U.S. GOVERNMENT PUBLISHING OFFICE

26–768 PDF WASHINGTON : 2018

S. Hrg. 115–314 

HIGH RISK: GOVERNMENT OPERATIONS 

SUSCEPTIBLE TO WASTE, FRAUD, AND 

MISMANAGEMENT 

HEARING 

BEFORE THE

COMMITTEE ON 

HOMELAND SECURITY AND 

GOVERNMENTAL AFFAIRS 

UNITED STATES SENATE 

ONE HUNDRED FIFTEENTH CONGRESS 

FIRST SESSION 

FEBRUARY 15, 2017 

Available via the World Wide Web: http://www.fdsys.gov/ 

Printed for the use of the 

Committee on Homeland Security and Governmental Affairs 

( 
(II) 

COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS 

RON JOHNSON, Wisconsin, Chairman 

JOHN MCCAIN, Arizona 

ROB PORTMAN, Ohio 

RAND PAUL, Kentucky 

JAMES LANKFORD, Oklahoma 

MICHAEL B. ENZI, Wyoming 

JOHN HOEVEN, North Dakota 

STEVE DAINES, Montana 

CLAIRE MCCASKILL, Missouri 

THOMAS R. CARPER, Delaware 

JON TESTER, Montana 

HEIDI HEITKAMP, North Dakota 

GARY C. PETERS, Michigan 

MAGGIE HASSAN, New Hampshire 

KAMALA D. HARRIS, California 

CHRISTOPHER R. HIXON, Staff Director 

GABRIELLE D’ADAMO SINGER, Chief Counsel 

PATRICK J. BAILEY, Chief Counsel for Governmental Affairs 

MARGARET E. DAUM, Minority Staff Director 

DONALD SHERMAN, Minority Senior Counsel 

LAURA W. KILBRIDE, Chief Clerk 

BONNI DINERSTEIN, Hearing Clerk 
(III) 

C O N T E N T S 

Opening statements: Page 

Senator Johnson ............................................................................................... 1 

Senator McCaskill ............................................................................................ 2 

Senator Carper ................................................................................................. 17 

Senator Portman .............................................................................................. 19 

Senator Lankford .............................................................................................. 22 

Senator Tester .................................................................................................. 25 

Senator Harris .................................................................................................. 28 

Senator Paul ..................................................................................................... 31 

Senator Heitkamp ............................................................................................ 34 

Prepared statements: 

Senator Johnson ............................................................................................... 39 

Senator McCaskill ............................................................................................ 41 

WITNESSES 

WEDNESDAY, FEBRUARY 15, 2017 

Hon. Eugene L. Dodaro, Comptroller General of the United States, U.S. 

Government Accountability Office ...................................................................... 4 

Hon. John H. Thompson, Director, U.S. Census Bureau, U.S. Department 

of Commerce ......................................................................................................... 6 

Hon. Michael J. Missal, Inspector General, U.S. Department of Veterans 

Affairs .................................................................................................................... 8 

Hon. John Roth, Inspector General, U.S. Department of Homeland Security ... 10 

ALPHABETICAL LIST OF WITNESSES

Dodaro, Hon. Eugene L.: 

Testimony .......................................................................................................... 4 

Prepared statement .......................................................................................... 44 

Missal, Hon. Michael J.: 

Testimony .......................................................................................................... 8 

Prepared statement .......................................................................................... 107 

Roth, Hon. John: 

Testimony .......................................................................................................... 10 

Prepared statement .......................................................................................... 114 

Thompson, Hon. John H.: 

Testimony .......................................................................................................... 6 

Prepared statement .......................................................................................... 97 

APPENDIX 

Chart referenced by Senator Johnson .................................................................... 126 

Mr. Dodaro response to Senator Portman ............................................................. 147 

Mr. Dodaro response to Senator Lanfkord ............................................................ 148 

Responses to post-hearing questions for the Record 

Mr. Dodaro ........................................................................................................ 128 

Mr. Thompson ................................................................................................... 149 

Mr. Missal ......................................................................................................... 154 

Mr. Roth ............................................................................................................ 159 

(1) 

1The prepared statement of Senator Johnson appears in the Appendix on page 39. 

HIGH RISK: GOVERNMENT OPERATIONS 

SUSCEPTIBLE TO WASTE, FRAUD, AND 

MISMANAGEMENT 

WEDNESDAY, FEBRUARY 15, 2017 

U.S. SENATE, COMMITTEE ON HOMELAND SECURITY

AND GOVERNMENTAL AFFAIRS, Washington, DC. 

The Committee met, pursuant to notice, at 2:49 p.m., in room 

SD–342, Dirksen Senate Office Building, Hon. Ron Johnson, Chairman of the Committee, presiding. 

Present: Senators Johnson, Portman, Paul, Lankford, Hoeven, 

McCaskill, Carper, Tester, Heitkamp, Peters, Hassan, and Harris. 

OPENING STATEMENT OF CHAIRMAN JOHNSON 

Chairman JOHNSON. This hearing will come to order. Good afternoon. I want to welcome all our witnesses. I appreciate your 

thoughtful testimony and your willingness to spend some time here 

with us today. 

I ask consent that my written opening statement be entered in 

the record.1 Without objection. 

This hearing is really what this Committee is all about, particularly on the Governmental Affairs portion. We have a mission 

statement that we developed last Congress with my former Ranking Member, Senator Carper, and then my new Ranking Member 

had a very good addition to it. The original one was to enhance the 

economic and national security of America. Senator McCaskill suggested we add ‘‘and promote more efficient, effective, and accountable government.’’ 

Of course, that is exactly what the Government Accountability 

Office (GAO) does. That is exactly what Inspectors General (IGs) 

do. And so, we certainly appreciate your work. I do not know how 

many times I have said, and I think others have said, that you are 

our favorite folks in government. You give us the information that 

really can make government more efficient, more effective, and accountable. 

Today’s hearing is about the GAO’s High-Risk Series, their list. 

This is something that has been prepared by GAO since the early 

1990s. The facts speak for themselves. In just the last 10 years, 

GAO reports that we probably saved about $240 million over that 

10-year period by enacting their recommendations to make government more efficient and effective. That is $24 billion per year. 
2 

1The prepared statement of Senator McCaskill appears in the Appendix on page 41. 

Of course, IGs play a key role in that as well. Senator Grassley 

and I sent a letter and requested that the IGs of the last Congress 

give us a list of all their recommendations that are outstanding, 

that have not been implemented. The result was 15,222; net potential savings, about $87 billion. So, even in the Federal Government, 

that is real money, and it is really folks like you that can make 

a huge difference. 

Today’s hearing, what we decided to do is this—because we have 

listened to Mr. Dodaro testify beautifully without notes, and he can 

speak an awful lot. But, rather than have him completely on the 

hot seat there, we thought we would invite two Inspectors General, 

and we have Mike Missal, the Inspector General of the Department 

of Veterans Affairs (VA), and John Roth, the Inspector General of 

the Department of Homeland Security (DHS), to testify in terms of 

their Department, the activity, and the High-Risk List. We also invited John Thompson, the Director of the Census Bureau, and, Mr. 

Thompson, we did not invite you to be here to be on the hot seat. 

Obviously, the Census is under this Committee’s jurisdiction, and 

I really wanted to bring in the Director and get his viewpoint in 

terms of a Director of one of these agencies that is listed on the 

High-Risk List, how you view that, what you do, what are your 

challenges in trying to get off the High-Risk List, and how seriously do you really take it. Again, I truly appreciate it—we will go 

easy on you here. We truly appreciate you coming. 

I am looking forward to the hearing. I do not want to spend 

much more time. I will turn it over to Senator McCaskill. 

OPENING STATEMENT OF SENATOR MCCASKILL1

Senator MCCASKILL. Thank you, Mr. Chairman, for holding this 

important hearing. I know that Mr. Dodaro knows this, that I really consider GAO to be one of the most important entities in Washington, D.C. It is an independent, nonpartisan agency that investigates how the Federal Government spends tax dollars. Your work 

supports us in meeting our legislative and oversight obligations 

under the Constitution and helps us to improve accountability in 

the Federal Government. And, the important thing is you provide 

information that is objective, that is fact based, nonpartisan, fair, 

and balanced. 

At the beginning of each Congress, you release a report of government programs that are at high risk due to their vulnerabilities 

to fraud, waste, abuse, and mismanagement. Shortly after the release of the report, the Senate Committee on Homeland Security 

and Governmental Affairs (HSGAC) invites GAO’s leaders—the 

Comptroller—to testify. I appreciate that this hearing is one of our 

first full Committee hearings of the 115th Congress. GAO’s 2017 

High-Risk Report provides us with a list of priorities for how this 

Committee can target and root out waste, fraud, and abuse. 

For example, GAO’s report says the Federal Government oversees more than $80 billion in taxpayer funds for information technology (IT) investments. But, poor management, as we know, leads 

many IT contracting projects to fail or experience significant cost 

overruns. Contract oversight is not a new problem in government, 
3 

but it remains one of the intractable and most important problems 

out there. 

While most government employees are dedicated public servants, 

GAO’s High-Risk Report highlights that more work is needed to ensure that the Federal bureaucracy performs effectively and efficiently on behalf of the American people. The report identifies several ‘‘mission-critical’’ skill gaps within the Federal workforce that 

could pose risks to American tax dollars and to American lives. 

For example, it is alarming that even after the large-scale cyber 

breach at the Office of Personnel Management (OPM) and the medical wait list scandal at the Department of Veterans Affairs, some 

of the Federal skills gap identified by GAO still include 

cybersecurity and nursing. 

This year, GAO added the 2020 Census program to its list of 

high-risk areas. Knowing that our next Census is rapidly approaching, I am grateful that Director Thompson is here to provide a status update on the program. The cost of the Census has risen over 

the last few decades, with the 2010 Census being the costliest U.S. 

Census in history. Billions of tax payer dollars were wasted on programs that had to be scrapped at the last minute in order to ensure the 2010 Census was done on time. 

Given these challenges and the important role the Census plays 

in counting our citizens as well as allocating precious taxpayer dollars to communities, I am eager to learn how the Bureau expects 

to effectively manage costs this time while simultaneously modernizing the Census program. 

I am grateful to Inspectors General Roth and Missal for joining 

Comptroller General Dodaro and Director Thompson here today to 

discuss their work to improve government programs at the Department of Homeland Security and Veterans Affairs, respectively. 

When there is ineffective oversight and accountability in government, money gets wasted and mismanagement goes unaddressed. 

As a former State auditor, I consider government accountability 

as maybe the most important part of my work here in the Senate. 

Last week, President Trump signed into law the GAO Access and 

Oversight Act, a bipartisan measure that I cosponsored to ensure 

that GAO has full access to the National Database of New Hires, 

a key tool for cutting waste and fraud in many of the government’s 

largest programs, as well as allowing States to aggressively pursue 

child support payments. The law also strengthens GAO’s ability to 

take legal action if an agency refuses to provide GAO with information necessary to perform its functions. This law is a great example 

of what our Committee can do when we work together to promote 

accountability in the Federal Government. 

The Federal Government is a complex system of agencies. It 

spends more than $3 trillion annually on behalf of the American 

people. We are members of a public trust to ensure those tax dollars are used well. 

Thank you so much for being here today. Thank you, Mr. Chairman, for having this Committee hearing, and I will look forward 

to questions. 

Chairman JOHNSON. Thank you, Senator McCaskill. 

It is the tradition of this Committee to swear in witnesses, so if 

you will all rise and raise your right hand. Do you swear that the 
4 

1The prepared statement of Mr. Dodaro appears in the Appendix on page 44. 

testimony you will give before this Committee will be the truth, the 

whole truth, and nothing but the truth, so help you, God? 

Mr. DODARO. I do. 

Mr. THOMPSON. I do. 

Mr. MISSAL. I do. 

Mr. ROTH. I do. 

Chairman JOHNSON. Please be seated. 

Our first witness is Eugene Dodaro. Mr. Dodaro has been the 

Comptroller General of the U.S. Government Accountability Office 

since 2010 and has more than 40 years experience at the agency, 

including as Acting Comptroller General, Chief Operating Officer 

(COO), and head of the Accounting and Information Management 

Division. Comptroller Dodaro. 

TESTIMONY OF THE HONORABLE EUGENE L. DODARO,1 COMPTROLLER GENERAL OF THE UNITED STATES, U.S. GOVERNMENT ACCOUNTABILITY OFFICE 

Mr. DODARO. Thank you very much, Mr. Chairman. Good afternoon to you, Ranking Member McCaskill. I am very pleased to be 

here today to discuss the latest addition to the GAO’s high-risk 

program. I am pleased to report that many of the 32 areas that 

were on the list in 2015 have shown improvement and are in a position now that they either meet or partially meet all five criteria 

for coming off the list. 

Now, the five criteria are leadership, you have to have the capacity, you have to have a good action plan, monitoring effort, and you 

have to demonstrate some progress. This is the one that is the 

hardest to meet, to actually show you are reducing the risk or making progress in fixing the problems. 

This progress is due to commitment by some of the agency leaders as well as the staff in the agencies, the Office of Management 

and Budget (OMB), and Congress. I am very pleased that the 

114th Congress passed over 12 bills that addressed high-risk areas 

and were part of the reason why we are showing this progress. 

And, Congress held over 250 hearings on areas discussed in GAO’s 

high-risk program. I am very pleased this Committee, in particular, 

was sponsoring a number of bills, holding a lot of hearings, and I 

am very appreciative of that. Congress is key to making progress. 

If you look at almost every area that we identify as achieving 

progress, congressional action has been instrumental in achieving 

that degree of progress. 

One area has met all the criteria and is coming off the list—managing the sharing of terrorism-related information. This is a very 

important area to the safety of our country. I can assure this Committee while it is coming off the list, it does not mean it is out of 

sight. We are going to keep an eye on it and make sure that things 

stay on track in that area. 

Another area that I know this Committee is very interested in 

is the Department of Homeland Security. IT has continued to show 

steady progress. Agency officials have improved their ability to 

monitor their action plan that they have in place. They really need 

to focus on their acquisition programs, fixing their financial man-
5 

agement systems, and improving employee morale. Those are the 

key things they need to continue to do. 

There are a number of areas on the list, however, that need substantial attention, and these I would particularly cite for this Committee’s attention. 

First is veterans’ health care. I added that to the list in 2015 for 

a number of very important reasons that I can elaborate on in the 

question and answer (Q&A), but I am very concerned that they 

have only made limited progress. 

Defense Department financial management, we talked about that 

several times before this Committee. They are still the only major 

Federal agency that has not been able to pass the test of an audit. 

Information technology and acquisitions and operations, as Senator McCaskill mentioned, that is an area that, while we have seen 

some progress, needs significantly more oversight and attention to 

make sure that it gets fixed. 

Cybersecurity, both cybersecurity as it relates to the Federal 

Government’s own information systems, but also critical infrastructure like the electricity grid, financial markets, air traffic control 

system, and others. We added cybersecurity across the Federal 

Government as a high-risk area to the list in 1997, so this is the 

20-year anniversary. We have been trying to get agencies to move 

on that area, and despite even the breaches, we have 1,000 recommendations that are still outstanding in the cybersecurity area. 

And then, reforming the housing finance system, this is one area 

that was not addressed coming out of the global financial crisis. 

Fannie Mae and Freddie Mac have been in conservatorship since 

2008. A lot of the risk has moved to the Federal Government, either directly or indirectly—directly through the Federal Housing 

Administration (FHA), who received about $1.68 billion in supplemental funding in 2013. About 70 percent of all the single-family 

mortgages originated in 2016 are either directly or indirectly supported by the Federal Government. We need to address Fannie and 

Freddie and get the private sector back into the financial market 

as well to reduce the risk on the Federal Government. 

We are adding three new areas this year. First is the Federal efforts to provide oversight over programs that serve Indian tribes 

and their members. We are very concerned. We looked at the education programs. Their schools are in poor condition, not properly 

staffed. The health care area, there are no quality standards for 

health care, a lot of vacant positions. They are distributing funds 

to send people to private sector care if it is not available in Indian 

hospitals. They are still using a formula that they used in the 

1930s. That needs attention. And, also, some tribes want to develop 

oil and gas on their lands, but they need Federal permitting and 

licensing, and it is just slow. It takes forever, and they are not able 

to generate that revenue that could help them deal with a number 

of their issues. 

Second, there is growth in environmental liabilities for the Federal Government. This is to dispose of waste from the nuclear 

weapons complex as well as from other Federal activities. The liability right now is approaching one-half trillion dollars. I believe 

it to be understated because of problems that we have seen with 

agencies such as DOD estimating environmental liabilities for 
6 

1The prepared statement of Mr. Thompson appears in the Appendix on page 97. 

cleaning up locations like the Department of Energy nuclear waste 

sites and Defense Department installations. 

Now, the Federal Government spends billions of dollars every 

year to clean up this waste, but the liability keeps growing. There 

is not enough risk-based decisionmaking made in those areas. We 

have a number of outstanding recommendations. 

The last area is the Census. As you mentioned, we have added 

that to the list because of the fact that the last Census was over 

$12 billion, the costliest ever. In order to contain costs, Census officials have introduced a lot of novel concepts using the Internet, developing address lists from spatial and other means rather than 

going door to door canvassing, and also using administrative 

records and new information technology. All these things add to 

the risk. And, the final plans have not been put in place yet. 

We look forward to working with this Committee, and I look forward to answering questions today at the appropriate time. Thank 

you very much. 

Chairman JOHNSON. Thank you, Mr. Dodaro. 

Our next witness is John Thompson. Mr. Thompson is the Director of the Census Bureau. Before his appointment as Director, Mr. 

Thompson was president and Chief Executive Officer (CEO) at the 

National Opinion Research Center (NORC). 

Director Thompson. 

TESTIMONY OF THE HONORABLE JOHN H. THOMPSON,1 DIRECTOR, U.S. CENSUS BUREAU, U.S. DEPARTMENT OF COMMERCE 

Mr. THOMPSON. Good afternoon, Chairman Johnson, Ranking 

Member McCaskill, and Members of the Committee. I appreciate 

the opportunity to update you on the 2020 Census. I am proud to 

report today that we remain on the critical path to readiness. 

The 2020 Census has been added to the most recent High-Risk 

List from the Government Accountability Office. Both the 2000 

Census and 2010 Census were also on this list, which is a reflection of the complexity, scale, and importance of conducting a fair 

and accurate census. This decade, the complexity is heightened as 

we replace a paper-and-pencil-based design with innovative technologies that will save taxpayers billions of dollars. We already 

have robust controls in place to mitigate the risks that are inherent 

in carrying out this constitutionally mandated task. 

As we plan and test the 34 operations and roughly 50 systems 

that comprise the 2020 Census, we are aware of the many risks the 

program faces. That is why we are working rigorously to manage, 

monitor, and mitigate those risks. In the final years of the decade, 

risk management is critical to our operational plan for 2020. Another important part of our preparations is continuing to work with 

our colleagues at the GAO and the Office of the Inspector General 

(OIG) at the Department of Commerce. 

I discuss the steps we are taking to mitigate risk in greater detail in my written testimony for the record, including the overarching risk of funding uncertainty. Today I want to highlight the 

following specific risk areas that we are concentrating on. 
7 

First, cybersecurity, fraud detection, and ensuring the public’s 

trust. We are actively securing our systems and devices for the 

2020 Census and its field test while ensuring that we prevent 

fraud and cyber attacks. We will use a layered defense strategy to 

protect the data we collect and administrative records. 

Second, ensuring systems readiness. We have developed and 

field-tested proof-of-concept systems, and our design is supported 

by findings from the Census tests. Now that we have awarded 

nearly all of the key contracts for 2020, we are finalizing our system of systems ahead of the 2018 End-to-End Census Test. 

Third, refining our field procedures through testing. 

Fourth, managing the Integrated Master Schedule for the 2020 

Census and its supporting programs. 

And, last, documenting and validating our 2020 Census life cycle 

cost estimates. 

Census tests are key to finalizing our designs and reducing risk. 

Last year, we tested core Census operations in Harris County, 

Texas, and Los Angeles County, California. Additionally, we tested 

our address canvassing procedures and systems in parts of Buncombe County, North Carolina, and St. Louis, Missouri. We learned 

many lessons from these tests, and we are using those lessons to 

refine our operations and mitigate the risks of an innovative Census. 

In addition, the Census Bureau has planned test operations in 

2017. These involve critical systems and operations that must be 

tested ahead of the 2018 End-to-End Census Test. 

The 2018 End-to-End Census Test is the final major field test before the 2020 Census. Field operations will begin in August 2017 

with a Census Day of April 1, 2018. We will conduct the test in 

three areas: Pierce County, Washington; Providence County, Rhode 

Island; and the Bluefield-Beckley-Oak Hill area of West Virginia. 

Collectively, it will cover about 770,000 housing units. We will test 

and prove in nearly all of the 2020 Census operations, procedures, 

systems, and field infrastructure. We will also produce prototypes 

of our geographic and data release products. 

Making sure that all of these Census systems work individually 

and in concert with each other is critical. Using the lessons from 

2018, we will make any necessary adjustments to ensure that we 

are ready for the Census and finalize our plans for operations. 

We have been transparent about how we are approaching the redesigned Census. We have held public quarterly program management reviews. We publicly documented and tracked our biggest decisions. We have shared our Integrated Master Schedule with the 

GAO every month, for example. 

There are many challenges ahead, but we are confident that, 

with appropriate funding levels, we can successfully execute the 

2020 census. I need to note that 2017 and 2018 are critical years 

in the census cycle. The funding we receive in these years will have 

a great effect on the outcome of the 2020 census, including achieving $5 billion in cost savings. 

We are now less than 6 months away from beginning field work 

on the final major test for the 2020 Census, but there is not yet 

clarity regarding the program’s funding in 2017. In January, uncertainty about the fiscal year (FY) 2017 budget required us to make 
8 

1The prepared statement of Mr. Missal appears in the Appendix on page 107. 

difficult decisions to descope some aspects of the program and 

pause others to mitigate funding uncertainty risk. This will lead to 

more address listing work in 2019, to a delay in opening three of 

our six regional Census centers in 2017, and to the elimination of 

advertising in the 2018 End-to-End Census Test. It will also lead 

to deep cuts to program and test management operations, despite 

the GAO and our Inspector General deeming them critical for a 

program of this complexity. 

I must stress that we need an adequate level of funding to do the 

development, testing, validation, documentation, and planning that 

are necessary for risk mitigation and which the GAO has urged us 

to conduct. 

We are planning an innovative, modern design for 2020 that will 

bring the decennial Census into the 21st Century. Our approach 

takes advantage of new technologies, methodologies, and data 

sources, while minimizing risk. With the funding we have requested, we can execute the design that will save taxpayers billions 

of dollars. 

I thank the Committee for your interest in our work. I look forward to discussing the challenges we face and how we are addressing them and to continuing our productive relationship with the 

GAO in the years ahead. 

Thank you. 

Chairman JOHNSON. Thank you, Director Thompson. 

Our next witness is Michael Missal. Mr. Missal is the Inspector 

General of the Department of Veterans Affairs. Prior to his service 

as the Inspector General, Michael was a partner at the law firm 

K&L Gates, where he led the firm’s policy and regulatory practice 

groups. Mr. Missal. 

TESTIMONY OF THE HONORABLE MICHAEL J. MISSAL,1 INSPECTOR GENERAL, U.S. DEPARTMENT OF VETERANS AFFAIRS 

Mr. MISSAL. Thank you. Chairman Johnson, Ranking Member 

McCaskill, and Members of the Committee, thank you for the opportunity to discuss the work of the VA Office of Inspector General 

and how we provide effective oversight of VA’s programs and operations through independent audits, inspections, and investigations. 

We seek to prevent and detect fraud, waste, and abuse, and make 

meaningful recommendations to drive economy, efficiency, and effectiveness throughout VA’s programs and operations. Our goal is 

to undertake impactful work that will assist VA in providing the 

appropriate and timely services and benefits that veterans so deservedly earned and ensuring the proper expenditure of taxpayer 

funds. 

I have had the great privilege of serving as the Inspector General 

since May 2, 2016. Since that time, I have fully immersed myself 

in the work, priorities, and policies of the OIG. We have made a 

number of enhancements since I started, including issuing a Mission, Vision, and Values statement, increasing transparency, creating a Rapid Response team, expanding our data analytics capabilities, and being more proactive in our review areas. I believe 
9 

that these changes will enable us to do additional impactful work 

in a timely manner. 

The OIG shares a similar mission with GAO. It is important that 

we have a strong relationship with GAO to ensure that we avoid 

duplication of effort as much as possible. To that end, one of the 

first things I did when I started was to meet with Comptroller General Gene Dodaro and some of his senior staff. Our offices have had 

a number of discussions and communications since that time to 

promote coordination and effective oversight of VA. 

GAO added Managing Risks and Improving VA Health Care to 

its biannual High-Risk List in 2015, and it remains on the HighRisk List that was just issued for 2017. The GAO focused its concerns in five broad areas: ambiguous policies and inconsistent processes, inadequate oversight and accountability, information technology challenges, inadequate training for VA staff, and unclear resource needs and allocation priorities. 

While our work is determined by what we believe is the most effective oversight of VA, a number of our reports address concerns 

in these same five areas. As the Committee requested, I will highlight a sampling of OIG work in each of the areas that resulted in 

GAO placing VA health care on its High-Risk List. It should be 

noted that many of the OIG’s reports could fit in more than one 

area. 

We have issued a number of reports in the past few years that 

include VA’s ambiguous policies and inconsistent processes. A review of the Health Eligibility Center determined that VA had not 

effectively managed its business processes to ensure the consistent 

creation and maintenance of essential health care eligibility data. 

We made 13 recommendations in that report, including one focused 

on controls to ensure that future enrollment data are accurate and 

reliable before being entered into the Enrollment System (ES). VA 

concurred with the recommendations and provided sufficient information to close all recommendations in October 2016. 

Proper oversight by management would ensure that programs 

and operations would work effectively and efficiently. Our September 2016 report on the Denver replacement medical center is an 

extremely costly example of the result of inadequate oversight. 

Through all phases of the project, we identified various factors that 

significantly contributed to delays and rising costs. This occurred 

due to a series of questionable business decisions and mismanagement by VA senior officials, resulting in a project years behind 

schedule and costing more than twice the initial budget of $800 

million. We made five recommendations and VA management concurred with all recommendations. We recently requested information from VA on the implementation status of the recommendations 

and will keep them open until VA provides satisfactory evidence of 

implementation. 

As we have reported in our list of VA’s major management challenges within VA’s Annual Financial Report, we have frequently 

identified VA’s struggles to design, procure, and/or implement functional IT systems. IT security is continually reported as a material 

weakness in our Consolidated Financial Statement audits. 

VA has a high number of legacy systems needing replacement. 

Moreover, after years of effort focused on replacement of VA’s leg-
10 

1The prepared statement of Mr. Roth appears in the Appendix on page 114. 

acy scheduling software, a new scheduling system is still not in 

place. VA’s issues with scheduling software are related to the inability to define its requirements and determine if a commercial solution is available or if it must design a system. Replacing systems 

has been a major challenge across the government, and it is not 

unique to VA. We have issued a number of reports outlining access 

issues and our work in this area is continuing. 

One prevailing theme of the OIG’s work related to wait times 

and scheduling issues was the inadequate, lack of, or incorrect 

training provided to VA staff for scheduling appointments. We conducted extensive work related to allegations of wait time manipulation through fiscal years 2015 and 2016 after the allegations at the 

Phoenix VA Health Care System surfaced in April 2014. As we 

have reported in more than 90 Administrative Summaries of Investigation and other reports that have been issued, the lack of training for schedulers and the lack of understanding of the process by 

their managers created a system in which long wait times were not 

accurately portrayed to management. 

VA needs to accurately forecast the demand for health care services in both the near term and the long term. The OIG is required 

by Section 301 of the Choice Act to review the Veterans Health Administration (VHA) occupations with the largest staffing shortages. 

In our most recent report issued in September 2016, we identified 

medical officer, nurse, psychologist, physician assistant, and physical therapist/medical technologist as the critical occupations with 

the largest staffing shortages. 

In conclusion, the OIG is committed to providing effective oversight of the programs and operations of VA. A number of our reports address the five broad areas noted by GAO in placing VA 

health care on its High-Risk List. We will continue to produce reports that provide VA, Congress, and the public with recommendations that we believe will help VA operate its programs and services in a manner that will effectively and timely deliver services 

and benefits to veterans and spend taxpayer money appropriately. 

Mr. Chairman, this concludes my statement, and I would be 

happy to answer any questions that you or other Members of the 

Committee may have. 

Chairman JOHNSON. Thank you, Mr. Missal. 

Our final witness is John Roth. Mr. Roth has served as the Inspector General for the Department of Homeland Security since 

March 2014. In addition to previous work for the Food and Drug 

Administration (FDA), Mr. Roth had a 25-year career as a Federal 

prosecutor, including Chief of Staff to the Deputy Attorney General. Mr. Roth. 

TESTIMONY OF THE HONORABLE JOHN ROTH,1 INSPECTOR 

GENERAL, U.S. DEPARTMENT OF HOMELAND SECURITY 

Mr. ROTH. Chairman Johnson, Ranking Member McCaskill, and 

Members of the Committee, thank you for inviting me here to testify today. 

Homeland Security faces long-standing challenges, and we at the 

Office of Inspector General have focused our energies on the major 
11 

management and performance challenges, which we published in 

November. We listed six: one, creating a unified Department; two, 

employee morale and engagement; three, acquisition management; 

four, grants management; five, cybersecurity; and six, improving 

management fundamentals. 

Additionally, with the new Administration, the Department will 

face new responsibilities. We understand the significant investment 

the Department will be making to satisfy its obligations under the 

President’s Executive Order (EO) to construct a Southern border 

barrier and the importance of spending that investment efficiently 

and effectively. 

The Department has historically performed very poorly in this 

area. As many recall, prior efforts to fortify the Southwest border, 

known as SBInet, were canceled in 2011 as being too expensive and 

ineffective. In a pilot program in Arizona, DHS spent about $1 billion to build the system across only 53 miles of the State’s border 

before abandoning the initiative. We must not allow that to be repeated. 

Given the risks involved, our office will be using a lifecycle approach to audit and monitor the Department’s actions to strengthen the physical security of the Nation’s Southern border. A lifecycle 

audit approach means that we will be able to audit the project 

throughout its life span rather than waiting for the project to be 

completed or partially completed before looking at it. In this way, 

we have an opportunity to stop waste and mismanagement before 

the money is spent rather than simply identifying it after the fact. 

Our first report will address lessons learned from the Department’s prior Secure Border Initiative and other relevant acquisitions related to securing our borders. We hope to have this report 

out in the next 6 weeks. Subsequently, we plan to review Customs 

and Border Protections (CBP’s) comprehensive study of the security 

of the Southern border that the Executive Order requires be completed within 180 days. Future audits will also address the planning, design, acquisition, and construction phases of the Southern 

border barrier. 

Similarly, the Department will face a number of challenges in 

executing the President’s Executive Orders directing the Department to hire an additional 5,000 Border Patrol Agents and 10,000 

Immigration Officers. We recently completed an audit that highlighted the numerous bottlenecks in effective Federal hiring. In fiscal year 2015, for example, it took an average of 282 days—over 

9 months—to hire a Border Patrol Agent, measured from the time 

the job announcement closed to the date the applicant was actually 

hired. Other positions likewise encountered similar significant 

delays. Again, we think this is an unacceptable level of performance and look to make recommendations for improvement. 

As with the acquisition area, we have initiated the first in a series of audits to further review the Department’s human capital 

strategies and management capabilities to ensure the Department 

can quickly and effectively hire a highly qualified and diverse 

workforce. We again will do this continuously throughout the process rather than waiting for the hiring to be completed. 

Finally, we will continue to focus on DHS’ highly troubled grants 

management program. In report after report, we have found effi-
12 

ciencies in the manner in which the Federal Emergency Management Agency (FEMA) holds grantees accountable and that the 

layer of oversight intended to monitor the billions of dollars awarded by FEMA in disaster assistance grants is ineffective, inefficient, 

and vulnerable to fraud, waste, and abuse. 

In fiscal year 2015, for example, we found a questioned cost rate 

of 29 percent, which is an unacceptably high percentage and serves 

as an illustration of FEMA’s continued failure to adequately manage grants. 

We believe that the root cause of this problem includes a failure 

of leadership, an inability or lack of desire to hold grantees accountable, and systemic issues that may only be cured by systemic 

statutory fixes. We have started to explore with this Committee’s 

staff some potential solutions, and we look forward to working with 

you on this important issue. 

Mr. Chairman, this concludes my testimony. I am happy to answer any questions you or other Members of the Committee may 

have. 

Chairman JOHNSON. Thank you, Mr. Roth. 

Let me start with Mr. Dodaro. In your testimony, you talked 

about cybersecurity. This is the 20th anniversary of being on the 

High-Risk List. Every other witness talked about either information technology challenges in the Department or also issues of 

cybersecurity. 

Can you summarize or give me kind of the main reason why it 

is so difficult to get agency heads or get departments up to speed 

from the standpoint of cybersecurity? 

Mr. DODARO. Yes, this has been a long-standing quest that I 

have been on. When we first started this, we actually built a computer lab that simulated the operating environment of the agencies 

and were able to hack into their systems to show them how easy 

it was to get into their systems. And, we still were not getting a 

lot of traction or attention because people thought, well, who is 

going to do that? 

You could see this coming, years ago, as the government became 

more dependent on technology. Even with the breaches now, there 

is not a sense of urgency yet as much as I think there should be 

across the Federal Government. 

Chairman JOHNSON. Let me just quickly interrupt. Because of 

these high-profile breaches, are you seeing any increased attention 

to this matter? 

Mr. DODARO. There is some. There is a lot of scrambling going 

on, but it is not really resulting in meaningful improvements in as 

many cases as it should. There are two things going on now. The 

government got a very slow start in this area despite our urgings. 

Second, it is saddled with a bunch of legacy systems that are decades old, where security was not built in up front, and they cannot 

patch them fast enough, and they have not been replaced with 

more modern systems with security technology built in up front. 

The workforce is not up to where it needs to be in order to be able 

to take care of this issue. And, there is not enough follow-through 

to see that the recommendations are being implemented. 

A lot of this is just management attention, too. You need the 

technical people, but a lot of the weaknesses can result in employ-
13 

ees not being aware and downloading malicious software into the 

system. 

There are well-defined best practices for having a comprehensive, 

effective cybersecurity program in place, and time after time we 

find that agencies do not have this comprehensive program in 

place. They are not responding to incidents when they do happen 

as fast as they need to in order to rectify the problem. 

I think this needs continual attention over time, but these legacy 

systems are part of the millstone around the agencies’ efforts to improve cybersecurity. We did a report recently, which I am happy to 

share with the Committee, on the oldest systems in the Federal 

Government, and some of them—including one at the Department 

of Defense (DOD) was operating still on a floppy disk system. On 

the one hand, they said, ‘‘Well, nobody is going to hack into it.’’ 

But, on the other hand—— [Laughter.] 

Chairman JOHNSON. Cybersecurity. 

Mr. DODARO. Protecting these systems against cyber attacks is 

not going to be sustainable over time. I cannot emphasize how concerned I am about this and how vulnerable we are. In 2003, we extended it to critical infrastructure protection across the country. 

Now, most of the computer resources are in the private sector 

hands, but there needs to be sharing between the Federal Government and the private sector. There is a lot of reluctance to share 

information in this regard on security threats. And, the threat is 

evolving much faster than the agencies’ ability to keep up with it. 

Chairman JOHNSON. Now, we did finally pass—and I would just 

say it is the table stakes first step in cybersecurity legislation 

here—in the Senate Intelligence Committee, but also in this Committee, the Federal Cybersecurity Enhancement Act. It provided information sharing, it provided liability protection, gave DHS a lot 

of authority in terms of imposing cybersecurity in the new EINSTEIN system on the agencies. Has that had any effect whatsoever? It was, again, just a very slow implementation. 

Mr. DODARO. Yes, those things help. There have been five different bills that have been passed. That has been one of the most 

important ones that you cite. It gives a sense of importance and urgency to it. There is some progress, but not enough to match the 

threat, in my opinion. 

Chairman JOHNSON. Inspector General Missal, obviously we have 

had some real problems at Tomah. Other Senators have had problems as well, specific problems. One of the questions I have for you, 

in your office—which I believe you took over a pretty troubled office, and I appreciate the fact now you have instituted mission 

statements and are trying to address that. Overall, what percent— 

and I do not expect a precise answer here, but what percent of your 

reports involve investigations on specific instances, either through 

whistleblowers or things you read in the news, which, of course, we 

refer a number of those to you, versus overall inspections just in 

general trying to address the problems in particularly the VA 

health care system? 

Mr. MISSAL. A very high percentage do. We have a number of different reports that come out. Our Health Care Unit will do reports 

on specific cases, much like you mentioned, in Tomah and other facilities. We do national reports. And then, we have a very vibrant 
14 

inspection program as well. Audits as well could be national, but 

we could focus as well on individual situations. So, it is a very 

healthy split of those. 

Chairman JOHNSON. So, almost a 50–50 type thing? 

Mr. MISSAL. Hard to estimate, but it is probably more than 50 

percent on individual situations at this time. 

Chairman JOHNSON. I was wondering if you were just being overwhelmed by individual instances, those taking up all your IG time, 

versus being able to concentrate on the day-to-day audits trying to 

improve the overall system. 

Mr. MISSAL. That is one of my goals. We are trying to clean out 

a lot of the work that was there when I started, which were a lot 

of the more individual cases. What I would like to move to is more 

impactful work, where we are doing more national health care reviews, we are doing more audits of programs, etc., and we are moving in that direction. 

Chairman JOHNSON. Inspector General Roth, you were talking 

about the challenges the Department has in terms of the Executive 

Order, implementing the reports, hiring the individuals. Hiring has 

been a real problem. You talked about hiring bottlenecks. Can you 

just quick describe those in the remaining seconds I have in my 

time? 

Mr. ROTH. Certainly. We did an audit of the hiring specifically 

with regard to Secret Service and CBP, and what we found there 

were bottlenecks as a result of the lack of advance planning. For 

example, they would not have the right kind of personnel specialist 

available to actually work the systems that they needed to work. 

That was one problem. 

The second problem that they had was that the systems that 

they had were antiquated, they did not talk to each other, so the 

actual sort of flow of paper and flow of bodies through the system 

did not work as well as it needed to. 

And, the third is, frankly, the polygraph system that both the Secret Service and CBP have in place creates significant bottlenecks 

with regard to getting people on board. 

Chairman JOHNSON. Can you just quick describe the bottleneck 

in the polygraph system? 

Mr. ROTH. Sure. Well—— 

Chairman JOHNSON. Lack of personnel? 

Mr. ROTH. It is that. I will just use Secret Service as an example. 

That is a collateral duty. It is a duty that a special agent would 

have in addition to the duties that he normally has of investigation 

and protection. Basically, he gets to the polygraphs whenever he 

gets to them. Of course, that is always going to drop low on the 

priority scale, and that backs up the kind of hiring that they are 

able to do. 

What we had recommended to the Secret Service as well as to 

CBP is to enhance, have a greater number of specialized polygraph 

operators who could do that work as their sole job. 

Chairman JOHNSON. So, it would seem to me that these bottlenecks could quite honestly be easily overcome. 

Mr. ROTH. Absolutely. It just requires some advance planning, 

and that is why we want to do a lifecycle approach on this hiring, 
15 

is to sort of warn them about what is coming and have them prepare in ways that make sense. 

Chairman JOHNSON. OK. Good. Senator McCaskill. 

Senator MCCASKILL. Thank you, Mr. Chairman. 

Mr. Dodaro, back in 2009, GAO did a report that concluded that 

Customs and Border Protection had not conducted any kind of costbenefit analysis on the effectiveness of physical barriers along the 

border. To your knowledge, has that cost-benefit analysis, which is 

required in any major business expenditure, has that ever been 

done? 

Mr. DODARO. Not to my knowledge. Let me just . . . 

I do not think so. 

Senator MCCASKILL. OK. 

Mr. DODARO. No. The answer is definitely no. 

Senator MCCASKILL. Definitely no. In your opinion, at GAO 

should something that is going to cost billions of dollars begin without a cost-benefit analysis? 

Mr. DODARO. No. 

Senator MCCASKILL. And, would it be typical to begin a multibillion-dollar project without any appropriated funds? 

Mr. DODARO. That would be difficult to do. No. 

Senator MCCASKILL. I understand the Administration is relying 

on a previous authorization for border security, which I certainly 

support border security, but do we know even how much this is 

going to cost based on what you have looked at? 

Mr. DODARO. Well, the last time when we looked at it in the 2009 

report, the estimates that were given at that time, it was $6.5 million per mile for fencing or barriers for pedestrian crossing and 

about $1.8 million for vehicular crossing at that time. Right now 

there is about—of the 2,000-mile border, there are about 650 miles 

where this fencing exists. Now, two-thirds of the remaining border, 

the Federal Government does not own. It is either State or it is private sector land. 

Senator MCCASKILL. So, it is going to have to be either bought 

or publicly condemned? 

Mr. DODARO. Yes, and part of that happened with the 650 miles 

as well. So, ownership—— 

Senator MCCASKILL. So, the Federal Government would be taking land from the ranchers that live along the border? 

Mr. DODARO. Or buy it from them. There would have to be some 

negotiation. There is the ownership issue of the border. There is a 

lot of rugged terrain along the border that would have to be dealt 

with as well. And then, there is the acquisition area that both the 

Inspector General from DHS and GAO have seen, is that the Department’s ability to manage large acquisitions is one of the reasons they are still on the High-Risk List. Part of that would have 

to be improving how they go about carrying out acquisitions. 

Now, with regard to the legal authority about the prior expenditures, I would have to go back, and I would have to take a look 

at that. Maybe there is some authority there that has not been 

used yet. But, generally speaking, you would have to have an appropriation available. 

Senator MCCASKILL. Let me move now to the Census. I have not 

looked at the contract, but I looked at the amount. We just entered 
16 

into a contract for almost $1 billion for an integrator. That is a lot 

of money, $887 million for T–Rex last summer to integrate, and we 

have had some bad experience, and Mr. Dodaro can certainly speak 

to that. In fact, integrators’ contracts have had a rocky history in 

the Federal Government in terms of success. And, I noticed when 

I was preparing for this hearing that you are asking them to integrate 50 different systems. Why do we need to make it that complicated, Mr. Thompson? Why do we need to integrate 50 systems? 

Can we not count people without integrating all of those different 

systems? 

Mr. THOMPSON. Thank you, Senator. We have 34 operations in 

place that we are planning to do for the 2020 Census, and they are 

supported by about 50 systems, as you mentioned. And, we gave 

your staff copies of those systems yesterday, and so the systems 

have to talk to each other, which is why we have—— 

Senator MCCASKILL. But why 50? I am somebody who just landed from another planet. Explain to me what you are doing with 50 

systems. Why do they all have to be combined for counting people, 

especially since we are going to be doing self-reporting I believe for 

the first time on the Internet? Why? I do not understand. 

Mr. THOMPSON. Right. Let me give you some examples. We have 

one system that we allow people to respond over the Internet with. 

That has to be integrated and talk to our control system so we 

know how many people have responded over the Internet, so we 

want to go out and collect the information—— 

Senator MCCASKILL. OK. There is one. 

Mr. THOMPSON. Right. 

Senator MCCASKILL. Forty-nine to go. 

Mr. THOMPSON. Right. Then we have to be able to do the in-person non-response, so we have to have a control system for that. We 

have to know—— 

Senator MCCASKILL. OK, the people that do not answer, you 

have to go out and find them and talk to them. 

Mr. THOMPSON. Right. And then, there has to be an instrument 

that collects the information from the people that do not respond, 

so we have to give our interviewer the handheld device—— 

Senator MCCASKILL. The handhelds hopefully this time. 

Mr. THOMPSON. Right. 

Senator MCCASKILL. Which we had to scrap last time. 

Mr. THOMPSON. I understand that. I would be happy to go on, 

but there is a need for each one of these systems. We have really 

carefully looked at the systems that we need because we do not 

want to make it overly complicated. 

Senator MCCASKILL. Well, 50 sounds very complicated, Mr. 

Thompson, and it may be that you absolutely have to have all 50. 

But, I do not think you are on schedule. Some of it is funding, I 

agree. But, you need to have an end-to-end test, I believe you are 

planning for 2018. 

Mr. THOMPSON. Yes. 

Senator MCCASKILL. And, you need to have more tests in 2017. 

You are already scrapping some of the projects you were going to 

do like in Spanish-speaking areas. I just worry that we are going 

to have deja-vu all over again, that we are making this more complex than it needs to be. Are you confident that—I mean, because 
17 

it seems to me in this day and age asking people to respond on the 

Internet—and on that, let me briefly go to another item. I think 

people are going to be reluctant to give their personal information 

over the Internet unless they are reassured about the security of 

that information. 

Are you working with DHS right now, are you working with 

other people in the area of cybersecurity so that you are confident 

you are going to have the protection of that data that will reassure 

people? Because every person who responds over the Internet is 

going to save us real money. 

Mr. THOMPSON. Yes, we are working with DHS, we are working 

with the National Institute of Standards and Technology (NIST), 

we are working with some private contractors to try to do penetration testing of the systems that we have. We do take that very seriously, and we are trying to work with the best on that. 

We also, by the way, do employ the EINSTEIN software on our 

Internet connections, so we are protected by that, too. We worked 

with DHS to get that in place. We take that very seriously. 

Senator MCCASKILL. Thank you, Mr. Thompson. 

Thank you, Mr. Chairman. 

Chairman JOHNSON. Senator Carper. 

OPENING STATEMENT OF SENATOR CARPER 

Senator CARPER. Thank you. Thank you so much. We appreciate 

more than you know the work that is done at GAO on a lot of 

areas, but especially in preparing the High-Risk List. I have said 

for years that for me, for my staff and I, it is our to-do list. And, 

I think for this Committee, Democrats and Republicans, it is our 

to-do list. 

When you and I met earlier this week, we talked about some 

areas where progress has been made. One of those is with respect 

to property management, real property management. Would you 

explain why you think we have finally got the ball in the end zone 

on that? 

Mr. DODARO. Yes. First, the Administration finally issued a national strategy to deal with this, to lay out with some goals and 

measures, to really have a good plan. To make progress you need 

that. 

Second, Congress really helped a lot with the passage of two bills 

at the end of last calendar year. One would be creating an independent board to make recommendations to sell or dispose of some 

high-value property that the Federal Government has. That is a 

good step forward, I believe. The second bill codified the Federal 

Council, the property management council in place, gave it some 

to-do lists. Congress required them to improve the data, to regularly report. Hopefully it will result in a reduced reliance on leasing as well. That is an area that still needs to be addressed. The 

Federal Government leases some property for decades that it would 

have been far cheaper to build rather than lease. We are trying to 

get the agencies to focus on some high-value leases and doing a 

cost comparison in those areas. They are starting to improve the 

accuracy of the information in the property management database. 

So, some leadership, some strategies, good support from the Congress, all these are ingredients to the progress. 
18 

Senator CARPER. Good. Thank you. 

There is a law called Federal Information Security Management 

Act (FISMA). I believe that is what it stands for. 

Mr. DODARO. Yes. 

Senator CARPER. But, that has been around forever and, frankly, 

not apparently too effective in terms of real-time security for Federal—the dot.gov domain. We passed FISMA legislation. I think a 

number of us on this panel worked on it. Dr. Coburn worked on 

this when he was with us as well. General Roth, do you have any 

sense for how the passage of that legislation is being implemented 

for good or for not? The idea is to make it real-time and not after 

the fact. 

Mr. ROTH. Yes, continuous monitoring, and I will have to say 

from DHS’ point of view, we had a somewhat different experience 

than what Mr. Dodaro recounted. I think in the last year of the 

close of the Administration, there was a real sprint based on some 

of the high-profile hacks that had occurred in other agencies, to try 

to get, for example, continuous monitoring online, to get all components to actually report the results to a central headquarters location, to get two-factor authentication on every machine and every 

user having two factors—in other words, a card that they stick in 

plus a password; and then, last, to get what is known as authorities to operate, which is basically a license, a certification by the 

Chief Information Officer (CIO) that those systems, in fact, are effectively locked down according to FISMA standards. 

We have seen, I think, some improvement. Obviously, with DHS 

there is a long way to go, but particularly in the last year, we have 

seen some improvement. 

Senator CARPER. One of the things that we did in this Committee 

is to make it possible for DHS to compete for cyber warriors in 

terms of the kind of pay and personnel policies that they could offer 

to compete, whether it is against the National Security Agency or 

the private sector. Does anybody know whether or not that is making a difference yet? We did it over a year ago. Does anybody know, 

anybody have a feel for that? 

[No response.] 

OK. When Jeh Johnson became the Secretary and Ali Mayorkas 

became the Deputy Secretary of the Department of Homeland Security, I suggested to them that they do what Jane Holl Lute used 

to do when she was Deputy Secretary at DHS, and that is, go every 

month or two to GAO and sit down, whether it was Gene or some 

of his top folks, and just literally go through the High-Risk List 

that pertains to the Department of Homeland Security. My sense 

is that they did that, and my sense is it has made a difference. 

Would you just confirm or deny that for us? 

Mr. DODARO. Yes. The relationship we have had with the Department of Homeland Security is really kind of a model on how to deal 

with the High-Risk List. When I first met Jane, she was puzzled 

as to why they were on the list, so I sent a 20-page letter over that 

said, ‘‘Here is everything you need to do.’’ She said, ‘‘I understand,’’ 

and they developed a plan, and every so many months they reported to us. We had quarterly meetings, and they made real 

progress. We agreed on 30 things that needed to be done, needed 
19 

to be measured. They fully met 13 of them now. They still have a 

ways to go on the remaining piece. 

I have suggested that model that could be used in other places 

particularly at the VA with the High-Risk areas as well, and so 

that—— 

Senator CARPER. We just confirmed a new Secretary of the VA, 

Dr. Shulkin, who I think is going to be a good one. 

Mr. DODARO. Yes. 

Senator CARPER. His predecessor certainly was, Bob McDonald. 

We have the Inspector General here for the VA, right? 

Mr. MISSAL. Correct. 

Senator CARPER. One of my pieces of advice to Dr. Shulkin would 

be to spend time with you and to develop a constructive relationship, a good working relationship, and figure out how you and your 

folks can help the VA going forward, and the same idea with GAO 

and the High-Risk List. 

Mr. DODARO. Right. I try to meet with every Cabinet official, to 

talk about the high-risk area. We have had a series of meetings 

with OMB, the agency on the High-Risk List, and GAO, which I 

personally participate in, and that has, I think, had some benefits 

and showing progress. 

Senator CARPER. Good. Mr. Thompson, how are you doing? 

Mr. THOMPSON. I am doing fine. Thank you, Senator Carper. 

Senator CARPER. Good. Nice to see you. Give us one thing that 

we can do at our end, in addition to what we have already done 

with respect to the Census, to make sure the next Census comes 

in on time, on budget, maybe even under budget. What are maybe 

one or two things that this Committee and the Congress need to 

do to be a good partner? 

Mr. THOMPSON. Well, thank you for the opportunity, Senator 

Carper. As I said in my testimony and in my oral testimony, one 

of the issues that we are dealing with is the uncertainty of our 

funding. And, I know this is not Appropriations, but I know that 

we have good support so far from both Congress and from OMB 

and the Administration. If that continues, that will be very good. 

Like I said, we are in a very pivotal year right now, 2017. We 

would like to get some uncertainty lifted there. We also are looking 

forward to working with the Administration on the 2018 budget, 

and with the Congress. So, support there. Also help with getting 

administrative records. I know we have talked before about getting 

access to the National Database of New Hires, and your support 

there would also be very helpful. 

Senator CARPER. Good. Thank you so much. Good to see you all. 

Thank you. 

Chairman JOHNSON. Thank you, Senator Carper. Senator 

Portman. 

OPENING STATEMENT OF SENATOR PORTMAN 

Senator PORTMAN. Thank you, Mr. Chairman, and I appreciate 

your holding this hearing regularly, and this is an opportunity for 

us to gauge progress in some of these high-risk areas. And, some 

of these topics you have already discussed with others, but the two 

that jump out to me are real property and you talk about in your 

report the need for us to move more rapidly from leases to owner-
20 

1The information submitted by Mr. Dodaro appears in the Appendix on page 147. 

ship where there is a long-term lease that is not cost-effective. You 

also talk about physical security at Federal buildings, and I want 

to probe those a little further. 

But, the one that always troubles me is the number of Federal 

facilities that are not being used or are not fully used, and yet we 

cannot seem to transfer those to either cities or States or private 

sector or nonprofit needs. This is where Senator Carper and I and 

the Chairman and I and others have worked on this over the years, 

including back when I was at OMB. 

Can you give us, Mr. Dodaro, a report on that part of the real 

property high risk that you over the years have identified? Where 

are we on the disposal of these properties? 

Mr. DODARO. Yes. An example we give in our report is the Cotton 

Annex building for which GSA recently received a successful bid. 

Once the sale grows through GSA it will transfer ownership to the 

buyer. So, there is some progress, but it is not a lot. That is why 

I think this legislation that Congress passed last year to set up this 

independent board to identify some high-value real properties is an 

important step forward. 

Now, some of the properties are not worth a lot or they need a 

lot of repair, and the agencies have not had enough money to fix 

up the properties to make them appealing or attractive to sell, 

which is one area that I think has not been explored very much. 

Another area on our list is the Postal Service. They have a lot of 

vacant space now that I think could be perhaps rented out to other 

Federal agencies, which in turn could create other vacant space 

that could be sold and transferred. 

The bottom line to answer your question is there has been some 

progress incrementally, but not as much as I would like to see. 

Senator PORTMAN. It seems like one reason you say there has 

been progress is that year-end we did pass those two bills finally. 

Mr. DODARO. Right. 

Senator PORTMAN. They should not have taken so long. One does 

provide for an inventory. Another does provide for this commission. 

Is that part of the reason you think things are going better just because we have set in place now some new laws in relationship to 

this? And, now I suppose our job is, along with you, to monitor the 

implementation of that and make sure it is actually done right. 

Mr. DODARO. That is exactly right. In my experience over several 

decades now, most major management improvements that succeed 

in the government have a statutory underpinning to them, because 

it brings a degree of continuity and certainty over time, and then 

Congress can hold people accountable. 

Senator PORTMAN. Yes. Can you tell us this afternoon how many 

square feet or how many buildings or what the value is of those 

buildings that are either not being used at all or are only partly 

being used? 

Mr. DODARO. I do not have that information ready. I will be 

happy to see what is available and provide it for the record.1

Senator PORTMAN. It is an extraordinary number, and it is a 

great opportunity to save some taxpayer money, too. 
21 

With regard to cybersecurity, you talked a little bit about this 

earlier, but one of the challenges you cite in your report is the 

agencies and departments having that cybersecurity workforce. 

With regard to DHS, looking at Mr. Roth, we have specific legislation that was meant to address that to try to attract some of the 

best and brightest and retain some of the good people. 

For both of you, how is that working? How is the framework 

working? Are you pleased with it? Is it something that you think 

we are making progress on or not? 

Mr. ROTH. Anecdotally, it seems like the Chief Human Capital 

Officer (CHCO) at DHS is trying some innovative solutions with regard to hiring IT specialists and cyber specialists. Our plan was to 

let this go for a little bit just to have them get their sea legs before 

we do a formal audit. But, anecdotally, I think they are using this 

opportunity to try to hire as many as they can. 

Senator PORTMAN. The idea of the legislation—and this was 

started back in 2014 with Senator Bennet and myself—was to establish some common language and job codes specific to 

cybersecurity because we had identified that as a problem, that it 

was difficult to hire people because we had not provided the sort 

of standardization as to what the job descriptions were and job 

codes. And then, we got some of the legislation passed as it relates 

to DHS, and, frankly, I just do not know that we are making the 

progress that we should be. Clearly, when you look at what is happening with regard to the hacking not just in government but all 

over now, this is a huge priority, and these people are in high demand, that is, the people that have the cybersecurity skills to be 

able to push back or go on the offense. 

But, you think, Mr. Roth, from your time at DHS that you see 

progress in this area? And, if not, what do you think we need to 

do? I mean, the rest of the government is not subject to the same 

rules that you are under this legislation. You are sort of the beta. 

You are like the test case here. Is it helping? Is it working? 

Mr. ROTH. As I said, we have not done a formal audit of it, so 

it is very difficult to make a formal conclusion. But, anecdotally, we 

see DHS trying different things. For example, they had a job fair 

in which they brought a number of people who were qualified 

under that IT specialist and, were able to provide offers on the 

spot. 

We are hopeful, but, again, until we actually do a formal piece 

of work on it, it is difficult to conclude. 

Senator PORTMAN. Could you do that work on it and let us know 

how it is working? One of the aspects, as I recall, was a central 

database to simply—which seems common sense but was not being 

done. Is that being done to your satisfaction? Is there a central 

database now where people know what all the cybersecurity needs 

are and that, as you said, when there is a job fair, can people give 

an offer without having to go through a long process? One of the 

things we found was that people just were not patient enough to 

wait for the government response. They needed to know right 

away. Are they getting the job or not? They had other offers in the 

private sector. 

Mr. ROTH. Right. My understanding is that they recently held 

one of the first job fairs that, in fact, did that. But, again, this is 
22 

anecdotal. This is what they are telling me. We have not validated 

it. But, we will bring this request back, and it seems like it is—— 

Senator PORTMAN. How long would it take you to audit that and 

to get back to us? 

Mr. ROTH. It typically takes 6 to 9 months to do a full-fledged 

audit. 

Senator PORTMAN. Could you speed that up and get back to us 

in 6 months? 

Mr. ROTH. We will do what we can. 

Senator PORTMAN. I know there is a lot of interest in the Committee on that topic, and obviously an urgent issue, to be sure that 

we have the capability to be able to push back and to go on the 

offense where necessary. 

Thank you very much, Mr. Chairman. 

Chairman JOHNSON. Senator Lankford. 

OPENING STATEMENT OF SENATOR LANKFORD 

Senator LANKFORD. Thank you. All of you, thank you for the 

work that is ongoing. We appreciate it very much. I have about 45 

questions in 7 minutes here. [Laughter.] 

So, let me try to get through as many as I can. 

Mr. Dodaro, just a request for you as well. This Congress 

changed the W–2 forms and the acceleration of that, small delay 

in the returns coming to try to deal with identity theft and to deal 

with fraud. Is that something a year from now you will be able to 

tell us how it went? Obviously, that is just being implemented right 

now. When do you think we will get results on that? 

Mr. DODARO. Yes, we will review the use of that for this filing 

season, and I am very pleased and appreciative that Congress 

acted on our recommendation to do that. I think it will be tremendously helpful, and we will report on that. 

Senator LANKFORD. That is one that should have been done before. We obviously lost billions of dollars on that over the past several years with the lack of action. 

For those of us that work in Indian policy, I was a little surprised to be able to see that some of the Indian issues for the first 

time were on the High-Risk List. So, my question to you is: Is this 

a new issue or a first time to look at the Indian issues? 

Mr. DODARO. It is not the first time to look at the issues. It 

reached the threshold from my standpoint when I saw it on multiple fronts. 

Senator LANKFORD. Right. 

Mr. DODARO. Schools, health care, energy resources, and I 

thought it was time to elevate the attention. 

Senator LANKFORD. It is clearly a national tragedy, some of the 

things that are happening in some of the Indian country, and I am 

so glad to be able to see it reach that limit. This is something that 

needs to be addressed. 

Can I ask specifically on the health care side, when you look at 

the health care, are you examining the differences between tribes 

that run their health care or between the Indian Health Service 

(IHS) running the health care? There are some locations where the 

tribe builds it or operates a facility, and so really they would all 

be listed under IHS. But, the operational system is very different 
23 

whether the tribe is running it or whether it is being run nationally. 

Mr. DODARO. Yes. We have been focused on the Federal facilities, 

not the tribe facilities. 

Senator LANKFORD. OK, even though they have an IHS footprint 

there in the middle of it as well. 

Mr. DODARO. Right, so far. And, we have not looked at that because—— 

Senator LANKFORD. That may be a good control to be able to look 

at it at some point. 

Mr. DODARO. OK. 

Senator LANKFORD. Just to be able to examine it, because there 

are some obvious differences between how they run and what is 

happening to be able to see the differences as we are looking for 

solutions for the long term. 

Mr. DODARO. OK. That is a good point. 

Senator LANKFORD. That is health care. Let me ask about the 

issue on Choice. There has been some conversation ongoing about 

VA and occasionally giving the appearance, at least, of dragging 

their feet on implementing Choice and some of the pushback on 

that. What are you experiencing? And, does it look like VA is currently actively implementing the Choice program in the locations 

and the way law States? 

Mr. MISSAL. Yes, we have some reports that we have already 

issued. We also have some work that is in progress right now. It 

does appear that progress is being made. Like, for instance, with 

respect to network providers, the physicians who are providing the 

health care outside of VA, those numbers have increased fairly dramatically, according to VA. There are still issues there with respect 

to Choice program that we are looking at. We are looking at access. 

We are looking at payments as well, as well as the sharing of 

records. When a veteran goes out into the community, there is an 

issue in terms of making sure the records get back to VA so that 

the VA system will have those records as well. 

Senator LANKFORD. OK. Terrific. Is there a way to be able to get 

an accurate number of the cost per patient per procedure that actually includes everything the private sector would include? When I 

have asked VA before for costs for certain items, capital expenses, 

all of those things were all different colors of money. Obviously, in 

the private sector they cannot do that. So, we cannot really get an 

accurate cost of what things are other than it is always more expensive in the private area, but we really cannot find out what it 

is from VA. How do we get that number? 

Mr. MISSAL. We have not looked into that. I think there would 

be challenges to getting that, but I certainly will take that back 

and see whether we can get that done. 

Senator LANKFORD. OK. That would be very helpful. Obviously, 

every business has to do that to be able to calculate what the actual cost is, including their capital costs and depreciation and such. 

It would be helpful for us to be able to have an apples-to-apples 

comparison as we deal with issues in the VA in the days ahead. 

Mr. Dodaro, the Social Security Administration (SSA) is not completely done with everything they need to do, especially in the disability area. Very small progress that you have noticed. One of my 
24 

1The information submitted by Mr. Dodaro appears in the Appendix on page 148. 

great frustrations is we have talked with them at length, multiple 

hearings on the occupational grid. Now, you know full well what 

that is, but for everyone else here that is tracking that, the occupational grid is basically a big dictionary of all jobs in America because, according to disability, you cannot be employed by any job 

available in the economy. Since 1978, that list has not been updated. There seems to be some slight changes in our economy since 

1978 in the type of jobs. My recollection from your report is we have currently spent $178 

million updating the job dictionary of the jobs in America, and we 

still do not have that dictionary. Is that correct? 

Mr. DODARO. GAO has been tracking SSA’s progress in replacing 

the Dictionary of Occupational Titles and obtaining more current 

occupational data. We will provide information for the record.1 We 

are particularly concerned about that they have not finalized the 

ability to use assistive technologies. I think personally the Congress may need to act to update some of the disability laws that 

underpin the process that the Social Security Administration is following. I think if you wait for them to do this job, it is not going 

to get effectively reformed. 

Senator LANKFORD. I could not agree more, and I would tell you 

that when we get the grid updated, we need to have a mandate 

that the grid is periodically updated on a routine basis rather than 

waiting every 40 years to be able to update it. We might want to 

update it more often than that, plus do some other disability work 

that desperately needs to be done. 

Mr. Thompson, let me ask you about the American Community 

Survey (ACS). The last time you and I talked a little bit about it, 

you were testing out some pilots on trying to remove some of the 

mandatory language to see how that would work. Obviously, people 

that get it often hate the American Community Survey. How is 

that going and the testing and removing some of that mandatory 

under penalty of law language? 

Mr. THOMPSON. We have been working on testing some language. 

We have actually done some focus groups looking at the language, 

and we are at the point where we have come up with some language that we believe is not as threatening. We would be happy 

to share that with you. 

Senator LANKFORD. Great. When will that be piloted out in the 

public? 

Mr. THOMPSON. We have already tested it in the public. We are 

doing one more test this year, and then we will be ready to go. 

Senator LANKFORD. Great. That would be helpful to see. And, on 

the Internet filing for the Census, may I assume that you are 

somehow combining that with the online filing of taxes? Because 

millions of Americans file their taxes online, is there a possibility 

they can also file their Census work at the same time they do their 

taxes? Or are we talking about two different passwords, two different systems, two different requests from people to be able to do 

their taxes at one point online but their Census at another point? 

Mr. THOMPSON. Right now we are looking at a separate system 

for Census and for the IRS. 
25 

Senator LANKFORD. There is no way that people could fill out 

their Census work while they are also completing their taxes? The 

information is—obviously, there is not that much—— 

Mr. THOMPSON. We would love to work with the IRS and have 

them be able to direct people to our site to fill it out, but we have 

not—— 

Senator LANKFORD. But, they could not complete their taxes and 

also complete their Census work at the same time? 

Mr. THOMPSON. Not at the current point in time, no, sir. 

Senator LANKFORD. So, not by 2020, certainly if that is not being 

tried. 

Mr. THOMPSON. No, sir. 

Senator LANKFORD. OK. Thank you. 

Chairman JOHNSON. Senator Tester. 

OPENING STATEMENT OF SENATOR TESTER 

Senator TESTER. Thank you, Mr. Chairman. I think that is a 

great idea, Senator Lankford. Yes? 

Mr. DODARO. The only issue with that—and John could correct 

me if I am wrong, but I think the Census count is on a particular 

day, who is resident and how many people are resident on—was it 

the April 1st date. Your filing dates are different than that, so you 

would want to collate the specific dates. 

Senator TESTER. Move it to April 15th. [Laughter.] 

At any rate, that is not why I came. First of all, thank you all 

for your testimony. This is for you, Gene and Mike, mainly with 

the Veterans Choice program. Can you tell me how reactive—either 

one of you—the VA has been with your recommendations of being 

on the High-Risk List? Have they taken this pretty seriously? Have 

they dragged their feet or are they kind of—what have they done? 

Mr. DODARO. With regard to the recommendations that we have 

made, they are beginning to take some action on that, but we had 

new ones. There are still over 100 that are outstanding, Senator 

Tester, but I am very concerned they do not have a good plan for 

addressing the high-risk areas. We say that in our report. 

Senator TESTER. Did you tell them that? 

Mr. DODARO. Oh, yes. I met with Secretary McDonald three 

times: once to tell him we were putting him on the High-Risk List, 

he agreed; second, to tell him they did not have a good plan to 

come off the High-Risk List; and the third time was to offer GAO’s 

experts in different areas—IT, for example—to help them understand best practices on how to do this. We had the meeting, but 

there has been very little uptake. 

Senator TESTER. Mike, where do you interface on this process? 

Mr. MISSAL. Well, we interface because a number of the areas 

identified in GAO’s high-risk area are also areas we are looking at 

as well. 

Senator TESTER. OK. 

Mr. MISSAL. Like, for instance, IT is one area where we have a 

group focused on that. 

Senator TESTER. So, how has their response to you been? Has it 

been proactive or has it been, ‘‘Ahh, what the heck?’’ 

Mr. MISSAL. They say they are committed to adhering to the recommendations that we have. 
26 

Senator TESTER. Have you seen that commitment in action? Saying it is one thing, doing it is another. 

Mr. MISSAL. In some respects, yes. For instance, for VHA where 

we had—at our last semiannual report, there were 563 outstanding 

recommendations. They have now reduced that to 320-some-odd. I 

believe they are trying, but there are still some areas which give 

us great pause. 

Mr. DODARO. I am very concerned, Senator, that they are not 

making the progress that I would like to see. I am planning to 

meet with Secretary Shulkin to talk about this. There is also a disagreement we have with them on wait times. We think veterans 

are waiting too long. The measure of wait times, of when there is 

an appointment scheduled, they are not measuring the whole experience. The IT systems—I could go on and on. 

Senator TESTER. Gene, you have a lot of fans in Congress. You 

do. I think you can tell Dr. Shulkin that—and I say this as Ranking Member on VA. If they do not take these seriously, we are 

going to. We will do what we need to do on the VA Committee to 

hold them accountable to make sure that your suggestions are not 

just given lip service but actual productivity on it, because as has 

been pointed out by the Chairman and Ranking Member and yourself, you guys have saved a bunch of money. Efficiency is not a bad 

thing. And so, you can certainly utilize that. 

You brought up the housing finance system in your opening remarks, Gene, and that is something that we have worked on a bit. 

I agree with what you said. Taking the taxpayers off the hook and 

getting it out of conservatorship is really important. Do you guys 

ever get a chance to look at any of the legislation that we do? Is 

that within your purview to see if it actually solves the problem? 

Because there is legislation out there that actually I think gets to 

some of your points, but I do not know if it gets to your points. 

Mr. DODARO. Well, if we are asked to look at legislation and comment on it, we will. 

Senator TESTER. Have you been asked to look at the WarnerCorker legislation from a few years back on housing? Somebody is 

giving you a note. 

Mr. DODARO. Yes, and it basically says what I already said. 

Senator TESTER. Good. [Laughter.] 

Because that is what I thought it said, too. 

Mr. DODARO. Yes, but we have developed a framework for evaluating legislative proposals. I would be happy to look at any legislative proposal, but we do not do it proactively unless we are asked. 

I would be happy to do it. 

Senator TESTER. But, you have already done it, you said. 

Mr. DODARO. No. We could evaluate a legislative proposal 

against a framework that we developed to assess proposed changes. 

I was so concerned, about the weakness in the housing finance system, that I started a study under my own authority, to develop this 

framework. It describes the elements that when applied, should 

help reveal the relative strengths and weaknesses of proposed reforms, and identify what are likely significant tradeoffs among 

competing goals and policies. 
27 

1The chart referenced by Senator Johnson appears in the Appendix on page 126. 

Senator TESTER. I think we will do our best to get that in front 

of you so we can get your recommendations to make sure we are 

not pushing that does not solve the problem in its entirety. 

Mr. DODARO. I would be happy to. 

Senator TESTER. Thank you. 

Last month, Senators Durbin and Duckworth requested an IG report regarding broad implementation of President Trump’s refugee 

ban. This is for you, Mr. Roth. When would you anticipate this to 

be completed? 

Mr. ROTH. Some of it depends on the Department’s response. We 

have already started a number of field interviews with the various 

airports, the individuals, the CBP officers there. We have requested 

documents. We have very good cooperation from CBP. We are going 

to be starting the high-level interviews hopefully as early as next 

week. 

We do not know how long it is going to take because we do not 

know what we are going to find, but my direction is that it ought 

to be weeks, not months, and we are working as quickly as we possibly can. 

Senator TESTER. OK. I appreciate that. Have you had any difficulties getting the documents that you need for your investigation? 

Mr. ROTH. No. The cooperation has been very good. 

Senator TESTER. All right. And so, there are no findings you can 

share with us today, I would assume. 

Mr. ROTH. No, but we understand the urgency, and we are moving as quickly as we can. 

Senator TESTER. OK. Well, I appreciate all your work. Just a 

closing comment, and this is not why I came here at all, but the 

Census figure because of technology should be going down, not continually going up. This figure should be costing the taxpayers less, 

not more. My guess is you could probably get a hold of Facebook, 

they could tell you where everybody lives today or on the 1st of 

April. So, it would not hurt to maybe interface with those folks to 

find out how they can help you and save money. 

Mr. THOMPSON. Thank you, Senator. We actually do talk to 

Google and Facebook quite a bit to understand how they can help 

us. 

Senator TESTER. OK. I will ask you the same question I asked 

Dodaro. Talk is one thing. Doing is another, OK? All right. Thank 

you very much. I appreciate all your work. 

Chairman JOHNSON. Senator Tester, as long as you brought it 

up—I appreciate you looking at our charts1—I will just give Director Thompson a chance to respond. Why has the cost, for example, 

per household increased by such a dramatic amount? These are inflation-adjusted dollars. Twelve times in terms of total dollars 

spent, why is that? And, again, we are mindful of the fact you just 

started in this decade. 

Mr. THOMPSON. Right. Actually, I started working at the Census 

Bureau as a career person in 1975, and I worked there through the 

2000 Census, and I was the career executive for the 2000 Census, 
28 

so I have a lot of experience with the Census costs. I know there 

are two underlying causes for this. 

One, which is not the major cause, is that the population has 

grown. But, that does not explain this growth. 

The other factor is that we have been doing the same Census 

process since 1970, essentially, and that is, we mail out, they get 

mailed back, we capture the information electronically off the 

forms, and then we go out and we collect the information from 

those that do not self-respond. That operation has always been a 

paper-and-pencil operation. As our population has gotten more 

complex and gated communities, different and more languages, the 

only way you can adapt a paper-and-pencil process to that is to put 

more people on it. 

Just to give you an example, in 2000 we determined that the job 

had gotten so difficult for the people supervising the enumerators, 

we had to give them an extra assistant, and that added $250 million to the cost of the 2000 Census in 2000 dollars. So, it is has 

really been the fact that we have had a paper-and-pencil process 

and we just had to throw more and more people at it. 

Chairman JOHNSON. It is not the requirements increase in terms 

of what you are collecting? It is really just the complexity of the 

population? 

Mr. THOMPSON. The basic Census questions have been essentially the same since 1970. We have had a long form and a short 

form. The short form has been about the same. In 1980 Hispanic 

origin was put on the short form, but it has been about 10 questions. And, the long form or the ACS now, it has been about the 

same length. 

Chairman JOHNSON. Mr. Dodaro. 

Mr. DODARO. Mr. Chairman, I believe another contributing factor 

is the fact that the Census has been done through a mail process, 

but the response rate has gone down considerably since 1970. I 

think in 1970, John, it was like about 78 percent or over 70 percent; now it is down to about 60 percent. So, if people are not responding, then they have to go send people out to their homes. 

Even if you use the Internet, the question is—using Facebook or 

other media—will they respond? That has been a challenge for the 

Census, particularly as the demographics change in the country. 

There are notably a number of hard-to-enumerate areas and lowincome and minority populations that Census is working hard on 

with special projects. 

I think, the question is: How willing are the American people to 

provide the information? 

Chairman JOHNSON. My guess is we will be holding a hearing on 

this in the future, so that would be good, just up front give an explanation of that. Senator Harris. 

OPENING STATEMENT OF SENATOR HARRIS 

Senator HARRIS. General Roth, thank you for your years of service. I have a few questions for you. You indicated in fiscal year 

2015 that it took on average about 9 months to make a hire at U.S. 

Immigration and Customs Enforcement (ICE). Is that correct? 

Mr. ROTH. That is correct. 
29 

Senator HARRIS. OK. My rough math tells me it would 

take—if it takes that long for each person that needs to be hired 

to fulfill the directive from the Executive Order, it would take 

11,250 years to process an additional 15,000 officers. Now, I am 

sure it will not take that long, but have you assessed how long it 

would take you based on current standards to actually bring on 

board the 15,000 new officers that are directed? 

Mr. ROTH. We have not. The only thing that we have looked at 

is the last time that there was a surge of deportation officer 

hirings, for example. That number that is reflected in my testimony 

actually almost quadrupled. In other words, when you try to put 

more people through the same pipeline, the logjams are going to 

get even greater. So, that is why we want to sort of take a look 

at this earlier. 

Again, they are not hiring one at a time serially. They are trying 

to do it sequentially. And, I would say that is from the moment 

that the announcement has closed to the time that that person is 

actually hired. But then, of course, there is training and all sorts 

of on-boarding that would have to go on. So, that 9-month number 

is actually quite a bit longer. 

Senator HARRIS. Have you been given a timeline for when those 

15,000 new officers should be brought on board? 

Mr. ROTH. We have just started our work on this area, so we do 

not have any information yet as to what the Department’s plans 

are in this area. 

Senator HARRIS. Has there been any discussion about a goal in 

terms of a date that that would be completed? 

Mr. ROTH. Not yet. Some of this depends on what the Department’s planning is. What we do with lifecycle audits is we will take 

a look, for example, if it is an acquisition, we will look at the phase 

of figuring out what the need is, for example, or the requirements, 

and then we will basically follow the Department through that 

process. I do not think the Department has yet started or at least 

I am not aware that the Department has actually started the initial process of figuring out how it is that they are going to on-board 

this many people. 

Senator HARRIS. And, I appreciate that in your testimony you indicated that you will audit with the aim of ensuring that DHS can 

quickly and effectively hire a highly qualified and diverse workforce. Is that correct? 

Mr. ROTH. That is correct. I think that is the Department’s goal 

as well. 

Senator HARRIS. Great. So, just based on my experience as a 

prosecutor in California, we know that when we bring officers, law 

enforcement officers, on board, we want to bring them on board 

after we have had an ability to vet who they are and to ensure that 

they actually will be able to perform their job in a correct manner. 

Do you have any concern that with this historic goal of bringing on 

15,000 new officers—I understand there are only 7,000 there 

now—that we might compromise our ability to bring on highly 

qualified officers? 

Mr. ROTH. Certainly the last time CBP had a hiring surge, there 

was a concern about the level of quality that they were getting, and 

as a result, for example, that is when Congress stepped in and in-
30 

stituted mandatory polygraphs, for example. But, that is always an 

issue any time that you try to increase the hiring; the worry is that 

you are going to reduce the quality. I think that is something we 

will look at as we move forward in this process. 

Senator HARRIS. Can you then give us in about 3 months an update on what you might believe Congress should do in this circumstance to ensure that we are bringing on highly qualified officers? 

Mr. ROTH. As I said, this will be a process, so I cannot really 

commit as to when we are going to get the first product out there 

that will sort of describe what the Department is doing, but we will 

certainly do this on an ongoing basis. Of course, as an IG, we are 

committed to keeping Congress fully and currently informed. 

Senator HARRIS. What would you recommend I ask you as a 

timeline for when you would come back to report the status of the 

quality of the officers who are being brought on board? 

Mr. ROTH. I think in about 3 months we are going to know a lot 

more about what the Department’s process—— 

Senator HARRIS. Three months, that is fantastic. That is great. 

Mr. ROTH. As I said, in 3 months we will know more. [Laughter.] 

I do not know if we will have—— 

Senator HARRIS. Well, what you know I would like to know, too, 

so I will expect you to come back, and we can arrange it through 

the Chairman and the Ranking Member. 

Mr. ROTH. We are happy to brief anybody on the Committee who 

would like to hear about it. 

Senator HARRIS. Thank you. One of the concerns that we have 

had across the country in terms of law enforcement officers is that 

we are adequately hiring and then training with an eye toward implicit bias and procedural justice concerns. What in your audit is 

detecting and tracking the Department’s ability to hire in a way 

that we look for implicit bias and also train so that we avoid implicit bias and that we encourage procedural justice? 

Mr. ROTH. We have not looked specifically at that issue. Again, 

this series of audits is going to be more mechanically based, that 

is, how it is that you take a great number of people and try to fit 

them through what is really a finite pipe. 

Senator HARRIS. Yes. 

Mr. ROTH. We do, of course, as part of what we do a lot of civil 

rights/civil liberties investigations, excessive use of force, those 

kinds of policing issues, which we will continue to do, of course, as 

our mandate. But, we have not specifically looked at that issue. 

Senator HARRIS. What would be your recommendation based on 

your experience that we could do to audit beforehand so we can 

prevent what otherwise would be something you are going to have 

to react to afterward, which is that there will be distrust, there 

could be very unintended and serious consequences, including lethal consequences, if we are rushing through this large number of 

people without properly vetting them on this issue, and, in particular, when we are talking about ICE agents and the issues that 

are at play? 

Mr. ROTH. Well, I think one of the issues is a leadership issue, 

and so this Committee obviously will have the opportunity to take 

a look at who the nominees are for these various positions and get 
31 

the kinds of commitments that I think would be required to send 

the message to the rank-and-file as to what is the appropriate level 

of conduct that the rank-and-file has. If you are asking me my advice, my advice is to take the advice-and-consent process very seriously when it comes to the ICE Director and when it comes to the 

CBP Director. 

Senator HARRIS. Thank you. 

Chairman JOHNSON. Senator Paul. 

OPENING STATEMENT OF SENATOR PAUL 

Senator PAUL. Thank you. Mr. Chairman, if you want to save 

money on the Census, maybe we could, let us see, give people a 

$100 deduction on their taxes, and then those who sign up for welfare, make it part of their signing up for welfare. I would bet you 

95 percent of the public either pays taxes or receives something 

from government. So, have them sign up and use the data. If it 

happens on different dates, just change the rules. Why not just say, 

‘‘Well, estimate how many kids you are going to have and what 

your income is going to be on April 1st?’’ It is all sort of an estimate to a certain extent. And then, maybe we should charge people 

to use the Census data. We do not do any charging, right, for Census data? 

Mr. THOMPSON. No, sir. 

Senator PAUL. Companies love this data, right? It is really important to know what incomes and how many people of a certain age. 

Companies could just be charged for it. I will bet you I could run 

the Census Bureau without any money, if you will sell it to me—— 

Senator MCCASKILL. I think that is a great idea. 

Senator PAUL. If you will sell it to me. [Laughter.] 

But, anyway, we should not just stick to rules. We have a rule 

it has to be on April 1st. Make it that it has to be sometime during 

that year, and we just say now the Census is for information that 

year, not April 1st of every year. But, pay people for the time to 

fill it out. I guarantee if you let people have a $100 deduction, 

which is no more than like a $33 or $34 reduction in their taxes, 

they would do it probably. They would probably fill it out. You 

would get huge voluntary—compare that to the postage that you 

send out on millions and millions of things. Then you mail them 

again. Then you have somebody knock on their door. You could 

really get a lot of it done through the tax system and probably 

through the welfare system as well for anybody that signs up. People sign up for welfare, they sign up for Social Security, all that 

stuff. Still make it voluntary, and for the people who sign up, it 

just should be a requirement of signing up for government benefits. 

But, for those who want to do it on their tax return, give them a 

benefit. 

Getting back to the subject—— 

Chairman JOHNSON. Can I ask—— 

Senator PAUL. Go ahead. 

Chairman JOHNSON. Do we have three cosponsors of that one 

here? [Laughter.] 

Senator PAUL. Think about it. Think outside the box. 

Chairman JOHNSON. Happy to look at it. Let us work on something like that. 
32 

Senator PAUL. I have a great deal of respect for those who look 

throughout government for waste and try to fix things, and in fact, 

sometimes I have thought maybe after doing it for a couple years, 

we should put you in charge of the organization, and maybe we 

would get even more effect from your recommendations. 

But, I also have watched waste since I was a kid. I remember 

William Proxmire, the Golden Fleece awards and the waste. I 

scratch my head and cannot scientifically say this, but I would say 

the more we are trying to get rid of it, the more it stays the same, 

the more it is still there. I guess my question in general is, not that 

it is your fault, you are finding it, but we will start with Mr. Missal, that, you find it. How often do you think as a guess when you 

find it or we are getting rid of the problem—I will give you one example that we used in our waste report from your digging was the 

300,000 TVs at the VA that were wrong connections, stuck in a 

closet, bought before the renovation, and I think to my mind are 

still not being used. You found that. That came to their attention. 

Maybe that person does it again, but do you think you fixed a systemic problem when you found that problem so it does not happen 

again? Or do you think we need more done to fix the systemic problem that you found in that particular instance? 

Mr. MISSAL. That was one report where the dollars were not that 

large compared to a number of things we do, but that got a lot of 

publicity and attention. Hopefully that would have a deterrent effect for others. But, I think we need to expand the work that we 

are doing with respect to finding waste, and we are trying to be 

more proactive. We are expanding our data analytics capability so 

that we can look for outliers, which should give us a better indication. 

Senator PAUL. When you find waste, is it fixed 100 percent of the 

time, 50 percent of the time, 20 percent? Just a guess. 

Mr. MISSAL. For that particular situation, we will have—— 

Senator PAUL. Any situation of finding waste, how often do you 

feel like you are satisfied by the organization that you are inspecting that it gets fixed? Just a guess. 

Mr. MISSAL. I think for a particular situation, we are satisfied, 

but we also know that is not going to be the only problem, that I 

think there are significant issues out there. 

Senator PAUL. So, that is the question: Are we finding waste, fixing it, and then waste just keeps cropping up? Or do we have some 

of the waste that we have had for decade after decade and it is not 

going away despite the people finding it? That is a big question. 

Are we eliminating some waste and just new waste is popping up? 

If it is new waste popping up, then what do we do as an incentive 

to get less waste in government? Do we have more waste in government? Is it less quickly fixed than it is in the private marketplace? 

My guess is that if you have to make a profit and make a payroll 

each month, you quickly make adjustments, and the government is 

probably slower in that vein. 

One of the things that I have introduced—and if anybody wants 

to make a comment on it—is legislation that would give bonuses 

to civil servants who find waste. We have sort of a whistleblower 

program for malfeasance, but not much is used. But, actually to 

give people a financial bonus if they find waste—and I think every-
33 

body here is actually supportive of it, Republican and Democrat. 

But, whether or not we could try to introduce some incentives like 

that into government so if waste is an inherent problem, when 

waste seems to be worse in government than the private sector, 

bring a private sector kind of thing into that. We will start with 

Mr. Missal, and then anybody else who wants to respond. 

Mr. MISSAL. I think a program like that would be helpful as we 

are always looking for ways to get more information. We are trying 

to be proactive, find things on our own, but that is going to be limited given the people we have. Any opportunity there is for others 

out there, we have a hotline where we look at every contact that 

comes in, and so we would love more contacts to that hotline. 

Senator PAUL. Anybody else on ways to find waste? 

Mr. DODARO. If we did that at the GAO, I could have retired a 

long time ago. [Laughter.] 

Senator PAUL. We would have to exempt you, sir. 

Mr. DODARO. But, I would say anything that would help identify 

acting that have a positive outcome would be very welcome. On 

your point about how much is systemic versus how much is solvable, it is a mixture of both. Over 75, almost 80 percent of our recommendations are implemented over a 4-year period of time. I will 

give you one classic example. We make recommendations to stop 

particular weapons systems—the technology is not mature, they 

are not ready to go into production. But, yet different weapons systems will be approved that have a similar kind of problem. Some 

things get stopped completely and they are not bought at all, the 

same thing with IT systems. But, there is a systemic problem there 

about why we—— 

Senator PAUL. Just one quick comment. I think that is great. If 

you are fixing 75 percent of the problem, that would be enormous 

if that is true, and it may well be. But, it probably shows that we 

have another problem then, the generation of more waste. 

Mr. DODARO. Right. 

Senator PAUL. And then, some waste is in the eye of the beholder, and it is the philosophical view of what you think government should do—— 

Mr. DODARO. I think one of the reasons for that, Senator, is that 

most Federal programs get funded year after year without having 

to prove that they are effectively accomplishing their objectives. It 

is hard, and the burden is on us now in the accountability community to prove something is not working, to get it stopped. 

Senator PAUL. But, one quick point before I finish. The people we 

have here are doing sort of their job in what we want them to do, 

but it is bigger than their job. They are finding the waste, and we 

are eliminating it. We also have to look for the incentives-we have 

to change the incentives somehow of government because they are 

finding as much as they can maybe, and we can try to be even better. But, it is still not enough because there is an enormous 

amount of waste in government. I am not saying you do not do 

your job. I think we need to think beyond what we normally do to 

see if there is any way to change incentives in government. 

Thank you. 

Chairman JOHNSON. First of all, Senator Paul, I think these are 

great ideas, and I am really looking forward to the use of your Sub-
34 

committee to generate more of these. And, I am serious about that. 

I think this is really good. I would like to work with you and maybe 

the Director on Census proposals as well. Good ideas. Senator 

Heitkamp. 

OPENING STATEMENT OF SENATOR HEITKAMP 

Senator HEITKAMP. Thank you, Mr. Chairman, and I think from 

all the attention the Census has gotten, we probably need to have 

a whole other opportunity to sit down and go through the Census 

and the process, because I have some questions, too, but I do not 

want to spend my time talking about the Census. 

I want to again congratulate Gene for the great work that GAO 

does. Senator Ernst and I, as you know, worked very hard to craft 

legislation to improve program management across the Federal 

Government. Our bill went on to be signed into law finally in December, and I was really pleased when you gave us a shout-out in 

your testimony. The Program Management Improvement and Accountability Act, I think if it is properly implemented—and we tend 

to be very aggressive in oversight—can foster prevention for waste. 

I am really excited about the opportunity to work with you and 

make sure it is implemented, and make sure that the ideas that 

were in that bill actually see the light of day going forward. 

I want to talk about this idea of waste, fraud, and abuse, and 

whistleblowers. Mostly, John and Michael, as IGs, you know that 

we have been working with your organization to try and get one 

portal where people on this dais can actually go out and look, 

where people can try and discover systemic kinds of waste, systemic frauds that are going on. Have you both participated in that 

effort? And, are there any recommendations you would make to us 

about how we can provide greater transparency on IG reports? 

[Pause.] 

Mr. MISSAL. We agree wholeheartedly with more transparency. 

We would, support efforts to get more information. With respect to 

whistleblowers, we have had our staff trained with respect to how 

to ensure that we treat whistleblowers with respect, that we get 

the information from them that we need. And so, anything that can 

help us—— 

Senator HEITKAMP. Are you familiar with the work that we are 

doing or the work that the association is doing, the IG association? 

Mr. MISSAL. With the Council of the Inspectors General on Integrity and Efficiency (CIGIE), yes, we are very active with CIGIE. 

Senator HEITKAMP. OK. And so, you are familiar with the portal 

that is being developed. 

Mr. MISSAL. Yes, absolutely. 

Senator HEITKAMP. And, do you see this as a mechanism to provide more systemic oversight? When GAO issues a report, we know 

where to go. We do not have to go to, Interior’s GAO. Bureau with 

the IG reports, each one of the agencies have their own separate 

way of doing things. I think getting everybody onto one portal—I 

am not saying you have to abandon what you are already doing, 

but to me it is a way to really examine whether we have a lot of 

cross-pollination that we can do to avoid waste, fraud, and abuse. 

Mr. MISSAL. Absolutely, and we have spoken as IGs together. I 

think there is strong support for that idea to do it. I agree with 
35 

you that we would not abandon what we are doing individually as 

an agency, but having one portal I think would be very helpful. 

Senator HEITKAMP. We are going to be very aggressive on this 

issue. 

John, have you looked at the draft portal? 

Mr. ROTH. Yes, we participate in it, and I cannot tell you right 

now the very status of it, but I know that there is a lot of excitement within the IG community to have a single point of contact in 

which basically every IG report gets published. 

Senator HEITKAMP. Just for my colleagues here, I think this is 

amazing because this has all been done without any appropriation. 

Mr. ROTH. Right. 

Senator HEITKAMP. It has been done just through volunteer 

work. The Postal Service has been great, providing the background 

and some of the technical support. We think we can even improve 

it more with just a little bit of attention to an appropriation, and 

so we are going to be working very hard on that provision because 

I think sunshine is a huge component. 

I want to go back to you, Gene. We talk about this quite often 

when you appear either in our Subcommittee or before the full 

Committee. What tools do we need to give you, what can you recommend to us that we should be doing in our oversight function 

that we are not currently doing or we are not aggressive enough 

on? 

Mr. DODARO. Well, first, I am very appreciative of the GAO bill 

that Senator McCaskill mentioned in her opening remarks to give 

us additional access authorities. That has been signed into law 

now. That was very helpful. 

I think if we run into problems getting information—we are not 

currently having any right now—I would want the Committee’s 

support to help us get the information that we need. 

I would suggest for the high-risk areas, I would like to see more 

hearings on the high-risk areas. We flag individual ones that need 

legislative action to actually address the issue. Many of them require Executive Branch actions. But, a fair number of them also require legislative action to address the high-risk problems. And so, 

I would like to see more hearings and attention on those high-risk 

areas. 

And so, I feel we are well supported. Obviously a word on our 

budget would not hurt. I cannot go by without taking this opportunity. 

Senator HEITKAMP. Tell us what has happened to your budget in 

terms of the growth of the overall Federal expenditure and then 

what we have given, our eyes and ears out there, what we have 

given you to examine it. 

Mr. DODARO. Well, we are operating under a continuing resolution (CR) that is less than last year’s funding, so I am not replacing 

people as they leave the GAO. We cannot afford it until we have 

an appropriation for the year. 

Senator HEITKAMP. Are you subject to the hiring freeze? 

Mr. DODARO. No. 

Senator HEITKAMP. OK. 

Mr. DODARO. No, but I do not have a budget. And, that is a problem with all the—— 
36 

Senator HEITKAMP. Heck of a way to run a railroad, is it not? 

Mr. DODARO. We came out of the sequester in 2013, though, just 

to put this in perspective, at the lowest staffing level since 1935. 

We have clawed back some of that, but I believe we need to be at 

least 3,250 people at the GAO. Right now we are under 3,000 and 

going down unless we get an appropriation for this year. 

Senator HEITKAMP. Have you ever calculated that for every dollar of investment in GAO managed well by you what that would 

return in terms of—— 

Mr. DODARO. Last year, it was $112 for every dollar invested in 

GAO. We returned over $63 billion in financial benefits. The year 

before it was $70 billion. We are a good investment. 

Senator HEITKAMP. The point that I want to make, before I conclude here, is that we are so often penny wise and pound foolish. 

I do not think that Congress takes its oversight responsibility as 

seriously as it should. I think that you are that auditor for us, 

whether it is a management audit, whether it is a fiscal audit, and 

we ought to have a fully funded, functional GAO and then a fully 

functional Committee and Congress that is going to be absolutely 

aggressive. Because if people think these are just one-offs, which 

I think in the past they have, then, you feel a little bit of heat and 

it goes away. We need to turn up the heat and make sure that 

every dime that we spend of taxpayer money gets spent in a way 

that that taxpayer would spend it themselves. 

I really appreciate all the work that all of you do. Continue to 

send suggestions and ideas. We are very curious and interested in 

what we can do to help. 

Mr. DODARO. Thank you very much, Senator. 

Chairman JOHNSON. Thank you, Senator. It sounds like Gene 

had done that calculation, unless he is really quick with the math. 

[Laughter.] 

That is what you call a softball question. 

Senator HEITKAMP. Mr. Chairman, he asked me to ask him that 

question. [Laughter.] 

Chairman JOHNSON. I was expecting to see a $20 payment here. 

Senator HEITKAMP. Oh, no. It cost him a lot more than that. 

Chairman JOHNSON. Gene, real quick—now, watch out. You have 

a gift limit. 

Just quickly, how many hearings were held in the last Congress, 

other than the one in this Committee or maybe the Oversight Committee in the House, on the High-Risk List? 

Mr. DODARO. Over 250 hearings. 

Chairman JOHNSON. Different hearings on the High-Risk List. 

Mr. DODARO. On areas covered by the high-risk area. 

Chairman JOHNSON. OK. Well, that is pretty good. 

Mr. DODARO. It is good, and 12 bills came out. That is why you 

saw progress, 12 pieces of legislation. There are very few high-risk 

areas that make progress without congressional attention on oversight, prompt action on the agency, or without statutory changes 

and without some funding. Some of these areas Congress funded, 

gaps in the weather satellites that help them put in contingency 

plans, that got effectively implemented. Any lasting change has to 

have some statutory—— 
37 

Chairman JOHNSON. But, again, the committees of jurisdiction 

take this High-Risk Series very seriously, and they actually hold 

hearings on those recommendations with those departments and 

agencies. 

Mr. DODARO. Yes, but it is not evenly distributed across the highrisk areas. Most of the hearings were held on cybersecurity, a lot 

on veterans affairs. And so, they are not uniformly focused on some 

of these areas. 

Chairman JOHNSON. I just asked Senator McCaskill if she would 

be willing to sign on to letters, two of us and you, to those committees of jurisdiction asking them to hold hearings on specific highrisk areas. If you want to prepare that list, we will do those letters. 

Mr. DODARO. Sure. 

Chairman JOHNSON. And, we will sign them to prompt that action, because this works. 

Mr. DODARO. I would be happy to do so, and I appreciate that 

support. I think it is very helpful. 

Chairman JOHNSON. Again, thank you all for, first of all, what you do—how many dollars to $1? 

Mr. DODARO. $112. 

Chairman JOHNSON. And, IGs, your return on investment? 

Mr. MISSAL. Ours last year was $35 to $1. 

Chairman JOHNSON. Well, you have to up your game. [Laughter.] 

But, no, thank you very much. Director Thompson, thank you 

again. I realize this was a little bit different for you coming into 

this setting. We will hold a hearing on the Census. Again, I think 

Senator Paul’s suggestions are intriguing, and maybe we can take 

a look at some out-of-the-box thinking to drive some improvements 

from that standpoint. 

Mr. THOMPSON. I would like forward to a hearing. 

Chairman JOHNSON. Again, thank you all for your time, your testimony, and your work. The hearing record will remain open for 15 

days until March 2nd at 5 p.m. for the submission of statements 

and questions for the record. 

This hearing is adjourned. 

[Whereupon, at 4:37 p.m., the Committee was adjourned.] 

(39) 

A P P E N D I X 
40 

As always, I want to thank Gene Dodaro and all the hardworking men and women at the GAO 

who he represents. Your work is invaluable to the American people. I thank all of our witnesses 

for being here today, and I look forward to your testimony. 
41 

"High Risk: Government Operations Susceptible to Waste, Fraud, and Mismanagement" 

February 15, 2017 

Senator Claire McCaskill 

Opening Statement 

Thank you, Mr. Chairman, for holding this important hearing focused on the U.S. 

Government Accountability Office's 2017 High Risk Report. 

GAO is an independent, nonpartisan agency that investigates how the federal government 

spends taxpayer dollars. GAO's work supports us in meeting our legislative and oversight 

obligations under the constitution and helps to improve accountability in the federal government 

by providing Congress with timely information that is objective, fact-based, nonpartisan, fair, 

and balanced. 

At the beginning of each Congress, GAO releases its report of government programs that 

are at high risk due to their vulnerabilities to fraud, waste, abuse, and mismanagement. Shortly 

after the release of the report, the Senate Committee on Homeland Security and Governmental 

Affairs Committee invites GAO's leader- the Comptroller of the United States to testify 

before the Committee about the GAO High Risk report. 

I appreciate that this hearing is one of our tirst full Committee hearings of the 115'h 

Congress. GAO's 2017 High Risk Report provides us with a list of priorities for how this 

Committee can target and root out waste, fraud, and abuse in our government. For example, 

GAO reports that the federal government oversees more than $80 billion in taxpayer funds for 

information technology investments, but poor management leads many IT contracting projects to 

fail or experience significant cost over runs. Contract oversight is not a new problem in 

government, but it remains one of the most important. 
42 

While most government employees are dedicated public servants, GAO's High Risk 

Report highlights that more work is needed to ensure that the federal bureaucracy performs 

effectively and efficiently on behalf of the American people. The report identifies several 

"mission critical" skill gaps within the federal workforce that could pose risks to American tax 

dollars and to American lives. For example, it is alarming that even after the large-scale cyber 

breach at the Office of Personnel Management and the medical wait list scandal at the 

Department of Veterans Affairs. that some of the federal "skills gaps" identified by GAO still 

include cyber security and nursing. 

This year, GAO added the 2020 Census progran1 to its list of High Risk areas. Knowing 

that our next census is rapidly approaching, I am grateful Director Thompson is here to provide a 

status update on the 2020 Census program. The cost of the Census has risen over the last few 

decades, with the 2010 Census being the costliest U.S. Census in history. Billions of tax payer 

dollars were wasted on programs that had to be scrapped at the last minute in order to ensure the 

2010 Census was on time. Given these challenges and the important role the Census plays in 

counting our citizens as well as allocating resources to vulnerable communities, I am eager to 

learn how the Bureau expects to effectively manage costs while simultaneously modernizing the 

Census program and ensuring a complete enumeration. It is important that we avoid repeating 

the mistakes of the past. 

I am also grateful to Inspectors General Roth and Missal for joining Comptroller General 

Dodaro and Director Thompson here today to discuss their work to improve government 

programs at the Departments of Homeland Security and Veterans Affairs respectively. 

When there is ineffective oversight and accountability in government, money gets wasted 

and mismanagement goes unaddressed. As a former state Auditor, I consider government 

2 
43 

accountability as an important part of my work here in the Senate. I have spent my career 

confronting waste, fraud, and abuse in government Here in the Senate, I helped to establish the 

Subcommittee on Contracting Oversight, which investigated waste, fraud, and abuse of taxpayer 

dollars at every federal agency, holding dozens of hearings to investigate waste and misconduct 

in federal spending, As Ranking Member of the Permanent Subcommittee on Investigations, 

Senator Portman and I were able launch several bipartisan investigations including one 

addressing anti-opioid abuse efforts in Medicare and private health insurance systems. 

Last week, President Trump signed into law the GAO Access and Oversight Act, a 

bipartisan measure I that co-sponsored to ensure that GAO has full access to the National 

Database of New Hires, a key tool for cutting waste and fraud in many of the government's 

largest programs, as well as allowing states to aggressively pursue child support payments. The 

law also strengthens GAO's ability to take legal action if an agency refuses to provide GAO with 

information necessary to perform its oversight functions. This law is a great example of what our 

Committee can do when we work together to promote accountability in the federal government 

on behalf of our constituents. 

The federal government is a complex system of agencies that spends more than $3 trillion 

dollars annually on behalf of the American people, As elected representatives, we are members 

of a public trust to ensure that those tax payer dollars arc used effectively and efficiently, 

I have never shied away from confronting government waste and I don't intend to now as 

the Ranking Member of the Committee on Homeland Security and Governmental Affairs. I will 

continue to examine the areas where the federal government can make improvements to better 

serve our constituents and appreciate the witnesses' testimony on this important issue today. 

Thank you. 

3 
44 

For Release on Delivery 

Expected at 2:30 p.m. ET Wednesday, February 15,2017 

GA0-17-407T 

United States Government Accountability Office 

Testimony 

Before the Committee on Homeland 

Security and Governmental Affairs, U.S. 

Senate 

HIGH-RISK SERIES 

Progress on Many 

High-Risk Areas, While 

Substantial Efforts Needed 

on Others 

Statement of Gene L Dodaro 

Comptroller General of the United States 
45 

HIGH-RISK SERIES 

Progress on Many High-Risk Areas, While Substantial 

Efforts Needed on Others 

What GAO Found 

Since GAO's last high-risk update, many of the 32 high-risk areas on the 2015 

list have shown solid progress. Twenty-three high-risk areas, or two-thirds of all 

the areas, have met or partially met all five criteria for removal from the HighRisk List; 15 of these areas fully met at least one criterion. Progress has been 

possible through the concerted efforts of Congress and leadership and staff in 

agencies. For example, Congress enacted over a dozen laws since GAO's last 

report in February 2015 to help address high-risk issues. 

GAO removed 1 high-risk area on managing terrorism-related information, 

because significant progress had been made to strengthen how intelligence on 

terrorism, homeland security, and law enforcement is shared among federal, 

state, local, tribal, international, and private sector partners. Sufficient progress 

was made to remove segments of 2 areas related to supply chain management 

at the Department of Defense (DOD) and gaps in geostationary weather satellite 

data. 

Two high-risk areas expanded-DOD's polar-orbiting weather satellites and the 

Department of the Interior's restructuring of offshore oil and gas oversight 

Several other areas need substantive attention including VA health care, DOD 

financial management, ensuring the security of federal information systems and 

cyber critical infrastructure, resolving the federal role in housing flnance, and 

improving the management of IT acquisitions and operations. 

GAO is adding 3 areas to the High-Risk list, bringing the total to 34: 

Management of Federal Programs That Serve Tribes and Their 

Members. GAO has reported that federal agencies, including the 

Department of the Interior's Bureaus of Indian Education and Indian Affairs 

and the Department of Health and Human Services' Indian Health Service, 

have ineffectively administered Indian education and health care programs 

and inefficiently developed Indian energy resources. Thirty-nine of 41 GAO 

recommendations on this issue remain unimplemented. 

U.S. Government's Environmental Liabilities. In fiscal year 2016 this 

liability was estimated at $447 billion (up from $212 billion in 1997). The 

Department of Energy is responsible for 83 percent of these liabilities and 

DOD for 14 percent. Agencies spend bH!ions each year on environmental 

cleanup efforts but the estimated environmental liability continues to rise. 

Since 1994, GAO has made at least 28 recommendations related to this 

area; 13 are unimplemented. 

The 2020 Decennial Census. The cost of the census has been escalating 

over the last several decennials; the 2010 Census was the costliest U.S. 

Census in history at about $12.3 billion, about 31 percent more than the 2000 

Census (in 2020 dollars). The U.S. Census Bureau (Bureau) plans to 

implement several innovations-including IT systems-for the 2020 Census. 

Successfully implementing these innovations, along with other challenges, 

risk the Bureau's ability to conduct a cost-effective census. Since 2014, GAO 

has made 30 recommendations related to this area; however, only 6 have 

been fully implemented. 

--------------United States Government Accountability Office 
46 

GAO's 2017 High-Risk List 

Strengthening the Foundation for Efficiency and.Effectiveness 

. Strategic Human Capital Management 

. Managing Federal Real Property 

Funding the Nation's Surface Transportation System 

. Modernizing the U.S. Financial Regulatory System and the Federal Role in 

Housing Finance· 

. Restructuring the U.S. Postal Service to Achieve Sustainable Financial 

Viability· 

. Management of Federal Oil and Gas Resources 

. Limiting the Federal Government's Fiscal Exposure by Better Managing 

Climate Change Risks 

. Improving the Management of IT Acquisitions and Operations 

. Improving Federal Programs that Serve Tribes and Their Members (new)' 

. 2020 Decennial Census (new) 

. U.S. Government's Environmental Liabilities (new)· 

Transfonning DOD Program Management 

DOD Supply Chain Management 

. DOD Weapon Systems Acquisition 

. DOD Financial Management 

. DOD Business Systems Modernization 

DOD Support Infrastructure Management" 

. DOD Approach to Business Transformation 

Ensuring Public Safety and Security 

. Ensuring the Security of Federal Information Systems and Cyber Critical 

lnfrastructu[e and Protecting the Privacy of Personally Identifiable 

Information 

. Strengthening Department of Homeland Security Management Functions 

. Ensuring the Effe7tive Protection of Technologies Critical to U.S. National 

Security Interests 

. Improving Federal Oversight of Food Safety 

Protecting Public Health through Enhanced Oversight of Medical Products 

. Transforming EPA's Processes for Assessing and Controlling Toxic 

Chemicals 

. Miti ating Gaps in Weather Satellite Data 

Managing Federal Contracting More Effectively 

. DOE's Contract Management for the National Nuclear Security 

Administration and Office of Environmental Management 

. NASA Acquisition Management 

. DOD Contract Manaaemen( 

Assessing the Efficiency and Effecti~eness of Tax Law Administration 

. Enforcement ofT ax Laws 

Modernizing and Safeguard in~ Insurance and Benefit Programs 

. Medicare Program • 

. Medicaid Program 

. Improving and Modernizing Federal Disability Programs 

. Pension Benefit Guaranty Corpora!ion Insurance Programs· 

. National Flood Insurance Program 

. Mana ina Risks and lmprovino VA Health Care 

Source. GAO. I GA0-17-317 

"Legislation is likely to be necessary in order to effectively address this area 
47 

High-Risk Areas 

Making Progress 

Chairman Johnson, Ranking Member McCaskill and Members of the 

Committee: 

Since the early 1990s, our high-risk program has focused attention on 

government operations with greater vulnerabilities to fraud, waste, abuse, 

and mismanagement or that are in need of transformation to address 

economy, efficiency, or effectiveness challenges. This effort, supported 

by the Senate Committee on Homeland Security and Governmental 

Affairs and by the House of Representatives Committee on Oversight and 

Government Reform, has brought much-needed attention to problems 

impeding effective government and costing billions of dollars each year. 

To help improve these high-risk operations, we have made hundreds of 

recommendations. Executive agencies either have addressed or are 

addressing many of them and, as a result, progress is being made in a 

number of areas. Congress also continues to take important actions. For 

example, Congress enacted over a dozen laws since our last report in 

February 2015 to help make progress on high-risk issues. Progress in 

high-risk areas over the past decade (fiscal year 2007 through fiscal year 

2016) resulted in financial benefits totaling approximately $240 billion or 

an average of about $24 billion per year. 1 

Our 2017 high-risk update, which is being released today, describes (1) 

progress made addressing high-risk areas and the reasons for that 

progress, and (2) actions that are still needed to assure further progress. 

It also identifies three new high-risk areas, which include the 

management of federal programs that serve tribes and their members, 

the federal government's environmental liabilities, and the 2020 Census. 2 

Since our last high-risk update, while progress has varied, many of the 32 

high-risk areas on our 2015 Jist have shown solid progress. One area 

related to sharing and managing terrorism-related information is now 

being removed from the list. 

1

Financial benefits are based on actions taken in response to our work, such as reducing 

government expenditures, increasing revenues, or reallocating funds to other areas 

2

GAO, High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts 

Needed on Others, GA0-17-317 (Washington, D.C.: Feb.15, 2017) 

Page1 GA0-17-407T 
48 

Agencies can show progress by addressing our five criteria for removal 

from the list: leadership commitment, capacity, action plan, monitoring, 

and demonstrated progress.' As shown in table 1, 23 high-risk areas, or 

two-thirds of all the areas, have met or partially met all five criteria for 

removal from our High-Risk List; 15 of these areas fully met at least one 

criterion. Compared with our last assessment, 11 high-risk areas showed 

progress in one or more of the five criteria. Two areas declined since 

2015. These changes are indicated by the up and down arrows in table 1. 

Table 1: 2015 High~Risk Areas Rated Against Five Criteria for Removal from GAO's High-Risk List 

(t indicates one or more areas progressed; J.. indicates one or more areas declined since 2015.) 

High-risk area 

Transforming the Environmental Protection Agency's (EPA) Processes for 

Assessing and Controlling Toxic Chemicals 

Improving the Management of IT Acquisitions and Operations 

Ensuring the Security of Federal Information Systems and Cyber Critical 

Infrastructure and Protecting the Privacy of Personally Identifiable Information 

DOD Approach to Business Transformation 

Strategic Human Capital Management 

DOE's Contract Management for the National Nuclear Security Administration and 

Office of Environmental Manac1em,ent 

Change 

since 2015 

Number of criteria 

Met Partially Not met 

met 

detail on our high-risk criteria and ratings is in appendix I of our report. 

Page2 GA0-17-407T 
49 

High-risk area Change 

since 2015 

Ensuring the Effective Protection of Technologies Critical to U.S. National Security 

Interests 

Improving and Modernizing Federal Disability Programs 

Modernizing the U.S. Financial Regulatory System and the Federal Role in Housing 

Finance 

National Flood Insurance Program 

Restructuring the U.S. Postal Service to Achieve Sustainable Financial Viability 

Medicaid Program11 

Limiting the Federal Government's Fiscal Exposure by Better Managing Chmate 

Change Risks 

4 

DOD Business Systems Modernization 

DOD Financial Management 

Improving Federal Oversight of Food Safety 

Managing Risks and Improving VA Health Care 

Funding the Nation's Surface Transportation System N/A N/A N/A 

Pension Benefit Guaranty Corporation Insurance Programs N/A N/A N/A 

Legend: N/A"' Not applicable. 

Source GAO ! GAO" 17-317 

High-Risk Areas Showing 

Progress 

One High-Risk Designation 

Removed 

Notes: Two high-risk areas received a "not applicable" rating because addr-essing them primarily 

involves congressional action (Funding the Nation's Surface Transportation System and Pension 

Benefit Guaranty Corporation insurance Programs). 

"Medicare and Medicaid programs only refer to the Improper Payments programs and we did not rate 

other elements of the Medicare and Medicaid programs. 

Of the 11 high-risk areas showing progress between 2015 and 2017, 

sufficient progress was made in 1 area-Establishing Effective 

Mechanisms for Sharing and Managing Terrorism-Related Information to 

Protect the Homeland-to be removed from the list. In two other areas, 

enough progress was made that we removed a segment of the high-risk 

area-Mitigating Gaps in Weather Satellite Data and Department of 

Defense (DOD) Supply Chain Management. The other eight areas 

improved in at least one criterion rating by either moving from "not met" to 

"partially met" or from "partially met" to "met." 

We removed the area of Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information to Protect the Homeland 

from the High-Risk List because the Program Manager for the Information 

Sharing Environment (ISE) and key departments and agencies have 

made significant progress to strengthen how intelligence on terrorism, 

homeland security, and law enforcement, as well as other information 

Page3 GA0-17-407T 
50 

(collectively referred to in this section as terrorism-related information), is 

shared among federal, state, local, tribal, international, and private sector 

partners. As a result, the Program Manager and key stakeholders have 

met all five criteria for addressing our high-risk designation, and we are 

removing this issue from our High-Risk List. While this progress is 

commendable, it does not mean the government has eliminated all risk 

associated with sharing terrorism-related information. It remains 

imperative that the Program Manager and key departments and agencies 

continue their efforts to advance and sustain ISE. Continued oversight 

and attention is also warranted given the issue's direct relevance to 

homeland security as well as the constant evolution of terrorist threats 

and changing technology. 

The Program Manager, the individual responsible for planning, 

overseeing, and managing ISE, along with the key departments and 

agencies-the Departments of Homeland Security (DHS), Justice (DOJ), 

State (State), and Defense (DOD), and the Office of the Director of 

National Intelligence (ODNI)-are critical to implementing and sustaining 

ISE. 4 Following the terrorist attacks of 2001, Congress and the executive 

branch took numerous actions aimed explicitly at establishing a range of 

new measures to strengthen the nation's ability to identify, detect, and 

deter terrorism-related activities. For example, ISE was established in 

accordance with the Intelligence Reform and Terrorism Prevention Act of 

2004 (Intelligence Reform Act) to facilitate the sharing of terrorism-related 

information. 5 Figure 1 depicts the relationship between the various 

stakeholders and disciplines involved with the sharing and safeguarding 

of terrorism-related information through IS E. 

Office of the Program Manager for ISE is situated within and funded through 

amounts appropriated to ODNL Additional departments and agencies also participate in 

ISE, including Air Force Intelligence, Surveillance, and Reconnaissance; Central 

Intelligence Agency; the Departments of Commerce, Energy, Health and Human Services, 

the Interior, Transportation, and the Treasury; National Counterterrorism Center; National 

Geospatial-Jntelligence Agency: and National Reconnaissance Office. 

5

See Pub. L. No. 108-458, § 1016, 118 Stat 3638, 3664-70 (2004) at 6 U.S. C.§ 485). 

See also 6 U.S.C. § 482 (requiring the establishment of procedures for the sharing of 

homeland security information). 

Page4 
51 

Figure 1: Elements of the Information Sharing Environment 

The Program Manager and key departments and agencies met the 

leadership commitment and capacity criteria in 2015, and have 

subsequently sustained efforts in both these areas. For example, the 

Program Manager clearly articulated a vision for ISE that reflects the 

government's terrorism-related information sharing priorities. Key 

departments and agencies also continued to allocate resources to 

operations that improve information sharing, including developing better 

technical capabilities. 

The Program Manager and key departments and agencies also 

developed, generally agreed upon, and executed the 2013 Strategic 

Implementation Plan (Implementation Plan), which includes the overall 

strategy and more specific planning steps to achieve ISE. Further, they 

have demonstrated that various information-sharing initiatives are being 

used across multiple agencies as well as state, local, and private-sector 

stakeholders. For example, the project manager has developed a 

comprehensive framework for managing enterprise architecture to help 

share and integrate terrorism-related information among multiple 

Page 5 GA0-17-407T 
52 

stakeholders in ISE6 Specifically, the Project lnteroperability initiative 

includes technical resources and other guidance that promote greater 

information system compatibility and performance. 7 Furthermore, the key 

departments and agencies have applied the concepts of the Project 

lnteroperability Initiative to improve mission operations by better linking 

different law enforcement databases and facilitating better geospatial 

analysis, among other things. 

In addition, the Program Manager and key departments and agencies 

have continued to devise and implement ways to measure the effect of 

ISE on information sharing to address terrorist and other threats to the 

homeland. They developed performance metrics for specific informationsharing initiatives (e.g., fusion centers) used by various stakeholders to 

receive and share information. The Program Manager and key 

departments and agencies have also documented mission-specific 

accomplishments (e.g., related to maritime domain awareness) where the 

Program Manager helped connect previously incompatible information 

systems. The Program Manager has also partnered with DHS to create 

an Information Sharing Measure Development Pilot that intends to better 

measure the effectiveness of information sharing across all levels of IS E. 

Further, the Program Manager and key departments and agencies have 

used the Implementation Plan to track progress, address challenges, and 

substantially achieve the objectives in the National Strategy for 

enterprise architecture. or modernization blueprint, is intended to provide a clear and 

comprehensive picture of an entity, whether it is an organization (e.g., federal department 

or agency} or a functional or mission area that cuts across more than one organization 

(e.g., financial management). This picture consists of snapshots of the enterprise's current 

and target operational and technological environments, and contains a road map for 

transitioning from the current to the target environment. 

7

Project lnteroperability refers to a collection of policies and guidance related to 

information interoperability. Information interoperability is the ability to share and use 

information in a consistent, efficient way across multiple organizations and IT systems to 

accomplish operational missions. From a technical perspective, interoperabi!ity is 

developed in part by using common technical standards and definitions to manage 

information. 

Page 6 
53 

Information Sharing and Safeguarding-' The Implementation Plan 

contains 16 priority objectives, and by the end of fiscal year 2016, 13 of 

the 16 priority objectives were completed. The Program Manager 

transferred the remaining three objectives, which were all underway, to 

other entities with the appropriate technical expertise to continue 

implementation through fiscal year 2019. 

In our 2013 high-risk update, we listed nine action items that were critical 

for moving ISE forward. In that report, we determined that two of those 

action items-demonstrating that the leadership structure has the needed 

authority to leverage participating departments, and updating the vision 

for ISE-had been completed. In our 2015 update, we determined that 

the Program Manager and key departments had achieved four of the 

seven remaining action items-demonstrating that departments are 

defining incremental costs and funding; continuing to identify 

technological capabilities and services that can be shared collaboratively; 

demonstrating that initiatives within individual departments are, or will be, 

leveraged to benefit all stakeholders; and demonstrating that 

stakeholders generally agree with the strategy, plans, time frames, 

responsibilities, and activities for substantially achieving ISE. 

For the 2017 update, we determined that the remaining three action items 

have been completed: establishing an enterprise architecture 

management capability; demonstrating that the federal government can 

show, or is more fully developing a set of metrics to measure, the extent 

to which sharing has improved under ISE; and demonstrating that 

established milestones and time frames are being used as baselines to 

track and monitor progress. Achieving all nine action items has, in effect, 

addressed our high-risk criteria. 

While this demonstrates significant and important progress, sharing 

terrorism-related information remains a constantly evolving work in 

progress that requires continued effort and attention from the Program 

of the Program Manager for the Information Sharing Environment, Strategic 

Implementation Plan for the National Strategy for Information Sharing and Safeguarding 

(Washington, D.C.: December 2013). In December 2012, the President signed the 

National Strategy for Information Sharing and Safeguarding, which provides guidance on 

implementing policies, standards. and technologies that promote secure and responsible 

national security information sharing. This document builds on the 2010 National Security 

Strategy and the 2007 National Strategy for Information Sharing, The December 2012 

national strategy identifies priority objectives, which have been incorporated into the 

Implementation Plan. 

Page 7 GA0·17-407T 
54 

Manager, departments, and agencies. Although no longer a high-risk 

issue, sharing terrorism-related information remains an area with some 

risk, and continues to be vitally important to homeland security, requiring 

ongoing oversight as well as continuous improvement to identify and 

respond to changing threats and technology. Table 2 summarizes the 

Program Manager's and key departments' and agencies' progress in 

achieving the action items. 

Table 2: Status of Action Items Required to Remove Terrorism-Related Information Sharing from GAO's High~Risk List 

Action items 

Demonstrate that the Information Sharing and Access Interagency Policy Committee has 

needed authority, is !everagmg participating departments, and is producing results, 

Update the vision for ISE-the information sharing capabilities and procedures that need to 

be in place to help ensure terrorism~related information is accessible and identifiable to 

relevant federal, state, local, private, and foreign partners. 

Demonstrate that departments are defining incremental costs and funding needed to 

complete the responsibilities and activities which substantially achieve ISE 

Continue to identify technological capabilities and services that can be shared collaboratively 

within and across ISE, consistent with a federated architecture approach 

Demonstrate that initiatives within individual departments are, or will be, leveraged to benefit 

all relevant federal, state, local, and private security stakeholders participating in ISE 

Establish an enterprise architecture management capability and demonstrate that it will be 

used to guide selection of projects for substantially achieving ISE 

Demonstrate that stakeholders generally agree with the strategy, plans, time frames, their 

responsibilities, and their activities for substantially achieving IS E. 

Demonstrate that the federal government can show the extent to which sharing has 

improved under ISE, or can show it has actions underway to more fu!!y develop a set of 

metrics and processes to measure results achieved, both from individual projects and 

activities, as well as from the overall IS E. 

Demonstrate that established milestones and time frames are being used as baselines to 

track and monitor progress on individual projects and in substantia!ly achieving the overall 

ISE. 

Action 

item 

status 

Meta 

Meta 

Met 

Met5 

Met 

Met 

Met 

Met 

Met 

High-risk category 

Leadership Commitment 

Leadership Commitment 

Capacity to resolve risk 

Capacity to resolve risk 

Action plans that provide 

corrective measures 

Action plans that provide 

corrective measures 

Action plans that provide 

corrective measures 

Monitor and validate the 

effectiveness of corrective 

measures 

Demonstrated Progress 

Source GAO ana!ys;s of Office of the Program Manager for the lnlormatoon Shanng En111ronment and key department documents. mterv•ews. and pr~or GAO reports I GAQ-17-317 

awe determined that these action items were complete in our 2013 high-risk update. 

OWe detennined thai these action items were complete in our 2015 high-risk update. 

As we have with areas previously removed from the High-Risk List, we 

will continue to monitor this area, as appropriate, to ensure that the 

improvements we have noted are sustained. If significant problems again 

arise, we will consider reapplying the high-risk designation. 

Page 8 GA0-17-407T 
55 

Two High-Risk Areas 

Narrowed 

Additional Information on Establishing Effective Mechanisms for Sharing 

and Managing Terrorism-Related Information to Protect the Homeland is 

provided on page 653 of the report. 

In the 2 years since our last high-risk update, sufficient progress has been 

made in two areas-DOD Supply Chain Management and Mitigating 

Gaps in Weather Satellite Data-that we are narrowing their scope. 

DOD Supply Chain Management 

DOD manages about 4.9 million secondary inventory items, such as 

spare parts, with a reported value of approximately $91 billion as of 

September 2015. Since 1990, DOD's inventory management has been 

included on our High-Risk List due to the accumulation of excess 

inventory and weaknesses in demand forecasting for spare parts. In 

addition to DOD's inventory management, the supply chain management 

high-risk area focuses on materiel distribution and asset visibility within 

DOD. Based on DOD's leadership commitment and demonstrated 

progress to address weaknesses since 2010, we are removing the 

inventory management component from the supply chain management 

high-risk area. Specifically, DOD has taken the following actions: 

Implemented a congressionally mandated inventory management 

corrective action plan and institutionalized a performance 

management framework, including regular performance reviews and 

standardized metrics. DOD has also developed and begun 

implementing a follow-on improvement plan. 9 

Reduced the percentage and value of its "on-order excess inventory" 

(i.e., items already purchased that may be excess due to subsequent 

changes in requirements) and "on-hand excess inventory" (i.e., items 

categorized for potential reuse or disposal). DOD's data show that the 

proportion of on-order excess inventory to the total amount of onorder inventory decreased from 9.5 percent at the end of fiscal year 

2009 to 7 percent at the end of fiscal year 2015, the most recent fiscal 

year for which data are available. During these years, the value of onNat1onal Defense Authorization Act for Fiscal Year 2010 required the Secretary of 

Defense to submit to congressional defense committees a comprehensive plan for 

improving the inventory management systems of the military departments, and Defense 

Logistics Agency with the objective of reducing the acquisition and storage of secondary 

inventory that is excess to requirements. Pub. L No. 111-84 § 328 (2009). 

Page 9 
56 

order excess inventory also decreased from $1.3 billion to $701 

million. DOD's data show that the proportion of on-hand excess 

inventory to the total amount of on-hand inventory dropped from 9.4 

percent at the end of fiscal year 2009 to 7.3 percent at the end of 

fiscal year 2015. The value of on-hand excess inventory also 

decreased during these years from $8.8 billion to $6.8 billion. 

Implemented numerous actions to improve demand forecasting and 

began tracking department-wide forecasting accuracy metrics in 2013, 

resulting in forecast accuracy improving from 46.7 percent in fiscal 

year 2013 to 57.4 percent in fiscal year 2015, the latest fiscal year for 

which complete data are available. 

Implemented 42 of our recommendations since 2006 and is taking 

actions to implement an additional 13 recommendations, which are 

focused generally on reassessing inventory goals, improving 

collaborative forecasting, and making changes to information 

technology (IT) systems used to manage inventory. 

Additional information on DOD Supply Chain Management is provided on 

page 248 of the report. 

Mitigating Gaps in Weather Satellite Data 

The United States relies on two complementary types of satellite systems 

for weather observations and forecasts: (1) polar-orbiting satellites that 

provide a global perspective every morning and afternoon, and (2) 

geostationary satellites that maintain a fixed view of the United States. 

Both types of systems are critical to weather forecasters, climatologists, 

and the military, who map and monitor changes in weather, climate, the 

oceans, and the environment. Federal agencies are planning or executing 

major satellite acquisition programs to replace existing polar and 

geostationary satellite systems that are nearing or beyond the end of their 

expected life spans. The Department of Commerce's National Oceanic 

and Atmospheric Administration (NOAA) is responsible for the polar 

satellite program that crosses the equator in the afternoon and for the 

nation's geostationary weather satellite program; DOD is responsible for 

the polar satellite program that crosses the equator in the early morning 

orbit. 

Over the last several years, we have reported on the potential for a gap in 

satellite data between the time that the current satellites are expected to 

reach the end of their lifespans and the time when the next satellites are 

expected to be in orbit and operationaL We added this area to our HighRisk List in 2013. According to NOAA program officials, a satellite data 

Page 10 GA0-17-407T 
57 

gap would result in less accurate and timely weather forecasts and 

warnings of extreme events-such as hurricanes, storm surges, and 

floods. Such degraded forecasts and warnings would endanger lives, 

property, and our nation's critical infrastructures. Similarly, according to 

DOD officials, a gap in space-based weather monitoring capabilities could 

affect the planning, execution, and sustainment of U.S. military operations 

around the world. In our prior high-risk updates, we reported on NOAA's 

efforts to mitigate the risk of a gap in its polar and geostationary satellite 

programs. 

With strong congressional support and oversight, NOAA has made 

significant progress in its efforts to mitigate the potential for gaps in 

weather satellite data on its geostationary weather satellite program. 

Specifically, the agency demonstrated strong leadership commitment to 

mitigating potential gaps in geostationary satellite data by revising and 

improving its gap mitigation/contingency plans. Previously, in December 

2014, we reported on shortfalls in the satellite program's gap 

mitigation/contingency plans and made recommendations to NOAA to 

address these shortfalls. 10 For example, we noted that the plan did not 

sufficiently address 

strategies for preventing a launch delay, 

timelines and triggers to prevent a launch delay, and 

whether any of its mitigation strategies would meet minimum 

performance levels. 

NOAA agreed with these recommendations and released a new version 

of its geostationary satellite contingency plan in February 2015 that 

addressed the recommendations, thereby meeting the criterion for having 

an action plan. 

We rated capacity as partially met in our 2015 report due to concerns 

about NOAA's ability to complete critical testing activities because it was 

already conducting testing on a round-the-clock, accelerated schedule. 

Since then, NOAA adjusted its launch schedule to allow time to complete 

critical integration and testing activities. In doing so, the agency 

demonstrated that it met the capacity criterion. 

10GAO, Geostationary Weather Satel!ites: Launch Date Nears, but Remaining Schedule 

Risks Need to be Addressed, GA0-15-60 (Washington, D.C.: Dec. 16. 2014). 

Page 11 GA0~17·407T 
58 

Progress in Other Areas 

NOAA has also met the criterion for demonstrating progress by mitigating 

schedule risks and successfully launching the satellite. In September 

2013, we reported that the agency had weaknesses in its schedulemanagement practices on its core ground system and spacecraft. We 

made recommendations to address those weaknesses, which included 

sequencing all activities, ensuring there are adequate resources for the 

activities, and analyzing schedule risks. NOAA agreed with the 

recommendations and the Geostationary Operational Environmental 

Satellite-R series (GOES-R) program improved its schedule management 

practices. By early 2016, the program had improved the links between 

remaining activities on the spacecraft schedule, included needed 

schedule logic for a greater number of activities on the ground schedule, 

and included indications on the ground schedule that the results of a 

schedule risk analysis were used in calculating its durations. In addition, 

the program successfully launched the GOES-R satellite in November 

2016. 

Oversight by Congress has been instrumental in reducing the risk of 

geostationary weather satellite gaps. For example, Subcommittees of the 

House Science, Space, and Technology Committee held multiple 

hearings to provide oversight of the satellite acquisition and the risk of 

gaps in satellite coverage. 

As a result, the agency now has a robust constellation of operational and 

backup satellites in orbit and has made significant progress in addressing 

the risk of a gap in geostationary data coverage. Accordingly, there is 

sufficient progress to remove this segment from the high-risk area. 11 

Additional information on Mitigating Gaps in Weather Satellite Data is 

provided on pages 19 and 430 of the high-risk report. 

Below are selected examples of areas where progress has been made. 

Strengthening Department of Homeland Security Management 

Functions. The Department of Homeland Security (DHS) continues 

to strengthen and integrate its management functions and progressed 

from partially met to met for the monitoring criterion. Since our 2015 

high-risk update, DHS has strengthened its monitoring efforts for 

financial system modernization programs by entering into a contract 

removed this segment from the High-Risk List, we added another segment in 

this area-DOD's Polar-Orbiting Weather Satellites_ See page 19 of this statement 

Page 12 GA0-17-407T 
59 

for independent verification and validation services to help ensure that 

the modernization projects meet key requirements. These programs 

are key to effectively supporting the department's financial 

management operations. 

Additionally, DHS continued to meet the criteria for leadership 

commitment and a corrective action plan. DHS's top leadership has 

demonstrated exemplary support and a continued focus on 

addressing the department's management challenges by, among 

other things, issuing 10 updated versions of DHS's initial January 

2011 Integrated Strategy for High Risk Management. 

The National Defense Authorization Act for Fiscal Year 2017 

reinforces this focus with the inclusion of a mandate that the DHS 

Under Secretary for Management report to us every 6 months to 

demonstrate measurable, sustainable progress made in implementing 

DHS's corrective action plans to address the high-risk area until we 

submit written notification of the area's removal from the High-Risk 

List to the appropriate congressional committees.'' Similar provisions 

were included in the DHS Headquarters Reform and Improvement Act 

of 2015, 13 the DHS Accountability Act of 2016, 14 and the DHS Reform 

and Improvement Act. 15 Additional information on this high-risk area is 

provided on page 354 of the report. 

Strategic Human Capital Management. This area progressed from 

partially met to met on leadership commitment. The Office of 

Personnel Management (OPM), agencies, and Congress have taken 

actions to improve efforts to address mission critical skills gaps. 

Specifically, OPM has demonstrated leadership commitment by 

publishing revisions to its human capital regulations in December 

2016 that require agencies to, among other things, implement human 

capital policies and programs that address and monitor governmentwide and agency-specific skills gaps. This initiative has increased the 

likelihood that skills gaps with the greatest operational effect will be 

addressed in future efforts. 

L. No.114-328, § 1903(b)codifiedat6 u.s.c. §341(a){11). 

13H.R.3572, 114th Gong. (as passed by House, Oct. 20, 2015). 

14S. 2976, 114th Cong. § 101 (b) (as reported by S. Comm. on Homeland Sec. and Gov'tal 

Affairs, June 28, 2016). 

15H.R. 6381, 114thCong. (2016). 

Page 13 GA0~17-407T 
60 

At the same time, Congress has provided agencies with authorities 

and flexibilities to manage the federal workforce and make the federal 

government a more accountable employer. For example, Congress 

included a provision in the National Defense Authorization Act for 

Fiscal Year 2016 to extend the probationary period for newly-hired 

civilian DOD employees from 1 to 2 years." This action is consistent 

with our 2015 reporting that better use of probationary periods gives 

agencies the ability to ensure an employee's skills are a good fit for all 

critical areas of a particular job. Additional information on this high-risk 

area is provided on page 61 of the report. 

Transforming the Environmental Protection Agency's Processes 

for Assessing and Controlling Toxic Chemicals. Overall, this highrisk area progressed from not met to partially met on two criteriacapacity and demonstrated progress-and continued to partially meet 

the criterion for monitoring due to progress in one program area. The 

Environmental Protection Agency's (EPA) ability to effectively 

implement its mission of protecting public health and the environment 

is critically dependent on assessing the risks posed by chemicals in a 

credible and timely manner. EPA assesses these risks under a variety 

of actions, including the Integrated Risk Information System (IRIS) 

program and EPA's Toxic Substances Control Act (TSCA) program. 

The IRIS program has made some progress on the capacity, 

monitoring, and demonstrated progress criteria. In terms of IRIS 

capacity, EPA has partially met this criterion by finalizing a Multi-Year 

Agenda to better assess how many people and resources should be 

dedicated to the IRIS program. In terms of IRIS monitoring, EPA has 

met this criterion in part by using a Chemical Assessment Advisory 

Committee to review IRIS assessments, among other actions. In 

terms of IRIS demonstrated progress, EPA has partially met this 

criterion as of January 2017 by issuing five assessments since fiscal 

year 2015. 

The Frank R. Lautenberg Chemical Safety for the 21st Century Act 

amended TSCA and was enacted on June 22, 2016. 17 Passing TSCA 

reform may facilitate EPA's effort to improve its processes for 

assessing and controlling toxic chemicals in the years ahead. The 

new law provides EPA with greater authority and the ability to take 

actions that could help EPA implement its mission of protecting 

16Pub. L. No. 114-92, div. A, title XI,§ 1105, 129 Stat. 726, 1023-1024, codified at 10 

U.S.C § 1599e 

17Pub. L. No. 114-182, 130 Stat. 448. 

Page 14 GA0·17407T 
61 

human health and the environment. EPA officials stated that the 

agency is better positioned to take action to require chemical 

companies to report chemical toxicity and exposure data. Officials 

also stated that the new law gives the agency additional authorities, 

including the authority to require companies to develop new 

information relating to a chemical as necessary for prioritization and 

risk evaluation. 

Using both new and previously existing TSCA authorities should 

enhance the agency's ability to gather new information as necessary 

to evaluate hazard and exposure risks. Continued leadership 

commitment from EPA officials and Congress will be needed to fully 

implement reforms. Additional work will also be needed to issue a 

workload analysis to demonstrate capacity, complete a corrective 

action plan, and demonstrate progress implementing the new 

legislation. Additional information on this high-risk area is provided on 

page 417 of the report. 

Managing Federal Real Property. The federal government continued 

to meet the criteria for leadership commitment, now partially meets 

the criterion for demonstrated progress, and made some progress in 

each of the other high-risk criteria. The Office of Management and 

Budget (OMB) issued the National Strategy for the Efficient Use of 

Real Property (National Strategy) on March 25, 2015, which directs 

Chief Financial Officer (CFO) Act agencies to take actions to reduce 

the size of the federal real property portfolio, as we recommended in 

2012. In addition, in December 2016, two real property reform bills 

were enacted that could address the long-standing problem of federal 

excess and underutilized property. The Federal Assets Sale and 

Transfer Act of 2016 may help address stakeholder influence by 

establishing an independent board to identify and recommend five 

high-value civilian federal buildings for disposal within 180 days after 

the board members are appointed, as well as develop 

recommendations to dispose and redevelop federal civilian real 

properties. 18 

Additionally, the Federal Property Management Reform Act of 2016 

codified the Federal Real Property Council (FRPC) for the purpose of 

ensuring efficient and effective real property management while 

reducing costs to the federal government. 19 FRPC is required to 

L. No. 114~287, 130 Stat 1463. The act excludes properties on military msWiations 

among other types of properties 

19Pub. L. No.114-318,130Stat.1608. 

Page 15 GA0~17-407T 
62 

establish a real property management plan template, which must 

include performance measures, and strategies and government-wide 

goals to reduce surplus property or to achieve better utilization of 

underutilized property. In addition, federal agencies are required to 

annually provide FRPC a report on all excess and underutilized 

property, and identify leased space that is not fully used or occupied. 

In addressing our 2016 recommendation to improve the reliability of 

real property data, GSA conducted an in-depth survey that focused on 

key real property data elements maintained in the Federal Real 

Property Profile, formed a working group of CFO Act agencies to 

analyze the survey results and reach consensus on reforms, and 

issued a memorandum to CFO Act agencies designed to improve the 

consistency and quality of real property data. The Federal Protective 

Service, which protects about 9,500 federal facilities, implemented our 

recommendation aimed at improving physical security by issuing a 

plan that identifies goals and describes resources that support its risk 

management approach. In addition, the Interagency Security 

Committee, a OHS-chaired organization, issued new guidance 

intended to make the most effective use of physical security 

resources. Additional information on this high-risk area is provided on 

page 77 of the report. 

Enforcement of Tax Laws. The Internal Revenue Service's (IRS) 

continued efforts to enforce tax laws and address identity theft refund 

fraud (lOT) have resulted in the agency meeting one criterion for 

removal from the High-Risk List (leadership commitment) and partially 

meeting the remaining four criteria (capacity, action plan, monitoring, 

and demonstrating progress). lOT is a persistent and evolving threat 

that burdens legitimate taxpayers who are victims of the crime. It cost 

the U.S. Treasury an estimated minimum of $2.2 billion during the 

2015 tax year. 

Congress and IRS have taken steps to address this challenge. IRS 

has deployed new tools and increased resources dedicated to 

identifying and combating lOT refund fraud. In addition, the 

Consolidated Appropriations Act, 2016, amended the tax code to 

accelerate Wage and Tax Statement (W-2) filing deadlines to January 

31. 20 We had previously reported that the wage information that 

employers report on Form W-2 was not available to IRS until after it 

issues most refunds. With earlier access to W-2 wage data, IRS could 

20Pub. L. No. 114-113, div. Q, § 201, 129 Slat. 2242. 3076 (2015). This change wentinto 

effect forW-2s reporting payments made in 2016 and filed in 2017. 

Page 16 GA0-17·407T 
63 

Progress on 

Government-wide HighRisk Issues 

match such information to taxpayers' returns and identify 

discrepancies before issuing billions of dollars of fraudulent IDT 

refunds. Such matching could also provide potential benefits for other 

IRS enforcement programs, such as preventing improper payments 

via the Earned Income Tax Credit. Additional information on this highrisk area is provided on page 500 of the report. 

In addition to being instrumental in supporting progress in individual highrisk areas, Congress also has taken actions to enact various statutes that, 

if implemented effectively, will help foster progress on high-risk issues 

government-wide. These include the following: 

Program Management Improvement Accountability Act: 21 

Enacted in December 2016, the act seeks to improve program and 

project management in federal agencies. Among other things, the act 

requires the Deputy Director of the Office of Management and Budget 

(OMB) to adopt and oversee implementation of government-wide 

standards, policies, and guidelines for program and project 

management in executive agencies. The act also requires the Deputy 

Director to conduct portfolio reviews to address programs on our 

High-Risk List. It further creates a Program Management Policy 

Council to act as an interagency forum for improving practices related 

to program and project management. The Council is to review 

programs on the High-Risk List and make recommendations to the 

Deputy Director or designee. We are to review the effectiveness of 

key efforts under the act to improve federal program management. 

Fraud Reduction and Data Analytics Act of 2015 (FRDA): 22 FRDA, 

enacted in June 2016, is intended to strengthen federal anti-fraud 

controls, while also addressing improper payments. 23 FRDA requires 

OMB to use our Fraud Risk Framework to create guidelines for 

federal agencies to identify and assess fraud risks, and then design 

and implement control activities to prevent, detect, and respond to 

21Pub. L. No. 114-264, 130 Stat 1371 (2016). 

22Pub. L No. 114-186, 130 Stat. 546 (2016). 

23!t is important to note that while a!! fraud involving a federal payment is considered an 

improper payment, not all improper payments are fraud. However, minimizing fraud risks 

in federal agency programs can help reduce improper payments and enhance program 

integrity. 

Page 17 GA0.17407T 
64 

fraud. 24 Agencies, as part of their annual financial reports beginning in 

fiscal year 2017, are further required to report on their fraud risks and 

their implementation of fraud reduction strategies, which should help 

Congress monitor agencies' progress in addressing and reducing 

fraud risks. To aid federal agencies in better analyzing fraud risks, 

FRDA requires OMB to establish a working group tasked with 

developing a plan for the creation of an interagency library of data 

analytics and data sets to facilitate the detection of fraud and the 

recovery of improper payments. This working group and the library 

should help agencies to coordinate their fraud detection efforts and 

improve their ability to use data analytics to monitor databases for 

potential improper payments. The billions of dollars of improper 

payments are a central part of the Medicare Program, Medicaid 

Program, and Enforcement of Tax Laws (Earned Income Tax Credit) 

high-risk areas. 

IT Acquisition Reform, Legislation known as the Federal 

Information Technology Acquisition Reform Act (FITARA): 25 

FITARA, enacted in December 2014, was intended to improve how 

agencies acquire IT and enable Congress to monitor agencies' 

progress and hold them accountable for reducing duplication and 

achieving cost savings. FIT ARA includes specific requirements 

related to seven areas: the federal data center consolidation initiative. 

enhanced transparency and improved risk management, agency 

Chief Information Officer authority enhancements, portfolio review, 

expansion of training and use of IT acquisition cadres, governmentwide software purchasing, and maximizing the benefit of the federal 

strategic sourcing initiative. Effective implementation of FITARA is 

central to making progress in the Improving the Management of IT 

Acquisitions and Operations government-wide area we added to the 

High-Risk List in 2015. 

help managers combat fraud and preserve integrity in government agencies and 

programs, we identified leading practices for managing fraud risks and organized them 

into a conceptual framework. GAO, A Framework for Managing Fraud Risks in Federal 

Programs, GA0-15-593SP (Washington, D.C.: July 28, 2015). 

25FITARA was enacted into taw a part of the Carl Levin and Howard P. "Buck" McKeon 

National Defense Authorization Act for Fiscal Year 2015, Pub. L No. t 13-291 (2014), div. 

A, t1tle VIII, subtitleD,§§ 831-837, 128 Stat 3292, 3438-3450. 

Page 18 GA0·17-407T 
65 

High-Risk Areas 

Highlighted for 

Significant Attention 

Expanding High-Risk 

Area: Mitigating Gaps in 

DOD Weather Satellite 

Data 

DOD's Polar-Orbiting Weather 

Satellites 

In the 2 years since the last high-risk update, two areas-Mitigating Gaps 

in Weather Satellite Data and Management of Federal Oil and Gas 

Resources-have expanded in scope because of emerging challenges 

related to these overall high-risk areas. In addition, while progress is 

needed across all high-risk areas, particular areas need significant 

attention. 

While NOAA has made significant progress, as described earlier, in its 

geostationary weather satellite program, DOD has made limited progress 

in meeting its requirements for the polar satellite program. In 201 0, when 

the Executive Office of the President decided to disband a tri-agency 

polar weather satellite program, DOD was given responsibility for 

providing polar-orbiting weather satellite capabilities in the early morning 

orbit. This information is used to provide updated information for weather 

observations and models. However, the department was slow to develop 

plans to replace the existing satellites that provide this coverage. 

Because DOD delayed establishing plans for its next generation of 

weather satellites, there is a risk of a satellite data gap in the early 

morning orbit. 

The last satellite that the department launched in 2014 called Defense 

Meteorological Satellite Program (DMSP)-19, stopped providing recorded 

data used in weather models in February 2016. A prior satellite, called 

DMSP-17, is now the primary satellite operating in the early morning orbit. 

However, this satellite, which was launched in 2006, is operating with 

limitations due to the age of its instruments. DOD had developed another 

satellite, called DMSP-20, but plans to launch that satellite were canceled 

after the department did not certify that it would launch the satellite by the 

end of calendar year 2016. 

The department conducted a requirements review and analysis of 

alternatives from February 2012 through September 2014 to determine 

the best way forward for providing needed polar-orbiting satellite 

environmental capabilities in the early morning orbit. In October 2016, 

DOD approved plans for its next generation of weather satellites, called 

the Weather System Follow-on-Microwave program, which will meet the 

Page 19 GA0~17407T 
66 

department's needs for satellite information on oceanic wind speed and 

direction to protect ships on the ocean's surface. The department plans to 

launch a demonstration satellite in 2017 and to launch its first operational 

satellite developed under this program in 2022. However, DOD's plans for 

the early morning orbit are not comprehensive. 

The department did not thoroughly assess options for providing its two 

highest-priority capabilities, cloud descriptions and area-specific weather 

imagery. These capabilities were not addressed due to an inccrrect 

assumption about the capabilities that would be provided by international 

partners. The Weather System Follow-on-Microwave program does not 

address these two highest-priority capabilities and the department has not 

yet determined its long-term plans for providing these capabilities. As a 

result, the department will need to continue to rely on the older DMSP-17 

satellite until its new satellite becomes operational in 2022, and it 

establishes and implements plans to address the high-priority capabilities 

that the new satellite will not address. Given the age of the DMSP-17 

satellite and uncertainty on how much longer it will last, the department 

could face a gap in critical satellite data. 

In August 2016, DOD reported to Congress its near-term plans to address 

potential satellite data gaps. These plans include a greater reliance on 

international partner capabilities, exploring options to move a 

geostationary satellite over an affected region, and plans to explore 

options for acquiring and fielding new equipment, such as satellites and 

satellite components to provide the capabilities. In addition, the 

department anticipates that the demonstration satellite to be developed 

as a precursor to the Weather System Follow-on-Microwave program 

could help mitigate a potential gap by providing some useable data. 

However, these proposed solutions may not be available in time or be 

comprehensive enough to avoid near-term coverage gaps. Such a gap 

could negatively affect military operations that depend on weather data, 

such as long-range strike capabilities and aerial refueling. 

DOD needs to demonstrate progress on its new Weather Satellite Followon-Microwave program and to establish and implement plans to address 

the high-priority capabilities that are not included in the program. 

Additional information on Mitigating Gaps in Weather Satellite Data is 

provided on page 430 of the high-risk report. 

Page 20 GA0-17-407T 
67 

Expanding High-Risk 

Area: Management of 

Federal Oil and Gas 

Resources 

Restructuring of Offshore Oil 

and Gas Oversight 

On April 20, 201 0, the Deepwater Horizon drilling rig exploded in the Gulf 

of Mexico, resulting in 11 deaths, serious injuries, and the largest marine 

oil spill in U.S. history. In response, in May 2010, the Department of the 

Interior (Interior) first reorganized its offshore oil and gas management 

activities into separate offices for revenue collection, under the Office of 

Natural Resources Revenue, and energy development and regulatory 

oversight, under the Bureau of Ocean Energy Management, Regulation 

and Enforcement. Later, in October 2011, Interior further reorganized its 

energy development and regulatory oversight activities when it 

established two new bureaus to oversee offshore resources and 

operational compliance with environmental and safety requirements. The 

new Bureau of Ocean Energy Management (BOEM) is responsible for 

leasing and approving offshore development plans while the new Bureau 

of Safety and Environmental Enforcement (BSEE) is responsible for lease 

operations, safety, and enforcement. 

In 2011, we added Interior's management of federal oil and gas resources 

to the High-Risk List based on three concerns: (1) Interior did not have 

reasonable assurance that it was collecting its share of billions of dollars 

of revenue from federal oil and gas resources; (2) Interior continued to 

experience problems hiring, training, and retaining sufficient staff to 

oversee and manage federal oil and gas resources: and (3) Interior was 

engaged in restructuring its oil and gas program, which is inherently 

challenging, and there were questions about whether Interior had the 

capacity to reorganize while carrying out its range of responsibilities, 

especially in a constrained resource environment. 

Immediately after reorganizing, Interior developed memorandums and 

standard operating procedures to define roles and responsibilities, and 

facilitate and formalize coordination between BOEM and BSEE. Interior 

also revised polices intended to improve its oversight of offshore oil and 

gas activities, such as new requirements designed to mitigate the risk of a 

subsea well blowout or spill. In 2013, we determined that progress had 

been made, because Interior had fundamentally completed reorganizing 

its oversight of offshore oil and gas activities. As a result, in 2013, we 

removed the reorganization segment from this high-risk area. 

Page 21 GA0~17-407T 
68 

However, in February 2016, we reported that BSEE had undertaken 

various reform efforts since its creation in 2011, but had not fully 

addressed deficiencies in its investigative, environmental compliance, and 

enforcement capabilities identified by investigations after the Deepwater 

Horizon incident. 

BSEE's ongoing restructuring has made limited progress enhancing the 

bureau's investigative capabilities. BSEE continues to use preDeepwater Horizon incident policies and procedures. Specifically, BSEE 

has not completed a policy outlining investigative responsibilities or 

updated procedures for investigating incidents-among the goals of 

BSEE's restructuring, according to restructuring planning documents, and 

consistent with federal standards for internal control. The use of outdated 

investigative policies and procedures is a long-standing deficiency. PostDeepwater Horizon incident investigations found that Interior's policies 

and procedures did not require it to plan investigations, gather and 

document evidence, and ensure quality control, and determined that 

continuing to use them posed a risk to the effectiveness of bureau 

investigations. Without completing and updating its investigative policies 

and procedures, BSEE continues to face this risk. 

BSEE's ongoing restructuring of its environmental compliance program 

reverses actions taken to address post-Deepwater Horizon incident 

concerns, and risks weakening the bureau's environmental compliance 

oversight capabilities. In 2011, in response to two post-Deepwater 

Horizon incident investigations that found that BSEE's predecessor's 

focus on oil and gas development might have been at the expense of 

protecting the environment, BSEE created an environmental oversight 

division with region-based staff reporting directly to the headquartersbased division chief instead of regional management. This reporting 

structure was to help ensure that environmental issues received 

appropriate weight and consideration within the bureau. 

Under the restructuring, since February 2015, field-based environmental 

compliance staff again report to their regional directors. BSEE's rationale 

for this action is unclear, as it was not documented or analyzed as part of 

the bureau's restructuring planning. Under federal standards for internal 

control, management is to assess the risks posed by ex1ernal and internal 

sources and decide what actions to take to mitigate them. Without 

assessing the risk of reversing its reporting structure, Interior cannot be 

sure that BSEE will have reasonable assurance that environmental issues 

are receiving the appropriate weight and consideration, as called for by 

post-Deepwater Horizon incident investigations. 

Page 22 GA0~17-407T 
69 

When we reviewed BSEE's environmental compliance program, we found 

that the interagency agreements between Interior and EPA designed to 

coordinate water quality monitoring under the National Pollutant 

Discharge Elimination System were decades old. According to BSEE 

annual environmental compliance activity reports, the agreements may 

not reflect the agency's current resources and needs. For example, a 

1989 agreement stipulates that Interior shall inspect no more than 50 

facilities on behalf of EPA per year, and shall not conduct water sampling 

on behalf of EPA. Almost 30 years later, after numerous changes in 

drilling practices and technologies, it is unclear whether inspecting no 

more than 50 facilities per year is sufficient to monitor water quality. 

Nevertheless, senior BSEE officials told us that the bureau has no plans 

to update its agreements with EPA, and some officials said that a 

previous headquarters-led effort to update the agreements was not 

completed because it did not sufficiently describe the bureau's offshore oil 

and gas responsibilities. According to Standards for Internal Control in the 

Federal Government, as programs change and agencies strive to improve 

operational processes and adopt new technologies, management officials 

must continually assess and evaluate internal controls to ensure that 

control activities are effective and updated when necessary. 

BSEE's ongoing restructuring has made limited progress in enhancing its 

enforcement capabilities. In particular, BSEE has not developed 

procedures with criteria to guide how it uses enforcement tools-such as 

warnings and fines-which are among the goals of BSEE's restructuring, 

according to planning documents, and consistent with federal standards 

for internal control. BSEE restructuring plans state that the current lack of 

criteria causes BSEE to act inconsistently, which makes oil and gas 

industry operators uncertain about BSEE's oversight approach and 

expectations. The absence of enforcement climate criteria is a longstanding deficiency. For example, post-Deepwater Horizon incident 

investigations recommended BSEE assess its enforcement tools and how 

to employ them to deter safety and environmental violations. Without 

developing procedures with defined criteria for taking enforcement 

actions, BSEE continues to face risks to the effectiveness of its 

enforcement capabilities. 

To enhance Interior's oversight of oil and gas development, we 

recommended in February 2016 that the Secretary of the Interior direct 

Page 23 
70 

the Director of BSEE to take the following nine actions as it continues to 

restructure. 26 

To address risks to the effectiveness of BSEE's investigations, 

environmental compliance, and enforcement capabilities, we 

recommended that BSEE complete policies outlining the 

responsibilities of investigations, environmental compliance, and 

enforcement programs, and update and develop procedures to guide 

them. 

To enhance its investigative capabilities, we recommended that BSEE 

establish a capability to review investigation policy and collect and 

analyze incidents to identify trends in safety and environmental 

hazards; 

develop a plan with milestones for implementing the case 

management system for investigations; 

clearly communicate the purpose of BSEE's investigations 

program to industry operators; and 

clarify policies and procedures for assigning panel investigation 

membership and referring cases of suspected criminal 

wrongdoing to the Inspector GeneraL 

To enhance its environmental compliance capabilities, we 

recommended that BSEE 

conduct and document a risk analysis of the regional-based 

reporting structure of its Environmental Compliance Division, 

including actions to mitigate any identified risks; 

coordinate with the Administrator of the Environmental Protection 

Agency to consider the relevance of existing interagency 

agreements for monitoring operator compliance with National 

Pollutant Discharge Elimination System permits on the Outer 

Continental Shelf and, if necessary, update agreements to reflect 

current oversight needs; and 

develop a plan to address documented environmental oversight 

staffing needs. 

26GAO, Oil and Gas Management: Interior's Bureau of Safety and Environmental 

Enforcement Restructuring Has Not Addressed Long-Standing Oversight Deficiencies, 

GA0-16-245 (Washington, D.C .. Feb. 10, 2016) 

Page 24 
71 

Additional High-Risk Areas 

Needing Significant 

Attention 

To enhance its enforcement capabilities, we recommended that BSEE 

develop a mechanism to ensure that it reviews the maximum daily 

civil penalty and adjusts it to reflect changes in the Consumer Price 

Index within the time frames established by statute. 

In its written comments, Interior agreed that additional reforms-such as 

documented policies and procedures-are needed to address offshore oil 

and gas oversight deficiencies, but Interior neither agreed nor disagreed 

with our specific recommendations. Additional information on 

Management of Federal Oil and Gas Resources is provided on page 136 

of the high-risk report. 

Managing Risks and Improving VA Health Care. Since we added 

Department of Veterans Affairs (VA) health care to our High-Risk List 

in 2015, VA has acknowledged the significant scope of the work that 

lies ahead in each of the five areas of concern we identified: (1) 

ambiguous policies and inconsistent processes; (2) inadequate 

oversight and accountability; (3) information technology (IT) 

challenges; (4) inadequate training for VA staff; and (5) unclear 

resource needs and allocation priorities. It is imperative that VA 

maintain strong leadership support, and as the new administration 

sets its priorities, VA will need to integrate those priorities with its 

high-risk related actions. 

VA developed an action plan for addressing its high-risk designation, 

but the plan describes many planned outcomes with overly ambitious 

deadlines for completion. We are concerned about the lack of root 

cause analyses for most areas of concern, and the lack of clear 

metrics and needed resources for achieving stated outcomes. In 

addition, with the increased use of community care programs, it is 

imperative that VA's action plan discuss the role of community care in 

decisions related to policies, oversight, IT, training, and resource 

needs. 

Finally, to help address its high-risk designation, VA should continue 

to implement our recommendations, as well as recommendations 

from others. While VA's leadership has increased its focus on 

implementing our recommendations in the last 2 years, additional 

work is needed. We made 66 VA health care-related 

recommendations in products issued since the VA health care highrisk designation in February 2015, for a total of 244 recommendations 

from January 1, 2010, through December 31,2016. VA has 

implemented 122 (about 50 percent) of the 244 recommendations, but 

over 100 recommendations remain open as of December 31, 2016 

Page 25 GA0-17-407T 
72 

(with about 25 percent being open for 3 or more years). It is critical 

that VA implement our recommendations in a timely manner. 

Additional information on Managing Risks and Improving VA Health 

Care is provided on page 627 of the report. 

DOD Financial Management. The effects of DOD's financial 

management problems extend beyond financial reporting and 

negatively affect DOD's ability to manage the department and make 

sound decisions on mission and operations. In addition, DOD remains 

one of the few federal entities that cannot demonstrate its ability to 

accurately account for and reliably report its spending or assets. 

DOD's financial management problems continue as one of three 

major impediments preventing us from expressing an opinion on the 

consolidated financial statements of the federal government. 

Sustained leadership commitment will be critical to DOD's success in 

achieving financial accountability, and in providing reliable information 

for day-to-day management decision making as well as financial audit 

readiness. DOD needs to assure the sustained involvement of 

leadership at all levels of the department in addressing financial 

management reform and business transformation. In addition, further 

action is needed in the areas of capacity and action planning. 

Specifically, DOD needs to 

continue building a workforce with the level of training and 

experience needed to support and sustain sound financial 

management; 

continue to develop and deploy enterprise resource planning 

systems as a critical component of DOD's financial improvement 

and audit readiness strategy, as well as strengthen automated 

controls or design manual workarounds for the remaining legacy 

systems to satisfy audit requirements and improve data used for 

day-to-day decision making; and 

effectively implement its Financial Improvement and Audit 

Readiness Plan and related guidance to focus on strengthening 

processes, controls, and systems to improve the accuracy, 

reliability, and reporting for its priority areas, including budgetary 

information and mission-critical assets. 

Further, DOD needs to monitor and assess the progress the 

department is making to remediate its internal control deficiencies. 

DOD should (1) require the military services to improve their policies 

and procedures for monitoring their corrective action plans for 

financial management-related findings and recommendations, and (2) 

improve its process for monitoring the military services' audit 

Page 26 GA0·17-407T 
73 

remediation efforts by preparing a consolidated management 

summary that provides a comprehensive picture of the status of 

corrective actions throughout the department. DOD is continuing to 

work toward undergoing a full financial statement audit by fiscal year 

2018; however. it expects to receive disclaimers of opinion on its 

financial statements for a number of years. 

A lack of comprehensive information on the corrective action plans 

limits the ability of DOD and Congress to evaluate DOD's progress 

toward achieving audit readiness, especially given the short amount of 

time remaining before DOD is required to undergo an audit of the 

department-wide financial statements for fiscal year 2018. Being able 

to demonstrate progress in remediating its financial management 

deficiencies will be useful as the department works toward 

implementing lasting financial management reform to ensure that it 

can generate reliable, useful, and timely information for financial 

reporting as well as for decision making and effective operations. 

Moreover, stronger financial management would show DOD's 

accountability for funds and would help it operate more efficiently. 

Additional information on DOD Financial Management is provided on 

page 280 of the high-risk report. 

Modernizing the U.S. Financial Regulatory System and the 

Federal Role in Housing Finance. Resolving the role of the federal 

government in housing finance will require leadership commitment 

and action by Congress and the administration. The federal 

government has directly or indirectly supported more than two-thirds 

of the value of new mortgage originations in the single-family housing 

market since the beginning of the 2007-2009 financial crisis27 

Mortgages with federal support include those backed by Fannie Mae 

and Freddie Mac, two large government-sponsored enterprises (the 

enterprises). Out of concern that their deteriorating financial condition 

threatened the stability of financial markets, the Federal Housing 

Finance Agency (FHFA) placed the enterprises into federal 

conservatorship in 2008, creating an explicit fiscal exposure for the 

federal government. As of September 2016, the Department of the 

Treasury (Treasury) had provided about $187.5 billion in funds as 

capital support to the enterprises, with an additional $258.1 billion 

available to the enterprises should they need further assistance. In 

accordance with the terms of agreements with Treasury, the 

figure is based on data from Inside Mortgage Finance. 

Page 27 
74 

enterprises had paid dividends to Treasury totaling about $250.5 

billion through September 2016. 

More than 8 years after entering conservatorship, the enterprises' 

futures remain uncertain and billions of federal dollars remain at risk. 

The enterprises have a reduced capacity to absorb future losses due 

to a capital reserve amount that falls to $0 by 2018. Without a capital 

reserve, any quarterly losses-including those due to market 

fluctuations and not necessarily to economic conditions-would 

require the enterprises to draw additional funds from Treasury. 

Additionally, prolonged conservatorships and a change in leadership 

at FHFA could shift priorities for the conservatorships, which in turn 

could send mixed messages and create uncertainties for market 

participants and hinder the development of the broader secondary 

mortgage market. For this reason, we said in November 2016 that 

Congress should consider legislation establishing objectives for the 

future federal role in housing finance, including the structure of the 

enterprises, and a transition plan to a reformed housing finance 

system that enables the enterprises to exit conservatorship." 

The federal government also supports mortgages through insurance 

or guarantee programs, the largest of which is administered by the 

Department of Housing and Urban Development's Federal Housing 

Administration (FHA). During the financial crisis, FHA served its 

traditional role of helping to stabilize the housing market, but also 

experienced financial difficulties from which it only recently recovered. 

Maintaining FHA's long-term financial health and defining its future 

role also will be critical to any effort to overhaul the housing finance 

system. 

We previously recommended that Congress or FHA specify the 

economic conditions that FHA's Mutual Mortgage Insurance Fund 

would be expected to withstand without requiring supplemental funds. 

As evidenced by the $1.68 billion FHA received in 2013, the current 2 

percent capital requirement for FHA's fund may not always be 

adequate to avoid the need for supplemental funds under severe 

stress scenarios. Implementing our recommendation would be an 

important step not only in addressing FHA's long-term financial 

viability, but also in clarifying FHA's role. 

26GAO, Federal Housing Finance Agency: Objectives Needed for the Future of Femme 

Mae and Freddie Mac After Conservatorships, GAO~ 17-92 (Washington, D.C.· Nov. 17, 

2016). 

Page 28 GA0-17-407T 
75 

Additional information on Modernizing the U.S. Financial Regulatory 

System and the Federal Role in Housing Finance is provided on page 

1 07 of the report. 

Pension Benefit Guaranty Corporation Insurance Programs. The 

Pension Benefit Guaranty Corporation (PBGC) is responsible for 

insuring the defined benefit pension plans of nearly 40 million 

American workers and retirees who participate in nearly 24,000 

private sector plans. PBGC faces an uncertain financial future due, in 

part, to a long-term decline in the number of traditional defined benefit 

plans and the collective financial risk of the many underfunded 

pension plans that PBGC insures. PBGC's financial portfolio is one of 

the largest of all federal government corporations and, at the end of 

fiscal year 2016, PBGC's net accumulated financial deficit was over 

$79 billion-having more than doubled since fiscal year 2013. PBGC 

has estimated that, without additional funding, its multiemployer 

insurance program will likely be exhausted by 2025 as a result of 

current and projected pension plan insolvencies. The agency's singleemployer insurance program is also at risk due to the continuing 

decline of traditional defined benefit pension plans, increased financial 

risk and reduced premium payments. 

While Congress and PBGC have taken significant and positive steps 

to strengthen the agency over recent years, challenges related to 

PBGC's funding and governance structure remain. Addressing the 

significant financial risk and governance challenges that PBGC faces 

requires additional congressional action. To improve the long-term 

financial stability of PBGC's insurance programs, Congress should 

consider: (1) authorizing a redesign of PBGC's single employer 

program premium structure to better align rates with sponsor risk; (2) 

adopting additional changes to PBGC's governance structure-in 

particular, expanding the composition of its board of directors; (3) 

strengthening funding requirements for plan sponsors as appropriate 

given national economic conditions; (4) working with PBGC to develop 

a strategy for funding PBGC claims over the long term, as the defined 

benefit pension system continues to decline; and (5) enacting 

additional structural reforms to reinforce and stabilize the 

multiemployer system that balance the needs and potential sacrifices 

of contributing employers, participants and the federal government. 

Absent additional steps to improve PBGC's finances, the long-term 

financial stability of the agency remains uncertain and the retirement 

benefits of millions of American workers and retirees could be at risk 

of dramatic reductions. 

Page 29 GA0-17-407T 
76 

Additional information on Pension Benefit Guaranty Corporation 

Insurance Programs is provided on page 609 of the report. 

Ensuring the Security of Federal Information Systems and Cyber 

Critical Infrastructure and Protecting the Privacy of Personally 

Identifiable Information. Federal agencies and our nation's critical 

infrastructures-such as energy, transportation systems, 

communications, and financial services-are dependent on 

computerized (cyber) information systems and electronic data to carry 

out operations and to process, maintain, and report essential 

information. 29 The security of these systems and data is vital to public 

confidence and the nation's safety, prosperity, and well-being. 

However, safeguarding computer systems and data supporting the 

federal government and the nation's critical infrastructure is a 

concern. We first designated information security as a governmentwide high-risk area in 1997. 

This high-risk area was expanded to include the protection of critical 

cyber infrastructure in 2003 and protecting the privacy of personally 

identifiable information (PI I) in 2015. Ineffectively protecting cyber 

assets can facilitate security incidents and cyberattacks that disrupt 

critical operations; lead to inappropriate access to and disclosure, 

modification, or destruction of sensitive information; and threaten 

national security, economic well-being, and public health and safety. 

In addition, the increasing sophistication of hackers and others with 

malicious intent, and the extent to which both federal agencies and 

private companies collect sensitive information about individuals, have 

increased the risk of PII being exposed and compromised. 

Over the past several years, we have made about 2,500 

recommendations to agencies aimed at improving the security of 

federal systems and information. These recommendations would help 

agencies strengthen technical security controls over their computer 

networks and systems, fully implement aspects of their information 

security programs, and protect the privacy of PII held on their 

systems. As of October 2016, about 1,000 of our information securityinfrastructure includes systems and assets so vital to the United States that 

incapacitating or destroying them would have a debilitating effect on national security. 

These critical infrastructures are grouped by the following industries or "sectors": 

chemical; commercial facilities; communications; critical manufacturing; dams; defense 

industrial base; emergency services; energy; financial services: food and agriculture; 

government facilities; health care and public health; information technology: nuclear 

reactors, materials, and waste; transportation systems; and water and wastewater 

systems. 

Page 30 GA0-17-407T 
77 

New High-Risk Areas 

Management of Programs 

That Serve Tribes and 

Their Members 

related recommendations had not been implemented. In addition, the 

federal government needs, among other things, to improve its abilities 

to detect, respond to, and mitigate cyber incidents; expand efforts to 

protect cyber critical infrastructure; and oversee the protection of PI I, 

among other things. 

Additional information on Ensuring the Security of Federal Information 

Systems and Cyber Critical Infrastructure and Protecting the Privacy 

of Personally Identifiable Information is provided on page 338 of the 

report. 

For 2017, we are adding three new areas to the High-Risk List 30 

We, along with inspectors general, special commissions, and others, 

have reported that federal agencies have ineffectively administered Indian 

education and health care programs, and inefficiently fulfilled their 

responsibilities for managing the development of Indian energy 

resources. In particular, we have found numerous challenges facing 

Interior's Bureau of Indian Education (BIE) and Bureau of Indian Affairs 

(BIA) 31 and the Department of Health and Human Services' (HHS) Indian 

Health Service (IHS) in administering education and health care services, 

which put the health and safety of American Indians served by these 

programs at risk. These challenges included poor conditions at BIE 

school facilities that endangered students, and inadequate oversight of 

health care that hindered IHS's ability to ensure quality care to Indian 

communities. In addition, we have reported that BIA mismanages Indian 

energy resources held in trust and thereby limits opportunities for tribes 

and their members to use those resources to create economic benefits 

and improve the well-being of their communities. 

Congress recently noted, "through treaties, statutes, and historical 

relations with Indian tribes, the United States has undertaken a unique 

trust responsibility to protect and support Indian tribes and Indians."" In 

light of this unique trust responsibility and concerns about the federal 

determine which federal government programs and functions should be designated 

risk, we use our guidance document, Determining Pertonnance and Accountabi!ity 

High Risks, GA0-01-159SP. 

31 Both of these bureaus are under the Office of the Assistant Secretary for Indian Affairs 

(Indian Affairs). 

321ndian Trust Asset Reform Act, Pub. L. No. 114-178, § 101(3)(2016). 

Page 31 GA0·17-407T 
78 

What Needs to Be Done 

government ineffectively administering Indian education and health care 

programs and mismanaging Indian energy resources, we are adding 

these programs as a high-risk issue because they uniquely affect tribal 

nations and their members. 

Federal agencies have performed poorly in the following broad areas: ( 1) 

oversight of federal activities; (2) collaboration and communication; (3) 

federal workforce planning; (4) equipment, technology, and infrastructure; 

and (5) federal agencies' data. While federal agencies have taken some 

actions to address the 41 recommendations we made related to Indian 

programs, there are currently 39 that have yet to be fully resolved. 

We plan to continue monitoring federal efforts in these areas. To this end, 

we have ongoing work focusing on accountability for safe schools and 

school construction, and tribal control of energy delivery, management, 

and resource development. 

Education: We have identified weaknesses in how Indian Affairs 

oversees school safety and construction and in how it monitors the way 

schools use Interior funds. We have also found limited workforce planning 

in several key areas related to BIE schools. Moreover, aging BIE school 

facilities and equipment contribute to degraded and unsafe conditions for 

students and staff. Finally, a lack of internal controls and other 

weaknesses hinder Indian Affairs' ability to collect complete and accurate 

information on the physical conditions of BIE schools. 

In the past 3 years, we issued three reports on challenges with Indian 

Affairs' management of BIE schools in which we made 13 

recommendations. Eleven recommendations below remain open. 

To help ensure that BIE schools provide safe and healthy facilities for 

students and staff, we made four recommendations which remain 

open, including that Indian Affairs ensure the inspection information it 

collects on BIE schools is complete and accurate; develop a plan to 

build schools' capacity to promptly address safety and health 

deficiencies; and consistently monitor whether BIE schools have 

established required safety committees. 

To help ensure that BIE conducts more effective oversight of school 

spending, we made four recommendations which remain open, 

including that Indian Affairs develop a workforce plan to ensure that 

BIE has the staff to effectively oversee school spending; put in place 

written procedures and a risk-based approach to guide BIE in 

Page 32 GA0-17-407T 
79 

overseeing school spending; and improve information sharing to 

support the oversight of BIE school spending. 

To help ensure that Indian Affairs improves how it manages Indian 

education, we made five recommendations. Three recommendations 

remain open, including that Indian Affairs develop a strategic plan for 

BIE that includes goals and performance measures for how its offices 

are fulfilling their responsibilities to provide BIE with support; revise 

Indian Affairs' strategic workforce plan to ensure that BIA regional 

offices have an appropriate number of staff with the right skills to 

support BIE schools in their regions; and develop and implement 

decision-making procedures for BIE to improve accountability for BIE 

schools. 

Health Care: IHS provides inadequate oversight of health care, both of its 

federally operated facilities and through the Purchase Referred Care 

program (PRC). Other issues include ineffective collaborationspecifically, IHS does not require its area offices to inform IHS 

headquarters if they distribute funds to local PRC programs using 

different criteria than the PRC allocation formula suggested by 

headquarters. As a result, IHS may be unaware of additional funding 

variation across areas. We have also reported that IHS officials told us 

that an insufficient workforce was the biggest impediment to ensuring 

patients could access timely primary care. 

In the past 6 years, we have made 12 recommendations related to Indian 

health care that remain open. Although IHS has taken several actions in 

response to our recommendations, such as improving the data collected 

for the PRC program and adopting Medicare-like rates for nonhospital 

services, much more needs to be done. 

To help ensure that Indian people receive quality health care, the 

Secretary of HHS should direct the Director of IHS to take the 

following two actions: (1) as part of implementing IHS's quality 

framework, ensure that agency-wide standards for the quality of care 

provided in its federally operated facilities are developed, and 

systematically monitor facility performance in meeting these standards 

over time; and (2) develop contingency and succession plans for 

replacing key personnel, including area directors. 

To help ensure that timely primary care is available and accessible to 

Indians, IHS should: (1) develop and communicate specific agencywide standards for wait times in federally-operated facilities, and (2) 

monitor patient wait times in federally-operated facilities and ensure 

that corrective actions are taken when standards are not met. 

Page 33 GA0-17-407T 
80 

To help ensure that IHS has meaningful information on the timeliness 

with which it issues purchase orders authorizing payment under the 

PRC program, and to improve the timeliness of payments to 

providers, we recommended that IHS: (1) modify IHS's claims 

payment system to separately track IHS referrals and self-referrals, 

revise Government Performance and Results Act measures for the 

PRC program so that it distinguishes between these two types of 

referrals, and establish separate time frame targets for these referral 

types; and (2) better align PRC staffing levels and workloads by 

revising its current practices, where available, used to pay for PRC 

program staff. In addition, as HHS and IHS monitor the effect that new 

coverage options available to IHS beneficiaries through PPACA have 

on PRC funds, we recommend that IHS concurrently develop potential 

options to streamline requirements for program eligibility. 

To help ensure successful outreach efforts regarding PPACA 

coverage expansions, we recommended that IHS realign current 

resources and personnel to increase capacity to deal with enrollment 

in Medicaid and the exchanges, and prepare for increased billing to 

these payers. 

If payments for physician and other nonhospital services are capped, 

we recommended that IHS monitor patient access to these services. 

To help ensure a more equitable allocation of funds per capita across 

areas, we recommended that Congress consider requiring IHS to 

develop and use a new method for allocating PRC funds. 

To develop more accurate data for estimating the funds needed for 

the PRC program and improve IHS oversight, we recommended that 

IHS develop a written policy documenting how it evaluates the need 

for the PRC program, and disseminate it to area offices so they 

understand how unfunded services data are used to estimate overall 

program needs. We also recommended that IHS develop written 

guidance for PRC programs outlining a process to use when funds 

are depleted but recipients continue to need services. 

Energy: We have reported on issues with BIA oversight of federal 

activities, such as the length of time it takes the agency to review energyrelated documents. We also reported on challenges with collaboration-in 

particular, while working to form an Indian Energy Service Center, BIA did 

not coordinate with key regulatory agencies, including the Department of 

the Interior's Fish and Wildlife Service, the U.S. Army Corps of Engineers, 

and the Environmental Protection Agency. In addition, we found 

workforce planning issues at BIA contribute to management shortcomings 

that have hindered Indian energy development. Lastly, we found issues 

Page 34 
81 

with outdated and deteriorating equipment, technology, and infrastructure, 

as well as incomplete and inaccurate data. 

In the past 2 years, we issued three reports on developing Indian energy 

resources in which we made 14 recommendations to BIA. All 

recommendations remain open. 

To help ensure BIA can verify ownership in a timely manner and 

identify resources available for development, we made two 

recommendations, including that Interior take steps to improve its 

geographic information system mapping capabilities. 

To help ensure BIA's review process is efficient and transparent, we 

made two recommendations, including that Interior take steps to 

develop a documented process to track review and response times for 

energy-related documents that must be approved before tribes can 

develop energy resources. 

To help improve clarity of tribal energy resource agreement 

regulations, we recommended BIA provide additional guidance to 

tribes on provisions that tribes have identified to Interior as unclear. 

To help ensure that BIA streamlines the review and approval process 

for revenue-sharing agreements, we made three recommendations, 

including that Interior establish time frames for the review and 

approval of Indian revenue-sharing agreements for oil and gas, and 

establish a system for tracking and monitoring the review and 

approval process to determine whether time frames are met. 

To help improve efficiencies in the federal regulatory process, we 

made four recommendations, including that BIA take steps to 

coordinate with other regulatory agencies so the Service Center can 

serve as a single point of contact or lead agency to navigate the 

regulatory process. 

To help ensure that BIA has a workforce with the right skills, 

appropriately aligned to meet the agency's goals and tribal priorities, 

we made two recommendations, including that BIA establish a 

documented process for assessing BIA's workforce composition at 

agency offices. 

Congressional Actions Needed: It is critical that Congress maintain its 

focus on improving the effectiveness with which federal agencies meet 

their responsibilities to serve tribes and their members. Since 2013, we 

testified at six hearings to address significant weaknesses we found in the 

federal management of programs that serve tribes and their members. 

Sustained congressional attention to these issues will highlight the 

Page 35 
82 

U.S. Government's 

Environmental Liabilities 

challenges discussed here and could facilitate federal actions to improve 

Indian education and health care programs, and the development of 

Indian energy resources. 

See pages 200-219 of the high-risk report for additional details on what 

we found. 

The federal government's environmental liability has been growing for the 

past 20 years and is likely to continue to increase. For fiscal year 2016, 

the federal government's estimated environmental liability was $447 

billion-up from $212 billion for fiscal year 1997. 33 However, this estimate 

does not reflect all of the future cleanup responsibilities facing federal 

agencies. Because of the lack of complete information and the oflen 

inconsistent approach to making cleanup decisions, federal agencies 

cannot always address their environmental liabilities in ways that 

maximize the reduction of health and safety risks to the public and the 

environment in a cost-effective manner. 

The federal government is financially liable for cleaning up areas where 

federal activities have contaminated the environment. Various federal 

laws, agreements with states, and court decisions require the federal 

government to clean up environmental hazards at federal sites and 

facilities-such as nuclear weapons production facilities and military 

installations. Such sites are contaminated by many types of waste, much 

of which is highly hazardous. 

Federal accounting standards require agencies responsible for cleaning 

up contamination to estimate future cleanup and waste disposal costs, 

and to report such costs in their annual financial statements as 

environmental liabilities. Per federal accounting standards, federal 

agencies' environmental liability estimates are to include probable and 

reasonably estimable costs of cleanup work. Federal agencies' 

environmental liability estimates do not include cost estimates for work for 

which reasonable estimates cannot currently be generated. 

Consequently, the ultimate cost of addressing the U.S. government's 

environmental cleanup is likely greater than $447 billion. Federal 

33We did not adjust environmental liability estimates for inflation because information 

about the amount of the !lability applicable to each fiscal year was not available. 

Page 36 GA0~17·407T 
83 

What Needs to Be Done 

agencies' approaches to addressing their environmental liabilities and 

cleaning up the contamination from past activities are often influenced by 

numerous site-specific factors, stakeholder agreements, and legal 

provisions. 

We have also found that some agencies do not take a holistic, riskinformed approach to environmental cleanup that aligns limited funds with 

the greatest risks to human health and the environment. Since 1994, we 

have made at least 28 recommendations related to addressing the federal 

government's environmental liability. These include 22 recommendations 

to the Departments of Energy (DOE) or Defense (DOD), 1 

recommendation to OMS to consult with Congress on agencies' 

environmental cleanup costs, and 4 recommendations to Congress to 

change the laws governing cleanup activities. Of these, 13 

recommendations remain unimplemented. If implemented, these steps 

would improve the completeness and reliability of the estimated costs of 

future cleanup responsibilities, and lead to more risk-based management 

of the cleanup work. 

Of the federal government's estimated $447 billion environmental liability, 

DOE is responsible for by far the largest share of the liability, and DOD is 

responsible for the second largest share. The rest of the federal 

government makes up the remaining 3 percent of the liability with 

agencies such as the National Aeronautics and Space Administration 

(NASA) and the Departments of Transportation, Veteran's Affairs, 

Agriculture (USDA), and Interior holding large liabilities (see figure 2). 

Page 37 GA0-17-407T 
84 

Figure 2: Total Reported U.S. Environmental Liability, Fiscal Year 2016 

Dollars in billions 

Source. GAO analys•s <'.lf!ll!l Fonanc•al Report of!he US Government, fisc;~! year 2016 l GAO-17-317 

Note: We did not adjust environmental liability estimates for inflation because infonnation about the 

amount of the liability applicable to each fiscal year was not available. 

Agencies spend billions each year on environmental cleanup efforts but 

the estimated environmental liability continues to rise. For example, 

despite billions spent on environmental cleanup, DOE's environmental 

liability has roughly doubled from a low of $176 billion in fiscal year 1997 

to the fiscal year 2016 estimate of $372 billion. In the last 6 years alone, 

DOE's Office of Environmental Management (EM) has spent $35 billion, 

primarily to treat and dispose of nuclear and hazardous waste, and 

construct capital asset projects to treat the waste; however, EM's portion 

of the environmental liability has grown over this same time period by 

over $90 billion, from $163 billion to $257 billion (see figure 3). 

Page 38 GA0·17·407T 
85 

Figure 3: DOE's Office of Environmental Management's Annual Spending and 

Growing Environmental Liability 

Do!Jars{mbillions) 

2014 

Fiscal year 

Source GAO ar!alys1s of Oepartme!Tt of Energy budget data 1 GA0·17-317 

Note: EM is the organization within DOE responsible for managing environmental cleanup and is 

responsible for cleaning up 107 sites across the country. To date, EM has completed cleanup at 91 of 

these sites. EM spending includes money to treat and dispose of nuclear and hazardous waste, and 

to construct capital asset pmjects to treat the waste. We did not adjust environmental liability 

estimates for inflation because information about the amount of the liability applicable to each fiscal 

year was not available. 

Progress in addressing the U.S. government's environmental liabilities 

depends on how effectively federal departments and agencies set 

priorities. under increasingly restrictive budgets, that maximize the risk 

reduction and cost-effectiveness of cleanup approaches. As a first step, 

some departments and agencies may need to improve the completeness 

of information about long-term cleanup responsibilities and their 

associated costs so that decision makers, including Congress, can 

consider the full scope of the federal government's cleanup obligations. 

As a next step, certain departments, such as DOE, may need to change 

how they establish cleanup priorities. For example, DOE's current 

practice of negotiating agreements with individual sites without 

Page 39 GA0-17-407T 
86 

Completeness of 

Environmental Liability 

Estimates 

Reliability of Environmental 

Liability Estimates 

Risk-Based Decision Making 

considering other sites' agreements or available resources may not 

ensure that limited resources will be allocated to reducing the greatest 

environmental risks, and costs will be minimized. 

We have recommended actions to federal agencies that, if implemented, 

would improve the completeness and reliability of the estimated costs of 

future cleanup responsibilities, and lead to more risk-based management 

of the cleanup work. These recommendations include the following. 

In 1994, we recommended that Congress amend certain legislation to 

require agencies to report annually on progress in implementing plans 

for completing site inventories, estimates of the total costs to clean up 

their potential hazardous waste sites, and agencies' progress toward 

completing their site inventories and on their latest estimates of total 

cleanup costs. We believe these recommendations are as relevant, if 

not more so, today. 

In 2015, we recommended that USDA develop plans and procedures 

for completing its inventories of potentially contaminated sites. USDA 

disagreed with this recommendation. However, we continue to believe 

that USDA's inventory of contaminated and potentially contaminated 

sites-in particular, abandoned mines, primarily on Forest Service 

land-is insufficient for effectively managing USDA's overall cleanup 

program. Interior is also faced with an incomplete inventory of 

abandoned mines that it is working to improve. 

In 2006, we recommended that DOD develop, document, and 

implement a program for financial management review, assessment, 

and monitoring of the processes for estimating and reporting 

environmental liabilities. This recommendation has not been 

implemented. 

We have found in the past that DOE's cleanup strategy is not risk 

based and should be re-evaluated. DOE's decisions are often driven 

by local stakeholders and certain requirements in federal facilities 

agreements and consent decrees. In 1995, we recommended that 

DOE set national priorities for cleaning up its contaminated sites using 

data gathered during ongoing risk evaluations. This recommendation 

has not been implemented. 

In 2003, we recommended that DOE ask Congress to clarify its 

authority for designating certain waste with relatively low levels of 

radioactivity as waste incidental to reprocessing, and therefore not 

managed as high-level waste. In 2004, DOE received this specific 

Page 40 GA0·17-407T 
87 

2020 Decennial Census 

authority from Congress for the Savannah River and Idaho Sites, 34 

thereby allowing DOE to save billions of dollars in waste treatment 

costs. The law, however, excluded the Hanford Site. 

More recently, in 2015, we found that DOE is not comprehensively 

integrating risks posed by National Nuclear Security Administration's 

(NNSA) nonoperational contaminated facilities with EM's portfolio of 

cleanup work. 35 By not integrating nonoperational facilities from 

NNSA, EM is not providing Congress with complete information about 

EM's current and future cleanup obligations as Congress deliberates 

annually about appropriating funds for cleanup activities. We 

recommended that DOE integrate its lists of facilities prioritized for 

disposition with all NNSA facilities that meet EM's transfer 

requirements, and that EM should include this integrated list as part of 

the Congressional Budget Justification for DOE. DOE neither agreed 

nor disagreed with this recommendation. 

See pages 232-24 7 of the high-risk report for additional details on what 

we found. 

One of the most important functions of the U.S. Census Bureau (Bureau) 

is conducting the decennial census of the U.S. population, which is 

mandated by the Constitution and provides vital data for the nation. This 

information is used to apportion the seats of the U.S. House of 

Representatives; realign the boundaries of the legislative districts of each 

state; allocate billions of dollars in federal financial assistance; and 

provide social, demographic, and economic profiles of the nation's people 

to guide policy decisions at each level of government. A complete count 

of the nation's population is an enormous challenge as the Bureau seeks 

to control the cost of the census while it implements several new 

innovations and manages the processes of acquiring and developing new 

and modified IT systems supporting them. Over the past 3 years, we have 

made 30 recommendations to help the Bureau design and implement a 

more cost-effective census for 2020; however, only 6 of them had been 

fully implemented as of January 2017. 

L. No. 108-375, § 3116 (2004). 

35NNSA has identified 83 contaminated facilities for potential transfer to EM for disposition 

over a 25-year period, 56 of which are currently nonoperationaL NNSA is maintaining 

these facillties for future transfer to EM, but the condition of nonoperational facilities 

continues to degrade, resulting in increasing costs to NNSA to maintain them to prevent 

the spread of contamination. 

Page 41 GA0-17407T 
88 

-------------------------

The cost of the census, in terms of cost for counting each housing unit, 

has been escalating over the last several decennials. The 2010 Census 

was the costliest U.S. Census in history at about $12.3 billion, and was 

about 31 percent more costly than the $9.4 billion cost of the 2000 

Census (in 2020 dollars). 36 The average cost for counting a housing unit 

increased from about $16 in 1970 to around $92 in 2010 (in 2020 

constant dollars). Meanwhile, the return of census questionnaires by mail 

(the primary mode of data collection) declined over this period from 78 

percent in 1970 to 63 percent in 2010. Declining mail response rates-a 

key indicator of a cost-effective census-are significant and lead to higher 

costs. This is because the Bureau sends enumerators to each 

nonresponding household to obtain census data. As a result, 

nonresponse follow-up is the Bureau's largest and most costly field 

operation. In many ways, the Bureau has had to invest substantially more 

resources each decade to match the results of prior enumerations. 

The Bureau plans to implement several new innovations in its design of 

the 2020 Census. In response to our recommendations regarding past 

decennial efforts and other assessments, the Bureau has fundamentally 

reexamined its approach for conducting the 2020 Census. Its plan for 

2020 includes four broad innovation areas that it believes will save it over 

$5 billion (2020 constant dollars) when compared to what it estimates 

conducting the census with traditional methods would cost. The Bureau's 

innovations include (1) using the Internet as a self-response option, which 

the Bureau has never done on a large scale before; (2) verifying most 

addresses using "in-office" procedures and on-screen imagery rather than 

street-by-street field canvassing; (3) re-engineering data collection 

methods such as by relying on an automated case management system; 

and (4) in certain instances, replacing enumerator collection of data with 

administrative records (information already provided to federal and state 

governments as they administer other programs). These innovations 

show promise for a more cost-effective head count However, they also 

introduce new risks, in part, because they include new procedures and 

technology that have not been used extensively in earlier decennials, if at 

all. 

3

Brhe fiscal year 2020 constant dollar factors the Bureau used are derived from lhe 

Chained Price Index from "Gross Domestic Product and Deflators Used in the Historical 

Tables: 1940-2020" table from the Fiscal Year 2016 Budget of the United States 

Government 

Page 42 GA0-17-407T 
89 

What Needs to Be Done 

The Bureau is also managing the acquisition and development of new 

and modified IT systems, which add complexity to the design of the 

census. To help control census costs, the Bureau plans to significantly 

change the methods and technology it uses to count the population, such 

as offering an option for households to respond to the survey via the 

Internet or phone, providing mobile devices for field enumerators to 

collect survey data from households, and automating the management of 

field operations. This redesign relies on acquiring and developing many 

new and modified IT systems, which could add complexity to the design. 

These cost risks, new innovations, and acquisition and development of IT 

systems for the 2020 Census, along with other challenges we have 

identified in recent years, raise serious concerns about the Bureau's 

ability to conduct a cost-effective enumeration. Based on these concerns, 

we have concluded that the 2020 Census is a high-risk area and have 

added it to the High-Risk list in 2017. 

To help the Bureau mitigate the risks associated with its fundamentally 

new and complex innovations for the 2020 Census, the commitment of 

top leadership is needed to ensure the Bureau's management, culture, 

and business practices align with a cost-effective enumeration. For 

example, the Bureau needs to continue strategic workforce planning 

efforts to ensure it has the skills and competencies needed to support 

planning and executing the census. It must also rigorously test individual 

census-taking activities to provide information on their feasibility and 

performance, their potential for achieving desired results, and the extent 

to which they are able to function together under full operational 

conditions. 37 

We have recommended that the Bureau also ensure that its scheduling 

adheres to leading practices and be able to support a quantitative 

schedule risk assessment, such as by having all activities associated with 

the levels of resources and effort needed to complete them. The Bureau 

has stated that it has begun maturing project schedules to ensure that the 

logical relationships are in place and plans to conduct a quantitative risk 

assessment. We will continue to monitor the Bureau's efforts. 

37 GAO, 2020 Census: Additional Actions Could Strengthen Data Collection Efforts, 

GA0-17-191 (Washington, D.C.: Jan. 26, 2017). 

Page 43 
90 

The Bureau must also improve its ability to manage, develop, and secure 

its IT systems. For example, the Bureau needs to prioritize its IT 

decisions and determine what information it needs in order to make those 

decisions. In addition, the Bureau needs to make key IT decisions for the 

2020 Census in order to ensure they have enough time to have the 

production systems in place to support the end-to-end system test. To 

this end, we recommended the Bureau ensure that the methodologies for 

answering the Internet response rate and IT infrastructure research 

questions are determined and documented in time to inform key design 

decisions. 38 Further, given the numerous and critical dependencies 

between the Census Enterprise Data Collection and Processing and 2020 

Census programs, their parallel implementation tracks, and the 2020 

Census's immovable deadline, we recommended that the Bureau 

establish a comprehensive and integrated list of all interdependent risks 

facing the two programs, and clearly identify roles and responsibilities for 

managing this list. 39 The Bureau stated that it plans to take actions to 

address our recommendations. 

It is also critical for the Bureau to have better oversight and control over 

its cost estimation process and we have recommended that the Bureau 

ensure its cost estimate is consistent with our leading practices 4 ° For 

example, the Bureau will need to, among other practices, document all 

cost-influencing assumptions; describe estimating methodologies used for 

each cost element; ensure that variances between planned and actual 

cost are documented, explained, and reviewed; and include a 

comprehensive sensitivity analysis, so that it can better estimate costs. 

We also recommended that the Bureau implement and institutionalize 

processes or methods for ensuring control over how risk and uncertainty 

are accounted for and communicated within its cost estimation process. 

The Bureau agreed with our recommendations, and we are currently 

conducting a follow-up audit of the Bureau's most recent cost estimate 

and will determine whether the Bureau has implemented them. 

Sustained congressional oversight will be essential as well. In 2015 and 

2016, congressional committees held five hearings focusing on the 

progress of the Bureau's preparations for the decennial. Going forward, 

39GA0-16-623. 

40GA0-16-628. 

Page 44 GA0-17-401T 
91 

Monitoring Previous 

High-Risk Areas 

Personnel Security 

Clearances 

active oversight will be needed to ensure these efforts stay on track, the 

Bureau has needed resources, and Bureau officials are held accountable 

for implementing the enumeration as planned. 

We will continue monitoring the Bureau's efforts to conduct a costeffective enumeration. To this end, we have ongoing work focusing on 

such topics as the Bureau's updated lifecycle cost estimate and the 

readiness of IT systems for the 2018 End-to-End Test 

See pages 219-231 of the high-risk report for additional details on what 

we found. 

After we remove areas from the High-Risk List we continue to monitor 

them, as appropriate, to determine if the improvements we have noted 

are sustained and whether new issues emerge. If significant problems 

again arise, we will consider reapplying the high-risk designation. DOD's 

Personnel Security Clearance Program is one former high-risk area that 

we continue to closely monitor in light of government-wide reform efforts. 

The Office of the Director of National Intelligence (ODNI) estimates that 

approximately 4.2 million federal government and contractor employees 

held or were eligible to hold a security clearance as of October 1, 2015. 41 

Personnel security clearances provide personnel with access to classified 

information, the unauthorized disclosure of which could, in certain 

circumstances, cause exceptionally grave damage to national security. 

High profile security incidents, such as the disclosure of classified 

programs and documents by a National Security Agency contractor and 

the OPM data breach of 21.5 million records, demonstrate the continued 

need for high quality background investigations and adjudications, strong 

oversight, and a secure IT process, which have been areas of longstanding challenges for the federal government 

Director of National Intelligence (DNI), in accordance with Executive Order 13467, 

is responsible, as the Security Executive Agent, for the development of policies and 

procedures governing the conduct of investigations and adjudications for eligibility for 

access to classified information and eligibility to hold a sensitive position. See Exec. Order 

No. 13.467. § 2.3(c), 73 Fed. Reg. 38,103 (June 30, 2008). (renumbered as section 2 S(e) 

in January 2017). 

Page 45 GA0·17-407T 
92 

------------------------------------------------------------------

In 2005, we designated the DOD personnel security clearance program, 

as a high-risk area because of delays in completing background 

investigations and adjudications. We continued the high-risk designation 

in the 2007 and 2009 updates to our High-Risk List because of issues 

with the quality of investigation and adjudication documentation and 

because delays in the timely processing of security clearances 

continued 42 

In our 2011 high-risk report, we removed DOD's personnel security 

clearance program from the High-Risk List because DOD took actions to 

develop guidance to improve its adjudication process, develop and 

implement tools and metrics to assess quality of investigations and 

adjudications, and improve timeliness for processing clearances43 We 

also noted that DOD continues to be a prominent player in the overall 

security clearance reform effort, which includes entities within the OMB, 

OPM, and ODNI that comprise the Performance Accountability Council 

(PAC) which oversees security clearance reform. The executive branch 

has also taken steps to monitor its security clearance reform efforts. The 

GPRA Modernization Act of 2010 requires OMB to report through a 

website-performance.gov-on long-term cross-agency priority goals, 

which are outcome-oriented goals covering a limited number of 

crosscutting policy areas, as well as goals to improve management 

across the federal government44 Among the cross-agency priority goals, 

the executive branch identified security clearance reform as one of the 

key areas it is monitoring. 

Since removing DOD's personnel security clearance program from the 

High-Risk List, the government's overall reform efforts that began after 

passage of the Intelligence Reform and Terrorism Prevention Act of 2004 

have had mixed progress, and key reform efforts have not yet been 

implemented. In the aftermath of the June 2013 disclosure of classified 

documents by a former National Security Agency contractor and the 

September 2013 shooting at the Washington Navy Yard, OMB issued, in 

February 2014, the Suitability and Security Processes Review Report to 

42GAO, High-Risk Series: An Update, GA0-07-310 (Washington, D.C .. January 2007); 

and High-Risk Series.· An Update, GA0-09-271 (Washington, D.C .. January 2009) 

43GAO, High-Risk Series: An Update, GA0~11-278 {Washington, D.C.: January 2011). 

44See also GAO, Performance.gov: Long-Term Strategy Needed to Improve Website 

Usability, GA0-16-693 (Washington, D.C.: Aug. 30, 2016). 

Page 46 
93 

the President, a 120-day review of the government's processes for 

granting security clearances, among other things. 

The 120-day review resulted in 37 recommendations, 65 percent of which 

have been implemented, as of October 2016, including the issuance of 

executive branch-wide quality assessment standards for investigations in 

January 2015. Additionally, the recommendations led to expanding 

DOD's ability to continuously evaluate the continued eligibility of cleared 

personnel. However, other recommendations from the 120-day review 

have not yet been implemented. For example, the reform effort is still 

trying to fully implement the revised background investigation standards 

issued in 2012 and improve data sharing between local, state, and federal 

entities. 

In addition, the 120-day review further found that performance measures 

for investigative quality are neither standardized nor implemented 

consistently across the government, and that measuring and ensuring 

quality continues to be a challenge. The review contained three 

recommendations to address the development of quality metrics, but the 

PAC has only partially implemented those recommendations. We 

previously reported that the executive branch had developed some 

metrics to assess quality at different phases of the personnel security 

clearance process; however, those metrics had not been fully developed 

and implemented. 45 

The development of metrics to assess quality throughout the security 

clearance process has been a long-standing concern. 46 Since the late 

1990s we have emphasized the need to build and monitor quality 

throughout the personnel security clearance process47 In 2009, we again 

Personnel Security Clearances: Full Development and Implementation of Metrics 

Measure Quality of Process, GA0-14-157T (Washington, D.C.: Oct. 31, 2013) 

46GAO, Personnel Secun1y Clearances Funding Estimates and Government-wide Metrics 

Are Needed to Implement Long-Standing Reform Efforts, GA0-15-179SU (Washington, 

D.C.: Apr. 23, 2015); Personnel Security Clearances: Additional Guidance and Oversight 

Needed at DHS and DOD to Ensure Consistent Application of Revocation Process, 

GA0-14-640 (Washington, D.C.: Sept 8, 2014): DOD Personnel Clearances: 

Comprehensive Timeliness Reporting, Complete Clearance Documentation, and Quality 

Measures Are Needed to Further Improve the Clearance Process, GA0-09-400 

(Washington, D.C .. May 19. 2009) 

47 GAO, DOD Personnel: Inadequate Personnel Security Investigations Pose National 

Security Risks, GAOINSIAD-00-12 (Washington, D.C .. Oct. 27, 1999). 

Page 47 GA0-17-407T 
94 

noted that clearly defined quality metrics can improve the security 

clearance process by enhancing oversight of the time required to process 

security clearances and the quality of the investigation and adjudicative 

decisions. We recommended that OMB provide Congress with results of 

metrics on comprehensive timeliness and the quality of investigations and 

adjudications'' According to ODNI, in October 2016, ODNI began 

implementation of a Quality Assessment and Reporting Tool to document 

customer issues with background investigations. The tool will be used to 

report on the quality of 5 percent of each executive branch agency's 

background investigations. 

ODNI officials stated that they plan to develop metrics in the future as 

data are gathered from the tool, but did not identify a completion date for 

these metrics. Separately, the NOAA for Fiscal Year 2017, among other 

things, requires DOD to institute a program to collect and maintain data 

and metrics on the background investigation process, in the context of 

developing a system for performance of background investigations. 49 The 

PAC's effort to fully address the 120-day review and our 

recommendations on establishing metrics on the quality of investigations 

as well as DOD's efforts to address the broader requirements in the 

NOAA for Fiscal Year 2017 remain open and will need to be a continued 

focus of the department moving forward in its effort to improve its 

management of the security clearance process. 

Further, in response to the 2015 OPM data breach, the PAC completed a 

90-day review which led to an executive order establishing the National 

Background Investigations Bureau, within OPM, to replace the Federal 

Investigative Services and transferred responsibility to develop, maintain 

and secure new IT systems for clearances to DOD. 50 Additionally, the 

Executive Order made DOD a full principal member of the PAC. 51 The 

Executive Order also directed the PAC to review authorities, roles, and 

responsibilities, including submitting recommendations related to revising, 

49See Pub. L No. 114-328, § 951(b)(1}(G} (2016}. 

50See Exec. Order No. 13,741,81 Fed. Reg. 68,289 (Sept 29, 2016} (amending Exec. 

Order No. 13,467} 

51 See Exec. Order No 13,741, § 1(e}, 81 Fed Reg. at 68,289-90. 

Page 48 GA0-17 -407T 
95 

as appropriate, executive orders pertaining to security clearances. 52 This 

effort is ongoing. 

In addition to addressing the quality of security clearances and other 

goals and recommendations outlined in the 120-day and 90-day reviews 

and the government's cross-agency priority goals, the PAC has the added 

challenge of addressing recent changes that may result from the NDAA 

for Fiscal Year 2017. Specifically, section 951 of the act requires the 

Secretary of Defense to develop an implementation plan for the Defense 

Security Service to conduct background investigations for certain DOD 

personnel-presently conducted by OPM-after October 1, 2017. 53 The 

Secretary of Defense must submit the plan to the congressional defense 

committees by August 1, 2017. It also requires the Secretary of Defense 

and Director of OPM to develop a plan by October 1, 2017, to transfer 

investigative personnel and contracted resources to DOD in proportion to 

the workload if the plan for DOD to conduct the background investigations 

were implemented. 54 It is unknown if these potential changes will impact 

recent clearance reform efforts. 

Given the history and inherent challenges of reforming the governmentwide security clearance process, coupled with recent amendments to a 

governing Executive Order and potential changes arising from the NDAA 

for Fiscal Year 2017, we will continue reviewing critical functions for 

personnel security clearance reform and monitor the government's 

implementation of key reform efforts. We have ongoing work assessing 

progress being made on the overall security clearance reform effort and 

in implementing a continuous evaluation process, 55 a key reform effort 

considered important to improving the timeliness and quality of 

52See Exec. Order No. 13,741, § 2, 81 Fed. Reg. at 68,291. 

53Specifica!ly, the implementation plan would cover background investigations for DOD 

personnel whose investigations are adjudicated by the DOD Consolidated Adjudication 

Facility. See Pub. L No. 114-328, § 951(a). According to the Consolidated Adjudication 

Facility, its mission is to determine security clearance eligibility of non-intelligence agency 

DOD personnel, with a customer base including all military service members, military 

applicants, civilian emptoyees, and consultants affiliated with DOD. 

54See id. 

55Continuous evaluation refers to a vetting process to review the background of an 

individual who has been determined to be eligible for access to classified information or to 

hold a sens1tive position at any time during the period of eligibility. It leverages a set of 

automated record checks and business rules to assist in the on~going assessment of 

continued eligibility. Exec. Order No. 13,764, § 3(e) (Jan. 17, 2017). 

Page 49 
96 

(101467) 

investigations. We anticipate issuing a report on the status of the 

government's continuous evaluation process in the fall of 2017. 

Additionally, we have previously reported on the importance of securing 

federal IT systems and anticipate issuing a report in early 2017 that 

examines IT security at OPM and efforts to secure these types of critical 

systems. 56 Continued progress in reforming personnel security 

clearances is essential in helping to ensure a federal workforce entrusted 

to protect U.S. government information and property, promote a safe and 

secure work environment, and enhance the U.S. government's risk 

management approach. 

The high-risk assessment continues to be a top priority and we will 

maintain our emphasis on identifying high-risk issues across government 

and on providing insights and sustained attention to help address them, 

by working collaboratively with Congress, agency leaders, and OMS. As 

part of this effort, with the new administration and Congress in 2017 we 

hope to continue to participate in regular meetings with the incoming 

OMS Deputy Director for Management and with top agency officials to 

discuss progress in addressing high-risk areas. Such efforts have been 

critical for the progress that has been made. 

This high-risk update is intended to help inform the oversight agenda for 

the 115th Congress and to guide efforts of the administration and 

agencies to improve government performance and reduce waste and 

risks. 

Thank you, Chairman Johnson, Ranking Member McCaskill, and 

Members of the Committee. This concludes my testimony. I would be 

pleased to answer any questions. 

For further information on this testimony, please contact J. Christopher 

Mihm at mihmj@gao.gov or (202) 512-6806. Contact points for the 

individual high-risk areas are listed in the report and on our high-risk 

website. Contact points for our Congressional Relations and Public Affairs 

offices may be found on the last page of this statement. 

Page 50 

Information Security: Agencies Need to Improve Controls over Selected HighGA0-16-501 (Washington, D.C.: May 18, 2016). 

GA0-17-407T 
97 

PREPARED STATEMENT OF 

JOHN H. THOMPSON 

DIRECTOR 

U.S. CENSUS BUREAU 

High-Risk Government Operations Susceptible to Waste, Fraud, and Mismanagement 

Before the Committee on Homeland Security and Governmental Affairs 

U.S. Senate 

15 February 2017 

Good morning Chairman Johnson, Ranking Member McCaskill. and members of the Committee. I 

appreciate the opportunity to update you on the 2020 Census. I am proud to report today that we 

remain on the critical path to readiness for the 2020 Census. With that said, the 2020 Census has been 

added to the most recent Government Accountability Office's High-Risk List. Previously, both the 

2000 Census and the 2010 Census were included on their list. The repeated inclusion is a reflection of 

the complexity, scale, and importance of conducting a fair and accurate count of the Nation each 

decade. This decade the complexity is heightened, as we look to modernize by replacing the paper and 

pencil design of the 2010 Census with innovative technologies that will help us save the taxpayer 

billions of dollars. I am grateful for this opportunity to describe the robust controls we have in place to 

mitigate the risks that are inherent in carrying out this constitutionally-mandated task. 

ln planning and testing the 34 operations and roughly 50 systems that comprise the 2020 Census. we 

arc aware of the many risks the program faces, which is why we work rigorously to manage, monitor, 

and mitigate those risks. Based on GAO's reports and recommendations and our continuing work with 

their team, we are aware of their ongoing concerns to: 

• Define, test, and secure our system of systems ahead of the 2020 Census; 

• Integrate schedule and risk management across the 2020 Census and its supporting programs 

such as the Census Enterprise Data Collection and Processing system, known as CEDCaP; 

1 
98 

• Validate and document our lifccycle cost estimate; and 

• Assess and improve certain field procedures to achieve better field efficiency. 

We concur with each of the GAO's recommendations, and are working to implement their 

suggestions. 

We also have been open and transparent about the challenges we face in successfully conducting this 

redesigned and cost effective decennial census. Accordingly, we: 

• Hold quarterly Program Management Reviews that are open to the public. 

• Have documented our largest decisions in the 2020 Census Decision Memorandum Series. 

Additionally, our 2020 Census Operational Plan lists all decisions that have been made so far, 

along with the time line for making those that remain; it was last updated in October 2016. 

• Have and will continue to share our Integrated Master Schedule with GAO on a monthly 

basis. 

We recognize that we face challenges to get this right, but are confident that with adequate funding we 

can implement, integrate, secure and test our designs on an efficient schedule to successfully execute 

the 2020 Census. The uncertainty of the final fiscal year 2017 budget required us to make difficult 

decisions in January to descope some aspects of the program and pause others to mitigate funding 

uncertainty risk until we know final funding levels. These decisions, announced last month to ensure 

systems readiness, will lead to: a greater percentage of address listing field work in 2019, a delay in 

opening three of our six Regional Census Centers in 2017, the elimination of advertising in the 2018 

End-to-End Census Test, and program and test management operations Jar lower than has been 

recommended by GAO and our Inspector General to successfully manage a program ofthis 

complexity. As we ramp-up to 2020, maintaining adequate funding levels is paramount to achieving 

$5 billion in cost savings without sacrificing data quality or taking on excessive program risk. I stress 

that funding certainty will enable us to conduct the testing, securing, validation, documentation, and 

planning that we have deemed and GAO has urged as necessary for risk mitigation and ultimately 

success for the 2020 Census. 

Over the past five years, we are proud to report we have fundamentally redesigned the decennial 

census. After a four-year period of research and testing early in the decade, we released the 2020 

2 
99 

Census Operational Plan in October 2015 that documents the design for conducting the 2020 Census. 

This design modernizes the way we conduct the decennial census by embracing technology, 

preexisting data, and automated operations. We took up the challenge posed to us by Congress to 

conduct the 2020 Census at a lower cost per household than the 20 I 0 Census, adjusted tor inflation, 

without sacrificing data quality or increasing operational risk. The design we are executing. if we 

receive the necessary funding, will save the taxpayer more than $5 billion relative to repeating the 

paper and pencil design of the 2010. 

As we look to the final years of the decade, monitoring and mitigating risks at the program and project 

level is among the most important things we are doing to ensure we can execute our operational plan 

for the 2020 Census. Another related and equally important component to success has been and will 

continue to be working with our colleagues both at GAO and our Inspector General's office as they 

look at our designs, plans, systems, and operations to identity areas of improvement and implement 

their recommendations. Specifically, we are concentrated on the following risk areas, along with the 

overarching risk of funding uncertainty mentioned above: 

I. Cybersecurity, Fraud Detection, and Ensuring the Public's Trust 

2. Systems Readiness Ahead of the Census 

3. Refining Field Procedures through 2020 Census Testing 

4. Integrated Schedule Management 

5. Lifecycle Cost Estimate Documentation and Validation 

1. Cybersecurity, Fraud Detection, and Ensuring the Public's Trust 

Ensuring the trust of the public in protecting all data at all times is at the bedrock of the Census 

Bureau's mission. We are actively securing our systems and all devices needed for the 2020 Census 

and its field tests, while also ensuring that we prevent fraud, distributed denial-of-service attacks, and 

phishing. This is particularly critical to the decennial census that must count everyone in the country 

once, only once, and in the right place. 

To combat potential cybcrattacks, the Census Bureau uses a layered defense strategy to protect all data 

it collects from respondents as well as administrative records. Implementing robust IT security 

controls will help block attempts from outside infiltration, as well as prevent negative impacts to 

3 
100 

services or data such as network disruption, technical malfunctions, and stolen or corrupted data. 

Information will be encrypted during transmission and at rest. 

The Census Bureau employs sophisticated security protocols, is protected by the Department of 

Homeland Security (D!IS)-managed Einstein program, and adheres to National Institute of Standards 

and Technology (NISD requirements and guidance as required by the Federal Information Security 

Management Act (FISMA). We also are engaging with other Federal agencies, most prominently 

DHS to provide assistance to us in reviewing our design and security architecture for the 2020 

Decennial Census. In addition, we have established NSA and the Department of Commerce Office of 

Security relationships for assistance in threat analysis and related counter-terrorism assistance. We 

have also brought in private-sector expertise to further ensure state-of-the-art defense against cyberattacks. 

2. Systems Readiness Ahead of the 2020 Census 

The Census Bureau learned many lessons in systems development and readiness from efforts leading 

up to the 201 0 Census. Foremost among these wa<; to develop and field test proof of concept systems, 

which we did for the 2020 Census from 2012 through 2015. As a result, we have crafted a design in 

2015, which has been validated by the Census Tests conducted so far. 

In May 2016, after rigorous evaluation and analysis of alternatives, we decided to implement a hybrid 

approach to the question of whether to build or buy CEDCaP software by choosing a commercial otTthe-shelf platform integrated with select Census Bureau custom solutions to optimally address the goal 

of successfully deploying an automated 2020 Census. The resulting buy decision was designed to help 

reduce risk for the 2020 Census and our other surveys and censuses by adopting proven technology 

and standards-based solutions to help deliver secure systems and information. 

Additionally, we have brought in expert help from a large team of private sector IT experts to aid with 

the integration of our full system of systems. Having a fully integrated system of systems ahead of the 

2018 End-to-End Census Test is key to our 2020 Census readiness and risk mitigation. We have built 

and continue to maintain a comprehensive Integrated Master Schedule that allows us to ensure we are 

on track for systems and operational readiness for the 2018 End-to-End Census Test. To support the 

4 
101 

management of all major IT Decennial contract solutions, each contract has a dedicated Government 

Program Management Oftlce and those arc consolidated in a single division of the 2020 Census 

program. We have a robust governance process with three groups that work together to ensure that all 

contracts meet business requirements and that solutions are delivered on time. 

In support of the readiness and security of the 2020 Census system of systems, the Technical 

Integration (TI) contract provides architecture and engineering expertise to define, guide, and execute 

the integration of the 2020 Census technical solution. In doing that work, this team works closely with 

the other significant contracts as follows: the CEDCaP commercial off-the-shelf platfonn ECaSE, 

Census Questionnaire Assistance (CQA), Device as a Service, and the Census Schedule A Human 

Resources Recruiting and Payroll Systems (C-SHARPS). Tl plays a large role supporting the Census 

Bureau's efforts to ensure integration across the program ahead of the 2018 End-to-End Census Test. 

3. Refining Field Procedures through 2020 Census Testing 

Conducting a decennial census is a major undertaking with many moving parts. As we implement the 

operational design for the 2020 Census, we are leveraging new methods, procedures, systems, and 

solutions, which will make it easier for people to respond and save taxpayers more than $5 billion 

relative to the 20 I 0 Census. Census tests are critical to preparing for the 2020 Census. Moreover, to 

help us improve our testing methods and results, we have invited our oversight stakeholders, including 

GAO, to each of our Census field tests to see how the operations and systems are progressing 

throughout the decade, and also to have as many observers in the field to help us learn lessons and 

document improvements to make to our operational design. This is the main reason we test and must 

continue to, as we are rigorously adapting after each test to maximize efficiency and effectiveness in 

our operations. 

2016 Census Test 

In 2016, we conducted the 2016 Census Test in Harris County, Texas, and Los Angeles County, 

California, to study a variety of new methods and advanced technologies. The primary focus of 

this test was to refine the methodology for Nonresponse Followup- the operation we conduct to 

visit nonresponding addresses in person. The Census Bureau also refined methods and related 

activities for maximizing self-response (particularly via the Internet) to the 2020 Census. 

5 
102 

The 2016 Census Test was a valuable learning experience. Among other successes from this test, 

we: 

• Demonstrated that our self-response contact strategy, using paper questionnaires in an 

initial contact for certain parts of the country and letters rather than postcards as a first 

reminder have a positive impact on response rates. 

• Validated the positive trend we have experienced in past census tests regarding collecting 

and processing responses without unique Census IDs, confirming our ability to 

successfully match a large majority of respondent addresses to our frame through realtime matching, administrative records, and clerical matching. 

• Successfully expanded language support services, including Chinese and Korean 

(languages using non-Roman alphabets). 

• Reduced Nonresponse Followup by using administrative records and third-party data for 

both vacant and occupied addresses. 

• Collaborated with the United States Postal Service (USPS) to further our understanding 

of USPS processing of mail pieces, specifically for why mail is unable to be delivered, to 

help inform our assessment of vacancy status to reduce the Nonresponse Followup 

workload. 

• Determined that the implementation of two different staffing ratios that increased the 

number of enumerators to each supervisor over that of the 20 I 0 Census were both viable, 

due to increased automation of operational control capabilities and other field 

efficiencies. 

• Improved quality control by re-contacting a sample ofNonresponse Followup cases to 

validate the data collection in the initial Nonresponse Followup interview. 

We also gained valuable insights into areas where we must make improvements such as: 

• Continued development of closeout processes and procedures .for data collection 

operations. Our test data showed an increased number of nonresponding cases that 

reached the maximum number of contact attempts without a successful enumeration. 

Moving forward, we will closely monitor the progress of the Nonresponse Followup 

workload to ensure a complete and accurate count for all localities. We will monitor 

6 
103 

enumerators' performance and productivity and proactively retain enumerators who are 

successful in reaching respondents and completing household enumerations. We will 

implement procedures such that cases are actively worked until completion. 

• Better training for enumerators. We learned from the 2016 Census Test that certain 

topics require additional emphasis in the training. Balancing training content against the 

critical components of an enumerator's job while also considering cost and schedule 

will be key to our success. 

• Better procedures for enumerators at multiunit structures. In the 2016 Census Test, we 

implemented new procedures for contacting nonresponding addresses at multiunit 

structures such as apartments and condominiums. Because the layout and addressing of 

multiunit structures are not standard, we observed situations where the revised approach 

worked well and others where it did not. We are working to consider enhancements that 

create flexibility for enumerators to assess unique situations. 

• Enhancements to the proxy interview process. During the 2016 Census Test, if a proxy 

respondent, like a neighbor, could not provide the names of a nonresponding household's 

residents, the interview concluded and no information was captured. We need to enhance 

our data collection application to enable the enumerator to capture partial information in 

this situation. 

2016Address Canvassing Test 

In the fall of2016, we conducted the 2016 Address Canvassing Test in Buncombe County, North 

Carolina, and part of the city of St. Louis, Missouri to measure the effectiveness and quality of 

in-office address canvassing and in-field address canvassing. These sites were selected because 

they provide us an opportunity to execute the Address Canvassing operation in both an 

urban/suburban/rural site that is experiencing both population and housing growth, with a mix of 

housing types and address styles and in an urban site that has had sustained population and 

housing loss and recent redevelopment. Combined, the sites had over 220,000 housing units. 

The results of the 2016 Address Canvassing Test and additional research will help is to validate 

our procedures around the in-field address canvassing operation and our assumptions for its 

workload. The results will inform key assumption contributing to the lifecycle cost estimates for 

7 
104 

the 2020 Census. We are processing and analyzing the results of this test, and assessing valuable 

lessons we learned in the field and how they will help us refine the operation. 

2017 Census Test 

In addition to the 2016 Address Canvassing Test, the Census Bureau has been planning for 

additional key test operations in 20 I 7 ahead of the 2018 End-to-End Census Test. This test will 

involve the key systems and operations that must be integrated and deployed in the field in 2017 

to ensure readiness for the 2018 End-to-End Census Test. With operations beginning just next 

month ahead of an April I, 2017 Census day nationwide, we plan to conduct a test of the selfresponse operations and systems with a sample of 80,000 addresses across the country. 

Foremost, this will allow us to test the Internet self-response system, with a Spanish language 

option, and Operational Control Systems integrated with the Census Questionnaire Assistance 

and non-ID processing operations, as well as the ability to provision and run in a Cloud. These 

key systems and operations must be integrated and tested ahead of the 2018 End-to-End Census 

Test. We also will be able lo lest the feasibility of collecting tribal enrollment information. 

2018 End-to-End Census Test 

The 2018 End-to-End Census Test is the final major field test prior to the beginning of the 2020 

Census. It is scheduled for a Census Day of April I, 2018, but field operations will begin in 

August 2017 with the Address Canvassing operation. We will be conducting our 20 I 8 End-toEnd Census Test in at least three areas: Pierce County, Washington; Providence County, Rhode 

Island; and the Bluefield-Beckley-Oak Hill area of West Virginia. Collectively, the test on these 

three sites will cover about 770,000 housing units. The 20 I 8 End-to-End Census Test will allow 

the Census Bureau to prove-in our design and validate that we are ready for the 2020 Census. 

We will test and validate nearly all 2020 Census operations, procedures, systems, and field 

infrastructure together to ensure proper integration and conformance with functional and nonfunctional requirements. We also will produce a prototype of our geographic and data release 

products. Using our experiences in the 2018 End-to-End Census Test and any lessons learned, 

we will finalize plans for all operations and make any necessary adjustments to ensure readiness 

for the 2020 Census. 

8 
105 

4. Integrated Schedule Management 

The integration of schedules across the 2020 Census and all of its supporting programs was a 

major theme of a GAO report released last year. After thorough review of our procedures and 

the interdependencies between the 2020 Census and its supporting programs, I am happy to 

report the Census Bureau maintains full schedule alignment between the 2020 Census Program 

and all of its corporate service providers at the agency, including CEDCaP through a single 

integrated master schedule. The 2020 Census Program Integrated Master Schedule (IMS) drives 

the schedule for all corporate service providers that support the program based on the key 

milestones. The IMS is the single schedule that all projects, including those managed by 

corporate service providers, interact with in order to provide status on their work on a weekly 

basis. Project teams may have their own detailed schedules to support day-to-day tasks in order 

to support the time lines necessary to meet the 2020 Census milestones. Those detailed schedules 

are linked to the IMS though the 2020 key milestone dates, and we continue to share the 

Integrated Master Schedule with GAO on a monthly basis 

5. Lifecycle Cost Estimate Documentation and Validation 

One of the key ways we can measure if we are on track and on schedule to meet our goals for the 

2020 Census is through the 2020 Census lifecycle cost estimate. This is why we have employed 

rigorous cost estimation techniques and validated many of our key assumptions through actual data 

we have gathered through our testing. In their 2016 audit, GAO recognized that the Census Bureau 

has taken significant steps to improve our cost estimation approach. We are committed to continuing 

down the path of following the GAO Cost Estimating and Assessment Guide: Best Practices for 

Developing and Managing Capital Program Costs when producing annual updates to the 2020 cost 

estimate. We agreed with GAO findings that there are still improvements that we can make to our cost 

estimation to improve the process and documentation around the modeling in line with best practices. 

One significant improvement the Census Bureau has made in this area in recent years is to establish 

the independent Office of Cost Estimation, Analysis, and Assessment. This office has now produced 

independent estimates for the 2020 Census and reviewed them with Department of Commerce subject 

matter experts. The independent estimates use different methodologies than the 2020 Census program 

9 
106 

office estimate, but the two are close in total cost. This is a major reason we are confident in our most 

recent estimate oflifecycle costs, and our estimate that we can avoid $5.2 billion in costs compared to 

repeating the 'paper and pencil' design used for the 20 I 0 Census. 

Conclusion 

We are in the midst of implementing an innovative and modem design for the 2020 Census, one that 

will bring the decennial census into the 21 ''century. This design reflects a flexible approach that takes 

advantage of new technologies, methodologies, and data sources while minimizing risk. With the 

funding we have requested, we can still execute most of the design that will save taxpayers billions of 

dollars. !look forward to further discussion of the challenges we face and what we are doing to 

mitigate them, and I look forward to continuing our long and productive relationship with GAO in the 

years ahead. 

10 
107 

STATEMENT OF MICHAEL J. MISSAL 

INSPECTOR GENERAL 

DEPARTMENT OF VETERANS AFFAIRS 

BEFORE THE 

COMMITTEE ON HOMELAND SECURITY AND 

GOVERNMENTAL AFFAIRS 

UNITED STATES SENATE 

HEARING ON 

HIGH RISK: GOVERNMENT OPERATIONS SUSCEPTIBLE 

TO WASTE, FRAUD, AND MISMANAGEMENT 

FEBRUARY 15, 2017 

Mr. Chairman and Members of the Committee, thank you for the opportunity to discuss 

the work of the VA Office of Inspector General (OIG) and how the OIG provides 

effective oversight of VA programs and operations through independent audits, 

inspections, and investigations. The OIG seeks to prevent and detect fraud, waste, and 

abuse, and make meaningful recommendations to drive economy, efficiency, and 

effectiveness throughout VA programs and operations. Our goal is to undertake 

impactful work that will assist VA in providing the appropriate and timely services and 

benefits that veterans so deservedly earned, and ensuring the proper expenditure of 

taxpayer funds. 

I have had the great privilege of serving as the Inspector General since May 2, 2016. 

Since that time, I have fully immersed myself in the work, priorities, and policies of the 

OIG. We have made a number of enhancements since I started, including issuing a 

Mission, Vision, and Values statement; increasing transparency; creating a Rapid 

Response team in our Healthcare Inspections directorate; expanding our data analytics 

capabilities; and being more proactive in our review areas. I believe that these changes 

will enable us to do additional impactful work in a more timely manner. 

The OIG shares an analogous mission with the Government Accountability Office 

(GAO). It is important that the VA OIG has a strong relationship with GAO to ensure 

that we avoid duplication of effort as much as possible. To that end, one of the first 

things I did when I started was to meet with Comptroller General Dodaro and some of 

his senior staff. Our offices have had a number of communications since that time to 

promote coordination and more effective oversight of VA 

In February 2015, GAO added Managing Risks and Improving VA Health Care to its 

biannual High Risk list. It focused its concerns in five broad areas: 

• ambiguous policies and inconsistent processes, 

• inadequate oversight and accountability, 

• information technology challenges, 

• inadequate training for VA staff, and 

• unclear resource needs and allocation priorities. 
108 

While our work is determined by what we believe is the most effective oversight of VA, a 

number of our reports address concerns in these same five areas. As the Committee 

requested, I will highlight a sampling of OIG work in each of the areas that resulted in 

GAO placing VA Health Care on its High Risk list. It should be noted that many of the 

OIG's reports could fit in more than one area. 

Ambiguous Policies and Inconsistent Processes 

We have issued a number of reports in the past few years that include VA's ambiguous 

policies and inconsistent processes. For example, we reported in September 2015 

in Review of A/leged Mismanagement at the Health Eligibility Center that VA's Chief 

Business Office (CBO) had not effectively managed its business processes to ensure 

the consistent creation and maintenance of essential health care eligibility data. Due to 

the amount and age of the Enrollment System (ES) data, as well as lead times required 

to develop and implement software solutions, a multiyear project management plan was 

needed to address the accuracy of pending ES records and improve the usefulness of 

ES data. We made 13 recommendations in the report including one focused on 

controls to ensure that future enrollment data are accurate and reliable before being 

entered into the Enrollment System. VA concurred with the recommendations and 

provided sufficient information to close all recommendations in October 2016. We have 

an ongoing review of the Health Eligibility Center focusing on the alleged lack of 

effective governance over the Veterans Health Administration's (VHA) execution of the 

health care enrollment program at its medical facilities. We expect to issue our report in 

late spring 2017. 

In another example, of a one program that operates nationwide with issues related to 

inconsistent implementation of policies is the Homeless Grant Per Diem Program. In a 

June 2015 report, Audit of Homeless Providers Grant and Per Diem Case Management 

Oversight, we determined VA needed to clarify eligibility requirements across the 

program to ensure that all homeless veterans have equal access to case management 

services. Historically, homeless veterans ineligible for VA health care have not been 

excluded from the program. However, as we conducted our work and questioned the 

application of the program's eligibility criteria, we found the criteria were unclear and 

inconsistently applied. This was confirmed in our interviews of the VA's Office of 

General Counsel, program directors, network homeless coordinators, and liaisons, 

which revealed confusion occurred at all program levels. We made five 

recommendations, three of which involved establishing a definitive legal standard on 

program eligibility and ensuring that policies and controls matched that standard and 

were applied across the program. The recommendations dealing with policies and 

controls remain open. 

Inadequate Oversight and Accountability 

Proper oversight by management would ensure that programs and operations would 

work effectively and efficiently. Our September 2016 report, Review of the 

Replacement of the Denver Medical Center, Eastern Colorado Health Care System, on 

the management of the construction of a new VA medical center in the Denver area, is 

2 
109 

an extremely costly example of the result of inadequate oversight. We confirmed the 

project to build a new medical center in the Denver area has experienced significant 

and unnecessary cost overruns and schedule slippages. Originally estimated for 2013 

completion, it will not be ready before mid-to-late 2018, about 20 years after its need 

was identified in the late 1990s. Through all phases of the project, we identified various 

factors that significantly contributed to delays and rising costs, including: 

• Inadequate planning and design, 

• Construction phase was initiated without adequate design plans, 

• A change in acquisition strategy contributed to delays and increasing 

costs 

• Change request processing was untimely. 

This occurred due to a series of questionable business decisions and mismanagement 

by VA senior officials. The report summarizes the significant management decisions 

and factors that resulted in a project years behind schedule and costing more than twice 

the initial budget of $800 million. We made five recommendations and VA management 

concurred with all recommendations. We recently requested information from VA on 

the implementation status of the recommendations and will keep them open until VA 

provides satisfactory evidence of implementation. 

In June 2016, we issued a report on allegations related to appointment cancellations at 

the Houston VA Medical Center, Review of Alleged Manipulation of Appointment 

Cancellations at VA Medical Center, Houston, Texas. We substantiated that two 

previous scheduling supervisors and a current director of two outpatient clinics 

instructed staff to input clinic cancellations incorrectly as canceled by the patient. We 

also confirmed that a current director of two CBOCs instructed staff, as recently as 

February 2016, to record an appointment as canceled by the patient if clinic staff at one 

CBOC offered to reschedule a veteran's appointment at a different CBOC situated 

about 17 miles away and the veteran declined the appointment. The CBOC Director 

believed this was appropriate since the CBOC was still offering the patient an 

appointment. When interviewed regarding these cancellations, the CBOC Director 

acknowledged she instructed staff to cancel appointments by the patient if the veteran 

declined an appointment in the alternate location. We made six recommendations, 

including referring the matter to VA's Office of Accountability Review (OAR) to 

determine what, if any, administrative actions should be taken based on the factual 

circumstances developed in our report. 

In December 2014, we released an audit related to the VA National Call Center for 

homeless veterans, Audit of The National Call Center for Homeless Veterans. We 

reported that homeless and at-risk veterans who contacted the Call Center often 

experienced problems accessing a counselor and/or receiving a referral after 

completing the Call Center's intake process. Referred veterans did not always receive 

the services needed because the Call Center did not follow-up on referrals to medical 

centers. These missed opportunities occurred due to lapses in the Call Center's 

management and oversight. We made seven recommendations, including 

3 
110 

implementing effective performance metrics to ensure homeless veterans receive 

needed services. We closed our report in September 2015 based on information 

received that all recommendations had been implemented. 

Information Technology Challenges 

As we have reported in our list ofVA's Major Management Challenges within VA's 

Annual Financial Report we have frequently identified VA's struggles to design, procure, 

and/or implement functional information technology (IT) systems. IT security is 

continually reported as a material weakness in the Consolidated Financial Statement 

audits that are conducted annually by the OIG's independent auditing firm, 

CliftonlarsonAIIen (CLA). 

VA has a high number of legacy systems needing replacement: the Financial 

Management System; Integrated Funds Distribution, Control Point Activity, Accounting 

and Procurement system; Veterans Health Information Systems and Technology 

Architecture, Benefits Delivery Network; and the electronic Contract Managing System. 

After years of effort focused on replacement of VA's legacy scheduling software, a new 

scheduling system is not in place. VA's issues with scheduling appointments are 

related to the inability to define its requirements and determine if a commercial solution 

is available or if it must design a system. Replacing systems has been a major 

challenge across the government and is not unique to VA We have issued a number of 

reports outlining access issues and our work in this area is continuing. 

While the difficulties between VA's electronic health record (EHR) and the Department 

of Defense's EHR are well documented, the increased utilization of care in the 

community will present further IT challenges. To ensure that medical providers both 

inside and outside VA have the most complete and up-to-date information, VA needs to 

find a more effective method for sharing patients' EHRs. We reported on the possibility 

of delays in care because of the difficulties in sharing medical records in the Urology 

Clinic at the Phoenix VA Health Care System in our October 2015 report, Healthcare 

Inspection, Access to Urology Service, Phoenix VA Health Care System, Phoenix, 

Arizona. Specifically, we identified approved authorizations for non-VA care 

coordination (NVCC) urological care and a notation that an authorization was sent to the 

non-VA provider. A scheduled date and time of an appointment with the non-VA 

urologist was often documented. However, we were unable to locate scanned 

documents from non-VA providers in these patients' EHRs verifying that the patients 

had been seen for evaluations, and if seen, what the evaluations might have revealed. 

This finding suggested that the Phoenix VA Health Care System (PVAHCS) did not 

have accurate data on the clinical status of the patients who were referred for the 

specialty care. 

Further, with respect to scanning and reviewing outside clinical documents (for 

example, clinic notes, labs, or imaging results), when the services were provided by 

TriWest Health Care Alliance (TriWest), the treating providers' office submitted this data 

to the TriWest Portal. To access that information, an NVCC staff member was required 

to log into the TriWest Portal to print and scan these records into the patients EHRs. 

4 
111 

This process was delayed because of the NVCC staffing shortages, which could have 

resulted in important clinical information not being reviewed for several months. We 

made three recommendations, including one specifically related to ensuring that non-VA 

care providers' clinical documentation is available in the EHRs in a timely manner for 

PVAHCS providers to review. We closed our report in June 2016 after VA provided 

information that addressed the recommendations. 

In the area of IT security, VA uses personally identifiable information (PII), protected 

health information (PHI), and other sensitive information to deliver benefits to veterans 

and their dependents. Employees and contractors must safeguard this information. As 

we reported in our September 2015 report, Review of Alleged Data Sharing Violations 

at VA's Palo Alto Health Care System, the VA Palo Alto Health Care System 

(VAPAHCS) did not ensure that contract staff had the appropriate background 

investigations or proper security and privacy awareness training before being granted 

access to VA patient information. Additionally, facility Information Security Officers were 

not involved prior to the contractor placing its software on a VA server. We made three 

recommendations to VAPAHCS management and a fourth recommendation that VA's 

Office of Information Technology implement controls to ensure that unauthorized 

software is not procured or installed on VA networks without a formal risk assessment 

and approval to operate. We closed our report based on information provided that the 

recommendations were implemented. 

Inadequate Training for VA Staff 

One prevailing theme of the OIG's work related to wait times and scheduling issues was 

the inadequate, lack of, or incorrect training provided to VA staff responsible for 

scheduling appointments. We conducted extensive work related to allegations of wait 

time manipulation through fiscal years (FY) 2015 and 2016 after the allegations at the 

PVAHCS surfaced in April 2014. As we have reported in more than 90 Administrative 

Summaries of Investigation and other reports that have been issued, the lack of training 

for schedulers and the lack of understanding of the process by their managers created a 

system in which long wait times were not accurately portrayed to management. 

In October 2016, we reported again that there was still confusion regarding 

appointments. The focus for this report was on consult management. In our 

report, Review of Alleged Consult Mismanagement at the Phoenix VA Health Care 

System, we substantiated that in 2015, PVAHCS staff inappropriately discontinued 

consults. We determined that staff inappropriately discontinued 24 percent of specialty 

care consults we reviewed. This occurred because staff were generally unclear about 

specific consult management procedures, and services varied in their procedures and 

consult management responsibilities. As a result, patients did not receive the requested 

care or they encountered delays in care. This report has 14 recommendations including 

ensuring that staff is hired and trained appropriately. We are tracking VA's progress on 

implementing all the recommendations. 

In January 2016, we determined that VHA did not provide medical facilities with 

adequate tools to reasonably estimate non-VA care (NVC) obligations in our 

report, Audit of Non-VA Medical Care Obligations. The facilities we visited used a 

5 
112 

combination of methods that were ineffective at ensuring NVC cost estimates were 

reasonable. The methods used to calculate estimated costs included Medicare or 

contract rates, historical costs, and the optional cost estimation tools provided by CBO. 

The accuracy of estimates varied widely among these methodologies. We made five 

recommendations including for VA to improve the cost estimate tools so that NVC cost 

estimates are produced consistently, The recommendations related to cost estimate 

tools remain open. 

Unclear Resource Needs and Allocations Priorities 

The OIG has repeatedly reported on VA's legacy systems and how they impair VA 

operations. A key element to accurate planning is a financial system that provides 

timely information to VA leadership. As was reported in Audit of VA 's Financial 

Statements for Fiscal Years 2016 and 2015, VA's complex, disjointed, and legacy 

financial management system architecture has continued to deteriorate over time and 

no longer meets the increasingly stringent and demanding financial management and 

reporting requirements mandated by the Department of the Treasury and the Office of 

Management Budget VA continues to be challenged in its efforts to apply consistent 

and proactive enforcement of established policies and procedures throughout its 

geographically dispersed portfolio of legacy applications and systems. VA announced 

in October 2016 that it had selected the Department of Agriculture as its Federal shared 

service provider to deliver a modern financial management solution to replace its 

existing core financial management system. When completed, this will be a major and 

critical event for VA in modernizing its system architecture for financial management 

The audit ofVA's FY 2016 Financial Statements also identified Community Care 

obligations, reconciliations, and accrued expenses as a material weakness. Lack of 

tools to estimate non-VA Care costs, lack of controls to ensure timely deobligations, and 

the difficulty in reconciling non-VA Care authorizations to obligations in VA's Financial 

Management System, make the accurate and timely management of purchased care 

funds challenging, In addition, the Office of Community Care (OCC) did not have 

adequate policies and procedures for its own monitoring activities. OCC's activities also 

were not integrated with VA and VHA Chief Financial Officer (CFO) responsibilities 

under Public Law (PL) 101-576, the Chief Financial Officers Act of 1990, to develop 

and maintain integrated accounting and financial management systems and provide 

policy guidance and oversight of all Community Care financial management personnel, 

activities, and operations. 

To address the difficulties in estimating costs, VA has requested legislation that would 

allow VA to record an obligation at the time of payment rather than when care is 

authorized. In its consolidation plan, VA said this would likely reduce the potential for 

large deobligation amounts after the funds have expired. We recognize that the current 

process and system infrastructure are complex and do not provide for effective funds 

management We caution that such a change alone-Le., obligating funds at the time 

of payment-would not necessarily remove all of VA's challenges in this area. VA 

would still need adequate controls to monitor accounting, reconciliation, and 

6 
113 

management information processes to ensure they effectively manage funds 

appropriated by Congress. 

VA needs to accurately forecast the demand for health care services in both the near 

term and the long term. The OIG is required by Section 301 of P.L. 113-146, the 

Veterans Access, Choice, and Accountability Act of 2014 to review VHA occupations 

with the largest staffing shortages. We have issued three reports at this time and under 

the statute we will report for another two years. In our most recent report issued in 

September 2016, 1 we identified (i) medical officer; (ii) nurse; (iii) psychologist; (iv) 

physician assistant; and (v) physical therapist/medical therapist as the five critical 

occupations with the largest staffing shortages. In our initial review2 and our 

subsequent reviews3, we continue to recommend VHA create a staffing model that 

considers demand and complexity, and matches that to budget requests and 

allocations. While VHA has continually concurred with the recommendation, their 

planned completion date is September 2017. A further delay will result in missed 

opportunities to request appropriate funding when planning for the FY 2019 budget. 

CONCLUSION 

The OIG is committed to providing effective oversight of the programs and operations of 

VA. A number of our reports address the five broad areas noted by GAO in placing VA 

Health Care on its High Risk list. We will continue to produce reports that provide VA, 

Congress, and the public with recommendations that we believe will help VA operate its 

programs and services in a manner that will effectively and timely deliver services and 

benefits to veterans and spend taxpayer money appropriately. 

Mr. Chairman, this concludes my statement and I would be happy to answer any 

questions that you or other Members of the Committee may have. 

1 OIG Determination of VHA Occupational Staffing Shortages, September 28, 2016. 2 OIG Determination of Veterans Health Administration's Occupational Staffing Shortages, January 30, 

2015. 

3 0/G Determination of Veterans Health Administration's Occupational Staffing Shortages September 1, 

2015. 

7 
114 

' ',"' 

.~es•t::nno~ny of Inspector Gen~~al 

John Roth 

Before the Committee on 

)lomeland and 

Governmental Affairs 

"High Government 

Operations Susceptible to 

Waste, Fraud, 

Mismanagement'' 

February 15, 2017 

PM 
115 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Chairman Johnson, Ranking Member McCaskill, and Members of the 

Committee, thank you for inviting me here today to discuss our 

recommendations to improve the performance of the Department of Homeland 

Security (DHS). 

Since its establishment, DHS has progressed in addressing challenges to 

accomplish its mission. However, to fulfill its vital mission of protecting and 

securing our Nation successfully, the Department must continue to overcome 

challenges that hinder its efforts. The recommendations discussed below 

demonstrate our efforts to assist the Department and its components in 

overcoming the persistent challenges. By addressing these recommendations, 

DHS can continue to improve effectiveness and efficiency of its operations and 

reduce waste, fraud, and abuse. 

Major Management and Performance Challenges 

Homeland Security faces long-standing challenges, and we at the Office of 

Inspector General (OIG) have focused our energy on the major management 

and performance challenges. We have listed six: 

• Creating a unified Department; 

Employee morale and engagement; 

• Acquisition management; 

Grants management; 

Cybersecurity; and 

Improving management fundamentals.! 

Today, I will focus on the challenges the Department faces in creating a unified 

Department; acquisition management, with a focus on border and immigration 

security; and grants management. 

Addressing New Priorities 

With a new Administration, the Department will face new responsibilities. We 

understand the significant investment the Department will be making to satisfy 

its obligations under the President's Executive Order, Border Security and 

Immigration Enforcement Improvements, and the importance of spending that 

1 Maior Management and Performance Challenges Facing the Department o(Ffomeland Secun'ty. 

O!G-17-08 (November 2016). 

www.oig.dhs.gov 
116 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

investment efficiently and effectively. The Department has historically 

performed very poorly in this area. As many recall, prior efforts to fortify the 

southwest border, known as SB!net, were cancelled in 2011 as being too 

expensive and ineffective. In a pilot program in Arizona, DHS spent about $1 

billion to build the system across 53 miles of the state's border before 

abandoning the initiative.2 

Given the risks involved, we will be using a lifecycle approach to audit and 

monitor the Department's actions to strengthen the physical security of the 

Nation's southern border. A lifecycle audit approach means that we will be 

auditing the project throughout its life span, rather than waiting for the project 

to be completed or partially completed before looking at it. In this way, we have 

an opportunity to stop waste and mismanagement before the money is spent, 

rather than simply identifying it after the fact. 

Our first report will address lessons learned from the Department's prior 

Secure Border Initiative and other relevant acquisitions related to securing our 

borders. We hope to have this report out in the next six weeks. Subsequently, 

we plan to review U.S. Customs and Border Protection's (CBP) comprehensive 

study of the security of the southern border that the Executive Order requires 

be completed within 180 days of the date of the Executive Order. Future audits 

will address the planning, designing, acquisitions, and construction phases of 

the southern border barrier. 

Similarly, the Department will face a number of challenges in executing the 

President's Executive Orders directing the Department to hire an additional 

5,000 Border Patrol Agents and 10,000 Immigration Officers. We recently 

completed an audit that highlighted numerous bottlenecks in effective hiring. 

We found that historically DHS components had insufficient staffing in the 

human resource area and had inadequate systems to track and process 

applicants. In fiscal year (FY) 2015, it took an average of 282 days (over 9 

months) to hire a Border Patrol Agent, measured from the time the job 

announcement closed to the date the applicant was hired. Other positions 

likewise encountered significant delays. 3 

As with the acquisition area, I have initiated the first in a series of audits to 

further review the Department's human capital strategies and management 

2 Sec, e.g., Risk Management Advisory for the SBlnet Program Initiation. OIG 07-07 (November 

2006): Controls Over SBinet Program Cost and Schedule Could Be Improved. 010-10-96 pune 

2010): U.S. Customs and Border Protection's Management of the Purchase and Storage of Steel in 

Support of the Secure Border Initiative, OJG-12-05 (November 2011): 

3 DHS Is Slow to Hire Law Enforcement Personnel, OJG-17-05 (October 2016). 

www.oig.dhs.gov 2 
117 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

capabilities to ensure the Department can quickly and effectively hire a highly 

qualified and diverse workforce. Our first engagement will compile and review 

open source literature, other government reports, and prior work of our office 

to help the Department and its components avoid previously identified poor 

management practices and their negative impacts. Subsequent audits will 

address the collateral impact hiring 15,000 agents and officers will have not 

only on other Departmental components, but also on other Federal agencies. 

Likewise, as we announced in the beginning of this month, we have begun a 

review of DHS' implementation of the recent Executive Order, Protecting the 

Nation from Foreign Terrorist Entry into the United States. The review is being 

initiated in response to congressional requests and whistleblower and hotline 

complaints. In addition to reviewing the implementation of the Executive Order, 

we will review DHS' adherence to court orders and allegations of individual 

misconduct on the part of DHS personnel. If circumstances warrant, we will 

consider including other issues that may arise during the course of the review. 

At the culmination of this review, we will provide a final report to Secretary 

Kelly, the Congress, and the public. We appreciate the cooperation we have 

received from the Department's components as we conduct this review. 

Creating a Unified Department 

DHS' primary challenge moving forward is transitioning from an organization of 

22 semi-independent components, each conducting its affairs without regard 

to, and often without knowledge of, other DHS components' programs and 

operations, to a more cohesive entity focused on the central mission of 

protecting the homeland. A lack of coordination and unity occurs in all aspects 

of DHS' programs-planning, programing, budgeting, and execution-and leads 

to waste and inefficiency. 

Our previous audit and inspection reports are replete with examples of the 

consequences of failing to act as a single entity: 

Our 2013 audit of DHS' H-60 helicopter programs showed that 

components did not cooperate with another to realize potential cost 

savings and other efficiencies. Specifically, CBP was unwilling to 

coordinate with the Coast Guard to upgrade its H-60 helicopters, even 

though both components were converting the same helicopters. We 

estimated potential savings of about $126 million if the two components 

had successfully coordinated the conversion of CBP's H-60 helicopters 

at the Coast Guard's Aviation Logistics Center. A subsequent H-60 

Business Case Analysis by DHS' Office of Chief Readiness Support 

www.oig.dhs.gov 3 
118 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Officer, the Aviation Governing Board, the Coast Guard, and CBP 

confirmed the cost savings of having the Coast Guard convert the 

helicopters, but it was too late. 4 

DHS employs approximately 80,000 Federal law enforcement officers 

whose positions allow for the use of force as they perform their duties; 

however, DHS does not have an office responsible for managing and 

overseeing component use-of-force activities. We discovered that each 

component varies on its use-of-force activities and DHS has no 

centralized oversight of use-of-force allegations, trends, training, 

facilities, and resource challenges faced by field personnel. We recently 

recommended that DHS establish a department-level entity to actively 

oversee and assist with component use-of-force activities, update 

policies, and improve training. s 

Since its formation, DHS has faced challenges in integrating various 

component training facilities and programs, and does not have adequate 

oversight of its workforce training. Multiple prior audits have shown 

DHS does not have reliable training cost data and information to make 

informed management decisions. During our 2016 audit, we attempted 

to determine total DHS training costs for FYs 2014 and 2015. When we 

requested DHS training costs from the DHS Office of the Chief Financial 

Officer (OCFO), it could not readily provide the data. The OCFO did not 

have access to components' financial systems; rather, it relied on data 

calls to provide the training costs and could not validate the data. As a 

result, we found significant discrepancies between the total amounts 

reported by DHS. Although DHS has taken steps to improve the 

reliability of its training data, further action is needed-thus, we 

recommended that the Under Secretary for Management develop and 

implement a process to accurately capture and report training 

information across DHS.6 

In January 2016, we issued a report on human trafficking and the visa 

process. Our audit objectives were to determine how individuals charged 

with or convicted of human trafficking used legal means to bring victims 

to the United States, and to identify data quality and exchange issues 

that may hinder efforts to combat human trafficking. In this audit, we 

compared databases belonging to U.S. Immigration and Customs 

Enforcement (ICE) and to U.S. Citizenship and immigration Services 

4 DHS' H-60 Helicopter Programs /Revised}, OIG-13-89 (May 2013). 5 DHS Lacks Oversight of Component use of Force, O!G-17 -22 panuarv 2017). 6 DHS' Oversight oUts Workforce Training Needs Improvement, OIG-16-19 iJanuarv 2016). 

www.oig.dhs.gov 4 
119 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

(USCIS) and found that ICE and USCIS could improve data quality to 

facilitate data matching and identification of possible instances of 

human trafficking. For example, when ICE employees identified a 

human trafficker, they did not always advise USCIS regarding the 

victims they identified. In turn, in selected instances where USCIS 

obtained traffickers' names from victims, USC IS did not have a process 

to routinely share this information with ICE. Without concerted DHS 

efforts to collect and share information, the risk exists that some human 

traffickers may remain unidentified and free to abuse other individuals.7 

DHS has taken steps to develop a Departmental Pandemic Workforce 

Protection Plan (PWPP) intended to protect the workforce during a 

pandemic event. However, DHS cannot be assured that its preparedness 

plans can be executed effectively during a pandemic event. For example, 

DHS has not developed clear requirements for pandemic readiness 

training, even though the DHS PWPP requires components to train and 

exercise staff and senior leadership on pandemic readiness at least 

annually. The Department did not provide details on applicable trainings 

or the frequency needed to meet this requirement. As a result, seven of 

the components reviewed did not always include the necessary details in 

their plans on how pandemic training requirements would be met. s 

Despite these examples, progress has been made both in tone and substance. 

In the last 3 years, DHS leadership has taken steps to forge multiple 

components into a single organization. New policies and directives have been 

created to ensure cohesive budget planning and execution, including ensuring 

a joint requirements process. The Department also has a process to identify 

and analyze its mission responsibilities and capabilities, with an eye toward 

understanding how components fit together and how each adds value to the 

enterprise. A new method for coordinating operations, the Southern Border and 

Approaches Campaign, was created to try to reduce the silos and redundancy. 

However, in our report issued last November, describing the Department's 

major management challenges, we found that this progress has been a result of 

the force of will of a small team within the Department's leadership, and may 

not be sustainable. We warned that absent structural changes within the 

Department to ensure streamlined oversight, communication, responsibility, 

7 ICE and USCIS Could Improve Data Quality and Exchange to Help Identify Potential Human 

Trafficking Cases, OIG-16-17 (January 2016). 

' DHS Pandemic Planning Needs Better Oversight, Training, and Execution, OIG-17 -02 (October 

2016). 

www.oig.dhs.gov 5 
120 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

and accountability-changes that we believe must be enshrined in law-this 

progress could be undone. 

Fortunately, I am gratified to report that the National Defense Authorization 

Act for Fiscal Year 2017 establishes within the Department the Office of 

Strategy, Policy, and Plans.9 This Office, headed by a Presidentially-appointed, 

Senate confirmed Under Secretary, will lead, conduct, and coordinate the 

development of the Department's priority policies and will work with each 

component of the Department in establishing or modifying policies. We believe 

that the creation of this new office is an important first step toward the 

structural changes that are needed to create a unified Department. 

Acquisition Management 

Acquisition management, which is critical to fulfilling all DHS missions, is 

inherently complex, high risk, and challenging. Since its inception in 2003, 

the Department has spent tens of billions of dollars annually on a broad 

range of assets and services-from ships, aircraft, surveillance towers, and 

nuclear detection equipment to IT systems for financial management and 

human resources. DHS' yearly spending on contractual services and 

supplies, along with acquisition of assets, exceeds $25 billion. There continue 

to be DHS major acquisition programs that cost more than expected, take 

longer to deploy than planned, or deliver less capability than promised. 

The Department was established very quickly by combining many legacy and 

new agencies, so DHS' earliest acquisition processes were imperfect and slow 

to mature. Initially, DHS operated in disparate silos focused on purchasing 

goods and services with minimal management of requirements. In their 

transition to DHS, seven agencies, including the Coast Guard, FEMA, and 

TSA retained their own procurement functions. The expertise and capability 

of the seven procurement offices mirrored their pre-DHS expertise and 

capability, with staff sizes ranging from 21 to 346. 

Although DHS has made much progress since then, it has not yet coalesced 

into one entity working toward a common goal. The Department still lacks 

uniform acquisition policies and procedures, a dedicated core of acquisition 

professionals, as well as component commitment to adhere to departmental 

acquisition guidance, adequately define requirements, develop performance 

measures, and dedicate sufficient resources to contract oversight. 

9 National Defense Authorization Act, Pub L No. 114-328, §1902 (2017). 

www.oig.dhs.gov 6 
121 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Current Challenges 

A good example of the challenges faced can be seen in USCIS' efforts to 

automate the processing of immigration benefits. users still uses a paper file 

system to process immigration benefits and spends $300 million per year just 

to store and transport its 20 million immigrant paper files. users has been 

attempting to automate this process since 2005, but despite spending more 

than $500 million on the technology program between FYs 2008 and 2012, 

little progress has been made. Past automation attempts have been hampered 

by ineffective planning, multiple changes in direction, and inconsistent 

stakeholder involvement. USCIS deployed the Electronic Immigration System 

(ELlS) in May 2012, but to date, customers can apply online for only 2 of about 

90 types of immigration benefits and services. users now estimates that it will 

take 3 more years-more than 4 years longer than estimated-and an 

additional $1 billion to automate all benefit types as expected.lO 

These failures have a real impact on our national security. Because of 

processing errors resulting from premature release of ELlS software, USC IS 

received over 200,000 reports from approved applicants about missing green 

cards. The number of cards sent to wrong addresses has incrementally 

increased since 2013 due in part to complex processes for updating addresses, 

ELlS limitations, and factors beyond the agency's control. USCIS produced at 

least 19,000 cards that included incorrect information or were issued in 

duplicate. Most card issuance errors were due to design and functionality 

problems in ELlS. USCIS' efforts to address the errors have been inadequate. 

Although USCIS conducted a number of efforts to recover the inappropriately 

issued cards, these efforts also were not fully successful and lacked 

consistency and a sense of urgency. Errors can result in approved applicants 

unable to obtain benefits, maintain employment, or prove lawful immigration 

status. In the wrong hands, Green Cards may enable terrorists, criminals, and 

illegal aliens to remain in the United States and access immigrant benefits. II 

Finally, we issued a management alert as it related to the USCIS rollout of the 

N-400 form on ELlS in April of last year. The use of ELlS has impaired the 

ability of USCIS Immigration Services Officers and field personnel to conduct 

naturalization processing. In the course of our audit work, we discovered 

significant deficiencies in background and security checks for applicants, 

including 175 applicants who were granted citizenship with incomplete or 

inaccurate background checks. We are pleased to report that USCIS has agreed 

IO USCIS Automation o[Immiqration Benefits Processing Remains Ineffective. O!G-16A8 (March 

2016). 

11 Better Safeguards are Needed in USC IS Green Card Issuance, OIG-17 -11 (November 20 16) 

www.oig.dhs.gov 7 
122 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

to delay the return to ELlS processing until all of the technical issues have 

been resolved. 12 

DHS has instituted major reforms to the acquisition process and has exerted 

significant leadership to gain control of an unruly and wasteful process. 

However, we worry that these reforms, if not continuously supported and 

enforced, could be undone. As DHS continues to build its acquisition 

management capabilities, it will need stronger departmental oversight and 

authority, increased commitment by the Department and components, as well 

as skilled personnel to effect real and lasting change. 

Acquisition Legislation 

Congress has previously introduced legislation designed to address DHS' 

acquisition challenges. We would support legislation that codifies existing 

policy and relevant offices; provides the necessary authority for key personnel 

and mechanisms within the Department to effectively manage major 

acquisition programs; reinforces the importance of key acquisition 

management practices, such as establishing cost, schedule, and capability 

parameters; and includes requirements to better identify and address poorly 

performing acquisition programs. 

Grants Management 

FEMA manages the Federal response to, and recovery from, major domestic 

disasters and emergencies of all types. In doing so, FEMA coordinates 

programs to improve the effectiveness of the whole community and leverages its 

resources to prevent, protect against, mitigate, respond to, and recover from 

major disasters, terrorist attacks, and other emergencies. In this role, FEMA 

awards an average of about $10 billion each year in disaster assistance grants 

and preparedness grants. 

Based on the work and findings of OIG Emergency Management Oversight 

teams deployed to disaster sites in nearly a dozen states, we determined that 

FEMA generally responds effectively to disasters. For the disaster sites we 

visited, FEMA responded proactively and overcame a variety of challenges while 

coordinating activities with other Federal agencies and state and local 

12 Management Alerl.- U.S. Citizenship and Immigration Services' Use of the Electronic 

Immigration System for Naturalization Benefits Processing, OIG-17 -26-MA (January 20 17) 

www.oig.dhs.gov 8 
123 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

governments. FEMA remains a victim-centric organization, committed to its 

disaster response mission notwithstanding an increased operational tempo. 13 

However, FEMA's other mission-administering recovery grants, often years 

after the disaster-remains significantly troubled. Although FEMA provides 

grant management funding to grantees, FEMA has not held them accountable 

for managing subgrantees, and grantees generally have not done well in 

guiding and managing subgrantees. This means the entire layer of oversight 

intended to monitor the billions of dollars awarded by FEMA in disaster 

assistance grants is ineffective, inefficient, and vulnerable to fraud, waste, and 

abuse. Of the $1.55 billion in disaster grant funds we audited last year, we 

found $457 million in questioned costs, such as duplicate payments, 

unsupported costs, improper procurement practices, and unauthorized 

expenditures. Extrapolated across the entire grant program, this equates to $3 

billion in questioned costs. A 29 percent questioned-cost rate far exceeds 

industry norms, and illustrates FEMA's continued failure to adequately 

manage grants.l4 

We also saw examples of inadequate grant management in preparedness 

grants. In an overarching audit of OIG recommendations related to 

preparedness grants, we reported that FEMA had not adequately analyzed 

recurring recommendations to implement changes to improve its oversight of 

these grants. This occurred because FEMA did not clearly communicate 

internal roles and responsibilities and did not have policies and procedures to 

conduct substantive trend analyses of audit recommendations. IS 

Part of the problem is that FEMA has not sufficiently held grant recipients 

financially accountable for improperly spending disaster relief funds. As of 

September 27, 2016, FEMA has not taken sufficient action on 24 

recommendations containing 90 percent ($413 million) of the $457 million we 

recommended FEMA disallow as improperly spent or not sufficiently 

supported. Further, in FYs 2009 through 2014, FEMA allowed grant recipients 

to keep 91 percent of the contract costs we recommended for disallowance for 

noncompliance with Federal procurement regulations. Because FEMA 

regularly waives these questioned costs, the subgrantees have no motivation 

13 See, e.g., FEMA's Initial Response to Severe Stomts and Flooding in West Virainia. OIG-17-37-

!2 (February 2017); }>'EMA Was Generally Effective in Its Initial Response to the Sever Wildfires in 

California, OIG-16-106-D (June 2016); FEMA's Initial Response to the 2015 Texas Spring Severe 

Stmms and f>1ooding, OIG-16-85-D (May 2016). 14 Summarn and Key Findings of Fiscal Year 2015 FEMA Disaster Grant and Program Audits. 

OIG-17-13-D (November 2016). 

15 Analysis of Recurring Audit Recommendations Could Improve FEMA's Oversight o(HSGP, OIG16-49 (March 2016). 

www.oig.dhs.gov 9 
124 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

to comply with basic contracting and acquisition principles, and the problem 

will continue to fester. 16 

We believe the answer to the problem is three fold. First, there must be a 

significant leadership and management commitment to address these 

findings. We have not found that to be the case thus far. In addition to the 

significant waiver percentage, the open recommendations, and the multiple 

repeat recommendations, FEMA's own strategic plan shows a lack of 

attention to the matter. FEMA has five strategic priorities, 16 objectives 

outcomes, none of which addresses grants management. There has been 

little public acknowledgement of the need for improvement, and as far as 

we can tell, little high-level attention to the problem. 

Second, as noted, FEMA has the ability to hold the grantees, which generally 

are each state, more accountable, but does not do so. We have issued report 

after report documenting the failures of the grantees to do the basic grant 

management duties for which FEMA pays them. For example, we found that 

Mississippi did not provide proper oversight of a $29.9 million grant provided to 

retrofit homes for potential storm damage. As a result, FEMA has no assurance 

that Mississippi properly accounted for and expended Federal funds. Among 

other basic failures, Mississippi failed to ensure separation of duties-a basic 

tenet of internal control-and did not provide documentation for over $30 

million it claimed it paid to contractors. I? We have made similar findings on 

other State grantees who have failed to provide basic oversight and guidance to 

subgrantees during the execution of the grant prograrn.Is 

16 FEMA Can Do More to Improve Public Assistance Grantees' and Subarantees' Compliance with 

Federal Procurement Rules OIG-16-126-D (September 2016). 

17 FEMA Should Suspend All Grant Pauments on the $29.9 Million Coastal Retrofit Program Until 

Mississippi Can Properly Account [or Federal Funds. OIG-16-115-D (August 2016). 

IS See, e.g., FEMA Should Disallow $1.2 Million of$6.0 Million in Public Assistance Program 

Grant Funds Awarded to the City of San Diego. California, OIG-16-23-D, (January 2016); PEMA 

Should Recover $1.2 Million o($10.1 Million in Grant Funds Awarded to Tuscaloosa Alabama, 

[or a 2011 Disaster, OIG-16-24-D (January 2016); FEMA Should Recover $505,549 o[$3.3 

Million in Public Assistance Grant Funds Awarded to DeKalb COunty Georgia, for Damages [rom 

a September 2009 Flood OIG-16-09-D (November 20 15); FEMA Should Recover $4.2 Million 

o[$142.1 Million in Grant Funds Awarded to the City o[Gul[vort, Mississippi, [or Hurricane 

Katrina Damages. OIG-15-148-D (September 2015); FEMA Should Recover $32.4 Million in 

Grant Funds Awarded to Riverside General Hospital, Houston. Texas, OIG-15-149-D (September 

2015); FEMA Should Recover $1.78 Million of Public Assistance Grant Funds Awarded to the City 

o[Duluth, Minnesota, O!G-15-132-D (August 2015); FEMA Should Disallow $82.4 Million of 

Improper Contracting Costs Awarded to Holy Cross School, New Orleans, Louisiana O!G-15-65-

12 (April2015). 

www.oig.dhs.gov 10 
125 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Finally, that the problem is systemic and persistent means that the current 

legal, regulatory, and management structure may need to be changed. FEMA 

administers grants to over 100,000 subgrantees, a number that is simply too 

large for FEMA to manage. In theory, it should be able to rely on the state-level 

grantees to conduct oversight, but as we have seen time and again, FEMA has 

been unable or unwilling to do so. A new structure-one that both empowers 

the states and holds them accountable for results-is needed to enhance 

accountability, decision making, and transparency. We have started to explore 

with your staff some potential systemic solutions, which may require 

legislation, and we look forward to working with you on this important issue. 

Mr. Chairman, this concludes my testimony. l am happy to answer any 

questions you or other members of the committee may have. 

www.oig.dhs.gov 11 
126 

Census cost per dollars 

!! 

(~;-

·~ .. ~~ 

0 

~§ 

a 

LJ..l 

tn ~~ ::J 

a 

<! 

' z 

0 

~ ~I u... 

~~~~ 

·I 

CD 

.. ·~ 
127 

~~ 

.Q 

0 f1 

N ~fi "'f"' 

~a 

~i 'f"' 

u ~I 'f"' 

~~ 'f"' " ., 

e 

00 " 

~ !l 

"' " 0 <> "' 

SJeiiOP ~0 SUO!IIJQ snsuao ll:!lO:j, 
128 

Post-Hearing Questions for the Record 

Submitted to the Honorable Gene Dodaro 

From Senator Heidi Heitkamp 

"High Risk: Government Operations Susceptible to Waste, Fraud, and Mismanagement" 

February 15, 2017 

l. GAO has added "Improving Federall>rograms that Serve Tribes and Their Members" 

to its high risk list. In your testimony, you made note that many of the 

recommendations GAO has made to the Bureau of Indian Education, the Bureau of 

Indian Affairs and the Indian Health Services have not been "fully resolved." What are 

some of the reasons that the recommendations have not been fully resolved? 

Education 

Of the 13 recommendations we have made to the Office of the Assistant Secretary for Indian 

Affairs (Indian Affairs) regarding Indian education in the last 3 years, Il recommendations 

remain open. For three of the open recommendations, Indian AtTairs has not provided 

documentation that it has planned or implemented any changes that address our 

recommendations. For example, in March 2016 we recommended that Indian Atfairs develop a 

plan to build Bureau of Indian Education (BIE) schools' capacity to promptly address safety and 

health issues at school facilities. As of March 2017, Indian Affairs has not provided us any 

information that it has developed and implemented such a plan. 

With other recommendations, Indian Affairs has taken some initial steps but has not followed 

through with full implementation. For example, Indian Affairs developed a strategic plan for BIE 

to respond to a recommendation in our September 2013 report. However, Indian A !fairs has not 

finalized BIE's strategic plan, which has remained in draft status for several years. In another 

case, Indian Affairs proceeded with changes that did not substantively address the 

recommendation. Specifically, Indian Affairs developed a workforce plan in 2016 in response to 

a recommendation in our September 2013 report, but the plan did not address our central 

requirement that the plan include information on the employees that provide administrative 

support to BIE schools. In particular, we found that the plan contained little or no specific 

information about vacancies among these stat{ how they are distributed in the organization, and 

gaps in their skills and competencies to provide administrative support to BIE schools. 

Healthcare 

For some recommendations to the Indian Health Service (IllS) that remain open. IHS officials 

have stated that the agency has taken action to implement them, but has not provided sufficient 

documentation of its actions. For example: 

Estimating Purchased/Referred Care {PRC) needs. In fiscal year 2011, we 

recommended that IHS develop more accurate data for estimating the funds needed for 

the PRC Program-previously referred to as the Contract Health Services program- and 

improving IHS oversight. We recommended that IHS do so by developing a written 

policy documenting how it evaluates need for the PRC program and disseminate it to area 
129 

offices and PRC programs to ensure they understand how unfunded services data are 

used to estimate overall program needs. We also recommended that IllS provide written 

guidance to PRC programs on a process to use when funds are depleted and there is a 

continued need for services, and monitor to ensure that appropriate actions arc taken. In 

response. IHS officials reported that IllS had been working on a comprehensive update of 

a policy chapter related to the PRC program since December 2012, due to be completed 

in September 2016. However, !I-IS has not provided us with any documentation to 

support that this has been completed. 

Preparing for expanded Medicaid eligibility. In fiscal year 2013, we recommended 

that lHS prepare for the increase in eligibility for expanded Medicaid and new coverage 

options, and the need for enrollment assistance and billing capacity, by realigning current 

resources and personnel to increase capacity to assist with these efforts. As of January 

2017, IHS has reported that it developed a business plan template to help maximize 

capacity building and enrollment activities at the local level in coordination with !HS 

Headquarters and Area Offices. The agency reported that it will monitor the overall 

implementation process through performance plan evaluations oflocalleadership by their 

respective Area Directors. However. IHS ofticials have provided no documentation to 

support that this has been completed. 

Some open lHS recommendations were made just recently, and IllS has not yet fully 

implemented them. For example: 

Developing agency-wide standards for patient wait times. In fiscal year 2016, we 

recommended that IHS develop and communicate specific agency-wide standards for 

patient wait times in federally operated facilities, monitor patient wait times, and take 

corrective actions when standards are not met. IllS stated that it agreed with the need to 

improve patient wait times at IllS federally-operated facilities to ensure that primary care 

is available and accessible to Indians. lHS described its plan to establish an Office of 

Quality Health Care at IHS Headquarters to provide national policies for and oversee 

critical quality improvement strategies, and to ensure their success and accountability. As 

of January 20 I 7, IllS had not yet established the Office of Quality llealth Care, and has 

not developed agency-wide standards for patient wait times in federally operated 

facilities. 

Developing agency-wide standards for quality of care. In tiscal year 2017, we 

recommended that IHS develop agency-wide standards for the quality of care provided in 

its federally operated facilities, systematically monitor facility performance in meeting 

these standards over time, and enhance its adverse event reporting system. As of January 

2017, IHS has not yet implemented this recommendation. 

For other open recommendations, lHS has not implemented them. For example: 

Allocating Purchased/Referred Care funds more equitably. In fiscal year 2012, we 

made multiple recommendations to IHS in an effort to make the allocation of PRC funds 

more equitable. We recommended that IllS (I) develop written policies and procedures 

to require area offices to notify IHS when changes are made to the allocations of funds to 

PRC programs: (2) use actual counts ofPRC users, rather than aii!HS users, in any 

formula for allocating PRC funds that relies on the number of active users; and (3) use 

variations in levels of available hospital services, rather than just the existence of a 

2 
130 

Energy 

qualif'ying hospital, in any formula for allocating PRC funds that contains a hospital 

access component. IHS did not concur with our recommendation to use actual counts of 

PRC users, stating that the combined count of all users is intended to reflect the health 

care needs of PRC users. However, the current count of active PRC users does not reflect 

those who actually received PRC services, and because PRC program increases are 

intended to reflect variations in the numbers of PRC users among areas, we continue to 

believe that IHS should use counts of actual PRC users in determining program increases. 

IHS concurred with the other two recommendations, but as of January 2017, the agency 

has not implemented these recommendations. 

Legislation introduced in the House and reported out of committee in 2016 would have 

required If!S to establish regulations to develop and implement a revised PRC 

distribution formula taking into account certain factors that may vary across areas. Also, 

a 2016 bill's accompanying llouse Report would have directed the agency to allocate an 

increased funding increment resulting from the 2017 Department oflnterior regular 

appropriation, ll.R. 5538, pursuant to a specified allocation formula that may vary across 

areas. Neither bill became law. 

Streamlining program eligibility requirements, In fiscal year 2014, we recommended 

that as HHS and II IS monitor the effect that new coverage options available to IHS 

beneficiaries through the Patient Protection and Affordable Care Act have on PRC 

program funds, JHS should proactively develop potential options to streamline program 

eligibility requirements. HHS agreed with the premise that Medicaid eligibility expansion 

and private insurance for more American Indians and Alaska Natives would reduce the 

demand for PRC services and noted that lHS would monitor the effects of new coverage 

on program funds and develop options to improve and streamline the PRC program 

processes. However, as of January 2017, lHS had not implemented this recommendation. 

BlA has taken some actions that will help it to address our recommendations related to federal 

management of Indian energy resources and the development process, but these actions are 

generally limited in scope and more actions are needed to fully resolve the recommendations. For 

instance, in June 2015, we recommended that BIA develop a documented process to track its 

review and response times for energy development activities. In response, BlA stated it will try to 

implement a tracking and monitoring mechanism by the end of fiscal year 2017 tor oil and gas 

leases. 1-lowever, BIA did not indicate whether it intends to track and monitor how it reviews 

other energy-related documents that must be approved before resources are developed. We 

continue to believe BIA needs to take additional actions to ensure its process to review and 

approve all energy-related documents is transparent, effective, and efficient. 

In response to other recommendations, BIA stated it will consider taking actions but has not 

provided additional information regarding its intentions. For example, in June 2015, we 

recommended that Interior provide clarif'ying guidance on provisions of Tribal Energy Resource 

Agreement regulations that tribes identi1led as unclear. In response, Interior of1lcials stated that 

the agency is considering further guidance, but it has not provided additional information on 

whether the guidance will be issued or a timefrarne for making this determination. Further, in 

response to some recommendations, BIA identified actions it will take but added the actions are 

3 
131 

dependent on budget and resource availability. In June 2015, we recommended BlA take steps to 

complete geographic information system (GIS) mapping capabilities. BIA responded that a 

national dataset wmposed of all Indian land tracts and boundaries with visualization functionality 

will be completed within 4 years, depending on budget and resource availability. 

2. How can Congress do a better job in providing oversight of these programs? 

Congress could increase oversight of federal agencies' management of programs that serve tribes and 

their members in several ways. In addition to considering legislation to require agencies to carry out 

specilic actions that Congress deems appropriate. congressional committees could direct agencies to 

provide regular written updates and/or briefings to the committees on their progress in meeting goals 

and implementing our recommendations. Also. Congress could hold more hearings on these programs, 

which could increase the visibility of management problems and exert greater pressure on agencies to 

implement our recommendations. 

4 
132 

Post-Hearing Questions for the Record 

Submitted to Hon. Gene Dodaro 

From Senator ,James Lankford 

"High Risk: Government Operations Susceptible to Waste, Fraud, and Mismanagement" 

February 15,2017 

1) As a preliminary judgement, would the integration of these processes be feasible? 

What efficiencies could be gained and what challenges would Census or IRS face? 

We have not studied the integration of the census and tax filing, and are thus limited in what we 

can say about its feasibility. Although there could be opportunities for efficiencies depending on 

the approach used, significant challenges exist to a broad integration of census response and tax 

filing processes that would first need to be addressed. They include, for example, 

differences in key definitions (e.g., IRS and the Census Bureau may define "household" 

differently: ''Census Day" is April I while the tax return liling deadline is April IS); 

differences in population coverage (e.g., not everyone is required to file an income tax return) 

willingness to participate (e.g .. trust in either the Bureau's or IRS's use of the data may 

affect who participates); 

role ofthird-parties (e.g., most tax liling occurs through third parties); and 

information technology challenges of integrating systems, and legal challenges of resolving 

any statutory changes that may be needed, as discussed below. 

For the 2020 Census, it appears infeasible to integrate these processes due to the short period 

remaining before the start of the US Census Bureau's 2018 End-to-End Test, which is scheduled 

to begin later in this calendar year. The changes that would be needed to procedures and systems 

would be too great and come too late to include in the Bureau's 1inal major test for the 2020 

Census. We have previously reported on the need to establish early buy-in on census methods to 

be used, as well as the risks of introducing signi !icant change late in the process. 

Nevertheless. the Bureau has worked with IRS over the years to leverage IRS data that the 

Bureau believes improves operations and reduces cost. There may be additional opportunities for 

the Bureau and IRS to work with each other to identity efficiencies or address these challenges 

beyond the 2020 Census. 

2) Are there any statutory or other impediments to integrating these pi'Ocesses? 

There are constitutional and statutory impediments to integrating liling the decennial census with 

individual tax returns. Article I Section 2 of the Constitution requires enumeration of all persons; 

therefore any attempt at integration would have to ensure that all individuals arc enumerated. It is 

important to note, however, that the Internal Revenue Code does not require everyone to 1ile an 

income tax return each year. See, e.g. 26 U.S. C.§ 6012. Consequently, there would be 

individuals in the year of the census that would not be required to file tax returns and who would 

need to be counted under an alternative process. 

5 
133 

In addition to the Constitution, Title 13 of the United States Code governs the operations of the 

Census Bureau. Specifically, Section 9 of Title 13 requires officers or employees of the 

"Department of Commerce or bureau or agency thereof, or local government census liaison" to 

keep information gained under Title 13 confidential and not use the information ''for any purpose 

other than the statistical purposes for which it is supplied." 13 USC § 9{a){l}. To achieve 

integration, were the data to be visible to the Internal Revenue Service (IRS), this provision 

would need to be amended to provide for disclosure of Title I3 information to IRS. 

Also, Section 141 of Title 13 requires the census to occur on April! st, therefore this date may 

have to he adjusted to align with IRS' tax filing season and the due date for filing returns plus 

allowable extensions. 13 U.S.C § 14/(a). Furthermore. Section 141 requires the tabulation of the 

population required for the apportionment of representatives in Congress be completed "within 9 

months after the Census date". 13 US.C § 141 (h, and IRS's allowable extension might interfere 

with this). Additionally. this tabulation must be provided to states within I year after the census 

date for purposes of redistricting. 13 U.S C.§ 1.f1{c). Effmts to integrate the IRS and census 

processes would have to reconcile the time limitations in Section 14 I. 

Title 26 governs the disclosure of taxpayer data by the IRS. Section 6103 of Title 26 contains two 

subsections that may. depending on the manner in which integration is carried out, need to be 

amended. Section 61 03(a) protects tax return information by prohibiting employees or officers of 

IRS from disclosing "any return or return information obtained by him in any manner in 

connection with his service as such an officer or an employee or otherwise or under the 

provisions of this section." While Section 61030) specifically authorizes IRS to disclose tax 

information to the Census Bureau, that disclosure is "only to the extent necessary in, the 

structuring of censuses and national economic accounts and conducting related statistical 

activities authorized by law." These sections may need to be amended depending on the 

integration's structure. 

Finally, other impediments to integrating these processes are outlined in the response to Question 

I. 

6 
134 

Post-Hearing Questions for the Record 

Submitted to the Honorable Gene Dodaro 

From Senator Claire McCaskill 

"High Risk: Government Operations Susceptible to Waste, Fraud, and Mismanagement" 

February 15, 2017 

2020 Census: Cyber Security 

The Bureau has developed a "systems of systems" called the Census Enterprise 

Collection and Processing (CEDCAP) initiative that serves as the backbone for the 2020 

Census operations. The redesign of the 2020 Census relics on CEDCAP's ability to function 

properly. In 2016, the Government Accountability Office (GAO) reported on the challenges 

the Bureau faces in managing the interdependencies between the 2020 Census and 

CEDCAP programs, as well as challenges it faces in ensuring the security and integrity of 

Bureau systems and data. 

t. Please expound on GAO's specific concerns related to the implementation of 

CEDCAP's 14 systems and the security issues that the Bureau could face if GAO's 

recommendations arc not met before the 2018 End-to-End Test. 

The Bureau has much work left to do to develop CEDCAP systems and to integrate them 

with other legacy systems in preparation for the 2018 End-to-End Test, which is 

scheduled to begin in August 2017. In total, the Bureau plans to integrate about 50 

systems for this test, including those to gather information via the internet, phone, or 

through door-to-door data collection. However, a great deal of development work 

remains to be completed, selected system development efforts are behind schedule, key 

infrastructure procurements have not been made, and the Bureau is still finalizing 

development and test plans. 

In August and November 2016, we reported that the majority of the 50 systems for the 

2018 End-to-End Test were being managed by the 2020 Census Program, while 11 of the 

50 systems were being developed as part of the enterprise-wide CEDCAP Program. 

However. we found that the Bureau was not effectively managing the integration of 

schedules, risks, and requirements between the two Programs. We recommended (among 

other things) that the two Programs maintain a single dependency schedule, establish an 

integrated list of all interdependent risks, and finalize the processes for managing 

requirements. 

Bureau officials acknowledged weaknesses in managing the interdependencies between 

the two programs, and responded that they were taking steps to address our 

recommendations, such as by monitoring interdependent risks through an integrated risk 

register. Nevertheless, time is running out to cJTcctivcly integrate schedules and address 

risks before the start of the 2018 test. If this is not accomplished, the bureau may not be 

7 
135 

able to ensure critical systems are included in the End-to-End test, a key milestone in the 

bureau's approach to the 2020 Decennial Census. 

Further, the Bureau faces significant challenges in securing systems and data. Because 

many of the systems to be used in the 2018 End-to-End test are not yet fully developed, 

the Bureau has not finalized all of the controls to be implemented, completed an 

assessment of those controls. developed plans to rcmcdiate any control weaknesses, and 

determined whether there is time to fully remcdiate any weaknesses before the system 

test begins. We have previously reported that tight time frames (such as those the Bureau 

faces in the run up to 2018 End-to-End test beginning in August 20 17) can exacerbate 

these types of security challenges. Given the short window of time before the test is to 

begin, it is important that the Bureau continue to focus its attention on implementing and 

securing the systems that are to collect and store the personal information of millions of 

American people. 

2. Given the challenges of implementing the CEDCAP systems and the redesign for the 

2020 Census, are you confident that the Bureau will be ready for its planned 2018 

End-to-End test and for the 2020 Census Day? 

Given the challenges that we have identiticd in our work, we arc not optimistic that the 

Rureau will be ready for all aspects of the 2018 End-to-End test set to begin in August 

2017. As previously discussed, a great deal of system development work needs to be 

completed, inl!·astructure procurements still need to be completed, and development and 

test plans need to be tinalizcd. The 2018 End-to-End test is the last major operational test 

prior to the 2020 Census, and is meant to test all key systems and operations to ensure 

readiness for the 2020 Census. If the Bureau tails to adequately test the systems and 

technology during the 2018 End-to-End test, it increases the risk that systems and 

technology may experience issues during 2020 Census operations. 

Legacy Systems 

In 2015, GAO added improving government management of IT acquisitions and 

operations to its list of high-risk areas. GAO's 2017 report notes that the executive branch 

manages more than $80 billion in federal IT investments, but that unfortunately, these 

pro,jects "too frequently fail or incur cost overruns and schedule slippages while 

contributing little to mission-related outcomes." 

One of the primary reasons for this problem is that nearly 75% of the government's 

funding for IT systems is spent on operating and maintaining existing legacy information 

technology systems, which are becoming increasingly obsolete. The remaining 25% 

(approximately $20 billion) is spent on new developments. 

3. How does maintaining this kind of funding imbalance impact the federal 

government's ability to invest in new information technology solutions? 

8 
136 

Over the past 7 fiscal years, federal agencies' spending on operating and maintaining 

their legacy systems has steadily increased, while the amount invested in developing new 

systems has continually decreased. Specifically, the amount that federal agencies have 

invested in developing new systems has decreased by about $7.3 billion since fiscal year 

2010. Such an imbalance means that agencies are not innovating and improving mission 

performance to the extent needed. 

In addition, agencies are not required to identify, evaluate, and prioritize their existing 

investments to determine whether they should be kept as-is, modernized, replaced, or 

retired. The Office of Management and Budget (0~1B) has created draft guidance that 

would require agencies to identify and prioritize legacy information systems that are in 

need of replacement or modernization. but has not finalized this guidance. 

4. How many legacy IT systems does the federal government maintain that are more 

than 20 years old? Please list them. 

We do not have information identifying the exact number of the systems that are more 

than 20 years old. However, our work has shown that federal legacy IT investments are 

becoming increasingly obsolete. Many use outdated software languages and hardware 

parts that are unsupported. In our May 2016 report, selected agencies reported using 

several systems that have components that are, in some cases, at least 50 years old. Table 

1 provides seven examples of legacy systems across the federal government that agencies 

report are more than 30 years old and usc obsolete software or hardware. 

Table 1: Examples of Federal Agencies' Legacy Investments and Systems 

Agency 

Department of 

the Treasury 

Department of 

the Treasury 

Investment or 

system Description 

Individual Master File The authoritative data source for 

individual taxpayers where accounts 

are updated, taxes are assessed, and 

refunds are generated. This 

investment is written in assembly 

language code-a computer code that 

is difficult to write and maintain~and 

operates on an IBM mainframe. 

Business Master File Retains all tax data pertaining to 

individual business income taxpayers 

and reflects a continuously updated 

and current record of each taxpayer's 

account. This investment is also 

written in assembly language code and 

operates on an IBM mainframe. 

9 

Agencyreported modernization or 

age replacement 

-56 No - The agency has 

general plans to 

replace this investment, 

but there is no firm date 

associated with the 

transition. 

-56 No - The agency has 

general plans to update 

this system, but there is 

no time frame 

established for this 

transition. 
137 

Investment or 

Agency system 

Department of Strategic Automated 

Defense Command and 

Control System 

Department of 

Veterans 

Affairs 

Personnel and 

Accounting Integrated 

Data 

Department of Benefits Delivery 

Veterans Network 

Affairs 

Security 

Administration 

Description 

Coordinates the operational functions 

of the United States' nuclear forces, 

such as intercontinental ballistic 

missiles, nuclear bombers, and tanker 

support aircrafts. This system runs on 

an IBM Series/1 Computer-a 1970s 

computing system-and uses 8-inch 

fioppy disks. 

Automates time and attendance for 

employees. timekeepers, payroll, and 

supervisors. It is written in Common 

Business Oriented Language 

(COBOL)-a programming language 

developed in the 1950s and 1960sand runs on an IBM mainframe. 

Tracks claims filed by veterans for 

benefits, eligibility, and dates of death. 

This system is a suite of COBOL 

mainframe applications 

regarding 

and custody levels, inmate program 

and work assignments, and other 

pertinent information about the inmate 

population. The system uses COBOL 

and Java 

eligibility and amounts. The investment 

is comprised of 162 subsystems 

written in COBOL. 

Agencyreported modernization or 

age replacement 

53 Yes - The agency plans 

to update its data 

storage solutions, port 

expansion processors, 

portable terminals, and 

desktop terminals by 

the end of fiscal year 

2017. 

53 Yes- The agency plans 

to replace it with a 

project called Human 

Resources Information 

System Shared Service 

Center in 2017. 

51 No - The agency has 

general plans to roll 

capabilities into another 

system, but there is no 

firm time frame 

associated with this 

transition. 

agency 

ongoing modernization 

efforts, including one 

that is experiencing 

cost and schedule 

challenges due to the 

complexities of the 

legacy software. 

Source: GAO analysis of IT Dashboard data, agency documentation, and interviews. 1 "'-'-=-""'''''"' Note: Age was reported by agencies. Systems and investments may have individual components newer than the 

reported age. 

5. Why have some federal agencies struggled so mightily at identifying and addressing 

legacy IT systems? 

Agencies have struggled at identifying and addressing legacy IT systems, in part, because 

they continue to maintain obsolete systems and are not required to identify, evaluate, and 

prioritize their existing investments to determine whether they should be kept as-is, 

modernized, replaced, or retired. The Office of Management and Budget (OMB) has 

created draft guidance that would require agencies to identify and prioritize legacy 

information systems that are in need of replacement or modernization. Such guidance is 

10 
138 

needed; however, OMB has not committed to a firm time frame for when the policy is to 

be issued. 

6, What types of challenges do legacy systems pose to national security and other 

critical government functions? 

Legacy systems, many of which use outdated languages and old hardware, can pose 

challenges to national security and other government functions when parts become more 

difficult to replace, security vulnerabilities accrue due to lack of vendor support, and 

maintenance costs increase in part due to specialized labor requirements. In our May 

2016 report, we found that numerous old investments are using obsolete programming 

languages. Several agencies reported using COBOL-a programming language 

developed in the late 1950s and early 1960s-to program their legacy systems. In 

addition, some legacy systems may usc parts that arc obsolete, and therefore, more 

difficult to find. Further, in some cases, the vendors no longer provide support for 

hardware or software, creating security vulnerabilities and additional costs. For example, 

the Departments of Commerce, Defense, Transportation, Health and Human Services, 

and Veterans Affairs all reported using 1980s and 1990s Microsoft operating systems that 

stopped being supported by the vendor more than a decade ago. Lastly, legacy systems 

may become increasingly more expensive as agencies have to deal with the previously 

mentioned issues and may pay a premium to hire staff or contractors with the knowledge 

to maintain outdated systems. 

Skills Gaps Hinder IT Management 

One critical reason why the government's ability to manage its IT infrastructure is 

lacking, relates to our human resources. GAO reports that executive-level governance of 

federal IT projects by chief information officers (CIOs) has been ineffective. 

GAO found that some CIOs are limited in that they lack the authority to review and 

approve the entire agency IT portfolio. 

7. Are these decisions made on an agency-by-agency basis"? 

C!Os' authority to review or approve investments varies from agency to agency. In 2013 

we reported that, according to a survey conducted by OMB, 6 of 26 agencies either 

reported that the CIO did not have the authority to review and approve the entire agency 

IT portfolio or that there were limitations to their authority to perform these activities1 

To address these issues, in December 2014, Congress enacted IT reform legislation 

commonly referred to as FIT ARA 2

, which requires that agency heads ensure that their 

'GAO, fnjimnation Technology: Additional Ofv!B and Agency Actions Are Needed to Achieve Portfolio Savings, 

( "\' •· (Washington, D.C .. Nov. 6, 2013). 2

Federallnformation Technology Acquisition Reform Act (FITARA) provisions of the Carl Levin and Howard P_ ·Duck' 

~v1cKeon National Defense Authorization Act f'or Fiscal Year 2015. Pub. L. ~o. 113-291. div. A title VHL subtitle D. 128 Stat. 

3292.3438-3450 (Dec. !9, 20!4). FITARA general!)' applies to the 24 Chief Financial Officers Act agen~ies. 

11 
139 

C!Os have a significant role in the decision processes for programming, budgeting, and 

execution decisions, related to IT; and that agency C!Os both conduct an annual review 

of the agency's IT portfolio and approve the IT budget request for their agency. FITARA 

also specifies that agencies may not enter into an IT contract or other agreement without 

the agency CIO's review and approval. In addition, in June 2015, OMB provided 

agencies with implementation guidance for FIT ARA3 This guidance established a 

common baseline for roles of the agency C!O in managing IT, including the following: 

• the CIO shall approve the IT components of any plans; 

• the CIO must review and approve the major IT investments portion of the agency 

budget request; 

• the CIO may recommend to the agency head the modification, pause, or termination 

of any acquisition, investment, or activity that includes a significant IT component 

based on the CIO's evaluation; and 

• the CIO must approve any movement of funds for IT resources that requires 

Congressional notification. 

The guidance also required each agency to conduct a self~assessmcnt that identifies 

conformity with or gaps in conformity with the common baseline. 

8. Which agencies fall into this category? 

All 24 CFO agencies fall into this category because each has experienced issues in 

implementing FITARA provisions. We have ongoing work looking at the key challenges 

C!Os at each of these 24 agencies face in fultilling their responsibilities to caiTy out 

federal law and guidance, including FITARA provisions. 

In addition. according to the January 2017 Federal CIO Council Report, many agency 

C!Os do not have direct supervision, budget authority, or management control of the IT 

activities at their agencies. This report also stated that many C!Os faced limitations in 

their ability to influence agency decisions on IT investments because a significant portion 

of an agency's IT funding is allocated and spent at the component, or bureau level, of an 

agency, and that IT-related decisions at many agencies are still made without significant 

involvement from the CIO. Until agency CIOs have full authority to review and approve 

the entire IT portfolio, they will be limited in their ability to ensure that IT investments 

are made in a cost effective manner. 

According to GAO, federal agencies must address IT workforce skills gaps in order 

to improve their capacity to acquire new IT investments. 

9. Does the federal government face any hurdles in competing with the private sector 

to recruit high-level information technology professionals? 

'OM B. ,\!anagemenf and Oversight (~(Federal Information Techno!O&J)'. Memorandum :v1-l5- 14 (Washington. D.C :June 10. 

CIO CounciL Slate of F!!deralln(ormation Technology (January 2017). 

12 
140 

According to a panel offormer federal CIOs, current federal CIOs, and other IT experts 

convened by the Comptroller General in September 2016, there are several challenges 

that the federal government faces in recruiting C!Os and other high-level IT professionals 

from the private sector. These include being able to ( 1) offer a salary that competes with 

what the individual can earn in the private sector; (2) find individuals who are enticed by 

public service but who are also at a point in their career where they arc prepared to 

transition from the private sector; and (3) provide the level of authority over IT decisions 

that CIOs arc used to having in the private sector. 

10. What impact do you expect the federal hiring freeze will have on agencies' ability to 

hire individuals with critical expertise in IT? 

A federal hiring freeze can be disruptive to agencies' recruitment efforts, especially when 

recruiting individuals with IT skills that arc in high demand. For example, it can be 

difficult to hold potential candidates' interest when there are no current vacancies and 

there is uncertainty about when a freeze might be lifted. According to findings from a 

2011 working group established by the Office of Personnel Management and the Federal 

Chief Human Capital Off1cers CounciL a government-wide cybersecurity skill gap 

already exists. A hiring freeze that reduces the number of vacancies and disrupts 

recruitment efforts could make it more difficult to hire cybersecurity professionals and, 

thus, exacerbate the skill gap. 

11. What steps can Congress take to address these IT skills gaps? 

Congress has already passed important laws-such as the Clinger-Cohen Act ofl996, the 

£-Government Act o{2002, the Federal Infimnation Technology Acquisition Reform Act, 

and the Federal Cybersecurity Workforce Assessment Act of 20 I 5-aimed at, among 

other things, improving federal agencies' ability to assess and address IT skill gaps 

through IT workforce planning activities. GAO recently reported that selected agencies 

had mixed progress in assessing their IT skill gaps 5 Given that cybersecurity is an area 

where a government-wide skill gap already exists, it is important that Congress continue 

to oversee agencies' efforts in implementing robust IT workforce planning steps, such as 

identifying skill gaps and developing plans to address them. 

12. Are there challenges unique to DHS that make IT management difficult? 

While every federal agency has unique mission needs and concerns, in general the 

Department of Homeland Security faces challenges with respect to managing IT 

acquisitions and operations that arc similar to challenges at other departments. IT 

management can be challenging ror a large, federated organization like the Department of 

Homeland Security. 

With respect to managing the IT workforce, in January 2015 the Department of 

Homeland Security shifted its IT paradigm from acquiring assets to acquiring services, 

Ensure ~\'trong Integrated Pro~ram Teams: .\'elected Do!partments ,Veed to Assess Skill Gaps, ( i, \U311. 21116), 

13 
141 

and acting as a service broker (e.g., an intermediary between the purchaser of a service 

and the seller of that service). According to DHS ot11cials in May 2015, this paradigm 

change will require a major transition in the skill sets ofDHS's IT workforce, as well as 

the hiring, training, and managing of those new skill sets. As such. this effort will need to 

be closely managed in order to succeed 

13. How can the federal government do a better job at identifying, communicating and 

implementing best practices throughout the government? 

Federal agencies can leverage recently published guidance on assessing skills associated 

with IT positions and the CIO Council's Workforce Committee for assistance in 

identifying, communicating, and implementing best practices in IT workforce planning. 

In January 2017, the Office of Personnel Management released guidance to federal 

agencies on coding positions with IT, cybersecurity, and cyber-related functions by using 

the National Institute of Standards and Technology's Federal Cybersecurity Coding 

Structure 6 The guidance and coding structure are intended to help agencies better 

identify specilic IT knowledge, skills, and abilities that exist within each agency. If 

implemented, agencies could utilize the guidance and coding structure as a standardized 

method to compare current workforce skills and work roles to those needed in the future. 

In addition, the Federal CIO Council's Workforce Committee could be a helpful 

mechanism f()r identifying and communicating best practices associated with IT 

workforce planning. As an example, the CIO Council led government-wide surveys of 

the IT and cybersecurity workforce in May 2011 and March 2013, respectively. Such 

efforts can provide valuable benchmarking and agency-specific information for eros to 

utilize in their workforce planning. 

DHS Progress on GAO Recommendations 

One of the consistent themes throughout GAO's High Risk report across the years is 

that federal agencies such as DHS must improve their contracting management and 

oversight processes. Last December, DHS updated its staffing assessment guidance to 

refocus the assessment process on all major program acquisition-related positions. GAO 

reported that DHS plans to pilot the implementation of this update incrementally during 

2017 and the timing of full implementation is not yet known. 

14. Since December, has DHS provided you with more concrete details regarding their 

timeline for full implementation of this acquisitions overhaul? 

14 
142 

D!IS has not provided any further information on the timeline for implementing its 

updated staffing assessment process since December 2016. We will continue to follow up 

on the issue in the course of our other ongoing DHS acquisition work. 

a. If no, has DHS given you a timeline for confirming their timeline? 

DHS has not provided a timeline but. as noted above, we will follow up on its 

progress. 

15. What's at stake for our national security interests if DHS and its components cannot 

promote etTective and consistent oversight of its contracting processes? 

The bottom line is that. without effective and consistent acquisition oversight, DHS risks 

not delivering capabilities to end users on time, which means operators in the field are 

being asked to do their jobs without the tools they have been promised. 

D!IS is responsible tor confronting dynamic threats with a constrained budget, and DHS 

leadership has taken a number of steps in recent years to improve acquisition 

management. These steps have improved DHS's ability to manage these programs and 

enabled more robust oversight. However, in the past, we found that staffing shortfalls can 

lead to poor program execution. Furthermore, not all programs have conducted or passed 

operational testing. which means those capabilities that have been deployed may not 

operate as intended. Additionally, many of these programs arc costing more than DHS 

leadership had initially approved, effectively decreasing DHS's buying power and 

reducing the amount of capability the department may be able to afford in the future. 

DHS: Leadership Commitment 

The 2017 High Risk Report says that DHS should maintain its current level of top 

leadership support and sustained commitment to ensure continued progress in executing its 

corrective actions through completion. 

16. Have you had an opportunity to meet with Secretary Kelly and get his assurance 

that the Department will continue to implement GAO's recommendations through 

completion? 

I have tried to meet with Secretary Kelly and have not been successful. I will meet with the 

Deputy Secretary when confirmed and will continue to pursue a discussion with the Secretary. 

Additionally. we will continue to engage with DHS leadership through various means to help 

ensure the department maintains its progress in implementing corrective actions through 

completion. Specilically, we will continue to 

assess and provide feedback to DHS leadership on reports the department submits on its 

progress in addressing the Strengthening DHS Management Functions high-risk area, which 

15 
143 

the National Defense Authorization Act for Fiscal Year 2017 mandates the DHS Under 

Secretary for Management provide to us every 6 months7

; 

hold quarterly meetings with DHS leadership to discuss the Strenf<lhening DHS Management 

Functions high-risk area and other pertinent issues; 

discuss the results of our audit work within DHS's management areas with DHS leadership 

(e.g., with regard to financial management, we have ongoing work examining DHS's efforts 

to modernize its financial management systems); and 

reach out to senior DHS officials regarding the extent to which the department has 

implemented our recommendations, including those related to the Strengthening DHS 

A1anagement Functions high-risk area, to help ensure that they are implemented effectively 

and in a timely manner. 

Weakness in the Department of Veterans Affairs Action Plan 

GAO designated VA health care as a high risk area in 2015. GAO identified five 

areas of concern that placed VA on the high risk list. Those areas are: (I) ambiguous 

policies and inconsistent processes; (2) inadequate training for VA staff; (3) information 

technology (IT) challenges; (4) inadequate training for VA; and (5) unclear resources needs 

and allocation priorities. 

17. Taking into consideration the significant work that is needed to fully address all five 

areas, how can GAO work with the VA to develop a system to prioritize these areas 

to fully address them rather than implementing change piece meal? 

Our five areas of concern are interdependent. For example, addressing the area of Inadequate 

Training for VA Staff involves the four other areas of concern: it requires establishing a new 

training management policy (Ambiguous Policies and Inconsistent Processes); determining that 

adequate resources are available to implement the new training management program and 

disseminate it to the field (Unclear Resource Needs and Allocation Priorities); implementing a 

new training management system (IT Challenges); and overseeing the policy's implementation to 

ensure compliance with new requirements (Inadequate Oversight and Accountability). 

In its action plan, VA had separated its discussion of department-wide initiatives (like My VA) 

from its High-Risk List mitigation strategies. We do not view high-risk mitigation strategies as 

separate from other department initiatives. and would like to see VA integrate these efforts. That 

way, they can develop strategies that link more effectively and efficiently to actions and guidance 

in order to facilitate their implementation. 

An important first step towards establishing integrated eft<1rts is for VA to analyze the root causes 

of the issues contributing to its high-risk designation for each of the five areas of concern. A root 

cause analysis is a key component of the action plan criterion for High-Risk List removal, and 

provides the foundation for establishing milestones and metries to measure progress. Once VA 

has been able to identify the root causes of its high-risk designation, it can then identity the 

fhr.: National Defense Authorization Act for Fiscal Year 2017 includes a mandate that the DHS Under Secretary for 

Mtma:scn1en1 report to us every 6 months to demonstrate measurable, sustainable made in implementing OriS's 

action plans to address the Functwns area until we submit written 

notification of the area"s removal from the appropriate co''""'"''""'" committees. Sec Pub. L. No. 114-328, 

j \903(b) (codified at 6 t:.s.c. § 34\(a)( 1 

16 
144 

specific actions that are needed to resolve them. This process may also provide an opportunity to 

prioritize specitlc actions. 

VA 's ability to implement those actions will, in part, be driven by its assessment of, and ability to 

demonstrate, its capacity (i.e., people and resources, another criterion for High-Risk List removal) 

to resolve the concerns the led to the high-risk designation. VA may identifY needed actions to 

resolve root causes. but will then need to allocate the necessary resources and address any skills 

gaps through guidance and training in order to successfully implement them. Throughout this 

process, VA will need to demonstrate consistent, strong leadership commitment and monitor 

actions that will allow them to demonstrate progress. 

As part of our work on the 2017 High-Risk Report, we have met with VA officials including the 

Secretary, provided feedback, and offered suggestions and subject-matter expertise to guide their 

high-risk-related actions. For example, we met multiple times with VA officials in 2015 and 2016 

to discuss the high-risk designation. We also provided feedback on drafts of VA 's action plan, 

stressing the need for establishing specific timelines and assessing resources needed for 

implementation. Moreover, we have offered the expertise of our senior staff to share best 

practices with VA officials related to the five areas of concern, among other topics, and suggested 

that they review the Department of Homeland Security's action plan, which is publically 

available, as a good example. To the extent that we can, given the need to preserve our 

independence, we will continue to provide feedback to VA officials on the development of their 

action plan. and areas where they need to focus their attention. To that end, we identified in the 

2017 High-Risk Report the following recommendations that need immediate attention: 

improve oversight of access to timely medical appointments, including developing wait-time 

measures that are more reliable and not prone to user error or manipulation, as well as 

ensuring that medical centers consistently and accurately implement Vl·lA's scheduling 

policy; 

improve oversight of VA community care to ensure-among other things--timely payment 

to community providers; 

improve planning. deployment, and oversight of VA/VIlA IT systems. including identifying 

outcome-oriented metrics and defining goals for intcroperability with DOD; and 

ensure that recommendations resulting from internal and external reviews ofVHA's 

organizational structure are evaluated for implementation. This process should include 

documenting decisions and assigning officials or offices responsibility for ensuring that 

approved recommendations are implemented. 

Cyber Critical Infrastructure: Cyber Work Force 

18. How have DHS and other federal agencies made improvements in hiring and 

retaining cybcrsecurity professionals? 

We are reviewing cybersecurity workforce matters related to this issue. As mandated by the 

Federal Cybersecurity Workforce Assessment Act of2015, we have recently initiated an 

engagement to analyze and monitor how federal agencies are implementing their requirements 

under the act.' We are specifically monitoring how agencies identify all agency positions that 

"l'ub. L. No. 114-113. div. N. * 305. 129 Stat. 2242. 2977 (20 15). 

17 
145 

perform cybersecurity-related functions and identify cyber-related work roles of critical need. The 

act requires that we submit a report by December 2018. 

19. In what capacity has GAO worked with DHS to address hiring shortfalls'! 

We are reviewing cybersccurity workforce matters related to this issue. As mandated by the 

Homeland Security Cybersecurity Workforce Assessment Act of2014, we will initiate an 

engagement to analyze and monitor DHS implementing its requirements under the act.' We will 

specifically monitor DHS ctl'i.1rts to identify all cybersecurity worktorce positions within the 

department, to identify cybersecurity specially areas of critical need, and to make 

recommendations, if appropriate. The act requires that we submit a report by December 2017. 

Access to Agency Documents 

The GAO Access and Oversight Act is a bipartisan measure to ensure that GAO has 

full access to the National Database of New Hires, a key tool for cutting waste and fraud in 

many of the government's largest programs. 

20. What does the National Database of New Hires do, and why was it so critical for 

GAO to get full access to this system? 

The National Directory of New Hires (NDNH) is a compilation of state databases of persons 

newly hired by employers within each state, as well as recipients of earned income, and 

unemployment insurance information on individuals who have received or applied for 

unemployment. It was critical for GAO to obtain full access to the NDNH because it can be used 

to enhance work on a variety of audits, including those related to improper payments and fraud 

work in programs where eligibility is means-tested. Specifically, full access to the NDNH will 

provide GAO with the means to identify potential improper payments and systemic weaknesses 

in controls over these programs and to make recommendations tor improvements. As we noted in 

June 2016, improper payment estimates across the federal government tor fiscal year 2015 totaled 

$136.7 billion; thus. we view the NDNH as an important tool that could be used to help address a 

significant federal financial issue. 

21. Please explain why GAO needed expanded authority to take legal action when 

agencies refuse to provide documents to GAO. 

a. What are the reasons agencies have given for withholding such information? 

The recently enacted GAO Access and Oversight Act of2017 responded to the District 

Court's ruling in Walker v. Cheney and affirmed the Comptroller General's existing 

authority at 31 U.S.C. § 716 to enforce GAO's access rights in court. In Walker v. 

Cheney, the U.S. District Court for the District of Columbia held that the Comptroller 

General lacked standing to bring suit to compel then Vice-President Cheney's energy task 

force to provide requested records on the grounds that he had not suffered the requisite 

personal, concrete, and particularized injury and that any injury to Congress was too 

''Pub 1.. 1\o 113-277. ~ 4(c). 12g Slat. 2995.3010 (2014). 

18 
146 

·'vague and amorphous" to confer standing on the Comptroller General as its agent. The 

District Court also cited the passage of time since enactment of the enforcement 

provision in section 716. questioning whether the provision represented current 

congressional authorization. The recently enacted legislation made clear that section 716 

authorizes the Comptroller General to initiate a lawsuit to redress the injury sustained 

when an agency withholds records and that it will continue to provide such authorization 

until it is repealed. 

It is important to note more broadly that executive agencies have generally been 

cooperative in providing GAO with access to the information needed for audits, 

evaluations. and investigations. At times, agency officials raise concerns that certain 

information requested by GAO is ·'sensitive" or "non-public," among other things. 

However, where agency officials have concerns about providing information to GAO, we 

are usually able to work toward an accommodation that allows the work to move 

forward. GAO expects we will continue to do so, but the Act provides additional leverage 

should the need arise. 

22. How does this legislation help ensure that you will get the documents you need to 

perform robust government oversight? 

As discussed above, the GAO Access and Oversight Act of2017 confirmed GAO's authority to 

access a critical source of employment information for GAO audits of federal benefits programs 

and reviews of employment and workforce issues, as well as GAO's authority to enforce its 

access rights to federal agency records in court. In addition, the legislation requires agencies to 

submit information about actions taken or planned in response to GAO recommendations directly 

to GAO, as well as to various congressional committees. In all of these respects, the legislation 

helps to ensure that GAO will have the access it needs to conduct robust government oversight. 

(101467) 

19 
147 

Insert A 

Answer to Senator Portman 

Our analysis of fiscal year 2015 data shows that 23 federal agencies reported over 7,000 

excess or underutilized real property assets, according to the Federal Real Property Profile 

(FRPP)- the federal government real property database. Federal agencies waste scarce 

budget resources maintaining and securing these facilities when they could be put to more 

productive uses or, in some cases sold to generate revenue for the federal government. A lack 

of reliable data related to facility costs make it difficult to accurately estimate the amount of 

money that could be saved by disposing of these assets. However, due to the multi-tiered 

screening process for excess federal assets, we have found that most of the savings from 

property disposal comes from savings from operations, maintenance, and security not sales 

revenue. 
148 

Response to Senator Lankford 

Since our 2015 High Risk Update, the Social Security Administration (SSA) has continued making 

progress on updating the occupation data that it uses to help make disability benefit determination 

decisions. SSA relies on the Dictionary of Occupational Titles (DOT) to provide information on jobs in the 

national economy and support the occupational criteria it uses to determine if disability applicants are 

able to work. To do so, occupational data from the DOT is used in a set of rules and guidelines-known 

as grid rules-to evaluate the combined effect of an individual's physical residual capacity, age, 

education, and work experience to determine whether the individual can perform the work he or she 

did in the past or any work in the national economy. Nevertheless, we reported in 2012 that the DOT 

contains outdated information and has not received a major update since 19771 

SSA initially planned to replace the DOT by developing its own database of occupational data. However, 

in response to a recommendation in our 2012 report, SSA opted to pursue a less ambitious, potentially 

more cost-effective approach that leverages existing expertise and survey efforts at the Bureau of Labor 

Statistics (BLS) to develop the DOT's replacement-the Occupational Information System (OIS). This 

change in approach saved SSA $27 million from fiscal year 2011 through fiscal year 2015. In fiscal year 

2015, BLS completed an initial trial of the OIS, including collecting test occupational data from over 

2,500 employers and evaluating new data elements that describe mental and cognitive requirements. In 

fiscal year 2016, SSA completed the first of three years of collecting data to use in the OIS from about 

6,500 employers. SSA plans to collect occupation information from 10,000 employers in both fiscal years 

2017 and 2018, and anticipates having a complete set of estimates based on a total 30,000 employerssufficient to populate its OIS-by the end of fiscal year 2018. SSA estimates it will need to pay BLS $82 

million for its 3-year data collection effort, and plans to fully implement the OIS in early fiscal year 2019. 

Based on a study conducted for SSA, the agency determined that occupational data will remain current 

for 5 to 10 years, and thus plans to continue to update the OIS on a 5-year cycle. Specifically, SSA plans 

to collect data from 10,000 employers for each of the 5 years, and estimates that this first round of 5-

year updates-to be completed in fiscal year 2024-will cost $178 million. 

1 The DOT was updated in 1991, but for less than 20 percent of occupations. GAO, Modernizing SSA Disability 

Programs: Progress Made, but Key Efforts Warrant More Management Focus, GA0-12-420 (Washington, D.C. June 

19, 2012). 
149 

Post-Hearing Questions for the Record 

Submitted to the Honorable John H. Thompson 

From Senator Heidi Heitkamp 

"High Risk: Government Operations Susceptible to Waste, Fraud, and Mismanagement" 

February 15, 2017 

I. On October 18, 2016, U.S. Census Bureau issued a 2020 Census Program Memorandum 

stating that, ''[i]n order to mitigate fi.mding uncertainty risk, and ensure readiness for the 

2018 End-to-End Census Test, the Census Bureau will stop FY 2017 field testing 

operation in ... Puerto Rico and Standing Rock Reservation in North and South Dakota 

and Colville Reservation and Off-Reservation Trust Land in Washington." When the 

Census Bureau speaks of "funding uncertainty,•· was that uncertainty caused by 

Congress's failure to pass an Appropriations Bill 0 

No, the uncertainty was not the result of the Continuing Resolution, but rather was the 

difference between the levels proposed in the FY 2017 President's Budget and the House 

and Senate proposed funding levels. The House and Senate marks from the spring of 2016 

required the Census Bureau to prioritize 2020 Census activities in 2017. After this 

prioritization, the field component of the FY 2017 Census test was not afforded under 

either the House or Senate funding scenario because funds were needed to develop the 

systems and infrastructure needed to ensure a successful 2020 Census. Because neither 

Congressional funding report provided resources to conduct the Congressional priority 

and the field component, the Census Bureau thought it unwise to proceed with an 

expenditure that appeared not to be supported. 

2. In the same October l 8111 memo, it stated that the Census Bureau will "consider" moving 

these field sites to be a part of the 2018 End-to-End Census test. Has the Bureau decided 

whether these field tests will be a part of the 2018 End-to-End test or not? 

We are still considering whether to include the field test sites de-scoped from the 2017 

Census Test in the 2018 End-to-End Census Test. 1 The 2018 End-to-End Census Test 

begins with the address canvassing activity in FY 2017. When we made the decision to descope the Field Tests from the 2017 Test, we also decided not to include them in the early 

operations of the 2018 Test, such as address canvassing, which is scheduled to begin in 

August 2017. 

3. I appreciate the investments the Census Bureau has made in technology, and moving the 

Decennial into the 21" Century. However, I am still concerned that even with the latest 

technologies; there is still a great chance of underrepresented populations falling through 

the cracks if there is not a plan in place to ensure that every citizen is counted in rural 

1 The FY 2018 President's Budget released in May 2017 proposes conducting the 2018 End-to-End Test at only one 

location (Providence, Rhode Island). The dc-scopcd field test sites from the 2017 Census Test arc not included in the 

FY 2018 Presidem·s Budget proposal for the 2018 End-to-End Test. 

*Note: Mr. Thompson retired effective June 30, 2017. These responses arc submitted by the 

Census Bureau. 
150 

America and on Indian Reservations. How will the Census Bureau make sure that Native 

Americans and the other underrepresented populations, who do have access to internet 

and technology, will be properly counted in the 2018 End-to-End Census Test? 

The Census Bureau is deeply committed to ensuring a complete and accurate count of 

everyone living in the country whether or not they have access to the Internet. Households 

will be able to respond via telephone and mail in addition to the Internet. Census Bureau 

mailings will explain how to do so and how to request a paper questionnaire. In addition, 

households identified as unlikely to be connected to the Internet or unlikely to use the 

Internet to respond to the 2020 Census will be proactively mailed a paper questionnaire 

with the first Census mailing; these households account for approximately 20 percent of all 

households in the country. And any household that has not responded after three mailings 

will also be sent or re-sent a paper questionnaire. 

Furthermore, through our Partnership Program, we are working closely with national, 

state, local, and tribal stakeholders that people trust to help communities understand the 

importance of responding to the Census. Census partners are major organizations, like the 

National Congress of American Indians, the National Association of Latino Elected 

Officials, and the National Urban League and community-based organizations like 

churches or other religions organizations, health clinics, and legal offices. Hundreds of 

thousands of Census partners join together during the Census to help people understand 

the importance of being included in the final counts. Working with groups representing 

American Indians and all other populations that are difficult to count is a high priol'ity for 

the Census Bureau. 

In addition, we plan to launch a robust advertising and promotion campaign in late 2019 

specifically targeted to hard-to-count populations. These partnership and communications 

efforts were an important part of our discussions during the 18 Tribal consultations we 

conducted over the past year. We also plan to have a strong on-the-ground presence to 

follow up with households that do not respond to the Census during the Nonresponse 

Followup (NR.Fll) Operation. The location of the on-the-ground workforce is based upon 

our anticipated workload and our knowledge of geographic areas that have a large number 

of hard-to-count populations. Our strategy is to hire locally, so that our interviewers 

understand the communities where they work. Throughout 2020 Census operations we 

will be closely monitoring self-response rates and completion rates during NRFll to ensure 

our workforce is deployed appropriately, and that our data in all areas, including rural 

America and on Indian Reservations, is complete and accurate. 

Post-Hearing Questions for the Record 

Submitted to Hon. John Thompson* 

·From Senator James Lankford 

"High Risk: Government Operations Susceptible to Waste, Fraud, and Mismanagement" 

February 15, 2017 

*Note: Mr. Thompson retired effective June 30. 2017. These responses arc submitted by the 

Census Bureau. 
151 

During the hearing, I raised a question about the possibility of integrating filing the decennial 

census with individual tax returns, which contain similar information and are often processed 

online. 

I) Has the Census communicated with the IRS in any capacity related to collection efforts'1 

2) Has the Census communicated with the IRS about integrating the processes of filing the 

Census with the individual tax rcturns0 

3) Would the integration of these processes be feasible? What efficiencies could be gained 

and what challenges would you face? 

4) Are there any statutory or other impediments to integrating these processes? 

The Census Bureau and the Internal Revenue Service (IRS) have been working closely 

throughout the decade to understand and operationalize the many ways that IRS data can 

be helpful in Decennial Census operations. We arc exploring the possibility of using IRS 

data to shorten the American Community Sun·ey, particularly with respect to the 

questions about household income. For the 2020 Census we already have operations in 

place to usc IRS data to help us reduce the Nonresponse Followup (NRFU) workload. We 

have not looked into the possibility of directly linking responses to the Census to the tax 

returns required by the IRS, and we expect that there would be statutory and data quality 

challenges that we would need to overcome in order to do this. We will explore this with 

the IRS to understand the challenges that we would have to address in order to integrate 

self-response to the Decennial Census with the tiling of individual tax returns. We also 

would be happy to meet with you and your staff to discuss your ideas. 

Post-Hearing Questions for the Record 

Submitted to the Honorable .John H. Thompson* 

From Senator Claire McCaskill 

"High Risk: Government Operations Susceptible to Waste, Fraud, and Mismanagement" 

February 15, 2017 

Census: Counting Populations 

In October 2016, the Bureau announced plans to stop two field tests for FY 2017 to 

mitigate risks from funding uncertainty. Two field tests, one which would have been conducted 

in tribal lands of Washington, North Dakota, and South Dakota, and the other in Puerto Rico, 

were cancelled. These planned field operations were to test the Bureau's mail out strategy and 

Nonresponse Followup (NRFU) and the Spanish versions of software and systems, respectively. 

I. In light of these cancellations, does the Bureau have a plan in place that will protect these 

vulnerable populations from being undercounted in the 2020 Census? 

The Census Bureau is deeply committed to ensuring a complete and accurate count of 

everyone living in the country. We have carefully selected our test sites since 2013 to 

*Note: Mr. Thompson retired effective June 30, 2017. These responses are submitted by the 

Census Bureau. 
152 

ensure that they include bard to count populations so that we could thoroughly test our 

language program and ensure that households that speak languages other than English, 

including Spanish, are effectively enumerated in the self-response and Nonresponse 

Followup (NRFU) Operations. In the 2020 Census households will be able to respond via 

telephone and mail in addition to the Internet, and we will be testing these operations in the 

2018 End-to-End Census Test. Households identified as unlikely to be connected to the 

Internet or unlikely to usc the Internet to respond to the 2020 Census will be proactively 

mailed a paper questionnaire with the first Census mailing; these households account for 

approximately 20 percent of all households in the country. And any household that has not 

responded after three mailings will also be sent or re-sent a paper questionnaire. 

Furthermore, through our Partnership Program we are working closely with national, 

state, local, and tribal stakeholders that people trust to help communities understand the 

importance of responding to the Census. Census partners are major organizations, like the 

National Congress of American Indians, the National Association of Latino Elected 

Officials, and the National Urban League and community-based organizations like 

churches or other religions organizations, health clinics, and legal offices. Hundreds of 

thousands of Census partners join together during the census to help people understand 

the importance of being included in the final counts. Working with groups representing 

populations that arc difficult to count is a high priority for the Census Bureau. 

In addition, we plan to launch a robust advertising and promotion campaign in late 2019 

specifically targeted to hard-to-count populations. We also plan to have a strong on-theground presence to follow up with households that do not respond to the Census during the 

NRFU Operation. The location of the on-the-ground workforce is based upon our 

anticipated workload and our knowledge of geographic areas that have a large number of 

hard-to-count populations. Our strategy is to hire locally, so that our interviewers 

understand the communities where they work. Throughout 2020 Census operations we 

will be closely monitoring self-response rates and completion rates during NRFU to ensure 

our workforce is deployed appropriately, and that our data in all areas, including rural 

America and on Indian Reservations, is as complete and accurate. 

Census: Contracts 

ln the lead up to the 20 I 0 count, the Bureau experienced significant challenges with a 

contract that was critical to the success of the 20 I 0 Census. Shortly before the count began, the 

Bureau's plan for acquiring handheld devices had to be scrapped, and the Bureau reverted back 

to a paper and pen operation. costing taxpayers millions of dollars. Jn August 2016, the Census 

Bureau awarded a large technical integration contract ($887 million) toT-Rex Corporation. 

2. Does the Bureau have Contracting Of1icer Representatives in place at contracting sites to 

provide management and oversight of contracts and to make certain that contractors are 

meeting deadlines and goals? 

a. lf so, how many arc currently working at these sites? 

*Note: Mr. Thompson retired effective June 30, 2017. These responses arc submitted by the 

Census Bureau. 
153 

Yes. There are a total of 25 Contracting Officer Representatives (COR) working on the 

2020 Program at this time. We have one COR on site at the facility managing the T-Rex 

Technical Integration Contract, and one COR on site for the General Dynamics 

Information Technology Census Questionnaire Assistance Contract. The remaining 22 

CORs work at Census Headquarters assisting the Decennial Contract Execution Office 

with the management of all of our Decennial contracts. 

We also have two Contracting Officers (CO) dedicated to the major IT contracts, and we 

work closely with another 5 COs and 10 Contract Specialists in our Acquisitions Division 

who assist us with the management of our other Decennial contracts. 

Census: Open GAO Recommendations 

GAO placed the 2020 Decennial Census on the High Risk List for 2017 because the cost 

of the Census has been escalating. The 2010 Census cost approximately $12.3 billion and 

resulted in several billion dollars in cost overmns. While the Bureau is planning innovative 

changes to help save $5 billion compared to the 2010 Census, these new technologies come with 

added risks. GAO has made 30 recommendations in this area, but reports that only 6 have been 

implemented by the Bureau. 

3. What progress has the Bureau made to close out the remaining open recommendations? 

4. Will these recommendations be closed before the 2018 End-to-End Test? 

\Ve have action plans in place to address each of the recommendations we have received 

from GAO. While we have closed six of the 30 recommendations they have made in this 

area, we have completed the action plans for an additional14 recommendations. GAO is 

currently reviewing each of these, and we are working with GAO to understand if there are 

additional steps that we need to take to close them out. We have determined that three of 

the 30 recommendations are duplicates. Of the remaining seven recommendations, action 

plans have not been completed for three, and the remaining four have action plans that arc 

scheduled for completion between now and the end of2018, after the 2018 end-to-end 

Census Test is complete. 

*Note: Mr. Thompson retired effective June 30, 2017. These responses are submitted by the 

Census Bureau. 
154 

"AR 2 8 2917 

DEPARTMENT OF VETERANS AFFAIRS 

INSPECTOR GENERAL 

WASHINGTON DC 20420 

The Honorable Ron Johnson 

Chairman, Committee on 

Homeland Security and 

Governmental Affairs 

US. Senate 

Washington, DC 20510 

Dear Mr. Chairman: 

Enclosed are the Office of Inspector General's (OIG) responses to questions received 

following the February 15, 2017 hearing before the Committee on Homeland Security 

and Governmental Affairs. 

Thank you for the opportunity to testify at the hearing and we request that this letter be 

included in the hearing record. Thank you for your interest in the OIG. 

Enclosure 

Copy to: The Honorable Claire McCaskill, Ranking Member 

Committee on Homeland Security and Governmental Affairs 
155 

Post-Hearing Questions for the Record 

Submitted to the Honorable Michael Missal 

From Senator Claire McCaskill 

"High Risk: Government Operations Susceptible to Waste, Fraud, and 

Mismanagement" 

February 15, 2017 

VA: Leadership Commitment 

In addition to Government Accountability Office (GAO) reports on VA health care 

facilities, the VA Office of Inspector General (VA OIG) has issued numerous reports on 

facilities failing to provide timely health care for our veterans. These delays in health 

care are extremely harmful for our veterans who are in desperate need of care. 

1. How many of VA OIG's recommendations to the VA regarding delays in access to 

health care remain open? 

VA OIG Response: As of March 6, 2017, we identified 13 OIG reports (this includes 

reports by the OIG's Office of Audits and Evaluations and OIG's Office of Healthcare 

Inspections) related to access to care. A listing of those reports is attached. From 

those reports, 37 recommendations remain open. 

a. What action has the VA taken to respond to these recommendations? 

VA OIG Response: VA provides action plans for OIG recommendations during their 

review of the draft report. They are responsible for the action plans and they 

determine the time table for implementation. Our follow-up process is structured to 

request updates every 90 days. After VA submits information to close a 

recommendation, the team that worked on the report reviews and makes a 

determination if that information or evidence is responsive. 

The VA submitted an action plan to GAO outlining how it plans to address the five areas 

of concern that caused its placement on the High Risk List 

2. Did the VA submit a similar action plan to the VA OIG on how it will address open IG 

recommendations regarding delays to access in health care? 

VA OIG Response: As stated above, VA provides information on their 

implementation plan and time table during their review of OIG draft reports. We 

include VA's comments in the every OIG report. 
156 

Access to Agency Documents 

In December 2016, President Obama signed into law the Inspector General 

Empowerment Act, which expands the responsibilities and strengthens the 

independence of the Offices of Inspectors General from agency heads. The law also 

ensures that our IGs have greater access to documents and witnesses in order to 

effectuate their work. 

3. How will this legislation make VA OIG's job to ensure accountability in government 

easier? 

VA OIG Response: The exemptions of the Inspector General Empowerment Act will 

allow us to complete data analyses of matched computerized data without a 

time-consuming, formal computer matching agreement. The data analysis will give 

us new tools to help us find fraud, waste, and abuse in VA programs. It will also 

allow us to conduct a survey of those affected by VA programs within the timeframe 

of our audit report process. Surveys will help us to understand and report on the 

impact on veterans, veterans' families, VA contractors, and other members of the 

public affected by problems with VA programs uncovered in our audit work. 

4. Will you provide regular reports to this Committee on instances where VA officials 

refuse your oversight and investigative requests? 

VA OIG Response: The VA OIG is committed to keeping the Congress currently 

informed of issues related to information access with VA. 

2 
157 

VA OIG Reports with Open Recommendations Regarding Delays in Access 

~-Report Title----·-----··-] Issue Date I Number of Open-~· 

h- _ : Recommendations 

l 1 .. Review of Alleged Patient ! August 26, 2014 I 1 -

I Deaths, Patient Wait Times, and I ' I . Scheduling Practices at the Phoenix , I' rr ~:~!~c;~-l~~1~n-~ Alle-ged --hune 11, 2015-- --------1----- j 

: Magnetic Resonance Imaging Order i 

1

. 

I 

Deletion and Record Destruction, I 1 

VA Greater Los Angeles Healthcare : l ~ys~~~~t~~~~!~!~ti~~~for~--+:Jurie17,- 2015-·- 1 --------1---------j 

: Mismanagement of Mental Health I 1 ' 

I 

Consults and Other Access to Care . I 

1 Concerns, VA Maine Healthcare I I 1 

~~ys~~~ti~~~~~P~~tion-_----~.-January 14:·2016 --r-----1--~ j ~mergency Department Concerns. , : L \ ·~Central Alabama VA Health Care 1 ! 

?ystef!l.._ Mon_tgQ.f!l_ery,_.61_abama -=-+-- .. __ ___j : · 5. Healthcare Inspection- Veterans 

1 

February 11, 2016 i 1 I 

I 

Crisis Line Caller Response and \ I 

Quality Assurance Concerns 

Car~andaigua, New_York _____ j' _ _j 

Healthcare Inspection- Alleged May 3, 2016 2 I 

proper Management of I 1 Dermatology Requests, Fayetteville II J 

l VA Medical Center, Fayetteville, 

North Carolina R~ort___ ----L-- _ ______ _ ---------1 

7. Review of VHA's Alleged 1 June 20, 2016 2 

I Manipulation of Appointment i 

j ~=~~=l!ationsatVAMC Housto~ 

8.-Healthcarelnspection - Reported : August 11. 2016 · 

Primary Care Staffing at St Cloud 1

1 

VA Health Care System, Veterans 

Integrated Service Network 23, I ~f@l'l_, ,._,.,inn_~sota _ ___ _ ----i--c:--

,l, 9. Healthcare Inspection- Review 1 August 11, 2016 

, of Primary Care Ghost Panels, I 

I Veterans Integrated Service : 

Lt-Jetw?_rls_~;L Eag~J'.f1ir'1_n~SSJta __ l _______ _ 

~ 

! 

1--------:----··· ~· ·~ 

j__ J 

3 
158 

VA OIG Reports with Open Recommendations Regarding Delays in Access 

! Report Title- ·-----···-----~--Issue- Date- I Number of Open 

k ! 10. Review of Alleged Consult ! 

, October 4, 20H3--~~~~~~~ -- 9 -- I 

l~~sa~~-~;r~~~:t :~the Phoe:':_vA _\ __________ ···-~--···----·-··----~~ j11. Healthcare Inspection - Review r December 13, 2016 I 1 I 

of Complaints Regarding Mental I I 

Health Services Clinical and 

Administrative Processes VA St. , I 

1 

Louis Health Care System St. Louis, I ~ 

r..::rcc.;...::::..:c-:=-· ~-=-~:::..~~:::::cc.~a=o:§>_t~-eh_-~_i!e~~~~=-~-0-" m 1 J"""~"'~3-_o._2_o_-1_7 ___ t-·-------==---~===-~--_j 113. Audit of Veteran Wait Time Jl March 2, 2017 10 1 

: Data, Choice Access, and Consult • 

It t-,.1anag€lr:nent in\jiSN _§_ _____ .. ~---···· ____ _1_ _____________ _ .. ·-·····-- ···-·-·------- T()!'!!__ __ ~ ____ L ___ E:_ __ _ 

4 
159 

Post-Hearing Questions for the Record 

Submitted to the Honorable .John Roth 

From Senator Claire McCaskill 

"High Risk: Government Operations Susceptible to Waste, Fraud, and Mismanagement" 

February 15,2017 

Executive Orders Process and Implementation 

There are conflicting reports regarding communication between the White House, 

Congress and the national security agencies including Department of Homeland Security (DHS) 

regarding President Trump's Executive Order, ·'Protecting the Nation from Foreign Terrorist 

Entry into the United States." 

I. Many agencies include their Inspector General as part of the departmental clearance 

process. What role if any did your ot1ice have in reviewing or clearing this document 

before it was issued by the President0 

Answer: We did not play any role in reviewing or clearing Executive Order. "Protecting the 

Nation from Foreign Terrorist Entry into the United States." As a matter ofOIG policy, we do 

not review or clear Department or Administration policies before they arc released, as we believe 

that such action would be an impermissible participation in the management of the Department, 

and thus against government auditing standards. 

I recently wrote you to request that you investigate whether and how DHS and U.S. 

Customs Border and Protection (CBP) were involved in the development of the President's 

Travel Ban and how DHS and CBP are implementing the Executive Order. 

2. Will you commit to report your findings truthfully regardless of what criticism you may 

face from the administration? 

Answer: As previously announced, our office has initiated a review ofDHS' implementation of 

the EO. The review is focused on the manner in which the EO was implemented by the 

Department tl-om the time the EO went into effect until it was stayed by federal court orderand will not review events prior to implementation, including development of the EO. As with 

all our work. \VC are committed to publishing accurate findings without concern for how those 

findings may be received by efTected or interested parties. 

Since the President issued this executive order, he has issued several others that also 

require the need for Dl-IS' implementation. 

3. Has your o!Tice looked into how these Executive Orders were developed and arc being 

implemented') 
160 

Answer: Yes, we have initiated several reviews that will touch on various aspects of the 

Department's implementation of the President's Executive Orders. For instance, one review will 

assess the Department's human capital strategies and management capabilities to determine 

whether the Department has the necessary mission support framework and hiring processes in 

place to quickly and ctTectively hire 15,000 law enforcement onicers. This review will compile 

and review open source literature, oti1er government reports, and prior work of our otTicc to help 

the Department and its components avoid previously identified poor management practices and 

their negative impacts. Subsequent audits will address the collateral impact hiring 15,000 agents 

and ol1icers will have not only on other Departmental components, but also on other Federal 

agencies. Another review will look at the Department's use of polygraphs in the hiring process 

and will specifically address CBP's proposed changes to its hiring requirements and standards to 

meet its new hiring obligations. A third review will identify lessons learned from prior work on 

CBP's 2005 Secure Border Initiative and make recommendations aimed at helping CBP avoid 

the pitfalls of the past. 

Dl!S: Leadership Commitment 

DIIS OIG has raised very similar concerns about the DHS's management challenges as 

those identified by Government Accountability Office (GAO). Your November 2016 memo to 

then-Secretary Jeh Johnson regarding the Department's "Major Management and Performance 

Challenges Facing the Department of Homeland" noted that while DHS has made '·significant 

progress" over the last three years ·'the Department continues to face long-standing, persistent 

challenges overseeing and managing its homeland security mission" including preventing 

terrorism and protecting our borders. 

According to the Department's written response to DHS OIG's management challenges 

report, the Department's '·Unity of Effort Initiative" was designed to break silos and "to 

centralize senior decision-making at DHS.'' 

4. What steps should Secretary Kelly take to build on progress made by former Secretary 

Johnson to address areas where the Department has traditionally struggled? 

Answer: The steps the prior leadership took to increase Unity of Effort were very important, and 

extended over a number of areas of the Department's operations. These have benefited the 

Department and created efficiencies and synergies that would not have otherwise existed. 

However, the key to maintaining these improvements is constant vigilance and efTort to ensure 

that the Department moves forward as a single entity. To do otherwise will result in a return to 

DIIS consisting of a number of siloed organizations, each operating independently of each other. 

The new leadership should prioritize DHS' acquisition management, an area where increased 

.. unity of effort" would pay dividends for the Department. Since its inception in 2003, DHS has 

spent tens of billions of dollars annually on a broad range of assets and services-- from ships, 

aircraft, surveillance towers, and nuclear detection equipment to IT systems for financial 

management and human resources. However, the Department's lack of uniform policies and 

procedures, a dedicated core of acquisition professionals, and component commitment to 

departmental acquisition guidance, adequately define requirements, develop periormance 

2 
161 

measures, and dedicate sutTicient resources to contract oversight has resulted in inefficiencies 

and wasteful spending. In 2017, our audit work will evaluate DHS' progress in the area of 

acquisition management, with an emphasis on '"unity of effort." 

Beyond acquisition management, our work in 2017 will look at ··unity of effort" in other areas as 

well. For instance, we have ongoing work to determine whether DHS fosters collaboration and 

unity of effort Department-wide to et1force and administer immigration policy. We are also 

evaluating the extent to which DHS' Joint Task Forces etTectively coordinate DIIS assets and 

personnel, and whether they achieve expected results. Based on our findings, we will make 

concrete. practicable recommendations to the Department that will assist the Secretary in his 

efforts to build on the good work statied by his predecessor. 

DHS: Lack of Acquisition Management 

Another management challenge that your office identified relates to the Federal 

Emergency Management Agency's (FEMA) management of its grant making process which 

awards an average of about $10 billiJn in disaster assistance grants each year. 

DHS IG audits in 2015 found approximately S457 million in questioned costs, such as 

duplicate payments, unsupported costs, improper procurement practices, and unauthorized 

expenditures. 

5. What steps does FEMA need to take to address the deficiencies in its grant making and 

oversight processes? 

Answer: FEMA awards an average of about $10 billion each year in disaster assistance grants 

and preparedness grants. Our body of work over the past few years suggests that FEMA has not 

managed recovery from disasters well. Although FEMA provides grant management funding to 

grantees, FEMA has not held them accountable for managing sub grantees, and states and other 

grantees have not done well in guiding and managing sub grantees. This means the entire layer of 

oversight intended to monitor the billions of dollars awarded by FEMA in disaster assistance 

grants is inet1ective, inetlicient, and vulnerable to fraud, waste, and abuse. As you noted, of the 

S 1.55 billion in disaster grant funds we audited last year, we Cound $457 million in questioned 

costs, such as duplicate payments, unsupported costs, improper procurement practices, and 

unauthorized expenditures. This equates to a 29 percent questioned-cost rate, which far exceeds 

industry norms. and it illustrates FEMA's continued failure to adequately manage grants 1 

We also saw examples of inadequate grant management in preparedness grants. In an 

overarching audit of OIG recommendations related to preparedness grants, we reported that 

FEMA had not adequately analyzed recurring recommendations to implement changes to 

improve its oversight of these grants. This occurred because FEMA did not clearly communicate 

1 

.\11n:mu:~\ (//1,_/J\:' r !il(il!i,'-.',' 

(November 2016). 

3 
162 

internal roles and responsibilities and did not have policies and procedures to conduct 

substantive trend analyses of audit recommendations 2 

In general, FEMA has not sufficiently held grant recipients financially accountable for 

improperly spending disaster relief funds. As of September 27, 2016, FEMA had taken 

sufticient action to close 130 of our 154 FY 2015 disaster grant audit report recommendations. 

However. the 24 recommendations that remained open contained 90 percent ($413 million) of 

the $457 million we recommended FEMA disallow that grant recipients spent improperly or 

could not support. Further, in FY s 2009 through 2014. FEMA allowed grant recipients to keep 

91 percent of the contract costs we recommended f(Jr disallowance for noncompliance with 

Federal procurement regulations, such as those that require opportunities for disadvantaged 

firms (e.g .. small. minority, and women-owned) to bid on federally funded work3 

I3ased on our recurring audit findings, it is critically important that FEMA officials examine 

regulations, policies, and procedures and assess the need for more robust changes 

throughout all grant programs. FEMA should refocus its efforts to identify systemic issues 

and develop solutions to address the cause and not just the symptoms. FEMA needs to 

improve its oversight of state grantees and proactively engage with states to improve 

management and guidance of sub grantees. 

Outstanding IG Recommendations 

In March of20 16. DHS OJG identified outstanding OIG recommendations that have 

remained open for more than six months. These recommendations were numerous and wideranging from information technology management to staffing concerns. 

6. Are any of the recommendations that DHS OIG reported on in March 2016 still open? 

a. If so, which ones? 

Answer: Yes, of the 583 open recommendations we reported in March 2016,252 are still open 

(sec Enclosure 1, DHS OIG Open Recommendations). 

7. As of today, how many OIG recommendations have been open for more than six months? 

a. f lave you been given a timeline for their completion? 

Answer: As of Fcbmary 15, 2017. 387 recommendations have been open Jor more than six 

months. We have been given a timeline for all but five recommendations: OIG-13-110, #9; O!G15-18, #6, #15, #16: and 010-16-51, #4 (see Enclosure 2, DHS OIG Open Unresolved 

Recommendations). 

4 
163 

Cvbcr: Russian Hacking 

Election infrastructure was designated by the previous administration as critical 

infrastructure and Secretary Kelly indicated that he supports the designation. Although political 

parties' infrastructure would not be included in that definition, we do know that the Democratic 

National Committee and Republican National Committee's systems were hacked by Russia and 

that information from them was used in an attempt to influence our most recent election. 

8. Do you believe that adequate security mechanisms are in place at DHS to prevent Russia 

or another foreign actor from gaining access to government systems that are part of our 

election infrastructure? 

a. What more can be done'? 

Answer: To date, we have not done work reviewing the security mechanisms in place at DHS to 

prevent Russian, or any other actor, from gaining access to government systems that are part of 

our election infrastructure. The Secretary of DHS recently designated the electoral system as 

"critical infrastructure," which gives election equipment the same status as the power grid or the 

financial sector. Under the new designation, states that request cybersecurity assistance can 

receive swifter access to threat intelligence and be able to pm1icipate in joint defense exercises. I 

am also aware of proposed legislation which would codify this designation, as well as 

establishing security standards for voting machines. To date, we are unaware of any action the 

Department has taken as a result of this designation, but we will monitor and do future work as 

needed. 

9. What steps has DHS taken to prevent Russia or another actor from interfering with our 

electoral process in the future? 

Answer: Sec above. 

Access to Agency Documents 

In December 2016, President Obama signed into law the l nspcctor General 

Empowerment Act, which expands the responsibilities and strengthens the independence of the 

Oflices oflnspectors General from agency heads. The law also ensures that our lOs have greater 

access to documents and witnesses in order to effectuate their work. 

10. How does this legislation make your job to ensure accountability in government easier? 

Answer: We could not accomplish our critical mission without unfettered access to the 

information we need, and legislation like the Inspector General Empowerment Act of2016 is 

essential to our work. For instance, Section 2 of the Act vastly enhances our ability to ferret out 

fraud, waste, and abuse using proactive data analytics by exempting O!Gs from certain 

requirements under the Computer Matching and Privacy Protection Act of 1988 and the 

Paperwork Reduction Act. Any legislation that increases our access to information, or expands 

5 
164 

our resources to permit us to do more work, will necessarily result in improved government 

efficiency, effectiveness, and integrity. 

11. Will you provide the Committee with regular reports of any instances where DHS 

officials refuse your oversight and investigative requests? 

Answer: Yes. 

6 
165 

Post-Hearing Questions for the Record 

Submitted to the Honorable John Roth 

From Senator Kamala D. Harris 

"High Risk: Government Operations Susceptible to Waste, Fraud, and Mismanagement" 

February IS, 2017 

1. You stated that ''the Department [of Homeland Security] will face a number of challenges 

in executing the president's executive order directing the department to hire an additional 

5,000 border patrol agents and 10,000 immigration officers." As evidence of this, you 

stated that: "In Fiscal Year 2015, for example, it took an average of282 days over 9 

months to hire a border patrol agent measured from the time the job announcement closed 

to the date the applicant was actually hired." You called this an "unacceptable level of 

performance.'' 

a. What would you deem an ''acceptable level of performance" in relation to DHS's 

hiring the 15,000 additional ICE and CBP officers mandated by President 

Trump's executive order? What would be the minimum "acceptable" time lapse 

between when a job announcement closes and when an applicant is actually 

hired? 

Answer: To determine an acceptable level of performance for hiring the 15,000 additional 

personnel needed to comply with President Trump's Executive Order (EO), DHS, CBP, and 

ICE Jirst need to review each step in the law enforcement hiring process, set realistic timing 

goals for each step, and then work to meet those goals by improving efficiency while 

maintaining the integrity of the process. In our October 2016 report, DHS is Slow to Hire 

Law Enjilrcemen/ Personnel, we concluded that the Oftice of Personnel Management's 

recommended 80-day time-to-hire goal is unrealistic for law enforcement applicants given 

that there are several unique, time-intensive steps specific to law enforcement hiring. Yet, 

neither DHS nor CBP has established their own internal time-to-hire goals for law 

enforcement personnel, and while ICE has set internal goals. it does not always meet them. 

To address this issue. we recommended that CBP and ICE establish reasonable hiring 

timcframes that account for all steps in the law enforcement hiring process. In response to 

our recommendations, CBP indicated it would establish timeframes by June 30, 2017, and 

ICE plans to have timeframes by August 30, 2017. 

While our report was published before the EO was issued, we believe that compliance with 

our recommendations will enable DHS, CBP, and ICE to properly plan for the hiring surge. 

b. 

What will it take, at a minimum, for DHS to get from its present state of hiring 

performance, to what you deem the minimum ''acceptable" time lapse between 

job announcement closure and hiring? 

7 
166 

Answer: We have identified several steps that CBP and ICE should take to improve the 

et1iciency of its Jaw enforcement hiring process. including: 

• Prioritizing and dedicating full-time human resources. investigative, and/or 

polygraph personnel to help process law enforcement applicants: 

• Automating the tracking of applicants through the entire Jaw enforcement hiring 

process: and 

• Establishing performance measures to accurately determine the long-term effect 

of process improvements. 

In response to our recommendations, the Department has taken the initial step of improving 

its time-to-hire data collection and reporting. Within the next few months, the Department 

also intends to complete an analysis of the timeframes for common phases in the hiring 

process and establish department-wide hiring performance measures. Further. in Fiscal Year 

(FY) 2017. ICE plans to hire 44 additional staff members to assist with law enforcement 

hiring in connection with the hiring surge, and is currently exploring various case 

management systems to track applicants during the hiring process. And, as noted above, both 

CBP and ICE are working to establish reasonable time-to-hire goals that account for all steps 

in the law enforcement hiring process. 

c. What specific measures will you undertake as IG to monitor DIIS's hiring process 

improvements? 

Answer: As part of our normal process, we will continue to track the implementation of 

recommendations from our report, DHS Is S/o"w to !!ire Law Enforcement Personnel. We have 

also initiated one of a series of audits on human capital strategies and management capabilities to 

ensure the Department has the necessary mission support framework and hiring processes in 

place to quickly and effectively hire a qualified and diverse workforce. These audits may lead to 

further recommendations to improve the hiring process. 

2.1 am concerned, as you may remember, about the impact a hiring surge will have on the 

quality of applicants. You stated that "'the last time CBP had a hiring surge, there was a 

concern about the level of quality that they were getting and as a result, for example, that's 

when Congress stepped in and instituted mandatory polygraphs, for example.'' 

a. Since the time of your testimony, reports have emerged of a DHS memorandum 

calling for a reduction in the hiring standards required for CBP officials, so as to 

meet President Trump's hiring mandate 4 Do you believe that it is necessary to 

loosen the hiring requirements for CBP officials? 

4 Trump Administration Seeks to Loosen Hiring Requirements to Beef Up Border Patrol. Foreign Policy, Feb. 25, 

2017 (online at: http ~,1m 20! 7 U2 2~ trumrh_t_dm~n_l_~_tration-:;-:.::k~-to-1\)0St.:!l~hiring-r..::qui.r~'!llcnts-to8 
167 

Answer: At this time, we would not recommend that CBP "loosen" its hiring requirements and 

standards. Not only do CBP's proposed changes fail to achieve the goal of shortening the hiring 

process-our preliminary work suggests that the changes might actually lengthen the processbut they also increase the risk that unsuitable candidates may be hired. CBP needs to evaluate all 

steps in its hiring process, not just the polygraph exam, to identify steps that can be made more 

efticient without sacrificing integrity and etTectiveness. We have ongoing and planned audit 

work in this area that will focus on highlighting inefficiencies in the process and recommending 

process improvements that do not require a loosening of requirements and standards. 

ii 

If you answered "yes" to the above, how do you believe the Department 

can loosen hiring requirements while also protecting maximally against 

the infiltration of criminals and other unqualified candidates into the 

border and interior immigration enforcement corps" 

lfyou answered "no" to the above, how will you monitor the Department 

to ensure that it is not loosening hiring requirements in any way to 

expedite their hiring requirements, and instead retaining the lessons 

learned from the last CBP hiring surge, as documented by the Government 

Accountability Oi1ice?5 

AJ1Swcr: Through our ongoing and planned work, we intend to help DHS apply lessons learned 

and improve the efficiency of the hiring process while maintaining its integrity and ef!Cctiveness. 

We are currently conducting an audit to assess the adequacy of the Department's internal 

controls over polygraph and complaints processes (including processes at TSA, Secret Service, 

ICE, and CBP). Given the serious and time-sensitive nature of this issue, we are also planning to 

issue a public statement in the coming weeks that will discuss some risks we recently identified 

during the course of our ongoing work in this area. 

iii 

Answer: Yes. 

Will you commit to monitoring the polygraph and entrance exam 

requirements for CBP officials to detect any changes made moving 

forward') 

3. During your testimony on February 15, 2017, you stated that you couldn't '·really commit 

as when we're going to get the first product out there that will sort of descrihe what the 

Department is doing" as to its hiring process. Since that time, reports have emerged of an 

internal DHS memorandum that specifically called for a hiring increase from 19,627 

5 Additional Actions Needed to Strengthen CBP Efforts to Mitigate Risk of Employee Corruption and Misconduct, 

Government Accountability Office, GA0-13-59, Dec. 2012. at 17, Table 6 (online at: 

l111p, 1}60 (~5~l~O~.n(tJ). 

9 
168 

Border Patrol ot11cers to 26,370 officers, over a five-year period, costing $2.2 billion. 6 

That memorandum is dated February 17, 20177 

a. Do you believe that when you testified on February 15, 20 !7 before the Senate 

Homeland Security and Government Accountability Committee you had been 

given complete information as to DHS's hiring plans, given its detailed internal 

memorandum about hiring plans that was dated just two days later? 

Answer: My response at the hearing was focused on the timing ofDHS OJG work product, 

rather than the timing of DHS's hiring efforts. Typically, our audits arc retrospective in nature, 

so we do not open an audit and issue a report on a particular program or initiative until it has 

been in operation for some time. This enables us to provide a more comprehensive assessment of 

the program, from planning, to implementation, to cfTcctivencss over time. Regarding the 

particular memorandum you referenced, I have no reason to believe the Department made any 

effort to deliberately withhold this information li·mn the OJG. 

b. 

What specific measures will you take to ensure that moving forward, the 

Department you must hold accountable is giving you a full and transparent picture 

of its hiring plans? 

Answer: The lnspec/or General Act ofl978 gives us unfettered access to any and all information 

relevant to our work. In general, the Department has historically provided us with prompt access 

to the information and documents we have requested. We will continue to insist on nothing less 

than full cooperation from the Department moving forward, including in our ongoing and 

planned work on DHS' hiring efforts. 

4. During your testimony on February 15, 2017, yon stated that "in about three months we're 

going to know a lot more about what the Department's [hiring] process is" and that you'd 

be "happy to brief anyone on the [HSGAC) committee who would like to hear about it." 

a. 

Answer: Yes. 

b. 

Will you commit to providing a briefing to HSGAC on what you have learned 

about the Department's hiring plans no later than May 15, 2017? 

In the interim, what spccitic measures will you be taking to have routine access to 

DHS's hiring plans as they evolve, with the aim of preventing, rather than 

responding to, errors in the hiring process that may put the country, to say nothing 

of the Department's own mission, at grave risk? 

Answer: In the course of our work, we will request the information necessary for a thorough 

review, and we expect DHS to be transparent in providing needed, up-to-date information, which 

will ultimately benetlt its processes, operations, and programs. 

;:; Trump Administration Seeks to Loosen Hiring Requirements to Beef Up Border Patrol, Foreign 

2017(onlincat: '01 

10 
169 

5. During your testimony you noted that additional time, beyond just that expended during the 

hiring process itself~ is necessary to produce a fully functioning immigration oHicial, 

noting that "of course, there's training and all sorts ofonboarding that would have to go 

on" before an individual is truly ready to serve as an ICE or CBP official. 

a. Can you confirm to this Committee that you will be tracking DHS's training and 

onboarding processes, to ensure that at a minimum, given staffing pressures, their 

training and onboarding processes are not diminished? Specifically, can you: 

i 

ii 

iii 

Track the intervals at which ICE and CBP officials are receiving training; 

Audit the type of training and onboarding ICE and CBP officials are 

receiving; and 

In the service of these tracking efforts, obtain copies of the curricula used 

for training and on boarding, and provide them to this Committee? 

Answer: Although we have no current plans to review the training of!CE and CBP personnel 

specifically. we will very likely examine this issue as part of our upcoming series of audits 

on DHS' human capital strategies and management capabilities. These audits will assess 

whether the Department and its components have the human capital strategies in place, as 

well as related capabilities, to quickly and effectively hire a highly qualified and diverse 

workforce. We would be happy to brief the Committee on the design and scope of these 

audits upon request. 

11 
170 

I~ I~ 

I! 

II 

11 

ll 

I~ 

!l 

I~ I~ II 
171 
172 

I 

I~ I~ I~ 

I~ I~ 
173 
174 
175 
176 
177 

ill 

H 

HI], IJ ' ll I§ J IJ ] 

~' .P 

1 j :c I~ 

: " 

II li ll! t 

' 

1 !l { 

~ 

~ ~ 

It ] 

ll :."i ' ~ 

~ 'i 1 

:!l ! i .g 

~~ 11 ll .¥. 

~ 

II ~ ~. 

i! 

~~ I~ 1! !j !I ]j li I] J1 ] .~ 11 11 l ~ '~ 

" 

II~ I~ ~~ I~ ~~ 

I~ ~~ I~ 

If 1

II ll l1 II l 

u il 

"" c ~H 
178 
179 
180 

~l 

H 

HI~ I~ ll ' IJ, 1l 

j ], ~ f 

l~ F '~. le 

i . lo .· " 

~ li f IL li ~ 

il 

5' 

!J I i f ~ 

~ ~ §. 

I! 

f 

ll 

"' 

I! il ~ u I~ ' 3~ 

: .· ~ 1 

..5 ~ 

! I~ ~~ I~ !l j ;;.S ~ lii 

\] 

~~ jj 

I! 1~ ] ~ ~ ~s e i<i0 

.· .. · ~ s lit ~! g~ _g I~ ~ ~ ~~ H IW ~ g 

§ ~ ~ j ]t H ~ ~ 

. ~e 

I~ I~ I~ lc lc I' I~ 

I' l I~ 

II )j C:2 ~ 

:f ~ 

llil 

o::: ~ 

~ ~ i I~ :6,] 

~1 ll IHI 

ii 

~~ a II 

il 2 ' ll 
181 
182 

;;r .? ? ' 

~ 
183 

!I~ !~ 

I~ 

H 

}!IJ 11 ~ ll ~ j ]. I~ J, J 

~J ~ 

~. 

-

,. 

li _] 

~" 

II 

.s ' ~ 

l 

ll II 

J[ ~ 

! 11 ~ 

~ 

' li H 

J ~ I~ 

II IL I~ 5<:; 

~ ' jj i! ~ 

It 

1 ~ci 

I! ~~ 2~ ~ c C3 J. " ~ ~ ~ ,s~ !I ~ '5!1 ..;,; I~ ~ ~ ~ ~ 

II Hi ~ ~ .5 

~ ~ ~ ~ ~ ~ 

' ,;;gj ~., 

I~ I~ 1¥ 1:· 1: I~ l'i 

I' IJ li H ~ j 

!j u j ~. 

11 8 

ill 

'"' ~ 

j~] t) iil ] I~ !H 

}] ~l ~'2 3' ~ f ;',;} .<Y lh ~~ ~~ 
184 
185 

ll 

H 

u !J J !J IJ 1 IJ 1l 

< ~' ll ll 

~~ " I~ 

~i ,, 2 . ~ 0 

!~ li I~ g 

~ E ~ if 1 ' #..: -~ IP li <:i!' i n ] }~ ~ ~ r ~~ It ~ ? ~ 

~i ~~ [j 

IJI 

' 

fi ~ 1 H 1 

H ll~ £ 

H ~~ lj i 11 

H 

di r 

G i1 ;::g ]~ ] 

11 

3 ~ .:<.a i1 ! I, il :;§ .,;!i! u e 

If] ~~ 

[]IJ j! H ~ ~ @;;;, 

§ :! ~ j ~ n:: 

~~f ~ ~ 

I~ I~ I~ I~ I~ I~ 

iH 11 I~ 

~~ I~ 

10 10 

l .J.?, 

I! I~ I§ 

!] ] § I" 

~j ~- 1: 

~h ~~ ~ 

~ j] ~ H h ili ljJt iII 

~ Hi 

I~ :; 
186 
187 
188 

f 
189 
190 
191 
192 

!l I 

n 

u} ], IJ 11 II ll 5' I! ' J. 

~J~ I~ ; ~ 

~ 

I! lt ! 1 

!,I ~ 

II li ~ 

ll i ~ ij j ' ! I~ 

·~ ll .:;;. 

11 

' 

I~ lilt i ~ I~ ll ll lh IH [ 

Iii" i l 

I~ I~ I~ I~ I~ I~ I~ I~ I~ 

If I! ~·~ If] ~ .; 

I~ ~~ 

11 

~ ~ 

II ~~ jj I~ t~ 

Ia ! j ..:;~ 

t~ 

H 11 ~ H j ~?: 

i';'< ! ~ 

.· 
193 

I~ ' :t < ~ 

I 

I~ 
194 

-,-----

!I 

u 

}L I I] J IJ l II l II ~, ~' j 

~i 3 

.~ ~ c 

1 

II 

r ~ 

~ li ] l • 4 t;; 

~ 

I~ 2 ' I II " ~ ~ [I H ' ':l 

• \j ~ I! ~ 

11 

i ' ! li F.t;. l ~ 

' ll H 

' ,, l " .~ e 

i I~ J i 4 

' 

~ ~- li 3~ 

l1l l!1 11 

2€ 

ltr IH 11£ 

s,_; 

n ~ }. ~ ~ ~ ; 

J~ I~ ~ I~ § I~ ~ 

iJ 

1l ~ g 

I~ ' ll' H E& 1 I ~ ~ ~ 

G~ 

I] : ~ 

' ll ~ ~ g~ ~1 i %£ 

I! 1:! J ~; ?~ d " ,;j:"· 

~s 

If] ~~ j 

11~ f .§ s 

] ~ 

~ ~ 

i~ ~ ~ ~j ~£ 

1~ -g ~ }j li 

li I" 

I 10 

0 I~ 0 I~ I~ " 
195 
196 
197 
198 
199 
200 
201 
202 

Æ