National Mediation Board: Progress Made on Some GAO Recommendations to Strengthen Operations, but Key Controls Continue to Be Needed
Published: 2016-02-12T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: NMB was established under the Railway Labor Act to facilitate labor relations for railroads and airlines by mediating and arbitrating labor disputes and overseeing union elections. The FAA Modernization and Reform Act of 2012 included a provision for GAO to evaluate NMB programs and activities every 2 years. GAO's first report under this provision, issued in December 2013, included seven recommendations for NMB based on assessments of policies and processes in several management and program areas.
This second report examines the extent to which NMB has 1) implemented recommendations made by GAO in December 2013, and 2) incorporated key procurement practices. GAO reviewed relevant federal laws, regulations, and NMB documents, such as its strategic and workforce plans; and contracting data for fiscal years 2014-2015; and interviewed NMB officials.
section_title: What GAO Found
paragraphs: The National Mediation Board (NMB) has made some progress in addressing the seven recommendations GAO made in December 2013; however, additional actions are needed to fully implement those recommendations and strengthen operations (see table). Without full implementation, NMB lacks reasonable assurance that its limited resources are effectively targeted and may be missing opportunities to improve performance and mitigate risks in program and management areas.
Source: GAO analysis of NMB documents and interviews with officials. | GAO-16-240
NMB is following some key procurement practices that GAO has identified in prior work. However, NMB has not developed and implemented written policies and processes—consistent with internal control standards and best practice—that reflect its new interagency agreement with the Department of the Treasury for the performance of certain procurement functions. Without this documentation NMB cannot ensure the use of consistent processes in its new procurement environment.
section_title: What GAO Recommends
paragraphs: GAO recommends that NMB develop and implement written policies and processes to reflect its current procurement environment. NMB agreed with the recommendation and indicated it would take steps to implement it.

section_title: Letter
paragraphs: The National Mediation Board (NMB), created by a 1934 amendment to  the Railway Labor Act (RLA), oversees union elections and provides  mediation, arbitration, and other services to resolve railroad and airline  labor disputes, including resolving disputes over issues such as working  conditions, rates of pay, and union representation. Currently, NMB  delivers services to management and labor unions at 150 commercial  airlines and over 500 railroads. NMB has 51 full-time staff positions and  had a fiscal year 2015 appropriation of approximately $13 million.
The FAA Modernization and Reform Act of 2012 further amended the  RLA and included a provision for us to evaluate and audit the programs,  operations, and activities of NMB every 2 years. We issued our first  report in December 2013, which reviewed agency planning and controls  related to several management and program areas and included seven  recommendations to address deficiencies in these areas (see table 1).
In our December 2013 report we also found that NMB did not follow  procurement policies and procedures it had in place at that time. The  agency developed a checklist for taking the required steps in the  procurement process that responded to those findings prior to the  issuance of the 2013 report. We did not, therefore, make any  recommendations in that area at that time.
In addition, we found that the Office of Management and Budget (OMB)  and Office of Personnel Management (OPM) provided limited budgetary  and human capital oversight of NMB, the agency did not have  mechanisms to monitor its operations and programs, and independent  auditors’ findings were not being addressed. As a result, we suggested  that Congress consider authorizing an appropriate federal agency’s Office  of Inspector General to provide independent audit and investigative  oversight of NMB.
This is the second review of NMB and this report examines the extent to  which NMB:  1. has implemented each of our December 2013 recommendations, and 2. has incorporated key procurement practices.
To address our objectives, we reviewed relevant federal laws and  regulations. We also assessed NMB documents related to strategic  planning, performance management, information security, information  privacy, workforce planning, and procurement using Standards for  Internal Control in the Federal Government, provisions of the Federal  Information Security Modernization Act (FISMA) of 2014, Privacy Act of  1974, E-Government Act of 2002, the Government Performance and  Results Act of 1993 as updated by the GPRA Modernization Act of 2010  (GPRAMA), guidance developed by OMB and in the National Institute of  Standards and Technology Special Publication 800-53 Revision 4, as well  as criteria on strategic workforce planning and best practices in  procurement developed by GAO in prior work.
We analyzed NMB’s contract actions for fiscal years 2014 and 2015 using  data provided by the Department of the Treasury’s Bureau of the Fiscal  Service. We assessed the reliability of these data and information from  NMB’s fiscal year 2013 through 2015 financial statement audit reports by  interviewing knowledgeable officials and reviewing relevant documents.  We determined that these data were sufficiently reliable for our purposes.
We interviewed NMB officials and current board members. We also  interviewed key stakeholders who were interviewed for the December  2013 report, including representatives from rail and air management and  labor groups. The results of these interviews are not generalizable to all  NMB stakeholders. Further, we interviewed officials at OMB and OPM  to determine how these agencies provide oversight and guidance to  NMB. For additional details, see appendix I.
We conducted this performance audit from April 2015 to February 2016 in  accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: NMB’s Organization and Mission
paragraphs: NMB is headed by a three-member board, with each member appointed  by the President and confirmed by the Senate for a term of 3 years.  Day-to-day administration of the agency is provided by NMB’s General  Counsel within the Office of Legal Affairs and the Chief of Staff (see fig.  1). NMB does not have an office of inspector general to provide  independent audit and investigative oversight.
According to NMB, its overall mission is to provide for the independence  of air and rail carriers and employees in matters of self-organization,  avoid interruption to commerce conducted through the operation of those  carriers, and administer statutory adjustment boards as well as develop  complementary strategies to resolve disputes. To fulfill its mission, NMB  has three program areas:
Representation: Unions are selected for the purposes of collective bargaining through secret-ballot elections conducted by NMB. If there is a question concerning representation of a specific craft or class,NMB is charged with resolving the representation dispute through its Office of Legal Affairs, and has the sole jurisdiction to decide these disputes.
Mediation and Alternative Dispute Resolution: The RLA provides mediation to help resolve disputes that can occur between management and labor during collective bargaining negotiations.When rail or air carriers and unions cannot reach agreement on the terms of a new or revised collective bargaining agreement—such as working conditions or rates of pay—either party can apply for NMB’s mediation services to resolve their differences or NMB may impose mediation if it finds that resolving the dispute is in the public’s interest. NMB also offers grievance mediation to parties as an alternative way to resolve disputes filed for grievance arbitration.
Arbitration: The RLA also offers grievance arbitration to help resolve disagreements between carriers and unions over how to interpret and apply provisions of existing collective bargaining agreements. For example, employees may file grievances if they believe they were wrongfully fired or disciplined in violation of the agreement. If the carrier and the employee cannot resolve the grievance, the RLA permits either of these parties to refer the dispute to arbitration before an adjustment board. The adjustment board consists of a carrier  representative, a union representative, and a neutral arbitrator  provided by NMB. In this capacity, the arbitrator is called upon to  break a tie. NMB does not directly provide arbitration services, but  rather maintains a list of registered arbitrators from which the parties  can select someone to review and decide their case. In the airline  industry, the parties pay the costs of arbitration. In the railroad  industry, however, consistent with the requirements of the RLA, NMB  pays the fee and travel expenses of the arbitrator.
section_title: NMB Has Made Progress, but Has Not Yet Fully Implemented GAO’s 2013 Recommendations
paragraphs: NMB has made some progress in implementing each of the seven  recommendations we made in December 2013.
subsections: section_title: Developing a Strategic Planning Process
paragraphs: In our December 2013 report, we found that NMB lacked a formal  strategic planning process and officials confirmed that they did not have a  systematic mechanism for involving congressional and other stakeholders  in this process. We concluded that without a robust process, NMB lacked  assurance that its limited resources were effectively targeted toward its  highest priorities.
In this review, we found that NMB has implemented a strategic planning  process but has not formalized it through written policies and procedures.  In fiscal year 2014, NMB developed and published a strategic plan  covering fiscal years 2014 through 2019, which we determined was  largely consistent with OMB guidance on implementing the GPRA  Modernization Act of 2010 (GPRAMA). NMB officials told us they used a  strategic planning process soliciting input from staff in NMB program  areas as well as from external stakeholders and Congress. Five of the  seven external stakeholder groups that we interviewed said they  commented on a draft of the strategic plan or discussed aspects of it  during regular meetings with the agency, and all reported being satisfied  with their overall communication with NMB.
However, the agency has not developed a written policy or set of  procedures outlining its strategic planning process. Federal internal  control standards call for agencies to document the policies and  procedures necessary to achieve their objectives, including strategic  planning. Specifically, agencies should (1) establish policies and  procedures to ensure that management directives are carried out and (2)  appropriately document transactions and other significant events, and  ensure that those records are properly managed, maintained, and  available for examination. Further, through these policies and procedures,  agency management can define responsibilities, assign key roles, and  delegate authority.
Meeting these requirements may be particularly important for NMB. NMB  officials said there was little need for preparing written documentation of  the strategic planning process, such as a standard operating procedure,  because it was simple and would be easy to replicate in the future.  Officials also said, because the agency is small, with 51 full-time  positions, its staff frequently communicate informally, limiting the need for  written procedures. However, three of NMB’s five senior managers,  including the Chief of Staff and General Counsel, are eligible to retire, as  are many other employees, increasing the risk of the agency losing  institutional knowledge should they do so. Moreover, because the agency  is small, some staff members have multiple responsibilities, increasing  the magnitude of knowledge loss when an individual staff member leaves  the agency.
section_title: Establishing Performance Goals and Measures
paragraphs: In our December 2013 report, we found that NMB was not meeting OMB  guidance to implement GPRAMA requirements for annual performance  planning and reporting. Specifically, the agency’s performance goals were  not objective, quantifiable, and measurable—as required by GPRAMA— and did not have targets and a time period over which to measure  performance—as recommended by OMB guidance implementing  GPRAMA. Without meeting this federal guidance, we concluded that the  agency was not positioned to track and publicly report progress or results  in its program areas.
In this review, we found that NMB has developed new performance goals.  However, of the 19 goals in its fiscal year 2016 performance plan, one  goal specified a target, another specified a timeframe; but none followed  all elements of OMB guidance for implementing GPRAMA. Several  NMB officials told us that it is difficult for the agency to design  performance goals because some outcomes are out of its control, such  as how long it takes parties to reach agreement through mediation. Many  federal agencies also set measurable performance goals for outcomes  that include external factors outside of their direct control. Our prior work  has shown that there are a number of strategies that federal agencies can  use to reduce the influence of external factors on agencies’ measures.  OMB officials told us NMB could seek assistance from them to refine its  performance goals or could partner with another agency that has a strong  performance management department.
section_title: Resolving Auditor Findings and Recommendations
paragraphs: GAO 2013 Recommendation: NMB should  develop and implement a formal mechanism  to ensure the prompt resolution of findings  and recommendations by independent  auditors, including clearly assigning  responsibility for this follow-up to agency  management.
In our December 2013 report, we found that NMB was following most key  practices for financial accountability and control, but had an outstanding  significant deficiency from its fiscal year 2012 financial statement audit  and did not have a mechanism for ensuring prompt resolution of audit  findings. As a result, we concluded that some recommendations made  by auditors to improve the agency’s internal controls or operations may  not have been addressed.
In this review, we found that while NMB in fiscal year 2015 resolved the  significant deficiency identified in its 2012 financial statement audit, it  does not have a formal mechanism to promptly resolve all audit findings  consistent with federal internal control standards. Specifically, while  NMB drafted a financial audit standard operating procedure in 2014, it  does not cover the agency’s response to findings from non-financial  audits. The agency has also not addressed two recommendations made  in previous auditors’ management letters that accompanied NMB’s  financial audit reports. One of those recommendations was made as a  result of the fiscal year 2014 audit and the other recommendation was  related to a discrepancy that has been unresolved since 1995. In its  fiscal year 2015 response, NMB indicated that the only management  official with knowledge of the long-term discrepancy had retired and the  agency would work to resolve the discrepancy through its financial  management system.
section_title: Ensuring Information Security and Privacy
paragraphs: In our December 2013 report, we found that NMB had not fully  implemented key practices for information security and privacy. Without  implementation of these key practices, we concluded that NMB had  increased risks that the confidentiality, integrity, and availability of its  information would be compromised and it had limited assurance that the  personal information it collected and used was adequately protected.
In this review, we found that NMB has fully transitioned its network  infrastructure and records management system into a cloud computing  environment as a result of federal initiatives aimed at improving, among  other things, the federal government’s operational efficiencies and overall  IT security posture. NMB also fully transitioned its financial systems to  third-party service providers. Specifically, NMB relies on other agencies’  systems, such as the Department of the Interior, for payroll, personnel,  and human resources services, and the Department of the Treasury’s  Bureau of the Fiscal Service for a full range of accounting services,  including hosting its financial management system.
In addition, NMB has begun to take steps to improve its information  security program. Specifically, NMB developed a policy for managing  agency information, documents, and records. The agency has also  drafted procedures for its new enterprise network that include provisions  for access and identity control, configuration management, planning,  contingency monitoring, and audits. Further, it has developed a procedure  for handling cyber incidents. Finally, it has an agreement in place with the  Bureau of the Fiscal Service to, among other things, conduct a security  assessment of its enterprise network.
However, NMB has not fully implemented most key information security  and privacy practices. (For additional details, see appendix II.) For  example, the agency does not have policies and procedures in place for  its information security program, including those for the oversight of third- party providers—entities that provide or manage information systems that  support NMB operations. In addition, NMB has not conducted the  required assessments of its third-party providers to ensure their systems  are in compliance with the Federal Information Security Modernization Act  (FISMA) of 2014. FISMA requires federal agencies to develop,  document, and implement an agency-wide information security program  to protect the information and information systems that support the  operations and assets of the agency, including those provided or  managed by another agency, contractor, or other source.
Moreover, NMB has not assessed whether its third-party providers’  systems were in compliance with the Privacy Act of 1974 and E- Government Act of 2002, which describe, among other things, agency  responsibilities with regard to protecting personally identifiable  information.
NMB officials said the agency is taking steps to address its remaining  information security and privacy issues. For example, because the  agency’s new enterprise network is now a cloud-based system, NMB  plans to use the Federal Risk and Authorization Management Program  (FedRAMP), to the extent possible, to guide the development of its  agency-wide policies and procedures, including how it will oversee its  third-party providers and ensure they are in compliance with FISMA. In  addition, NMB reached out to OMB in September 2015, and NMB officials  said they have tried reaching out to the Department of Homeland Security  (DHS) to ensure NMB is doing what is required to meet annual FISMA  reporting requirements. NMB officials said they have been receiving  information on FISMA from OMB, but not from DHS.
Further, NMB officials said they are working on drafting information  security program and privacy policies and procedures. They said that  finalizing the information security policies and procedures will assist the  agency in completing all of its required reviews in the future.
section_title: Developing a Strategic Workforce Plan
paragraphs: In our December 2013 report, we found that NMB’s human capital  program was not guided by a strategic workforce plan. Without workforce  planning, a key internal control, we concluded that agency management  could not ensure that skill needs would be continually assessed and that  the agency would be able to obtain and maintain a workforce with the  skills necessary to achieve organizational goals. Without a plan, the  agency could not monitor and evaluate the results of its workforce  planning efforts, including whether those efforts contributed to the agency  accomplishing its strategic goals.
In this review, we found NMB in October 2014 completed a strategic  workforce plan that at least partially addressed four of the five practices  from our December 2013 recommendation (see table 2).
While members of one of NMB’s advisory groups said they provided input  on some of the agency’s workforce decisions, our prior work suggests  that formally including stakeholders in the workforce planning process can  help the agency develop ways to streamline processes and improve  human capital strategies. In addition, NMB’s performance goals,  including those related to human capital, do not meet federal guidance.  Without performance goals that meet guidance or the inclusion of other  monitoring and evaluation efforts in its workforce and succession plan,  the agency is not positioned to measure the outcomes of its human  capital strategies or evaluate whether these strategies helped it  accomplish its goals.
section_title: Managing Rail Grievance Arbitration
paragraphs: In our December 2013 report, we found that NMB was struggling to  efficiently manage grievance cases in the rail industry and it lacked data  on the types of grievances filed to more efficiently manage the process.  As a result, we concluded that if NMB did not address this demand on its  limited resources, it could face a growing backlog of arbitration cases.
In this review, we found that NMB is collecting data on the type of  grievances filed for arbitration in some, but not all cases. An NMB official  said part of the reason the agency is not collecting complete data on  grievance types is because it does not have access to all cases. NMB  reviews all grievances filed for arbitration by either a railroad or union and  then forwards them to one of three types of adjustment boards—the  National Railroad Adjustment Board (NRAB), a Public Law Board, or a  Special Board of Adjustment. NMB is able to track information on the  type of grievances filed for arbitration by the Public Law Boards and  Special Boards of Adjustment because NMB requires parties to code their  grievance type when they file their request for these boards. Parties  filing grievances with NRAB, however, are not required by NMB to code  their grievance type, an NMB official said, because NRAB is an  independent organization that sets its own procedures and NMB cannot  require that grievance codes be included in requests for arbitration filed  with NRAB. However, NMB may be able to obtain that information  because NRAB officials told us they track information on grievance type  and are willing to share this information with NMB.
Even with data on types of grievances filed for all cases, it is not clear the  extent to which NMB would analyze them to address the arbitration  backlog. One program official said that NMB does not have a systematic  way to identify cases that may be good candidates for some type of  alternative to arbitration, such as grievance mediation, because staff  cannot easily access case information in a way that makes it readily  available for analysis. Analysis of these cases continues to be largely a  manual process that takes significant staff resources, he said. According  to an NMB information technologist, in the past, the agency has primarily  relied on staff to sort and analyze these data. However, the agency’s new  arbitration case management system, which it upgraded in November  2015, should be able to produce by spring 2016 standard electronic data  reports that would facilitate this analysis. Until those reports are available,  it appears NMB will have limited ability to analyze data that might help it  reduce its arbitration backlog, which, according to NMB, continues to  grow.
section_title: NMB Has Not Established Procurement Policies and Processes That Reflect Its New Procurement Environment
paragraphs: NMB is following key procurement practices in 2 of 3 areas that our prior  work on assessing the acquisition function at federal agencies identified  as promoting agencies’ efficient, effective, and accountable procurement  functions—organizational alignment and leadership; and knowledge and  information management. NMB, however, has not developed policies  and processes—a third area our prior work identified—that reflect its new  procurement interagency agreement. After the retirement of its only  contracting officer in January 2014, NMB entered into an interagency  agreement with the Department of the Treasury’s Bureau of the Fiscal  Service (Fiscal Service) for provision of certain procurement functions  that NMB had previously handled in-house.
In this new environment, NMB is continuing to align its procurement  function with its mission and ensure adequate resources to meet its  procurement needs, a key practice to facilitate efficient and effective  management of acquisition activities. Its Office of Administration is at an  organizational level comparable to other key mission offices, such as the  Office of Mediation and Alternative Dispute Resolution and the Office of  Arbitration. An NMB official told us that the agency also involves internal  stakeholders in acquisition decisions, including determining procurement  needs, reviewing existing contracts before automatically renewing them,  and justifying purchase requests. In addition, the agency entered into the  interagency agreement with the Fiscal Service in response to changes in  its workforce (i.e., the retirement of its contracting officer). Further, to  ensure NMB has a procurement workforce adequate to support the  organization’s needs, two staff are being trained as contracting officers  because not having a contracting officer is a risk to the agency, the NMB  official said. In addition, six NMB staff were trained and certified as  contracting officer representatives, who assist the contracting officer in  providing administration of contract actions under the interagency  agreement and evaluating performance.
NMB is also following a second key practice by establishing knowledge  and information tools to help it make well-informed procurement  decisions. NMB now has access to electronic data on purchase requests  from the procurement and financial management systems administered  by Fiscal Service. Fiscal Service also provides NMB with monthly billing  reconciliations and weekly updates on the status of its contracts. A NMB  official said that the information received from Fiscal Service has helped  the agency analyze and adjust its spending and, as a result, NMB has  eliminated contracts for items it no longer needs, such as storage space,  copiers, and periodical subscriptions.
However, NMB is not following an element of a third key practice—to  have policies and processes in place consistent with internal control  standards and best practice. NMB has not developed written internal  policies and processes that reflect its new interagency agreement  procurement environment. The NMB procurement official said the agency  does not have current policies and processes because some of the  previous policies and procedures were lost in the transition which  occurred when the previous contracting officer retired. As a result, the  agency has had to recreate them, the official said. The agency’s fiscal  year 2014 to 2019 strategic plan (as amended in fiscal year 2015) called  for procurement processes to be updated by the end of fiscal year 2014 in  light of the new procurement environment. Developing and implementing  written procurement policies and processes that reflect NMB’s current  procurement environment could help ensure its staff use consistent  processes under this new environment.
section_title: Conclusions
paragraphs: Since we made our recommendations in December 2013, NMB has taken  several positive steps in response, such as developing strategic and  workforce plans and closing a long-standing deficiency in a financial  statement audit. However, additional actions are needed to fully respond  to those recommendations. For example, NMB’s performance goals do  not yet meet all federal guidance. As a result, the agency is not positioned  to track and publicly report progress or results in its program areas. In the  areas of strategic planning and information security and privacy, officials  were not able to provide the written policies and procedures that guide  their actions, consistent with standards for internal control. Without fully  implementing these recommendations, NMB cannot ensure that its limited  resources are effectively targeted toward its highest priorities. Moreover,  it may be missing opportunities to improve performance and mitigate risks  in its program and management areas. In addition, NMB has not  developed written policies and procedures that reflect its new  procurement environment under its interagency agreement. Without  written policies and processes—as called for by internal control standards  and best practice—NMB cannot ensure the use of consistent  procurement processes.
We continue to believe, as suggested in our December 2013 report, that  Congress should consider authorizing an appropriate federal agency’s  Office of Inspector General to provide independent audit and investigative  oversight of NMB.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Chairman of the National Mediation Board  develop and implement written policies and processes to reflect the  agency’s current procurement environment.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to the National Mediation Board (NMB)  for comment. The agency provided written comments, which are  reproduced in their entirety in appendix III. We also shared a draft with  the Office of Management and Budget (OMB) and Office of Personnel  Management (OPM). Neither agency provided comments.
NMB commented that many of the areas we had concerns about are not  under its direct control considering that NMB has entered into interagency  agreements for certain services with the Department of the Interior and  the Department of the Treasury’s Bureau of the Fiscal Service (Fiscal  Service). We continue to believe, however, that NMB must retain ultimate  control and responsibility for all its programs and data, regardless of  which agencies are to perform the services. For example, with regard to  our findings related to information security, NMB commented that it will  develop standard operating procedures for reviewing audits conducted by  its third-party providers, but that it does not have the resources to conduct  its own audits of those contracted agencies. Under FISMA, however,  NMB is responsible for developing, documenting, and implementing a  security program to protect its information systems and data, including  those managed by another agency, contractor, or other source. We  believe that developing procedures for reviewing audits conducted by  third-party providers will be a positive step toward ensuring that NMB is  conducting this required oversight.
NMB agreed with our recommendation to develop and implement policies  and processes to reflect the agency’s current procurement environment  and indicated it is taking steps to do so. NMB also commented that  because it does not manage all of its own procurements, its policies and  processes would be largely subordinate to those of the Fiscal Service.  However, because NMB’s interagency agreement with the Fiscal Service  for performance of certain procurement functions does not absolve NMB  of its responsibility to develop policies and processes as called for by  internal control standards and best practice, NMB must develop its own  set of complementary policies and processes to ensure the agency meets  its needs through efficient, effective, and accountable procurement  functions.
In terms of its response to audits, NMB commented that all program audit  findings have been addressed and that there are no outstanding issues  related to any audits. While we recognized in the report that NMB  resolved a long-standing, significant deficiency in its fiscal year 2015  financial statement audit, we disagree that all audit issues have been  resolved. NMB needs to develop policies and procedures to address  findings from all audits, not solely those reported in the financial  statement audit report.
NMB also commented that some of our concerns appeared to be related  to the agency’s failure to sufficiently document its processes and that this  was not necessarily an indication of noncompliance with any particular  requirement. We agree that NMB has made strides in certain areas, such  as developing strategic and workforce plans, but its actions are not in  accordance with federal guidance or federal internal control standards in  some areas. For example, in the areas of strategic planning, information  security and privacy, and procurement, officials were not able to provide  the written policies and procedures that guide their actions. We continue  to believe it is important for NMB to create this documentation to ensure  future consistency and success in its management and program areas.
Finally, NMB commented it had concerns that we continued to assert the  agency did not adequately consult with its stakeholders even though we  noted several times in the report that stakeholders told us they had input  and were satisfied with their overall communication with the agency.  Stakeholder groups did tell us they had good communication with NMB,  particularly with regard to the agency’s strategic planning. However, in the  development of its workforce plan, NMB officials said that they did not  specifically solicit stakeholder input, and the agency’s workforce and  succession plan does not address collecting and incorporating feedback  from stakeholders. As our prior work suggests, it will be important for  NMB to formally include stakeholders in this process in the future  because involving stakeholders can help the agency develop ways to  streamline processes and improve human capital strategies.
We are sending copies of this report to the Chairman of NMB and  appropriate congressional committees. In addition, the report is available  at no charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-7215 or brownbarnesc@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The FAA Modernization and Reform Act of 2012 included a provision for  us to evaluate and audit the programs, operations, and activities of the  National Mediation Board (NMB) every 2 years. Our first report was  issued in December 2013. This is the second review of NMB and this  report examines the extent to which NMB:  1.  has implemented each of our December 2013 recommendations, and  2.  has incorporated key procurement practices.
To address our research objectives, we reviewed key NMB documents  and compared those documents with relevant federal laws, regulations,  guidance, and related leading practices identified in our previous work  (see table 3).
We interviewed NMB officials and current board members. In addition, we  interviewed key stakeholders who were interviewed for the December  2013 report, among others. Specifically, we interviewed representatives  from key rail and air management and labor groups including Airlines for  America, National Railway Labor Conference, AFL-CIO Transportation  Trades Department and affiliated rail and air unions, and the International  Brotherhood of Teamsters. Further, we interviewed representatives from  the National Association of Railroad Referees, an association  representing railroad arbitrators; the Dunlop II Committee, an informal  NMB advisory group; and the National Railroad Adjustment Board, which  hears rail grievance arbitration cases. The results of these interviews are  not generalizable to all NMB stakeholders. Finally, we interviewed  officials at the Office of Management and Budget and the Office of  Personnel Management to determine how these agencies provide  oversight and guidance to NMB.
In addition, we reviewed NMB procurement data. Specifically, we  reviewed data provided by the Department of the Treasury’s Bureau of  the Fiscal Service on NMB’s fiscal year 2014 and 2015 contract actions.  We assessed the reliability of data from the Bureau of the Fiscal Service  and NMB’s fiscal year 2013 through 2015 financial statement audit  reports by interviewing knowledgeable officials and reviewing relevant  documents. We determined that these data were sufficiently reliable for  our purposes.
We conducted this performance audit from April 2015 to February 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Extent to Which the National Mediation Board (NMB) Is Following Key Practices for Information Security and Privacy
subsections: section_title: Practice Information Security Practices Periodic risk assessments
paragraphs: Example of NMB’s status   NMB has not conducted risk assessments of its new enterprise  network and financial management systems.
Partially following  NMB developed a policy for managing agency information,  documents, and records in May 2013. In addition, it drafted  procedures for its new enterprise network that include provisions  for access and identity control, configuration management,  planning, contingency monitoring, and audits. However, NMB has  not developed agency-wide policies and procedures that govern  its information security program, including policies and procedures  for the oversight of third-party providers.
Partially following  NMB has drafted a security plan for its new enterprise network  dated May 2014. However, NMB has not developed a security  plan for its new financial management systems.
NMB stated its staff was provided security awareness training  during 2015. However, NMB did not provide evidence to support  that all employees and contractors had received the training.
Partially following  NMB conducted an initial review of its new enterprise network in  May 2014. NMB stated its new financial management systems  were reviewed in September 2014. However, NMB was unable to  provide evidence to support the review.
Partially following  NMB has not established and documented a remedial action  process for its information security control weaknesses. NMB has  not formally documented and tracked its preliminary plan of  actions for its new enterprise network and has not included  required attributes, such as milestones and scheduled completion  dates. In addition, NMB has not yet begun formally documenting  and tracking any information security control weaknesses which  have been identified through other reviews (e.g., GAO).
Partially following  NMB has developed a procedure for handling cyber incidents.
However, there are no indicators of date, review and approval. In  addition, the procedure does not include required actions, such as  mitigating risks associated with incidents before substantial  damage is done, and notifying and consulting with the federal  information security incident center.
NMB has not established and maintained up-to-date continuity of  operations plans and procedures for its information systems.  Specifically, its continuity of operations plan has not been updated  since June 2011 and does not reflect the current information  technology environment.
NMB has designated its Assistant Chief of Staff as its senior  agency official for privacy.
Example of NMB’s status   NMB does not have policies and procedures for privacy  protections.
NMB has not conducted a privacy impact assessment for its  financial management systems, which contain personally  identifiable information.
NMB did not issue system of records notice for its financial  management systems.
section_title: Appendix III: Comments from the National Mediation Board
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Cindy Brown Barnes, (202) 512-7215, brownbarnesc@gao.gov.
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Clarita Mrena (Assistant  Director), Amy Anderson (analyst in charge), Benjamin L. Sponholtz,  Shirley Abel, Marie Ahearn, James Rebbe, Shaunyce Wallace, and  Candice Wright made significant contributions to this report. In addition,  key support was provided by James Bennett, Rachael Chamberlin, Susan  Chin, David Chrisinger, Larry Crosland, Karin Fangman, Maria Gaona,  Gretta Goodwin, Christopher Jones, Julia Kennon, Jason Kirwan, Kathy  Leslie, Benjamin Licht, Steven Lozano, Monica Perez-Nelson, and Walter  Vance.