Project Bioshield: HHS Can Improve Agency Internal Controls for Its New Contracting Authorities
Published: 2009-07-21T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Project BioShield Act of 2004 (BioShield Act) increased the federal government's ability to procure needed countermeasures to address threats from chemical, biological, radiological, and nuclear agents. Under the BioShield Act, the Department of Health and Human Services (HHS) was provided with new contracting authorities (increased simplified acquisition and micropurchase thresholds, and expanded abilities to use procedures other than full and open competition and personal services contracts) and was authorized to use about $5.6 billion in a Special Reserve Fund to procure countermeasures. Based on the BioShield Act's mandate, GAO reviewed (1) how HHS has used its purchasing and contracting authorities, and (2) the extent to which HHS has internal controls in place to manage and help ensure the appropriate use of its new authorities. To do this work, GAO reviewed contract files and other HHS documents, including internal control guidance, which GAO compared with federal statutes and federal internal control standards.
section_title: What GAO Found
paragraphs: Since 2004, HHS has awarded nine contracts using its Special Reserve Fund (Fund) purchasing authority under the BioShield Act to procure countermeasures that address anthrax, botulism, smallpox, and radiation poisoning. HHS may procure countermeasures that are approved by the Food and Drug Administration and ones that are unapproved, but are within 8 years of approval. Of the nine contracts, one was terminated for convenience and the remaining eight are valued at almost $2 billion. HHS officials told GAO that additional contracts are likely to be awarded in the near future as the Fund provides funding through fiscal year 2013. In addition, HHS has used one of its new contracting authorities, simplified acquisition procedures, although it has not used this authority since 2005. HHS has established internal controls on its new purchasing and contracting authorities. In addition to the language in the BioShield Act, which sets up a broad framework of controls over the use of the Special Reserve Fund, the internal controls for this purchasing authority are documented in a variety of internal policy and procedure documents and interagency agreements, which provide guidance on roles and responsibilities for how the controls are to be implemented. In response to BioShield Act requirements, HHS also established internal controls for three of the contracting authorities: the increased simplified acquisition threshold and its use with Special Reserve Funds, the increased micropurchase threshold, and the use of personal services contracts. Federal internal control standards state that, among other things, management needs to comprehensively identify risks, analyze them for possible effect, and determine how risks should be managed. Although some of the risk statements in a memo HHS issued identify some risks and one mentions possible negative consequences that could occur without proper controls in place, the risk statements for using the increased micropurchase threshold and increased simplified acquisition procedures lack analysis of specific risks. In particular, the memo does not discuss a key risk associated with using simplified acquisition procedures--namely, that an agency is prohibited from obtaining cost or pricing data for acquisitions at or below the simplified acquisition threshold. Without this data, the agency may not be able to determine if the price of a contract is fair and reasonable. Moreover, not having adequately documented and appropriately communicated risk assessments potentially results in future employees not knowing or understanding the risks or trade-offs involved in using the authorities. With employee turnover, HHS' reliance on the knowledge of current personnel to appropriately implement key controls will not enable future employees to make sound, informed, and consistent decisions.

section_title: Letter
paragraphs: Following the attacks using anthrax-laced letters in the United States in  2001 and other biological attacks, such as the Sarin gas attack in Japan,  some members of Congress were concerned that the United States was  vulnerable to threats from chemical, biological, radiological, and nuclear  (CBRN) agents and did not have sufficient medical countermeasures to  adequately protect the public from such threats or provide post-exposure  treatment. To address this gap in national defense capability, the Project  BioShield Act of 2004 (BioShield Act) provided the Department of Health  and Human Services (HHS) with the ability to accelerate the research,  development, acquisition, and availability of effective countermeasures  (such as, vaccines, pharmaceuticals, and diagnostics) that are necessary to  respond to an attack involving CBRN agents.
The BioShield Act provided HHS with a number of new authorities,  including four new contracting authorities:    an increased simplified acquisition threshold,    an increased ability to use procedures other than full and open    an increased micropurchase threshold, and   the ability to use personal services contracts.
HHS was also authorized to use funds from a Special Reserve Fund to  procure countermeasures to be added to the inventory of medical supplies  and countermeasures currently stored in the Strategic National Stockpile.  At the time of its establishment, the Fund provided HHS about $5.6 billion  to use over a 10-year period (fiscal years 2004 to 2013), with a spending  cap of $3.4 billion during fiscal years 2004 to 2008. This purchasing  authority expanded the types of medical countermeasures that HHS could  obtain to address threats from CBRN agents to include not only those that  are approved by the Food and Drug Administration (FDA), but also those  that are determined to be within 8 years of approval or which have been  authorized for use under an emergency use authorization. Prior to the  BioShield Act, HHS officials told us that the agency was, in general, only  able to purchase medical countermeasures that were FDA approved.
Based on the GAO reporting requirements in the BioShield Act, this report  examines: (1) how HHS has used its BioShield Act purchasing and  contracting authorities to procure medical countermeasures, and (2) the  extent to which HHS has designed internal controls to manage and help  ensure the appropriate use of its BioShield contracting and purchasing  authorities.
To review HHS’s use of the BioShield contracting and purchasing  authorities, we reviewed legislation and HHS documentation, including  annual reports to the Congress on BioShield and contract files. In  reviewing contract files, we relied on HHS annual reports to the Congress  and statements from officials to identify the contracts awarded by HHS  using the BioShield contracting authorities. We also met with HHS officials  responsible for managing procurement under the BioShield Act. To assess  the internal controls related to the contracting and purchasing authorities,  we reviewed HHS regulations, policies, and other forms of written  guidance and met with HHS officials responsible for internal controls. We  also compared HHS’s internal controls with the Act’s requirements and  other federal internal control requirements and standards. Because HHS  established controls for its new contracting authorities after it awarded  contracts using one of those authorities, and it has not used the  contracting authorities since that time, we limited our review of the  controls to their design.
We conducted this performance audit from February 2009 to July 2009 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
subsections: section_title: Background
paragraphs: HHS’ ability to use the Special Reserve Fund for the procurement of  countermeasures is predicated on a six-step process involving  coordination with DHS and approval by the Director of the Office of  Management and Budget (OMB). As provided in the BioShield Act, the  process requires:  1.  the DHS Secretary, in consultation with the HHS Secretary and the  heads of other agencies as appropriate, to determine that a material  threat exists and issue a “material threat determination;”  2.  the HHS Secretary to determine countermeasures that are necessary to  protect the public health;  3.  the HHS Secretary to determine that a particular countermeasure is  appropriate for procurement for the Strategic National Stockpile using  the Special Reserve Fund and the quantities to be procured;  4.  the DHS and HHS Secretaries to jointly recommend to the Director of  OMB that the Special Reserve Fund should be used for the designated  countermeasure acquisitions;  5.  the director of OMB to approve the use of the Special Reserve Fund;  6.  both Secretaries to notify designated congressional committees of the  procurement.
The BioShield Act also provides HHS the ability to use four new  contracting authorities for the acquisition of countermeasures. In general,  these authorities expanded upon existing provisions in the Federal  Acquisition Regulation (FAR). The four authorities are:    Simplified acquisition procedures which, in general, increased HHS  contract threshold amounts from $100,000 to $25 million. However, the  BioShield Act does not place a threshold limit on countermeasures that  are procured using the Special Reserve Fund if the HHS Secretary  determines there is a pressing need for the specific countermeasure.
Procedures other than full and open competition can be used to award  contracts when the requirement is only available from one responsible  source or a limited number of responsible sources. In addition, in order to  conduct procurements on a basis other than full and open competition  using simplified acquisition procedures, the HHS Secretary must  determine that the mission of the BioShield Program under the Act would  be seriously impaired without such a limitation.  Increased micropurchase threshold from $2,500 to $15,000.
Personal services contracts may be used for experts or consultants who  have scientific or other professional qualifications when the HHS  Secretary determines such contracts are necessary to respond to pressing  countermeasure research and development needs.
In 2006, the Pandemic and All-Hazards Preparedness Act (PAHPA),  among other things, established the Biomedical Advanced Research and  Development Authority (BARDA), within HHS, to provide a coordinated,  systematic approach to the development and purchases of  countermeasures, including vaccines, drugs, therapies, and diagnostic  tools. Later, in 2009, Congress transferred the following amounts from the  Special Reserve Fund to HHS accounts: $275 million to be used for the  advanced research and development of countermeasures and $137 million  for influenza pandemic preparation.
section_title: HHS Has Used New Authorities to Procure Countermeasures
paragraphs: HHS has used its Special Reserve Fund (purchasing) authority and one of  its contracting authorities to procure countermeasures for the Strategic  National Stockpile. Since 2004, HHS awarded nine contracts using Special  Reserve Fund monies to procure various countermeasures, such as  anthrax and botulism antitoxins, vaccines for anthrax and smallpox, and  post-exposure treatments for radiation poisoning in children and adults.  Of the nine contracts awarded using monies from the Fund, HHS  terminated one contract, in 2006, because the contractor was unable to  meet a major contractual milestone. To date, the remaining eight contracts  are valued at almost $2 billion. See table 1. In addition, HHS officials told  us there are currently two requests for proposal solicitations for an  anthrax vaccine and a smallpox therapeutic.
Of the four contracting authorities provided under the BioShield Act, HHS  has only used the simplified acquisition procedure authority. From 2004  through 2005, HHS’s National Institutes of Health (NIH) used this authority  to award five other contracts, including ones for research to develop a  botulism antitoxin and improved treatments for radiation poisoning.  Awarded with NIH funding, these contracts have a total value of almost  $30 million when options and other later modifications are included. See  table 2.
HHS officials told us that they have not used this authority since 2005.  HHS officials also told us that no other BioShield contracting authorities  have been used to date, although the officials noted that these authorities  may be needed for use in the future.
section_title: HHS Has Established Internal Controls for Its New Authorities, but Lacks Adequate Documentation of the Risks of Using the Contracting Authorities
paragraphs: In response to BioShield requirements, HHS has established internal  controls on its Special Reserve Fund (purchasing) and contracting  authorities, but lacks adequate documentation of the risks of using the  new contracting authorities. Language in the BioShield Act sets up a  broad framework of controls over the procurement of countermeasures,  including those with Special Reserve Funds, by requiring HHS to  coordinate with DHS and obtain approval by OMB before the Fund may be  used. In addition to the language in the Act, HHS officials told us that the  internal controls for procuring countermeasures using the Fund are  documented in a variety of internal policy and procedure documents and  interagency agreements, which provide guidance on roles and  responsibilities for how the controls are to be implemented. These  documents include:    an HHS policy document that establishes an enterprise governance board  to oversee requirements and priority-setting regarding emergency medical  countermeasures for the civilian population. The document also outlines  the authorities, organizational structure, and guidelines for the board;    an HHS budget execution document that delineates responsibilities and  describes the processes for requesting contract actions, purchases, and  interagency agreements;    a BARDA standard operating procedure document that provides  contracting and other BARDA officials with guidance on source selection  procedures and outlines specific responsibilities in carrying out those  procedures;    a BARDA acquisition plan which details the pre- and post-award approval  processes for procurements using the Fund;    an interagency agreement between HHS and DHS dated September 25,  2006, that outlines the terms and conditions for when the Fund can be  used; and    an OMB Circular on transferring budget authority from one agency to  another.
HHS has also established internal controls for the contracting authorities  that were specified in the BioShield Act. On October 18, 2005, HHS issued  a memorandum that provided guidance on the use of the following  contracting authorities:   the increased simplified acquisition threshold and its use with the Special  Reserve Fund,  the increased micropurchase threshold, and  the use of personal services contracts.
HHS’s memo is structured around the five elements of internal control: the  control environment, risk assessment, control activities, information and  communications, and monitoring. Federal internal control standards  state that management needs to comprehensively identify risks, analyze  them for possible effect, and determine how risks should be managed.  Federal internal control standards also state that controls need to be  clearly documented, readily available for examination, and distributed in a  form and time frame that permits people to perform their duties  efficiently.
Risk assessment statements we reviewed in the memo are generally not  assessments of the risks involved in using particular authorities. Some of  the risk statements identify some risks and one mentions possible negative  consequences that could occur without proper controls in place, but the  statements lack an analysis of those risks. For example, the risk  assessment statement for using the increased micropurchase threshold  states that “control procedures are necessary to prevent noncompliance  with specific requirements of the Act, including exceeding statutory  limitation on number of contracts and selections based on improper  criteria.” And, the risk assessment statement on increased simplified  acquisition procedures does not mention or assess risk. It simply states  that “control procedures are necessary to prevent noncompliance with  specific requirements of the Act.” In particular, the risk statement on  simplified acquisition procedures in the memo does not discuss a key risk  associated with using simplified acquisition procedures—namely, that an  agency is prohibited from obtaining cost or pricing data for acquisitions at  or below the simplified acquisition threshold.
According to a senior BARDA procurement official, while using simplified  acquisition procedures can expedite the procurement process, the agency  will not have cost and pricing data, which may be needed to determine  that the price of a contract—especially those valued in the tens of millions  or hundreds of millions—is fair and reasonable. In a subsequent meeting,  he stated that he is aware of these trade-offs based on his own experience  and knowledge of the FAR. He also confirmed that an explanation  assessing the trade-offs and risks involved when using the new contracting  authorities is not contained in other HHS documents. Instead, this official  acknowledged that HHS’s written guidance on the controls for the  contracting authorities does not document known risks and trade-offs of  using the authorities. As a result, implementation of these controls  depends on the experience and knowledge of current personnel.  Moreover, the consistent application of these controls is not likely to be  sustained over time as employees leave their positions and new ones take  their place. Not having adequately documented and appropriately  communicated risk assessments, which institutionalize agency policies,  may potentially result in future employees not knowing or understanding  the risks or tradeoffs involved in using the various contracting authorities.
section_title: Conclusions
paragraphs: Since the enactment of the BioShield Act in 2004, HHS has awarded almost  $2 billion in contracts to either procure medical countermeasures or to  facilitate their development. Although HHS has established internal  controls for its new purchasing and contracting authorities, the risk  assessment statements related to the agency’s internal controls for the  contracting authorities are not sufficiently specific. In particular, the  failure to mention and lack of analysis of specific risks in the risk  statements associated with using the increased micropurchase threshold  and increased simplified acquisition procedures is not consistent with  requirements under federal internal control standards.
With employee turnover, the lack of adequately documented risk  assessment statements could create a situation in which employees do not  know the risks or trade-offs involved in using the various authorities. The  effectiveness of the internal controls now in place is dependent on the  knowledge of individuals currently working at the agency. Without  appropriately documented risk assessments that institutionalize agency  policies, HHS will be unable to ensure that sound, informed, and  consistent decisions will be made in the face of employee turnover.
section_title: Recommendation for Executive Action
paragraphs: We recommend that the Secretary of Health and Human Services include  comprehensive risk assessment statements in written guidance on the  internal controls for the BioShield contracting authorities for which the  agency was required to establish controls.
section_title: Agency Comments and Our Evaluation
paragraphs: HHS provided us with written comments on a draft of this report. The  comments appear in appendix I.
HHS agreed with our recommendation and said that it will revise its  internal control guidance on risk assessments for using BioShield  contracting authorities. We believe that this is a positive step toward  helping ensure that sound, informed, and consistent risk assessments will  be made in BioShield acquisitions. HHS also provided observations on the  Special Reserve Fund and risk assessments, which appear in appendix I.
We are sending copies of this report to the Secretary of Health and Human  Services. The report is also available at no charge on the GAO Web site at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (202) 512-4841 or NeedhamJK1@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last   page of this report. GAO staff who made major contributions to this report  are listed in appendix II.
section_title: Appendix I: Comments from the Department of Health & Human Services
section_title: Appendix II: GAO Contacts and Acknowledgments
subsections: section_title: Acknowledgments
paragraphs: In addition to the contact named above, Carol Dawn Petersen, Assistant  Director; Angela D. Thomas, Kelly Bradley, Robert S. Swierczek, Marie P.  Ahearn, and Kenneth E. Patton made key contributions to this report.