VA incorporate an oversight process 

in its primary care panel management policy that assigns responsibility, 

as appropriate, to regional networks and central office for verifying and 

monitoring panel sizes.

VA has not met the criterion for demonstrating progress in addressing 

weaknesses we identified in its oversight and accountability. We found, 

as part of our December 2016 report on VA’s health care services for 

women veterans, VA’s lack of reliable data meant that it could not ensure 

medical center compliance with requirements related to the environment 

of care for women veterans. These requirements include standards for 

privacy at check-in and interview areas, location of exam rooms, and the 

presence of privacy curtains in exam and inpatient rooms. We found that 

only 3 of the 155 instances of noncompliance we observed during on-site 

inspections of waiting, procedure, and examination areas at six VA 

medical centers were reported to VA central office. Because VA uses 

these data to track facility compliance, their accuracy is vital for effective 

oversight. We recommended that VHA strengthen its environment of care 

inspections process and VA’s oversight of this process by expanding the 

list of inspection requirements to align with VA’s women’s health 

handbook, clarifying the roles and responsibilities of facility-level staff 

responsible for identifying and addressing areas of noncompliance, and 

establishing a process to verify the accuracy and completeness of 

medical centers’ self-reported information. Without taking these actions, 

VA cannot provide reasonable assurance that it is protecting the privacy, 

Monitoring

Demonstrated Progress
Managing Risks and Improving VA Health Care

Page 641 GAO-17-317 High-Risk Series

safety, and dignity of women veterans when they receive care at VA 

medical facilities.

In our 2015 high-risk report, we identified limitations in the capacity of 

VA’s existing IT systems, including the outdated, inefficient nature of 

certain systems and a lack of system interoperability—the ability to 

exchange and use electronic health information—as contributors to VA’s 

IT challenges related to VA health care. These challenges present risks to 

the timeliness, quality, and safety of VA health care. VA has partially met 

our leadership commitment criterion by involving top leadership in this 

area of concern, but it has not met our four remaining criteria for removing 

IT challenges from the High-Risk List.

VA has partially met the leadership commitment criterion for addressing 

IT challenges. Specifically, VA outlined in its action plan a high-level 

governance structure that designates an official within VA’s departmentlevel Office of Information and Technology (OI&T) as responsible for this 

area of concern. In addition, VA’s Chief Information Officer (CIO) has 

recently initiated an effort to transform the focus and functions of OI&T in 

response to the Secretary’s goal of making VA a more veteran-focused 

organization. The CIO’s transformation strategy, initiated in January 2016, 

calls for the office to stabilize and streamline processes, mitigate 

weaknesses highlighted in our assessments, and improve outcomes by 

institutionalizing a new set of IT management capabilities. As part of this 

transformation, in January 2016, the CIO began transitioning the 

oversight and accountability of IT projects to a new project management 

process called the veteran-focused integration process, in an effort to 

streamline its systems development and delivery of new IT capabilities.

The CIO also intends to establish five new functions within OI&T to 

enable VA to address its IT challenges: (1) the Enterprise Program 

Management Office, which began initial operations in April 2016 and is 

Information Technology 

Challenges

Leadership Commitment
Managing Risks and Improving VA Health Care

Page 642 GAO-17-317 High-Risk Series

intended to serve as OI&T’s portfolio management and project tracking 

organization; (2) account management, led by three account managers 

responsible for managing the IT needs of VA’s major components; (3) 

quality and compliance, responsible for establishing effective policy 

governance and standards, and ensuring VA adheres to the policies and 

standards; (4) data management, intended to improve both service 

delivery and the veteran experience by engaging with data stewards to 

ensure the accuracy and security of the information collected by VA; and 

(5) strategic sourcing, which is expected to be responsible for establishing 

an approach to working with vendors that can supply solutions to VA’s IT 

requirements. However, VA is in the early stages of implementing these 

new functions, and it will need to sustain leadership commitment by 

maintaining OI&T’s transformation through the presidential transition.

VA has not taken sufficient action to demonstrate it has the capacity to 

address the IT challenges we identified. VA has extensive IT resources in 

terms of staff and funding. In fiscal year 2016, VA’s IT appropriations 

were approximately $4.1 billion, and in our August 2016 report on VA’s IT 

management, OI&T reported nearly 7,300 federal employees and 

approximately 7,800 contractor staff working in support of IT-related 

functions. However, VA has not demonstrated improvement in several 

capacity actions, such as establishing specific responsibilities for its new 

functions, improving collaboration between internal and external 

stakeholders, and addressing skill gaps. For example, in our August 2016 

report, we found that OI&T was still in the process of fully defining the 

roles and responsibilities of its new organizational units, as of July 2016.

With regard to collaboration, VA designated an account manager for VHA 

as of May 2016, which has the potential to improve VHA and VA 

collaboration on IT needs. However, its August 2016 action plan for IT 

challenges describes plans rather than actions already taken to 

implement the account management function. In addition, we have 

repeatedly reported on the importance of VA working with DOD to 

achieve electronic health record interoperability. In August 2015, we 

reported on the status of these interoperability efforts and noted that the 

departments have engaged in several near-term efforts focused on 

expanding interoperability between their existing electronic health record 

systems. However, we were concerned by the lack of outcome-oriented 

goals and metrics that would more clearly define what VA and DOD aim 

to achieve from their interoperability efforts. Accordingly, we 

recommended that the departments establish a time frame for identifying 

outcome-oriented metrics and define related goals for achieving 

interoperability.

Capacity
Managing Risks and Improving VA Health Care

Page 643 GAO-17-317 High-Risk Series

Finally, in our August 2016 report, we found that while OI&T conducted 

annual skill gap analyses and developed training courses, and 

recommended other actions for addressing these gaps, the office had not 

identified potential gaps that may exist in future years. This led us to 

recommend that OI&T identify IT skills needed beyond the current fiscal 

year to assist in identifying future skill gaps. By focusing on the current 

year, OI&T may not be aware of skill gaps that need to be filled to assure 

its staff can deliver long-term IT support that contributes to improved 

services for veterans.

VA has not met the action plan criterion for addressing the IT challenges 

we identified. VA’s action plan for this area provides a descriptive problem 

statement—reflecting our previously stated concerns—and high-level 

information about VA-wide IT strategies and initiatives. However, it does 

not contain a root cause analysis that would help identify and prioritize 

critical actions and outcomes to address IT challenges. As a result, VA’s 

stated milestones and dates appear unrealistic and disconnected from the 

challenges identified. For example, VA set a goal of having 50 percent of 

its active IT projects on budget and on schedule by the end of 2016, but it 

does not state what supporting actions and processes would be 

necessary to achieve this ambitious goal. Also, without a root cause 

analysis, VA cannot be certain this action will address its IT challenges. A 

significant concern we identified in our August 2015 report on VA’s and 

DOD’s interoperability efforts is that the two departments had not 

identified outcome-oriented goals and metrics that would more clearly 

define what they aim to achieve from their interoperability efforts and the 

value and benefits these efforts are intended to yield.

VA has not met the criterion related to monitoring actions to address IT 

challenges. Without outcome-oriented goals and metrics to measure 

progress, VA cannot demonstrate that it is effectively monitoring 

implementation and tracking progress against goals. As we have stressed 

in our prior work, assessing the performance of a program should include 

measuring its outcomes in terms of the desired results of products or 

services. In this case, such outcomes could include improving the quality 

of health care or clinician satisfaction. Establishing outcome-oriented 

goals and metrics is essential to determining whether a program is 

operating as intended and delivering value.

VA has not met the criterion for demonstrating progress in this area of 

concern. As with monitoring, without goals and metrics that address a 

root cause analysis, VA cannot demonstrate progress in effectively 

managing implementation and is unable to ensure that actions taken are 

Action Plan

Monitoring

Demonstrated Progress
Managing Risks and Improving VA Health Care

Page 644 GAO-17-317 High-Risk Series

sustained. A key action within the criterion for demonstrated progress is 

implementing recommendations. We have made several 

recommendations to VA to address outdated systems such as its 

scheduling and community care claims processing systems, but VA has 

not yet implemented these recommendations. For example, in May 2016, 

we recommended that VA develop a sound plan for modernizing its 

claims processing system. We found that, due to recent increases in 

utilization of community care, VA has had difficulty with the timely 

processing of claims from community providers and the contractors 

responsible for administering the Veterans Choice Program. VA officials 

and claims processing staff indicated that IT limitations, manual 

processes, and staffing challenges had delayed claims processing. The 

department had implemented interim measures to address some of the 

system’s challenges, but it did not expect to deploy solutions to address 

all challenges, including those related to IT, until fiscal year 2018 or later.

When identifying this area of concern in our 2015 high-risk report, we 

described several gaps in VA’s training, as well as burdensome training 

requirements, that we found in our prior work. Since we issued the 2015 

report, VA has expressed its desire to improve the department’s 

standardization and management of training, but has not met any of our 

criteria for removing this area of concern from the High-Risk List.

VA has not met our criterion for leadership commitment. In its action plan 

discussing this area of concern, VA described its intention to establish a 

comprehensive health care training management policy and a mandatory 

annual training process. However, as of December 2016, VA officials said 

they had not begun drafting the policy, which would replace an outdated 

document from 2002 that contains training requirements that are no 

longer relevant. In addition, with respect to the mandatory annual training 

Inadequate Training for VA 

Staff

Leadership Commitment
Managing Risks and Improving VA Health Care

Page 645 GAO-17-317 High-Risk Series

process, VA’s action plan states that it will set goals that enable VA 

medical center involvement in training planning, but those goals are not 

fully articulated in the document. The high-level nature of the descriptions 

in the action plan and lack of action to update outdated policies and set 

goals for improving training shows that VA lacks leadership commitment 

to address the concerns that led to our inclusion of this area in the 2015 

high-risk report.

VA also has not demonstrated that it has the capacity to address our 

concerns regarding inadequate training. Since identifying these concerns 

in our 2015 high-risk report, we have continued to find VA health care 

training gaps that need to be addressed. VA needs to determine the 

resources needed, actions required, and systems that need to be 

established to support improvements in how it manages training.

In our September 2015 report on nurse recruitment and retention, for 

example, we found that VA did not know whether its medical center staff 

had sufficient training to support its national initiatives to recruit and retain 

nurses. As a result, we recommended that VA evaluate the adequacy of 

these training resources to help ensure the effective recruitment and 

retention of nurses across VA medical centers. In our December 2016 

report on VHA’s human resources (HR) capacity, we found that VA’s 

competency assessment tool did not address two of the three personnel 

systems under which VHA staff may be hired. We recommended that 

VHA (1) develop a comprehensive competency assessment tool for HR 

staff that evaluates knowledge of all three of VHA’s personnel systems 

and (2) ensure that all VHA HR staff complete it so that VHA may use the 

data to identify and address competency gaps among HR staff. Without 

such a tool, VHA will have limited insights into the abilities of its HR staff 

and be ill-positioned to provide necessary support and training.

VA also has not met the action plan criterion for this area of concern. In 

its action plan, VA identified an outdated 2002 policy and a decentralized 

approach to training as potential root causes of the lack of effective 

training management and oversight we previously identified. VA did not, 

however, take the additional steps in its action plan of conducting an 

analysis to confirm its assumptions. It is also not clear from the action 

plan whether VA plans to establish clear milestones and metrics to review 

and measure its progress in addressing the root causes of inadequate 

training for VA staff.

VA has not met the monitoring criterion because, without clear milestones 

and metrics, VA does not have a means of tracking performance 

Capacity

Action Plan

Monitoring
Managing Risks and Improving VA Health Care

Page 646 GAO-17-317 High-Risk Series

measures and its progress against goals. One key monitoring action is 

reporting on program progress to senior managers. VA’s action plan for 

this area states that VHA leadership, including the VHA Under Secretary 

for Health, will review and approve an annual training plan, but the action 

plan does not describe what data will support that review, and how it will 

define progress against goals.

Because VA’s comprehensive training management strategy is in the 

early stages of development, VA has not met the criterion for 

demonstrated progress in addressing this high-risk area of concern. 

Without clear priorities and goals for improving training, an action plan 

with clear milestones and metrics, and data to support reports on 

progress, it is not possible for VA to demonstrate progress in effectively 

addressing this area.

In our prior work, we reported on gaps in the availability of data needed 

for VA to identify the resources it needs and ensure they are effectively 

allocated across VA’s health care system. We included this area of 

concern when we designated VA health care as a high-risk area in 2015. 

Over the past 2 years, VA’s actions have partially met our criterion for 

leadership commitment but not met the other four criteria for removing 

this area of concern from the High-Risk List.

VA has partially met our criterion for leadership commitment. In its action 

plan, VA reported adopting a framework in 2016 called “Managing for 

Results” to improve its strategic planning and budgeting process. VA 

anticipates that this framework will better connect VA’s requirements 

setting process (that forecasts veterans’ needs) with its process for 

developing the department’s budget. VA states that full implementation of 

the Managing for Results framework will take place over several budget 

Demonstrated Progress

Unclear Resource Needs 

and Allocation Priorities

Leadership Commitment
Managing Risks and Improving VA Health Care

Page 647 GAO-17-317 High-Risk Series

cycles. However, VA’s planned actions do not make clear how VHA, as 

the agency managing VA health care, is or will be incorporated into VA’s 

department-level framework, or how that framework will be communicated 

and reflected at the regional network and medical center levels. Actions 

that will assist VA in demonstrating progress in leadership commitment 

for this area of concern include clarifying the role and responsibilities of 

VHA in the Managing for Results framework, and ensuring continued 

oversight and accountability of the framework’s implementation.

VA has not met our criterion for capacity for this area of concern. In its 

action plan, VA names several initiatives that are underway to enable 

Managing for Results, including establishing a mission-requirementsplanning function to supply the ground rules and assumptions necessary 

to inform cost analysis of major VA initiatives. However, VA does not 

explain how it intends to establish the mission-requirements-planning 

function, or what resources may be necessary to establish and maintain 

that function at the national and local levels. Understanding the resources 

necessary to establish a new process can help to identify skills gaps and 

training that VA staff may need to facilitate implementation.

VA has not met our action plan criterion for this area of concern because 

it has not established performance measures based on a root cause 

analysis of its unclear resource needs and allocation priorities. VA’s 

action plan states that the fragmented nature of the department’s data 

and information management systems limits its ability to integrate 

priorities, requirements, and solutions. While Managing for Results is 

intended to facilitate that integration, the action plan does not contain an 

analysis or explanation for how VA determined that fragmented systems 

was a cause of unclear resource needs and allocation priorities, or how 

their chosen framework would address that cause. As a result, VA lacks 

reasonable assurance that planned actions are addressing the root cause 

of the problem.

In our October 2016 report on VHA’s strategic planning, we 

recommended VHA develop strategies with clear milestones. We found 

that VHA did not consistently develop strategies for regional network and 

medical center officials to operationalize VA’s strategic goals and 

objectives for VA health care. Among other things, our previous work has 

shown that strategies should have clearly defined milestones, outline how 

an organization will hold managers and staff accountable for achieving its 

goals, and be linked to the day-to-day activities of the organization. In 

addition, individual strategies should be linked to a specific goal or 

objective. We found that, without developing adequate strategies to 

Capacity

Action Plan
Managing Risks and Improving VA Health Care

Page 648 GAO-17-317 High-Risk Series

correspond to all of its strategic goals and objectives, VHA’s regional 

networks and medical centers had limited guidance to help them 

operationalize VA’s strategic goals and objectives. Moreover, the day-today activities and initiatives developed by VHA regional networks and 

medical centers may not appropriately align with national goals and 

objectives for VA health care. Directly aligning strategic goals and their 

associated strategies is important in assessing an organization’s ability to 

achieve those goals.

VA has not met our criteria for monitoring because its planned actions do 

not address our previously stated concerns about data quality. VA’s 

planned actions to address unclear resource needs and allocation 

priorities include incorporating information from VHA’s resource allocation 

model, enrollment projection model, and health care staffing utilization 

data to improve the accuracy of its resource decisions. However, we have 

described our concerns about the accuracy of data used for health care 

resourcing decisions in our 2015 high-risk report, as well as in our June 

2016 report examining VA’s projected fiscal year 2015 funding gap. In the 

2016 report, we found that VA’s weaknesses in estimating costs and 

tracking obligations as use of VA’s community care programs increased 

was one reason for VA’s projected funding gap. To better align cost 

estimates for community care services with associated obligations, we 

reported that VA was examining options for replacing its outdated 

financial IT systems, a plan that is reiterated in VA’s high-risk action plan, 

with a projected completion date of fiscal year 2020. However, VA’s highrisk action plan states that updating its financial management system will 

only partly address the capability gap associated with having the systems 

necessary to extract cost data. VA has made previous, unsuccessful, 

attempts to update its financial IT systems. To show progress in 

monitoring actions, VA will need to ensure data quality and regularly 

review its status and performance compared to its goals.

VA has not demonstrated progress in addressing its unclear resource 

needs and allocation priorities for VA health care because there are 

weaknesses in its process for evaluating and implementing 

recommendations—a key action for demonstrating progress. For 

example, in our September 2016 report on VHA’s organizational 

structure, we found that VA devoted significant time, effort, and funds to 

generate recommendations for organizational structure changes intended 

to improve the efficiency of VHA operations. However, the department 

then either did not act or acted slowly to implement the recommendations. 

Without robust processes for evaluating and implementing 

recommendations, there is little assurance that VHA’s delivery of health 

Monitoring

Demonstrated Progress
Managing Risks and Improving VA Health Care

Page 649 GAO-17-317 High-Risk Series

care to the nation’s veterans will improve. We recommended that VA 

develop a process to ensure that it evaluates organizational structure 

recommendations resulting from internal and external reviews of VHA. 

This process should include documenting decisions and assigning 

officials or offices responsibility for ensuring that approved 

recommendations are implemented. Such a process will help VA ensure 

that it is using resources efficiently, monitoring and evaluating 

implementation, and holding officials accountable.

Both Congress and VA have taken action to address our high-risk 

designation. In July 2015, the VA Budget and Choice Improvement Act 

directed VA to, among other things, include in its annual budget 

submission a new appropriations account for medical care delivered by 

community providers. Beginning in fiscal year 2017, Congress began 

funding community care through this new Medical Community Care 

appropriations account. This should allow VA to better ensure that 

sufficient funds are available for community care in the future.

• In November 2014, we reviewed data that VA collects on veteran 

suicides. We found that the data were not always complete, accurate, 

or consistent because the medical centers we reviewed differed in 

how they interpreted and used templates for collecting the data. We 

made six recommendations, including that VA clarify guidance on how 

to complete these templates and ensure that medical centers have a 

process to review them. In response, VA took several actions in 2015, 

including analyzing diagnostic coding practices at medical centers, 

adding more specific guidance on how to complete the templates, and 

requiring medical center leadership to review the templates. These 

actions positioned VA to collect consistent data to better inform its 

suicide prevention efforts, and we closed all six report 

recommendations as implemented in fiscal year 2016.

• In July 2015, we reported on VA medical centers’ use of root cause 

analysis—a process used to identify and evaluate the systems or 

processes that caused an adverse health event, such as a missed or 

delayed diagnosis. We found that VA medical centers had completed 

18 percent fewer root cause analyses in fiscal year 2014 compared to 

fiscal year 2010. VHA had not analyzed the reasons for the decrease, 

which could have been due to medical centers using alternative 

processes. We recommended that VA determine the extent to which 

medical centers are using alternative processes and collect 

information on the number and results of those alternative processes. 

In September 2015, VA developed and fielded a survey to all medical 

Benefits Achieved by 

Implementing Our 

Recommendations
Managing Risks and Improving VA Health Care

Page 650 GAO-17-317 High-Risk Series

centers to assess the degree they were using alternative processes to 

address the root causes of adverse events when a root cause

analysis is not required. By collecting this information, VA increased 

its awareness of medical center actions to address the root causes of 

adverse events.

• For our 2011 review of VA’s purchasing, tracking, and reprocessing of 

expendable medical supplies (e.g., needles) and reusable medical 

equipment (e.g., endoscopes), we examined VA’s requirements as 

well as VA central office and regional network oversight processes. 

We found that both the tracking and reprocessing requirements we 

reviewed were inadequate to help ensure the safety of veterans who 

receive care at medical centers. We also found that VA central office 

did not analyze regional network reports on noncompliance with 

reusable medical equipment policies to inform its oversight. As such, 

we made four recommendations, including that VA develop and 

implement an approach for providing standardized training for 

reprocessing reusable medical equipment; hold VAMCs accountable 

for implementing the training; and use the regional network reports of 

noncompliance to take action to improve compliance in areas such as 

those that occur frequently, pose high risks to veterans’ safety, or 

have not been addressed. In 2015 and 2016, VA took action to 

require standardized training for reprocessing reusable medical 

equipment and oversight of reprocessing activities, issue guidance to 

clarify regional networks’ oversight responsibility, and identify areas of 

noncompliance that occur frequently and issue guidance to help 

address this noncompliance. All recommendations from this report 

have been closed as implemented.

For additional information about this high-risk area, contact Debra Draper 

at (202) 512-7114 or draperd@gao.gov, or Randall Williamson at (202) 

512-7114 or williamsonr@gao.gov.

Veterans Health Administration: Management Attention Is Needed to 

Address Systemic, Long-standing Human Capital Challenges. 

GAO-17-30. Washington, D.C.: December 23, 2016.

VA Health Care: Improved Monitoring Needed for Effective Oversight of 

Care for Women Veterans. GAO-17-52. Washington, D.C.: December 2, 

2016.

GAO Contacts

Related GAO 

Products
Managing Risks and Improving VA Health Care

Page 651 GAO-17-317 High-Risk Series

Veterans Health Care: Improvements Needed in Operationalizing 

Strategic Goals and Objectives. GAO-17-50. Washington, D.C.: October 

21, 2016.

VA Health Care: Processes to Evaluate, Implement, and Monitor 

Organizational Structure Changes Needed. GAO-16-803. Washington, 

D.C.: September 27, 2016.

Veterans’ Health Care: Improved Oversight of Community Care 

Physicians’ Credentials Needed. GAO-16-795. Washington, D.C.: 

September 19, 2016.

VA IT Management: Organization Is Largely Centralized; Additional 

Actions Could Improve Human Capital Practices and Systems 

Development Processes. GAO-16-403. Washington, D.C.: August 17, 

2016.

Veterans Affairs: Sustained Management Attention Needed to Address 

Numerous IT Challenges. GAO-16-762T. Washington, D.C.: June 22, 

2016.

VA’s Health Care Budget: In Response to a Projected Funding Gap in 

Fiscal Year 2015, VA Has Made Efforts to Better Manage Future 

Budgets. GAO-16-584. Washington, D.C.: June 3, 2016.

Veterans Crisis Line: Additional Testing, Monitoring, and Information 

Needed to Ensure Better Quality Service. GAO-16-373. Washington, 

D.C.: May 26, 2016.

Veterans’ Health Care: Proper Plan Needed to Modernize System for 

Paying Community Providers. GAO-16-353. Washington, D.C.: May 11, 

2016.

VA Health Care: Actions Needed to Improve Newly Enrolled Veterans’

Access to Primary Care. GAO-16-328. Washington, D.C.: March 18, 

2016.

DOD and VA Health Care: Actions Needed to Help Ensure Appropriate 

Medication Continuation and Prescribing Practices. GAO-16-158. 

Washington, D.C.: January 5, 2016.

VA Mental Health: Clearer Guidance on Access Policies and Wait-Time 

Data Needed. GAO-16-24. Washington, D.C.: October 28, 2015.
Managing Risks and Improving VA Health Care

Page 652 GAO-17-317 High-Risk Series

VA Primary Care: Improved Oversight Needed to Better Ensure Timely 

Access and Efficient Delivery of Care. GAO-16-83. Washington, D.C.: 

October 8, 2015.

VA Health Care: Oversight Improvements Needed for Nurse Recruitment 

and Retention Initiatives. GAO-15-794. Washington, D.C.: September 30, 

2015.

Electronic Health Records: Outcome-Oriented Metrics and Goals Needed 

to Gauge DOD’s and VA’s Progress in Achieving Interoperability. 

GAO-15-530. Washington, D.C.: August 13, 2015.
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 653 GAO-17-317 High-Risk Series

Since 2015, the Program Manager (Program Manager) for the Information 

Sharing Environment (ISE) and key departments and agencies have 

made significant progress to strengthen how intelligence on terrorism, 

homeland security, and law enforcement, as well as other information 

(collectively referred to in this section as terrorism-related information) is 

shared among federal, state, local, tribal, international, and private sector 

partners. As a result, the Program Manager and key stakeholders have 

met all five criteria for addressing our high risk designation, and we are 

removing this issue from our High-Risk List. While this progress is 

commendable, it does not mean the government has eliminated all risk 

associated with sharing terrorism-related information. It remains 

imperative that the Program Manager and key departments and agencies 

continue their efforts to advance and sustain the ISE. Continued oversight 

and attention is also warranted given the issue’s direct relevance to 

homeland security as well as the constant evolution of terrorist threats 

and changing technology. As we have with areas previously removed 

from the High-Risk List, we will continue to monitor this area, as 

appropriate, to ensure that the improvements are sustained. If significant 

problems again arise, we will consider reapplying the high risk 

designation.

The Program Manager, the individual responsible for planning, 

overseeing, and managing the ISE, along with the key departments and 

agencies—the Departments of Homeland Security (DHS), Justice (DOJ), 

State (State), and (DOD), and the Office of the Director of National 

Intelligence (ODNI)—are critical to implementing and sustaining the ISE.1

Following the terrorist attacks of 2001, Congress and the executive 

branch took numerous actions aimed explicitly at establishing a range of 

new measures to strengthen the nation’s ability to identify, detect, and 

deter terrorism-related activities. For example, the ISE was established in 

accordance with the Intelligence Reform and Terrorism Prevention Act of 

2004 (Intelligence Reform Act), as amended, to facilitate the sharing of 

 1

The Office of the Program Manager for the ISE is situated within and funded through 

amounts appropriated to ODNI. Additional departments and agencies also participate in 

the ISE, including Air Force Intelligence, Surveillance, and Reconnaissance; Central 

Intelligence Agency; Department of Commerce; Department of Energy; Department of 

Health and Human Services; Department of the Interior; Department of Transportation; 

Department of the Treasury; National Counterterrorism Center; National GeospatialIntelligence Agency; and National Reconnaissance Office.

Establishing Effective Mechanisms for 

Sharing and Managing Terrorism-Related 

Information to Protect the Homeland

Why Area Was High 

Risk
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 654 GAO-17-317 High-Risk Series

terrorism-related information.2 Figure 22 depicts the relationship between 

the various stakeholders and disciplines involved with the sharing and 

safeguarding of terrorism-related information through the ISE.

Figure 22: Elements of the Information Sharing Environment 

The federal government has made significant progress in promoting the 

sharing of information on terrorist threats, and has met all of our criteria 

for removal from the High-Risk List. The Program Manager and key 

departments and agencies met the leadership commitment and capacity 

criteria in 2015, and have subsequently sustained efforts in both these 

areas. For example, the Program Manager clearly articulated a vision for 

the ISE that reflects the government’s terrorism-related information 

sharing priorities. Key departments and agencies also continued to 

allocate resources to operations that improve information sharing, 

including developing better technical capabilities.

The Program Manager and key departments and agencies also 

developed, generally agreed upon, and executed the 2013 Strategic 

 2 See Pub. L. No. 108-458, § 1016, 118 Stat. 3638, 3664-70 (2004) 6 U.S.C. § 485). See 

also 6 U.S.C. § 482 (requiring the establishment of procedures for the sharing of 

homeland security information).

What GAO Found
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 655 GAO-17-317 High-Risk Series

Implementation Plan (Implementation Plan), which includes the overall 

strategy and more specific planning steps to achieve the ISE.3 Further, 

they have demonstrated that various information sharing initiatives are 

being used across multiple agencies as well as state, local, and private 

sector stakeholders. For example, the Project Manager has developed a 

comprehensive framework for managing enterprise architecture to help 

share and integrate terrorism-related information among multiple 

stakeholders in the ISE.4 Specifically, the Project Interoperability initiative 

includes technical resources and other guidance that promote greater 

information system compatibility and performance.5 Furthermore, the key 

departments and agencies have applied the concepts of the Project 

Interoperability initiative to improve mission operations by better linking 

different law enforcement databases, and facilitating better geospatial 

analysis, among other things.

In addition, the Program Manager and key departments and agencies 

have continued to devise and implement ways to measure the effect of 

the ISE on information sharing to address terrorist and other threats to the 

homeland. They developed performance metrics for specific informationsharing initiatives (e.g., fusion centers) used by various stakeholders to 

receive and share information. The Program Manager and key 

departments and agencies have also documented mission-specific 

 3

Office of the Program Manager for the Information Sharing Environment, Strategic 

Implementation Plan for the National Strategy for Information Sharing and Safeguarding

(Washington, D.C.: December 2013). In December 2012, the President signed the 

National Strategy for Information Sharing and Safeguarding, which provides guidance on 

implementing policies, standards, and technologies that promote secure and responsible 

national security information sharing. This document builds on the 2010 National Security 

Strategy and the 2007 National Strategy for Information Sharing. The December 2012 

national strategy identifies priority objectives, which have been incorporated into the 

Implementation Plan.

4

An enterprise architecture, or modernization blueprint, is intended to provide a clear and 

comprehensive picture of an entity, whether it is an organization (e.g., federal department 

or agency) or a functional or mission area that cuts across more than one organization 

(e.g., financial management). This picture consists of snapshots of the enterprise’s current 

and target operational and technological environments, and contains a road map for 

transitioning from the current to the target environment.

5

Project Interoperability refers to a collection of policies and guidance related to 

information interoperability. Information interoperability is the ability to share and use 

information in a consistent, efficient way across multiple organizations and information 

technology (IT) systems to accomplish operational missions. From a technical 

perspective, interoperability refers to the capability of systems to communicate with one 

another and to exchange and use information and is achieved developed in part by using 

common technical standards and definitions to manage information.
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 656 GAO-17-317 High-Risk Series

accomplishments (e.g., related to maritime domain awareness) where the 

Program Manager helped connect previously incompatible information 

systems. The Program Manager has also partnered with DHS to create 

an Information Sharing Measure Development Pilot that intends to better 

measure the effectiveness of information sharing across all levels of the 

ISE.

Further, the Program Manager and key departments and agencies have 

used the Implementation Plan to track progress, address challenges, and 

substantially achieve the objectives in the National Strategy for 

Information Sharing and Safeguarding. The Implementation Plan contains 

16 priority objectives, and by the end of fiscal year 2016, 13 of the 16 

priority objectives were completed. The Program Manager transferred the 

remaining 3 objectives, which were all underway, to other entities with the 

appropriate technical expertise to continue implementation through fiscal 

year 2019.

In our 2013 high-risk update, we listed nine action items that were critical 

for moving the ISE forward. In that report, we determined that two of 

those action items—demonstrating that the leadership structure has the 

needed authority to leverage participating departments, and updating the 

vision for the ISE—had been completed. In our 2015 update, we 

determined that the Program Manager and key departments had 

achieved four of the seven remaining action items—demonstrating that 

departments are defining incremental costs and funding; continuing to 

identify technological capabilities and services that can be shared 

collaboratively; demonstrating that initiatives within individual departments 

are, or will be, leveraged to benefit all stakeholders; and demonstrating 

that stakeholders generally agree with the strategy, plans, time frames, 

responsibilities, and activities for substantially achieving the ISE.

For the 2017 update, we determined that the remaining three action items 

have been completed: establishing an enterprise architecture 

management capability; demonstrating that the federal government can 

show, or is more fully developing a set of metrics to measure, the extent 

to which sharing has improved under the ISE; and demonstrating that 

established milestones and time frames are being used as baselines to 

track and monitor progress. Achieving all nine action items has, in effect, 

addressed our high-risk criteria.

While this demonstrates significant and important progress, sharing 

terrorism-related information remains a constantly evolving work in 

progress that requires continued effort and attention from the Program 
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 657 GAO-17-317 High-Risk Series

Manager, departments, and agencies. Although no longer a high-risk 

issue, sharing terrorism-related information remains an area with some 

risk and continues to be vitally important to homeland security, requiring 

ongoing oversight as well as continuous improvement to identify and 

respond to changing threats and technology. Table 11 summarizes the 

Program Manager’s and key departments’ and agencies’ progress in 

achieving the action items.

Table 11: Status of Action Items Required to Remove Terrorism-Related Information Sharing from GAO’s High-Risk List

Action Items Action 

Item 

Status

High-Risk Category

Demonstrate that the Information Sharing and Access Interagency Policy Committee has 

needed authority, is leveraging participating departments, and is producing results.

Meta Leadership Commitment

Update the vision for the Information Sharing Environment (ISE)—the information sharing 

capabilities and procedures that need to be in place to help ensure terrorism-related 

information is accessible and identifiable to relevant federal, state, local, private, and foreign 

partners.

Meta Leadership Commitment

Demonstrate that departments are defining incremental costs and funding needed to 

complete the responsibilities and activities which substantially achieve the ISE.

Metb Capacity to resolve risk

Continue to identify technological capabilities and services that can be shared collaboratively

within and across the ISE, consistent with a federated architecture approach.

Metb Capacity to resolve risk

Demonstrate that initiatives within individual departments are, or will be, leveraged to benefit 

all relevant federal, state, local, and private security stakeholders participating in the ISE.

Metb Action plans that provide 

corrective measures

Establish an enterprise architecture management capability and demonstrate that it will be 

used to guide selection of projects for substantially achieving the ISE.

Met Action plans that provide 

corrective measures

Demonstrate that stakeholders generally agree with the strategy, plans, time frames, their 

responsibilities, and their activities for substantially achieving the ISE.

Metb Action plans that provide 

corrective measures

Demonstrate that the federal government can show the extent to which sharing has 

improved under the ISE, or can show it has actions underway to more fully develop a set of 

metrics and processes to measure results achieved, both from individual projects and 

activities, as well as from the overall ISE.

Met Monitor and validate the 

effectiveness of corrective 

measures

Demonstrate that established milestones and time frames are being used as baselines to 

track and monitor progress on individual projects and in substantially achieving the overall 

ISE.

Met Demonstrated Progress

Source: GAO analysis of Office of the Program Manager for the Information Sharing Environment and key department documents, interviews, and prior GAO reports. | GAO-17-317.

a

We determined that these action items were complete in our 2013 high-risk update.

b

We determined that these action items were complete in our 2015 high-risk update.
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 658 GAO-17-317 High-Risk Series

In our 2013 high-risk update, we reported that the federal government 

had fundamentally met this high-risk criterion—primarily because it had 

established an interagency policy committee to leverage the efforts of 

participating departments and agencies. In addition, the Program 

Manager has continued to update the vision for the ISE as information 

sharing initiatives have evolved. Further, since 2013, the government has 

issued and largely executed the Implementation Plan and taken other 

actions, which demonstrate continued leadership commitment.

With the majority of Implementation Plan priority objectives completed in 

fiscal year 2016, the Program Manager has updated the vision and led 

the establishment of new goals to strengthen the ISE. For example, now 

that terrorism-related information sharing among key federal departments 

and agencies has matured, the Program Manger is expanding 

collaboration on information sharing initiatives with state, local, tribal, 

territorial, and private sector partners. This includes promoting the use of 

interoperable systems and disseminating best practices for sharing and 

safeguarding information. According to the Program Manager, this 

expanded stakeholder engagement is necessary given the increasing 

overlap of national security and public safety.

Although the future of the ISE after the Implementation Plan is fully 

executed will depend in part on the policies of the incoming 

administration, the Program Manager has demonstrated leadership in 

shifting focus to sustaining the progress achieved in the ISE, while also 

promoting its expansion to non-federal partners. As the ISE and terrorist 

threats have continued to evolve, entities aside from the Program 

Manager will have increased leadership roles. For example, in addition to 

the key departments and agencies, the Standards Coordinating Council 

(SCC) and the Criminal Intelligence Coordinating Council (CICC) have 

Additional Details on 

What GAO Found

Leadership Commitment
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 659 GAO-17-317 High-Risk Series

assumed key roles in governing ISE activities.6 The SCC is the focal point 

for advancing core interoperability frameworks and standards, and the 

CICC is a key forum for federal and non-federal entities to develop, 

implement, and align information sharing platforms, according to the 2016 

Information Sharing Environment Annual Report to the Congress.7 In 

addition, the SCC and CICC will have key roles in overseeing the three 

Implementation Plan priority objectives not completed in fiscal year 2016. 

Updating the vision for the ISE, including the expanded leadership roles 

for entities like the SCC and CICC, helps ensure terrorism-related 

information is accessible and identifiable to relevant federal, state, local, 

private, and foreign partners.

As we reported in 2015, key departments and agencies have also played 

an increased leadership role by serving as stewards for the priority 

objectives in the Implementation Plan. For example, DHS led the 

implementation of the priority objective on fusion centers, which was 

completed in fiscal year 2015, and has continued to lead efforts in this 

area as the vision for the ISE evolves. Additionally, departments and 

agencies have taken various actions to govern their own information 

sharing activities and to coordinate with the ISE. For example, DHS has 

used a governance board to serve as the decision-making body for DHS 

information-sharing issues since 2007. This board has identified 

information-sharing gaps and has developed a list of key initiatives to help 

address those gaps. Many of these initiatives—such as those related to 

safeguarding information—are consistent with established priorities for 

the ISE.

Among other things, the federal government met this high-risk criterion in 

2015 by changing its approach to funding information-sharing activities. 

 6

The SCC oversees the development of information sharing and safeguarding standards, 

including technical standards that promote interoperability and data exchanges. Members 

include industry consortia, standards development organizations, and federal entities,

including DHS and the Program Manager. The CICC supports state, local, and tribal law 

enforcement and homeland security agencies in their ability to develop and share criminal 

and terrorism-related intelligence and information nationwide. Members include 

intelligence and law enforcement officials from across all levels of government, including 

the Program Manager.

7

The Information Sharing Environment Annual Report to Congress examines the extent to 

which the mandate in the Intelligence Reform and Terrorism Prevention Act of 2004, as 

amended— to establish an ISE, and for sharing terrorism-related information in general, 

—is being implemented. See 6 U.S.C. § 485(h).

Capacity
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 660 GAO-17-317 High-Risk Series

Specifically, key departments are funding ISE-related activities as part of 

mission activities and operations instead of seeking separate funds. 

Additionally, the Implementation Plan defines the fundamental 

technological capabilities and services for advancing the ISE. The 

Program Manager and key departments and agencies also satisfied this 

high-risk criterion through their progress in identifying technological 

capabilities and services that can be shared collaboratively within and 

across the ISE, consistent with a federated architecture approach.8

As we reported in 2015, regarding the government’s approach to funding, 

senior officials in each key department or agency explained that any 

incremental costs related to implementing the ISE continue to be 

embedded within each department’s mission activities and operations and 

do not require separate funding. The Program Manager and department 

and agency officials also noted that the Implementation Plan assigned 

priority objectives to those departments and agencies whose missions 

most align with the initiatives under each objective, thereby helping to 

ensure that the activities received funding.

The Program Manager and key departments and agencies have also 

defined and established technological capabilities and services which 

improve information sharing. For example, a key initiative to develop 

capacity for the ISE is the Federal Identity Credential and Access 

Management (FICAM) program. FICAM’s goal is to control access to 

sensitive information on computer networks while also providing 

authorized users the information they need. FICAM comprises, among 

other things, the technologies and services used to create trusted digital 

credentials that can be used to verify and provide individuals authorized 

access to an agency’s information. This helps ensure that information can 

be shared without the threat of security breaches. Seven specific 

milestones associated with the Implementation Plan’s FICAM priority 

objective were completed by the end of fiscal year 2016. For example, the 

working group charged with implementing this priority objective developed 

various documents, such as baseline credentialing assessments for 

unclassified and classified security domains, and digital policy 

governance guidance. Key departments, including DHS and DOJ, have 

 8

Under a federated approach, the architecture consists of a family of coherent but distinct 

member architectures that conform to an overarching corporate or parent architecture 

approach. As such, member architectures (e.g., component, subordinate, or subsidiary 

architectures) are substantially autonomous, but they also inherit certain rules, policies, 

procedures, and services from the parent architectures
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 661 GAO-17-317 High-Risk Series

begun to adopt these standards, an important step in developing federal 

capabilities to establish individual accountability and facilitate the 

appropriate level of information access.

There are multiple priority objectives in the Implementation Plan that 

further the capacity to identify and share technical capabilities within and 

across the ISE. For instance, the priority objective on discovering and 

accessing information addresses the ability to discover that information 

exists and retrieve it. According to the results of a 2014 questionnaire 

administered by the Office of the Program Manager, over 80 percent of 

agencies reported improvements over the previous year in their ability to 

discover, access, and retrieve information necessary to accomplish their 

missions. As of December 2016, the remaining milestones associated 

with this priority objective were expected to be completed by fiscal year 

2019, according to the Program Manager and key department 

documentation.

The Implementation Plan also contains an objective dedicated to 

standards-based acquisition, which seeks to ensure that future products 

and services are interoperable and can easily exchange and interpret 

data. The goal of this objective is to develop common technical standards 

to guide all departments and agencies when they acquire new 

technologies. The five milestones contained under this objective were 

completed in fiscal year 2016, including developing a standards 

handbook. The Implementation Plan also identifies capacity-related 

activities consistent with a federated architecture approach, such as 

identifying technological capabilities and services to be used across 

communities of interest. For example, ISE stakeholders developed a 

repository of capabilities and services as part of the priority objective on 

interoperability. These knowledge resources include a web-based 

collection of tools, best practices, and frameworks for improving 

information interoperability.

The government has met this high-risk criterion by developing and largely 

executing the Implementation Plan, leveraging information-sharing 

initiatives across the government, and improving enterprise architecture 

management as recommended in our 2011 report on the ISE.9

 9

GAO, Information Sharing Environment: Better Road Map Needed to Guide 

Implementation and Investments, GAO‐11‐455 (Washington, D.C.: July 21, 2011).

Action Plan
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 662 GAO-17-317 High-Risk Series

Developing and executing the Implementation Plan were important steps 

for the ISE, and as we have reported, are characteristics that can 

enhance the usefulness of national strategies.10 Specifically, the Program 

Manager and key departments and agencies generally agreed with the 

plan’s actions and time frames to advance the ISE. Further, the Program 

Manager has demonstrated that ISE stakeholders have taken steps to 

implement concepts promoted by the Project Interoperability initiative, 

including those contained in the Information Interoperability Framework 

(I2F).

In addition to identifying key initiatives—such as those intended to control 

information access, safeguard information, increase a user’s ability to 

search for relevant information, and increase interoperability among data 

systems—the Implementation Plan seeks to address gaps in information 

sharing that ISE stakeholders identified and that we highlighted in our 

2013 and 2015 high-risk reports. For example, the plan establishes a 

priority objective dedicated to information sharing with the private sector. 

This objective seeks to ensure that processes and procedures are in 

place for identifying threats, including those related to cybersecurity and 

to critical infrastructure—such as financial institutions, commercial 

facilities, and energy production and transmission facilities, among others. 

The Program Manger and key departments and agencies reached 

agreement on and completed all four milestones associated with the 

private sector priority objective by the end of fiscal year 2016. Among 

other things, this effort is intended to make appropriate fusion center 

products accessible to critical infrastructure owners and operators, and 

identify systems tools that provide near real time situational awareness of 

critical infrastructure vulnerabilities across the law enforcement and 

intelligence communities.

As we reported in 2015, initiatives within individual departments have 

been leveraged to benefit relevant federal, state, local, and private 

security stakeholders participating in the ISE. For example, the Federal 

Bureau of Investigation’s (FBI) eGuardian system allows law enforcement 

agencies to submit suspicious activity reports into a single system that is 

accessible by thousands of law enforcement personnel.11 In a 2014 

 10GAO, Combating Terrorism: Evaluation of Selected Characteristics in National 

Strategies Related to Terrorism, GAO‐04‐408T (Washington, D.C.: Feb. 3, 2004).

11See GAO, Information Sharing: Additional Actions Could Help Ensure That Efforts to 

Share Terrorism-Related Suspicious Activity Reports Are Effective (Washington, D.C: 

Mar. 13, 2013).
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 663 GAO-17-317 High-Risk Series

survey administered by the Program Manager, numerous agencies also 

mentioned that they were leveraging the fusion center information sharing 

initiative. Specifically, all agencies that answered the 2014 question 

related to fusion center progress reported satisfaction with improvements 

made in the last year to enhance the capabilities and performance of the 

national network of fusion centers. This included improving how threat 

and encounter information is shared between the federal government and 

state, local, and private partners. In November 2014, we reported on 

federal efforts to improve fusion center capabilities and results.12

Additionally, in April 2013, we reported that fusion centers, along with 

other field-based information sharing entities, provided a variety of 

analytical activities that resulted in benefits, such as intelligence 

products.13 We also recommended that DHS, DOJ, and the Office of 

National Drug Control Policy (ONDCP) collaborate to (1) identify practices 

that could enhance the coordination and reduce unnecessary overlap 

across field-based information sharing entities, and (2) develop a 

mechanism that will allow them to hold field-based information-sharing 

entities accountable for coordinating with each other. Since our report 

DHS, DOJ, and ONDCP have made significant progress toward 

addressing our recommendations. Specifically, the three agencies have 

taken the necessary steps to assess the extent to which practices that 

can enhance coordination are being implemented at fusion centers and 

other field-based information sharing entities. They have also developed 

a mechanism to hold fusion centers and other field-based information 

sharing entities accountable for coordinating their analytical and 

investigative activities. However, the FBI has not taken action on our 

recommendations for the field-based information sharing entities it leads 

and, as a result, the recommendations from our report have not been fully 

addressed.

Since 2015, the Program Manager has also made progress in action 

planning by promoting the Project Interoperability initiative, which has 

improved its enterprise architecture management capability and helped 

guide the selection of specific projects to help advance the ISE. For 

example, the Implementation Plan includes priority objectives and 

 12GAO, Information Sharing: DHS Is Assessing Fusion Center Capabilities and Results, 

but Needs to More Accurately Account For Federal Funding Provided to Centers, GAO‐15

‐155 (Washington, D.C.: Nov. 4, 2014).

13GAO, Information Sharing: Agencies Could Better Coordinate to Reduce Overlap in 

Field-Based Activities, GAO‐13‐471 (Washington, D.C.: Apr. 4, 2013).
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 664 GAO-17-317 High-Risk Series

milestones associated with establishing aspects of the ISE architecture. 

Such milestones include developing Project Interoperability and the I2F, 

key elements intended to help link systems across departments to enable 

information sharing (i.e., interoperability). For instance, the I2F calls for a 

common profile for achieving interoperability among systems, which 

among other things, can enable a user to access different departments’ or 

agencies’ databases from a single workstation. In March 2014, the 

Program Manager issued an initial version of I2F to guide the 

implementation of information-sharing capabilities. In 2016, the Program 

Manager identified several ongoing initiatives that implemented I2F 

concepts. For example, officials from the Office of the Program Manager 

provided documentation that illustrated how I2F was used and stated that 

the framework helped:

• identify security specifications for successfully exchanging data 

across various maritime partners to share information via the Maritime 

ISE, including services to publish and search for information about a 

ship’s location;

• create a virtual nationwide event deconfliction system to alert affected 

agencies or officers of potential conflicts between officers who are 

conducting law enforcement operations at the same time and in close 

proximity; and

• bridge data standards to enhance geospatial exchange capabilities 

(e.g., data embedded in maps) among mission partners, such as 

homeland security, law enforcement, emergency management, and 

public safety.

Furthermore, in December 2014, the Program Manager issued Version 

1.0 of the data tagging functional requirements document to help develop 

information discovery and access capabilities.14 Among other documents, 

this functional requirements document served to increase enterprise 

architecture management capabilities. Moreover, the Program Manager’s 

2015 and 2016 Annual Reports to Congress identified progress made in 

achieving greater systems interoperability. For example, some of the 

nation’s sensitive but unclassified networks (e.g., Homeland Security 

 14Data “tags” are metadata—“data about data” applied to resources, and are critical to the 

ability to both locate information and enable automated access control decisions. This 

document defines the minimum functional requirements of data tagging standards needed 

to facilitate interoperable Query and Discovery, Access Control, Correlation, Audit, and 

Records Management capabilities across federal networks and security domains, and sets 

forth a conceptual framework for interoperable data tagging through the introduction of 

“tag classes.”
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 665 GAO-17-317 High-Risk Series

Information Network, Regional Information Sharing Systems, Law 

Enforcement Enterprise Portal, and Intelink-U) are now interoperable, 

providing an array of services and information through a simplified signon using existing credentials. The Program Manager also stated that 

ongoing efforts to improve information sharing have informed future 

architecture efforts, including guidance associated with Project 

Interoperability 2.0, which is to provide the framework for building the next 

generation of the ISE.

The Program Manager has also made progress in using the 

Implementation Plan to hold key departments and entities accountable 

over time for executing priority objectives and milestones associated with 

establishing aspects of the ISE architecture. Specifically, the 

Implementation Plan established architecture-related milestones and time 

frames to track and monitor progress. Importantly, the Program Manager 

and key stakeholders collaborated to create the plan and generally 

agreed with its timeframes and delegation of responsibilities to advance 

the ISE. In September 2015 and July 2016, the Program Manager 

updated us on the status of executing these priority objectives, including 

milestones with revised target dates and new entities that will assume 

responsibilities to complete the priority objectives, thereby demonstrating 

that the priority objectives and milestones are monitored over time. The 

Program Manager has not yet demonstrated outcomes associated with all 

of the priority objectives because several milestones are not complete. 

We will continue to monitor these enterprise architecture activities to 

ensure that they are sustained over time.

The Program Manager and key departments and agencies have made 

sufficient progress to meet this high-risk criterion of monitoring by (1) 

implementing initiatives that show the extent to which information sharing 

has improved under the ISE and (2) continuing to develop metrics and 

processes to measure results achieved, both from individual projects and 

activities, as well as from the overall ISE. Developing effective 

performance metrics for information sharing initiatives is challenging 

given the complexity of information sharing, and the Program Manger 

acknowledged in 2016 that additional work is needed in this area. 

However, considering the collective efforts of the Program Manager’s 

performance management framework—including the Implementation 

Plan—key departments and agencies, and the ongoing Information 

Sharing Measure Development Pilot, we consider this high-risk criterion 

to be met.

Monitoring
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 666 GAO-17-317 High-Risk Series

The Program Manager has created a performance management 

framework to measure the performance of key departments and agencies 

in completing ISE initiatives, many of which are included in the 

Implementation Plan. At a high level, performance is monitored by 

executing the Implementation Plan. For example, there are clear linkages 

between the plan’s 16 priority objectives, which in turn are linked to the 5 

overarching goals in the 2012 National Strategy for Information Sharing 

and Safeguarding: collective action, common standards, shared services, 

safeguarding, and privacy. In this context, achieving milestones are a 

means of measuring progress toward the overarching strategic goals. For 

example, the 4 completed milestones under the governance priority 

objective helped advance all 5 strategic goals by identifying governance 

best practices and establishing a governance roadmap to implement 

information sharing initiatives. Table 12 illustrates the alignment between 

Implementation Plan priority objectives and national strategic goals.

Table 12: Implementation Plan Priority Objectives Aligned with National Strategy for Information Sharing and Safeguarding 

Goals

Goals

Priority objectives Collective 

action

Common 

standards

Shared 

services

Safeguarding Privacy

Governance     

Agreements   

Data tagging    

Federal Identity, Credential, and Access 

Management

 

Safeguarding  

Interoperability  

Training    

Discovery and Access     

Private sector  

Reference architecture  

Shared services 

Standards-based acquisition  

Foreign partner sharing  

Requests for information, and Alerts-WarningsNotifications

Nationwide suspicious activity reporting initiative 

Fusion centers  

Source: Office of the Program Manager for the Information Sharing Environment. | GAO-17-317.
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 667 GAO-17-317 High-Risk Series

The performance management framework also consists of several 

measures, including the Performance Assessment Questionnaire. For 

example, through the annual questionnaire, the Program Manager 

measured results from key ISE initiatives, such as the extent that 

information gathered from international partners is integrated into the 

process the government uses to screen individuals for potential terrorist 

threats. In 2016, the Program Manger reported that his office was revising 

the format of the questionnaire, in part because the Implementation Plan 

was mostly complete, but that collecting certain performance data would 

continue.

The Program Manager also developed a set of homeland security 

scenarios in 2011 to assist key departments in planning for and executing 

the ISE’s initiatives. The scenarios were designed to demonstrate 

information-sharing capabilities relevant to an agency’s mission, as well 

as to allow the Program Manager and departments to determine if the ISE 

is achieving desired capabilities. For example, 1 scenario described how 

departments need to mature their capabilities over the next 7 years such 

that an analyst does not have to manually check numerous databases to 

find information related to a suspicious activity, but rather can conduct 1 

search of linked databases from a single point of entry. Similarly, in 2016, 

the Program Manger referred to the eight “mission stories” documented 

on the Office of the Program Manager’s website as qualitative indicators 

of improved information sharing over time.

The mission stories include issue areas such as cybersecurity, 

counterterrorism, domain awareness, and interoperability, and according 

to the Program Manager, represent causal outcomes of ISE initiatives 

and are evidence of improved decision-making capability. Although the 

mission story information does not encompass quantitative metrics, it 

provides means to demonstrate the extent to which information sharing 

has improved, and results have been achieved through individual 

projects. For example, in the cybersecurity issue area, the Program 

Manager partnered with the International Association of Chiefs of Police, 

among other entities, to create the Law Enforcement Cyber Center, an 

online portal to facilitate information sharing about cyber-crime 

investigations.

Furthermore, the Program Manger and key departments have developed 

performance metrics for specific priority objectives in the Implementation 

Plan to demonstrate the extent to which information sharing has improved 

under the ISE. For example, the Program Manager led an initiative to 

measure the progress 47 agencies made implementing information 
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 668 GAO-17-317 High-Risk Series

safeguarding measures between 2011 and 2016. Specifically, the 

Program Manger solicited agency responses to 16 questionnaires that 

measured agency implementation of policy recommendations related to 

removable media, online identity management, insider threat programs, 

access control, and enterprise audit. The results of this program—which 

directly links to the Implementation Plan’s priority objective on information 

safeguarding—were used to inform executive and legislative leadership of 

the government’s progress in simultaneously sharing and protecting 

sensitive terrorism-related information, and provided a quantitative 

measure of results achieved

Separately, DHS and other stakeholders have been collecting 

performance data on fusion center capabilities since 2011, which are 

assessed and reported in annual reports. DHS uses an online selfassessment survey, which in 2015 included 128 questions and 10 data 

tables, to collect information from individual fusion centers. The results 

provide various output and outcome measures related to such areas as 

information gathering, analysis, and dissemination, and enhanced threat 

and domain awareness. The Program Manager’s and DHS’s efforts to 

establish performance metrics for areas such as information safeguarding 

and fusion centers are other means to help monitor and gain insight into 

the overall state of the ISE.

In addition, in October 2016, the Program Manager and DHS initiated a

pilot to help measure and monitor the overall performance of information 

sharing across the ISE. Specifically, the Information Sharing Measure 

Development Pilot intends to develop a new set of information sharing 

measures by analyzing how information is exchanged in various 

networks. According to DHS officials, algorithms will be used to calculate 

an Information Sharing Index that can quantify information sharing 

efficiencies across organizations, agencies, and departments regardless 

of information topic or use. The pilot project, scheduled for completion by 

the end of fiscal year 2017, will focus in part on fusion center information 

sharing. According to the Program Manager and DHS officials, the 

resulting metrics will then be applied more broadly across the ISE. The 

Program Manager and DHS have compiled a detailed Memorandum of 

Agreement, which clearly defines the project’s scope, objectives, time 

frames, and deliverables. If completed and broadly implemented, this 

performance measures initiative could be a valuable tool to assess and 

improve information sharing across the ISE.
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 669 GAO-17-317 High-Risk Series

The Program Manager and key departments and agencies have met this 

criterion primarily by using the Implementation Plan to track progress in 

implementing priority objectives and in substantially achieving the overall 

ISE. The Implementation Plan assigns stewards to each priority 

objective—in most cases, a senior official within a key department or 

agency—who have primary responsibility for coordinating, integrating, 

and synchronizing activities to achieve the priority objectives within the 

time frames established. The steward is responsible for ensuring that 

participating agencies communicate and collaborate to complete the 

objective, while also raising to senior management any issues that might 

hinder progress. Stewards are to communicate these issues via the 

Information Sharing Council (ISC), a body consisting of senior officials 

from a variety of federal departments and agencies.15

The Program Manager stated that 13 of the 16 priority objectives were 

completed by the end of fiscal year 2016. The Program Manager 

transferred the remaining 3 objectives—Data Tagging, FICAM, and 

Discovery and Access—to other entities to implement through fiscal year 

2019. Table 13 describes the 13 completed Implementation Plan priority 

objectives and examples of demonstrated progress. For example, work 

on several priority objectives—such as reference architecture and 

standards-based acquisitions—resulted in concrete guidance based on 

best practices that was then made available for stakeholders to use in 

their own organizations. The interoperability objective resulted in 

products, such as the I2F framework, that were used by multiple entities 

to improve terrorism-related information sharing across different 

information systems. Among other things, the fusion center and private 

sector priority objectives resulted in new processes that facilitated greater 

and more secure information sharing with critical infrastructure owners 

and operators.

 15The ISC was established in 2004 to advise the President and Program Manager on 

policies, procedures, guidelines, and standards related to the ISE, and to ensure proper 

coordination among stakeholders. See 6 U.S.C. § 485(g); Exec. Order No. 13,356, 

Strengthening the Sharing of Terrorism Information to Protect Americans (Aug. 27, 2004), 

69 Fed. Reg. 53,599 (Sept. 1, 2004). In 2009, the ISC was subsumed by the Information 

Sharing and Access Interagency Policy Committee (ISA IPC), an entity within the 

Executive Office of the President. In 2016, the ISC was reconstituted and replaced the ISA 

IPC in terms of overseeing the ISE. 

Demonstrated progress
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 670 GAO-17-317 High-Risk Series

Table 13: Descriptions of Completed Implementation Plan Priority Objectives and Examples of Demonstrated Progress

Priority 

objectives

Descriptions Examples of demonstrated progress 

Governance Align information sharing and safeguarding governance to 

foster better decision making, performance, accountability, 

and implementation of strategic goals.

• Identified best practices and common 

governance requirements

Agreements Develop guidelines for information sharing and 

safeguarding agreements to address common 

requirements while allowing flexibility to meet mission 

needs.

• Created a framework of recommendations 

for streamlining information sharing and 

access agreements.

Safeguarding Implement safeguarding capabilities to support information 

sharing.

• Convened a working group to determine 

safeguarding priorities, and developed 

metrics to measure implementation.

Interoperability Define and adopt baseline capabilities and common 

requirements to enable data, service, and network 

interoperability.

• Developed and implemented the 

Interoperability Framework (I2F)

Training Provide information sharing, safeguarding, and handling 

training to appropriate stakeholders using a common 

curriculum tailored to promote consistent yet flexible and 

trusted processes.

• Developed and posted core awareness 

training to Program Manager’s website.

Private sector Establish information sharing processes and sector-specific 

protocols with private sector partners to improve 

information quality and timeliness and secure the nation’s 

infrastructure.

• Made appropriate fusion center products 

accessible to critical infrastructure owners 

and operators.

Reference 

architecture

Develop a reference architecture to support a consistent 

approach to data discovery and correlation across 

disparate datasets.

• Published reference architecture document 

and other tools and guidance.

Shared services Implement the recommendations and activities of the 

Federal Information Technology Shared Services Strategy 

among appropriate stakeholders to facilitate adoption of 

shared services.

• Implemented program for shared service 

offerings across the federal government.

Standards-based 

acquisition

Refine processes enabling standards-based acquisitions 

among departments and agencies, standards bodies, and

vendors to promote interoperable products and services.

• Developed and published “Acquisitions 

Playbook” to provide guidance to 

departments, agencies, and other entities. 

Foreign partner 

sharing

Promote adherence to existing interagency processes to 

coordinate information sharing initiatives with foreign 

partners, as well as adopt and apply necessary guidelines 

to ensure consistency when sharing and safeguarding 

information.

• Catalogued existing agreement templates 

and models to guide foreign partner sharing. 

Requests for 

information, and 

Alerts-WarningsNotifications

Create a common process across all levels of government 

for Requests for Information (RFIs) to enable timely receipt 

and dissemination of information and appropriate response.

Create a common process across all levels of government 

for Alerts, Warnings, and Notifications (AWN) to enable 

timely receipt and dissemination of information and 

appropriate response.

• Analyzed RFI terminology and derived best 

practices and recommendations for 

improvements.

• Working group issued AWN Report of 

Findings. 
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 671 GAO-17-317 High-Risk Series

Priority 

objectives

Descriptions Examples of demonstrated progress 

Nationwide 

suspicious activity 

reporting initiative

Complete the implementation of the Nationwide Suspicious 

Activity Reporting (SAR) Initiative programs while 

expanding training and outreach beyond law enforcement 

to the rest of the public safety community.

• Refined and enhanced SAR analysis tools, 

and secured funding for related training 

materials.

Fusion centers Achieve the four Critical Operational Capabilities, four 

Enabling Capabilities, and other prioritized objectives 

across the National Network of Fusion Centers to help 

them effectively and lawfully execute their role as a focal 

point within the state and local environment for receiving, 

analyzing, gathering, and sharing threat-related 

information.

• Ensured appropriate federal analytic 

products are posted, shared, and cataloged 

within DHS’s secure information network. 

Source: GAO analysis of Office of the Program Manager for the Information Sharing Environment information. | GAO-17-317.

Progress had also been made in the three priority objectives that were 

still in the process of being implemented at the end of fiscal year 2016 

(see table 14). The Program Manager and relevant stakeholders noted 

additional work needed to fully advance these areas:

Table 14: Descriptions of Remaining Implementation Plan Priority Objectives, Examples of Demonstrated Progress, and What 

Remains to be Done

Priority 

objectives

Descriptions Examples of demonstrated 

progress 

What remains to be done

Data tagging Adopt data standards to facilitate 

federated discovery, access, correlation, 

and monitoring across federal networks 

and security domains.

• Issued document that 

defines data tagging 

functional requirements.

• Implement pilot projects; 

begin tagging new data and 

retroactively tag legacy data.

Federal Identity, 

Credential, and 

Access 

Management 

(FICAM)

Extend and implement the FICAM 

Roadmap across all security domains.

• Developed and published a 

FICAM implementation 

plan.

• Implement credentialing and 

access framework for Top 

Secret, Secret, and 

Unclassified information 

systems. 

Discovery and 

Access

Define and implement common 

processes and standards to support 

automated policy-based discovery and 

access decisions.

• Identified requirements for 

automated discovery and 

access decisions. 

• Develop and issue 

government-wide policy on 

discovery, and pilot 

implementation.

Source: GAO analysis of Office of the Program Manager for the Information Sharing Environment information. | GAO-17-317.

To track and monitor progress on individual projects to advance the ISE, 

personnel within the Office of the Program Manager coordinate with each 

priority objective steward or working group on implementation progress. 

The Program Manager’s staff and managers also have a process to 

assess this progress and make decisions about the status of priority 

objectives and milestones. For example, the Office of the Program 

Manager provided us documentation from September 2015 to July 2016 
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 672 GAO-17-317 High-Risk Series

that clearly documented the status of all priority objectives and 

milestones. Among other information, these tracking documents detailed 

whether milestones were completed, on track, needed attention, or 

deleted, along with due dates.

The Program Manger reported that his staff request documentation from 

stewards—such as white papers, emails, project completion notifications, 

and formal memorandums—to prove that milestones are complete. In this 

manner, over time, the Program Manager and key departments track 

milestones and adjust project baselines as needed. The status of 

modifying milestones was documented in regular priority objective and 

milestone updates. For instance, in cases where milestones were added, 

such as under the Data Tagging and FICAM priority objectives, the 

Program Manger noted that the new milestones were not creating 

additional tasks. Rather, the new milestones were written at a finer level 

of detail, which allowed departments and agencies to demonstrate 

incremental progress that was not visible under the original milestones. 

Milestones were deleted if stewards and stakeholders agreed that the 

milestones were no longer relevant to accomplishing priority objectives. 

The Program Manager and officials from key departments and agencies 

generally agreed that the Implementation Plan and process used to track 

and adjust priority objectives and milestones were effective, and we 

reviewed documentation that justified the status determinations for 

several milestones.

Overall, the Program Manager and key departments have demonstrated 

progress in advancing the ISE by using processes to track and assess 

the status of priority objectives and milestones, and to make adjustments 

if needed. The majority of milestones were met within the given 

timeframes of the Implementation Plan, which enabled the work of the 

ISE to move forward.

For additional information about this high-risk area, contact Diana Maurer 

at (202) 512-9627, or maurerd@gao.gov.

Information Sharing: DHS Is Assessing Fusion Center Capabilities and 

Results, but Needs to More Accurately Account For Federal Funding 

Provided to Centers. GAO-15-155. Washington, D.C.: November 4, 2014.

Maritime Critical Infrastructure Protection: DHS Needs to Better Address 

Port Cybersecurity. GAO-14-459. Washington, D.C.: June 5, 2014.

GAO Contact

Related GAO 

Products
Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information 

to Protect the Homeland

Page 673 GAO-17-317 High-Risk Series

DHS Intelligence Analysis: Additional Actions Needed to Address Analytic 

Priorities and Workforce Challenges. GAO-14-397. Washington, D.C.: 

June 4, 2014.

Intelligence, Surveillance, and Reconnaissance: DOD Has Taken Steps 

to Improve Data Management, but Key Guidance Is Incomplete. 

GAO-13-398SU. Washington, D.C.: May 8, 2013.

Intelligence, Surveillance, and Reconnaissance: DOD Has Partially 

Implemented GAO’s Recommendations to Enhance Intelligence 

Information Sharing. GAO-13-440SU. Washington, D.C.: April 26, 2013.

Information Sharing: Agencies Could Better Coordinate to Reduce 

Overlap in Field-Based Activities. GAO-13-471. Washington, D.C.: April 4, 

2013.

Information Sharing: Additional Actions Could Help Ensure That Efforts to 

Share Terrorism-Related Suspicious Activity Reports Are Effective. 

GAO-13-233. Washington, D.C: March 13, 2013.

Terrorist Watchlist: Routinely Assessing Impacts of Agency Actions since 

the December 25, 2009, Attempted Attack Could Help Inform Future 

Efforts. GAO-12-476. Washington, D.C.: May 31, 2012.

Information Sharing Environment: Better Road Map Needed to Guide 

Implementation and Investments. GAO‐11‐455. Washington, D.C.: July 

21, 2011.
Appendix III: GAO’s 2017 High-Risk List

Page 674 GAO-17-317 High-Risk Series

The areas on our 2017 High-Risk List are shown in table 15.

Table 15: GAO’s 2017 High-Risk List

Strengthening the Foundation for Efficiency and Effectiveness

• Strategic Human Capital Managementa

• Managing Federal Real Property

• Funding the Nation’s Surface Transportation Systema

• Modernizing the U.S. Financial Regulatory System and the Federal Role in Housing Financea

• Restructuring the U.S. Postal Service to Achieve Sustainable Financial Viabilitya

• Management of Federal Oil and Gas Resources

• Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks

• Improving the Management of IT Acquisitions and Operations

• Improving Federal Programs that Serve Native American Tribes and Their Members (new)a

• 2020 Decennial Census (new)

• U.S. Government Environmental Liabilities (new)a

Transforming DOD Program Management

• DOD Supply Chain Management

• DOD Weapon Systems Acquisition

• DOD Financial Management

• DOD Business Systems Modernization

• DOD Support Infrastructure Managementa

• DOD Approach to Business Transformation 

Ensuring Public Safety and Security

• Ensuring the Security of Federal Information Systems and Cyber Critical Infrastructure and Protecting the Privacy of Personally 

Identifiable Informationa

• Strengthening Department of Homeland Security Management Functions

• Ensuring the Effective Protection of Technologies Critical to U.S. National Security Interestsa

• Improving Federal Oversight of Food Safetya

• Protecting Public Health through Enhanced Oversight of Medical Products

• Transforming EPA’s Processes for Assessing and Controlling Toxic Chemicals

• Mitigating Gaps in Weather Satellite Data 

Managing Federal Contracting More Effectively

• DOE’s Contract Management for the National Nuclear Security Administration and Office of Environmental Management

• NASA Acquisition Management

• DOD Contract Managementa

Assessing the Efficiency and Effectiveness of Tax Law Administration

• Enforcement of Tax Lawsa

Appendix III: GAO’s 2017 High-Risk List
Appendix III: GAO’s 2017 High-Risk List

Page 675 GAO-17-317 High-Risk Series

Modernizing and Safeguarding Insurance and Benefit Programs

• Medicare Programa

• Medicaid Programa

• Improving and Modernizing Federal Disability Programs

• Pension Benefit Guaranty Corporation Insurance Programsa

• National Flood Insurance Programa

• Managing Risks and Improving VA Health Carea

Source: GAO. | GAO-17-317

a

Legislation is likely to be necessary in order to effectively address this area.
GAO Related Products

Page 676 GAO-17-317 High-Risk Series

The following GAO reports reflect our High-Risk Series reports issued 

since 2000. For additional GAO related products issued specific to each 

of the 34 high-risk areas on our updated list, see our High-Risk List

website, http://www.gao.gov/highrisk/.

High-Risk Series: Key Actions to Make Progress Addressing High-Risk 

Issues. GAO-16-480R. Washington, D.C.: April 25, 2016.

High-Risk Series: An Update. GAO-15-290. Washington, D.C.: February 

11, 2015.

High-Risk Series: An Update. GAO-13-283. Washington, D.C.: February 

14, 2013.

High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 

16, 2011.

High-Risk Series: An Update. GAO-09-271. Washington, D.C.: January 

22, 2009.

High-Risk Series: An Update. GAO-07-310. Washington, D.C.: January 

31, 2007.

High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January 1, 

2005.

High-Risk Series: An Update. GAO-03-119. Washington, D.C.: January 1, 

2003.

High-Risk Series: An Update. GAO-01-263. Washington, D.C.: January 1, 

2001.

Determining Performance and Accountability Challenges and High Risks. 

GAO-01-159SP. Washington, D.C.: November 1, 2000.

GAO Related Products

(100362)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov and read The Watchblog.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.