Telecommunications: Information Collection and Management at the Federal Communications Commission
Published: 2010-01-29T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Federal Communications Commission (FCC) regulates industries that affect the lives of virtually all Americans. FCC-regulated industries provide Americans with daily access to communications services, including wireline and wireless telephone, radio, and television. To ensure FCC is carrying out its mission, the commission requires a significant amount of information, such as ownership and operating information from radio and television stations. In prior reports, GAO has found weaknesses with FCC's information collection, management, and reporting processes. While FCC has taken action, the commission has not implemented all the recommendations associated with information collection, management, and reporting. As requested, this report provides information on (1) the information FCC collects; (2) how FCC collects and manages information; (3) the strengths and weaknesses, if any, in FCC's information collection and management practices; and (4) the status of FCC's internal review of its information collection and management practices. To complete this work, GAO gathered information on FCC's information collection efforts, reviewed information collection and management practices for 30 collection instruments, interviewed agency officials and industry stakeholders, and reviewed relevant laws and guidance. FCC provided comments which discuss its efforts to improve data management.
section_title: What GAO Found
paragraphs: FCC gathers a wide variety of information though information collection instruments. FCC gathers information through 413 collection instruments approved by the Office of Management and Budget (OMB). Through these OMB-approved collection instruments, FCC gathers information pertaining to (1) required company filings, such as the ownership of television stations; (2) applications for FCC licenses; (3) consumer complaints; (4) company financial and accounting performance; and (5) a variety of other issues, such as an annual survey of cable operators. FCC estimates that it receives nearly 385 million responses with an estimated 57 million burden hours associated with the 413 collection instruments. FCC's bureaus and offices collect and manage most commission information following commissionwide programs, policies, and procedures. FCC articulates its commissionwide programs, policies, and procedures in several directives, including its records management program. These directives help ensure FCC's compliance with governmentwide laws and regulations. Since FCC's bureaus and offices are the primary users of information, implementing decisions generally occur at that level. According to GAO's review of 30 information collections, FCC's bureaus and offices collect and manage information in a variety of ways. For example, FCC collects and manages 14 of the 30 information collections electronically, while it collects and manages some information in paper format. FCC disseminates information from 11 of the 30 information collections on its Web site, while it disseminates some information upon request, but in a redacted format. According to GAO's review of 30 information collections, FCC's bureaus and offices appear to follow commission- and governmentwide guidance, such as quality control procedures and safeguards for sensitive information. However, prior GAO reports and some stakeholders identified certain weaknesses with FCC's information collection and management practices. These weaknesses concern FCC's information collection processes and the accuracy of the estimated burden hours associated with FCC's information collections. For example, GAO recently reported that FCC rarely includes the text of a proposed rule in its Notice of Proposed Rulemaking, and stakeholders similarly noted that FCC does not initially specify the information that it wants to gather in the notice; the lack of specificity makes it harder for stakeholders and the public to provide meaningful input on the proposed information collection instrument. Recognizing the need to improve the commission's information practices, in July 2009, FCC's Chairman initiated a review of the commission's systems and processes. The Chairman sought to address whether (1) new information should be collected, (2) existing information reporting requirements could be streamlined or eliminated, and (3) existing technology and management processes could be modernized in order to make the commission's use of information more efficient and effective. FCC staff have taken several steps to implement the review and the effort continues.

section_title: Letter
paragraphs: The Federal Communications Commission (FCC) regulates industries that  affect the lives of virtually all Americans. FCC-regulated industries provide  Americans with daily access to a variety of communications services,  including wireline and wireless telephone, Internet access, radio, and  television. FCC’s mission is to ensure that the American people have  available at reasonable cost and without discrimination, rapid, efficient,  nationwide, and worldwide communication services whether by radio,  television, wire, wireless, satellite, or cable. To carry out its mission, FCC  has to collect and manage a significant amount of information. For  example, FCC obtains information on (1) broadband Internet access  connections to households and businesses, (2) license applications for  radio and television stations, (3) wireline telephone companies’ finances  and operations, and (4) consumer complaints.
We have previously reported that to be successful in measuring  performance, agencies generally need to collect sufficiently complete,  accurate, and consistent information. Yet, in reports examining FCC’s  programs and operations, we have found weaknesses in certain  information collection, management, and reporting processes. For  example, in a recent report, we found that limitations in FCC’s current  approach for collecting and analyzing enforcement data create challenges  for the commission in carrying out its enforcement responsibilities.  Another report found that FCC’s information for assessing competition for  dedicated access service (telecommunications service with guaranteed  capacity, high service levels, and security purchased by government  agencies and businesses) was significantly limited in describing the  presence, extent, or change in competition in any given area. Table 1  provides information on our previous reports and the status of our  recommendations to FCC. Recognizing the need to improve the  commission’s information practices, on July 22, 2009, FCC’s Chairman  initiated a top-to-bottom review of the commission’s systems and  processes.
In response to your request, we examined FCC’s information collection  and management practices across the agency. Specifically, we addressed  (1) the information FCC collects; (2) how FCC collects and manages  information; (3) the strengths and weaknesses, if any, in FCC’s  information collection and management practices; and (4) the status of  FCC’s internal review of its information collection and management  practices. We examined the extent to which FCC has commissionwide  information collection and management procedures and the commission’s  bureaus, and offices, adherence to those procedures. As such, we did not  assess whether individual information collection and management efforts  were adequate to meet FCC’s policy or rulemaking mission. Further, we  did not review FCC’s collection of information through its rulemaking  process.
To describe the information that FCC collects, we obtained information as  of April 2009 on the 413 collection instruments that the Office of  Management and Budget (OMB) approved through the Paperwork  Reduction Act (PRA). We interviewed FCC officials about the various  types of information the commission collects. To describe how FCC  collects and manages its information, we prepared two questionnaires for  FCC officials; these questionnaires sought information on information  collection, management, dissemination, and retention and disposal for 30  OMB-approved information collection instruments. To select the 30  information collection instruments, we initially asked FCC for the  repository (e.g., the database where the information resides) associated  with each of its OMB-approved information collection instruments; FCC  officials said the commission could not readily provide that information  because it does not maintain its records in such a manner. In response, we  adopted an alternative, multistep approach. Specifically, we (1) asked FCC  to categorize its OMB-approved collection instruments by activity or use  (e.g., licenses and surveys), (2) determined the average burden hours  associated the various categories, (3) established three strata based on the  average burden hours (greater than 46,803 hours, 46,803 hours to 17,904  hours, and less than 17,904 hours) and selected one category from each of  the first two strata and two categories from the third stratum, and (4)  judgmentally selected collection instruments from the four categories. We  received responses for all 30 OMB-approved information collection  instruments. Of the 30 responses, 9 pertained to collection instruments  where the reporting entity or a third-party entity maintains the  information; we used two questionnaires, one for information collection  instruments where FCC maintains the information and one for information  collection instruments where the reporting entity or a third-party entity  maintains the information. We reviewed FCC policies and procedures to  determine the guidance the commission has established for managing  information, and we interviewed FCC officials to determine how the  commission carries out its procedures. We also reviewed relevant laws  and regulations on procedures for collecting and managing information.  To identify the strengths and weaknesses in FCC’s information collection  and management practices, we compared the 30 responses from the  questionnaires with the commission’s internal policies and procedures and  federal guidance on information collection and management practices. We  also interviewed 19 stakeholders, including representatives from  communication companies, industry trade associations, consumer and  public interest groups, state regulators, and academic and industry  experts. We selected these stakeholders to include a cross section of  industries regulated by FCC, including radio and television broadcasters,  cable television operators, satellite operators, and wireline and wireless  telephone companies, as well as parties representing consumers and  regulators that are affected by the commission’s policies and rulemaking.  We also reviewed prior GAO reports and other relevant literature for best  practices for the collection and management of information.
We performed this performance audit from December 2008 to January  2010 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our review objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. A detailed discussion of  our scope and methodology appears in appendix I.
subsections: section_title: Background
paragraphs: Under the Communications Act, as amended, FCC regulates interstate and  international communications by radio, television, wire, satellite, and  cable. FCC regulates these industries by carrying out various activities,  including issuing licenses for radio and television broadcast stations;  overseeing the licensing, enforcement, and regulatory functions of cellular  telephones and other personal communication services; regulating the use  of the radio spectrum and conducting auctions of licenses for use of the  spectrum; investigating consumer complaints and taking enforcement  actions for violations of communications laws and commission rules;  addressing public safety, homeland security, emergency management, and  preparedness; educating and informing consumers about  telecommunications goods and services; and reviewing mergers of  companies holding FCC-issued licenses. FCC carries out these  responsibilities using its 7 bureaus and 10 offices. Table 2 provides  descriptions of each bureau’s responsibilities.
To fulfill its responsibilities, FCC requires regulated entities, such as  companies and licensees, in the communications industry that it regulates  to maintain records, submit information, or disclose information to others.  For example, television stations are required to provide FCC with  information relating to construction permits, license renewals, and  ownership. When collecting and managing information, FCC must adhere  to various laws and regulations and coordinate with various entities.
Paperwork Reduction Act. The PRA requires agencies, such as FCC, to  obtain approval for each information collection instrument that meets the  requirements of the PRA from OMB. Before approving a collection  instrument, OMB is required to determine that the agency’s collection of  information is necessary for the proper performance of the functions of  the agency, including whether the information will have practical utility.  Consistent with the PRA’s requirements, OMB has established a process to  review all proposals by agencies to collect information from 10 or more  persons, whether the collections are voluntary or mandatory. OMB’s  approval of each information collection instrument usually expires within  3 years, and agencies must periodically ask for an extension until the  collection is no longer needed.
Records management by federal agencies. As required by statute, the  head of each federal agency must establish and maintain an active,  continuing program for the economical and efficient management of the  agency’s records. The agency must provide for effective controls over the  creation, maintenance, and use of records in the conduct of current  business. Further, the agency must cooperate with the Administrator of  General Services and the Archivist in applying standards, procedures, and  techniques designed to improve the management of records; promote the  maintenance and security of records deemed appropriate for preservation;  and facilitate the segregation and disposal of records of temporary value.
Federal Information Security Management Act of 2002 (FISMA).  FISMA requires the head of each agency to provide information security  protections commensurate with the risk and magnitude of harm resulting  from unauthorized access, use, disclosure, disruption, modification, or  destruction of information collected or maintained by or on behalf of the  agency.
Additional requirements. In addition to the requirements established by  the various laws, federal agencies must follow regulations promulgated by  agencies such as OMB and the National Archives and Records  Administration (NARA). For example, OMB established policy for  managing information through its A-130 Circular. NARA provides federal  agencies with guidance on the management of records and other types of  documentary materials and assists agencies in creating and maintaining  accurate and complete records of an agency’s functions and activities and  in ensuring the authorized, timely, and appropriate disposition of  documentary materials.
To develop new rules or modify existing rules, including rules pertaining  to information collection instruments, FCC initiates a rulemaking  process. When implementing a rulemaking process, FCC must follow the  procedures set forth in the Administrative Procedure Act (APA). The  APA generally requires a “notice and comment” or “notice and comment  rulemaking” process to ensure that stakeholders and the public have  adequate opportunity to participate in agencies’ rulemaking processes. In  particular, the APA requires agencies, in most cases, to publish a notice of  proposed rulemaking in the Federal Register and give interested parties an  opportunity to comment on the proposed rule or rule change by providing  “written data, views, or arguments.” FCC generally collects information  through the following methods.
Notice of Inquiry (NOI). FCC releases a NOI to gather information  about a broad subject or as a means of generating ideas on a specific issue.
Notice of Proposed Rulemaking (NPRM). FCC issues a NPRM to  propose new rules or changes to its existing rules. The NPRM must  include either the terms or substance of the proposed rule or a description  of the subjects and issues involved and seek public comment on the  proposal.
Further Notice of Proposed Rulemaking (FNPRM). After reviewing  comments in the NPRM, FCC can issue a FNPRM regarding specific issues  raised in the process. The FNPRM provides an opportunity for the public  to comment further on a related or specific proposal.
section_title: FCC Uses OMB- Approved Collection Instruments to Gather a Wide Variety of Information on the Industries That It Regulates
paragraphs: As of April 2009, FCC used 413 OMB-approved information collection  instruments to gather information, maintain records, or disclose information;  however, the amount of information collected and managed varied by bureau  or office. Responsibility for these collections is spread across 10 FCC  bureaus and offices (see table 3). The Media, Wireline Competition, and  Wireless Telecommunications bureaus are responsible for almost three- quarters of the collections, with 139, 85, and 74 collections, respectively. The  estimated number of responses also varies significantly by bureau or office.  For example, both the Wireline Competition and Consumer and  Governmental Affairs bureaus anticipate over 140 million individual  responses annually to their collection instruments, whereas the Enforcement  Bureau anticipates fewer than 10,000. The burden associated with  submitting the information also varies by bureau or office; according to the  PRA, the term “burden” means the time, effort, or financial resources  expended by persons to generate, maintain, or provide information to a  federal agency. The Consumer and Governmental Affairs Bureau estimates  over 39 million hours for its collection instruments, more than the other  bureaus and offices combined; other bureaus with over 1 million estimated  annual burden hours include the Media, Wireline Competition, and Wireless  Telecommunications bureaus.
FCC collects a wide variety of information through its 413 OMB-approved  information collection instruments. In response to our request, FCC placed  each of its 413 collection instruments in a category based on the industry  and/or purpose. FCC identified 21 categories, and we further organized these  21 categories into five groups (see table 4). As shown in the table, there is  significant variation in the number of collection instruments and estimated  number of responses and annual burden hours across the 21 categories. We  provide a description of the types of information collection instruments  below.
Requirements. FCC-defined information collection instruments for  requirements span a wide variety of industries, including wireless and  wireline telephone, broadcasting, cable, equipment, and public safety. FCC  regulations require companies to provide a variety of information. For  example, the Wireline Competition Bureau has 58 collection instruments  of this type, including employment reports and local number portability  for wireline telephone companies. The Wireless Telecommunications  Bureau has 59 collection instruments of this type, such as reports on  interference.
Applications. Regulated entities, such as companies and individuals,  seeking to provide certain services must apply for and receive a license  from FCC. For example, the Media Bureau gathers license application  information from companies seeking to provide radio and television  broadcast service. The Office of Engineering and Technology gathers  license application and equipment authorization information from  companies seeking to market new wireless equipment, such as wireless  telephones.
Complaints. FCC collects consumer complaints on a variety of problems  through OMB-approved information collection instruments. These  complaints include a wide variety of problems such as deceptive or  unlawful advertising or marketing; obscene, profane, and/or indecent  material on broadcast radio or television; slamming, the illegal practice of  changing a consumer’s telephone service without permission; and  accessibility of communications services to persons with disabilities.
Financial and accounting. The Wireline Competition Bureau collects  information pertaining to both wireline carrier accounting and the  universal service fund. The wireline carrier accounting collections include  a variety of company submissions, such as information on rates, costs,  investment, and customer satisfaction. The universal service fund  collections include submissions necessary to pay into or receive payment  from the universal service fund. We also include collection instruments  for FCC’s financial operations in this group; these collections include, for  example, documents for FCC’s regulatory fees.
Other. These information collection instruments pertain to a variety of  topics. For example, the Media, Wireline Competition, and Wireless  Telecommunications bureaus conduct surveys of cable television  operators, companies providing broadband service, and participants in  FCC’s spectrum auctions, respectively. The Consumer and Governmental  Affairs Bureau collects information pertaining to telecommunications  relay service, which allows persons with hearing or speech disabilities to  place and receive telephone calls. The Wireless Telecommunications  Bureau uses collection instruments to receive applications for participants  in spectrum auctions and auction participants seeking bidding credits.
section_title: FCC Bureaus and Offices Collect and Manage Most of the Commission’s Information Following Commissionwide Programs, Policies, and Procedures
paragraphs: FCC has established commissionwide programs, policies, and procedures  for the collection and management of information; FCC articulates these  policies and procedures in its records management program, forms  management program, security policies and procedures, and information  system protection. However, since bureaus and offices are the primary  users of information, implementing decisions generally occur at the  bureau or office level. On the basis of responses to our questionnaires  about 30 OMB-approved information collection instruments, FCC’s  bureaus and offices collect and manage information in a variety of  different ways.
subsections: section_title: FCC Has Commissionwide Programs, Policies, and Procedures for Managing and Maintaining Information
paragraphs: FCC has four primary directives that establish procedures for commission  staff to follow for collecting and managing information. These directives  help ensure FCC’s compliance with governmentwide laws and regulations  pertaining to information collection and management, such as the PRA  and FISMA.
Records management program. By statute, the head of each federal  agency must establish and maintain an active, continuing program for the  economical and efficient management of all records of the agency. To  meet this requirement, FCC established a records management program  that sets out the policies, procedures, and activities needed to manage the  commission’s recorded information. The objectives of FCC’s records  management procedures are to    accurately and completely document the policies and transactions of the    control the quantity and quality of records produced by the commission;    establish and maintain mechanisms of control to promote effective and  economical operations of the commission;    simplify the activities, systems, and processes of creating, maintaining,  and using records; and  judiciously preserve and dispose of records.
Within the Office of Managing Director, FCC’s Performance Evaluation  and Records Management (PERM) staff carry out procedures to establish  and oversee the records management program. The procedures require  PERM staff to review and evaluate the program by conducting (1) on-site  inspections, (2) annual reviews of all bureau and office records control  schedules, and (3) reviews of bureau and office submissions of record  holdings.
Forms management program. FCC has a forms management program to  comply with statutory, regulatory, and policy requirements for federal  forms. The objectives of the forms management program are to ensure  (1) forms are directly linked to accomplishing specific missions of the  commission; (2) forms are properly designed with clear instructions to  make it easy as possible for respondents to provide information requested  in the least amount of time; and (3) forms make effective and efficient use  of electronic technologies for creating, collecting, distributing, and using  these forms to record, store, and disseminate information. The procedures  state that each bureau and office chief is responsible for, among other  things, ensuring that forms are created, maintained, and disposed of in  conformance with the commission’s records management program.
Security policies and procedures. FCC has security policies and  procedures for the management and safeguarding of all nonpublic  information. FCC has two categories of nonpublic information:  1.  “Highly sensitive/restricted” information is defined as information that  is highly market sensitive (i.e., disclosure of which is likely to  substantially affect the value of securities traded publicly or a  company’s market valuation) or other commercial or financial  information the commission considers confidential and highly  sensitive. For example, according to FCC officials, information that is  submitted to FCC’s Disaster Information Reporting System may  contain commercial information that could affect competition among  wireless, wireline, broadcast, and cable providers and is treated as  confidential by FCC. 2.  “Internal use only” information is defined as all other nonpublic  information not routinely available for inspection. For example, FCC  maintains information for internal use only that allows its crisis  incident managers to coordinate activities in the telecommunications  industry and FCC in the event of a crisis. This internal document has  contact information for FCC employees, other federal government  agencies, state and local governments, and the communications  industry.
According to these procedures, the bureau or office creating or using  nonpublic information is responsible for determining in which category  the information should be placed. FCC’s procedures are designed to  safeguard the nonpublic information in all formats including, but not  limited to, paper, computer files, e-mails, diskettes, CDs, audio and video  recordings, and oral communications. Among other things, the policies  and procedures require that nonpublic information must be disposed of in  a locked document disposal bin; such bins are located throughout FCC  headquarters.
Information systems protection. FCC has established policy to help  ensure that adequate levels of protection exist for all FCC information  systems,  including the FCC network, applications and databases, and  information created, stored, or processed. FCC’s Chief Information  Officer (CIO) has primary responsibility for managing the commission’s  policy. The policy states that the CIO’s responsibilities include (1)  evaluating and approving the resolution of issues relating to information  security, (2) developing and maintaining an agencywide information  security program, and (3) training and overseeing personnel with  significant responsibilities for information security. FCC also has a Chief  Information Security Officer responsible for (1) developing plans for  providing adequate information security for networks, facilities, and  systems or groups of information systems; (2) conducting periodic  assessments of the risk and magnitude of the harm that could result from  the unauthorized access, use, disclosure, disruption, modification, or  destruction of information and information systems that support the  operations and assets of the agency; and (3) developing plans and  procedures to ensure continuity of operations for information systems that  support the operations and assets of the agency.
section_title: Bureaus and Offices Are Primarily Responsible for Collecting and Managing the Commission’s Information
paragraphs: FCC’s policies and procedures for managing information are primarily  carried out at the bureau or office level. As the primary users of  information, FCC’s bureaus and offices manage most of the commission’s  information collected through OMB-approved collection instruments. The  previously mentioned records management guidance, which was  established by PERM, gives bureau and office chiefs authority to establish  their own procedures for managing records and ensuring staff observe  guidelines. According to FCC officials, bureaus and offices are allowed to  establish their own procedures. However, officials also said that they are  not aware of any bureaus and offices that have officially done so.  Similarly, officials with the bureaus and offices with whom we spoke said  that they use the commissionwide guidance to manage their information  and have no additional internal information procedures.
According to responses to our questionnaires about 30 OMB-approved  information collection instruments, FCC’s bureaus and offices collect and  manage information in various ways based on the type of information. As  mentioned previously, a reporting entity or third-party entity maintains the  information associated with some FCC collection instruments. In those  instances, certain questions pertaining to information collection,  management, dissemination, and retention and disposal are not applicable.  Therefore, we used two questionnaires, one for collection instruments  where FCC maintains the information and one for collection instruments  where the reporting entity or a third-party entity maintains the  information. Of the 30 responses we received, FCC maintains the  information for 21 collection instruments; for the remaining 9 collection  instruments, the reporting entity or third party maintains the information.  Most of the following analysis pertains to the 21 collection instruments  where FCC maintains the information.
Information collection. Respondents to our questionnaire reported that  they collect information in different formats, including electronic, paper,  and compact disc (CD). For the 21 collection instruments where FCC  maintains the information, 14 respondents reported that the reporting  entity submits information to the bureau or office in an electronic format.  For example, one respondent reported that cost and revenue information  from telephone companies, such as AT&T and Verizon, is submitted  electronically to FCC. In three instances, the respondent reported that the  bureau or office receives the information in a paper format. For example,  1 respondent reported that entities using certain radio frequency  identification devices are required to submit their information on paper to  register the location of these devices. Additionally, 3 respondents  reported receiving electronic and paper submissions, and 1 respondent  reporting receiving both paper and CD submissions.
The frequency of the collection also varied among the information  collection instruments. Nine information collections are annual. For  example, one respondent reported that FCC collects information annually  from a sample of cable operators on average rates charged for the basic  cable service, cable programming service tiers, and cable equipment. The  frequency of the collection for the remaining collection instruments varied,  from onetime submissions when filing an application to triennial filings.
Information management. After collecting the information, bureaus and  offices manage it in various ways. For all 30 collection instruments, 15  respondents reported that the bureau or office stores the information in a  database. As we discussed previously, in nine instances the reporting  entity or a third party maintains the information. The remaining  respondents to our questionnaire reported that the bureau or office stores  information in an internal network system or a file cabinet.
Respondents to our questionnaire reported that bureaus and offices use  several quality control procedures to ensure the accuracy of information.  For example, three respondents reported that information systems run  validity checks that ensure (1) certain data do not fall outside a reasonable  range for that data and (2) all data have been submitted as required. A  respondent reported that drop-down menus for individuals submitting  data electronically provide checks on the quality of the data, as do pop-up  warnings for data entries outside of the expected reasonable range. Other  respondents reported that staff review the information for completeness  and accuracy. For the 9 collection instruments wherein the reporting  entity or a third party maintains the information, 4 respondents reported  that the bureau or office may randomly select items for review, request the  records be provided to the commission, and review the records for  compliance with the commission rules; 3 respondents reported that the  bureau or office does not verify the information. In terms of correcting  errors, some respondents reported that the bureau or office contacts the  individual or organization that submitted the information and asks that  entity to make corrections. Other respondents reported that the bureau or  office will contact the individual or organization and ask for clarification  and update the information internally.
Respondents to our questionnaire also identified several approaches the  bureaus and offices employ to safeguard information. For the 21 collection  instruments where FCC maintains the information, 12 respondents reported  that their bureau’s or office’s information collections contain business  sensitive or confidential information. Nine respondents reported that the  information collections are less sensitive: 6 reported that the information is  generally public data, 1 reported that the information is not typically  business sensitive or confidential, and 2 reported that the information is not  business sensitive or confidential. To ensure the safeguarding of  information, 17 respondents reported that the bureau or office limits access  to information. For example, 1 respondent who reported that much of the  information is business sensitive also reported that access to the  information is limited to bureau staff. In addition, staff members are  instructed to keep the information and any related notes and worksheets  confidential and to keep any paper copies of the information in locked  cabinets. Fourteen respondents also reported that the information is  safeguarded with data backup and storage, and 2 respondents reported that  information is protected by encryption. Two respondents reported that  confidential submissions are kept in a locked file cabinet.
Information dissemination. FCC disseminates the information gathered  through some of the collection instruments we reviewed to the public.  Specifically, 15 respondents to our questionnaire reported that the  information collected is disseminated through internal or external reports.  Of the 15 respondents, 11 reported that some of the information collected  is disseminated to the public on FCC’s Web site. For example, 1  respondent reported that information on applications and licenses for  experimental use of radio frequencies is publicly accessible. Other  respondents reported the public can request the information or view the  information at FCC. For example, 1 respondent reported that in order to  protect the identity of the entity submitting information, FCC releases  redacted information in response to a request for information.  Additionally, several respondents reported that internal reports are  generated from the information collected. For example, 1 respondent  reported that the bureau or office generates internal workload, trend, and  management reports from the information.
Information retention and disposal. Bureaus and offices collecting  information via the collection instruments we reviewed retain the  information for a period of 1 year to indefinitely. Specifically, 7  respondents to our questionnaire reported that the bureau or office retains  the information indefinitely. For example, 1 respondent reported that  although the actual survey forms are kept for 5 years, spreadsheets of  information on surveys of license and spectrum auctions are kept  indefinitely. Another respondent reported that the information is retained  indefinitely because the disposal procedures are not yet in place. We also  asked about the procedures for disposing of information. Six respondents  reported that information is transferred to the NARA after being retained  by FCC for 5 years. Two respondents reported that paper documents are  shredded and electronic records are physically destroyed or erased  electronically.
section_title: FCC’s Bureaus and Offices Follow Commission- and Governmentwide Guidance, but Prior GAO Reports and Some Stakeholders Identified Certain Weaknesses in FCC’s Information Collection and Management Practices
paragraphs: According to our review of 30 OMB-approved information collections,  FCC’s bureaus and offices appear to follow commission- and  governmentwide policies and procedures for the collection and  management of information. For example, the bureaus and offices conduct  quality control procedures for these information collections. However, in  prior reports, we have identified weaknesses in FCC’s information  collection and management practices, and some stakeholders with whom  we spoke noted the same or similar weaknesses. In particular, these  reported weaknesses concern FCC’s information collection processes and  the estimated burden hours associated with FCC’s information collections.
subsections: section_title: On the Basis of Responses to GAO’s Questionnaire, FCC’s Bureaus and Offices Appear to Follow Commission- and Governmentwide Guidance
paragraphs: For the 30 information collections that we reviewed, FCC’s bureaus and  offices appeared to follow commission- and governmentwide policies and  procedures for the collection and management of information. In  particular, we compared the 30 responses from our questionnaires with  the commission’s internal policies and procedures and federal guidance on  information collection and management practices. We found that the  bureaus and offices followed the relevant policies and procedures for  these 30 information collections. For example, respondents to our  questionnaire reported carrying out a variety of commissionwide  information management procedures, including the following:    Quality control. FCC bureaus and offices responsible for the collections  reported using a variety of quality control procedures for managing the  collections to ensure the accuracy and integrity of the information in the  collections. These quality control procedures include general processes to  verify information, such as edit checks; Web-based filing systems, which  incorporate presubmission checks for internal consistency; and  notification of the filers of erroneous information and the legal obligation  to correct the information and resubmit the document.
Safeguarding sensitive and confidential information. The bureaus  and offices collecting confidential information reported implementing a  variety of safeguards. These safeguards include system limitations that  restrict access to the information and encryption of the data in  information collections.
section_title: Prior GAO Reports and Some Stakeholders Identified Certain Weaknesses in FCC’s Information Collection and Management Practices
paragraphs: As mentioned previously, in several reports, we have found weaknesses in  certain information collection, management, and reporting processes at  FCC. In several instances, FCC has not implemented our  recommendations. For example, we recommended that FCC consider  collecting additional data and developing additional measures to monitor  competition for dedicated access service on an ongoing basis; FCC  disagreed that it needed to better define competition and collect additional  data, although on November 5, 2009, it released a Public Notice inviting  comment on an appropriate analytical framework for examining dedicated  access. Some stakeholders with whom we spoke also identified certain  weaknesses in FCC’s processes.
Information collection. We recently reported that when issuing a NPRM to  gather public input before adopting, modifying, or deleting a rule, including  those rulemakings involving information collection instruments, FCC rarely  includes the text of the proposed rule in the notice, an omission that may limit  the effectiveness of the public comment process. We recommended that  FCC, where appropriate, include the actual text of proposed rules or rule  changes in either a NPRM or a FNPRM before the commission votes on new  or modified rules to improve the transparency and effectiveness of the  decision-making process. Six stakeholders with whom we spoke also  expressed concern about FCC’s lack of specificity when proposing the  collection of information through the notice and comment process. For  example, four stakeholders said that FCC does not initially specify the  information that it wants to gather through a proposed collection instrument  in the NPRM. Additionally, an official representing a major  telecommunications company said that FCC issues NPRMs that do not  contain the proposed rule for stakeholders to review and comment on. This  official added that NPRMs usually contain a general description of what the  rule will be and the companies can submit comments. The lack of specificity  in the NPRM makes it harder for stakeholders and the public to provide  meaningful input on the proposed information collection instrument.
Burden hour estimates. OMB recently released a request for comments  on improving implementation of the PRA. In its request, OMB noted that  agencies’ estimation methodologies can sometimes produce imprecise and  inconsistent estimates of the burdens associated with information  collection instruments. In particular, OMB noted that some estimates are  not based on sufficiently rigorous or internally consistent methodologies.  Additionally, OMB noted that some information collections may impose  significant burdens on small businesses. Therefore, OMB sought comment  on a variety of topics, including the following:    examples of substantially inaccurate burden estimates for information    new or improved practices for estimating burden,    examples of information collections that inaccurately estimate the impact  of burden upon small entities, and    whether or not a separate burden estimate should be created for small  entities.
Seven stakeholders with whom we spoke expressed concern about FCC’s  burden hour estimates and the overall burden associated with the  commission’s information collections, particularly the burden on small  companies. Three stakeholders mentioned that FCC’s burden hour  estimates are not accurate. For example, an official with a  telecommunications company said that the burden estimates for some of  the information collections the company submits are underestimated. In  particular, this official said that aggregating and submitting information to  FCC on broadband service (FCC Form 477) takes longer than FCC’s  estimate; FCC’s estimated average burden hours per response for the  Form 477 is 72 hours, yet this official said the time to prepare and submit  the Form 477 is off by a factor of 10. Six stakeholders mentioned the  burdensome nature of some FCC collections, particularly for small  companies. For example, one association said that providing data is a  burden for some of the smaller companies, which might have as few as 500  customers. Another official noted that inaccurate estimates can adversely  affect small companies, since the additional burden could negatively affect  their operations. In general, these stakeholders did not provide concrete  examples to substantiate their concerns about the estimated burden.
section_title: FCC Is Currently Reviewing Its Information Management Processes
paragraphs: On July 22, 2009, the FCC Chairman directed the Office of Strategic  Planning and Policy Analysis (OSPPA) to conduct a top-to-bottom review  of the commission’s systems and processes for information collection,  processing, analysis, and dissemination. According to the Chairman, he  initiated the review to uncover opportunities to improve the commission’s  information capabilities. In particular, the Chairman sought information  on whether any (1) new information should be collected to support the  commission’s mission, (2) existing information reporting requirements  could be streamlined or eliminated because they are unduly burdensome  or no longer relevant, and (3) existing technological platforms and  management processes could be modernized in order to make the  commission’s use of information more efficient and effective. The  Chairman asked OSPPA to answer 20 questions, including the following:    For each bureau and office, what significant information is collected and  which information is used most heavily internally or externally?
Is there overlap among bureaus or offices with regard to information  collection?
What formal operational processes exist to manage the full information  “life cycle” and are there any bottlenecks?
Does FCC make regular efforts to gather best practices from other  information collections agencies?
What reports does FCC regularly generate to make information available  to the public, what are the most important information systems, and what  metrics does FCC have to track public consumption of information?
According to FCC officials, OSPPA has taken several steps to carry out the  Chairman’s request. In particular, OSPPA (1) sought information on the  current information collection efforts and future information needs in  FCC’s bureaus and offices and (2) identified potential gaps between the  current collections and future needs. OSPPA officials said that the current  effort will likely identify areas for greater investigation for the bureaus and  offices, and that the current effort is the beginning of a multiyear review  and transition process.
Additionally, the Chairman initiated an assessment of FCC’s database and  communications infrastructure. According to the Chairman, an initial  review strongly suggested that a significant upgrade will be warranted to  bring the commission into the 21st century. The Chairman also stated that  an upgrade will permit the commission and its staff to function much more  efficiently and facilitate public use of its Web site. FCC also launched an  internal online forum where employees can submit ideas for improvement  and reform, and FCC plans to launch a section on its Web site allowing the  public to offer ideas for reform as well.
section_title: Agency Comments
paragraphs: We provided FCC with a draft of this report for its review and comment.  FCC provided written comments, which appear in appendix II. In its  written comments, FCC discussed the various efforts under way at the  commission to improve its data management processes. FCC also  provided technical comments that we incorporated where appropriate.
As agreed with your office, unless you publicly announce the contents of  the report earlier, we plan no further distribution of it until 30 days from  the date of this report. At that time we will send a copy of this report to the  Chairman of the Federal Communications Commission. The report also is  available at no charge on the GAO Web site at http://www.gao.gov.
If you have any questions about this report, please contact me at (202) 512- 2834 or wised@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report. GAO  staff who made major contributions to this report are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report examines (1) the information the Federal Communication  Commission (FCC) collects; (2) how FCC collects and manages  information; (3) the strengths and weaknesses, if any, in FCC’s  information collection and management practices; and (4) the status of  FCC’s internal review of its information collection and management  practices.
To describe the information FCC collects, we obtained and reviewed  FCC’s list of information collection instruments approved under the  Paperwork Reduction Act (PRA); we reviewed collection instruments that  were approved as of April 22, 2009. The list included FCC’s description of  the information collection, the PRA number, the name of the bureau or  office responsible for managing the collection, and the estimated annual  burden hours associated with the collection. We also interviewed FCC  officials from seven bureaus and offices, including the Chief Information  Officer. We discussed the availability, formats, and special characteristics  of FCC’s information collections.
To describe how FCC collects and manages information, we reviewed  commissionwide directives on FCC’s (1) records management program,  (2) forms management program, (3) management of nonpublic  information, and (4) information security program. We reviewed the  National Institute of Standards and Technology’s guidance on security  procedures for information, the Office of Management and Budget’s  (OMB) Office of Information and Regulatory Affairs directives on  managing and securing information, and the National Archives and  Records Administration’s (NARA) guidance for retaining and disposing of  information. We also interviewed FCC officials.
Additionally, to obtain information on how various FCC bureaus and  offices collect and manage information, we developed two questionnaires  that covered various aspects of the information life cycle—collection,  management, dissemination, and retention and disposal. We developed  one questionnaire for collection instruments where FCC retains the  information and a second questionnaire for collection instruments where  the filing entity or a third party maintains the information. We pretested  the questions to determine appropriateness and made revisions based on  the results of the pretest. To select the information collection instruments  from which we would obtain information via the questionnaires, we  initially asked FCC for the repository (e.g., the database where the  information resides) associated with each of its information collections;  FCC officials said the commission could not readily provide that  information because it does not maintain its records in such a manner. In  response, we adopted an alternative, multistep approach. We asked FCC  to classify the 413 OMB-approved information collection instruments into  categories based on activity or use (e.g., licenses and surveys); FCC  divided its 413 collection instruments into 21 categories. We determined  the average burden hours for each of the 21 categories, based on the  estimated annual burden hours for the collection instruments in each  category. We established three strata based on the average burden hours  (greater than 46,803 hours, 46,803 hours to 17,904 hours, and less than  17,904 hours). We selected one category from each of the first two stratum  and two categories from the third strata in order to obtain a mix of  collection types and to eliminate collections that received extremely  limited submissions. Finally, we judgmentally selected collection  instruments from each of these four categories; this process resulted in the  selection of 30 information collection instruments. Because of the nature  of our selection process, our results can not be used to evaluate FCC’s  collection processes overall. Of the 30 collection instruments, FCC  maintains the information for 21 collection instruments and the filing  entity or a third party maintains the information for the remaining 9  collection instruments. We received responses for all 30 collections. After  receiving the 30 responses, we reviewed and analyzed the answers and  followed up on selected answers and documentation provided in the  questionnaire by interviewing the responsible officials.
To describe the strengths and weaknesses in FCC’s information collection  and management practices, we compared the 30 responses from the  questionnaires with the commission’s internal policies and procedures and  federal guidance on information collection and management practices. We  also interviewed 19 stakeholders, including representatives from  communication companies, industry trade associations, consumer and  public interest groups, state regulators, and academic and industry  experts. We selected these stakeholders to include a cross section of  industries regulated by FCC, including radio and television broadcasters,  cable television operators, satellite operators, and wireline and wireless  telephone companies, as well as parties representing consumers and  regulators that are affected by the commission’s policies and rulemaking.  We reviewed prior GAO reports and performed a literature review of best  practices for the collection and management of information.
To describe the steps FCC is taking to address information management  weaknesses, we reviewed a memoranda dated July 22, 2009, from the FCC  Chairman initiating a review of the commission’s information management  collections and processes. We also reviewed a congressional hearing  statement made by the Chairman in which he discussed FCC’s initiatives  to improve information management. We met with the Chief of the Office  of Strategic Planning and Policy Analysis to discuss progress on the  commissionwide information management review the Chairman requested  in July of 2009.
section_title: Appendix II: Comments from the Federal Communications Commission
section_title: Appendix III: Contact and Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the contact listed above, Michael Clements (Assistant  Director), Andy Clinton, Mya Dinh, Amy Rosewarne, Don Watson, Mindi  Weisenbloom, and Elizabeth Wood made major contributions to this  report.